@exposify/next 0.0.4 → 0.0.6

package/README.md

@@ -184,7 +184,11 @@ route reads `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
 name them, or `supabase: false` to turn it off. The dashboard shows what was
 found and has the switch for passwords. `inspect` says which way it went and
 why; `npx @exposify/next test-sign-in` signs in on your running app and checks
-a protected page accepts the cookie. `@supabase/auth-helpers-nextjs` (an
+a protected page accepts the cookie. If your `proxy.ts` sends signed-out
+visitors to the login page (Supabase's starter does), it would send AI
+assistants there too, before they can sign in: `inspect` warns, and
+`setup --apply` leaves `/mcp` out of its matcher. Your pages still go through
+it on tool calls. `@supabase/auth-helpers-nextjs` (an
 older cookie format) isn't supported, and apps on `@supabase/supabase-js`
 alone keep their session in the browser, where the server never sees it.
 

package/dist/exposify-next.js

@@ -2296,8 +2296,8 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
 import { createInterface } from "readline";
 
 // bin/adapter.ts
-import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname4, join as join9, relative as relative3, resolve as resolve2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname4, join as join10, relative as relative3, resolve as resolve2 } from "path";
 import { decideExposure, deriveDescription, resolveOptions, toolNames } from "@exposify/core";
 import { renderConfig, replaceAiReadyOptions } from "@exposify/cli";
 
@@ -2646,13 +2646,134 @@ function scanActions(d, call, root, notes, suggestions = []) {
   return rows;
 }
 
+// bin/proxy.ts
+import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
+import { join as join9 } from "path";
+var FILES = ["", "src/"].flatMap((dir) => ["proxy", "middleware"].flatMap((name) => [".ts", ".js", ".mjs"].map((ext) => `${dir}${name}${ext}`)));
+var REDIRECT = /\bredirect\s*\(/;
+function matcherRegExp(pattern) {
+  let re = "";
+  for (let i = 0; i < pattern.length; ) {
+    const c = pattern[i];
+    if (c === "(") {
+      let depth = 0;
+      let j = i;
+      for (; j < pattern.length; j++) {
+        if (pattern[j] === "\\") j++;
+        else if (pattern[j] === "(") depth++;
+        else if (pattern[j] === ")" && --depth === 0) break;
+      }
+      re += pattern.slice(i, j + 1);
+      i = j + 1;
+    } else if (c === "/" && pattern[i + 1] === ":") {
+      const m = /^\/:\w+([*+?]?)/.exec(pattern.slice(i));
+      re += m[1] === "*" ? "(?:/.*)?" : m[1] === "+" ? "/.+" : m[1] === "?" ? "(?:/[^/]+)?" : "/[^/]+";
+      i += m[0].length;
+    } else {
+      re += c.replace(/[.*+?^${}|[\]\\]/g, "\\$&");
+      i++;
+    }
+  }
+  try {
+    return new RegExp(`^${re}/?$`);
+  } catch {
+    return void 0;
+  }
+}
+function matcherNode(program) {
+  for (const n of program.body) {
+    const decl = n.type === "ExportNamedDeclaration" ? n.declaration : void 0;
+    if (decl?.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations) {
+      if (d.id?.name !== "config") continue;
+      const obj = unwrapTs(d.init);
+      if (obj?.type !== "ObjectExpression") return "opaque";
+      const prop2 = obj.properties.find((p) => p.type === "ObjectProperty" && (p.key?.name ?? p.key?.value) === "matcher");
+      return prop2 ? unwrapTs(prop2.value) ?? "opaque" : null;
+    }
+  }
+  return null;
+}
+function matcherEntries(node) {
+  const items = node.type === "ArrayExpression" ? node.elements : [node];
+  const out = [];
+  for (const item of items) {
+    const literal = item?.type === "ObjectExpression" ? unwrapTs(item.properties.find((p) => (p.key?.name ?? p.key?.value) === "source")?.value) : item;
+    const pattern = stringValue(literal);
+    if (pattern === void 0 || !literal) return void 0;
+    out.push({ pattern, node: literal });
+  }
+  return out;
+}
+function redirects(root, file, source, program) {
+  if (REDIRECT.test(source)) return true;
+  const load = moduleLoader(root);
+  for (const n of program.body) {
+    if (n.type !== "ImportDeclaration") continue;
+    const found = load(n.source.value, file);
+    if (found && REDIRECT.test(found.source)) return true;
+  }
+  return false;
+}
+function middlewareFile(root) {
+  return FILES.find((f) => existsSync4(join9(root, f)));
+}
+function findProxyGate(root, mcpPath = "/mcp") {
+  const file = middlewareFile(root);
+  if (!file) return void 0;
+  const source = readFileSync9(join9(root, file), "utf8");
+  const program = parseModule(source, file);
+  if (!program || !redirects(root, file, source, program)) return void 0;
+  const matcher = matcherNode(program);
+  if (matcher === "opaque") return void 0;
+  if (matcher === null) return { file, mcpPath, matching: [] };
+  const entries = matcherEntries(matcher);
+  if (!entries) return void 0;
+  const probes = [mcpPath, `${mcpPath.replace(/\/$/, "")}/login`];
+  const matching = entries.filter((e) => probes.some((p) => matcherRegExp(e.pattern)?.test(p))).map((e) => e.pattern);
+  return matching.length > 0 ? { file, mcpPath, matching } : void 0;
+}
+function proxyGateHint(gate) {
+  return `${gate.file} sends signed-out requests to another page and runs on ${gate.mcpPath}, so AI assistants get that page instead of a sign-in. Leave ${gate.mcpPath} out of its matcher (the MCP route checks its own callers): ` + (gate.matching.some((p) => p.startsWith("/((?!")) ? `add ${exclusion(gate.mcpPath)}| after "(?!" in config.matcher.` : `matcher: ["/((?!${exclusion(gate.mcpPath)}).*)"].`);
+}
+var exclusion = (mcpPath) => `${mcpPath.replace(/^\/+|\/+$/g, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|$)`;
+var inSource = (mcpPath) => exclusion(mcpPath).replace(/\\/g, "\\\\");
+function excludeMcpFromProxy(root, gate) {
+  const file = join9(root, gate.file);
+  const before = readFileSync9(file, "utf8");
+  const program = parseModule(before, gate.file);
+  if (!program) return { blocked: `couldn't parse ${gate.file}` };
+  const summary = `Leave ${gate.mcpPath} out of ${gate.file}'s matcher, so AI assistants reach the sign-in instead of your login page`;
+  const matcher = matcherNode(program);
+  if (matcher === null) {
+    const after2 = `${before.replace(/\n*$/, "\n")}
+export const config = {
+  matcher: ["/((?!${inSource(gate.mcpPath)}).*)"],
+};
+`;
+    return { plan: { file, summary, before, after: after2 } };
+  }
+  const entries = matcher === "opaque" ? void 0 : matcherEntries(matcher);
+  if (!entries) return { blocked: `${gate.file}'s matcher isn't a list of strings` };
+  let after = before;
+  for (const e of [...entries].reverse()) {
+    if (!gate.matching.includes(e.pattern)) continue;
+    const raw = before.slice(e.node.start, e.node.end);
+    const at = raw.indexOf("/((?!");
+    if (at < 0) return { blocked: `${gate.file}'s matcher "${e.pattern}" has no "(?!" to add ${gate.mcpPath} to` };
+    const insert = e.node.start + at + "/((?!".length;
+    after = `${after.slice(0, insert)}${inSource(gate.mcpPath)}|${after.slice(insert)}`;
+  }
+  return { plan: { file, summary, before, after } };
+}
+
 // bin/adapter.ts
 var MCP_ROUTE_DIR = "mcp/[[...transport]]";
 function isNextProject(dir) {
   try {
-    const pkg = JSON.parse(readFileSync9(join9(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync10(join10(dir, "package.json"), "utf8"));
     const hasNext = Boolean(pkg.dependencies?.next ?? pkg.devDependencies?.next);
-    return hasNext && ["app", "src/app", "pages", "src/pages"].some((d) => existsSync4(join9(dir, d)));
+    return hasNext && ["app", "src/app", "pages", "src/pages"].some((d) => existsSync5(join10(dir, d)));
   } catch {
     return false;
   }
@@ -2667,6 +2788,10 @@ var nextAdapter = {
   bin: "npx @exposify/next",
   entryExample: "apps/web",
   entryHelp: "The Next.js project directory",
+  commands: [
+    ["generate", "Write exposify.generated.ts (withExposify() in next.config does it on dev and build)"],
+    ["test-sign-in", "Check, on your running app, that the Supabase session Connect sends signs you in"]
+  ],
   locate(cwd, entryFlag) {
     const root = findNextRoot(entryFlag ? resolve2(cwd, entryFlag) : cwd);
     return root ? { entry: root, root, via: "package.json" } : void 0;
@@ -2697,26 +2822,25 @@ ${block}
     if (stubs.some((s) => s.includes("TODO(exposify)"))) {
       lines.push("Go through the TODO(exposify) lines: an action whose input is still incomplete stays hidden until you write it out.");
     }
-    if (!hasWithExposify(root)) {
-      lines.push(
-        'Wrap your next.config export: `export default withExposify(nextConfig)`, imported from "@exposify/next/config". It keeps exposify.generated.ts current on `next dev` and `next build`.'
-      );
-    }
-    const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join9(root, f)).find((f) => existsSync4(f));
+    const wrap = hasWithExposify(root) ? null : wrapNextConfig(root);
+    const also = wrap && "plan" in wrap ? [{ plan: wrap.plan, manual: WRAP_HINT }] : [];
+    if (wrap && !("plan" in wrap)) lines.push(WRAP_HINT);
+    const gate = findProxyGate(root, d.mcpPath ?? "/mcp");
+    const unblock = gate ? excludeMcpFromProxy(root, gate) : null;
+    if (gate && unblock && "plan" in unblock) also.push({ plan: unblock.plan, manual: proxyGateHint(gate) });
+    else if (gate) lines.push(proxyGateHint(gate));
+    const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join10(root, f)).find((f) => existsSync5(f));
     const manifestFile = existing ?? generate(root, {}, () => {
     }).file;
     const generated = relative3(root, manifestFile);
     if (result.aiReady?.site) {
       const file = relative3(root, result.aiReady.site.file);
       if (usesZod) lines.push('The input stubs use zod: `import { z } from "zod";` in that file, if it isn\'t there.');
-      return {
-        code: options,
-        hint: { lines: [`Replace the aiReady(...) call in ${file}:${result.aiReady.site.line} with this.`, ...lines] },
-        apply: applyReplace(result.aiReady.site, config, entries, usesZod, file)
-      };
+      const apply = withAlso(applyReplace(result.aiReady.site, config, entries, usesZod, file), also, lines);
+      return { code: options, hint: { lines: [`Replace the aiReady(...) call in ${file}:${result.aiReady.site.line} with this.`, ...lines] }, apply };
     }
     const routeFile = `${d.appDir ?? "app"}/${MCP_ROUTE_DIR}/route.${generated.endsWith(".ts") ? "ts" : "js"}`;
-    const manifestImport = relative3(join9(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
+    const manifestImport = relative3(join10(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
     const code = [
       'import { aiReady } from "@exposify/next";',
       ...usesZod ? ['import { z } from "zod";'] : [],
@@ -2728,16 +2852,50 @@ ${block}
     ].join("\n");
     return {
       code,
-      apply: { plan: { file: join9(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
-` } },
+      apply: { plan: { file: join10(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
+` }, ...also.length ? { also } : {} },
       hint: { lines: [`Create ${routeFile} with this (agents connect to /mcp). It imports ${generated}${existing ? "" : ", written just now"}.`, ...lines] }
     };
   }
 };
+var WRAP_HINT = 'Wrap your next.config export: `export default withExposify(nextConfig)`, imported from "@exposify/next/config". It keeps exposify.generated.ts current on `next dev` and `next build`.';
+var NEXT_CONFIGS = ["next.config.ts", "next.config.mjs", "next.config.js", "next.config.cjs", "next.config.mts"];
+function withAlso(outcome, also, lines) {
+  if ("plan" in outcome) return also.length ? { ...outcome, also } : outcome;
+  lines.push(...also.map((a) => a.manual));
+  return outcome;
+}
+function wrapNextConfig(root) {
+  const name = NEXT_CONFIGS.find((n) => existsSync5(join10(root, n)));
+  if (!name) return { blocked: "no next.config file" };
+  const file = join10(root, name);
+  const before = readFileSync10(file, "utf8");
+  const program = parseModule(before, name);
+  if (!program) return { blocked: `couldn't parse ${name}` };
+  const body = program.body;
+  const esm = body.find((n) => n.type === "ExportDefaultDeclaration");
+  const cjs = body.find((n) => {
+    const e = n.type === "ExpressionStatement" ? unwrapTs(n.expression) : void 0;
+    return e?.type === "AssignmentExpression" && e.left?.type === "MemberExpression" && e.left.object?.name === "module" && e.left.property?.name === "exports";
+  });
+  const value = esm ? esm.declaration : cjs ? unwrapTs(cjs.expression)?.right : void 0;
+  if (!value || value.start == null || value.end == null || /Declaration$/.test(value.type)) return { blocked: `couldn't find the config ${name} exports` };
+  const wrapped = `${before.slice(0, value.start)}withExposify(${before.slice(value.start, value.end)})${before.slice(value.end)}`;
+  const imports = body.filter((n) => n.type === "ImportDeclaration" || n.type === "VariableDeclaration" && /require\(/.test(before.slice(n.start, n.end)));
+  const at = imports.length ? imports.at(-1).end : 0;
+  const last = at ? before.slice(imports.at(-1).start, at) : "";
+  const q = /'/.test(last) ? "'" : '"';
+  const semi = !last || last.trimEnd().endsWith(";") ? ";" : "";
+  const line = esm ? `import { withExposify } from ${q}@exposify/next/config${q}${semi}` : `const { withExposify } = require(${q}@exposify/next/config${q})${semi}`;
+  const after = at ? `${wrapped.slice(0, at)}
+${line}${wrapped.slice(at)}` : `${line}
+${wrapped}`;
+  return { plan: { file, summary: `Wrap ${name}'s export in withExposify()`, before, after } };
+}
 function hasWithExposify(root) {
-  for (const name of ["next.config.ts", "next.config.mjs", "next.config.js", "next.config.cjs", "next.config.mts"]) {
+  for (const name of NEXT_CONFIGS) {
     try {
-      if (readFileSync9(join9(root, name), "utf8").includes("withExposify")) return true;
+      if (readFileSync10(join10(root, name), "utf8").includes("withExposify")) return true;
     } catch {
     }
   }
@@ -2752,13 +2910,21 @@ function scanProject(root) {
   const notes = [];
   const descriptions = readDescriptions(root, (m) => notes.push(m));
   const rows = [];
+  const callbacks = new Set(d.supabase?.choice.callbacks ?? []);
   for (const r of d.routes) {
     if (r.router === "app") {
+      const callback = callbacks.has(r.file);
       for (const method of r.module.methods.filter((m) => m !== "OPTIONS")) {
         const m = r.module.markers[method];
         const marker = m ? m.kind === "described" ? { kind: "described", ...m.name ? { name: m.name } : {}, ...m.description ? { description: m.description } : {} } : { kind: m.kind } : void 0;
         const source = r.module.sources[method];
-        rows.push({ info: { method, path: r.path, params: r.params, ...marker ? { marker } : {} }, ...m?.name ? { describedName: m.name } : {}, ...m?.description ? { describedText: m.description } : {}, ...source ? { source } : {} });
+        rows.push({
+          info: { method, path: r.path, params: r.params, ...marker ? { marker } : {}, ...callback ? { optIn: true } : {} },
+          ...m?.name ? { describedName: m.name } : {},
+          ...m?.description ? { describedText: m.description } : {},
+          ...source ? { source } : {},
+          ...callback ? { callback: true } : {}
+        });
       }
       continue;
     }
@@ -2776,7 +2942,7 @@ function scanProject(root) {
   for (const p of d.pages) {
     let source;
     try {
-      source = readFileSync9(join9(root, p.file), "utf8");
+      source = readFileSync10(join10(root, p.file), "utf8");
     } catch {
       source = void 0;
     }
@@ -2803,6 +2969,8 @@ function scanProject(root) {
   for (const row of rows) if (row.page && row.describedName) names.set(`GET ${row.info.path}`, row.describedName);
   const suggestions = [];
   const actions = scanActions(d, call, root, notes, suggestions);
+  const gate = findProxyGate(root, d.mcpPath ?? "/mcp");
+  if (gate) notes.push(`${proxyGateHint(gate)} setup --apply can make this change.`);
   const routes = rows.map((row) => {
     const key = `${row.info.method} ${row.info.path}`;
     const decision = exposure.get(key);
@@ -2817,8 +2985,9 @@ function scanProject(root) {
       tool: names.get(key),
       ...derived ? { derived } : {},
       exposed: decision.exposed,
-      reason: row.formOnly && !decision.exposed ? `a page that's just a form posting to a Server Action (the action is the tool); list "GET ${row.info.path}" in expose to read it anyway` : row.page && decision.exposed ? "a page: read like a browser reads it" : decision.reason,
+      reason: row.formOnly && !decision.exposed ? `a page that's just a form posting to a Server Action (the action is the tool); list "GET ${row.info.path}" in expose to read it anyway` : row.callback && !decision.exposed ? `finishes a Supabase sign-in from an email link or a redirect, which an agent has no use for; list "${key}" in expose to make it a tool anyway` : row.page && decision.exposed ? "a page: read like a browser reads it" : decision.reason,
       ...row.info.optIn ? { optIn: true } : {},
+      ...row.formOnly || row.callback ? { offByDefault: true } : {},
       ...row.page ? { kind: "page" } : {},
       ...row.source ? { source: row.source } : {}
     };
@@ -2844,7 +3013,7 @@ function scanProject(root) {
     } : {},
     ...call && d.mcpRoute ? {
       aiReady: {
-        site: { file: join9(root, d.mcpRoute.file), line: call.line },
+        site: { file: join10(root, d.mcpRoute.file), line: call.line },
         options: {
           ...call.expose ? { expose: call.expose } : {},
           ...call.exclude ? { exclude: call.exclude } : {},
@@ -2858,7 +3027,7 @@ function scanProject(root) {
 }
 function applyReplace(site, config, entries, usesZod, relFile) {
   try {
-    const before = readFileSync9(site.file, "utf8");
+    const before = readFileSync10(site.file, "utf8");
     const edit = replaceAiReadyOptions({
       source: before,
       file: site.file,
@@ -2877,8 +3046,8 @@ function applyReplace(site, config, entries, usesZod, relFile) {
 }
 
 // bin/test-sign-in.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join10 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join11 } from "path";
 import { parseEnv } from "util";
 import { supabaseCookieName, supabasePasswordLogin, supabaseSessionCookies } from "@exposify/core";
 var TEST_SIGN_IN_USAGE = `Usage: @exposify/next test-sign-in [options]
@@ -2886,10 +3055,13 @@ var TEST_SIGN_IN_USAGE = `Usage: @exposify/next test-sign-in [options]
 Signs in to your app's Supabase Auth as AI assistants will (a password, then
 the authenticator code if you have one), and checks that a page your app
 protects accepts the session cookie Connect sends. Run it with your app up.
+With no page that turns signed-out visitors away, it looks for one that
+shows your email once signed in.
 
 Options:
   --url <origin>   Where the app runs (default: http://localhost:3000)
-  --page <path>    A page that redirects signed-out visitors (default: found)
+  --page <path>    A page that redirects signed-out visitors, or shows
+                   who's signed in (default: found)
   --entry <path>   The Next.js project directory (default: detected)
 
 Reads NEXT_PUBLIC_SUPABASE_URL and the publishable (or anon) key from the
@@ -2897,7 +3069,7 @@ environment, .env.local or .env. Signs the test session out afterwards.`;
 function supabaseEnv(root, env) {
   const files = [".env.local", ".env"].map((f) => {
     try {
-      return parseEnv(readFileSync10(join10(root, f), "utf8"));
+      return parseEnv(readFileSync11(join11(root, f), "utf8"));
     } catch {
       return {};
     }
@@ -2920,36 +3092,27 @@ async function testSignIn(root, opts, deps) {
     return 1;
   }
   const origin = opts.url.replace(/\/+$/, "");
-  const get = (path, cookie) => deps.fetch(`${origin}${path}`, { headers: cookie ? { cookie } : {}, redirect: "manual" }).catch(() => null);
-  let page = opts.page;
-  if (!page) {
-    const skip = new Set(d.supabase.choice.loginPages ?? []);
-    const candidates2 = d.pages.filter((p) => p.params.length === 0 && !skip.has(p.path) && !p.path.startsWith(d.mcpPath ?? "/mcp")).slice(0, 15);
-    for (const p of candidates2) {
-      const res2 = await get(p.path);
-      if (res2 === null) {
-        deps.log(`Couldn't reach ${origin}. Start your app (next dev), or pass --url.`);
-        return 1;
-      }
-      if (redirected(res2)) {
-        page = p.path;
-        break;
-      }
-    }
-    if (!page) {
-      deps.log("No page turned a signed-out request away, so there's nothing to check the session against. Pass --page with one that does.");
-      return 1;
-    }
-  } else {
-    const res2 = await get(page);
-    if (res2 === null) {
+  const get = (path, cookie2) => deps.fetch(`${origin}${path}`, { headers: cookie2 ? { cookie: cookie2 } : {}, redirect: "manual" }).catch(() => null);
+  let page;
+  const open = [];
+  const candidates2 = opts.page ? [opts.page] : d.pages.filter((p) => p.params.length === 0 && !(d.supabase.choice.loginPages ?? []).includes(p.path) && !p.path.startsWith(d.mcpPath ?? "/mcp")).slice(0, 15).map((p) => p.path);
+  for (const path of candidates2) {
+    const res = await get(path);
+    if (res === null) {
       deps.log(`Couldn't reach ${origin}. Start your app (next dev), or pass --url.`);
       return 1;
     }
-    if (!redirected(res2)) {
-      deps.log(`${page} answered ${res2.status} without signing in, so it can't tell whether the session works. Pass --page with a page that redirects signed-out visitors.`);
-      return 1;
+    if (redirected(res)) {
+      page = path;
+      break;
     }
+    if (res.ok) open.push({ path, body: await res.text() });
+  }
+  if (!page && open.length === 0) {
+    deps.log(
+      opts.page ? `${opts.page} answered with an error without signing in, so it can't tell whether the session works. Pass --page with a page that redirects signed-out visitors or shows who's signed in.` : "No page answered a signed-out request, so there's nothing to check the session against. Pass --page with one that redirects signed-out visitors or shows who's signed in."
+    );
+    return 1;
   }
   const login = supabasePasswordLogin({ ...project, fetch: deps.fetch });
   const ctx = { origin };
@@ -2967,13 +3130,31 @@ async function testSignIn(root, opts, deps) {
   const session = result.session.supabase;
   const name = d.supabase.choice.cookieName ?? supabaseCookieName(project.url);
   const cookies = supabaseSessionCookies(name, session);
-  const res = await get(page, cookies.map((c) => `${c.name}=${c.value}`).join("; "));
-  await deps.fetch(`${project.url.replace(/\/+$/, "")}/auth/v1/logout?scope=local`, { method: "POST", headers: { apikey: project.key, authorization: `Bearer ${session.accessToken}` } }).catch(() => null);
-  if (res && res.status >= 200 && res.status < 300) {
-    deps.log(`\u2713 ${page} answered ${res.status} with the session cookie Connect sends (${cookies.length === 1 ? name : `${name}.0\u2013.${cookies.length - 1}`}), and turned you away without it.`);
-    return 0;
+  const cookie = cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+  const cookieLabel = cookies.length === 1 ? name : `${name}.0\u2013.${cookies.length - 1}`;
+  let ok = false;
+  if (page) {
+    const res = await get(page, cookie);
+    ok = Boolean(res && res.status >= 200 && res.status < 300);
+    if (ok) deps.log(`\u2713 ${page} answered ${res.status} with the session cookie Connect sends (${cookieLabel}), and turned you away without it.`);
+    else deps.log(`\u2717 ${page} answered ${res?.status ?? "nothing"} with the session cookie${res?.headers.get("location") ? ` (to ${res.headers.get("location")})` : ""}: your app didn't accept it.`);
+  } else {
+    const shown = (typeof session.user?.email === "string" ? session.user.email : email).toLowerCase();
+    for (const p of open.filter((o) => !o.body.toLowerCase().includes(shown))) {
+      const res = await get(p.path, cookie);
+      if (res?.ok && (await res.text()).toLowerCase().includes(shown)) {
+        deps.log(`\u2713 ${p.path} showed ${shown} with the session cookie Connect sends (${cookieLabel}), and didn't without it.`);
+        ok = true;
+        break;
+      }
+    }
+    if (!ok) {
+      deps.log(`\u2717 No page turns signed-out visitors away, and none of ${open.map((o) => o.path).join(", ")} showed ${shown} with the session cookie: your app may not have accepted it.`);
+      deps.log("  Pass --page with a page that redirects signed-out visitors or shows who's signed in, to check against it.");
+    }
   }
-  deps.log(`\u2717 ${page} answered ${res?.status ?? "nothing"} with the session cookie${res?.headers.get("location") ? ` (to ${res.headers.get("location")})` : ""}: your app didn't accept it.`);
+  await deps.fetch(`${project.url.replace(/\/+$/, "")}/auth/v1/logout?scope=local`, { method: "POST", headers: { apikey: project.key, authorization: `Bearer ${session.accessToken}` } }).catch(() => null);
+  if (ok) return 0;
   if (d.supabase.choice.cookieName === void 0) deps.log(`  It was named ${name}. If your app sets another cookie name, the generator didn't see it.`);
   return 1;
 }

package/dist/index.cjs

@@ -444,9 +444,58 @@ function tokenize(html) {
   if (last < html.length) out.push(html.slice(last));
   return out;
 }
+function divEnd(html, from) {
+  const re = /<div\b(?:[^>"']|"[^"]*"|'[^']*')*>|<\/div\s*>/gi;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][1] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function boundaryEnd(html, from) {
+  const re = /<!--\$[?!]?-->|<!--\/\$-->/g;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][4] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function resolveStreamed(html) {
+  const chunks = [];
+  const open = /<div\s+hidden(?:="")?\s+id="S:([0-9a-f]+)"\s*>/g;
+  let out = "";
+  let last = 0;
+  for (let m = open.exec(html); m; m = open.exec(html)) {
+    const end = divEnd(html, open.lastIndex);
+    chunks.push({ id: m[1], content: html.slice(open.lastIndex, end).replace(/<\/div\s*>$/i, "") });
+    out += html.slice(last, m.index);
+    last = end;
+    open.lastIndex = end;
+  }
+  if (chunks.length === 0) return html;
+  out += html.slice(last);
+  for (let moved = true; moved; ) {
+    moved = false;
+    for (const c of chunks) {
+      const marker = `<template id="B:${c.id}"></template>`;
+      const at = out.indexOf(marker);
+      if (at < 0) continue;
+      const inBoundary = out.slice(Math.max(0, at - 9), at) === "<!--$?-->";
+      const start = inBoundary ? at - 9 : at;
+      const end = inBoundary ? boundaryEnd(out, at) : at + marker.length;
+      out = out.slice(0, start) + c.content + out.slice(end);
+      moved = true;
+    }
+  }
+  return out;
+}
 var hidden = (t) => "hidden" in t.attrs || t.attrs["aria-hidden"] === "true" || /display\s*:\s*none|visibility\s*:\s*hidden/i.test(t.attrs.style ?? "") || t.name === "input" && t.attrs.type === "hidden";
 function htmlToText(html) {
-  const tokens = tokenize(html);
+  const tokens = tokenize(resolveStreamed(html));
   const hasMain = tokens.some((t) => typeof t !== "string" && t.name === "main" && !t.close);
   const lines = [];
   let line = "";
@@ -698,6 +747,7 @@ function errorMessage(err) {
 }
 async function routesFrom(manifest, cfg, warnings) {
   const listed = Array.isArray(cfg.expose) ? cfg.expose.map(import_core.parseMethodEntry).filter((e) => e !== null) : [];
+  const callbacks = new Set(manifest.supabase?.callbacks ?? []);
   const perEntry = await Promise.all(
     manifest.routes.map(async (entry) => {
       const base = { path: entry.path, params: entry.params };
@@ -715,7 +765,7 @@ async function routesFrom(manifest, cfg, warnings) {
       const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
       return methods.filter((m) => m !== "OPTIONS").map((method) => {
         const marker = mod ? (0, import_core.getMarker)(mod[method]) : void 0;
-        return { ...base, method, ...marker ? { marker } : {} };
+        return { ...base, method, ...marker ? { marker } : {}, ...callbacks.has(entry.file) ? { optIn: true } : {} };
       });
     })
   );

package/dist/index.js

@@ -454,9 +454,58 @@ function tokenize(html) {
   if (last < html.length) out.push(html.slice(last));
   return out;
 }
+function divEnd(html, from) {
+  const re = /<div\b(?:[^>"']|"[^"]*"|'[^']*')*>|<\/div\s*>/gi;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][1] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function boundaryEnd(html, from) {
+  const re = /<!--\$[?!]?-->|<!--\/\$-->/g;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][4] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function resolveStreamed(html) {
+  const chunks = [];
+  const open = /<div\s+hidden(?:="")?\s+id="S:([0-9a-f]+)"\s*>/g;
+  let out = "";
+  let last = 0;
+  for (let m = open.exec(html); m; m = open.exec(html)) {
+    const end = divEnd(html, open.lastIndex);
+    chunks.push({ id: m[1], content: html.slice(open.lastIndex, end).replace(/<\/div\s*>$/i, "") });
+    out += html.slice(last, m.index);
+    last = end;
+    open.lastIndex = end;
+  }
+  if (chunks.length === 0) return html;
+  out += html.slice(last);
+  for (let moved = true; moved; ) {
+    moved = false;
+    for (const c of chunks) {
+      const marker = `<template id="B:${c.id}"></template>`;
+      const at = out.indexOf(marker);
+      if (at < 0) continue;
+      const inBoundary = out.slice(Math.max(0, at - 9), at) === "<!--$?-->";
+      const start = inBoundary ? at - 9 : at;
+      const end = inBoundary ? boundaryEnd(out, at) : at + marker.length;
+      out = out.slice(0, start) + c.content + out.slice(end);
+      moved = true;
+    }
+  }
+  return out;
+}
 var hidden = (t) => "hidden" in t.attrs || t.attrs["aria-hidden"] === "true" || /display\s*:\s*none|visibility\s*:\s*hidden/i.test(t.attrs.style ?? "") || t.name === "input" && t.attrs.type === "hidden";
 function htmlToText(html) {
-  const tokens = tokenize(html);
+  const tokens = tokenize(resolveStreamed(html));
   const hasMain = tokens.some((t) => typeof t !== "string" && t.name === "main" && !t.close);
   const lines = [];
   let line = "";
@@ -712,6 +761,7 @@ function errorMessage(err) {
 }
 async function routesFrom(manifest, cfg, warnings) {
   const listed = Array.isArray(cfg.expose) ? cfg.expose.map(parseMethodEntry).filter((e) => e !== null) : [];
+  const callbacks = new Set(manifest.supabase?.callbacks ?? []);
   const perEntry = await Promise.all(
     manifest.routes.map(async (entry) => {
       const base = { path: entry.path, params: entry.params };
@@ -729,7 +779,7 @@ async function routesFrom(manifest, cfg, warnings) {
       const methods = mod ? HTTP_METHODS.filter((m) => typeof mod[m] === "function") : entry.methods;
       return methods.filter((m) => m !== "OPTIONS").map((method) => {
         const marker = mod ? getMarker(mod[method]) : void 0;
-        return { ...base, method, ...marker ? { marker } : {} };
+        return { ...base, method, ...marker ? { marker } : {}, ...callbacks.has(entry.file) ? { optIn: true } : {} };
       });
     })
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.3",
+    "@exposify/cli": "0.0.5",
     "@exposify/core": "0.3.16",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"