@exposify/next 0.0.5 → 0.0.6

package/README.md

@@ -184,7 +184,11 @@ route reads `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
 name them, or `supabase: false` to turn it off. The dashboard shows what was
 found and has the switch for passwords. `inspect` says which way it went and
 why; `npx @exposify/next test-sign-in` signs in on your running app and checks
-a protected page accepts the cookie. `@supabase/auth-helpers-nextjs` (an
+a protected page accepts the cookie. If your `proxy.ts` sends signed-out
+visitors to the login page (Supabase's starter does), it would send AI
+assistants there too, before they can sign in: `inspect` warns, and
+`setup --apply` leaves `/mcp` out of its matcher. Your pages still go through
+it on tool calls. `@supabase/auth-helpers-nextjs` (an
 older cookie format) isn't supported, and apps on `@supabase/supabase-js`
 alone keep their session in the browser, where the server never sees it.
 

package/dist/exposify-next.js

@@ -2296,8 +2296,8 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
 import { createInterface } from "readline";
 
 // bin/adapter.ts
-import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
-import { dirname as dirname4, join as join9, relative as relative3, resolve as resolve2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname4, join as join10, relative as relative3, resolve as resolve2 } from "path";
 import { decideExposure, deriveDescription, resolveOptions, toolNames } from "@exposify/core";
 import { renderConfig, replaceAiReadyOptions } from "@exposify/cli";
 
@@ -2646,13 +2646,134 @@ function scanActions(d, call, root, notes, suggestions = []) {
   return rows;
 }
 
+// bin/proxy.ts
+import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
+import { join as join9 } from "path";
+var FILES = ["", "src/"].flatMap((dir) => ["proxy", "middleware"].flatMap((name) => [".ts", ".js", ".mjs"].map((ext) => `${dir}${name}${ext}`)));
+var REDIRECT = /\bredirect\s*\(/;
+function matcherRegExp(pattern) {
+  let re = "";
+  for (let i = 0; i < pattern.length; ) {
+    const c = pattern[i];
+    if (c === "(") {
+      let depth = 0;
+      let j = i;
+      for (; j < pattern.length; j++) {
+        if (pattern[j] === "\\") j++;
+        else if (pattern[j] === "(") depth++;
+        else if (pattern[j] === ")" && --depth === 0) break;
+      }
+      re += pattern.slice(i, j + 1);
+      i = j + 1;
+    } else if (c === "/" && pattern[i + 1] === ":") {
+      const m = /^\/:\w+([*+?]?)/.exec(pattern.slice(i));
+      re += m[1] === "*" ? "(?:/.*)?" : m[1] === "+" ? "/.+" : m[1] === "?" ? "(?:/[^/]+)?" : "/[^/]+";
+      i += m[0].length;
+    } else {
+      re += c.replace(/[.*+?^${}|[\]\\]/g, "\\$&");
+      i++;
+    }
+  }
+  try {
+    return new RegExp(`^${re}/?$`);
+  } catch {
+    return void 0;
+  }
+}
+function matcherNode(program) {
+  for (const n of program.body) {
+    const decl = n.type === "ExportNamedDeclaration" ? n.declaration : void 0;
+    if (decl?.type !== "VariableDeclaration") continue;
+    for (const d of decl.declarations) {
+      if (d.id?.name !== "config") continue;
+      const obj = unwrapTs(d.init);
+      if (obj?.type !== "ObjectExpression") return "opaque";
+      const prop2 = obj.properties.find((p) => p.type === "ObjectProperty" && (p.key?.name ?? p.key?.value) === "matcher");
+      return prop2 ? unwrapTs(prop2.value) ?? "opaque" : null;
+    }
+  }
+  return null;
+}
+function matcherEntries(node) {
+  const items = node.type === "ArrayExpression" ? node.elements : [node];
+  const out = [];
+  for (const item of items) {
+    const literal = item?.type === "ObjectExpression" ? unwrapTs(item.properties.find((p) => (p.key?.name ?? p.key?.value) === "source")?.value) : item;
+    const pattern = stringValue(literal);
+    if (pattern === void 0 || !literal) return void 0;
+    out.push({ pattern, node: literal });
+  }
+  return out;
+}
+function redirects(root, file, source, program) {
+  if (REDIRECT.test(source)) return true;
+  const load = moduleLoader(root);
+  for (const n of program.body) {
+    if (n.type !== "ImportDeclaration") continue;
+    const found = load(n.source.value, file);
+    if (found && REDIRECT.test(found.source)) return true;
+  }
+  return false;
+}
+function middlewareFile(root) {
+  return FILES.find((f) => existsSync4(join9(root, f)));
+}
+function findProxyGate(root, mcpPath = "/mcp") {
+  const file = middlewareFile(root);
+  if (!file) return void 0;
+  const source = readFileSync9(join9(root, file), "utf8");
+  const program = parseModule(source, file);
+  if (!program || !redirects(root, file, source, program)) return void 0;
+  const matcher = matcherNode(program);
+  if (matcher === "opaque") return void 0;
+  if (matcher === null) return { file, mcpPath, matching: [] };
+  const entries = matcherEntries(matcher);
+  if (!entries) return void 0;
+  const probes = [mcpPath, `${mcpPath.replace(/\/$/, "")}/login`];
+  const matching = entries.filter((e) => probes.some((p) => matcherRegExp(e.pattern)?.test(p))).map((e) => e.pattern);
+  return matching.length > 0 ? { file, mcpPath, matching } : void 0;
+}
+function proxyGateHint(gate) {
+  return `${gate.file} sends signed-out requests to another page and runs on ${gate.mcpPath}, so AI assistants get that page instead of a sign-in. Leave ${gate.mcpPath} out of its matcher (the MCP route checks its own callers): ` + (gate.matching.some((p) => p.startsWith("/((?!")) ? `add ${exclusion(gate.mcpPath)}| after "(?!" in config.matcher.` : `matcher: ["/((?!${exclusion(gate.mcpPath)}).*)"].`);
+}
+var exclusion = (mcpPath) => `${mcpPath.replace(/^\/+|\/+$/g, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|$)`;
+var inSource = (mcpPath) => exclusion(mcpPath).replace(/\\/g, "\\\\");
+function excludeMcpFromProxy(root, gate) {
+  const file = join9(root, gate.file);
+  const before = readFileSync9(file, "utf8");
+  const program = parseModule(before, gate.file);
+  if (!program) return { blocked: `couldn't parse ${gate.file}` };
+  const summary = `Leave ${gate.mcpPath} out of ${gate.file}'s matcher, so AI assistants reach the sign-in instead of your login page`;
+  const matcher = matcherNode(program);
+  if (matcher === null) {
+    const after2 = `${before.replace(/\n*$/, "\n")}
+export const config = {
+  matcher: ["/((?!${inSource(gate.mcpPath)}).*)"],
+};
+`;
+    return { plan: { file, summary, before, after: after2 } };
+  }
+  const entries = matcher === "opaque" ? void 0 : matcherEntries(matcher);
+  if (!entries) return { blocked: `${gate.file}'s matcher isn't a list of strings` };
+  let after = before;
+  for (const e of [...entries].reverse()) {
+    if (!gate.matching.includes(e.pattern)) continue;
+    const raw = before.slice(e.node.start, e.node.end);
+    const at = raw.indexOf("/((?!");
+    if (at < 0) return { blocked: `${gate.file}'s matcher "${e.pattern}" has no "(?!" to add ${gate.mcpPath} to` };
+    const insert = e.node.start + at + "/((?!".length;
+    after = `${after.slice(0, insert)}${inSource(gate.mcpPath)}|${after.slice(insert)}`;
+  }
+  return { plan: { file, summary, before, after } };
+}
+
 // bin/adapter.ts
 var MCP_ROUTE_DIR = "mcp/[[...transport]]";
 function isNextProject(dir) {
   try {
-    const pkg = JSON.parse(readFileSync9(join9(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync10(join10(dir, "package.json"), "utf8"));
     const hasNext = Boolean(pkg.dependencies?.next ?? pkg.devDependencies?.next);
-    return hasNext && ["app", "src/app", "pages", "src/pages"].some((d) => existsSync4(join9(dir, d)));
+    return hasNext && ["app", "src/app", "pages", "src/pages"].some((d) => existsSync5(join10(dir, d)));
   } catch {
     return false;
   }
@@ -2704,7 +2825,11 @@ ${block}
     const wrap = hasWithExposify(root) ? null : wrapNextConfig(root);
     const also = wrap && "plan" in wrap ? [{ plan: wrap.plan, manual: WRAP_HINT }] : [];
     if (wrap && !("plan" in wrap)) lines.push(WRAP_HINT);
-    const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join9(root, f)).find((f) => existsSync4(f));
+    const gate = findProxyGate(root, d.mcpPath ?? "/mcp");
+    const unblock = gate ? excludeMcpFromProxy(root, gate) : null;
+    if (gate && unblock && "plan" in unblock) also.push({ plan: unblock.plan, manual: proxyGateHint(gate) });
+    else if (gate) lines.push(proxyGateHint(gate));
+    const existing = ["exposify.generated.ts", "exposify.generated.js"].map((f) => join10(root, f)).find((f) => existsSync5(f));
     const manifestFile = existing ?? generate(root, {}, () => {
     }).file;
     const generated = relative3(root, manifestFile);
@@ -2715,7 +2840,7 @@ ${block}
       return { code: options, hint: { lines: [`Replace the aiReady(...) call in ${file}:${result.aiReady.site.line} with this.`, ...lines] }, apply };
     }
     const routeFile = `${d.appDir ?? "app"}/${MCP_ROUTE_DIR}/route.${generated.endsWith(".ts") ? "ts" : "js"}`;
-    const manifestImport = relative3(join9(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
+    const manifestImport = relative3(join10(root, dirname4(routeFile)), manifestFile).replace(/\.[jt]s$/, "");
     const code = [
       'import { aiReady } from "@exposify/next";',
       ...usesZod ? ['import { z } from "zod";'] : [],
@@ -2727,7 +2852,7 @@ ${block}
     ].join("\n");
     return {
       code,
-      apply: { plan: { file: join9(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
+      apply: { plan: { file: join10(root, routeFile), summary: `Create ${routeFile}`, before: null, after: `${code}
 ` }, ...also.length ? { also } : {} },
       hint: { lines: [`Create ${routeFile} with this (agents connect to /mcp). It imports ${generated}${existing ? "" : ", written just now"}.`, ...lines] }
     };
@@ -2741,10 +2866,10 @@ function withAlso(outcome, also, lines) {
   return outcome;
 }
 function wrapNextConfig(root) {
-  const name = NEXT_CONFIGS.find((n) => existsSync4(join9(root, n)));
+  const name = NEXT_CONFIGS.find((n) => existsSync5(join10(root, n)));
   if (!name) return { blocked: "no next.config file" };
-  const file = join9(root, name);
-  const before = readFileSync9(file, "utf8");
+  const file = join10(root, name);
+  const before = readFileSync10(file, "utf8");
   const program = parseModule(before, name);
   if (!program) return { blocked: `couldn't parse ${name}` };
   const body = program.body;
@@ -2770,7 +2895,7 @@ ${wrapped}`;
 function hasWithExposify(root) {
   for (const name of NEXT_CONFIGS) {
     try {
-      if (readFileSync9(join9(root, name), "utf8").includes("withExposify")) return true;
+      if (readFileSync10(join10(root, name), "utf8").includes("withExposify")) return true;
     } catch {
     }
   }
@@ -2817,7 +2942,7 @@ function scanProject(root) {
   for (const p of d.pages) {
     let source;
     try {
-      source = readFileSync9(join9(root, p.file), "utf8");
+      source = readFileSync10(join10(root, p.file), "utf8");
     } catch {
       source = void 0;
     }
@@ -2844,6 +2969,8 @@ function scanProject(root) {
   for (const row of rows) if (row.page && row.describedName) names.set(`GET ${row.info.path}`, row.describedName);
   const suggestions = [];
   const actions = scanActions(d, call, root, notes, suggestions);
+  const gate = findProxyGate(root, d.mcpPath ?? "/mcp");
+  if (gate) notes.push(`${proxyGateHint(gate)} setup --apply can make this change.`);
   const routes = rows.map((row) => {
     const key = `${row.info.method} ${row.info.path}`;
     const decision = exposure.get(key);
@@ -2886,7 +3013,7 @@ function scanProject(root) {
     } : {},
     ...call && d.mcpRoute ? {
       aiReady: {
-        site: { file: join9(root, d.mcpRoute.file), line: call.line },
+        site: { file: join10(root, d.mcpRoute.file), line: call.line },
         options: {
           ...call.expose ? { expose: call.expose } : {},
           ...call.exclude ? { exclude: call.exclude } : {},
@@ -2900,7 +3027,7 @@ function scanProject(root) {
 }
 function applyReplace(site, config, entries, usesZod, relFile) {
   try {
-    const before = readFileSync9(site.file, "utf8");
+    const before = readFileSync10(site.file, "utf8");
     const edit = replaceAiReadyOptions({
       source: before,
       file: site.file,
@@ -2919,8 +3046,8 @@ function applyReplace(site, config, entries, usesZod, relFile) {
 }
 
 // bin/test-sign-in.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join10 } from "path";
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join11 } from "path";
 import { parseEnv } from "util";
 import { supabaseCookieName, supabasePasswordLogin, supabaseSessionCookies } from "@exposify/core";
 var TEST_SIGN_IN_USAGE = `Usage: @exposify/next test-sign-in [options]
@@ -2942,7 +3069,7 @@ environment, .env.local or .env. Signs the test session out afterwards.`;
 function supabaseEnv(root, env) {
   const files = [".env.local", ".env"].map((f) => {
     try {
-      return parseEnv(readFileSync10(join10(root, f), "utf8"));
+      return parseEnv(readFileSync11(join11(root, f), "utf8"));
     } catch {
       return {};
     }

package/dist/index.cjs

@@ -444,9 +444,58 @@ function tokenize(html) {
   if (last < html.length) out.push(html.slice(last));
   return out;
 }
+function divEnd(html, from) {
+  const re = /<div\b(?:[^>"']|"[^"]*"|'[^']*')*>|<\/div\s*>/gi;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][1] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function boundaryEnd(html, from) {
+  const re = /<!--\$[?!]?-->|<!--\/\$-->/g;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][4] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function resolveStreamed(html) {
+  const chunks = [];
+  const open = /<div\s+hidden(?:="")?\s+id="S:([0-9a-f]+)"\s*>/g;
+  let out = "";
+  let last = 0;
+  for (let m = open.exec(html); m; m = open.exec(html)) {
+    const end = divEnd(html, open.lastIndex);
+    chunks.push({ id: m[1], content: html.slice(open.lastIndex, end).replace(/<\/div\s*>$/i, "") });
+    out += html.slice(last, m.index);
+    last = end;
+    open.lastIndex = end;
+  }
+  if (chunks.length === 0) return html;
+  out += html.slice(last);
+  for (let moved = true; moved; ) {
+    moved = false;
+    for (const c of chunks) {
+      const marker = `<template id="B:${c.id}"></template>`;
+      const at = out.indexOf(marker);
+      if (at < 0) continue;
+      const inBoundary = out.slice(Math.max(0, at - 9), at) === "<!--$?-->";
+      const start = inBoundary ? at - 9 : at;
+      const end = inBoundary ? boundaryEnd(out, at) : at + marker.length;
+      out = out.slice(0, start) + c.content + out.slice(end);
+      moved = true;
+    }
+  }
+  return out;
+}
 var hidden = (t) => "hidden" in t.attrs || t.attrs["aria-hidden"] === "true" || /display\s*:\s*none|visibility\s*:\s*hidden/i.test(t.attrs.style ?? "") || t.name === "input" && t.attrs.type === "hidden";
 function htmlToText(html) {
-  const tokens = tokenize(html);
+  const tokens = tokenize(resolveStreamed(html));
   const hasMain = tokens.some((t) => typeof t !== "string" && t.name === "main" && !t.close);
   const lines = [];
   let line = "";

package/dist/index.js

@@ -454,9 +454,58 @@ function tokenize(html) {
   if (last < html.length) out.push(html.slice(last));
   return out;
 }
+function divEnd(html, from) {
+  const re = /<div\b(?:[^>"']|"[^"]*"|'[^']*')*>|<\/div\s*>/gi;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][1] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function boundaryEnd(html, from) {
+  const re = /<!--\$[?!]?-->|<!--\/\$-->/g;
+  re.lastIndex = from;
+  let depth = 1;
+  for (let m = re.exec(html); m; m = re.exec(html)) {
+    depth += m[0][4] === "/" ? -1 : 1;
+    if (depth === 0) return re.lastIndex;
+  }
+  return html.length;
+}
+function resolveStreamed(html) {
+  const chunks = [];
+  const open = /<div\s+hidden(?:="")?\s+id="S:([0-9a-f]+)"\s*>/g;
+  let out = "";
+  let last = 0;
+  for (let m = open.exec(html); m; m = open.exec(html)) {
+    const end = divEnd(html, open.lastIndex);
+    chunks.push({ id: m[1], content: html.slice(open.lastIndex, end).replace(/<\/div\s*>$/i, "") });
+    out += html.slice(last, m.index);
+    last = end;
+    open.lastIndex = end;
+  }
+  if (chunks.length === 0) return html;
+  out += html.slice(last);
+  for (let moved = true; moved; ) {
+    moved = false;
+    for (const c of chunks) {
+      const marker = `<template id="B:${c.id}"></template>`;
+      const at = out.indexOf(marker);
+      if (at < 0) continue;
+      const inBoundary = out.slice(Math.max(0, at - 9), at) === "<!--$?-->";
+      const start = inBoundary ? at - 9 : at;
+      const end = inBoundary ? boundaryEnd(out, at) : at + marker.length;
+      out = out.slice(0, start) + c.content + out.slice(end);
+      moved = true;
+    }
+  }
+  return out;
+}
 var hidden = (t) => "hidden" in t.attrs || t.attrs["aria-hidden"] === "true" || /display\s*:\s*none|visibility\s*:\s*hidden/i.test(t.attrs.style ?? "") || t.name === "input" && t.attrs.type === "hidden";
 function htmlToText(html) {
-  const tokens = tokenize(html);
+  const tokens = tokenize(resolveStreamed(html));
   const hasMain = tokens.some((t) => typeof t !== "string" && t.name === "main" && !t.close);
   const lines = [];
   let line = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.4",
+    "@exposify/cli": "0.0.5",
     "@exposify/core": "0.3.16",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"