@exposify/next 0.0.6 → 0.0.7

package/README.md

@@ -187,7 +187,9 @@ why; `npx @exposify/next test-sign-in` signs in on your running app and checks
 a protected page accepts the cookie. If your `proxy.ts` sends signed-out
 visitors to the login page (Supabase's starter does), it would send AI
 assistants there too, before they can sign in: `inspect` warns, and
-`setup --apply` leaves `/mcp` out of its matcher. Your pages still go through
+`setup --apply` leaves `/mcp` and `/.well-known/oauth-protected-resource` out
+of its matcher (a matcher that already leaves out `/mcp` gets the second one
+added). Your pages still go through
 it on tool calls. `@supabase/auth-helpers-nextjs` (an
 older cookie format) isn't supported, and apps on `@supabase/supabase-js`
 alone keep their session in the browser, where the server never sees it.

package/dist/exposify-next.js

@@ -2649,6 +2649,7 @@ function scanActions(d, call, root, notes, suggestions = []) {
 // bin/proxy.ts
 import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
 import { join as join9 } from "path";
+import { PRM_PATH } from "@exposify/core";
 var FILES = ["", "src/"].flatMap((dir) => ["proxy", "middleware"].flatMap((name) => [".ts", ".js", ".mjs"].map((ext) => `${dir}${name}${ext}`)));
 var REDIRECT = /\bredirect\s*\(/;
 function matcherRegExp(pattern) {
@@ -2729,15 +2730,22 @@ function findProxyGate(root, mcpPath = "/mcp") {
   if (matcher === null) return { file, mcpPath, matching: [] };
   const entries = matcherEntries(matcher);
   if (!entries) return void 0;
-  const probes = [mcpPath, `${mcpPath.replace(/\/$/, "")}/login`];
+  const probes = exclusions(mcpPath).flatMap((x) => x.probes);
   const matching = entries.filter((e) => probes.some((p) => matcherRegExp(e.pattern)?.test(p))).map((e) => e.pattern);
   return matching.length > 0 ? { file, mcpPath, matching } : void 0;
 }
 function proxyGateHint(gate) {
-  return `${gate.file} sends signed-out requests to another page and runs on ${gate.mcpPath}, so AI assistants get that page instead of a sign-in. Leave ${gate.mcpPath} out of its matcher (the MCP route checks its own callers): ` + (gate.matching.some((p) => p.startsWith("/((?!")) ? `add ${exclusion(gate.mcpPath)}| after "(?!" in config.matcher.` : `matcher: ["/((?!${exclusion(gate.mcpPath)}).*)"].`);
+  return `${gate.file} sends signed-out requests to another page and runs on ${gate.mcpPath}, so AI assistants get that page instead of a sign-in. Leave ${gate.mcpPath} and ${PRM_PATH} out of its matcher (the MCP route checks its own callers): ` + (gate.matching.some((p) => p.startsWith("/((?!")) ? `add ${inSource(gate.mcpPath)}| after "(?!" in config.matcher.` : `matcher: ["/((?!${inSource(gate.mcpPath)}).*)"].`);
 }
-var exclusion = (mcpPath) => `${mcpPath.replace(/^\/+|\/+$/g, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|$)`;
-var inSource = (mcpPath) => exclusion(mcpPath).replace(/\\/g, "\\\\");
+var exclusions = (mcpPath) => [
+  {
+    alt: `${mcpPath.replace(/^\/+|\/+$/g, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|$)`,
+    probes: [mcpPath, `${mcpPath.replace(/\/$/, "")}/login`]
+  },
+  { alt: String.raw`\.well-known/oauth-protected-resource(?:/|$)`, probes: [`${PRM_PATH}${mcpPath}`] }
+];
+var exclusion = (mcpPath, pattern) => exclusions(mcpPath).filter((x) => pattern === void 0 || x.probes.some((p) => matcherRegExp(pattern)?.test(p))).map((x) => x.alt).join("|");
+var inSource = (mcpPath, pattern) => exclusion(mcpPath, pattern).replace(/\\/g, "\\\\");
 function excludeMcpFromProxy(root, gate) {
   const file = join9(root, gate.file);
   const before = readFileSync9(file, "utf8");
@@ -2762,7 +2770,7 @@ export const config = {
     const at = raw.indexOf("/((?!");
     if (at < 0) return { blocked: `${gate.file}'s matcher "${e.pattern}" has no "(?!" to add ${gate.mcpPath} to` };
     const insert = e.node.start + at + "/((?!".length;
-    after = `${after.slice(0, insert)}${inSource(gate.mcpPath)}|${after.slice(insert)}`;
+    after = `${after.slice(0, insert)}${inSource(gate.mcpPath, e.pattern)}|${after.slice(insert)}`;
   }
   return { plan: { file, summary, before, after } };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,7 +32,7 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.5",
+    "@exposify/cli": "0.0.6",
     "@exposify/core": "0.3.16",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"