@exposify/next 0.0.7 → 0.0.9

package/README.md

@@ -182,8 +182,8 @@ reads, and Exposify refreshes the session before supabase-js would. The
 route reads `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY`
 (or `_ANON_KEY`); pass `aiReady(exposify, { supabase: { url, key } })` to
 name them, or `supabase: false` to turn it off. The dashboard shows what was
-found and has the switch for passwords. `inspect` says which way it went and
-why; `npx @exposify/next test-sign-in` signs in on your running app and checks
+found and has the switch for passwords. `inspect` says which way it went
+(`--why` for the reasoning); `npx @exposify/next test-sign-in` signs in on your running app and checks
 a protected page accepts the cookie. If your `proxy.ts` sends signed-out
 visitors to the login page (Supabase's starter does), it would send AI
 assistants there too, before they can sign in: `inspect` warns, and
@@ -204,6 +204,24 @@ minute.
 Not supported yet: logins in more than one step (SMS codes, email links),
 and logins that need a CSRF token from your own form page.
 
+## Connect your AI assistant
+
+With `EXPOSIFY_KEY` set and the broker running, anyone opening your MCP URL in a
+browser gets a page on your domain, in your project's name and sign-in colors,
+with steps for Claude, ChatGPT, Cursor and VS Code, and Claude Code under "For
+developers". There's nothing to add to your code. `GET` requests that accept
+`text/html` get the page; MCP clients never send that, so they're unaffected.
+
+Turn it off or change its intro on the project's dashboard page, under "Connect
+page"; the same card shows page opens over 7 days and live connections. Changes
+show within about a minute. Free-tier projects also show "Powered by Exposify".
+The page has no analytics or external scripts; your server tells the broker about
+each open.
+
+Your MCP URL answers as it did before when the page is off, when the broker has
+never answered, and when the project has no running broker. That last case
+includes an app with no sign-in method.
+
 ## Pages
 
 Every App Router page is a read tool too, so an app whose server components
@@ -350,9 +368,10 @@ instead of booting the app.
 
 Server Actions get their own rows:
 
-- `inspect` lists each action with whether it's a tool and why, its status
-  (input known, input partly unknown, or flagged as sign-in/out or taking a
-  file), the forms that submit to it, and what the scan couldn't tell. Where
+- `inspect` lists each action with whether it's a tool; add `--why` for the
+  reason on each, its status (input known, input partly unknown, or flagged as
+  sign-in/out or taking a file), the forms that submit to it, and what the scan
+  couldn't tell. Where
   an input you wrote no longer matches the code (a field the action now
   reads, an option the form dropped), it says so, and `inspect --check` fails
   on it in CI. The `inspect --snapshot` file includes action tools, by their

package/dist/index.cjs

@@ -1320,6 +1320,13 @@ function aiReady(manifest, options = {}) {
     }
     const actionKey = actionUrl?.exec(pathname)?.[1];
     if (actionKey !== void 0) return serveAction(req, decodeURIComponent(actionKey));
+    const hosted = (0, import_core.hostedResolverInfo)(cfg.auth);
+    if (hosted && (0, import_core.wantsConnectPage)(req) && !pathname.endsWith(PRM_SUFFIX)) {
+      const pub = new URL((0, import_core.publicRequestUrl)(req.url, req.headers));
+      const derived = `${pub.origin}${pub.pathname}`;
+      const page = await (0, import_core.serveConnectPage)(req, hosted, hosted.resource ?? brokerGate?.resourceFor(derived) ?? derived);
+      if (page) return page;
+    }
     if (req.headers.has(DISPATCH_HEADER)) {
       return Response.json({ error: "a tool call can't call the MCP endpoint itself" }, { status: 508 });
     }

package/dist/index.js

@@ -19,6 +19,8 @@ import {
   fieldKind,
   handleLoginPage,
   hostedResolverInfo,
+  serveConnectPage,
+  wantsConnectPage,
   loginResultFromResponse,
   keepFailedCookies,
   readStep,
@@ -1334,6 +1336,13 @@ function aiReady(manifest, options = {}) {
     }
     const actionKey = actionUrl?.exec(pathname)?.[1];
     if (actionKey !== void 0) return serveAction(req, decodeURIComponent(actionKey));
+    const hosted = hostedResolverInfo(cfg.auth);
+    if (hosted && wantsConnectPage(req) && !pathname.endsWith(PRM_SUFFIX)) {
+      const pub = new URL(publicRequestUrl(req.url, req.headers));
+      const derived = `${pub.origin}${pub.pathname}`;
+      const page = await serveConnectPage(req, hosted, hosted.resource ?? brokerGate?.resourceFor(derived) ?? derived);
+      if (page) return page;
+    }
     if (req.headers.has(DISPATCH_HEADER)) {
       return Response.json({ error: "a tool call can't call the MCP endpoint itself" }, { status: 508 });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.6",
-    "@exposify/core": "0.3.16",
+    "@exposify/cli": "0.0.8",
+    "@exposify/core": "0.3.18",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"
   },