@exposify/next 0.0.8 → 0.0.10

package/README.md

@@ -1,14 +1,25 @@
 # @exposify/next
 
-Next.js integration for [Exposify](../../README.md): your route handlers,
-pages and Server Actions become MCP tools that AI agents can call, at `/mcp` on
-your own app.
+Next.js integration for
+[Exposify](https://github.com/ayadagain/agentready#readme): your route
+handlers, pages and Server Actions become MCP tools that AI agents can call,
+at `/mcp` on your own app. Tool calls go over HTTP to your own app, so your
+`proxy.ts`/middleware auth applies — there's no separate service and no
+privilege escalation.
 
 ```sh
 npm install @exposify/next
 npx @exposify/next setup   # pick the endpoints, get the route file to create
 ```
 
+> **Which package?** Use **`@exposify/next`** for a Next.js app, including one
+> whose users sign in with Supabase Auth (`@supabase/ssr`) — tool calls run
+> through your Next server, so your own auth and checks apply. Use
+> [**`@exposify/supabase`**](https://github.com/ayadagain/agentready/tree/main/packages/supabase)
+> instead when you want an MCP endpoint served straight from a Supabase **edge
+> function** over PostgREST, with RLS as the authorization layer and no Next
+> app in front of it.
+
 Or by hand, in two files:
 
 ```ts
@@ -182,8 +193,8 @@ reads, and Exposify refreshes the session before supabase-js would. The
 route reads `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY`
 (or `_ANON_KEY`); pass `aiReady(exposify, { supabase: { url, key } })` to
 name them, or `supabase: false` to turn it off. The dashboard shows what was
-found and has the switch for passwords. `inspect` says which way it went and
-why; `npx @exposify/next test-sign-in` signs in on your running app and checks
+found and has the switch for passwords. `inspect` says which way it went
+(`--why` for the reasoning); `npx @exposify/next test-sign-in` signs in on your running app and checks
 a protected page accepts the cookie. If your `proxy.ts` sends signed-out
 visitors to the login page (Supabase's starter does), it would send AI
 assistants there too, before they can sign in: `inspect` warns, and
@@ -197,13 +208,31 @@ alone keep their session in the browser, where the server never sees it.
 **No login found, and no sign-in method in the dashboard?** Then agents use
 your app signed out: `/mcp` doesn't ask them to sign in, and your own checks
 decide what they can do. The startup log says which it is
-(`[agentready] How agents sign in: ...`), and so does the dashboard's "How
+(`[exposify] How agents sign in: ...`), and so does the dashboard's "How
 agents sign in" page. Adding a sign-in method there takes effect within a
 minute.
 
 Not supported yet: logins in more than one step (SMS codes, email links),
 and logins that need a CSRF token from your own form page.
 
+## Connect your AI assistant
+
+With `EXPOSIFY_KEY` set and the broker running, anyone opening your MCP URL in a
+browser gets a page on your domain, in your project's name and sign-in colors,
+with steps for Claude, ChatGPT, Cursor and VS Code, and Claude Code under "For
+developers". There's nothing to add to your code. `GET` requests that accept
+`text/html` get the page; MCP clients never send that, so they're unaffected.
+
+Turn it off or change its intro on the project's dashboard page, under "Connect
+page"; the same card shows page opens over 7 days and live connections. Changes
+show within about a minute. Free-tier projects also show "Powered by Exposify".
+The page has no analytics or external scripts; your server tells the broker about
+each open.
+
+Your MCP URL answers as it did before when the page is off, when the broker has
+never answered, and when the project has no running broker. That last case
+includes an app with no sign-in method.
+
 ## Pages
 
 Every App Router page is a read tool too, so an app whose server components
@@ -350,9 +379,10 @@ instead of booting the app.
 
 Server Actions get their own rows:
 
-- `inspect` lists each action with whether it's a tool and why, its status
-  (input known, input partly unknown, or flagged as sign-in/out or taking a
-  file), the forms that submit to it, and what the scan couldn't tell. Where
+- `inspect` lists each action with whether it's a tool; add `--why` for the
+  reason on each, its status (input known, input partly unknown, or flagged as
+  sign-in/out or taking a file), the forms that submit to it, and what the scan
+  couldn't tell. Where
   an input you wrote no longer matches the code (a field the action now
   reads, an option the form dropped), it says so, and `inspect --check` fails
   on it in CI. The `inspect --snapshot` file includes action tools, by their

package/dist/index.cjs

@@ -129,7 +129,7 @@ async function runAction(fn, action, args) {
     const flow = nextControlFlow(err);
     if (flow && "redirect" in flow) return json(JSON.stringify({ ok: true, redirectedTo: flow.redirect }));
     if (flow) return json(JSON.stringify({ error: ERRORS[flow.status] ?? `HTTP ${flow.status}` }), flow.status);
-    console.error(`[agentready] server action ${action.export} threw:`, err);
+    console.error(`[exposify] server action ${action.export} threw:`, err);
     return json(JSON.stringify({ error: "the action threw an error" }), 500);
   }
 }
@@ -304,7 +304,7 @@ async function readActionResponse(res, exportName) {
     const flow = nextControlFlow({ digest: err.digest });
     if (flow && "redirect" in flow) return json(JSON.stringify({ ok: true, redirectedTo: flow.redirect }));
     if (flow) return json(JSON.stringify({ error: ERRORS[flow.status] ?? `HTTP ${flow.status}` }), flow.status);
-    console.error(`[agentready] server action ${exportName} threw: ${err.message}`);
+    console.error(`[exposify] server action ${exportName} threw: ${err.message}`);
     return json(JSON.stringify({ error: "the action threw an error" }), 500);
   }
 }
@@ -735,7 +735,7 @@ async function agentIp(request, options = {}) {
 var import_core2 = require("@exposify/core");
 var DISPATCH_HEADER = "x-exposify-dispatch";
 var PRM_SUFFIX = "/.well-known/oauth-protected-resource";
-var LOG_PREFIX = "[agentready]";
+var LOG_PREFIX = "[exposify]";
 var ACTION_NOTE = "It returns the action's result, or { ok: true, redirectedTo } when the action redirects; a redirect to a sign-in page means the call wasn't authorised.";
 var LEFT_BLANK = "A field you leave out is as if left blank on the form.";
 var PAGE_NOTE = "Returns the page's main content as text, with links, and the data it was rendered with when the page passes any to its components. An error naming a sign-in page means signing in first.";
@@ -1320,6 +1320,13 @@ function aiReady(manifest, options = {}) {
     }
     const actionKey = actionUrl?.exec(pathname)?.[1];
     if (actionKey !== void 0) return serveAction(req, decodeURIComponent(actionKey));
+    const hosted = (0, import_core.hostedResolverInfo)(cfg.auth);
+    if (hosted && (0, import_core.wantsConnectPage)(req) && !pathname.endsWith(PRM_SUFFIX)) {
+      const pub = new URL((0, import_core.publicRequestUrl)(req.url, req.headers));
+      const derived = `${pub.origin}${pub.pathname}`;
+      const page = await (0, import_core.serveConnectPage)(req, hosted, hosted.resource ?? brokerGate?.resourceFor(derived) ?? derived);
+      if (page) return page;
+    }
     if (req.headers.has(DISPATCH_HEADER)) {
       return Response.json({ error: "a tool call can't call the MCP endpoint itself" }, { status: 508 });
     }

package/dist/index.js

@@ -19,6 +19,8 @@ import {
   fieldKind,
   handleLoginPage,
   hostedResolverInfo,
+  serveConnectPage,
+  wantsConnectPage,
   loginResultFromResponse,
   keepFailedCookies,
   readStep,
@@ -139,7 +141,7 @@ async function runAction(fn, action, args) {
     const flow = nextControlFlow(err);
     if (flow && "redirect" in flow) return json(JSON.stringify({ ok: true, redirectedTo: flow.redirect }));
     if (flow) return json(JSON.stringify({ error: ERRORS[flow.status] ?? `HTTP ${flow.status}` }), flow.status);
-    console.error(`[agentready] server action ${action.export} threw:`, err);
+    console.error(`[exposify] server action ${action.export} threw:`, err);
     return json(JSON.stringify({ error: "the action threw an error" }), 500);
   }
 }
@@ -314,7 +316,7 @@ async function readActionResponse(res, exportName) {
     const flow = nextControlFlow({ digest: err.digest });
     if (flow && "redirect" in flow) return json(JSON.stringify({ ok: true, redirectedTo: flow.redirect }));
     if (flow) return json(JSON.stringify({ error: ERRORS[flow.status] ?? `HTTP ${flow.status}` }), flow.status);
-    console.error(`[agentready] server action ${exportName} threw: ${err.message}`);
+    console.error(`[exposify] server action ${exportName} threw: ${err.message}`);
     return json(JSON.stringify({ error: "the action threw an error" }), 500);
   }
 }
@@ -749,7 +751,7 @@ import {
 } from "@exposify/core";
 var DISPATCH_HEADER = "x-exposify-dispatch";
 var PRM_SUFFIX = "/.well-known/oauth-protected-resource";
-var LOG_PREFIX = "[agentready]";
+var LOG_PREFIX = "[exposify]";
 var ACTION_NOTE = "It returns the action's result, or { ok: true, redirectedTo } when the action redirects; a redirect to a sign-in page means the call wasn't authorised.";
 var LEFT_BLANK = "A field you leave out is as if left blank on the form.";
 var PAGE_NOTE = "Returns the page's main content as text, with links, and the data it was rendered with when the page passes any to its components. An error naming a sign-in page means signing in first.";
@@ -1334,6 +1336,13 @@ function aiReady(manifest, options = {}) {
     }
     const actionKey = actionUrl?.exec(pathname)?.[1];
     if (actionKey !== void 0) return serveAction(req, decodeURIComponent(actionKey));
+    const hosted = hostedResolverInfo(cfg.auth);
+    if (hosted && wantsConnectPage(req) && !pathname.endsWith(PRM_SUFFIX)) {
+      const pub = new URL(publicRequestUrl(req.url, req.headers));
+      const derived = `${pub.origin}${pub.pathname}`;
+      const page = await serveConnectPage(req, hosted, hosted.resource ?? brokerGate?.resourceFor(derived) ?? derived);
+      if (page) return page;
+    }
     if (req.headers.has(DISPATCH_HEADER)) {
       return Response.json({ error: "a tool call can't call the MCP endpoint itself" }, { status: 508 });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.7",
-    "@exposify/core": "0.3.17",
+    "@exposify/cli": "0.0.9",
+    "@exposify/core": "0.3.19",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"
   },