@exposify/express 0.3.9 → 0.3.10

package/README.md

@@ -173,6 +173,13 @@ signs in with your app's own login, with no code:
 `login: { path, fields, body? }` names another route; `login: false` turns
 it off. Routers introspection can't see (sub-apps) need `mounts`.
 
+**No login found, and no sign-in method in the dashboard?** Then agents use
+your app signed out: `/mcp` doesn't ask them to sign in, and your own checks
+decide what they can do. The startup log says which it is
+(`[agentready] How agents sign in: ...`), and so does the dashboard's "How
+agents sign in" page. Adding a sign-in method there takes effect within a
+minute.
+
 ## "Click Connect and log in" (OAuth)
 
 By default the MCP client has to be handed a token by hand. If your app's

package/dist/index.cjs

@@ -31,6 +31,7 @@ __export(index_exports, {
   routesFromExpress: () => routesFromExpress
 });
 module.exports = __toCommonJS(index_exports);
+var import_node_fs = require("fs");
 var import_node_path3 = require("path");
 var import_core6 = require("@exposify/core");
 var import_node2 = require("@exposify/core/node");
@@ -569,13 +570,25 @@ function aiReady(options = {}) {
       const given = options.login;
       const value = given ? { path: given.path, fields: given.fields.map((name) => ({ name, kind: (0, import_core6.fieldKind)(name) })), body: given.body ?? "json" } : findExpressLogin(app, mounts)?.login ?? null;
       loginFound = { value };
-      if (value) {
-        cfg.signedOutPaths = [value.path];
-        if (logReady) console.log(`${LOG_PREFIX} AI assistants sign in with your app's own login (POST ${value.path}) at ${MCP_PATH}/login`);
-      }
+      if (value) cfg.signedOutPaths = [value.path];
     }
     return loginFound.value;
   };
+  let stacks;
+  const stacksOf = () => {
+    if (!stacks) {
+      try {
+        stacks = (0, import_core6.authStacksOf)((0, import_core6.dependencyNames)(JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path3.join)(cwd, "package.json"), "utf8")))).map((s) => s.pkg);
+      } catch {
+        stacks = [];
+      }
+    }
+    return stacks;
+  };
+  const report = (req, resource) => {
+    const login = loginOf(req.app);
+    return (0, import_core6.reportAppLogin)(cfg.auth, resource, login, { ...login ? { where: `POST ${login.path}` } : {}, stacks: stacksOf(), log: logReady });
+  };
   const appLoginFor = (req, login) => ({
     label: `POST ${login.path}`,
     fields: login.fields,
@@ -633,7 +646,9 @@ function aiReady(options = {}) {
     }
     if (brokerGate && (path === PRM_ROOT || path === `${PRM_ROOT}${MCP_PATH}`)) {
       const resource = resourceOf(req, path, MCP_PATH);
-      void (0, import_core6.reportAppLogin)(cfg.auth, resource, loginOf(req.app)).then(() => sendWebResponse(res, brokerGate.metadataResponse(req.method, resource)));
+      void report(req, resource).then(
+        (verdict) => verdict === "open" ? void res.writeHead(404).end("not found") : sendWebResponse(res, brokerGate.metadataResponse(req.method, resource))
+      );
       return;
     }
     if (path !== MCP_PATH && !path.startsWith(`${MCP_PATH}/`)) return next();
@@ -649,11 +664,13 @@ function aiReady(options = {}) {
       console.warn("[agentready] oauth gate failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;
-    }) : brokerGate ? (0, import_core6.reportAppLogin)(cfg.auth, resourceOf(req, path, MCP_PATH), loginOf(req.app)).then(() => brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH))).then(async (result) => {
+    }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
+      if (verdict === "open") return {};
+      const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
       if (result.ok) return {};
       await sendWebResponse(res, result.response);
       return null;
-    }, (err) => {
+    }).catch((err) => {
       console.warn("[agentready] broker check failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;

package/dist/index.js

@@ -6,11 +6,14 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/index.ts
+import { readFileSync } from "fs";
 import { join as join3 } from "path";
 import {
+  authStacksOf,
   countTools,
   createBrokerGate,
   createOAuthGate,
+  dependencyNames,
   describeAuth,
   formatFailed,
   formatReady,
@@ -574,13 +577,25 @@ function aiReady(options = {}) {
       const given = options.login;
       const value = given ? { path: given.path, fields: given.fields.map((name) => ({ name, kind: fieldKind(name) })), body: given.body ?? "json" } : findExpressLogin(app, mounts)?.login ?? null;
       loginFound = { value };
-      if (value) {
-        cfg.signedOutPaths = [value.path];
-        if (logReady) console.log(`${LOG_PREFIX} AI assistants sign in with your app's own login (POST ${value.path}) at ${MCP_PATH}/login`);
-      }
+      if (value) cfg.signedOutPaths = [value.path];
     }
     return loginFound.value;
   };
+  let stacks;
+  const stacksOf = () => {
+    if (!stacks) {
+      try {
+        stacks = authStacksOf(dependencyNames(JSON.parse(readFileSync(join3(cwd, "package.json"), "utf8")))).map((s) => s.pkg);
+      } catch {
+        stacks = [];
+      }
+    }
+    return stacks;
+  };
+  const report = (req, resource) => {
+    const login = loginOf(req.app);
+    return reportAppLogin(cfg.auth, resource, login, { ...login ? { where: `POST ${login.path}` } : {}, stacks: stacksOf(), log: logReady });
+  };
   const appLoginFor = (req, login) => ({
     label: `POST ${login.path}`,
     fields: login.fields,
@@ -638,7 +653,9 @@ function aiReady(options = {}) {
     }
     if (brokerGate && (path === PRM_ROOT || path === `${PRM_ROOT}${MCP_PATH}`)) {
       const resource = resourceOf(req, path, MCP_PATH);
-      void reportAppLogin(cfg.auth, resource, loginOf(req.app)).then(() => sendWebResponse(res, brokerGate.metadataResponse(req.method, resource)));
+      void report(req, resource).then(
+        (verdict) => verdict === "open" ? void res.writeHead(404).end("not found") : sendWebResponse(res, brokerGate.metadataResponse(req.method, resource))
+      );
       return;
     }
     if (path !== MCP_PATH && !path.startsWith(`${MCP_PATH}/`)) return next();
@@ -654,11 +671,13 @@ function aiReady(options = {}) {
       console.warn("[agentready] oauth gate failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;
-    }) : brokerGate ? reportAppLogin(cfg.auth, resourceOf(req, path, MCP_PATH), loginOf(req.app)).then(() => brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH))).then(async (result) => {
+    }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
+      if (verdict === "open") return {};
+      const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
       if (result.ok) return {};
       await sendWebResponse(res, result.response);
       return null;
-    }, (err) => {
+    }).catch((err) => {
       console.warn("[agentready] broker check failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;

package/dist/scan-preload.cjs

@@ -2077,9 +2077,21 @@ function requireHttpsBaseUrl(optionName, value) {
 // ../core/src/hosted-resolver.ts
 var DEFAULT_TIMEOUT_MS = 5e3;
 var REPORT_TIMEOUT_MS = 3e3;
+var REPORT_REFRESH_MS = 6e4;
 var DEFAULT_MAX_CACHE_MS = 3e4;
 var EXPIRY_SKEW_MS = 6e4;
 var MAX_CACHE_ENTRIES = 500;
+function signInMethodsOf(body) {
+  const methods = body?.signIn?.methods;
+  if (!Array.isArray(methods)) return null;
+  return methods.map((m) => {
+    const { kind, label } = m && typeof m === "object" ? m : {};
+    return {
+      kind: kind === "app-login" || kind === "oauth" || kind === "session" ? kind : "other",
+      label: typeof label === "string" && label.trim() ? label.trim().slice(0, 100) : "a sign-in method"
+    };
+  });
+}
 function createHostedAuthResolver(config) {
   const givenKey = config.key ?? config.licenseKey;
   const projectId = config.projectId ?? (config.key ? parseExposifyKey(config.key)?.projectId : void 0);
@@ -2173,7 +2185,7 @@ function createHostedAuthResolver(config) {
   }
   const sessionWrites = /* @__PURE__ */ new Map();
   const reported = /* @__PURE__ */ new Map();
-  const apiUrl = config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL;
+  const apiUrl = requireHttpsBaseUrl("apiUrl", config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL);
   const info = {
     issuer,
     resource: config.resource,
@@ -2222,21 +2234,34 @@ function createHostedAuthResolver(config) {
     },
     reportLogin(report) {
       const key = JSON.stringify(report);
-      let pending = reported.get(key);
-      if (!pending) {
-        pending = (async () => {
-          const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
-            method: "PUT",
-            headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
-            body: JSON.stringify(report),
-            signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
-          });
-          if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        })();
-        reported.set(key, pending);
+      const send2 = async () => {
+        const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
+          method: "PUT",
+          headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
+          body: JSON.stringify(report),
+          signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
+        });
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        return signInMethodsOf(await res.json().catch(() => null));
+      };
+      const entry2 = reported.get(key);
+      if (!entry2) {
+        const pending = send2();
+        reported.set(key, { answer: pending, at: Date.now() });
         pending.catch(() => reported.delete(key));
+        return pending;
+      }
+      if (!entry2.refreshing && Date.now() - entry2.at >= REPORT_REFRESH_MS) {
+        entry2.refreshing = true;
+        send2().then(
+          (methods) => reported.set(key, { answer: Promise.resolve(methods), at: Date.now() }),
+          () => {
+            entry2.at = Date.now();
+            entry2.refreshing = false;
+          }
+        );
       }
-      return pending;
+      return entry2.answer;
     }
   };
   Object.defineProperty(resolver, HOSTED_RESOLVER, { value: info });
@@ -6483,6 +6508,11 @@ function applyOpenApi(routes, doc) {
 
 // ../core/src/own-login.ts
 init_cjs_shims();
+
+// ../core/src/startup.ts
+init_cjs_shims();
+
+// ../core/src/own-login.ts
 var PASSWORD_NAME = /^(password|passwd|pass|pwd|pin|passcode|secret)$/i;
 var PASSWORD_PART = /(password|passwd|passcode)/i;
 var CONFIRM_NAME = /(confirm|repeat|again|verify|retype|new).*pass|pass.*(confirm|repeat|again|2)$/i;

package/dist/scan-preload.js

@@ -2081,9 +2081,21 @@ function requireHttpsBaseUrl(optionName, value) {
 // ../core/src/hosted-resolver.ts
 var DEFAULT_TIMEOUT_MS = 5e3;
 var REPORT_TIMEOUT_MS = 3e3;
+var REPORT_REFRESH_MS = 6e4;
 var DEFAULT_MAX_CACHE_MS = 3e4;
 var EXPIRY_SKEW_MS = 6e4;
 var MAX_CACHE_ENTRIES = 500;
+function signInMethodsOf(body) {
+  const methods = body?.signIn?.methods;
+  if (!Array.isArray(methods)) return null;
+  return methods.map((m) => {
+    const { kind, label } = m && typeof m === "object" ? m : {};
+    return {
+      kind: kind === "app-login" || kind === "oauth" || kind === "session" ? kind : "other",
+      label: typeof label === "string" && label.trim() ? label.trim().slice(0, 100) : "a sign-in method"
+    };
+  });
+}
 function createHostedAuthResolver(config) {
   const givenKey = config.key ?? config.licenseKey;
   const projectId = config.projectId ?? (config.key ? parseExposifyKey(config.key)?.projectId : void 0);
@@ -2177,7 +2189,7 @@ function createHostedAuthResolver(config) {
   }
   const sessionWrites = /* @__PURE__ */ new Map();
   const reported = /* @__PURE__ */ new Map();
-  const apiUrl = config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL;
+  const apiUrl = requireHttpsBaseUrl("apiUrl", config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL);
   const info = {
     issuer,
     resource: config.resource,
@@ -2226,21 +2238,34 @@ function createHostedAuthResolver(config) {
     },
     reportLogin(report) {
       const key = JSON.stringify(report);
-      let pending = reported.get(key);
-      if (!pending) {
-        pending = (async () => {
-          const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
-            method: "PUT",
-            headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
-            body: JSON.stringify(report),
-            signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
-          });
-          if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        })();
-        reported.set(key, pending);
+      const send2 = async () => {
+        const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
+          method: "PUT",
+          headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
+          body: JSON.stringify(report),
+          signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
+        });
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        return signInMethodsOf(await res.json().catch(() => null));
+      };
+      const entry2 = reported.get(key);
+      if (!entry2) {
+        const pending = send2();
+        reported.set(key, { answer: pending, at: Date.now() });
         pending.catch(() => reported.delete(key));
+        return pending;
+      }
+      if (!entry2.refreshing && Date.now() - entry2.at >= REPORT_REFRESH_MS) {
+        entry2.refreshing = true;
+        send2().then(
+          (methods) => reported.set(key, { answer: Promise.resolve(methods), at: Date.now() }),
+          () => {
+            entry2.at = Date.now();
+            entry2.refreshing = false;
+          }
+        );
       }
-      return pending;
+      return entry2.answer;
     }
   };
   Object.defineProperty(resolver, HOSTED_RESOLVER, { value: info });
@@ -6487,6 +6512,11 @@ function applyOpenApi(routes, doc) {
 
 // ../core/src/own-login.ts
 init_esm_shims();
+
+// ../core/src/startup.ts
+init_esm_shims();
+
+// ../core/src/own-login.ts
 var PASSWORD_NAME = /^(password|passwd|pass|pwd|pin|passcode|secret)$/i;
 var PASSWORD_PART = /(password|passwd|passcode)/i;
 var CONFIRM_NAME = /(confirm|repeat|again|verify|retype|new).*pass|pass.*(confirm|repeat|again|2)$/i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/express",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -26,8 +26,8 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/cli": "0.0.1",
-    "@exposify/core": "0.3.13"
+    "@exposify/cli": "0.0.2",
+    "@exposify/core": "0.3.14"
   },
   "peerDependencies": {
     "express": ">=4 <6"