@exposify/express 0.3.9 → 0.4.0

package/README.md

@@ -33,7 +33,7 @@ Tools get Nest's full paths (global prefix, URI versioning, `RouterModule`
 paths), and tool calls go through Nest itself: guards, pipes, interceptors
 and exception filters apply exactly as for any HTTP client, so a guarded
 route refuses an agent without credentials and a `ValidationPipe` error
-reaches the agent as an actionable 400. `npx exposify-express setup` and
+reaches the agent as an actionable 400. `npx @exposify/express setup` and
 `inspect` find `src/main.ts` from `nest-cli.json` and load it with your
 `ts-node`/`swc-node`. The Fastify platform isn't supported yet. See
 `examples/nest-demo`.
@@ -54,12 +54,12 @@ takes a path to a JSON file, for any Express app with an OpenAPI document.
 Description precedence: `describe()` in code, then
 `exposify.descriptions.json`, then OpenAPI, then the derived text.
 
-## Guided setup: `npx exposify-express setup`
+## Guided setup: `npx @exposify/express setup`
 
 Instead of writing the config by hand, run this in your app's directory:
 
 ```bash
-npx exposify-express setup
+npx @exposify/express setup
 ```
 
 It loads your app without starting a server, lists every endpoint (reads
@@ -110,7 +110,7 @@ give your tools real descriptions (below).
 
 **Tool descriptions.** Agents pick tools by their descriptions, and by default
 they get one derived from the route ("Create an order (POST /orders)").
-`setup`'s step 5, or `npx exposify-express describe` any time, replaces those:
+`setup`'s step 5, or `npx @exposify/express describe` any time, replaces those:
 
 - `a` sends each route's handler source to Exposify's description service,
   which writes a proposal with an LLM (`--no-source` sends only method, path
@@ -137,15 +137,15 @@ flagged for you to check. In CI, `describe --check` exits 1 if a tool has no
 description or one is out of date, and `describe --ci` writes AI
 descriptions for read routes only, listing the writes for a person.
 
-`npx exposify-express inspect` prints every route with its tool name,
+`npx @exposify/express inspect` prints every route with its tool name,
 whether agents get it, and why (`--json` for scripts): the answer to "why
 isn't my route showing up?".
 
-**Catch tool changes in CI:** `npx exposify-express inspect --snapshot` writes
+**Catch tool changes in CI:** `npx @exposify/express inspect --snapshot` writes
 `exposify.tools.json` (each route agents can call, and its tool name).
 `setup` offers to save the same file as its last question (default no;
 `--snapshot` to save without asking). Commit it, and run
-`npx exposify-express inspect --check` in CI: it exits 1,
+`npx @exposify/express inspect --check` in CI: it exits 1,
 listing what changed, when a route becomes a tool (writes flagged), stops
 being one, or gets a new tool name. Re-run `--snapshot` when the change is
 intended, so it shows up in the PR diff for review.
@@ -168,11 +168,30 @@ signs in with your app's own login, with no code:
   as that person; cookies you set later are kept; a 401 or a redirect to the
   login ends the connection, so the assistant asks to connect again.
 - `aiReady()` tells Exposify about the login and its MCP address before
-  answering `/mcp`, so there's nothing to add in the dashboard.
+  answering `/mcp`, so there's nothing to add in the dashboard. The address
+  comes from the request's `Host` (and `X-Forwarded-Host` only when you've
+  set Express's `trust proxy`, as you should behind a proxy). The first
+  domain reported is used as is; a new domain after that waits for you to
+  approve it on the dashboard, since any client can send a made-up `Host`.
 
 `login: { path, fields, body? }` names another route; `login: false` turns
 it off. Routers introspection can't see (sub-apps) need `mounts`.
 
+Logins in two steps work too: when the login asks for a code next (a
+redirect to a code page, or `{ mfaRequired: true }`), the form asks for it
+and sends your second-step route (`POST /auth/2fa/verify`: named like
+`verify`, `2fa`, `otp`, one code, sets the session) the code with the
+cookies the first step set. Passwordless (an email, then a code) is found the
+same way. `loginVerify: { path, fields, body? }` names the second step;
+`loginVerify: false` turns it off.
+
+**No login found, and no sign-in method in the dashboard?** Then agents use
+your app signed out: `/mcp` doesn't ask them to sign in, and your own checks
+decide what they can do. The startup log says which it is
+(`[agentready] How agents sign in: ...`), and so does the dashboard's "How
+agents sign in" page. Adding a sign-in method there takes effect within a
+minute.
+
 ## "Click Connect and log in" (OAuth)
 
 By default the MCP client has to be handed a token by hand. If your app's

package/dist/cli.js

@@ -227,7 +227,7 @@ ${last.output}`)) {
 
 // bin/adapter.ts
 var expressAdapter = {
-  bin: "exposify-express",
+  bin: "npx @exposify/express",
   entryExample: "src/server.ts",
   entryHelp: "The file that creates your Express app",
   locate(cwd, entryFlag) {

package/dist/index.cjs

@@ -31,6 +31,7 @@ __export(index_exports, {
   routesFromExpress: () => routesFromExpress
 });
 module.exports = __toCommonJS(index_exports);
+var import_node_fs = require("fs");
 var import_node_path3 = require("path");
 var import_core6 = require("@exposify/core");
 var import_node2 = require("@exposify/core/node");
@@ -503,6 +504,26 @@ function parsesJson(app) {
   if (names.includes("urlencodedParser")) return false;
   return null;
 }
+var LOGIN_RULE = { not: import_core5.NOT_A_LOGIN, name: import_core5.LOGIN_NAME, mustBeNamed: false, fields: (n) => (0, import_core5.loginFields)(n), session: true };
+var VERIFY_RULE = { not: import_core5.NOT_A_VERIFY, name: import_core5.VERIFY_NAME, mustBeNamed: true, fields: (n, named) => (0, import_core5.verifyFields)(n, named), session: true };
+var START_RULE = { not: import_core5.NOT_A_LOGIN, name: new RegExp(`${import_core5.LOGIN_NAME.source}|${import_core5.START_NAME.source}`, "i"), mustBeNamed: true, fields: (n) => (0, import_core5.startFields)(n), session: false };
+function candidates(app, routes, rule) {
+  const out = [];
+  for (const route of routes) {
+    if (route.method !== "POST" || route.params.length > 0 || rule.not.test(route.path)) continue;
+    const named = rule.name.test(route.path);
+    if (rule.mustBeNamed && !named) continue;
+    const handlers = routeHandlers.get(route) ?? [];
+    const own = sourceOf(handlers.at(-1));
+    const all = handlers.map(sourceOf).join("\n");
+    const fields = rule.fields(bodyFieldsOf(own), named);
+    if (!fields) continue;
+    if (rule.session && !import_core5.LOGIN_NAME.test(route.path) && !SESSION_CODE.test(all)) continue;
+    out.push({ step: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
+  }
+  out.sort((a, b) => Number(b.named) - Number(a.named) || a.step.fields.length - b.step.fields.length);
+  return out.map((c) => c.step);
+}
 function findExpressLogin(app, mounts) {
   let routes;
   try {
@@ -510,21 +531,21 @@ function findExpressLogin(app, mounts) {
   } catch {
     return null;
   }
-  const candidates = [];
-  for (const route of routes) {
-    if (route.method !== "POST" || route.params.length > 0 || import_core5.NOT_A_LOGIN.test(route.path)) continue;
-    const handlers = routeHandlers.get(route) ?? [];
-    const own = sourceOf(handlers.at(-1));
-    const all = handlers.map(sourceOf).join("\n");
-    const fields = (0, import_core5.loginFields)(bodyFieldsOf(own));
-    if (!fields) continue;
-    const named = import_core5.LOGIN_NAME.test(route.path);
-    if (!named && !SESSION_CODE.test(all)) continue;
-    candidates.push({ login: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
+  const verifies = candidates(app, routes, VERIFY_RULE);
+  const logins = candidates(app, routes, LOGIN_RULE);
+  if (logins.length > 0) {
+    const [first2, ...others2] = logins;
+    return { login: { ...first2, ...verifies[0] ? { verify: verifies[0] } : {} }, others: others2.map((c) => `POST ${c.path}`) };
+  }
+  const pairs = [];
+  for (const start of candidates(app, routes, START_RULE)) {
+    const who = new Set(start.fields.filter((f) => f.kind === "identity").map((f) => f.name));
+    const verify = verifies.find((v) => v.fields.some((f) => who.has(f.name))) ?? verifies.find((v) => !v.fields.some((f) => f.kind === "identity"));
+    if (verify) pairs.push({ ...start, passwordless: true, verify });
   }
-  if (candidates.length === 0) return null;
-  candidates.sort((a, b) => Number(b.named) - Number(a.named) || a.login.fields.length - b.login.fields.length);
-  return { login: candidates[0].login, others: candidates.slice(1).map((c) => `POST ${c.login.path}`) };
+  if (pairs.length === 0) return null;
+  const [first, ...others] = pairs;
+  return { login: first, others: others.map((c) => `POST ${c.path}`) };
 }
 
 // src/index.ts
@@ -557,7 +578,7 @@ function aiReady(options = {}) {
     const original = String(req.originalUrl ?? req.url).split("?")[0];
     const prefix = original.endsWith(path) ? original.slice(0, original.length - path.length) : "";
     const local = `${req.protocol ?? "http"}://${req.headers.host ?? "localhost"}${prefix}${mcpPath}`;
-    return brokerGate.resourceFor((0, import_core6.publicRequestUrl)(local, headersOf(req)));
+    return brokerGate.resourceFor((0, import_core6.publicRequestUrl)(local, headersOf(req), { trustForwardedHost: trustsProxy(req) }));
   };
   const cwd = options.cwd ?? process.cwd();
   const mounts = options.mounts;
@@ -567,29 +588,67 @@ function aiReady(options = {}) {
     if (!brokerInfo || options.login === false) return null;
     if (!loginFound) {
       const given = options.login;
-      const value = given ? { path: given.path, fields: given.fields.map((name) => ({ name, kind: (0, import_core6.fieldKind)(name) })), body: given.body ?? "json" } : findExpressLogin(app, mounts)?.login ?? null;
-      loginFound = { value };
-      if (value) {
-        cfg.signedOutPaths = [value.path];
-        if (logReady) console.log(`${LOG_PREFIX} AI assistants sign in with your app's own login (POST ${value.path}) at ${MCP_PATH}/login`);
+      let value = given ? { path: given.path, fields: given.fields.map((name) => ({ name, kind: (0, import_core6.fieldKind)(name) })), body: given.body ?? "json" } : findExpressLogin(app, mounts)?.login ?? null;
+      const verify = options.loginVerify;
+      if (value && verify !== void 0) {
+        const { verify: _found, ...first } = value;
+        const kind = (name) => (0, import_core6.verifyFields)([name], true)?.[0]?.kind ?? (0, import_core6.fieldKind)(name);
+        value = verify === false ? first : { ...first, verify: { path: verify.path, fields: verify.fields.map((name) => ({ name, kind: kind(name) })), body: verify.body ?? "json" } };
       }
+      loginFound = { value };
+      if (value) cfg.signedOutPaths = [value.path];
     }
     return loginFound.value;
   };
-  const appLoginFor = (req, login) => ({
-    label: `POST ${login.path}`,
-    fields: login.fields,
-    signedOutPaths: [login.path],
-    attempt: (values) => {
-      const body = login.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
-      const request = new Request(`http://app.internal${login.path}`, {
+  let stacks;
+  const stacksOf = () => {
+    if (!stacks) {
+      try {
+        stacks = (0, import_core6.authStacksOf)((0, import_core6.dependencyNames)(JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path3.join)(cwd, "package.json"), "utf8")))).map((s) => s.pkg);
+      } catch {
+        stacks = [];
+      }
+    }
+    return stacks;
+  };
+  const report = (req, resource) => {
+    const login = loginOf(req.app);
+    const where = login ? `POST ${login.path}${login.verify ? `, then a code: POST ${login.verify.path}` : ""}` : void 0;
+    return (0, import_core6.reportAppLogin)(cfg.auth, resource, login, { ...where ? { where } : {}, stacks: stacksOf(), log: logReady });
+  };
+  const appLoginFor = (req, login) => {
+    const send = (step, values, reading, cookies = []) => {
+      const body = step.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
+      const request = new Request(`http://app.internal${step.path}`, {
         method: "POST",
-        headers: { "content-type": login.body === "form" ? "application/x-www-form-urlencoded" : "application/json", ...req.headers["user-agent"] ? { "user-agent": String(req.headers["user-agent"]) } : {} },
+        headers: {
+          "content-type": step.body === "form" ? "application/x-www-form-urlencoded" : "application/json",
+          ...req.headers["user-agent"] ? { "user-agent": String(req.headers["user-agent"]) } : {},
+          ...cookies.length ? { cookie: cookies.map((c) => `${c.name}=${c.value}`).join("; ") } : {}
+        },
         body
       });
-      return runAsCaller(callerOf(req), () => appDispatcher(req.app)(request)).then(import_core6.loginResultFromResponse);
-    }
-  });
+      return runAsCaller(callerOf(req), () => appDispatcher(req.app)(request)).then((res) => (0, import_core6.loginResultFromResponse)(res, reading));
+    };
+    const verify = login.verify;
+    return {
+      label: `POST ${login.path}`,
+      fields: login.fields,
+      signedOutPaths: [login.path],
+      ...login.passwordless ? { passwordless: true } : {},
+      attempt: (values) => send(login, values, {
+        ...verify ? { verifyPaths: [verify.path], verifyFields: verify.fields.map((f) => f.name) } : {},
+        ...login.passwordless ? { start: true } : {}
+      }),
+      ...verify ? {
+        verify: {
+          label: `POST ${verify.path}`,
+          fields: verify.fields,
+          attempt: (values, ctx) => send(verify, values, { carried: ctx.carry.cookies, verifyPaths: [verify.path] }, ctx.carry.cookies)
+        }
+      } : {}
+    };
+  };
   const descriptions = options.descriptions;
   const openapi = options.openapi;
   try {
@@ -633,7 +692,9 @@ function aiReady(options = {}) {
     }
     if (brokerGate && (path === PRM_ROOT || path === `${PRM_ROOT}${MCP_PATH}`)) {
       const resource = resourceOf(req, path, MCP_PATH);
-      void (0, import_core6.reportAppLogin)(cfg.auth, resource, loginOf(req.app)).then(() => sendWebResponse(res, brokerGate.metadataResponse(req.method, resource)));
+      void report(req, resource).then(
+        (verdict) => verdict === "open" ? void res.writeHead(404).end("not found") : sendWebResponse(res, brokerGate.metadataResponse(req.method, resource))
+      );
       return;
     }
     if (path !== MCP_PATH && !path.startsWith(`${MCP_PATH}/`)) return next();
@@ -649,11 +710,13 @@ function aiReady(options = {}) {
       console.warn("[agentready] oauth gate failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;
-    }) : brokerGate ? (0, import_core6.reportAppLogin)(cfg.auth, resourceOf(req, path, MCP_PATH), loginOf(req.app)).then(() => brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH))).then(async (result) => {
+    }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
+      if (verdict === "open") return {};
+      const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
       if (result.ok) return {};
       await sendWebResponse(res, result.response);
       return null;
-    }, (err) => {
+    }).catch((err) => {
       console.warn("[agentready] broker check failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;
@@ -695,7 +758,7 @@ function aiReady(options = {}) {
   async function serveLoginPage(req, res, login) {
     const original = String(req.originalUrl ?? req.url);
     const local = `${req.protocol ?? "http"}://${req.headers.host ?? "localhost"}${original}`;
-    const url = new URL((0, import_core6.publicRequestUrl)(local, headersOf(req)));
+    const url = new URL((0, import_core6.publicRequestUrl)(local, headersOf(req), { trustForwardedHost: trustsProxy(req) }));
     url.search = new URL(local).search;
     let body;
     if (req.method === "POST") {
@@ -706,7 +769,7 @@ function aiReady(options = {}) {
         let size = 0;
         for await (const chunk of req) {
           size += chunk.length;
-          if (size > 16 * 1024) break;
+          if (size > 32 * 1024) break;
           chunks.push(chunk);
         }
         body = Buffer.concat(chunks).toString("utf8");
@@ -793,6 +856,9 @@ async function initialize(app, cfg, cwd, mounts, extras, onReady) {
   }
   return (0, import_node2.createNodeMcpHandler)({ getSurface, getKb, cfg });
 }
+function trustsProxy(req) {
+  return Boolean(req.app?.get?.("trust proxy"));
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AIREADY_OPTIONS_TAG,

package/dist/index.d.cts

@@ -31,6 +31,18 @@ interface ExpressAiReadyOptions extends AgentReadyOptions {
         fields: string[];
         body?: "json" | "form";
     };
+    /**
+     * The login's second step, when it asks for a code after the first (a
+     * password, then a code; or an email, then a code). Found by itself (a
+     * POST route named like `verify`, `2fa`, `otp` that reads one code and
+     * sets the session); name another route (`{ path, fields }`), or `false`
+     * for none.
+     */
+    loginVerify?: false | {
+        path: string;
+        fields: string[];
+        body?: "json" | "form";
+    };
     /** Where docs globs and the .exposify cache resolve. Default: process.cwd() */
     cwd?: string;
     /**
@@ -45,7 +57,7 @@ interface ExpressAiReadyOptions extends AgentReadyOptions {
      */
     mounts?: Record<string, unknown>;
     /**
-     * Tool descriptions file written by `exposify-express setup`/`describe`.
+     * Tool descriptions file written by `@exposify/express setup`/`describe`.
      * Default: exposify.descriptions.json in `cwd`, if present. `false` ignores it.
      * describe() text in code still wins over it.
      */

package/dist/index.d.ts

@@ -31,6 +31,18 @@ interface ExpressAiReadyOptions extends AgentReadyOptions {
         fields: string[];
         body?: "json" | "form";
     };
+    /**
+     * The login's second step, when it asks for a code after the first (a
+     * password, then a code; or an email, then a code). Found by itself (a
+     * POST route named like `verify`, `2fa`, `otp` that reads one code and
+     * sets the session); name another route (`{ path, fields }`), or `false`
+     * for none.
+     */
+    loginVerify?: false | {
+        path: string;
+        fields: string[];
+        body?: "json" | "form";
+    };
     /** Where docs globs and the .exposify cache resolve. Default: process.cwd() */
     cwd?: string;
     /**
@@ -45,7 +57,7 @@ interface ExpressAiReadyOptions extends AgentReadyOptions {
      */
     mounts?: Record<string, unknown>;
     /**
-     * Tool descriptions file written by `exposify-express setup`/`describe`.
+     * Tool descriptions file written by `@exposify/express setup`/`describe`.
      * Default: exposify.descriptions.json in `cwd`, if present. `false` ignores it.
      * describe() text in code still wins over it.
      */

package/dist/index.js

@@ -6,11 +6,14 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/index.ts
+import { readFileSync } from "fs";
 import { join as join3 } from "path";
 import {
+  authStacksOf,
   countTools,
   createBrokerGate,
   createOAuthGate,
+  dependencyNames,
   describeAuth,
   formatFailed,
   formatReady,
@@ -21,6 +24,7 @@ import {
   loginResultFromResponse,
   publicRequestUrl,
   reportAppLogin,
+  verifyFields as verifyFields2,
   resolveOptions,
   routeToolsPhrase,
   startupLogEnabled
@@ -472,7 +476,7 @@ async function readPackageInfo(cwd) {
 }
 
 // src/login.ts
-import { LOGIN_NAME, NOT_A_LOGIN, loginFields } from "@exposify/core";
+import { LOGIN_NAME, NOT_A_LOGIN, NOT_A_VERIFY, START_NAME, VERIFY_NAME, loginFields, startFields, verifyFields } from "@exposify/core";
 var SESSION_CODE = /\bres\.cookie\(|\.session\b|\.login\(|\blogIn\(|set-cookie|setHeader\(\s*["']set-cookie|\bjwt\.sign\(|new\s+SignJWT|\bsign\(|createSession|issueToken|generateToken/i;
 function bodyFieldsOf(source) {
   const names = /* @__PURE__ */ new Set();
@@ -501,6 +505,26 @@ function parsesJson(app) {
   if (names.includes("urlencodedParser")) return false;
   return null;
 }
+var LOGIN_RULE = { not: NOT_A_LOGIN, name: LOGIN_NAME, mustBeNamed: false, fields: (n) => loginFields(n), session: true };
+var VERIFY_RULE = { not: NOT_A_VERIFY, name: VERIFY_NAME, mustBeNamed: true, fields: (n, named) => verifyFields(n, named), session: true };
+var START_RULE = { not: NOT_A_LOGIN, name: new RegExp(`${LOGIN_NAME.source}|${START_NAME.source}`, "i"), mustBeNamed: true, fields: (n) => startFields(n), session: false };
+function candidates(app, routes, rule) {
+  const out = [];
+  for (const route of routes) {
+    if (route.method !== "POST" || route.params.length > 0 || rule.not.test(route.path)) continue;
+    const named = rule.name.test(route.path);
+    if (rule.mustBeNamed && !named) continue;
+    const handlers = routeHandlers.get(route) ?? [];
+    const own = sourceOf(handlers.at(-1));
+    const all = handlers.map(sourceOf).join("\n");
+    const fields = rule.fields(bodyFieldsOf(own), named);
+    if (!fields) continue;
+    if (rule.session && !LOGIN_NAME.test(route.path) && !SESSION_CODE.test(all)) continue;
+    out.push({ step: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
+  }
+  out.sort((a, b) => Number(b.named) - Number(a.named) || a.step.fields.length - b.step.fields.length);
+  return out.map((c) => c.step);
+}
 function findExpressLogin(app, mounts) {
   let routes;
   try {
@@ -508,21 +532,21 @@ function findExpressLogin(app, mounts) {
   } catch {
     return null;
   }
-  const candidates = [];
-  for (const route of routes) {
-    if (route.method !== "POST" || route.params.length > 0 || NOT_A_LOGIN.test(route.path)) continue;
-    const handlers = routeHandlers.get(route) ?? [];
-    const own = sourceOf(handlers.at(-1));
-    const all = handlers.map(sourceOf).join("\n");
-    const fields = loginFields(bodyFieldsOf(own));
-    if (!fields) continue;
-    const named = LOGIN_NAME.test(route.path);
-    if (!named && !SESSION_CODE.test(all)) continue;
-    candidates.push({ login: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
+  const verifies = candidates(app, routes, VERIFY_RULE);
+  const logins = candidates(app, routes, LOGIN_RULE);
+  if (logins.length > 0) {
+    const [first2, ...others2] = logins;
+    return { login: { ...first2, ...verifies[0] ? { verify: verifies[0] } : {} }, others: others2.map((c) => `POST ${c.path}`) };
+  }
+  const pairs = [];
+  for (const start of candidates(app, routes, START_RULE)) {
+    const who = new Set(start.fields.filter((f) => f.kind === "identity").map((f) => f.name));
+    const verify = verifies.find((v) => v.fields.some((f) => who.has(f.name))) ?? verifies.find((v) => !v.fields.some((f) => f.kind === "identity"));
+    if (verify) pairs.push({ ...start, passwordless: true, verify });
   }
-  if (candidates.length === 0) return null;
-  candidates.sort((a, b) => Number(b.named) - Number(a.named) || a.login.fields.length - b.login.fields.length);
-  return { login: candidates[0].login, others: candidates.slice(1).map((c) => `POST ${c.login.path}`) };
+  if (pairs.length === 0) return null;
+  const [first, ...others] = pairs;
+  return { login: first, others: others.map((c) => `POST ${c.path}`) };
 }
 
 // src/index.ts
@@ -562,7 +586,7 @@ function aiReady(options = {}) {
     const original = String(req.originalUrl ?? req.url).split("?")[0];
     const prefix = original.endsWith(path) ? original.slice(0, original.length - path.length) : "";
     const local = `${req.protocol ?? "http"}://${req.headers.host ?? "localhost"}${prefix}${mcpPath}`;
-    return brokerGate.resourceFor(publicRequestUrl(local, headersOf(req)));
+    return brokerGate.resourceFor(publicRequestUrl(local, headersOf(req), { trustForwardedHost: trustsProxy(req) }));
   };
   const cwd = options.cwd ?? process.cwd();
   const mounts = options.mounts;
@@ -572,29 +596,67 @@ function aiReady(options = {}) {
     if (!brokerInfo || options.login === false) return null;
     if (!loginFound) {
       const given = options.login;
-      const value = given ? { path: given.path, fields: given.fields.map((name) => ({ name, kind: fieldKind(name) })), body: given.body ?? "json" } : findExpressLogin(app, mounts)?.login ?? null;
-      loginFound = { value };
-      if (value) {
-        cfg.signedOutPaths = [value.path];
-        if (logReady) console.log(`${LOG_PREFIX} AI assistants sign in with your app's own login (POST ${value.path}) at ${MCP_PATH}/login`);
+      let value = given ? { path: given.path, fields: given.fields.map((name) => ({ name, kind: fieldKind(name) })), body: given.body ?? "json" } : findExpressLogin(app, mounts)?.login ?? null;
+      const verify = options.loginVerify;
+      if (value && verify !== void 0) {
+        const { verify: _found, ...first } = value;
+        const kind = (name) => verifyFields2([name], true)?.[0]?.kind ?? fieldKind(name);
+        value = verify === false ? first : { ...first, verify: { path: verify.path, fields: verify.fields.map((name) => ({ name, kind: kind(name) })), body: verify.body ?? "json" } };
       }
+      loginFound = { value };
+      if (value) cfg.signedOutPaths = [value.path];
     }
     return loginFound.value;
   };
-  const appLoginFor = (req, login) => ({
-    label: `POST ${login.path}`,
-    fields: login.fields,
-    signedOutPaths: [login.path],
-    attempt: (values) => {
-      const body = login.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
-      const request = new Request(`http://app.internal${login.path}`, {
+  let stacks;
+  const stacksOf = () => {
+    if (!stacks) {
+      try {
+        stacks = authStacksOf(dependencyNames(JSON.parse(readFileSync(join3(cwd, "package.json"), "utf8")))).map((s) => s.pkg);
+      } catch {
+        stacks = [];
+      }
+    }
+    return stacks;
+  };
+  const report = (req, resource) => {
+    const login = loginOf(req.app);
+    const where = login ? `POST ${login.path}${login.verify ? `, then a code: POST ${login.verify.path}` : ""}` : void 0;
+    return reportAppLogin(cfg.auth, resource, login, { ...where ? { where } : {}, stacks: stacksOf(), log: logReady });
+  };
+  const appLoginFor = (req, login) => {
+    const send = (step, values, reading, cookies = []) => {
+      const body = step.body === "form" ? new URLSearchParams(values).toString() : JSON.stringify(values);
+      const request = new Request(`http://app.internal${step.path}`, {
         method: "POST",
-        headers: { "content-type": login.body === "form" ? "application/x-www-form-urlencoded" : "application/json", ...req.headers["user-agent"] ? { "user-agent": String(req.headers["user-agent"]) } : {} },
+        headers: {
+          "content-type": step.body === "form" ? "application/x-www-form-urlencoded" : "application/json",
+          ...req.headers["user-agent"] ? { "user-agent": String(req.headers["user-agent"]) } : {},
+          ...cookies.length ? { cookie: cookies.map((c) => `${c.name}=${c.value}`).join("; ") } : {}
+        },
         body
       });
-      return runAsCaller(callerOf(req), () => appDispatcher(req.app)(request)).then(loginResultFromResponse);
-    }
-  });
+      return runAsCaller(callerOf(req), () => appDispatcher(req.app)(request)).then((res) => loginResultFromResponse(res, reading));
+    };
+    const verify = login.verify;
+    return {
+      label: `POST ${login.path}`,
+      fields: login.fields,
+      signedOutPaths: [login.path],
+      ...login.passwordless ? { passwordless: true } : {},
+      attempt: (values) => send(login, values, {
+        ...verify ? { verifyPaths: [verify.path], verifyFields: verify.fields.map((f) => f.name) } : {},
+        ...login.passwordless ? { start: true } : {}
+      }),
+      ...verify ? {
+        verify: {
+          label: `POST ${verify.path}`,
+          fields: verify.fields,
+          attempt: (values, ctx) => send(verify, values, { carried: ctx.carry.cookies, verifyPaths: [verify.path] }, ctx.carry.cookies)
+        }
+      } : {}
+    };
+  };
   const descriptions = options.descriptions;
   const openapi = options.openapi;
   try {
@@ -638,7 +700,9 @@ function aiReady(options = {}) {
     }
     if (brokerGate && (path === PRM_ROOT || path === `${PRM_ROOT}${MCP_PATH}`)) {
       const resource = resourceOf(req, path, MCP_PATH);
-      void reportAppLogin(cfg.auth, resource, loginOf(req.app)).then(() => sendWebResponse(res, brokerGate.metadataResponse(req.method, resource)));
+      void report(req, resource).then(
+        (verdict) => verdict === "open" ? void res.writeHead(404).end("not found") : sendWebResponse(res, brokerGate.metadataResponse(req.method, resource))
+      );
       return;
     }
     if (path !== MCP_PATH && !path.startsWith(`${MCP_PATH}/`)) return next();
@@ -654,11 +718,13 @@ function aiReady(options = {}) {
       console.warn("[agentready] oauth gate failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;
-    }) : brokerGate ? reportAppLogin(cfg.auth, resourceOf(req, path, MCP_PATH), loginOf(req.app)).then(() => brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH))).then(async (result) => {
+    }) : brokerGate ? report(req, resourceOf(req, path, MCP_PATH)).then(async (verdict) => {
+      if (verdict === "open") return {};
+      const result = await brokerGate.check(headersOf(req), resourceOf(req, path, MCP_PATH));
       if (result.ok) return {};
       await sendWebResponse(res, result.response);
       return null;
-    }, (err) => {
+    }).catch((err) => {
       console.warn("[agentready] broker check failed:", err);
       if (!res.headersSent) res.writeHead(503).end("authorization check failed");
       return null;
@@ -700,7 +766,7 @@ function aiReady(options = {}) {
   async function serveLoginPage(req, res, login) {
     const original = String(req.originalUrl ?? req.url);
     const local = `${req.protocol ?? "http"}://${req.headers.host ?? "localhost"}${original}`;
-    const url = new URL(publicRequestUrl(local, headersOf(req)));
+    const url = new URL(publicRequestUrl(local, headersOf(req), { trustForwardedHost: trustsProxy(req) }));
     url.search = new URL(local).search;
     let body;
     if (req.method === "POST") {
@@ -711,7 +777,7 @@ function aiReady(options = {}) {
         let size = 0;
         for await (const chunk of req) {
           size += chunk.length;
-          if (size > 16 * 1024) break;
+          if (size > 32 * 1024) break;
           chunks.push(chunk);
         }
         body = Buffer.concat(chunks).toString("utf8");
@@ -798,6 +864,9 @@ async function initialize(app, cfg, cwd, mounts, extras, onReady) {
   }
   return createNodeMcpHandler({ getSurface, getKb, cfg });
 }
+function trustsProxy(req) {
+  return Boolean(req.app?.get?.("trust proxy"));
+}
 export {
   AIREADY_OPTIONS_TAG,
   aiReady,

package/dist/scan-preload.cjs

@@ -2074,12 +2074,83 @@ function requireHttpsBaseUrl(optionName, value) {
   return value.replace(/\/+$/, "");
 }
 
+// ../core/src/seal.ts
+init_cjs_shims();
+function toBase64Url(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+  if (!/^[A-Za-z0-9_-]*$/.test(text)) return null;
+  try {
+    const bin = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+function createSealer(secret, label) {
+  let key;
+  const keyOf2 = () => key ??= crypto.subtle.digest("SHA-256", new TextEncoder().encode(`${label}
+${secret}`)).then((material) => crypto.subtle.importKey("raw", material, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]));
+  return {
+    async seal(text) {
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+      const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await keyOf2(), new TextEncoder().encode(text)));
+      const out = new Uint8Array(iv.length + sealed.length);
+      out.set(iv);
+      out.set(sealed, iv.length);
+      return toBase64Url(out);
+    },
+    async unseal(token) {
+      const bytes = fromBase64Url(token);
+      if (!bytes || bytes.length < 12 + 16) return null;
+      try {
+        const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: bytes.slice(0, 12) }, await keyOf2(), bytes.slice(12));
+        return new TextDecoder().decode(plain);
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+
+// ../core/src/login-theme.ts
+init_cjs_shims();
+var HEX = /^#[0-9a-f]{6}$/i;
+var KEYS = ["accent", "background", "surface", "text"];
+function parseLoginTheme(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const o = raw;
+  if (Object.keys(o).length !== KEYS.length) return null;
+  const out = {};
+  for (const k of KEYS) {
+    const v = o[k];
+    if (typeof v !== "string" || !HEX.test(v)) return null;
+    out[k] = v.toLowerCase();
+  }
+  return out;
+}
+
 // ../core/src/hosted-resolver.ts
 var DEFAULT_TIMEOUT_MS = 5e3;
 var REPORT_TIMEOUT_MS = 3e3;
+var REPORT_REFRESH_MS = 6e4;
 var DEFAULT_MAX_CACHE_MS = 3e4;
 var EXPIRY_SKEW_MS = 6e4;
 var MAX_CACHE_ENTRIES = 500;
+function signInMethodsOf(body) {
+  const methods = body?.signIn?.methods;
+  if (!Array.isArray(methods)) return null;
+  return methods.map((m) => {
+    const { kind, label } = m && typeof m === "object" ? m : {};
+    return {
+      kind: kind === "app-login" || kind === "oauth" || kind === "session" ? kind : "other",
+      label: typeof label === "string" && label.trim() ? label.trim().slice(0, 100) : "a sign-in method"
+    };
+  });
+}
 function createHostedAuthResolver(config) {
   const givenKey = config.key ?? config.licenseKey;
   const projectId = config.projectId ?? (config.key ? parseExposifyKey(config.key)?.projectId : void 0);
@@ -2173,9 +2244,13 @@ function createHostedAuthResolver(config) {
   }
   const sessionWrites = /* @__PURE__ */ new Map();
   const reported = /* @__PURE__ */ new Map();
-  const apiUrl = config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL;
+  let passwordDirect;
+  const apiUrl = requireHttpsBaseUrl("apiUrl", config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL);
+  const stepSealer = createSealer(licenseKey, "exposify login-step v1");
   const info = {
     issuer,
+    sealLoginStep: (text) => stepSealer.seal(text),
+    unsealLoginStep: (token) => stepSealer.unseal(token),
     resource: config.resource,
     // Answers from the same cache, so the tool call right after a check doesn't ask the broker again.
     async check(authorization) {
@@ -2192,7 +2267,8 @@ function createHostedAuthResolver(config) {
         live: true,
         clientName: typeof res.body.clientName === "string" ? res.body.clientName : "An AI assistant",
         appName: typeof res.body.appName === "string" ? res.body.appName : null,
-        resource: typeof res.body.resource === "string" ? res.body.resource : null
+        resource: typeof res.body.resource === "string" ? res.body.resource : null,
+        theme: parseLoginTheme(res.body.theme)
       };
     },
     async completeLogin(handle, session) {
@@ -2220,23 +2296,39 @@ function createHostedAuthResolver(config) {
       cache.delete(authorization);
       await brokerPost("session-ended", {}, authorization);
     },
+    supabasePasswordDirect: () => passwordDirect,
     reportLogin(report) {
       const key = JSON.stringify(report);
-      let pending = reported.get(key);
-      if (!pending) {
-        pending = (async () => {
-          const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
-            method: "PUT",
-            headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
-            body: JSON.stringify(report),
-            signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
-          });
-          if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        })();
-        reported.set(key, pending);
+      const send2 = async () => {
+        const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
+          method: "PUT",
+          headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
+          body: JSON.stringify(report),
+          signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
+        });
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const body = await res.json().catch(() => null);
+        passwordDirect = typeof body?.supabasePasswordDirect === "boolean" ? body.supabasePasswordDirect : void 0;
+        return signInMethodsOf(body);
+      };
+      const entry2 = reported.get(key);
+      if (!entry2) {
+        const pending = send2();
+        reported.set(key, { answer: pending, at: Date.now() });
         pending.catch(() => reported.delete(key));
+        return pending;
+      }
+      if (!entry2.refreshing && Date.now() - entry2.at >= REPORT_REFRESH_MS) {
+        entry2.refreshing = true;
+        send2().then(
+          (methods) => reported.set(key, { answer: Promise.resolve(methods), at: Date.now() }),
+          () => {
+            entry2.at = Date.now();
+            entry2.refreshing = false;
+          }
+        );
       }
-      return pending;
+      return entry2.answer;
     }
   };
   Object.defineProperty(resolver, HOSTED_RESOLVER, { value: info });
@@ -6483,15 +6575,26 @@ function applyOpenApi(routes, doc) {
 
 // ../core/src/own-login.ts
 init_cjs_shims();
+
+// ../core/src/startup.ts
+init_cjs_shims();
+
+// ../core/src/own-login.ts
 var PASSWORD_NAME = /^(password|passwd|pass|pwd|pin|passcode|secret)$/i;
 var PASSWORD_PART = /(password|passwd|passcode)/i;
 var CONFIRM_NAME = /(confirm|repeat|again|verify|retype|new).*pass|pass.*(confirm|repeat|again|2)$/i;
 var IDENTITY_NAME = /^(email|e-mail|mail|username|user|login|name|phone|phonenumber|phone_number|mobile|account|identifier|handle)$/i;
+var CODE_NAME = /^(code|otp|totp|pin[-_]?code|(mfa|2fa|two[-_]?factor|verification|verify|sms|one[-_]?time|otp|totp|backup|recovery|auth|security|login|access)[-_]?code)$/i;
 var NOT_A_LOGIN = /(register|signup|sign[-_]?up|create[-_]?(account|user)|join|logout|log[-_]?out|signout|sign[-_]?out|reset|forgot|change[-_]?password|invite|verify)/i;
 var LOGIN_NAME = /(^|[^a-z])(login|log[-_]?in|signin|sign[-_]?in|authenticate|session|sessions|auth)([^a-z]|$)/i;
+var VERIFY_NAME = /(verify|verification|2fa|two[-_]?factor|mfa|otp|totp|challenge|code)/i;
+var NOT_A_VERIFY = /(register|signup|sign[-_]?up|verify[-_]?email|email[-_]?verif|confirm[-_]?email|reset|forgot|invite|coupon|promo|discount|voucher|gift|referral)/i;
+var START_NAME = /((send|request|email|text|sms)[-_]?(code|otp|token|link))|passwordless|magic|otp/i;
+var bareName = (name) => name.replace(/^.*[.[]/, "").replace(/]$/, "");
 function fieldKind(name) {
-  const bare = name.replace(/^.*[.[]/, "").replace(/]$/, "");
+  const bare = bareName(name);
   if (PASSWORD_NAME.test(bare) || PASSWORD_PART.test(bare)) return "password";
+  if (CODE_NAME.test(bare)) return "code";
   if (IDENTITY_NAME.test(bare) || /email/i.test(bare)) return "identity";
   return "other";
 }
@@ -6502,7 +6605,21 @@ function loginFields(names) {
   if (fields.length < 2) return null;
   return fields;
 }
-var MAX_FORM_BYTES = 16 * 1024;
+function verifyFields(names, tokenIsCode = false) {
+  const fields = names.map((name) => {
+    const kind = fieldKind(name);
+    return { name, kind: kind === "other" && tokenIsCode && /^token$/i.test(bareName(name)) ? "code" : kind };
+  });
+  if (fields.some((f) => f.kind === "password") || fields.filter((f) => f.kind === "code").length !== 1) return null;
+  return fields;
+}
+function startFields(names) {
+  const fields = names.map((name) => ({ name, kind: fieldKind(name) }));
+  if (!fields.some((f) => f.kind === "identity") || fields.some((f) => f.kind === "password" || f.kind === "code")) return null;
+  return fields;
+}
+var STEP_TTL_MS = 10 * 6e4;
+var MAX_FORM_BYTES = 32 * 1024;
 
 // src/introspect.ts
 init_cjs_shims();
@@ -6788,6 +6905,26 @@ function parsesJson(app) {
   if (names.includes("urlencodedParser")) return false;
   return null;
 }
+var LOGIN_RULE = { not: NOT_A_LOGIN, name: LOGIN_NAME, mustBeNamed: false, fields: (n) => loginFields(n), session: true };
+var VERIFY_RULE = { not: NOT_A_VERIFY, name: VERIFY_NAME, mustBeNamed: true, fields: (n, named) => verifyFields(n, named), session: true };
+var START_RULE = { not: NOT_A_LOGIN, name: new RegExp(`${LOGIN_NAME.source}|${START_NAME.source}`, "i"), mustBeNamed: true, fields: (n) => startFields(n), session: false };
+function candidates(app, routes, rule) {
+  const out = [];
+  for (const route of routes) {
+    if (route.method !== "POST" || route.params.length > 0 || rule.not.test(route.path)) continue;
+    const named = rule.name.test(route.path);
+    if (rule.mustBeNamed && !named) continue;
+    const handlers = routeHandlers.get(route) ?? [];
+    const own = sourceOf(handlers.at(-1));
+    const all = handlers.map(sourceOf).join("\n");
+    const fields = rule.fields(bodyFieldsOf(own), named);
+    if (!fields) continue;
+    if (rule.session && !LOGIN_NAME.test(route.path) && !SESSION_CODE.test(all)) continue;
+    out.push({ step: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
+  }
+  out.sort((a, b) => Number(b.named) - Number(a.named) || a.step.fields.length - b.step.fields.length);
+  return out.map((c) => c.step);
+}
 function findExpressLogin(app, mounts) {
   let routes;
   try {
@@ -6795,21 +6932,21 @@ function findExpressLogin(app, mounts) {
   } catch {
     return null;
   }
-  const candidates = [];
-  for (const route of routes) {
-    if (route.method !== "POST" || route.params.length > 0 || NOT_A_LOGIN.test(route.path)) continue;
-    const handlers = routeHandlers.get(route) ?? [];
-    const own = sourceOf(handlers.at(-1));
-    const all = handlers.map(sourceOf).join("\n");
-    const fields = loginFields(bodyFieldsOf(own));
-    if (!fields) continue;
-    const named = LOGIN_NAME.test(route.path);
-    if (!named && !SESSION_CODE.test(all)) continue;
-    candidates.push({ login: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
-  }
-  if (candidates.length === 0) return null;
-  candidates.sort((a, b) => Number(b.named) - Number(a.named) || a.login.fields.length - b.login.fields.length);
-  return { login: candidates[0].login, others: candidates.slice(1).map((c) => `POST ${c.login.path}`) };
+  const verifies = candidates(app, routes, VERIFY_RULE);
+  const logins = candidates(app, routes, LOGIN_RULE);
+  if (logins.length > 0) {
+    const [first2, ...others2] = logins;
+    return { login: { ...first2, ...verifies[0] ? { verify: verifies[0] } : {} }, others: others2.map((c) => `POST ${c.path}`) };
+  }
+  const pairs = [];
+  for (const start of candidates(app, routes, START_RULE)) {
+    const who = new Set(start.fields.filter((f) => f.kind === "identity").map((f) => f.name));
+    const verify = verifies.find((v) => v.fields.some((f) => who.has(f.name))) ?? verifies.find((v) => !v.fields.some((f) => f.kind === "identity"));
+    if (verify) pairs.push({ ...start, passwordless: true, verify });
+  }
+  if (pairs.length === 0) return null;
+  const [first, ...others] = pairs;
+  return { login: first, others: others.map((c) => `POST ${c.path}`) };
 }
 
 // bin/scan/env.ts

package/dist/scan-preload.js

@@ -2078,12 +2078,83 @@ function requireHttpsBaseUrl(optionName, value) {
   return value.replace(/\/+$/, "");
 }
 
+// ../core/src/seal.ts
+init_esm_shims();
+function toBase64Url(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i += 32768) s += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+  if (!/^[A-Za-z0-9_-]*$/.test(text)) return null;
+  try {
+    const bin = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+function createSealer(secret, label) {
+  let key;
+  const keyOf2 = () => key ??= crypto.subtle.digest("SHA-256", new TextEncoder().encode(`${label}
+${secret}`)).then((material) => crypto.subtle.importKey("raw", material, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]));
+  return {
+    async seal(text) {
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+      const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await keyOf2(), new TextEncoder().encode(text)));
+      const out = new Uint8Array(iv.length + sealed.length);
+      out.set(iv);
+      out.set(sealed, iv.length);
+      return toBase64Url(out);
+    },
+    async unseal(token) {
+      const bytes = fromBase64Url(token);
+      if (!bytes || bytes.length < 12 + 16) return null;
+      try {
+        const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: bytes.slice(0, 12) }, await keyOf2(), bytes.slice(12));
+        return new TextDecoder().decode(plain);
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+
+// ../core/src/login-theme.ts
+init_esm_shims();
+var HEX = /^#[0-9a-f]{6}$/i;
+var KEYS = ["accent", "background", "surface", "text"];
+function parseLoginTheme(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const o = raw;
+  if (Object.keys(o).length !== KEYS.length) return null;
+  const out = {};
+  for (const k of KEYS) {
+    const v = o[k];
+    if (typeof v !== "string" || !HEX.test(v)) return null;
+    out[k] = v.toLowerCase();
+  }
+  return out;
+}
+
 // ../core/src/hosted-resolver.ts
 var DEFAULT_TIMEOUT_MS = 5e3;
 var REPORT_TIMEOUT_MS = 3e3;
+var REPORT_REFRESH_MS = 6e4;
 var DEFAULT_MAX_CACHE_MS = 3e4;
 var EXPIRY_SKEW_MS = 6e4;
 var MAX_CACHE_ENTRIES = 500;
+function signInMethodsOf(body) {
+  const methods = body?.signIn?.methods;
+  if (!Array.isArray(methods)) return null;
+  return methods.map((m) => {
+    const { kind, label } = m && typeof m === "object" ? m : {};
+    return {
+      kind: kind === "app-login" || kind === "oauth" || kind === "session" ? kind : "other",
+      label: typeof label === "string" && label.trim() ? label.trim().slice(0, 100) : "a sign-in method"
+    };
+  });
+}
 function createHostedAuthResolver(config) {
   const givenKey = config.key ?? config.licenseKey;
   const projectId = config.projectId ?? (config.key ? parseExposifyKey(config.key)?.projectId : void 0);
@@ -2177,9 +2248,13 @@ function createHostedAuthResolver(config) {
   }
   const sessionWrites = /* @__PURE__ */ new Map();
   const reported = /* @__PURE__ */ new Map();
-  const apiUrl = config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL;
+  let passwordDirect;
+  const apiUrl = requireHttpsBaseUrl("apiUrl", config.apiUrl ?? readEnv(API_URL_ENV) ?? DEFAULT_API_URL);
+  const stepSealer = createSealer(licenseKey, "exposify login-step v1");
   const info = {
     issuer,
+    sealLoginStep: (text) => stepSealer.seal(text),
+    unsealLoginStep: (token) => stepSealer.unseal(token),
     resource: config.resource,
     // Answers from the same cache, so the tool call right after a check doesn't ask the broker again.
     async check(authorization) {
@@ -2196,7 +2271,8 @@ function createHostedAuthResolver(config) {
         live: true,
         clientName: typeof res.body.clientName === "string" ? res.body.clientName : "An AI assistant",
         appName: typeof res.body.appName === "string" ? res.body.appName : null,
-        resource: typeof res.body.resource === "string" ? res.body.resource : null
+        resource: typeof res.body.resource === "string" ? res.body.resource : null,
+        theme: parseLoginTheme(res.body.theme)
       };
     },
     async completeLogin(handle, session) {
@@ -2224,23 +2300,39 @@ function createHostedAuthResolver(config) {
       cache.delete(authorization);
       await brokerPost("session-ended", {}, authorization);
     },
+    supabasePasswordDirect: () => passwordDirect,
     reportLogin(report) {
       const key = JSON.stringify(report);
-      let pending = reported.get(key);
-      if (!pending) {
-        pending = (async () => {
-          const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
-            method: "PUT",
-            headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
-            body: JSON.stringify(report),
-            signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
-          });
-          if (!res.ok) throw new Error(`HTTP ${res.status}`);
-        })();
-        reported.set(key, pending);
+      const send2 = async () => {
+        const res = await fetchImpl(`${apiUrl.replace(/\/+$/, "")}/api/v1/app/login`, {
+          method: "PUT",
+          headers: { "content-type": "application/json", authorization: `Bearer ${licenseKey}` },
+          body: JSON.stringify(report),
+          signal: AbortSignal.timeout(REPORT_TIMEOUT_MS)
+        });
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const body = await res.json().catch(() => null);
+        passwordDirect = typeof body?.supabasePasswordDirect === "boolean" ? body.supabasePasswordDirect : void 0;
+        return signInMethodsOf(body);
+      };
+      const entry2 = reported.get(key);
+      if (!entry2) {
+        const pending = send2();
+        reported.set(key, { answer: pending, at: Date.now() });
         pending.catch(() => reported.delete(key));
+        return pending;
+      }
+      if (!entry2.refreshing && Date.now() - entry2.at >= REPORT_REFRESH_MS) {
+        entry2.refreshing = true;
+        send2().then(
+          (methods) => reported.set(key, { answer: Promise.resolve(methods), at: Date.now() }),
+          () => {
+            entry2.at = Date.now();
+            entry2.refreshing = false;
+          }
+        );
       }
-      return pending;
+      return entry2.answer;
     }
   };
   Object.defineProperty(resolver, HOSTED_RESOLVER, { value: info });
@@ -6487,15 +6579,26 @@ function applyOpenApi(routes, doc) {
 
 // ../core/src/own-login.ts
 init_esm_shims();
+
+// ../core/src/startup.ts
+init_esm_shims();
+
+// ../core/src/own-login.ts
 var PASSWORD_NAME = /^(password|passwd|pass|pwd|pin|passcode|secret)$/i;
 var PASSWORD_PART = /(password|passwd|passcode)/i;
 var CONFIRM_NAME = /(confirm|repeat|again|verify|retype|new).*pass|pass.*(confirm|repeat|again|2)$/i;
 var IDENTITY_NAME = /^(email|e-mail|mail|username|user|login|name|phone|phonenumber|phone_number|mobile|account|identifier|handle)$/i;
+var CODE_NAME = /^(code|otp|totp|pin[-_]?code|(mfa|2fa|two[-_]?factor|verification|verify|sms|one[-_]?time|otp|totp|backup|recovery|auth|security|login|access)[-_]?code)$/i;
 var NOT_A_LOGIN = /(register|signup|sign[-_]?up|create[-_]?(account|user)|join|logout|log[-_]?out|signout|sign[-_]?out|reset|forgot|change[-_]?password|invite|verify)/i;
 var LOGIN_NAME = /(^|[^a-z])(login|log[-_]?in|signin|sign[-_]?in|authenticate|session|sessions|auth)([^a-z]|$)/i;
+var VERIFY_NAME = /(verify|verification|2fa|two[-_]?factor|mfa|otp|totp|challenge|code)/i;
+var NOT_A_VERIFY = /(register|signup|sign[-_]?up|verify[-_]?email|email[-_]?verif|confirm[-_]?email|reset|forgot|invite|coupon|promo|discount|voucher|gift|referral)/i;
+var START_NAME = /((send|request|email|text|sms)[-_]?(code|otp|token|link))|passwordless|magic|otp/i;
+var bareName = (name) => name.replace(/^.*[.[]/, "").replace(/]$/, "");
 function fieldKind(name) {
-  const bare = name.replace(/^.*[.[]/, "").replace(/]$/, "");
+  const bare = bareName(name);
   if (PASSWORD_NAME.test(bare) || PASSWORD_PART.test(bare)) return "password";
+  if (CODE_NAME.test(bare)) return "code";
   if (IDENTITY_NAME.test(bare) || /email/i.test(bare)) return "identity";
   return "other";
 }
@@ -6506,7 +6609,21 @@ function loginFields(names) {
   if (fields.length < 2) return null;
   return fields;
 }
-var MAX_FORM_BYTES = 16 * 1024;
+function verifyFields(names, tokenIsCode = false) {
+  const fields = names.map((name) => {
+    const kind = fieldKind(name);
+    return { name, kind: kind === "other" && tokenIsCode && /^token$/i.test(bareName(name)) ? "code" : kind };
+  });
+  if (fields.some((f) => f.kind === "password") || fields.filter((f) => f.kind === "code").length !== 1) return null;
+  return fields;
+}
+function startFields(names) {
+  const fields = names.map((name) => ({ name, kind: fieldKind(name) }));
+  if (!fields.some((f) => f.kind === "identity") || fields.some((f) => f.kind === "password" || f.kind === "code")) return null;
+  return fields;
+}
+var STEP_TTL_MS = 10 * 6e4;
+var MAX_FORM_BYTES = 32 * 1024;
 
 // src/introspect.ts
 init_esm_shims();
@@ -6792,6 +6909,26 @@ function parsesJson(app) {
   if (names.includes("urlencodedParser")) return false;
   return null;
 }
+var LOGIN_RULE = { not: NOT_A_LOGIN, name: LOGIN_NAME, mustBeNamed: false, fields: (n) => loginFields(n), session: true };
+var VERIFY_RULE = { not: NOT_A_VERIFY, name: VERIFY_NAME, mustBeNamed: true, fields: (n, named) => verifyFields(n, named), session: true };
+var START_RULE = { not: NOT_A_LOGIN, name: new RegExp(`${LOGIN_NAME.source}|${START_NAME.source}`, "i"), mustBeNamed: true, fields: (n) => startFields(n), session: false };
+function candidates(app, routes, rule) {
+  const out = [];
+  for (const route of routes) {
+    if (route.method !== "POST" || route.params.length > 0 || rule.not.test(route.path)) continue;
+    const named = rule.name.test(route.path);
+    if (rule.mustBeNamed && !named) continue;
+    const handlers = routeHandlers.get(route) ?? [];
+    const own = sourceOf(handlers.at(-1));
+    const all = handlers.map(sourceOf).join("\n");
+    const fields = rule.fields(bodyFieldsOf(own), named);
+    if (!fields) continue;
+    if (rule.session && !LOGIN_NAME.test(route.path) && !SESSION_CODE.test(all)) continue;
+    out.push({ step: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
+  }
+  out.sort((a, b) => Number(b.named) - Number(a.named) || a.step.fields.length - b.step.fields.length);
+  return out.map((c) => c.step);
+}
 function findExpressLogin(app, mounts) {
   let routes;
   try {
@@ -6799,21 +6936,21 @@ function findExpressLogin(app, mounts) {
   } catch {
     return null;
   }
-  const candidates = [];
-  for (const route of routes) {
-    if (route.method !== "POST" || route.params.length > 0 || NOT_A_LOGIN.test(route.path)) continue;
-    const handlers = routeHandlers.get(route) ?? [];
-    const own = sourceOf(handlers.at(-1));
-    const all = handlers.map(sourceOf).join("\n");
-    const fields = loginFields(bodyFieldsOf(own));
-    if (!fields) continue;
-    const named = LOGIN_NAME.test(route.path);
-    if (!named && !SESSION_CODE.test(all)) continue;
-    candidates.push({ login: { path: route.path, fields, body: parsesJson(app) === false ? "form" : "json" }, named });
-  }
-  if (candidates.length === 0) return null;
-  candidates.sort((a, b) => Number(b.named) - Number(a.named) || a.login.fields.length - b.login.fields.length);
-  return { login: candidates[0].login, others: candidates.slice(1).map((c) => `POST ${c.login.path}`) };
+  const verifies = candidates(app, routes, VERIFY_RULE);
+  const logins = candidates(app, routes, LOGIN_RULE);
+  if (logins.length > 0) {
+    const [first2, ...others2] = logins;
+    return { login: { ...first2, ...verifies[0] ? { verify: verifies[0] } : {} }, others: others2.map((c) => `POST ${c.path}`) };
+  }
+  const pairs = [];
+  for (const start of candidates(app, routes, START_RULE)) {
+    const who = new Set(start.fields.filter((f) => f.kind === "identity").map((f) => f.name));
+    const verify = verifies.find((v) => v.fields.some((f) => who.has(f.name))) ?? verifies.find((v) => !v.fields.some((f) => f.kind === "identity"));
+    if (verify) pairs.push({ ...start, passwordless: true, verify });
+  }
+  if (pairs.length === 0) return null;
+  const [first, ...others] = pairs;
+  return { login: first, others: others.map((c) => `POST ${c.path}`) };
 }
 
 // bin/scan/env.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/express",
-  "version": "0.3.9",
+  "version": "0.4.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -26,8 +26,8 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/cli": "0.0.1",
-    "@exposify/core": "0.3.13"
+    "@exposify/cli": "0.1.0",
+    "@exposify/core": "0.4.0"
   },
   "peerDependencies": {
     "express": ">=4 <6"