@exposify/firebase 0.0.1 → 0.0.3

package/README.md

@@ -22,7 +22,7 @@ root.
 From your Firebase project root (where `firebase.json` is):
 
 ```bash
-npx exposify-firebase init
+npx @exposify/firebase init
 ```
 
 It reads `firebase.json` to find your functions directory and
@@ -70,7 +70,11 @@ broker as the authorization server, and the client sends the user through
 sign-in. Tool calls then reach Firestore with the `Authorization` the broker
 resolves for that user, never the broker token itself, so your rules still
 decide. Requests without a connection are refused rather
-than run anonymously; pass `authRequired: false` to allow them.
+than run anonymously; pass `authRequired: false` to allow them. The
+exception: when the project has no sign-in method yet (add the Firebase
+preset in the dashboard), agents use the function signed out, as the
+anonymous user, with no sign-in asked. The startup log says which it is
+(`[agentready] How agents sign in: ...`).
 
 `auth: hostedBroker()` does the same explicitly. If the function is
 reached through a URL other than the one it sees (a custom domain or a

package/dist/cli.js

@@ -75,7 +75,7 @@ function stripComments(source) {
 }
 
 // bin/init.ts
-var GENERATED_MARKER = "Generated by `exposify-firebase init`";
+var GENERATED_MARKER = "Generated by `npx @exposify/firebase init`";
 function planInit(root) {
   const warnings = [];
   const firebaseJsonPath = join(root, "firebase.json");
@@ -194,7 +194,7 @@ function nextSteps(plan) {
 }
 
 // bin/cli.ts
-var USAGE = `Usage: exposify-firebase init [--dry-run]
+var USAGE = `Usage: @exposify/firebase init [--dry-run]
 
 Run from your Firebase project root (where firebase.json is). Writes an MCP
 function to your functions source directory, with collections proposed from

package/dist/index.cjs

@@ -104,7 +104,7 @@ function toolName(prefix, suffix, taken) {
 }
 
 // src/config.ts
-var LOG_PREFIX = "[exposify-firebase]";
+var LOG_PREFIX = "[@exposify/firebase]";
 var WRITE_OPS = ["create", "update", "delete"];
 function parseWrites(writes = []) {
   const grants = /* @__PURE__ */ new Map();
@@ -654,7 +654,7 @@ function toNodeHandler(handle) {
     try {
       response = await handle(await toWebRequest(req));
     } catch (err) {
-      console.error("[exposify-firebase] MCP request failed", err);
+      console.error("[@exposify/firebase] MCP request failed", err);
       response = Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
     res.statusCode = response.status;
@@ -791,7 +791,7 @@ function createFirebaseMcpHandler(options = {}) {
           }
         };
         return buildFirebaseMcpServer({
-          appName: "exposify-firebase",
+          appName: "@exposify/firebase",
           appVersion: "0.0.0",
           cfg,
           client: createFirestoreClient(baseUrl, authorization, fetchImpl),
@@ -807,13 +807,19 @@ function createFirebaseMcpHandler(options = {}) {
   if (!auth) return core;
   const brokerGate = authRequired ? (0, import_core2.createBrokerGate)(auth) : null;
   return async (req) => {
+    let open = false;
     if (brokerGate) {
       const own = (0, import_core2.publicRequestUrl)(req.url, req.headers);
       const isPrm = own.endsWith(import_core2.PRM_PATH);
       const resource = brokerGate.resourceFor(functionPublicUrl(isPrm ? own.slice(0, -import_core2.PRM_PATH.length) : own, functionName));
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      const result = await brokerGate.check(req.headers, resource, `${resource}${import_core2.PRM_PATH}`);
-      if (!result.ok) return result.response;
+      open = await (0, import_core2.reportAppLogin)(auth, resource, null, { stacks: ["firebase-admin"], why: "Firebase Auth sign-in for agents is the Firebase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${import_core2.PRM_PATH}`);
+        if (!result.ok) return result.response;
+      }
     }
     let resolved;
     try {
@@ -822,7 +828,7 @@ function createFirebaseMcpHandler(options = {}) {
       console.error(`${LOG_PREFIX} auth resolver failed`, err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (authRequired && !resolved.get("authorization")) {
+    if (authRequired && !open && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);

package/dist/index.js

@@ -10,6 +10,7 @@ import {
   KnowledgeBase,
   PRM_PATH,
   publicRequestUrl,
+  reportAppLogin,
   startupLogEnabled
 } from "@exposify/core";
 import { loadDocsFromFs } from "@exposify/core/node";
@@ -83,7 +84,7 @@ function toolName(prefix, suffix, taken) {
 }
 
 // src/config.ts
-var LOG_PREFIX = "[exposify-firebase]";
+var LOG_PREFIX = "[@exposify/firebase]";
 var WRITE_OPS = ["create", "update", "delete"];
 function parseWrites(writes = []) {
   const grants = /* @__PURE__ */ new Map();
@@ -633,7 +634,7 @@ function toNodeHandler(handle) {
     try {
       response = await handle(await toWebRequest(req));
     } catch (err) {
-      console.error("[exposify-firebase] MCP request failed", err);
+      console.error("[@exposify/firebase] MCP request failed", err);
       response = Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
     res.statusCode = response.status;
@@ -770,7 +771,7 @@ function createFirebaseMcpHandler(options = {}) {
           }
         };
         return buildFirebaseMcpServer({
-          appName: "exposify-firebase",
+          appName: "@exposify/firebase",
           appVersion: "0.0.0",
           cfg,
           client: createFirestoreClient(baseUrl, authorization, fetchImpl),
@@ -786,13 +787,19 @@ function createFirebaseMcpHandler(options = {}) {
   if (!auth) return core;
   const brokerGate = authRequired ? createBrokerGate(auth) : null;
   return async (req) => {
+    let open = false;
     if (brokerGate) {
       const own = publicRequestUrl(req.url, req.headers);
       const isPrm = own.endsWith(PRM_PATH);
       const resource = brokerGate.resourceFor(functionPublicUrl(isPrm ? own.slice(0, -PRM_PATH.length) : own, functionName));
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_PATH}`);
-      if (!result.ok) return result.response;
+      open = await reportAppLogin(auth, resource, null, { stacks: ["firebase-admin"], why: "Firebase Auth sign-in for agents is the Firebase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      if (open) {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_PATH}`);
+        if (!result.ok) return result.response;
+      }
     }
     let resolved;
     try {
@@ -801,7 +808,7 @@ function createFirebaseMcpHandler(options = {}) {
       console.error(`${LOG_PREFIX} auth resolver failed`, err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (authRequired && !resolved.get("authorization")) {
+    if (authRequired && !open && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/firebase",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "license": "MIT",
   "engines": {
     "node": ">=20.19"
@@ -29,7 +29,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.13",
+    "@exposify/core": "0.3.16",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },