@exposify/next 0.0.1 → 0.0.2

package/README.md

@@ -136,6 +136,13 @@ was found. Name another one with `aiReady(exposify, { login: "signIn" })`
 (an action's export name) or `{ login: { path: "/api/login", fields:
 ["email", "password"] } }`, or turn it off with `login: false`.
 
+**No login found, and no sign-in method in the dashboard?** Then agents use
+your app signed out: `/mcp` doesn't ask them to sign in, and your own checks
+decide what they can do. The startup log says which it is
+(`[agentready] How agents sign in: ...`), and so does the dashboard's "How
+agents sign in" page. Adding a sign-in method there takes effect within a
+minute.
+
 Not supported yet: logins in more than one step (SMS codes, email links),
 and logins that need a CSRF token from your own form page.
 

package/dist/config.cjs

@@ -1894,7 +1894,7 @@ function specifier(outFile, file) {
   return rel.startsWith(".") ? rel : `./${rel}`;
 }
 function manifestLogin(l) {
-  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {} } : { kind: "route", path: l.path, fields: l.fields, body: l.body };
+  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {}, where: `${l.export} in ${l.file}` } : { kind: "route", path: l.path, fields: l.fields, body: l.body, where: `POST ${l.path} in ${l.file}` };
 }
 function renderManifest(d, opts) {
   const ts = opts.outFile.endsWith(".ts");
@@ -1946,6 +1946,7 @@ function renderManifest(d, opts) {
     ...actions.length > 0 ? ["  actions: [", ...actions, "  ],"] : [],
     ...pages.length > 0 ? ["  pages: [", ...pages, "  ],"] : [],
     ...d.login ? [`  login: ${j(manifestLogin(d.login))},`] : [],
+    ...opts.authStacks?.length ? [`  authStacks: ${j(opts.authStacks)},`] : [],
     `  docs: ${j(opts.docs)},`,
     ...Object.keys(opts.descriptions).length > 0 ? [`  descriptions: ${JSON.stringify(opts.descriptions, null, 2).replace(/\n/g, "\n  ")},`] : [],
     "};",
@@ -1964,7 +1965,8 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     descriptions: readDescriptions(root, warn),
     info,
     ...opts.basePath ? { basePath: opts.basePath } : {},
-    ...opts.trailingSlash ? { trailingSlash: true } : {}
+    ...opts.trailingSlash ? { trailingSlash: true } : {},
+    authStacks: (0, import_core2.authStacksOf)((0, import_core2.dependencyNames)(pkg)).map((s) => s.pkg)
   });
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
     warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);

package/dist/config.js

@@ -14,7 +14,7 @@ import { DESCRIPTIONS_FILE as DESCRIPTIONS_FILE2 } from "@exposify/core";
 import { createHash } from "crypto";
 import { existsSync as existsSync2, readFileSync as readFileSync6, readdirSync, writeFileSync } from "fs";
 import { dirname as dirname2, join as join6, relative as relative2, sep as sep2 } from "path";
-import { DESCRIPTIONS_FILE, parseDescriptions } from "@exposify/core";
+import { DESCRIPTIONS_FILE, authStacksOf, dependencyNames, parseDescriptions } from "@exposify/core";
 import { globSync } from "tinyglobby";
 
 // src/ast.ts
@@ -1827,7 +1827,7 @@ function specifier(outFile, file) {
   return rel.startsWith(".") ? rel : `./${rel}`;
 }
 function manifestLogin(l) {
-  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {} } : { kind: "route", path: l.path, fields: l.fields, body: l.body };
+  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {}, where: `${l.export} in ${l.file}` } : { kind: "route", path: l.path, fields: l.fields, body: l.body, where: `POST ${l.path} in ${l.file}` };
 }
 function renderManifest(d, opts) {
   const ts = opts.outFile.endsWith(".ts");
@@ -1879,6 +1879,7 @@ function renderManifest(d, opts) {
     ...actions.length > 0 ? ["  actions: [", ...actions, "  ],"] : [],
     ...pages.length > 0 ? ["  pages: [", ...pages, "  ],"] : [],
     ...d.login ? [`  login: ${j(manifestLogin(d.login))},`] : [],
+    ...opts.authStacks?.length ? [`  authStacks: ${j(opts.authStacks)},`] : [],
     `  docs: ${j(opts.docs)},`,
     ...Object.keys(opts.descriptions).length > 0 ? [`  descriptions: ${JSON.stringify(opts.descriptions, null, 2).replace(/\n/g, "\n  ")},`] : [],
     "};",
@@ -1897,7 +1898,8 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     descriptions: readDescriptions(root, warn),
     info,
     ...opts.basePath ? { basePath: opts.basePath } : {},
-    ...opts.trailingSlash ? { trailingSlash: true } : {}
+    ...opts.trailingSlash ? { trailingSlash: true } : {},
+    authStacks: authStacksOf(dependencyNames(pkg)).map((s) => s.pkg)
   });
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
     warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);

package/dist/exposify-next.js

@@ -8,7 +8,7 @@ import { runCli } from "@exposify/cli";
 import { createHash } from "crypto";
 import { existsSync as existsSync2, readFileSync as readFileSync6, readdirSync, writeFileSync } from "fs";
 import { dirname as dirname2, join as join6, relative as relative2, sep as sep2 } from "path";
-import { DESCRIPTIONS_FILE, parseDescriptions } from "@exposify/core";
+import { DESCRIPTIONS_FILE, authStacksOf, dependencyNames, parseDescriptions } from "@exposify/core";
 import { globSync } from "tinyglobby";
 
 // src/ast.ts
@@ -1925,7 +1925,7 @@ function specifier(outFile, file) {
   return rel.startsWith(".") ? rel : `./${rel}`;
 }
 function manifestLogin(l) {
-  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {} } : { kind: "route", path: l.path, fields: l.fields, body: l.body };
+  return l.kind === "action" ? { kind: "action", key: l.key, fields: l.fields, ...l.host ? { host: l.host } : {}, where: `${l.export} in ${l.file}` } : { kind: "route", path: l.path, fields: l.fields, body: l.body, where: `POST ${l.path} in ${l.file}` };
 }
 function renderManifest(d, opts) {
   const ts = opts.outFile.endsWith(".ts");
@@ -1977,6 +1977,7 @@ function renderManifest(d, opts) {
     ...actions.length > 0 ? ["  actions: [", ...actions, "  ],"] : [],
     ...pages.length > 0 ? ["  pages: [", ...pages, "  ],"] : [],
     ...d.login ? [`  login: ${j(manifestLogin(d.login))},`] : [],
+    ...opts.authStacks?.length ? [`  authStacks: ${j(opts.authStacks)},`] : [],
     `  docs: ${j(opts.docs)},`,
     ...Object.keys(opts.descriptions).length > 0 ? [`  descriptions: ${JSON.stringify(opts.descriptions, null, 2).replace(/\n/g, "\n  ")},`] : [],
     "};",
@@ -1995,7 +1996,8 @@ function generate(root, opts = {}, warn = (m) => console.warn(`[exposify] ${m}`)
     descriptions: readDescriptions(root, warn),
     info,
     ...opts.basePath ? { basePath: opts.basePath } : {},
-    ...opts.trailingSlash ? { trailingSlash: true } : {}
+    ...opts.trailingSlash ? { trailingSlash: true } : {},
+    authStacks: authStacksOf(dependencyNames(pkg)).map((s) => s.pkg)
   });
   for (const a of discovery.actions.filter((x) => x.proposed?.status === "stale")) {
     warn(`the input accepted for the ${a.action.name} server action (${a.file}) is out of date, since the action changed: it's not used until \`exposify-next describe\` reviews it again`);

package/dist/index.cjs

@@ -833,7 +833,7 @@ function loginSpec(manifest, config, warnings) {
   if (config === void 0) return manifest.login ?? null;
   if (typeof config === "object") {
     const fields2 = config.fields.map((name) => ({ name, kind: (0, import_core.fieldKind)(name) }));
-    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json" };
+    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json", where: `POST ${config.path}` };
   }
   const action = (manifest.actions ?? []).find((a) => a.key === config || a.export === config);
   if (!action) {
@@ -841,7 +841,7 @@ function loginSpec(manifest, config, warnings) {
     return null;
   }
   const fields = action.fields.map((f) => ({ name: f.name, kind: (0, import_core.fieldKind)(f.name) }));
-  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {} };
+  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {}, where: `${action.export} in ${action.file}` };
 }
 async function actionLoginResult(raw, exportName) {
   if (actionNotFound(raw)) return { ok: false, message: "The app's sign-in page didn't run its login. Its developer needs to rebuild the app." };
@@ -1149,14 +1149,18 @@ function aiReady(manifest, options = {}) {
       const url = (0, import_core.publicRequestUrl)(req.url, req.headers);
       const isPrm = url.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(isPrm ? url.slice(0, -PRM_SUFFIX.length) : url);
-      await (0, import_core.reportAppLogin)(cfg.auth, resource, login);
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      try {
-        const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
-        if (!result.ok) return result.response;
-      } catch (err) {
-        console.warn(`${LOG_PREFIX} broker check failed:`, err);
-        return new Response("authorization check failed", { status: 503 });
+      const verdict = await (0, import_core.reportAppLogin)(cfg.auth, resource, login, { where: login?.where, stacks: manifest.authStacks, log: logReady });
+      if (verdict === "open") {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        try {
+          const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+          if (!result.ok) return result.response;
+        } catch (err) {
+          console.warn(`${LOG_PREFIX} broker check failed:`, err);
+          return new Response("authorization check failed", { status: 503 });
+        }
       }
     }
     return core(req);

package/dist/index.d.cts

@@ -85,7 +85,7 @@ interface ManifestPage {
  * this request, for Connect with no code. `host` is the page with the
  * action's form, which tool calls redirected to mean "signed out".
  */
-type ManifestLogin = {
+type ManifestLogin = ({
     kind: "action";
     key: string;
     fields: LoginField[];
@@ -95,6 +95,9 @@ type ManifestLogin = {
     path: string;
     fields: LoginField[];
     body: "json" | "form";
+}) & {
+    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
+    where?: string;
 };
 interface ExposifyManifest {
     info: {
@@ -111,6 +114,8 @@ interface ExposifyManifest {
     actions?: ManifestAction[];
     pages?: ManifestPage[];
     login?: ManifestLogin;
+    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
+    authStacks?: string[];
     /** Docs for search_docs, embedded so they work without a file system. */
     docs: DocSource[];
     /** exposify.descriptions.json's texts, "METHOD /path" -> text. */

package/dist/index.d.ts

@@ -85,7 +85,7 @@ interface ManifestPage {
  * this request, for Connect with no code. `host` is the page with the
  * action's form, which tool calls redirected to mean "signed out".
  */
-type ManifestLogin = {
+type ManifestLogin = ({
     kind: "action";
     key: string;
     fields: LoginField[];
@@ -95,6 +95,9 @@ type ManifestLogin = {
     path: string;
     fields: LoginField[];
     body: "json" | "form";
+}) & {
+    /** Where it is, for the startup log and the dashboard: "signIn in app/actions/auth.ts". */
+    where?: string;
 };
 interface ExposifyManifest {
     info: {
@@ -111,6 +114,8 @@ interface ExposifyManifest {
     actions?: ManifestAction[];
     pages?: ManifestPage[];
     login?: ManifestLogin;
+    /** Auth libraries in package.json ("next-auth", "@supabase/ssr", ...), reported with the login. */
+    authStacks?: string[];
     /** Docs for search_docs, embedded so they work without a file system. */
     docs: DocSource[];
     /** exposify.descriptions.json's texts, "METHOD /path" -> text. */

package/dist/index.js

@@ -841,7 +841,7 @@ function loginSpec(manifest, config, warnings) {
   if (config === void 0) return manifest.login ?? null;
   if (typeof config === "object") {
     const fields2 = config.fields.map((name) => ({ name, kind: fieldKind(name) }));
-    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json" };
+    return { kind: "route", path: config.path, fields: fields2, body: config.body ?? "json", where: `POST ${config.path}` };
   }
   const action = (manifest.actions ?? []).find((a) => a.key === config || a.export === config);
   if (!action) {
@@ -849,7 +849,7 @@ function loginSpec(manifest, config, warnings) {
     return null;
   }
   const fields = action.fields.map((f) => ({ name: f.name, kind: fieldKind(f.name) }));
-  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {} };
+  return { kind: "action", key: action.key, fields, ...action.host ? { host: action.host } : {}, where: `${action.export} in ${action.file}` };
 }
 async function actionLoginResult(raw, exportName) {
   if (actionNotFound(raw)) return { ok: false, message: "The app's sign-in page didn't run its login. Its developer needs to rebuild the app." };
@@ -1157,14 +1157,18 @@ function aiReady(manifest, options = {}) {
       const url = publicRequestUrl(req.url, req.headers);
       const isPrm = url.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(isPrm ? url.slice(0, -PRM_SUFFIX.length) : url);
-      await reportAppLogin(cfg.auth, resource, login);
-      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
-      try {
-        const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
-        if (!result.ok) return result.response;
-      } catch (err) {
-        console.warn(`${LOG_PREFIX} broker check failed:`, err);
-        return new Response("authorization check failed", { status: 503 });
+      const verdict = await reportAppLogin(cfg.auth, resource, login, { where: login?.where, stacks: manifest.authStacks, log: logReady });
+      if (verdict === "open") {
+        if (isPrm) return new Response("not found", { status: 404 });
+      } else {
+        if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+        try {
+          const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+          if (!result.ok) return result.response;
+        } catch (err) {
+          console.warn(`${LOG_PREFIX} broker check failed:`, err);
+          return new Response("authorization check failed", { status: 503 });
+        }
       }
     }
     return core(req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/next",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -32,8 +32,8 @@
   },
   "dependencies": {
     "@babel/parser": "^8.0.0",
-    "@exposify/cli": "0.0.1",
-    "@exposify/core": "0.3.13",
+    "@exposify/cli": "0.0.2",
+    "@exposify/core": "0.3.14",
     "tinyglobby": "^0.2.10",
     "zod": "^3.24.0"
   },