@exposify/supabase 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ali
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -15,7 +15,7 @@ root.
 
 - A Supabase project (local via the [Supabase CLI](https://supabase.com/docs/guides/cli), or hosted).
 - The Supabase CLI (`supabase` on your `PATH`) for `db push` / `functions deploy`.
-- Node or Yarn to run `npx agentify-supabase` (the CLI is a regular npm
+- Node or Yarn to run `npx exposify-supabase` (the CLI is a regular npm
   package; the edge function itself runs on Deno and needs no local install).
 
 ## 1. Scaffold
@@ -23,13 +23,13 @@ root.
 From your Supabase project's root (the directory containing `supabase/`):
 
 ```bash
-npx agentify-supabase init
+npx exposify-supabase init
 ```
 
 This writes two things and never overwrites an existing function file:
 
-- `supabase/migrations/<timestamp>_agentify_meta.sql` — a SQL migration that
-  adds `agentify_meta()`, a `SECURITY DEFINER` function returning, per table,
+- `supabase/migrations/<timestamp>_exposify_meta.sql` — a SQL migration that
+  adds `exposify_meta()`, a `SECURITY DEFINER` function returning, per table,
   whether RLS is enabled and any `COMMENT ON TABLE`/`COMMENT ON COLUMN` text
   you've written. It only ever returns catalog metadata (table/column names,
   flags, comments) — never row data — which is what makes it safe to grant
@@ -39,8 +39,9 @@ This writes two things and never overwrites an existing function file:
 - `supabase/functions/mcp/docs/` — an empty directory for optional bundled
   docs (see "Knowledge base" below).
 
-`init` is interactive from there. If the Supabase CLI is on your `PATH` and
-you're running it in a real terminal, it asks:
+`init` is interactive from there (skips straight to the old fixed behavior
+below if stdin isn't a real terminal — CI, a script, piped input). If the
+Supabase CLI is on your `PATH`, it asks:
 
 ```
 Apply the migration and deploy the function to whatever Supabase project is
@@ -49,8 +50,8 @@ currently linked, now? [y/N]
 
 Answering **y** runs `supabase db push` then `supabase functions deploy mcp`
 for you, streaming their output. The default is **no** — pressing Enter, the
-Supabase CLI not being installed, or running `init` non-interactively (CI, a
-script, piped input) all skip straight to printing the commands instead:
+Supabase CLI not being installed, or running `init` non-interactively all
+skip straight to printing the commands instead:
 
 ```
 Run these to finish setup:
@@ -61,14 +62,50 @@ Run these to finish setup:
 
 That's deliberate: `db push`/`functions deploy` act on whatever project is
 *currently linked*, which may not be a throwaway one, so nothing gets pushed
-without an explicit yes. If you want to edit `writes`/`rpc`/`functions` (next
-section) before the first deploy, just say no here and run the printed
-commands yourself once you're done editing.
+without an explicit yes.
+
+### The setup wizard
+
+If `init` can reach the project you're setting up — either because it was
+already deployed (a re-run), or because you say yes above and the deploy
+succeeds — it walks through a short interactive wizard instead of leaving
+you to hand-edit `writes`/`rpc`/comments yourself:
+
+1. **Anonymous sign-in.** `init` tries to auto-detect this via the project's
+   public `/auth/v1/settings` endpoint and asks you to confirm; if it can't
+   detect it, it just asks. If enabled, it adds a warning comment to the
+   generated `index.ts`: an anonymous Supabase Auth session gets
+   `role: authenticated` (not `role: anon`), so it passes any RLS policy
+   scoped to `authenticated` unless that policy explicitly excludes
+   `auth.jwt()->>'is_anonymous' = 'true'`. Worth knowing before granting
+   `writes` on anything an anonymous session could reach.
+2. **Per-table writes.** For every RLS-enabled table, asks which of
+   insert/update/delete to grant (`i`, `u`, `d`, comma-separated, or Enter
+   for none) — the resulting `writes` array is written for you instead of
+   left as a commented-out example.
+3. **RPC functions.** Lists Postgres functions PostgREST exposes and lets
+   you pick which to expose as tools.
+4. **Documentation.** For every table or column `exposify_meta()` reports
+   has no comment, offers to write one right there — the answers become a
+   `COMMENT ON TABLE`/`COMMENT ON COLUMN` migration
+   (`<timestamp>_exposify_comments.sql`) that gets applied alongside the
+   rest. This is what gives `query_<table>`/`insert_<table>`/etc. their tool
+   and parameter descriptions (see "Column/table descriptions" below) —
+   worth doing even for tables you're not granting writes on, since it's
+   the only thing that makes read tools self-explanatory to an agent.
+
+If `supabase/functions/mcp/index.ts` already exists, none of this touches
+it — your selections are printed as a config snippet to merge in by hand
+instead, and the documentation migration still gets written either way.
+Connects using `SUPABASE_URL`/`SUPABASE_ANON_KEY` (env vars or `--url`/`--key`
+flags) — without those, `init` can't reach anything to introspect and falls
+back to the fixed scaffold-and-ask-to-deploy flow above, same as before this
+wizard existed.
 
 ## 2. Decide what's exposed
 
 **Every RLS-enabled table is automatically readable.** A table only shows up
-at all if `agentify_meta()` reports RLS is turned on for it *and* PostgREST
+at all if `exposify_meta()` reports RLS is turned on for it *and* PostgREST
 actually exposes it (the calling role has grants) — an RLS-less table is
 invisible, full stop, with no override. For each exposed table you get a
 `query_<table>` tool: typed filters (`eq`/`neq`/`gt`/`lt`/`like`), a `select`
@@ -136,7 +173,7 @@ supabase functions deploy mcp
 
 Only `functions deploy` is needed for a config-only change to `index.ts`;
 `db push` is only needed again if the migration itself changed (it hasn't,
-unless you're editing `sql/agentify_meta.sql` directly).
+unless you're editing `sql/exposify_meta.sql` directly).
 
 (Local dev: `supabase start` then `supabase functions serve mcp` instead of
 `deploy`.)
@@ -169,9 +206,9 @@ them via the `search_docs` tool.
 Every request tries, in order:
 
 1. **Runtime introspection** — fetch PostgREST's OpenAPI document and call
-   `agentify_meta()`. This is the normal path; the result is cached in
+   `exposify_meta()`. This is the normal path; the result is cached in
    memory for the life of the edge instance, not refetched per call.
-2. **Bundled manifest** — if step 1 fails, and a `agentify.manifest.json`
+2. **Bundled manifest** — if step 1 fails, and a `exposify.manifest.json`
    was generated ahead of time (see below), tools are built from that
    instead.
 3. **Functions + knowledge base only** — if neither works, the function
@@ -187,32 +224,38 @@ project (local `supabase start` or linked):
 
 ```bash
 SUPABASE_URL=http://localhost:54321 \
-SUPABASE_SERVICE_ROLE_KEY=<service-role-key> \
-npx agentify-supabase generate
+SUPABASE_ANON_KEY=<anon-key> \
+npx exposify-supabase generate
 ```
 
-This writes `supabase/functions/mcp/agentify.manifest.json`. Load it in
+Uses the **anon key**, deliberately the same key runtime introspection
+itself uses (see "Fallback ladder" above) — a service-role key would see
+tables/columns the `anon`/`authenticated` roles can't actually reach,
+producing a fallback manifest that offers tools live introspection never
+would.
+
+This writes `supabase/functions/mcp/exposify.manifest.json`. Load it in
 `aiReady({ manifest: ... })` — since the function runs on Deno, import it
 with a JSON import:
 
 ```ts
-import manifest from "./agentify.manifest.json" with { type: "json" };
+import manifest from "./exposify.manifest.json" with { type: "json" };
 
 Deno.serve(aiReady({ manifest, /* ...writes/rpc/functions... */ }));
 ```
 
 ## Troubleshooting
 
-**"agentify_meta() is not reachable" / "PGRST202" errors in function logs.**
+**"exposify_meta() is not reachable" / "PGRST202" errors in function logs.**
 The migration hasn't been applied to this database. Run `supabase db push`
-(or apply `sql/agentify_meta.sql` from this package directly), then
+(or apply `sql/exposify_meta.sql` from this package directly), then
 redeploy the function — the error message names this exact fix.
 
 **A table I expected doesn't show up as a tool.** Check, in order: is RLS
 actually enabled on it (`alter table ... enable row level security;`)? Does
 the calling role (`anon`/`authenticated`) have grants PostgREST can see? If
 both are true and it's still missing, confirm the migration is applied —
-`agentify_meta()` is what reports the RLS flag in the first place.
+`exposify_meta()` is what reports the RLS flag in the first place.
 
 **An `rpc_<fn>` tool takes a single opaque `args` object instead of named
 parameters.** PostgREST's OpenAPI document didn't have a recognizable
@@ -226,3 +269,12 @@ entries are `"<table>.insert"` / `"<table>.update"` / `"<table>.delete"` /
 `"<table>.*"` — a malformed entry is dropped (with a console warning), not
 an error, so a typo silently disables just that grant rather than crashing
 the function.
+
+**`init` just scaffolds and asks to deploy — it never asks about writes/RPCs/
+documentation.** The wizard only runs when `init` can actually reach the
+project (`SUPABASE_URL`/`SUPABASE_ANON_KEY` env vars, or `--url`/`--key`
+flags, pointing at a project where the migration is already applied). On a
+brand-new project's first `init`, that's not true yet — say yes to the
+deploy prompt (or run `supabase db push` yourself) and the wizard picks up
+automatically once the migration is live, in the same run if you said yes,
+or on your next `exposify-supabase init` otherwise.

package/dist/cli.js

@@ -19,31 +19,31 @@ async function fetchOpenApi(postgrestUrl, headers, fetchImpl) {
 }
 
 // src/meta.ts
-var MissingAgentifyMetaError = class extends Error {
+var MissingExposifyMetaError = class extends Error {
   constructor(cause) {
     super(cause);
-    this.name = "MissingAgentifyMetaError";
+    this.name = "MissingExposifyMetaError";
   }
 };
-async function fetchAgentifyMeta(postgrestUrl, headers, fetchImpl) {
-  const res = await fetchImpl(`${postgrestUrl}/rpc/agentify_meta`, {
+async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
+  const res = await fetchImpl(`${postgrestUrl}/rpc/exposify_meta`, {
     method: "POST",
     headers: { ...Object.fromEntries(headers), "content-type": "application/json" },
     body: "{}"
   });
   if (res.status === 404) {
-    throw new MissingAgentifyMetaError(
-      "agentify_meta() is not reachable at /rpc/agentify_meta (404). Run `npx agentify-supabase init` (or apply sql/agentify_meta.sql directly) and `supabase db push`, then redeploy the function."
+    throw new MissingExposifyMetaError(
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     if (/PGRST202|function .* does not exist/i.test(body)) {
-      throw new MissingAgentifyMetaError(
-        "agentify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/agentify_meta.sql via `supabase db push`, then redeploy the function."
+      throw new MissingExposifyMetaError(
+        "exposify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/exposify_meta.sql via `supabase db push`, then redeploy the function."
       );
     }
-    throw new Error(`agentify_meta() call failed: HTTP ${res.status} ${body}`.trim());
+    throw new Error(`exposify_meta() call failed: HTTP ${res.status} ${body}`.trim());
   }
   return await res.json();
 }
@@ -74,7 +74,7 @@ function columnsFromOpenApi(doc, table) {
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
     // Primary/Foreign Key...<pk/|fk/>" boilerplate) -- strip that boilerplate
     // so a column with no real comment ends up `undefined`, not the
-    // boilerplate text. agentify_meta()'s copy wins when both exist anyway
+    // boilerplate text. exposify_meta()'s copy wins when both exist anyway
     // -- see introspect.ts's merge.
     description: prop.description?.replace(/\n*Note:[\s\S]*$/, "").trim() || void 0
   }));
@@ -99,7 +99,7 @@ function introspectTables(openapi, metaRows) {
       if (!fromOpenApi) continue;
       columns.push({
         ...fromOpenApi,
-        // agentify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
+        // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
         description: row.column_comment ?? fromOpenApi.description
       });
@@ -130,19 +130,98 @@ function buildManifest(openapi, metaRows, generatedAt) {
   return { version: MANIFEST_VERSION, generatedAt, tables: introspectTables(openapi, metaRows) };
 }
 
+// bin/wizard.ts
+function parseAnonymousSignInSetting(settings) {
+  if (!settings || typeof settings !== "object") return null;
+  const s = settings;
+  const external = s.external;
+  if (external && typeof external.anonymous_users === "boolean") return external.anonymous_users;
+  if (typeof s.anonymous_users === "boolean") return s.anonymous_users;
+  if (typeof s.external_anonymous_users === "boolean") return s.external_anonymous_users;
+  return null;
+}
+function rpcCandidatesFromOpenApi(doc) {
+  return Object.keys(doc.paths ?? {}).filter((p) => p.startsWith("/rpc/")).map((p) => p.slice("/rpc/".length)).filter((name) => name.length > 0 && name !== "exposify_meta").sort();
+}
+function flattenWriteGrants(grants) {
+  return grants.flatMap((g) => g.ops.map((op) => `${g.table}.${op}`));
+}
+function parseWriteOpsAnswer(answer) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of answer.split(",")) {
+    const token = raw.trim().toLowerCase();
+    if (token === "i" || token === "insert") seen.add("insert");
+    else if (token === "u" || token === "update") seen.add("update");
+    else if (token === "d" || token === "delete") seen.add("delete");
+  }
+  return ["insert", "update", "delete"].filter((op) => seen.has(op));
+}
+function parseSelectionAnswer(answer, candidates) {
+  const wanted = new Set(
+    answer.split(",").map((s) => s.trim()).filter(Boolean)
+  );
+  return candidates.filter((c) => wanted.has(c));
+}
+function tablesMissingDocs(tables) {
+  return tables.map((t) => ({
+    name: t.name,
+    missingTableComment: !t.description,
+    columnsWithoutComments: t.columns.filter((c) => !c.description).map((c) => c.name)
+  }));
+}
+function sqlStringLiteral(text) {
+  return `'${text.replace(/'/g, "''")}'`;
+}
+function sqlIdentifier(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function buildCommentStatements(entries) {
+  const lines = [];
+  for (const entry of entries) {
+    const table = sqlIdentifier(entry.table);
+    if (entry.tableDescription) {
+      lines.push(`comment on table public.${table} is ${sqlStringLiteral(entry.tableDescription)};`);
+    }
+    for (const col of entry.columns) {
+      lines.push(
+        `comment on column public.${table}.${sqlIdentifier(col.name)} is ${sqlStringLiteral(col.description)};`
+      );
+    }
+  }
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "";
+}
+var ANONYMOUS_SIGN_IN_WARNING = `// NOTE: this project has anonymous sign-in enabled. An anonymous Supabase
+// Auth session still gets role: authenticated (with an is_anonymous claim),
+// NOT role: anon -- so it passes any RLS policy scoped to "authenticated"
+// unless that policy explicitly excludes auth.jwt()->>'is_anonymous' = 'true'.
+// Double-check your RLS policies (especially on tables granted writes below)
+// account for this before trusting "authenticated" to mean "a real user".
+`;
+function buildFunctionTemplate(opts = {}) {
+  const lines = [];
+  if (opts.anonymousSignIn) lines.push(ANONYMOUS_SIGN_IN_WARNING);
+  lines.push(`import { aiReady } from "npm:@exposify/supabase";`, "");
+  lines.push("Deno.serve(aiReady({");
+  lines.push(
+    opts.writes && opts.writes.length > 0 ? `  writes: ${JSON.stringify(opts.writes)},` : `  // writes: ["orders.insert", "orders.update"],`
+  );
+  lines.push(
+    opts.rpc && opts.rpc.length > 0 ? `  rpc: ${JSON.stringify(opts.rpc)},` : `  // rpc: ["place_order"],`
+  );
+  lines.push(
+    "  // functions: {",
+    '  //   refund: { description: "Refund an order", input: { type: "object", properties: {} } },',
+    "  // },",
+    "}));",
+    ""
+  );
+  return lines.join("\n");
+}
+
 // bin/cli.ts
 var PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 var FUNCTION_DIR = "supabase/functions/mcp";
-var FUNCTION_TEMPLATE = `import { aiReady } from "npm:@exposify/supabase";
-
-Deno.serve(aiReady({
-  // writes: ["orders.insert", "orders.update"],
-  // rpc: ["place_order"],
-  // functions: {
-  //   refund: { description: "Refund an order", input: { type: "object", properties: {} } },
-  // },
-}));
-`;
 async function exists(path) {
   try {
     await access(path);
@@ -159,15 +238,18 @@ function hasSupabaseCli() {
     return false;
   }
 }
-async function promptYesNo(question) {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
+function openInteractiveReadline() {
+  if (!process.stdin.isTTY) return null;
+  return createInterface({ input: process.stdin, output: process.stdout });
+}
+async function promptYesNo(rl, question, defaultYes = false) {
+  const suffix = defaultYes ? "[Y/n]" : "[y/N]";
+  const answer = (await rl.question(`${question} ${suffix} `)).trim().toLowerCase();
+  if (answer === "") return defaultYes;
+  return answer === "y" || answer === "yes";
+}
+async function promptText(rl, question) {
+  return (await rl.question(question)).trim();
 }
 function printManualCommands(opts = {}) {
   console.log("\nRun these to finish setup:");
@@ -177,66 +259,250 @@ function printManualCommands(opts = {}) {
   steps.forEach((cmd, i) => console.log(`  ${i + 1}. ${cmd}`));
   console.log(`  ${steps.length + 1}. Paste the function URL + a user JWT into an MCP client.`);
 }
+function pushAndDeploy() {
+  let pushed = false;
+  try {
+    console.log("\n$ supabase db push");
+    execFileSync("supabase", ["db", "push"], { stdio: "inherit" });
+    pushed = true;
+    console.log("\n$ supabase functions deploy mcp");
+    execFileSync("supabase", ["functions", "deploy", "mcp"], { stdio: "inherit" });
+    return { pushed: true, deployed: true };
+  } catch (err) {
+    return { pushed, deployed: false, error: err };
+  }
+}
+function resolveConnectionInfo() {
+  const url = process.env.SUPABASE_URL ?? argValue("--url");
+  const anonKey = process.env.SUPABASE_ANON_KEY ?? argValue("--key");
+  if (!url || !anonKey) return null;
+  return { url, anonKey };
+}
+async function tryIntrospect(conn) {
+  try {
+    const postgrestUrl = `${conn.url.replace(/\/+$/, "")}/rest/v1`;
+    const headers = new Headers({ authorization: `Bearer ${conn.anonKey}`, apikey: conn.anonKey });
+    const [openapi, metaRows] = await Promise.all([
+      fetchOpenApi(postgrestUrl, headers, fetch),
+      fetchExposifyMeta(postgrestUrl, headers, fetch)
+    ]);
+    return { tables: introspectTables(openapi, metaRows), openapi };
+  } catch {
+    return null;
+  }
+}
+async function tryDetectAnonymousSignIn(conn) {
+  try {
+    const url = `${conn.url.replace(/\/+$/, "")}/auth/v1/settings`;
+    const res = await fetch(url, { headers: { apikey: conn.anonKey, authorization: `Bearer ${conn.anonKey}` } });
+    if (!res.ok) return null;
+    return parseAnonymousSignInSetting(await res.json());
+  } catch {
+    return null;
+  }
+}
+async function askAnonymousSignIn(rl, conn) {
+  const detected = conn ? await tryDetectAnonymousSignIn(conn) : null;
+  if (detected !== null) {
+    console.log(`
+Detected: anonymous sign-in is ${detected ? "enabled" : "disabled"} on this project.`);
+    const confirmed = await promptYesNo(rl, "Is that correct?", true);
+    if (confirmed) return detected;
+  }
+  return promptYesNo(rl, "\nDoes this Supabase project have anonymous sign-in enabled (Authentication \u2192 Sign In / Providers \u2192 Anonymous)?");
+}
+async function askWriteGrants(rl, tables) {
+  if (tables.length === 0) return [];
+  const configure = await promptYesNo(rl, `
+Configure write access for ${tables.length} table(s)?`);
+  if (!configure) return [];
+  const grants = [];
+  for (const table of tables) {
+    const answer = await promptText(
+      rl,
+      `  ${table.name} -- grant writes? (i=insert, u=update, d=delete, comma-separate, Enter=none): `
+    );
+    const ops = parseWriteOpsAnswer(answer);
+    if (ops.length > 0) grants.push({ table: table.name, ops });
+  }
+  return grants;
+}
+async function askRpcSelection(rl, candidates) {
+  if (candidates.length === 0) return [];
+  console.log(`
+Available Postgres functions: ${candidates.join(", ")}`);
+  const answer = await promptText(rl, "Expose any as tools? (comma-separate, Enter=none): ");
+  return parseSelectionAnswer(answer, candidates);
+}
+async function askDocumentation(rl, tables) {
+  const missing = tablesMissingDocs(tables).filter((t) => t.missingTableComment || t.columnsWithoutComments.length > 0);
+  if (missing.length === 0) return [];
+  const configure = await promptYesNo(
+    rl,
+    `
+${missing.length} table(s) are missing documentation MCP tools would otherwise show agents -- write some now?`
+  );
+  if (!configure) return [];
+  const entries = [];
+  for (const t of missing) {
+    const entry = { table: t.name, columns: [] };
+    if (t.missingTableComment) {
+      const desc = await promptText(rl, `  ${t.name} -- what is this table for? (Enter to skip): `);
+      if (desc) entry.tableDescription = desc;
+    }
+    if (t.columnsWithoutComments.length > 0) {
+      const addColumns = await promptYesNo(
+        rl,
+        `  Add descriptions for ${t.name}'s ${t.columnsWithoutComments.length} undocumented column(s)?`
+      );
+      if (addColumns) {
+        for (const col of t.columnsWithoutComments) {
+          const desc = await promptText(rl, `    ${t.name}.${col}: `);
+          if (desc) entry.columns.push({ name: col, description: desc });
+        }
+      }
+    }
+    if (entry.tableDescription || entry.columns.length > 0) entries.push(entry);
+  }
+  return entries;
+}
+async function writeCommentsMigration(entries) {
+  const sql = buildCommentStatements(entries);
+  if (!sql) return null;
+  const migrationsDir = "supabase/migrations";
+  await mkdir(migrationsDir, { recursive: true });
+  const path = join(migrationsDir, `${timestamp()}_exposify_comments.sql`);
+  await writeFile(path, sql);
+  return path;
+}
 async function cmdInit() {
-  const migrationSql = await readFile(join(PACKAGE_ROOT, "sql/agentify_meta.sql"), "utf8");
+  const migrationSql = await readFile(join(PACKAGE_ROOT, "sql/exposify_meta.sql"), "utf8");
   const migrationsDir = "supabase/migrations";
   await mkdir(migrationsDir, { recursive: true });
-  const migrationPath = join(migrationsDir, `${timestamp()}_agentify_meta.sql`);
+  const migrationPath = join(migrationsDir, `${timestamp()}_exposify_meta.sql`);
   await writeFile(migrationPath, migrationSql);
   console.log(`Wrote ${migrationPath}`);
   await mkdir(FUNCTION_DIR, { recursive: true });
   const functionPath = join(FUNCTION_DIR, "index.ts");
-  if (await exists(functionPath)) {
-    console.log(`Skipped ${functionPath} (already exists)`);
-  } else {
-    await writeFile(functionPath, FUNCTION_TEMPLATE);
-    console.log(`Wrote ${functionPath}`);
-  }
+  const functionExists = await exists(functionPath);
   await mkdir(join(FUNCTION_DIR, "docs"), { recursive: true });
-  if (!hasSupabaseCli()) {
-    console.log("\nSupabase CLI not found on PATH -- install it to run the next steps automatically next time.");
-    printManualCommands();
-    return;
-  }
-  const connect = await promptYesNo(
-    "\nApply the migration and deploy the function to whatever Supabase project is currently linked, now?"
-  );
-  if (!connect) {
+  const rl = openInteractiveReadline();
+  if (!rl) {
+    if (!functionExists) {
+      await writeFile(functionPath, buildFunctionTemplate());
+      console.log(`Wrote ${functionPath}`);
+    } else {
+      console.log(`Skipped ${functionPath} (already exists)`);
+    }
     printManualCommands();
     return;
   }
-  let pushed = false;
   try {
-    console.log("\n$ supabase db push");
-    execFileSync("supabase", ["db", "push"], { stdio: "inherit" });
-    pushed = true;
-    console.log("\n$ supabase functions deploy mcp");
-    execFileSync("supabase", ["functions", "deploy", "mcp"], { stdio: "inherit" });
+    const conn = resolveConnectionInfo();
+    const anonymousSignIn = await askAnonymousSignIn(rl, conn);
+    let introspection = conn ? await tryIntrospect(conn) : null;
+    let alreadyPushed = false;
+    let alreadyDeployed = false;
+    if (!introspection) {
+      if (!functionExists) {
+        await writeFile(functionPath, buildFunctionTemplate({ anonymousSignIn }));
+        console.log(`Wrote ${functionPath}`);
+      } else {
+        console.log(`Skipped ${functionPath} (already exists)`);
+      }
+      if (!hasSupabaseCli()) {
+        console.log("\nSupabase CLI not found on PATH -- install it to run the next steps automatically next time.");
+        printManualCommands();
+        return;
+      }
+      const connect = await promptYesNo(
+        rl,
+        "\nApply the migration and deploy the function to whatever Supabase project is currently linked, now?"
+      );
+      if (!connect) {
+        printManualCommands();
+        return;
+      }
+      const result2 = pushAndDeploy();
+      alreadyPushed = result2.pushed;
+      alreadyDeployed = result2.deployed;
+      if (!result2.deployed) {
+        console.error(`
+Supabase CLI command failed: ${result2.error instanceof Error ? result2.error.message : result2.error}`);
+        printManualCommands({ alreadyPushed });
+        return;
+      }
+      introspection = conn ? await tryIntrospect(conn) : null;
+      if (!introspection) {
+        console.log(
+          "\nDeployed, but couldn't reach the project to introspect tables (no SUPABASE_URL/SUPABASE_ANON_KEY or --url/--key available). Re-run `exposify-supabase init` with those set to configure writes, RPCs, and documentation interactively."
+        );
+        console.log("\nDone. Paste the function URL + a user JWT into an MCP client to try it.");
+        return;
+      }
+    }
+    const grants = await askWriteGrants(rl, introspection.tables);
+    const rpcCandidates = rpcCandidatesFromOpenApi(introspection.openapi);
+    const rpc = await askRpcSelection(rl, rpcCandidates);
+    const docs = await askDocumentation(rl, introspection.tables);
+    const writes = flattenWriteGrants(grants);
+    let wroteFunctionFile = false;
+    if (!functionExists) {
+      await writeFile(functionPath, buildFunctionTemplate({ writes, rpc, anonymousSignIn }));
+      console.log(`
+Wrote ${functionPath} with your selections.`);
+      wroteFunctionFile = true;
+    } else if (writes.length > 0 || rpc.length > 0) {
+      console.log(`
+${functionPath} already exists -- left untouched. Merge this into your aiReady() config:`);
+      console.log(buildFunctionTemplate({ writes, rpc, anonymousSignIn }));
+    }
+    const commentsPath = await writeCommentsMigration(docs);
+    if (commentsPath) console.log(`Wrote ${commentsPath}`);
+    const needsDeploy = wroteFunctionFile || commentsPath !== null;
+    if (!needsDeploy) {
+      console.log("\nNothing new to deploy.");
+      return;
+    }
+    if (!hasSupabaseCli()) {
+      console.log("\nSupabase CLI not found on PATH.");
+      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile });
+      return;
+    }
+    const redeploy = await promptYesNo(rl, "\nApply/deploy these changes now?", true);
+    if (!redeploy) {
+      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile });
+      return;
+    }
+    const result = pushAndDeploy();
+    if (!result.deployed) {
+      console.error(`
+Supabase CLI command failed: ${result.error instanceof Error ? result.error.message : result.error}`);
+      printManualCommands({ alreadyPushed: result.pushed });
+      return;
+    }
     console.log("\nDone. Paste the function URL + a user JWT into an MCP client to try it.");
-  } catch (err) {
-    console.error(`
-Supabase CLI command failed: ${err instanceof Error ? err.message : err}`);
-    printManualCommands({ alreadyPushed: pushed });
+  } finally {
+    rl.close();
   }
 }
 async function cmdGenerate() {
-  const supabaseUrl = process.env.SUPABASE_URL ?? argValue("--url");
-  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY ?? argValue("--key");
-  if (!supabaseUrl || !serviceKey) {
+  const conn = resolveConnectionInfo();
+  if (!conn) {
     console.error(
-      "generate needs SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (env vars, or --url/--key flags) pointing at a running local or linked project (e.g. `supabase start`)."
+      "generate needs SUPABASE_URL and SUPABASE_ANON_KEY (env vars, or --url/--key flags) pointing at a running local or linked project (e.g. `supabase start`)."
     );
     process.exitCode = 1;
     return;
   }
-  const postgrestUrl = `${supabaseUrl.replace(/\/+$/, "")}/rest/v1`;
-  const headers = new Headers({ authorization: `Bearer ${serviceKey}`, apikey: serviceKey });
+  const postgrestUrl = `${conn.url.replace(/\/+$/, "")}/rest/v1`;
+  const headers = new Headers({ authorization: `Bearer ${conn.anonKey}`, apikey: conn.anonKey });
   const [openapi, metaRows] = await Promise.all([
     fetchOpenApi(postgrestUrl, headers, fetch),
-    fetchAgentifyMeta(postgrestUrl, headers, fetch)
+    fetchExposifyMeta(postgrestUrl, headers, fetch)
   ]);
   const manifest = buildManifest(openapi, metaRows, (/* @__PURE__ */ new Date()).toISOString());
-  const outPath = join(FUNCTION_DIR, "agentify.manifest.json");
+  const outPath = join(FUNCTION_DIR, "exposify.manifest.json");
   await mkdir(dirname(outPath), { recursive: true });
   await writeFile(outPath, JSON.stringify(manifest, null, 2));
   console.log(`Wrote ${outPath} (${manifest.tables.length} table(s))`);
@@ -254,10 +520,13 @@ async function main() {
   const [, , cmd] = process.argv;
   if (cmd === "init") return cmdInit();
   if (cmd === "generate") return cmdGenerate();
-  console.log("Usage: agentify-supabase <init|generate>");
-  console.log("  init      Scaffold the agentify_meta() migration + supabase/functions/mcp/index.ts,");
-  console.log("            then interactively offer to run `supabase db push` + `functions deploy`");
-  console.log("  generate  Build agentify.manifest.json from a running local/linked project");
+  console.log("Usage: exposify-supabase <init|generate> [--url <url>] [--key <anon-key>]");
+  console.log("  init      Scaffold the exposify_meta() migration + supabase/functions/mcp/index.ts.");
+  console.log("            Interactively offers to run `supabase db push` + `functions deploy`; if a");
+  console.log("            project is reachable (SUPABASE_URL/SUPABASE_ANON_KEY env vars, or --url/--key),");
+  console.log("            also walks through anonymous sign-in, per-table writes, RPC exposure, and");
+  console.log("            documentation for tables/columns missing a comment.");
+  console.log("  generate  Build exposify.manifest.json from a running local/linked project");
   process.exitCode = cmd ? 1 : 0;
 }
 main().catch((err) => {

package/dist/index.cjs

@@ -21,11 +21,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   MANIFEST_VERSION: () => MANIFEST_VERSION,
-  MissingAgentifyMetaError: () => MissingAgentifyMetaError,
+  MissingExposifyMetaError: () => MissingExposifyMetaError,
   aiReady: () => aiReady,
   buildManifest: () => buildManifest,
   columnsFromOpenApi: () => columnsFromOpenApi,
-  fetchAgentifyMeta: () => fetchAgentifyMeta,
+  fetchExposifyMeta: () => fetchExposifyMeta,
   fetchOpenApi: () => fetchOpenApi,
   introspectTables: () => introspectTables,
   loadManifest: () => loadManifest,
@@ -103,7 +103,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[agentify-supabase] ${message}`);
+    console.warn(`[exposify-supabase] ${message}`);
   } catch {
   }
 }
@@ -129,6 +129,7 @@ function buildPostgrestHeaders(incoming, anonKey) {
     if (value) headers.set(name, value);
   }
   if (!headers.has("apikey")) headers.set("apikey", anonKey);
+  if (!headers.has("authorization")) headers.set("authorization", `Bearer ${anonKey}`);
   return headers;
 }
 function createPostgrestClient(postgrestUrl, headers, fetchImpl) {
@@ -172,31 +173,31 @@ async function fetchOpenApi(postgrestUrl, headers, fetchImpl) {
 }
 
 // src/meta.ts
-var MissingAgentifyMetaError = class extends Error {
+var MissingExposifyMetaError = class extends Error {
   constructor(cause) {
     super(cause);
-    this.name = "MissingAgentifyMetaError";
+    this.name = "MissingExposifyMetaError";
   }
 };
-async function fetchAgentifyMeta(postgrestUrl, headers, fetchImpl) {
-  const res = await fetchImpl(`${postgrestUrl}/rpc/agentify_meta`, {
+async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
+  const res = await fetchImpl(`${postgrestUrl}/rpc/exposify_meta`, {
     method: "POST",
     headers: { ...Object.fromEntries(headers), "content-type": "application/json" },
     body: "{}"
   });
   if (res.status === 404) {
-    throw new MissingAgentifyMetaError(
-      "agentify_meta() is not reachable at /rpc/agentify_meta (404). Run `npx agentify-supabase init` (or apply sql/agentify_meta.sql directly) and `supabase db push`, then redeploy the function."
+    throw new MissingExposifyMetaError(
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     if (/PGRST202|function .* does not exist/i.test(body)) {
-      throw new MissingAgentifyMetaError(
-        "agentify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/agentify_meta.sql via `supabase db push`, then redeploy the function."
+      throw new MissingExposifyMetaError(
+        "exposify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/exposify_meta.sql via `supabase db push`, then redeploy the function."
       );
     }
-    throw new Error(`agentify_meta() call failed: HTTP ${res.status} ${body}`.trim());
+    throw new Error(`exposify_meta() call failed: HTTP ${res.status} ${body}`.trim());
   }
   return await res.json();
 }
@@ -227,7 +228,7 @@ function columnsFromOpenApi(doc, table) {
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
     // Primary/Foreign Key...<pk/|fk/>" boilerplate) -- strip that boilerplate
     // so a column with no real comment ends up `undefined`, not the
-    // boilerplate text. agentify_meta()'s copy wins when both exist anyway
+    // boilerplate text. exposify_meta()'s copy wins when both exist anyway
     // -- see introspect.ts's merge.
     description: prop.description?.replace(/\n*Note:[\s\S]*$/, "").trim() || void 0
   }));
@@ -262,7 +263,7 @@ function introspectTables(openapi, metaRows) {
       if (!fromOpenApi) continue;
       columns.push({
         ...fromOpenApi,
-        // agentify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
+        // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
         description: row.column_comment ?? fromOpenApi.description
       });
@@ -305,7 +306,7 @@ async function resolveTableSchemas(deps) {
   try {
     const [openapi, metaRows] = await Promise.all([
       fetchOpenApi(deps.postgrestUrl, deps.headers, deps.fetchImpl),
-      fetchAgentifyMeta(deps.postgrestUrl, deps.headers, deps.fetchImpl)
+      fetchExposifyMeta(deps.postgrestUrl, deps.headers, deps.fetchImpl)
     ]);
     return { tables: introspectTables(openapi, metaRows), mode: "runtime", warnings, openapi };
   } catch (err) {
@@ -315,7 +316,7 @@ async function resolveTableSchemas(deps) {
   if (manifest) {
     warnings.push({
       rung: "manifest",
-      reason: "runtime introspection failed; serving tools from the bundled agentify.manifest.json instead"
+      reason: "runtime introspection failed; serving tools from the bundled exposify.manifest.json instead"
     });
     return { tables: manifest.tables, mode: "manifest", warnings };
   }
@@ -602,9 +603,9 @@ ${h.chunk.text}`).join("\n\n---\n\n") : "No matching documentation found.";
 function registerDiagnosticsResource(server, warnings) {
   if (warnings.length === 0) return;
   server.registerResource(
-    "agentify-diagnostics",
-    "agentify://diagnostics",
-    { title: "agentify-supabase diagnostics", mimeType: "application/json" },
+    "exposify-diagnostics",
+    "exposify://diagnostics",
+    { title: "exposify-supabase diagnostics", mimeType: "application/json" },
     async (uri) => ({ contents: [{ uri: uri.href, text: JSON.stringify(warnings, null, 2) }] })
   );
 }
@@ -659,7 +660,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[agentify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[exposify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });
@@ -687,7 +688,7 @@ function aiReady(options = {}) {
           return { status: res.status, bodyText: await res.text() };
         };
         return buildSupabaseMcpServer({
-          appName: "agentify-supabase",
+          appName: "exposify-supabase",
           appVersion: "0.0.0",
           tables: ladder.tables,
           cfg,
@@ -706,11 +707,11 @@ function aiReady(options = {}) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MANIFEST_VERSION,
-  MissingAgentifyMetaError,
+  MissingExposifyMetaError,
   aiReady,
   buildManifest,
   columnsFromOpenApi,
-  fetchAgentifyMeta,
+  fetchExposifyMeta,
   fetchOpenApi,
   introspectTables,
   loadManifest,

package/dist/index.d.cts

@@ -7,18 +7,18 @@ interface ColumnSchema {
     /** OpenAPI `format`, e.g. "uuid", "timestamp with time zone", "bigint". */
     format?: string;
     required: boolean;
-    /** From `agentify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
+    /** From `exposify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
     description?: string;
     isPrimaryKey?: boolean;
 }
 interface TableSchema {
     name: string;
     rlsEnabled: boolean;
-    /** From `agentify_meta()`'s `table_comment` (a `COMMENT ON TABLE`). */
+    /** From `exposify_meta()`'s `table_comment` (a `COMMENT ON TABLE`). */
     description?: string;
     columns: ColumnSchema[];
 }
-/** One row of `agentify_meta()` -- the migration returns one row per column. */
+/** One row of `exposify_meta()` -- the migration returns one row per column. */
 interface MetaRow {
     table_name: string;
     rls_enabled: boolean;
@@ -62,7 +62,7 @@ interface AgentifySupabaseOptions {
     anonKey?: string;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
-    /** Bundled fallback manifest (from `agentify-supabase generate`), used when runtime introspection fails. */
+    /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */
     manifest?: unknown;
     rateLimit?: number;
     rateWindowMs?: number;
@@ -98,7 +98,7 @@ interface PostgrestColumnProperty {
 /**
  * Extracts column schemas for one table from a PostgREST OpenAPI document.
  * Returns `[]` for a table PostgREST never exposed (not in `definitions` --
- * e.g. it exists at the catalog level per `agentify_meta()` but PostgREST's
+ * e.g. it exists at the catalog level per `exposify_meta()` but PostgREST's
  * role lacks USAGE/SELECT grants on it), which the caller treats the same as
  * "RLS-less": never shown to the agent.
  */
@@ -113,27 +113,27 @@ declare function columnsFromOpenApi(doc: PostgrestOpenApiDoc, table: string): Co
 declare function rpcArgSchema(doc: PostgrestOpenApiDoc, fn: string): JsonSchemaObject | null;
 
 declare const MANIFEST_VERSION = 1;
-interface AgentifyManifest {
+interface ExposifyManifest {
     version: typeof MANIFEST_VERSION;
     generatedAt: string;
     tables: TableSchema[];
 }
-/** Built by `npx agentify-supabase generate` against a local/linked project. */
-declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): AgentifyManifest;
+/** Built by `npx exposify-supabase generate` against a local/linked project. */
+declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): ExposifyManifest;
 /**
  * Defensive load: a manifest is bundled JSON shipped alongside the function
  * and can go stale relative to the deployed schema, or simply be malformed
  * (hand-edited, wrong version). Returns `null` -- never throws -- so the
  * degradation ladder can fall through to the next rung instead of crashing.
  */
-declare function loadManifest(raw: unknown): AgentifyManifest | null;
+declare function loadManifest(raw: unknown): ExposifyManifest | null;
 
 /**
- * Merges PostgREST's OpenAPI document (column types) with `agentify_meta()`
+ * Merges PostgREST's OpenAPI document (column types) with `exposify_meta()`
  * rows (RLS status + comments) into the DB tool surface.
  *
  * DB exposure policy (spec, locked): RLS-gated, reads auto. A table only
- * appears here if `agentify_meta()` reports `rls_enabled: true` for it AND
+ * appears here if `exposify_meta()` reports `rls_enabled: true` for it AND
  * PostgREST actually exposes it in its OpenAPI `definitions` (the role
  * calling this has grants on it) -- a table failing either check never
  * appears, silently, exactly like a table PostgREST doesn't know about at
@@ -142,25 +142,26 @@ declare function loadManifest(raw: unknown): AgentifyManifest | null;
  */
 declare function introspectTables(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[]): TableSchema[];
 
-declare class MissingAgentifyMetaError extends Error {
+declare class MissingExposifyMetaError extends Error {
     constructor(cause: string);
 }
 /**
- * Calls the `agentify_meta()` Postgres function via PostgREST's RPC
- * endpoint. Requires the migration from `sql/agentify_meta.sql` to have been
+ * Calls the `exposify_meta()` Postgres function via PostgREST's RPC
+ * endpoint. Requires the migration from `sql/exposify_meta.sql` to have been
  * applied; a 404 (unknown route) or PostgREST's `PGRST202` (function not
  * found in schema cache) both mean "migration missing" and are translated
  * into a self-diagnosing error (spec: "a missing `agentify_meta()` migration
- * produces a self-diagnosing message naming the exact fix").
+ * produces a self-diagnosing message naming the exact fix" -- function
+ * renamed to `exposify_meta()` post-spec, see the decisions journal).
  */
-declare function fetchAgentifyMeta(postgrestUrl: string, headers: Headers, fetchImpl: typeof fetch): Promise<MetaRow[]>;
+declare function fetchExposifyMeta(postgrestUrl: string, headers: Headers, fetchImpl: typeof fetch): Promise<MetaRow[]>;
 
 /** PostgREST serves its OpenAPI document at the API root when asked for it explicitly. */
 declare function fetchOpenApi(postgrestUrl: string, headers: Headers, fetchImpl: typeof fetch): Promise<PostgrestOpenApiDoc>;
 
 /**
  * Builds the `Deno.serve`-compatible MCP handler. Everything expensive
- * (OpenAPI fetch, `agentify_meta()` call, doc loading/chunking) happens
+ * (OpenAPI fetch, `exposify_meta()` call, doc loading/chunking) happens
  * lazily on first request and is cached in-memory for the life of the edge
  * instance -- "cold start" in the spec's sense, not literally module load,
  * since env vars and the incoming JWT aren't available before the first
@@ -168,4 +169,4 @@ declare function fetchOpenApi(postgrestUrl: string, headers: Headers, fetchImpl:
  */
 declare function aiReady(options?: AgentifySupabaseOptions): WebMcpHandler;
 
-export { type AgentifyManifest, type AgentifySupabaseOptions, MANIFEST_VERSION, MissingAgentifyMetaError, type PostgrestOpenApiDoc, aiReady, buildManifest, columnsFromOpenApi, fetchAgentifyMeta, fetchOpenApi, introspectTables, loadManifest, rpcArgSchema };
+export { type AgentifySupabaseOptions, type ExposifyManifest, MANIFEST_VERSION, MissingExposifyMetaError, type PostgrestOpenApiDoc, aiReady, buildManifest, columnsFromOpenApi, fetchExposifyMeta, fetchOpenApi, introspectTables, loadManifest, rpcArgSchema };

package/dist/index.d.ts

@@ -7,18 +7,18 @@ interface ColumnSchema {
     /** OpenAPI `format`, e.g. "uuid", "timestamp with time zone", "bigint". */
     format?: string;
     required: boolean;
-    /** From `agentify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
+    /** From `exposify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
     description?: string;
     isPrimaryKey?: boolean;
 }
 interface TableSchema {
     name: string;
     rlsEnabled: boolean;
-    /** From `agentify_meta()`'s `table_comment` (a `COMMENT ON TABLE`). */
+    /** From `exposify_meta()`'s `table_comment` (a `COMMENT ON TABLE`). */
     description?: string;
     columns: ColumnSchema[];
 }
-/** One row of `agentify_meta()` -- the migration returns one row per column. */
+/** One row of `exposify_meta()` -- the migration returns one row per column. */
 interface MetaRow {
     table_name: string;
     rls_enabled: boolean;
@@ -62,7 +62,7 @@ interface AgentifySupabaseOptions {
     anonKey?: string;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
-    /** Bundled fallback manifest (from `agentify-supabase generate`), used when runtime introspection fails. */
+    /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */
     manifest?: unknown;
     rateLimit?: number;
     rateWindowMs?: number;
@@ -98,7 +98,7 @@ interface PostgrestColumnProperty {
 /**
  * Extracts column schemas for one table from a PostgREST OpenAPI document.
  * Returns `[]` for a table PostgREST never exposed (not in `definitions` --
- * e.g. it exists at the catalog level per `agentify_meta()` but PostgREST's
+ * e.g. it exists at the catalog level per `exposify_meta()` but PostgREST's
  * role lacks USAGE/SELECT grants on it), which the caller treats the same as
  * "RLS-less": never shown to the agent.
  */
@@ -113,27 +113,27 @@ declare function columnsFromOpenApi(doc: PostgrestOpenApiDoc, table: string): Co
 declare function rpcArgSchema(doc: PostgrestOpenApiDoc, fn: string): JsonSchemaObject | null;
 
 declare const MANIFEST_VERSION = 1;
-interface AgentifyManifest {
+interface ExposifyManifest {
     version: typeof MANIFEST_VERSION;
     generatedAt: string;
     tables: TableSchema[];
 }
-/** Built by `npx agentify-supabase generate` against a local/linked project. */
-declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): AgentifyManifest;
+/** Built by `npx exposify-supabase generate` against a local/linked project. */
+declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): ExposifyManifest;
 /**
  * Defensive load: a manifest is bundled JSON shipped alongside the function
  * and can go stale relative to the deployed schema, or simply be malformed
  * (hand-edited, wrong version). Returns `null` -- never throws -- so the
  * degradation ladder can fall through to the next rung instead of crashing.
  */
-declare function loadManifest(raw: unknown): AgentifyManifest | null;
+declare function loadManifest(raw: unknown): ExposifyManifest | null;
 
 /**
- * Merges PostgREST's OpenAPI document (column types) with `agentify_meta()`
+ * Merges PostgREST's OpenAPI document (column types) with `exposify_meta()`
  * rows (RLS status + comments) into the DB tool surface.
  *
  * DB exposure policy (spec, locked): RLS-gated, reads auto. A table only
- * appears here if `agentify_meta()` reports `rls_enabled: true` for it AND
+ * appears here if `exposify_meta()` reports `rls_enabled: true` for it AND
  * PostgREST actually exposes it in its OpenAPI `definitions` (the role
  * calling this has grants on it) -- a table failing either check never
  * appears, silently, exactly like a table PostgREST doesn't know about at
@@ -142,25 +142,26 @@ declare function loadManifest(raw: unknown): AgentifyManifest | null;
  */
 declare function introspectTables(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[]): TableSchema[];
 
-declare class MissingAgentifyMetaError extends Error {
+declare class MissingExposifyMetaError extends Error {
     constructor(cause: string);
 }
 /**
- * Calls the `agentify_meta()` Postgres function via PostgREST's RPC
- * endpoint. Requires the migration from `sql/agentify_meta.sql` to have been
+ * Calls the `exposify_meta()` Postgres function via PostgREST's RPC
+ * endpoint. Requires the migration from `sql/exposify_meta.sql` to have been
  * applied; a 404 (unknown route) or PostgREST's `PGRST202` (function not
  * found in schema cache) both mean "migration missing" and are translated
  * into a self-diagnosing error (spec: "a missing `agentify_meta()` migration
- * produces a self-diagnosing message naming the exact fix").
+ * produces a self-diagnosing message naming the exact fix" -- function
+ * renamed to `exposify_meta()` post-spec, see the decisions journal).
  */
-declare function fetchAgentifyMeta(postgrestUrl: string, headers: Headers, fetchImpl: typeof fetch): Promise<MetaRow[]>;
+declare function fetchExposifyMeta(postgrestUrl: string, headers: Headers, fetchImpl: typeof fetch): Promise<MetaRow[]>;
 
 /** PostgREST serves its OpenAPI document at the API root when asked for it explicitly. */
 declare function fetchOpenApi(postgrestUrl: string, headers: Headers, fetchImpl: typeof fetch): Promise<PostgrestOpenApiDoc>;
 
 /**
  * Builds the `Deno.serve`-compatible MCP handler. Everything expensive
- * (OpenAPI fetch, `agentify_meta()` call, doc loading/chunking) happens
+ * (OpenAPI fetch, `exposify_meta()` call, doc loading/chunking) happens
  * lazily on first request and is cached in-memory for the life of the edge
  * instance -- "cold start" in the spec's sense, not literally module load,
  * since env vars and the incoming JWT aren't available before the first
@@ -168,4 +169,4 @@ declare function fetchOpenApi(postgrestUrl: string, headers: Headers, fetchImpl:
  */
 declare function aiReady(options?: AgentifySupabaseOptions): WebMcpHandler;
 
-export { type AgentifyManifest, type AgentifySupabaseOptions, MANIFEST_VERSION, MissingAgentifyMetaError, type PostgrestOpenApiDoc, aiReady, buildManifest, columnsFromOpenApi, fetchAgentifyMeta, fetchOpenApi, introspectTables, loadManifest, rpcArgSchema };
+export { type AgentifySupabaseOptions, type ExposifyManifest, MANIFEST_VERSION, MissingExposifyMetaError, type PostgrestOpenApiDoc, aiReady, buildManifest, columnsFromOpenApi, fetchExposifyMeta, fetchOpenApi, introspectTables, loadManifest, rpcArgSchema };

package/dist/index.js

@@ -70,7 +70,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[agentify-supabase] ${message}`);
+    console.warn(`[exposify-supabase] ${message}`);
   } catch {
   }
 }
@@ -96,6 +96,7 @@ function buildPostgrestHeaders(incoming, anonKey) {
     if (value) headers.set(name, value);
   }
   if (!headers.has("apikey")) headers.set("apikey", anonKey);
+  if (!headers.has("authorization")) headers.set("authorization", `Bearer ${anonKey}`);
   return headers;
 }
 function createPostgrestClient(postgrestUrl, headers, fetchImpl) {
@@ -139,31 +140,31 @@ async function fetchOpenApi(postgrestUrl, headers, fetchImpl) {
 }
 
 // src/meta.ts
-var MissingAgentifyMetaError = class extends Error {
+var MissingExposifyMetaError = class extends Error {
   constructor(cause) {
     super(cause);
-    this.name = "MissingAgentifyMetaError";
+    this.name = "MissingExposifyMetaError";
   }
 };
-async function fetchAgentifyMeta(postgrestUrl, headers, fetchImpl) {
-  const res = await fetchImpl(`${postgrestUrl}/rpc/agentify_meta`, {
+async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
+  const res = await fetchImpl(`${postgrestUrl}/rpc/exposify_meta`, {
     method: "POST",
     headers: { ...Object.fromEntries(headers), "content-type": "application/json" },
     body: "{}"
   });
   if (res.status === 404) {
-    throw new MissingAgentifyMetaError(
-      "agentify_meta() is not reachable at /rpc/agentify_meta (404). Run `npx agentify-supabase init` (or apply sql/agentify_meta.sql directly) and `supabase db push`, then redeploy the function."
+    throw new MissingExposifyMetaError(
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     if (/PGRST202|function .* does not exist/i.test(body)) {
-      throw new MissingAgentifyMetaError(
-        "agentify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/agentify_meta.sql via `supabase db push`, then redeploy the function."
+      throw new MissingExposifyMetaError(
+        "exposify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/exposify_meta.sql via `supabase db push`, then redeploy the function."
       );
     }
-    throw new Error(`agentify_meta() call failed: HTTP ${res.status} ${body}`.trim());
+    throw new Error(`exposify_meta() call failed: HTTP ${res.status} ${body}`.trim());
   }
   return await res.json();
 }
@@ -194,7 +195,7 @@ function columnsFromOpenApi(doc, table) {
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
     // Primary/Foreign Key...<pk/|fk/>" boilerplate) -- strip that boilerplate
     // so a column with no real comment ends up `undefined`, not the
-    // boilerplate text. agentify_meta()'s copy wins when both exist anyway
+    // boilerplate text. exposify_meta()'s copy wins when both exist anyway
     // -- see introspect.ts's merge.
     description: prop.description?.replace(/\n*Note:[\s\S]*$/, "").trim() || void 0
   }));
@@ -229,7 +230,7 @@ function introspectTables(openapi, metaRows) {
       if (!fromOpenApi) continue;
       columns.push({
         ...fromOpenApi,
-        // agentify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
+        // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
         description: row.column_comment ?? fromOpenApi.description
       });
@@ -272,7 +273,7 @@ async function resolveTableSchemas(deps) {
   try {
     const [openapi, metaRows] = await Promise.all([
       fetchOpenApi(deps.postgrestUrl, deps.headers, deps.fetchImpl),
-      fetchAgentifyMeta(deps.postgrestUrl, deps.headers, deps.fetchImpl)
+      fetchExposifyMeta(deps.postgrestUrl, deps.headers, deps.fetchImpl)
     ]);
     return { tables: introspectTables(openapi, metaRows), mode: "runtime", warnings, openapi };
   } catch (err) {
@@ -282,7 +283,7 @@ async function resolveTableSchemas(deps) {
   if (manifest) {
     warnings.push({
       rung: "manifest",
-      reason: "runtime introspection failed; serving tools from the bundled agentify.manifest.json instead"
+      reason: "runtime introspection failed; serving tools from the bundled exposify.manifest.json instead"
     });
     return { tables: manifest.tables, mode: "manifest", warnings };
   }
@@ -572,9 +573,9 @@ ${h.chunk.text}`).join("\n\n---\n\n") : "No matching documentation found.";
 function registerDiagnosticsResource(server, warnings) {
   if (warnings.length === 0) return;
   server.registerResource(
-    "agentify-diagnostics",
-    "agentify://diagnostics",
-    { title: "agentify-supabase diagnostics", mimeType: "application/json" },
+    "exposify-diagnostics",
+    "exposify://diagnostics",
+    { title: "exposify-supabase diagnostics", mimeType: "application/json" },
     async (uri) => ({ contents: [{ uri: uri.href, text: JSON.stringify(warnings, null, 2) }] })
   );
 }
@@ -629,7 +630,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[agentify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[exposify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });
@@ -657,7 +658,7 @@ function aiReady(options = {}) {
           return { status: res.status, bodyText: await res.text() };
         };
         return buildSupabaseMcpServer({
-          appName: "agentify-supabase",
+          appName: "exposify-supabase",
           appVersion: "0.0.0",
           tables: ladder.tables,
           cfg,
@@ -675,11 +676,11 @@ function aiReady(options = {}) {
 }
 export {
   MANIFEST_VERSION,
-  MissingAgentifyMetaError,
+  MissingExposifyMetaError,
   aiReady,
   buildManifest,
   columnsFromOpenApi,
-  fetchAgentifyMeta,
+  fetchExposifyMeta,
   fetchOpenApi,
   introspectTables,
   loadManifest,

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "agentify-supabase": "./dist/cli.js"
+    "exposify-supabase": "./dist/cli.js"
   },
   "exports": {
     ".": {
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.0.0",
+    "@exposify/core": "0.2.0",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },
@@ -39,5 +39,14 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ayadagain/agentready.git",
+    "directory": "packages/supabase"
+  },
+  "homepage": "https://github.com/ayadagain/agentready/tree/main/packages/supabase#readme",
+  "bugs": {
+    "url": "https://github.com/ayadagain/agentready/issues"
   }
 }

package/sql/{agentify_meta.sql → exposify_meta.sql}

@@ -1,6 +1,6 @@
--- agentify-supabase: schema introspection function.
+-- exposify-supabase: schema introspection function.
 --
--- Exposes, per PostgREST's RPC convention (POST /rpc/agentify_meta), one row
+-- Exposes, per PostgREST's RPC convention (POST /rpc/exposify_meta), one row
 -- per column of every ordinary table in the `public` schema: whether Row
 -- Level Security is enabled on its table, and the table/column comments an
 -- owner wrote via `COMMENT ON TABLE` / `COMMENT ON COLUMN`.
@@ -12,7 +12,15 @@
 -- necessarily SELECT from would otherwise be blocked; the function only ever
 -- returns catalog metadata, never row data, so this does not leak anything
 -- RLS would otherwise protect.
-create or replace function public.agentify_meta()
+--
+-- Renamed from agentify_meta() -- if you already applied that migration to a
+-- live project, this file alone will NOT rename it there (Postgres tracks
+-- migrations by filename, not by diffing function bodies). Apply this
+-- instead on an already-deployed project:
+--   alter function public.agentify_meta() rename to exposify_meta();
+-- or drop the old one after confirming nothing else calls it:
+--   drop function public.agentify_meta();
+create or replace function public.exposify_meta()
 returns table (
   table_name text,
   rls_enabled boolean,
@@ -43,4 +51,4 @@ $$;
 -- PostgREST's `anon`/`authenticated` roles must be able to call this RPC;
 -- the SECURITY DEFINER body above is what makes that safe (catalog metadata
 -- only, never row data).
-grant execute on function public.agentify_meta() to anon, authenticated;
+grant execute on function public.exposify_meta() to anon, authenticated;