@exposify/supabase 0.1.0 → 0.3.1

package/dist/cli.js

@@ -1,49 +1,56 @@
 #!/usr/bin/env node
 
 // bin/cli.ts
-import { mkdir, readFile, writeFile, access } from "fs/promises";
+import { mkdir, readFile, writeFile, access, readdir } from "fs/promises";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { execFileSync } from "child_process";
 import { createInterface } from "readline/promises";
 
 // src/fetch-openapi.ts
+var WRONG_KEY_TIER_RE = /service_role|secret api key/i;
 async function fetchOpenApi(postgrestUrl, headers, fetchImpl) {
   const res = await fetchImpl(postgrestUrl, {
     headers: { ...Object.fromEntries(headers), accept: "application/openapi+json" }
   });
   if (!res.ok) {
-    throw new Error(`PostgREST OpenAPI fetch failed: HTTP ${res.status}`);
+    const body = await res.text().catch(() => "");
+    if (res.status === 401 && WRONG_KEY_TIER_RE.test(body)) {
+      throw new Error(
+        `PostgREST OpenAPI fetch failed: HTTP 401 -- Supabase rejected this request because it wasn't made with the service role key (response: "${body.trim()}"). Schema introspection always needs SUPABASE_SERVICE_ROLE_KEY, never the anon key -- see this package's README, "Why introspection needs the service role key". In a deployed function this is auto-injected automatically; for local dev/testing pass { serviceRoleKey } explicitly (or --key for the CLI).`
+      );
+    }
+    throw new Error(`PostgREST OpenAPI fetch failed: HTTP ${res.status}${body ? `: ${body}` : ""}`);
   }
   return await res.json();
 }
 
 // src/meta.ts
-var MissingAgentifyMetaError = class extends Error {
+var MissingExposifyMetaError = class extends Error {
   constructor(cause) {
     super(cause);
-    this.name = "MissingAgentifyMetaError";
+    this.name = "MissingExposifyMetaError";
   }
 };
-async function fetchAgentifyMeta(postgrestUrl, headers, fetchImpl) {
-  const res = await fetchImpl(`${postgrestUrl}/rpc/agentify_meta`, {
+async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
+  const res = await fetchImpl(`${postgrestUrl}/rpc/exposify_meta`, {
     method: "POST",
     headers: { ...Object.fromEntries(headers), "content-type": "application/json" },
     body: "{}"
   });
   if (res.status === 404) {
-    throw new MissingAgentifyMetaError(
-      "agentify_meta() is not reachable at /rpc/agentify_meta (404). Run `npx agentify-supabase init` (or apply sql/agentify_meta.sql directly) and `supabase db push`, then redeploy the function."
+    throw new MissingExposifyMetaError(
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     if (/PGRST202|function .* does not exist/i.test(body)) {
-      throw new MissingAgentifyMetaError(
-        "agentify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/agentify_meta.sql via `supabase db push`, then redeploy the function."
+      throw new MissingExposifyMetaError(
+        "exposify_meta() is missing from the database (PostgREST error PGRST202). Apply the migration in sql/exposify_meta.sql via `supabase db push`, then redeploy the function."
       );
     }
-    throw new Error(`agentify_meta() call failed: HTTP ${res.status} ${body}`.trim());
+    throw new Error(`exposify_meta() call failed: HTTP ${res.status} ${body}`.trim());
   }
   return await res.json();
 }
@@ -74,7 +81,7 @@ function columnsFromOpenApi(doc, table) {
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
     // Primary/Foreign Key...<pk/|fk/>" boilerplate) -- strip that boilerplate
     // so a column with no real comment ends up `undefined`, not the
-    // boilerplate text. agentify_meta()'s copy wins when both exist anyway
+    // boilerplate text. exposify_meta()'s copy wins when both exist anyway
     // -- see introspect.ts's merge.
     description: prop.description?.replace(/\n*Note:[\s\S]*$/, "").trim() || void 0
   }));
@@ -99,7 +106,7 @@ function introspectTables(openapi, metaRows) {
       if (!fromOpenApi) continue;
       columns.push({
         ...fromOpenApi,
-        // agentify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
+        // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
         description: row.column_comment ?? fromOpenApi.description
       });
@@ -130,19 +137,129 @@ function buildManifest(openapi, metaRows, generatedAt) {
   return { version: MANIFEST_VERSION, generatedAt, tables: introspectTables(openapi, metaRows) };
 }
 
+// bin/wizard.ts
+function parseAnonymousSignInSetting(settings) {
+  if (!settings || typeof settings !== "object") return null;
+  const s = settings;
+  const external = s.external;
+  if (external && typeof external.anonymous_users === "boolean") return external.anonymous_users;
+  if (typeof s.anonymous_users === "boolean") return s.anonymous_users;
+  if (typeof s.external_anonymous_users === "boolean") return s.external_anonymous_users;
+  return null;
+}
+function rpcCandidatesFromOpenApi(doc) {
+  return Object.keys(doc.paths ?? {}).filter((p) => p.startsWith("/rpc/")).map((p) => p.slice("/rpc/".length)).filter((name) => name.length > 0 && name !== "exposify_meta").sort();
+}
+function flattenWriteGrants(grants) {
+  return grants.flatMap((g) => g.ops.map((op) => `${g.table}.${op}`));
+}
+function parseWriteOpsAnswer(answer) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of answer.split(",")) {
+    const token = raw.trim().toLowerCase();
+    if (token === "i" || token === "insert") seen.add("insert");
+    else if (token === "u" || token === "update") seen.add("update");
+    else if (token === "d" || token === "delete") seen.add("delete");
+  }
+  return ["insert", "update", "delete"].filter((op) => seen.has(op));
+}
+function parseSelectionAnswer(answer, candidates) {
+  const wanted = new Set(
+    answer.split(",").map((s) => s.trim()).filter(Boolean)
+  );
+  return candidates.filter((c) => wanted.has(c));
+}
+function tablesMissingDocs(tables) {
+  return tables.map((t) => ({
+    name: t.name,
+    missingTableComment: !t.description,
+    columnsWithoutComments: t.columns.filter((c) => !c.description).map((c) => c.name)
+  }));
+}
+function sqlStringLiteral(text) {
+  return `'${text.replace(/'/g, "''")}'`;
+}
+function sqlIdentifier(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function buildCommentStatements(entries) {
+  const lines = [];
+  for (const entry of entries) {
+    const table = sqlIdentifier(entry.table);
+    if (entry.tableDescription) {
+      lines.push(`comment on table public.${table} is ${sqlStringLiteral(entry.tableDescription)};`);
+    }
+    for (const col of entry.columns) {
+      lines.push(
+        `comment on column public.${table}.${sqlIdentifier(col.name)} is ${sqlStringLiteral(col.description)};`
+      );
+    }
+  }
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "";
+}
+var ANONYMOUS_SIGN_IN_WARNING = `// NOTE: this project has anonymous sign-in enabled. An anonymous Supabase
+// Auth session still gets role: authenticated (with an is_anonymous claim),
+// NOT role: anon -- so it passes any RLS policy scoped to "authenticated"
+// unless that policy explicitly excludes auth.jwt()->>'is_anonymous' = 'true'.
+// Double-check your RLS policies (especially on tables granted writes below)
+// account for this before trusting "authenticated" to mean "a real user".
+`;
+function buildFunctionTemplate(opts = {}) {
+  const lines = [];
+  if (opts.anonymousSignIn) lines.push(ANONYMOUS_SIGN_IN_WARNING);
+  lines.push(`import { aiReady } from "npm:@exposify/supabase";`, "");
+  lines.push("Deno.serve(aiReady({");
+  lines.push(
+    opts.writes && opts.writes.length > 0 ? `  writes: ${JSON.stringify(opts.writes)},` : `  // writes: ["orders.insert", "orders.update"],`
+  );
+  lines.push(
+    opts.rpc && opts.rpc.length > 0 ? `  rpc: ${JSON.stringify(opts.rpc)},` : `  // rpc: ["place_order"],`
+  );
+  lines.push(
+    "  // functions: {",
+    '  //   refund: { description: "Refund an order", input: { type: "object", properties: {} } },',
+    "  // },",
+    "}));",
+    ""
+  );
+  return lines.join("\n");
+}
+function findExistingMigration(filenames, suffix) {
+  const matches = filenames.filter((f) => f.endsWith(suffix)).sort();
+  return matches[0] ?? null;
+}
+function uniqueMigrationFilename(existing, desired) {
+  if (!existing.includes(desired)) return desired;
+  const dot = desired.lastIndexOf(".");
+  const base = dot === -1 ? desired : desired.slice(0, dot);
+  const ext = dot === -1 ? "" : desired.slice(dot);
+  let i = 2;
+  let candidate = `${base}-${i}${ext}`;
+  while (existing.includes(candidate)) candidate = `${base}-${++i}${ext}`;
+  return candidate;
+}
+function partialConnectionWarning(url, key) {
+  if (url && !key) return "SUPABASE_URL is set but SUPABASE_SERVICE_ROLE_KEY (or --key) is not -- both are required to introspect.";
+  if (!url && key) return "SUPABASE_SERVICE_ROLE_KEY (or --key) is set but SUPABASE_URL is not -- both are required to introspect.";
+  return null;
+}
+
 // bin/cli.ts
 var PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 var FUNCTION_DIR = "supabase/functions/mcp";
-var FUNCTION_TEMPLATE = `import { aiReady } from "npm:@exposify/supabase";
-
-Deno.serve(aiReady({
-  // writes: ["orders.insert", "orders.update"],
-  // rpc: ["place_order"],
-  // functions: {
-  //   refund: { description: "Refund an order", input: { type: "object", properties: {} } },
-  // },
-}));
-`;
+var MIGRATIONS_DIR = "supabase/migrations";
+var FETCH_TIMEOUT_MS = 1e4;
+function fetchWithTimeout(input, init) {
+  return fetch(input, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+}
+async function listFilesOrEmpty(dir) {
+  try {
+    return await readdir(dir);
+  } catch {
+    return [];
+  }
+}
 async function exists(path) {
   try {
     await access(path);
@@ -159,15 +276,18 @@ function hasSupabaseCli() {
     return false;
   }
 }
-async function promptYesNo(question) {
-  if (!process.stdin.isTTY) return false;
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
+function openInteractiveReadline() {
+  if (!process.stdin.isTTY) return null;
+  return createInterface({ input: process.stdin, output: process.stdout });
+}
+async function promptYesNo(rl, question, defaultYes = false) {
+  const suffix = defaultYes ? "[Y/n]" : "[y/N]";
+  const answer = (await rl.question(`${question} ${suffix} `)).trim().toLowerCase();
+  if (answer === "") return defaultYes;
+  return answer === "y" || answer === "yes";
+}
+async function promptText(rl, question) {
+  return (await rl.question(question)).trim();
 }
 function printManualCommands(opts = {}) {
   console.log("\nRun these to finish setup:");
@@ -177,66 +297,280 @@ function printManualCommands(opts = {}) {
   steps.forEach((cmd, i) => console.log(`  ${i + 1}. ${cmd}`));
   console.log(`  ${steps.length + 1}. Paste the function URL + a user JWT into an MCP client.`);
 }
+function pushAndDeploy() {
+  let pushed = false;
+  try {
+    console.log("\n$ supabase db push");
+    execFileSync("supabase", ["db", "push"], { stdio: "inherit" });
+    pushed = true;
+    console.log("\n$ supabase functions deploy mcp");
+    execFileSync("supabase", ["functions", "deploy", "mcp"], { stdio: "inherit" });
+    return { pushed: true, deployed: true };
+  } catch (err) {
+    return { pushed, deployed: false, error: err };
+  }
+}
+function resolveConnectionInfo() {
+  const url = process.env.SUPABASE_URL ?? argValue("--url");
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY ?? argValue("--key");
+  if (!url || !serviceRoleKey) return null;
+  return { url, serviceRoleKey };
+}
+async function tryIntrospect(conn) {
+  try {
+    const postgrestUrl = `${conn.url.replace(/\/+$/, "")}/rest/v1`;
+    const headers = new Headers({ authorization: `Bearer ${conn.serviceRoleKey}`, apikey: conn.serviceRoleKey });
+    const [openapi, metaRows] = await Promise.all([
+      fetchOpenApi(postgrestUrl, headers, fetchWithTimeout),
+      fetchExposifyMeta(postgrestUrl, headers, fetchWithTimeout)
+    ]);
+    return { tables: introspectTables(openapi, metaRows), openapi };
+  } catch (err) {
+    if (!(err instanceof MissingExposifyMetaError)) {
+      console.log(`
+Couldn't introspect the project: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return null;
+  }
+}
+async function tryDetectAnonymousSignIn(conn) {
+  try {
+    const url = `${conn.url.replace(/\/+$/, "")}/auth/v1/settings`;
+    const res = await fetchWithTimeout(url, {
+      headers: { apikey: conn.serviceRoleKey, authorization: `Bearer ${conn.serviceRoleKey}` }
+    });
+    if (!res.ok) return null;
+    return parseAnonymousSignInSetting(await res.json());
+  } catch {
+    return null;
+  }
+}
+async function askAnonymousSignIn(rl, conn) {
+  const detected = conn ? await tryDetectAnonymousSignIn(conn) : null;
+  if (detected !== null) {
+    console.log(`
+Detected: anonymous sign-in is ${detected ? "enabled" : "disabled"} on this project.`);
+    const confirmed = await promptYesNo(rl, "Is that correct?", true);
+    if (confirmed) return detected;
+  }
+  return promptYesNo(rl, "\nDoes this Supabase project have anonymous sign-in enabled (Authentication \u2192 Sign In / Providers \u2192 Anonymous)?");
+}
+async function askWriteGrants(rl, tables) {
+  if (tables.length === 0) return [];
+  const configure = await promptYesNo(rl, `
+Configure write access for ${tables.length} table(s)?`);
+  if (!configure) return [];
+  const grants = [];
+  for (const table of tables) {
+    const answer = await promptText(
+      rl,
+      `  ${table.name} -- grant writes? (i=insert, u=update, d=delete, comma-separate, Enter=none): `
+    );
+    const ops = parseWriteOpsAnswer(answer);
+    if (ops.length > 0) grants.push({ table: table.name, ops });
+  }
+  return grants;
+}
+async function askRpcSelection(rl, candidates) {
+  if (candidates.length === 0) return [];
+  console.log(`
+Available Postgres functions: ${candidates.join(", ")}`);
+  const answer = await promptText(rl, "Expose any as tools? (comma-separate, Enter=none): ");
+  return parseSelectionAnswer(answer, candidates);
+}
+async function askDocumentation(rl, tables) {
+  const missing = tablesMissingDocs(tables).filter((t) => t.missingTableComment || t.columnsWithoutComments.length > 0);
+  if (missing.length === 0) return [];
+  const configure = await promptYesNo(
+    rl,
+    `
+${missing.length} table(s) are missing documentation MCP tools would otherwise show agents -- write some now?`
+  );
+  if (!configure) return [];
+  const entries = [];
+  for (const t of missing) {
+    const entry = { table: t.name, columns: [] };
+    if (t.missingTableComment) {
+      const desc = await promptText(rl, `  ${t.name} -- what is this table for? (Enter to skip): `);
+      if (desc) entry.tableDescription = desc;
+    }
+    if (t.columnsWithoutComments.length > 0) {
+      const addColumns = await promptYesNo(
+        rl,
+        `  Add descriptions for ${t.name}'s ${t.columnsWithoutComments.length} undocumented column(s)?`
+      );
+      if (addColumns) {
+        for (const col of t.columnsWithoutComments) {
+          const desc = await promptText(rl, `    ${t.name}.${col}: `);
+          if (desc) entry.columns.push({ name: col, description: desc });
+        }
+      }
+    }
+    if (entry.tableDescription || entry.columns.length > 0) entries.push(entry);
+  }
+  return entries;
+}
+async function writeCommentsMigration(entries) {
+  const sql = buildCommentStatements(entries);
+  if (!sql) return null;
+  await mkdir(MIGRATIONS_DIR, { recursive: true });
+  const existing = await listFilesOrEmpty(MIGRATIONS_DIR);
+  const filename = uniqueMigrationFilename(existing, `${timestamp()}_exposify_comments.sql`);
+  const path = join(MIGRATIONS_DIR, filename);
+  await writeFile(path, sql);
+  return path;
+}
+async function ensureMetaMigration() {
+  await mkdir(MIGRATIONS_DIR, { recursive: true });
+  const existing = await listFilesOrEmpty(MIGRATIONS_DIR);
+  const found = findExistingMigration(existing, "_exposify_meta.sql");
+  if (found) return { path: join(MIGRATIONS_DIR, found), wasNew: false };
+  const migrationSql = await readFile(join(PACKAGE_ROOT, "sql/exposify_meta.sql"), "utf8");
+  const filename = uniqueMigrationFilename(existing, `${timestamp()}_exposify_meta.sql`);
+  const path = join(MIGRATIONS_DIR, filename);
+  await writeFile(path, migrationSql);
+  return { path, wasNew: true };
+}
+async function warnIfNotSupabaseProject() {
+  if (!await exists("supabase/config.toml")) {
+    console.warn(
+      "warn: no supabase/config.toml found here -- this doesn't look like a Supabase project root (or you haven't run `supabase init` yet). Continuing, but double-check you're in the right directory."
+    );
+  }
+}
 async function cmdInit() {
-  const migrationSql = await readFile(join(PACKAGE_ROOT, "sql/agentify_meta.sql"), "utf8");
-  const migrationsDir = "supabase/migrations";
-  await mkdir(migrationsDir, { recursive: true });
-  const migrationPath = join(migrationsDir, `${timestamp()}_agentify_meta.sql`);
-  await writeFile(migrationPath, migrationSql);
-  console.log(`Wrote ${migrationPath}`);
+  await warnIfNotSupabaseProject();
+  const { path: migrationPath, wasNew } = await ensureMetaMigration();
+  console.log(wasNew ? `Wrote ${migrationPath}` : `Skipped ${migrationPath} (already scaffolded)`);
   await mkdir(FUNCTION_DIR, { recursive: true });
   const functionPath = join(FUNCTION_DIR, "index.ts");
-  if (await exists(functionPath)) {
-    console.log(`Skipped ${functionPath} (already exists)`);
-  } else {
-    await writeFile(functionPath, FUNCTION_TEMPLATE);
-    console.log(`Wrote ${functionPath}`);
-  }
+  const functionExists = await exists(functionPath);
   await mkdir(join(FUNCTION_DIR, "docs"), { recursive: true });
-  if (!hasSupabaseCli()) {
-    console.log("\nSupabase CLI not found on PATH -- install it to run the next steps automatically next time.");
-    printManualCommands();
-    return;
-  }
-  const connect = await promptYesNo(
-    "\nApply the migration and deploy the function to whatever Supabase project is currently linked, now?"
+  const connWarning = partialConnectionWarning(
+    process.env.SUPABASE_URL ?? argValue("--url"),
+    process.env.SUPABASE_SERVICE_ROLE_KEY ?? argValue("--key")
   );
-  if (!connect) {
+  if (connWarning) console.warn(`warn: ${connWarning}`);
+  const rl = openInteractiveReadline();
+  if (!rl) {
+    if (!functionExists) {
+      await writeFile(functionPath, buildFunctionTemplate());
+      console.log(`Wrote ${functionPath}`);
+    } else {
+      console.log(`Skipped ${functionPath} (already exists)`);
+    }
     printManualCommands();
     return;
   }
-  let pushed = false;
   try {
-    console.log("\n$ supabase db push");
-    execFileSync("supabase", ["db", "push"], { stdio: "inherit" });
-    pushed = true;
-    console.log("\n$ supabase functions deploy mcp");
-    execFileSync("supabase", ["functions", "deploy", "mcp"], { stdio: "inherit" });
+    const conn = resolveConnectionInfo();
+    const anonymousSignIn = await askAnonymousSignIn(rl, conn);
+    let introspection = conn ? await tryIntrospect(conn) : null;
+    let alreadyPushed = false;
+    let alreadyDeployed = false;
+    if (!introspection) {
+      if (!functionExists) {
+        await writeFile(functionPath, buildFunctionTemplate({ anonymousSignIn }));
+        console.log(`Wrote ${functionPath}`);
+      } else {
+        console.log(`Skipped ${functionPath} (already exists)`);
+      }
+      if (!hasSupabaseCli()) {
+        console.log("\nSupabase CLI not found on PATH -- install it to run the next steps automatically next time.");
+        printManualCommands();
+        return;
+      }
+      const connect = await promptYesNo(
+        rl,
+        "\nApply the migration and deploy the function to whatever Supabase project is currently linked, now?"
+      );
+      if (!connect) {
+        printManualCommands();
+        return;
+      }
+      const result2 = pushAndDeploy();
+      alreadyPushed = result2.pushed;
+      alreadyDeployed = result2.deployed;
+      if (!result2.deployed) {
+        console.error(`
+Supabase CLI command failed: ${result2.error instanceof Error ? result2.error.message : result2.error}`);
+        printManualCommands({ alreadyPushed });
+        return;
+      }
+      introspection = conn ? await tryIntrospect(conn) : null;
+      if (!introspection) {
+        console.log(
+          "\nDeployed, but couldn't reach the project to introspect tables (no SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY or --url/--key available). Re-run `exposify-supabase init` with those set to configure writes, RPCs, and documentation interactively."
+        );
+        console.log("\nDone. Paste the function URL + a user JWT into an MCP client to try it.");
+        return;
+      }
+    }
+    const grants = await askWriteGrants(rl, introspection.tables);
+    const rpcCandidates = rpcCandidatesFromOpenApi(introspection.openapi);
+    const rpc = await askRpcSelection(rl, rpcCandidates);
+    const docs = await askDocumentation(rl, introspection.tables);
+    const writes = flattenWriteGrants(grants);
+    let wroteFunctionFile = false;
+    if (!functionExists) {
+      await writeFile(functionPath, buildFunctionTemplate({ writes, rpc, anonymousSignIn }));
+      console.log(`
+Wrote ${functionPath} with your selections.`);
+      wroteFunctionFile = true;
+    } else if (writes.length > 0 || rpc.length > 0) {
+      console.log(`
+${functionPath} already exists -- left untouched. Merge this into your aiReady() config:`);
+      console.log(buildFunctionTemplate({ writes, rpc, anonymousSignIn }));
+    }
+    const commentsPath = await writeCommentsMigration(docs);
+    if (commentsPath) console.log(`Wrote ${commentsPath}`);
+    const needsDeploy = wroteFunctionFile || commentsPath !== null;
+    if (!needsDeploy) {
+      console.log("\nNothing new to deploy.");
+      return;
+    }
+    if (!hasSupabaseCli()) {
+      console.log("\nSupabase CLI not found on PATH.");
+      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile });
+      return;
+    }
+    const redeploy = await promptYesNo(rl, "\nApply/deploy these changes now?", true);
+    if (!redeploy) {
+      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile });
+      return;
+    }
+    const result = pushAndDeploy();
+    if (!result.deployed) {
+      console.error(`
+Supabase CLI command failed: ${result.error instanceof Error ? result.error.message : result.error}`);
+      printManualCommands({ alreadyPushed: result.pushed });
+      return;
+    }
     console.log("\nDone. Paste the function URL + a user JWT into an MCP client to try it.");
-  } catch (err) {
-    console.error(`
-Supabase CLI command failed: ${err instanceof Error ? err.message : err}`);
-    printManualCommands({ alreadyPushed: pushed });
+  } finally {
+    rl.close();
   }
 }
 async function cmdGenerate() {
-  const supabaseUrl = process.env.SUPABASE_URL ?? argValue("--url");
-  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY ?? argValue("--key");
-  if (!supabaseUrl || !serviceKey) {
+  const conn = resolveConnectionInfo();
+  if (!conn) {
     console.error(
-      "generate needs SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (env vars, or --url/--key flags) pointing at a running local or linked project (e.g. `supabase start`)."
+      "generate needs SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (env vars, or --url/--key flags) pointing at a running local or linked project (e.g. `supabase start`). The service role key is used only for this one-time introspection call, matching what runtime introspection itself uses -- never written into the generated manifest."
     );
     process.exitCode = 1;
     return;
   }
-  const postgrestUrl = `${supabaseUrl.replace(/\/+$/, "")}/rest/v1`;
-  const headers = new Headers({ authorization: `Bearer ${serviceKey}`, apikey: serviceKey });
+  const postgrestUrl = `${conn.url.replace(/\/+$/, "")}/rest/v1`;
+  const headers = new Headers({
+    authorization: `Bearer ${conn.serviceRoleKey}`,
+    apikey: conn.serviceRoleKey
+  });
   const [openapi, metaRows] = await Promise.all([
-    fetchOpenApi(postgrestUrl, headers, fetch),
-    fetchAgentifyMeta(postgrestUrl, headers, fetch)
+    fetchOpenApi(postgrestUrl, headers, fetchWithTimeout),
+    fetchExposifyMeta(postgrestUrl, headers, fetchWithTimeout)
   ]);
   const manifest = buildManifest(openapi, metaRows, (/* @__PURE__ */ new Date()).toISOString());
-  const outPath = join(FUNCTION_DIR, "agentify.manifest.json");
+  const outPath = join(FUNCTION_DIR, "exposify.manifest.json");
   await mkdir(dirname(outPath), { recursive: true });
   await writeFile(outPath, JSON.stringify(manifest, null, 2));
   console.log(`Wrote ${outPath} (${manifest.tables.length} table(s))`);
@@ -254,10 +588,13 @@ async function main() {
   const [, , cmd] = process.argv;
   if (cmd === "init") return cmdInit();
   if (cmd === "generate") return cmdGenerate();
-  console.log("Usage: agentify-supabase <init|generate>");
-  console.log("  init      Scaffold the agentify_meta() migration + supabase/functions/mcp/index.ts,");
-  console.log("            then interactively offer to run `supabase db push` + `functions deploy`");
-  console.log("  generate  Build agentify.manifest.json from a running local/linked project");
+  console.log("Usage: exposify-supabase <init|generate> [--url <url>] [--key <service-role-key>]");
+  console.log("  init      Scaffold the exposify_meta() migration + supabase/functions/mcp/index.ts.");
+  console.log("            Interactively offers to run `supabase db push` + `functions deploy`; if a");
+  console.log("            project is reachable (SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY env vars, or --url/--key),");
+  console.log("            also walks through anonymous sign-in, per-table writes, RPC exposure, and");
+  console.log("            documentation for tables/columns missing a comment.");
+  console.log("  generate  Build exposify.manifest.json from a running local/linked project");
   process.exitCode = cmd ? 1 : 0;
 }
 main().catch((err) => {