@exposify/supabase 0.3.10 → 0.3.11

package/README.md

@@ -15,7 +15,7 @@ root.
 
 - A Supabase project (local via the [Supabase CLI](https://supabase.com/docs/guides/cli), or hosted).
 - The Supabase CLI (`supabase` on your `PATH`) for `db push` / `functions deploy`.
-- Node or Yarn to run `npx exposify-supabase` (the CLI is a regular npm
+- Node or Yarn to run `npx @exposify/supabase` (the CLI is a regular npm
   package; the edge function itself runs on Deno and needs no local install).
 
 ## 1. Scaffold
@@ -23,7 +23,7 @@ root.
 From your Supabase project's root (the directory containing `supabase/`):
 
 ```bash
-npx exposify-supabase init
+npx @exposify/supabase init
 ```
 
 This is safe to re-run; see "Re-running `init`" below. It writes:
@@ -216,7 +216,7 @@ or edit the managed block in `supabase/functions/mcp/index.ts` by hand,
 keeping its format. Anything else goes below the block:
 
 ```ts
-// exposify:begin -- generated by `npx exposify-supabase init`, ...
+// exposify:begin -- generated by `npx @exposify/supabase init`, ...
 import { aiReady } from "npm:@exposify/supabase";
 
 const generated = {
@@ -328,8 +328,8 @@ RLS enforcement, not anything in this SDK, is what makes that true.
 ## 5. Check it: `doctor`
 
 ```bash
-npx exposify-supabase doctor            # finds the project the same way init does
-npx exposify-supabase doctor --token <user-jwt | extb_...>
+npx @exposify/supabase doctor            # finds the project the same way init does
+npx @exposify/supabase doctor --token <user-jwt | extb_...>
 ```
 
 A read-only health check of everything `init` sets up. It never writes a file
@@ -535,7 +535,7 @@ project (local `supabase start` or linked):
 ```bash
 SUPABASE_URL=http://localhost:54321 \
 SUPABASE_SERVICE_ROLE_KEY=<service-role-key> \
-npx exposify-supabase generate
+npx @exposify/supabase generate
 ```
 
 Uses the **service role key**, deliberately the same key runtime
@@ -565,7 +565,7 @@ the function prints whether MCP is up. It shows in `supabase functions serve`
 locally and in the function's logs in production:
 
 ```
-[exposify-supabase] MCP ready at https://<ref>.supabase.co/functions/v1/mcp: 9 tools (5 query, 2 write, 1 rpc, search_docs), 3 docs indexed, auth: passthrough (caller's JWT)
+[@exposify/supabase] MCP ready at https://<ref>.supabase.co/functions/v1/mcp: 9 tools (5 query, 2 write, 1 rpc, search_docs), 3 docs indexed, auth: passthrough (caller's JWT)
 ```
 
 - **Manifest fallback:** the same line, marked "from the bundled manifest",
@@ -582,7 +582,7 @@ overrides that.
 
 ## Troubleshooting
 
-Start with `npx exposify-supabase doctor`. It checks most of what's below
+Start with `npx @exposify/supabase doctor`. It checks most of what's below
 and names the fix.
 
 **"exposify_meta() is not reachable" / "PGRST202" errors in function logs.**
@@ -617,7 +617,7 @@ above — pointing at a project where the migration is already applied). On a
 brand-new project's first `init`, that's not true yet — say yes to the
 deploy prompt (or run `supabase db push` yourself) and the wizard picks up
 automatically once the migration is live, in the same run if you said yes,
-or on your next `exposify-supabase init` otherwise.
+or on your next `@exposify/supabase init` otherwise.
 
 **`PostgREST OpenAPI fetch failed: HTTP 401`, and the error body (if you
 curl it directly) says `"Only the service_role API key can be used for this

package/dist/cli.js

@@ -40,7 +40,7 @@ async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
   });
   if (res.status === 404) {
     throw new MissingExposifyMetaError(
-      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx @exposify/supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
@@ -399,6 +399,9 @@ async function discoverConnection(deps) {
   return { connection: local ? fromLocal() : null, notes };
 }
 
+// bin/doctor.ts
+import { DEFAULT_BROKER_URL, parseExposifyKey, readSupabaseAuth } from "@exposify/core";
+
 // bin/function-file.ts
 var KEY_SECRET = "EXPOSIFY_KEY";
 var EMPTY_CONFIG = { writes: [], rpc: [], anonymousSignIn: false, broker: null, oauth: false };
@@ -422,7 +425,7 @@ var ANONYMOUS_MARKER = "anonymous sign-in enabled";
 function buildManagedBlock(config) {
   if (config.broker && config.oauth) throw new Error("the hosted broker and Supabase Auth OAuth can't be combined");
   const lines = [
-    `${BEGIN} -- generated by \`npx exposify-supabase init\`, which rewrites`,
+    `${BEGIN} -- generated by \`npx @exposify/supabase init\`, which rewrites`,
     `// everything down to exposify:end when you re-run it. Add your own code below.`
   ];
   if (config.anonymousSignIn) lines.push(...ANONYMOUS_SIGN_IN_WARNING);
@@ -669,12 +672,12 @@ async function runDoctor(deps) {
   const files = [];
   const migration = findExistingMigration(await deps.listDir(MIGRATIONS_DIR), "_exposify_meta.sql");
   files.push(
-    migration ? { status: "pass", message: `migration ${MIGRATIONS_DIR}/${migration}` } : { status: "fail", message: "no *_exposify_meta.sql migration", fix: "npx exposify-supabase init" }
+    migration ? { status: "pass", message: `migration ${MIGRATIONS_DIR}/${migration}` } : { status: "fail", message: "no *_exposify_meta.sql migration", fix: "npx @exposify/supabase init" }
   );
   const functionSource = await deps.readText(FUNCTION_PATH);
   const authMode = functionSource === null ? null : detectAuthMode(functionSource);
   files.push(
-    functionSource !== null ? { status: "pass", message: `function ${FUNCTION_PATH} (auth: ${AUTH_LABEL[authMode]})` } : { status: "fail", message: `no ${FUNCTION_PATH}`, fix: "npx exposify-supabase init" }
+    functionSource !== null ? { status: "pass", message: `function ${FUNCTION_PATH} (auth: ${AUTH_LABEL[authMode]})` } : { status: "fail", message: `no ${FUNCTION_PATH}`, fix: "npx @exposify/supabase init" }
   );
   if (bypassesGatewayJwt2(authMode)) {
     const verifyJwt = toml === null ? null : readFunctionVerifyJwt(toml);
@@ -686,7 +689,7 @@ async function runDoctor(deps) {
       } : {
         status: "fail",
         message: `verify_jwt is ${verifyJwt === null ? "unset (defaults to on)" : "on"} for ${FUNCTION_NAME}; ` + (oauth ? "MCP clients will never get the OAuth login challenge" : "the gateway will reject every extb_... token"),
-        fix: "re-run `npx exposify-supabase init` (it sets it), or add `[functions.mcp] verify_jwt = false` to config.toml and redeploy"
+        fix: "re-run `npx @exposify/supabase init` (it sets it), or add `[functions.mcp] verify_jwt = false` to config.toml and redeploy"
       }
     );
   }
@@ -747,7 +750,7 @@ async function runDoctor(deps) {
         db.push({
           status: "warn",
           message: `${undocumented.length} table(s) missing comments, so tools have thin descriptions: ${undocumented.map((t) => t.name).join(", ")}`,
-          fix: "re-run `npx exposify-supabase init` and write descriptions, or add COMMENT ON TABLE/COLUMN"
+          fix: "re-run `npx @exposify/supabase init` and write descriptions, or add COMMENT ON TABLE/COLUMN"
         });
       }
     }
@@ -763,8 +766,35 @@ async function runDoctor(deps) {
   }
   if (authMode === "broker") fn.push(licenseSecretCheck(deps));
   sections.push({ title: "Deployed function", checks: fn });
+  if (authMode === "broker" && conn) sections.push({ title: "Connect (agents sign in to your Supabase Auth)", checks: await connectChecks(deps, conn) });
   return sections;
 }
+async function connectChecks(deps, conn) {
+  const auth = conn.anonKey ? await readSupabaseAuth(conn.url, conn.anonKey, deps.fetch) : void 0;
+  const checks = [];
+  if (!auth) {
+    checks.push({ status: "warn", message: "couldn't read the project's Auth settings (/auth/v1/settings)", fix: "pass the anon key with --key, or check Auth is enabled" });
+    return checks;
+  }
+  checks.push(
+    auth.providers.length ? { status: "pass", message: `social sign-in offered to agents: ${auth.providers.join(", ")}` } : {
+      status: "warn",
+      message: "no social provider is switched on, so agents can only sign in with an email code",
+      fix: "switch one on in Auth \u2192 Sign In / Providers, or turn on email codes in the agemno dashboard"
+    }
+  );
+  if (!auth.signupsDisabled) {
+    checks.push({ status: "warn", message: "sign-ups are allowed: a new user who signs in with a social provider through Connect gets an account" });
+  }
+  const projectId = deps.exposifyKey ? parseExposifyKey(deps.exposifyKey)?.projectId : void 0;
+  const callback = projectId ? `${(deps.brokerUrl ?? DEFAULT_BROKER_URL).replace(/\/+$/, "")}/projects/${projectId}/supabase-callback` : null;
+  checks.push({
+    status: "warn",
+    message: callback ? `Redirect URLs must include ${callback} (can't be checked from here)` : "Redirect URLs must include the broker's callback (can't be checked from here)",
+    fix: callback ? "add it in Auth \u2192 URL Configuration \u2192 Redirect URLs" : "the agemno dashboard's sign-in page shows it; or run doctor with EXPOSIFY_KEY set to print it"
+  });
+  return checks;
+}
 function probeChecks(url, outcome, authMode, local) {
   switch (outcome.kind) {
     case "ok": {
@@ -1470,14 +1500,14 @@ No files were changed. Merge the block above into ${FUNCTION_PATH2}, then re-run
       }
       if (!c) {
         console.log(
-          "\nNothing changed locally. Couldn't check the project itself (no --url/--key, env vars, or local/linked project) -- run `npx exposify-supabase doctor` once it's reachable."
+          "\nNothing changed locally. Couldn't check the project itself (no --url/--key, env vars, or local/linked project) -- run `npx @exposify/supabase doctor` once it's reachable."
         );
         return;
       }
       console.log("\nNothing changed locally, but the project is behind:");
       for (const n of verdict.notes) console.log(`  - ${n}`);
       if (!verdict.push && !verdict.deploy) {
-        console.log("Run `npx exposify-supabase doctor` for details.");
+        console.log("Run `npx @exposify/supabase doctor` for details.");
         return;
       }
       if (c.source === "local") {
@@ -1493,7 +1523,7 @@ That's the local stack: run ${todo.join(" and ")}.`);
       const again = await tryIntrospect(await getConn());
       if (!again.introspection) {
         console.log(
-          "\nDeployed, but couldn't reach the project to introspect tables (no --url/--key, no SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY, and no local stack or linked project the Supabase CLI could supply keys for). Re-run `exposify-supabase init` with those set to configure writes, RPCs, and documentation interactively."
+          "\nDeployed, but couldn't reach the project to introspect tables (no --url/--key, no SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY, and no local stack or linked project the Supabase CLI could supply keys for). Re-run `npx @exposify/supabase init` with those set to configure writes, RPCs, and documentation interactively."
         );
         console.log(`
 Done. ${clientStep(effectiveAuth)}`);
@@ -1567,7 +1597,9 @@ async function cmdDoctor() {
     connectionNotes: notes,
     projectRef,
     fetch: fetchWithTimeout,
-    token: argValue("--token")
+    token: argValue("--token"),
+    ...process.env.EXPOSIFY_KEY ? { exposifyKey: process.env.EXPOSIFY_KEY } : {},
+    ...process.env.EXPOSIFY_BROKER_URL ? { brokerUrl: process.env.EXPOSIFY_BROKER_URL } : {}
   });
   console.log(formatReport(sections));
   if (hasFailures(sections)) process.exitCode = 1;
@@ -1587,7 +1619,7 @@ async function main() {
   if (cmd === "generate") return cmdGenerate();
   if (cmd === "doctor") return cmdDoctor();
   console.log(
-    "Usage: exposify-supabase <init|generate|doctor> [--url <url>] [--key <service-role-key>] [--local|--linked] [--broker [--broker-url <url>] | --oauth] [--token <token>] [--check]"
+    "Usage: @exposify/supabase <init|generate|doctor> [--url <url>] [--key <service-role-key>] [--local|--linked] [--broker [--broker-url <url>] | --oauth] [--token <token>] [--check]"
   );
   console.log("  init      Scaffold the exposify_meta() migration + supabase/functions/mcp/index.ts, then (when the");
   console.log("            project is reachable) walk through anonymous sign-in, per-table writes, RPC exposure, and");

package/dist/index.cjs

@@ -107,7 +107,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[exposify-supabase] ${message}`);
+    console.warn(`[@exposify/supabase] ${message}`);
   } catch {
   }
 }
@@ -206,7 +206,7 @@ async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
   });
   if (res.status === 404) {
     throw new MissingExposifyMetaError(
-      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx @exposify/supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
@@ -624,7 +624,7 @@ function registerDiagnosticsResource(server, warnings) {
   server.registerResource(
     "exposify-diagnostics",
     "exposify://diagnostics",
-    { title: "exposify-supabase diagnostics", mimeType: "application/json" },
+    { title: "@exposify/supabase diagnostics", mimeType: "application/json" },
     async (uri) => ({ contents: [{ uri: uri.href, text: JSON.stringify(warnings, null, 2) }] })
   );
 }
@@ -698,8 +698,8 @@ function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
 
 // src/startup.ts
 var import_core4 = require("@exposify/core");
-var LOG_PREFIX = "[exposify-supabase]";
-var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `exposify-supabase generate`";
+var LOG_PREFIX = "[@exposify/supabase]";
+var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `npx @exposify/supabase generate`";
 function supabaseToolsPhrase(ladder, cfg, hasDocs) {
   const query = ladder.tables.length;
   let write = 0;
@@ -797,7 +797,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[exposify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[@exposify/supabase] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });
@@ -834,7 +834,7 @@ function aiReady(options = {}) {
           return { status: res.status, bodyText: await res.text() };
         };
         return buildSupabaseMcpServer({
-          appName: "exposify-supabase",
+          appName: "@exposify/supabase",
           appVersion: "0.0.0",
           tables: ladder.tables,
           cfg,
@@ -861,6 +861,16 @@ function aiReady(options = {}) {
   const authRequired = options.authRequired ?? (envAuth !== void 0 || (0, import_core5.isHostedResolver)(auth));
   if (!auth) return core;
   const brokerGate = authRequired ? (0, import_core5.createBrokerGate)(auth) : null;
+  const authKey = anonKey || env?.get("SUPABASE_PUBLISHABLE_KEY") || "";
+  let supabaseAuth2;
+  const supabaseAuthOnce = () => {
+    if (!supabaseUrl || !authKey) return Promise.resolve(void 0);
+    supabaseAuth2 ??= (0, import_core5.readSupabaseAuth)(supabaseUrl, authKey, fetchImpl).then((found) => {
+      if (!found) supabaseAuth2 = void 0;
+      return found;
+    });
+    return supabaseAuth2;
+  };
   const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
     let open = false;
@@ -868,7 +878,13 @@ function aiReady(options = {}) {
       const own = (0, import_core5.publicRequestUrl)(req.url, req.headers);
       const isPrm = own.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
-      open = await (0, import_core5.reportAppLogin)(auth, resource, null, { stacks: ["@supabase/supabase-js"], why: "Supabase Auth sign-in for agents is the Supabase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      const supabase = await supabaseAuthOnce();
+      open = await (0, import_core5.reportAppLogin)(auth, resource, null, {
+        stacks: ["@supabase/supabase-js"],
+        why: supabase ? "Your Supabase Auth is turned off for agents in the dashboard." : "Couldn't read your project's Supabase Auth settings (/auth/v1/settings with the anon key), so Connect can't offer it yet.",
+        log: logReady,
+        ...supabase ? { supabase } : {}
+      }) === "open";
       if (open) {
         if (isPrm) return new Response("not found", { status: 404 });
       } else {
@@ -881,7 +897,7 @@ function aiReady(options = {}) {
     try {
       resolved = await auth(req.headers, {});
     } catch (err) {
-      console.error("exposify-supabase: auth resolver failed", err);
+      console.error("@exposify/supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
     if (authRequired && !open && !resolved.get("authorization")) {

package/dist/index.d.cts

@@ -126,7 +126,7 @@ interface AgentifySupabaseOptions {
     authRequired?: boolean;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
-    /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */
+    /** Bundled fallback manifest (from `@exposify/supabase generate`), used when runtime introspection fails. */
     manifest?: unknown;
     rateLimit?: number;
     rateWindowMs?: number;
@@ -196,7 +196,7 @@ interface ExposifyManifest {
     generatedAt: string;
     tables: TableSchema[];
 }
-/** Built by `npx exposify-supabase generate` against a local/linked project. */
+/** Built by `npx @exposify/supabase generate` against a local/linked project. */
 declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): ExposifyManifest;
 /**
  * Defensive load: a manifest is bundled JSON shipped alongside the function

package/dist/index.d.ts

@@ -126,7 +126,7 @@ interface AgentifySupabaseOptions {
     authRequired?: boolean;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
-    /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */
+    /** Bundled fallback manifest (from `@exposify/supabase generate`), used when runtime introspection fails. */
     manifest?: unknown;
     rateLimit?: number;
     rateWindowMs?: number;
@@ -196,7 +196,7 @@ interface ExposifyManifest {
     generatedAt: string;
     tables: TableSchema[];
 }
-/** Built by `npx exposify-supabase generate` against a local/linked project. */
+/** Built by `npx @exposify/supabase generate` against a local/linked project. */
 declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): ExposifyManifest;
 /**
  * Defensive load: a manifest is bundled JSON shipped alongside the function

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, reportAppLogin, startupLogEnabled } from "@exposify/core";
+import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, readSupabaseAuth, reportAppLogin, startupLogEnabled } from "@exposify/core";
 
 // src/kb.ts
 import { KnowledgeBase } from "@exposify/core";
@@ -70,7 +70,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[exposify-supabase] ${message}`);
+    console.warn(`[@exposify/supabase] ${message}`);
   } catch {
   }
 }
@@ -169,7 +169,7 @@ async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
   });
   if (res.status === 404) {
     throw new MissingExposifyMetaError(
-      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx @exposify/supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
@@ -590,7 +590,7 @@ function registerDiagnosticsResource(server, warnings) {
   server.registerResource(
     "exposify-diagnostics",
     "exposify://diagnostics",
-    { title: "exposify-supabase diagnostics", mimeType: "application/json" },
+    { title: "@exposify/supabase diagnostics", mimeType: "application/json" },
     async (uri) => ({ contents: [{ uri: uri.href, text: JSON.stringify(warnings, null, 2) }] })
   );
 }
@@ -664,8 +664,8 @@ function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
 
 // src/startup.ts
 import { formatFailed, formatReady, formatWarning } from "@exposify/core";
-var LOG_PREFIX = "[exposify-supabase]";
-var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `exposify-supabase generate`";
+var LOG_PREFIX = "[@exposify/supabase]";
+var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `npx @exposify/supabase generate`";
 function supabaseToolsPhrase(ladder, cfg, hasDocs) {
   const query = ladder.tables.length;
   let write = 0;
@@ -763,7 +763,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[exposify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[@exposify/supabase] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });
@@ -800,7 +800,7 @@ function aiReady(options = {}) {
           return { status: res.status, bodyText: await res.text() };
         };
         return buildSupabaseMcpServer({
-          appName: "exposify-supabase",
+          appName: "@exposify/supabase",
           appVersion: "0.0.0",
           tables: ladder.tables,
           cfg,
@@ -827,6 +827,16 @@ function aiReady(options = {}) {
   const authRequired = options.authRequired ?? (envAuth !== void 0 || isHostedResolver(auth));
   if (!auth) return core;
   const brokerGate = authRequired ? createBrokerGate(auth) : null;
+  const authKey = anonKey || env?.get("SUPABASE_PUBLISHABLE_KEY") || "";
+  let supabaseAuth2;
+  const supabaseAuthOnce = () => {
+    if (!supabaseUrl || !authKey) return Promise.resolve(void 0);
+    supabaseAuth2 ??= readSupabaseAuth(supabaseUrl, authKey, fetchImpl).then((found) => {
+      if (!found) supabaseAuth2 = void 0;
+      return found;
+    });
+    return supabaseAuth2;
+  };
   const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
     let open = false;
@@ -834,7 +844,13 @@ function aiReady(options = {}) {
       const own = publicRequestUrl(req.url, req.headers);
       const isPrm = own.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
-      open = await reportAppLogin(auth, resource, null, { stacks: ["@supabase/supabase-js"], why: "Supabase Auth sign-in for agents is the Supabase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      const supabase = await supabaseAuthOnce();
+      open = await reportAppLogin(auth, resource, null, {
+        stacks: ["@supabase/supabase-js"],
+        why: supabase ? "Your Supabase Auth is turned off for agents in the dashboard." : "Couldn't read your project's Supabase Auth settings (/auth/v1/settings with the anon key), so Connect can't offer it yet.",
+        log: logReady,
+        ...supabase ? { supabase } : {}
+      }) === "open";
       if (open) {
         if (isPrm) return new Response("not found", { status: 404 });
       } else {
@@ -847,7 +863,7 @@ function aiReady(options = {}) {
     try {
       resolved = await auth(req.headers, {});
     } catch (err) {
-      console.error("exposify-supabase: auth resolver failed", err);
+      console.error("@exposify/supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
     if (authRequired && !open && !resolved.get("authorization")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.14",
+    "@exposify/core": "0.3.16",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },

package/sql/exposify_meta.sql

@@ -1,4 +1,4 @@
--- exposify-supabase: schema introspection function.
+-- @exposify/supabase: schema introspection function.
 --
 -- Exposes, per PostgREST's RPC convention (POST /rpc/exposify_meta), one row
 -- per column of every ordinary table in the `public` schema: whether Row