@exposify/supabase 0.3.10 → 0.3.12

package/README.md

@@ -15,7 +15,7 @@ root.
 
 - A Supabase project (local via the [Supabase CLI](https://supabase.com/docs/guides/cli), or hosted).
 - The Supabase CLI (`supabase` on your `PATH`) for `db push` / `functions deploy`.
-- Node or Yarn to run `npx exposify-supabase` (the CLI is a regular npm
+- Node or Yarn to run `npx @exposify/supabase` (the CLI is a regular npm
   package; the edge function itself runs on Deno and needs no local install).
 
 ## 1. Scaffold
@@ -23,17 +23,20 @@ root.
 From your Supabase project's root (the directory containing `supabase/`):
 
 ```bash
-npx exposify-supabase init
+npx @exposify/supabase init
 ```
 
 This is safe to re-run; see "Re-running `init`" below. It writes:
 
-- `supabase/migrations/<timestamp>_exposify_meta.sql` — a SQL migration that
+- `supabase/migrations/<timestamp>_exposify_meta_v2.sql` — a SQL migration that
   adds `exposify_meta()`, a `SECURITY DEFINER` function returning, per table,
-  whether RLS is enabled and any `COMMENT ON TABLE`/`COMMENT ON COLUMN` text
+  whether RLS is enabled, what the `authenticated` role is granted on it
+  (select/insert/update/delete), and any `COMMENT ON TABLE`/`COMMENT ON COLUMN` text
   you've written. It only ever returns catalog metadata (table/column names,
   flags, comments) — never row data — which is what makes it safe to grant
-  to `anon`/`authenticated` and call with a low-privilege key.
+  to `anon`/`authenticated` and call with a low-privilege key. A project with
+  the older `<timestamp>_exposify_meta.sql` (no grants) gets the `_v2` one on
+  the next `init`, which replaces the function.
 - `supabase/functions/mcp/index.ts` — the edge function itself. `init` owns
   the part between `// exposify:begin` and `// exposify:end` (imports and a
   `generated` options object). Everything after that is yours, starting with
@@ -204,9 +207,14 @@ swaps in on each request, and it stops working when it expires.
 ## 2. Decide what's exposed
 
 **Every RLS-enabled table is automatically readable.** A table only shows up
-at all if `exposify_meta()` reports RLS is turned on for it *and* PostgREST
-actually exposes it (the calling role has grants) — an RLS-less table is
-invisible, full stop, with no override. For each exposed table you get a
+at all if `exposify_meta()` reports RLS is turned on for it *and* the
+`authenticated` role has `SELECT` on it — an RLS-less table is
+invisible, full stop, with no override. RLS decides which rows; the grant
+decides whether the role can touch the table at all, and without it every
+call answers 403. Newer Supabase local images no longer grant `anon` and
+`authenticated` on new tables in `public`, so check with `doctor`, which
+prints the `grant` to run. A write you opt into below only becomes a tool
+when the role is granted that operation too. For each exposed table you get a
 `query_<table>` tool: typed filters (`eq`/`neq`/`gt`/`lt`/`like`), a `select`
 column list, `order`, and a `limit` capped server-side (100 rows by default,
 regardless of what the caller asks for).
@@ -216,7 +224,7 @@ or edit the managed block in `supabase/functions/mcp/index.ts` by hand,
 keeping its format. Anything else goes below the block:
 
 ```ts
-// exposify:begin -- generated by `npx exposify-supabase init`, ...
+// exposify:begin -- generated by `npx @exposify/supabase init`, ...
 import { aiReady } from "npm:@exposify/supabase";
 
 const generated = {
@@ -244,9 +252,13 @@ Deno.serve(aiReady({
 ```
 
 Notes:
-- `update_<table>` and `delete_<table>` always require at least one filter —
-  there is no way to opt into a table-wide mutation, even where RLS would
-  technically allow it.
+- `update_<table>` and `delete_<table>` change one row: the filter must
+  include `eq` on every primary-key column (more filters only narrow it).
+  A filter that happens to match everything (`id neq -1`, `item like %`) is
+  refused, and there is no way to opt into a table-wide mutation, even where
+  RLS would technically allow it; an agent that means to change several rows
+  makes one call per row. A table without a primary key gets `insert_<table>`
+  but no update or delete tools (the cold-start log and `doctor` say so).
 - Column/table descriptions shown to the agent come from SQL comments
   (`COMMENT ON TABLE orders IS '...'`, `COMMENT ON COLUMN orders.status IS
   '...'`) — write these once and every generated tool reads them.
@@ -328,8 +340,8 @@ RLS enforcement, not anything in this SDK, is what makes that true.
 ## 5. Check it: `doctor`
 
 ```bash
-npx exposify-supabase doctor            # finds the project the same way init does
-npx exposify-supabase doctor --token <user-jwt | extb_...>
+npx @exposify/supabase doctor            # finds the project the same way init does
+npx @exposify/supabase doctor --token <user-jwt | extb_...>
 ```
 
 A read-only health check of everything `init` sets up. It never writes a file
@@ -343,8 +355,11 @@ exits 1 if anything failed, so you can run it in CI.
   that `verify_jwt = false` for `mcp`.
 - **Database:** `exposify_meta()` is applied and the PostgREST schema is
   readable. It lists which tables became tools, and warns about tables that
-  never will: RLS off, or RLS on but no API grants. It also warns about
-  tables whose missing comments leave tools with thin descriptions.
+  never will: RLS off, or RLS on but no `SELECT` for `authenticated` (with the
+  `grant` to run). It warns about writes in the function's config the role
+  isn't granted, about the older `exposify_meta()` that doesn't report
+  grants, and about tables whose missing comments leave tools with thin
+  descriptions.
 - **Deployed function:** speaks MCP to `<project>/functions/v1/mcp`
   (`initialize`, then `tools/list`) and reports the tool count. If the
   function registered `exposify://diagnostics`, which it only does when
@@ -535,7 +550,7 @@ project (local `supabase start` or linked):
 ```bash
 SUPABASE_URL=http://localhost:54321 \
 SUPABASE_SERVICE_ROLE_KEY=<service-role-key> \
-npx exposify-supabase generate
+npx @exposify/supabase generate
 ```
 
 Uses the **service role key**, deliberately the same key runtime
@@ -565,7 +580,7 @@ the function prints whether MCP is up. It shows in `supabase functions serve`
 locally and in the function's logs in production:
 
 ```
-[exposify-supabase] MCP ready at https://<ref>.supabase.co/functions/v1/mcp: 9 tools (5 query, 2 write, 1 rpc, search_docs), 3 docs indexed, auth: passthrough (caller's JWT)
+[@exposify/supabase] MCP ready at https://<ref>.supabase.co/functions/v1/mcp: 9 tools (5 query, 2 write, 1 rpc, search_docs), 3 docs indexed, auth: passthrough (caller's JWT)
 ```
 
 - **Manifest fallback:** the same line, marked "from the bundled manifest",
@@ -582,7 +597,7 @@ overrides that.
 
 ## Troubleshooting
 
-Start with `npx exposify-supabase doctor`. It checks most of what's below
+Start with `npx @exposify/supabase doctor`. It checks most of what's below
 and names the fix.
 
 **"exposify_meta() is not reachable" / "PGRST202" errors in function logs.**
@@ -617,7 +632,7 @@ above — pointing at a project where the migration is already applied). On a
 brand-new project's first `init`, that's not true yet — say yes to the
 deploy prompt (or run `supabase db push` yourself) and the wizard picks up
 automatically once the migration is live, in the same run if you said yes,
-or on your next `exposify-supabase init` otherwise.
+or on your next `@exposify/supabase init` otherwise.
 
 **`PostgREST OpenAPI fetch failed: HTTP 401`, and the error body (if you
 curl it directly) says `"Only the service_role API key can be used for this

package/dist/cli.js

@@ -40,7 +40,7 @@ async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
   });
   if (res.status === 404) {
     throw new MissingExposifyMetaError(
-      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx @exposify/supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
@@ -99,6 +99,8 @@ function introspectTables(openapi, metaRows) {
     const rlsEnabled = rows[0].rls_enabled;
     if (!rlsEnabled) continue;
     if (!exposedInOpenApi.has(name)) continue;
+    const grants = grantsOf(rows[0]);
+    if (grants && !grants.select) continue;
     const openApiColumns = new Map(columnsFromOpenApi(openapi, name).map((c) => [c.name, c]));
     const columns = [];
     for (const row of rows) {
@@ -116,11 +118,21 @@ function introspectTables(openapi, metaRows) {
       name,
       rlsEnabled: true,
       description: rows[0].table_comment ?? void 0,
-      columns
+      columns,
+      ...grants ? { grants } : {}
     });
   }
   return tables.sort((a, b) => a.name.localeCompare(b.name));
 }
+function grantsOf(row) {
+  if (typeof row.can_select !== "boolean") return void 0;
+  return {
+    select: row.can_select,
+    insert: row.can_insert === true,
+    update: row.can_update === true,
+    delete: row.can_delete === true
+  };
+}
 function groupByTable(rows) {
   const map = /* @__PURE__ */ new Map();
   for (const row of rows) {
@@ -399,6 +411,9 @@ async function discoverConnection(deps) {
   return { connection: local ? fromLocal() : null, notes };
 }
 
+// bin/doctor.ts
+import { DEFAULT_BROKER_URL, parseExposifyKey, readSupabaseAuth } from "@exposify/core";
+
 // bin/function-file.ts
 var KEY_SECRET = "EXPOSIFY_KEY";
 var EMPTY_CONFIG = { writes: [], rpc: [], anonymousSignIn: false, broker: null, oauth: false };
@@ -422,7 +437,7 @@ var ANONYMOUS_MARKER = "anonymous sign-in enabled";
 function buildManagedBlock(config) {
   if (config.broker && config.oauth) throw new Error("the hosted broker and Supabase Auth OAuth can't be combined");
   const lines = [
-    `${BEGIN} -- generated by \`npx exposify-supabase init\`, which rewrites`,
+    `${BEGIN} -- generated by \`npx @exposify/supabase init\`, which rewrites`,
     `// everything down to exposify:end when you re-run it. Add your own code below.`
   ];
   if (config.anonymousSignIn) lines.push(...ANONYMOUS_SIGN_IN_WARNING);
@@ -525,6 +540,53 @@ function configsEqual(a, b) {
   return sameSet(a.writes, b.writes) && sameSet(a.rpc, b.rpc) && a.anonymousSignIn === b.anonymousSignIn && a.broker === null === (b.broker === null) && a.broker?.brokerUrl === b.broker?.brokerUrl && a.oauth === b.oauth;
 }
 
+// src/config.ts
+var WRITE_OPS = ["insert", "update", "delete"];
+function parseWrites(writes = []) {
+  const grants = /* @__PURE__ */ new Map();
+  for (const entry of writes) {
+    const [table, op] = entry.split(".");
+    if (!table || !op) {
+      warnOnce(`ignoring malformed writes entry "${entry}" (expected "<table>.insert|update|delete|*")`);
+      continue;
+    }
+    const ops = op === "*" ? WRITE_OPS : isWriteOp(op) ? [op] : null;
+    if (!ops) {
+      warnOnce(`ignoring writes entry "${entry}": "${op}" is not insert, update, delete, or *`);
+      continue;
+    }
+    const set = grants.get(table) ?? /* @__PURE__ */ new Set();
+    for (const o of ops) set.add(o);
+    grants.set(table, set);
+  }
+  return grants;
+}
+function isWriteOp(op) {
+  return WRITE_OPS.includes(op);
+}
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(message) {
+  if (warned.has(message)) return;
+  warned.add(message);
+  try {
+    console.warn(`[@exposify/supabase] ${message}`);
+  } catch {
+  }
+}
+function writeToolOps(table, opted) {
+  const ops = [];
+  const ungranted = [];
+  const keyless = [];
+  const hasKey = table.columns.some((c) => c.isPrimaryKey);
+  for (const op of WRITE_OPS) {
+    if (!opted?.has(op)) continue;
+    if (table.grants && !table.grants[op]) ungranted.push(op);
+    else if (op !== "insert" && !hasKey) keyless.push(op);
+    else ops.push(op);
+  }
+  return { ops, ungranted, keyless };
+}
+
 // bin/doctor.ts
 var FUNCTION_NAME = "mcp";
 var FUNCTION_PATH = `supabase/functions/${FUNCTION_NAME}/index.ts`;
@@ -573,6 +635,17 @@ function invisibleTables(metaRows, exposed) {
   }
   return { rlsOff, notGranted };
 }
+function unavailableWrites(exposed, writes) {
+  const opted = parseWrites(writes);
+  const ungranted = [];
+  const keyless = [];
+  for (const table of exposed) {
+    const why = writeToolOps(table, opted.get(table.name));
+    for (const op of why.ungranted) ungranted.push({ table: table.name, op });
+    for (const op of why.keyless) keyless.push({ table: table.name, op });
+  }
+  return { ungranted, keyless };
+}
 function parseJsonRpcResponse(contentType, body, id) {
   const candidates = contentType.includes("text/event-stream") ? body.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()) : [body];
   for (const raw of candidates) {
@@ -667,14 +740,20 @@ async function runDoctor(deps) {
   );
   sections.push({ title: "Project", checks: project });
   const files = [];
-  const migration = findExistingMigration(await deps.listDir(MIGRATIONS_DIR), "_exposify_meta.sql");
+  const migrations = await deps.listDir(MIGRATIONS_DIR);
+  const migration = findExistingMigration(migrations, "_exposify_meta_v2.sql");
+  const legacyMigration = findExistingMigration(migrations, "_exposify_meta.sql");
   files.push(
-    migration ? { status: "pass", message: `migration ${MIGRATIONS_DIR}/${migration}` } : { status: "fail", message: "no *_exposify_meta.sql migration", fix: "npx exposify-supabase init" }
+    migration ? { status: "pass", message: `migration ${MIGRATIONS_DIR}/${migration}` } : legacyMigration ? {
+      status: "warn",
+      message: `migration ${MIGRATIONS_DIR}/${legacyMigration} is the older exposify_meta(), which doesn't report grants`,
+      fix: "npx @exposify/supabase init (it adds *_exposify_meta_v2.sql), then supabase db push"
+    } : { status: "fail", message: "no *_exposify_meta_v2.sql migration", fix: "npx @exposify/supabase init" }
   );
   const functionSource = await deps.readText(FUNCTION_PATH);
   const authMode = functionSource === null ? null : detectAuthMode(functionSource);
   files.push(
-    functionSource !== null ? { status: "pass", message: `function ${FUNCTION_PATH} (auth: ${AUTH_LABEL[authMode]})` } : { status: "fail", message: `no ${FUNCTION_PATH}`, fix: "npx exposify-supabase init" }
+    functionSource !== null ? { status: "pass", message: `function ${FUNCTION_PATH} (auth: ${AUTH_LABEL[authMode]})` } : { status: "fail", message: `no ${FUNCTION_PATH}`, fix: "npx @exposify/supabase init" }
   );
   if (bypassesGatewayJwt2(authMode)) {
     const verifyJwt = toml === null ? null : readFunctionVerifyJwt(toml);
@@ -686,7 +765,7 @@ async function runDoctor(deps) {
       } : {
         status: "fail",
         message: `verify_jwt is ${verifyJwt === null ? "unset (defaults to on)" : "on"} for ${FUNCTION_NAME}; ` + (oauth ? "MCP clients will never get the OAuth login challenge" : "the gateway will reject every extb_... token"),
-        fix: "re-run `npx exposify-supabase init` (it sets it), or add `[functions.mcp] verify_jwt = false` to config.toml and redeploy"
+        fix: "re-run `npx @exposify/supabase init` (it sets it), or add `[functions.mcp] verify_jwt = false` to config.toml and redeploy"
       }
     );
   }
@@ -715,6 +794,13 @@ async function runDoctor(deps) {
     } else {
       const tableCount = new Set(meta.value.map((r) => r.table_name)).size;
       db.push({ status: "pass", message: `exposify_meta() applied (${tableCount} table(s) in the catalog)` });
+      if (meta.value.length > 0 && grantsOf(meta.value[0]) === void 0) {
+        db.push({
+          status: "warn",
+          message: "exposify_meta() in the database is the older one: it doesn't report grants, so tables agents can't read are still listed as tools",
+          fix: "npx @exposify/supabase init, then supabase db push"
+        });
+      }
     }
     if (openapi.status === "rejected") {
       const reason = openapi.reason instanceof Error ? openapi.reason.message : String(openapi.reason);
@@ -724,10 +810,14 @@ async function runDoctor(deps) {
     }
     if (openapi.status === "fulfilled" && meta.status === "fulfilled") {
       const tables = introspectTables(openapi.value, meta.value);
+      const { rlsOff, notGranted } = invisibleTables(meta.value, tables);
       db.push(
-        tables.length > 0 ? { status: "pass", message: `${tables.length} table(s) exposed as tools: ${tables.map((t) => t.name).join(", ")}` } : { status: "warn", message: "no tables exposed (none have RLS on and API grants)", fix: "enable RLS on the tables agents should read" }
+        tables.length > 0 ? { status: "pass", message: `${tables.length} table(s) exposed as tools: ${tables.map((t) => t.name).join(", ")}` } : {
+          status: "warn",
+          message: "no tables exposed (none have RLS on and API grants)",
+          fix: notGranted.length > 0 ? "grant the authenticated role access (below)" : "enable RLS on the tables agents should read"
+        }
       );
-      const { rlsOff, notGranted } = invisibleTables(meta.value, tables);
       if (rlsOff.length > 0) {
         db.push({
           status: "warn",
@@ -738,8 +828,23 @@ async function runDoctor(deps) {
       if (notGranted.length > 0) {
         db.push({
           status: "warn",
-          message: `RLS on but not exposed by PostgREST (no API role grants): ${notGranted.join(", ")}`,
-          fix: "grant select on <name> to authenticated;"
+          message: `RLS on, but the authenticated role can't read them, so they aren't tools: ${notGranted.join(", ")}`,
+          fix: notGranted.map((t) => `grant select on public.${t} to authenticated;`).join(" ")
+        });
+      }
+      const { ungranted, keyless } = functionSource === null ? { ungranted: [], keyless: [] } : unavailableWrites(tables, parseFunctionFile(functionSource).config.writes);
+      if (keyless.length > 0) {
+        db.push({
+          status: "warn",
+          message: `writes in the function's config on tables without a primary key, so they aren't tools (an update or delete must name its row by key): ${keyless.map((w) => `${w.table}.${w.op}`).join(", ")}`,
+          fix: "add a primary key to the table"
+        });
+      }
+      if (ungranted.length > 0) {
+        db.push({
+          status: "warn",
+          message: `writes in the function's config the authenticated role isn't granted, so they aren't tools: ${ungranted.map((w) => `${w.table}.${w.op}`).join(", ")}`,
+          fix: ungranted.map((w) => `grant ${w.op} on public.${w.table} to authenticated;`).join(" ")
         });
       }
       const undocumented = tablesMissingDocs(tables).filter((t) => t.missingTableComment || t.columnsWithoutComments.length > 0);
@@ -747,7 +852,7 @@ async function runDoctor(deps) {
         db.push({
           status: "warn",
           message: `${undocumented.length} table(s) missing comments, so tools have thin descriptions: ${undocumented.map((t) => t.name).join(", ")}`,
-          fix: "re-run `npx exposify-supabase init` and write descriptions, or add COMMENT ON TABLE/COLUMN"
+          fix: "re-run `npx @exposify/supabase init` and write descriptions, or add COMMENT ON TABLE/COLUMN"
         });
       }
     }
@@ -763,8 +868,35 @@ async function runDoctor(deps) {
   }
   if (authMode === "broker") fn.push(licenseSecretCheck(deps));
   sections.push({ title: "Deployed function", checks: fn });
+  if (authMode === "broker" && conn) sections.push({ title: "Connect (agents sign in to your Supabase Auth)", checks: await connectChecks(deps, conn) });
   return sections;
 }
+async function connectChecks(deps, conn) {
+  const auth = conn.anonKey ? await readSupabaseAuth(conn.url, conn.anonKey, deps.fetch) : void 0;
+  const checks = [];
+  if (!auth) {
+    checks.push({ status: "warn", message: "couldn't read the project's Auth settings (/auth/v1/settings)", fix: "pass the anon key with --key, or check Auth is enabled" });
+    return checks;
+  }
+  checks.push(
+    auth.providers.length ? { status: "pass", message: `social sign-in offered to agents: ${auth.providers.join(", ")}` } : {
+      status: "warn",
+      message: "no social provider is switched on, so agents can only sign in with an email code",
+      fix: "switch one on in Auth \u2192 Sign In / Providers, or turn on email codes in the agemno dashboard"
+    }
+  );
+  if (!auth.signupsDisabled) {
+    checks.push({ status: "warn", message: "sign-ups are allowed: a new user who signs in with a social provider through Connect gets an account" });
+  }
+  const projectId = deps.exposifyKey ? parseExposifyKey(deps.exposifyKey)?.projectId : void 0;
+  const callback = projectId ? `${(deps.brokerUrl ?? DEFAULT_BROKER_URL).replace(/\/+$/, "")}/projects/${projectId}/supabase-callback` : null;
+  checks.push({
+    status: "warn",
+    message: callback ? `Redirect URLs must include ${callback} (can't be checked from here)` : "Redirect URLs must include the broker's callback (can't be checked from here)",
+    fix: callback ? "add it in Auth \u2192 URL Configuration \u2192 Redirect URLs" : "the agemno dashboard's sign-in page shows it; or run doctor with EXPOSIFY_KEY set to print it"
+  });
+  return checks;
+}
 function probeChecks(url, outcome, authMode, local) {
   switch (outcome.kind) {
     case "ok": {
@@ -868,7 +1000,8 @@ var FUNCTION_DIR = "supabase/functions/mcp";
 var FUNCTION_PATH2 = `${FUNCTION_DIR}/index.ts`;
 var MIGRATIONS_DIR2 = "supabase/migrations";
 var CONFIG_TOML2 = "supabase/config.toml";
-var META_SUFFIX = "_exposify_meta.sql";
+var META_SUFFIX = "_exposify_meta_v2.sql";
+var LEGACY_META_SUFFIX = "_exposify_meta.sql";
 var COMMENTS_SUFFIX = "_exposify_comments.sql";
 function authLabel(config) {
   return config.broker ? "hosted broker" : config.oauth ? "Supabase Auth OAuth" : "user JWT";
@@ -903,7 +1036,7 @@ function planInit(input) {
     changes.push({
       path: `${MIGRATIONS_DIR2}/${name}`,
       action: "create",
-      summary: "exposify_meta() migration",
+      summary: findExistingMigration(input.migrations, LEGACY_META_SUFFIX) ? "exposify_meta() update: it also reports the authenticated role's grants" : "exposify_meta() migration",
       content: input.metaMigrationSql,
       effect: "push"
     });
@@ -1019,14 +1152,10 @@ function staleFunctionReason(probe, config, exposedTables) {
     return config.oauth ? "the gateway still checks JWTs for the function, so MCP clients never get the login challenge (deploy with --no-verify-jwt)." : "the gateway still checks JWTs for the function, so broker tokens are rejected (deploy with --no-verify-jwt).";
   }
   if (probe.kind !== "ok" || !exposedTables) return null;
-  const exposed = new Set(exposedTables.map((t) => t.name));
+  const opted = parseWrites(config.writes);
   const expected = /* @__PURE__ */ new Set();
-  for (const w of config.writes) {
-    const dot = w.lastIndexOf(".");
-    const table = w.slice(0, dot);
-    if (!exposed.has(table)) continue;
-    const op = w.slice(dot + 1);
-    for (const o of op === "*" ? ["insert", "update", "delete"] : [op]) expected.add(`${o}_${sanitizeIdentifier(table)}`);
+  for (const table of exposedTables) {
+    for (const op of writeToolOps(table, opted.get(table.name)).ops) expected.add(`${op}_${sanitizeIdentifier(table.name)}`);
   }
   for (const fn of config.rpc) expected.add(`rpc_${sanitizeIdentifier(fn)}`);
   const live = new Set(probe.tools.filter((t) => /^(insert|update|delete|rpc)_/.test(t)));
@@ -1042,7 +1171,7 @@ function liveVerdict(s) {
   let deploy = false;
   if (s.migrationApplied === false) {
     push = true;
-    notes.push("exposify_meta() isn't in the database yet (migration not pushed).");
+    notes.push("the exposify_meta() migration isn't in the database yet (not pushed).");
   }
   if (s.pendingComments.length > 0) {
     push = true;
@@ -1231,7 +1360,8 @@ async function tryIntrospect(conn) {
       fetchOpenApi(postgrestUrl, headers, fetchWithTimeout),
       fetchExposifyMeta(postgrestUrl, headers, fetchWithTimeout)
     ]);
-    return { introspection: { tables: introspectTables(openapi, metaRows), openapi }, migrationApplied: true };
+    const current = metaRows.length === 0 || grantsOf(metaRows[0]) !== void 0;
+    return { introspection: { tables: introspectTables(openapi, metaRows), openapi }, migrationApplied: current };
   } catch (err) {
     if (err instanceof MissingExposifyMetaError) return { introspection: null, migrationApplied: false };
     console.log(`
@@ -1470,14 +1600,14 @@ No files were changed. Merge the block above into ${FUNCTION_PATH2}, then re-run
       }
       if (!c) {
         console.log(
-          "\nNothing changed locally. Couldn't check the project itself (no --url/--key, env vars, or local/linked project) -- run `npx exposify-supabase doctor` once it's reachable."
+          "\nNothing changed locally. Couldn't check the project itself (no --url/--key, env vars, or local/linked project) -- run `npx @exposify/supabase doctor` once it's reachable."
         );
         return;
       }
       console.log("\nNothing changed locally, but the project is behind:");
       for (const n of verdict.notes) console.log(`  - ${n}`);
       if (!verdict.push && !verdict.deploy) {
-        console.log("Run `npx exposify-supabase doctor` for details.");
+        console.log("Run `npx @exposify/supabase doctor` for details.");
         return;
       }
       if (c.source === "local") {
@@ -1493,7 +1623,7 @@ That's the local stack: run ${todo.join(" and ")}.`);
       const again = await tryIntrospect(await getConn());
       if (!again.introspection) {
         console.log(
-          "\nDeployed, but couldn't reach the project to introspect tables (no --url/--key, no SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY, and no local stack or linked project the Supabase CLI could supply keys for). Re-run `exposify-supabase init` with those set to configure writes, RPCs, and documentation interactively."
+          "\nDeployed, but couldn't reach the project to introspect tables (no --url/--key, no SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY, and no local stack or linked project the Supabase CLI could supply keys for). Re-run `npx @exposify/supabase init` with those set to configure writes, RPCs, and documentation interactively."
         );
         console.log(`
 Done. ${clientStep(effectiveAuth)}`);
@@ -1567,7 +1697,9 @@ async function cmdDoctor() {
     connectionNotes: notes,
     projectRef,
     fetch: fetchWithTimeout,
-    token: argValue("--token")
+    token: argValue("--token"),
+    ...process.env.EXPOSIFY_KEY ? { exposifyKey: process.env.EXPOSIFY_KEY } : {},
+    ...process.env.EXPOSIFY_BROKER_URL ? { brokerUrl: process.env.EXPOSIFY_BROKER_URL } : {}
   });
   console.log(formatReport(sections));
   if (hasFailures(sections)) process.exitCode = 1;
@@ -1587,7 +1719,7 @@ async function main() {
   if (cmd === "generate") return cmdGenerate();
   if (cmd === "doctor") return cmdDoctor();
   console.log(
-    "Usage: exposify-supabase <init|generate|doctor> [--url <url>] [--key <service-role-key>] [--local|--linked] [--broker [--broker-url <url>] | --oauth] [--token <token>] [--check]"
+    "Usage: @exposify/supabase <init|generate|doctor> [--url <url>] [--key <service-role-key>] [--local|--linked] [--broker [--broker-url <url>] | --oauth] [--token <token>] [--check]"
   );
   console.log("  init      Scaffold the exposify_meta() migration + supabase/functions/mcp/index.ts, then (when the");
   console.log("            project is reachable) walk through anonymous sign-in, per-table writes, RPC exposure, and");

package/dist/index.cjs

@@ -107,7 +107,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[exposify-supabase] ${message}`);
+    console.warn(`[@exposify/supabase] ${message}`);
   } catch {
   }
 }
@@ -131,6 +131,22 @@ function resolveSupabaseConfig(options = {}, hostedBroker2 = false) {
     rateWindowMs: options.rateWindowMs
   };
 }
+function writeToolOps(table, opted) {
+  const ops = [];
+  const ungranted = [];
+  const keyless = [];
+  const hasKey = table.columns.some((c) => c.isPrimaryKey);
+  for (const op of WRITE_OPS) {
+    if (!opted?.has(op)) continue;
+    if (table.grants && !table.grants[op]) ungranted.push(op);
+    else if (op !== "insert" && !hasKey) keyless.push(op);
+    else ops.push(op);
+  }
+  return { ops, ungranted, keyless };
+}
+function writeTools(table, cfg) {
+  return writeToolOps(table, cfg.writes.get(table.name));
+}
 
 // src/postgrest-client.ts
 var FORWARDED_HEADERS = ["authorization", "apikey"];
@@ -206,7 +222,7 @@ async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
   });
   if (res.status === 404) {
     throw new MissingExposifyMetaError(
-      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx @exposify/supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
@@ -275,6 +291,8 @@ function introspectTables(openapi, metaRows) {
     const rlsEnabled = rows[0].rls_enabled;
     if (!rlsEnabled) continue;
     if (!exposedInOpenApi.has(name)) continue;
+    const grants = grantsOf(rows[0]);
+    if (grants && !grants.select) continue;
     const openApiColumns = new Map(columnsFromOpenApi(openapi, name).map((c) => [c.name, c]));
     const columns = [];
     for (const row of rows) {
@@ -292,11 +310,21 @@ function introspectTables(openapi, metaRows) {
       name,
       rlsEnabled: true,
       description: rows[0].table_comment ?? void 0,
-      columns
+      columns,
+      ...grants ? { grants } : {}
     });
   }
   return tables.sort((a, b) => a.name.localeCompare(b.name));
 }
+function grantsOf(row) {
+  if (typeof row.can_select !== "boolean") return void 0;
+  return {
+    select: row.can_select,
+    insert: row.can_insert === true,
+    update: row.can_update === true,
+    delete: row.can_delete === true
+  };
+}
 function groupByTable(rows) {
   const map = /* @__PURE__ */ new Map();
   for (const row of rows) {
@@ -366,9 +394,16 @@ function buildQueryString(args, maxRows) {
   params.set("limit", String(limit));
   return params.toString();
 }
-function requireFilter(filter) {
-  if (!filter || filter.length === 0) {
-    throw new Error("At least one filter is required -- refusing a table-wide update/delete.");
+function requireKeyFilter(filter, keyColumns2) {
+  if (keyColumns2.length === 0) {
+    throw new Error("This table has no primary key, so a single row can't be named -- refusing the update/delete.");
+  }
+  const pinned = new Set((filter ?? []).filter((f) => f.op === "eq").map((f) => f.column));
+  const unpinned = keyColumns2.filter((c) => !pinned.has(c));
+  if (unpinned.length > 0) {
+    throw new Error(
+      `The filter must include eq on the primary key (${unpinned.join(", ")}), so it changes one row -- refusing a filter that could match many. To change several rows, make one call per row.`
+    );
   }
   return filter;
 }
@@ -442,10 +477,10 @@ function buildSupabaseMcpServer(deps) {
   const taken = /* @__PURE__ */ new Set(["search_docs"]);
   for (const table of tables) {
     registerQueryTool(server, table, client, cfg, taken);
-    const grants = cfg.writes.get(table.name);
-    if (grants?.has("insert")) registerInsertTool(server, table, client, taken);
-    if (grants?.has("update")) registerUpdateTool(server, table, client, taken);
-    if (grants?.has("delete")) registerDeleteTool(server, table, client, taken);
+    const { ops } = writeTools(table, cfg);
+    if (ops.includes("insert")) registerInsertTool(server, table, client, taken);
+    if (ops.includes("update")) registerUpdateTool(server, table, client, taken);
+    if (ops.includes("delete")) registerDeleteTool(server, table, client, taken);
   }
   for (const fn of cfg.rpc) {
     registerRpcTool(server, fn, client, deps.openapi, taken);
@@ -537,23 +572,30 @@ function registerInsertTool(server, table, client, taken) {
     async (args) => toResult(() => client.insert(table.name, args.body))
   );
 }
+function keyColumns(table) {
+  return table.columns.filter((c) => c.isPrimaryKey).map((c) => c.name);
+}
+function keyFilterShape(table, verb) {
+  const keys = keyColumns(table);
+  const message = `The filter must include eq on ${keys.join(", ")} -- refusing ${verb === "update" ? "an update" : "a delete"} that could match many rows.`;
+  return filterShape(table.columns).refine((f) => !!f && keys.every((k) => f.some((x) => x.column === k && x.op === "eq")), { message }).describe(`Filters, ANDed together. Must include eq on ${keys.join(", ")} (the primary key), so one row changes.`);
+}
 function registerUpdateTool(server, table, client, taken) {
   const name = toolName("update", table.name, taken);
   const setShape = {};
   for (const col of table.columns) setShape[col.name] = columnToZod(col).optional();
+  const keys = keyColumns(table);
   server.registerTool(
     name,
     {
-      description: `Update rows in ${table.name}. At least one filter is required.`,
+      description: `Update one row in ${table.name}, named by its primary key (${keys.join(", ")}) with eq in the filter.`,
       inputSchema: {
-        filter: filterShape(table.columns).refine((f) => !!f && f.length > 0, {
-          message: "At least one filter is required -- refusing a table-wide update."
-        }),
+        filter: keyFilterShape(table, "update"),
         set: import_zod2.z.object(setShape)
       },
       annotations: { readOnlyHint: false, destructiveHint: true }
     },
-    async (args) => toResult(() => client.update(table.name, filterQueryString(requireFilter(args.filter)), args.set))
+    async (args) => toResult(() => client.update(table.name, filterQueryString(requireKeyFilter(args.filter, keys)), args.set))
   );
 }
 function registerDeleteTool(server, table, client, taken) {
@@ -561,15 +603,13 @@ function registerDeleteTool(server, table, client, taken) {
   server.registerTool(
     name,
     {
-      description: `Delete rows from ${table.name}. At least one filter is required.`,
+      description: `Delete one row from ${table.name}, named by its primary key (${keyColumns(table).join(", ")}) with eq in the filter.`,
       inputSchema: {
-        filter: filterShape(table.columns).refine((f) => !!f && f.length > 0, {
-          message: "At least one filter is required -- refusing a table-wide delete."
-        })
+        filter: keyFilterShape(table, "delete")
       },
       annotations: { readOnlyHint: false, destructiveHint: true }
     },
-    async (args) => toResult(() => client.delete(table.name, filterQueryString(requireFilter(args.filter))))
+    async (args) => toResult(() => client.delete(table.name, filterQueryString(requireKeyFilter(args.filter, keyColumns(table)))))
   );
 }
 function registerRpcTool(server, fn, client, openapi, taken) {
@@ -624,7 +664,7 @@ function registerDiagnosticsResource(server, warnings) {
   server.registerResource(
     "exposify-diagnostics",
     "exposify://diagnostics",
-    { title: "exposify-supabase diagnostics", mimeType: "application/json" },
+    { title: "@exposify/supabase diagnostics", mimeType: "application/json" },
     async (uri) => ({ contents: [{ uri: uri.href, text: JSON.stringify(warnings, null, 2) }] })
   );
 }
@@ -698,12 +738,12 @@ function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
 
 // src/startup.ts
 var import_core4 = require("@exposify/core");
-var LOG_PREFIX = "[exposify-supabase]";
-var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `exposify-supabase generate`";
+var LOG_PREFIX = "[@exposify/supabase]";
+var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `npx @exposify/supabase generate`";
 function supabaseToolsPhrase(ladder, cfg, hasDocs) {
   const query = ladder.tables.length;
   let write = 0;
-  for (const table of ladder.tables) write += cfg.writes.get(table.name)?.size ?? 0;
+  for (const table of ladder.tables) write += writeTools(table, cfg).ops.length;
   const rpc = cfg.rpc.length;
   const fn = Object.keys(cfg.functions).length;
   const parts = [`${query} query`];
@@ -730,6 +770,26 @@ function logColdStart(opts) {
     const details = ladder.mode === "manifest" ? ["from the bundled manifest"] : [];
     console.log((0, import_core4.formatReady)(LOG_PREFIX, { endpoint, tools: supabaseToolsPhrase(ladder, cfg, docs > 0), details, docs, auth }));
   }
+  const keyless = ladder.tables.flatMap((t) => writeTools(t, cfg).keyless.map((op) => `${t.name}.${op}`));
+  if (keyless.length > 0) {
+    console.warn(
+      (0, import_core4.formatWarning)(
+        LOG_PREFIX,
+        `writes opted in on tables without a primary key, so they aren't tools (an update or delete must name its row by key): ${keyless.join(", ")}`,
+        "add a primary key to the table"
+      )
+    );
+  }
+  const ungranted = ladder.tables.flatMap((t) => writeTools(t, cfg).ungranted.map((op) => ({ table: t.name, op })));
+  if (ungranted.length > 0) {
+    console.warn(
+      (0, import_core4.formatWarning)(
+        LOG_PREFIX,
+        `writes opted in but not granted to the authenticated role, so they aren't tools: ${ungranted.map((w) => `${w.table}.${w.op}`).join(", ")}`,
+        ungranted.map((w) => `grant ${w.op} on public.${w.table} to authenticated;`).join(" ")
+      )
+    );
+  }
   if (ladder.mode === "manifest") {
     console.warn(
       (0, import_core4.formatWarning)(LOG_PREFIX, "live schema introspection failed; tools come from the bundled manifest and may be out of date", INTROSPECTION_FIX)
@@ -797,7 +857,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[exposify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[@exposify/supabase] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });
@@ -834,7 +894,7 @@ function aiReady(options = {}) {
           return { status: res.status, bodyText: await res.text() };
         };
         return buildSupabaseMcpServer({
-          appName: "exposify-supabase",
+          appName: "@exposify/supabase",
           appVersion: "0.0.0",
           tables: ladder.tables,
           cfg,
@@ -861,6 +921,16 @@ function aiReady(options = {}) {
   const authRequired = options.authRequired ?? (envAuth !== void 0 || (0, import_core5.isHostedResolver)(auth));
   if (!auth) return core;
   const brokerGate = authRequired ? (0, import_core5.createBrokerGate)(auth) : null;
+  const authKey = anonKey || env?.get("SUPABASE_PUBLISHABLE_KEY") || "";
+  let supabaseAuth2;
+  const supabaseAuthOnce = () => {
+    if (!supabaseUrl || !authKey) return Promise.resolve(void 0);
+    supabaseAuth2 ??= (0, import_core5.readSupabaseAuth)(supabaseUrl, authKey, fetchImpl).then((found) => {
+      if (!found) supabaseAuth2 = void 0;
+      return found;
+    });
+    return supabaseAuth2;
+  };
   const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
     let open = false;
@@ -868,7 +938,13 @@ function aiReady(options = {}) {
       const own = (0, import_core5.publicRequestUrl)(req.url, req.headers);
       const isPrm = own.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
-      open = await (0, import_core5.reportAppLogin)(auth, resource, null, { stacks: ["@supabase/supabase-js"], why: "Supabase Auth sign-in for agents is the Supabase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      const supabase = await supabaseAuthOnce();
+      open = await (0, import_core5.reportAppLogin)(auth, resource, null, {
+        stacks: ["@supabase/supabase-js"],
+        why: supabase ? "Your Supabase Auth is turned off for agents in the dashboard." : "Couldn't read your project's Supabase Auth settings (/auth/v1/settings with the anon key), so Connect can't offer it yet.",
+        log: logReady,
+        ...supabase ? { supabase } : {}
+      }) === "open";
       if (open) {
         if (isPrm) return new Response("not found", { status: 404 });
       } else {
@@ -881,7 +957,7 @@ function aiReady(options = {}) {
     try {
       resolved = await auth(req.headers, {});
     } catch (err) {
-      console.error("exposify-supabase: auth resolver failed", err);
+      console.error("@exposify/supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
     if (authRequired && !open && !resolved.get("authorization")) {

package/dist/index.d.cts

@@ -18,6 +18,18 @@ interface TableSchema {
     /** From `exposify_meta()`'s `table_comment` (a `COMMENT ON TABLE`). */
     description?: string;
     columns: ColumnSchema[];
+    /**
+     * What the `authenticated` role may do on the table (`exposify_meta()`'s
+     * `can_*` columns). Absent when the database still has the older function,
+     * which didn't report grants: then nothing is filtered on them.
+     */
+    grants?: TableGrants;
+}
+interface TableGrants {
+    select: boolean;
+    insert: boolean;
+    update: boolean;
+    delete: boolean;
 }
 /** One row of `exposify_meta()` -- the migration returns one row per column. */
 interface MetaRow {
@@ -26,6 +38,11 @@ interface MetaRow {
     table_comment: string | null;
     column_name: string;
     column_comment: string | null;
+    /** Absent from the older `exposify_meta()` (before the `_v2` migration). */
+    can_select?: boolean;
+    can_insert?: boolean;
+    can_update?: boolean;
+    can_delete?: boolean;
 }
 /** Registered sibling edge function exposed as a tool. */
 interface FunctionToolConfig {
@@ -126,7 +143,7 @@ interface AgentifySupabaseOptions {
     authRequired?: boolean;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
-    /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */
+    /** Bundled fallback manifest (from `@exposify/supabase generate`), used when runtime introspection fails. */
     manifest?: unknown;
     rateLimit?: number;
     rateWindowMs?: number;
@@ -196,7 +213,7 @@ interface ExposifyManifest {
     generatedAt: string;
     tables: TableSchema[];
 }
-/** Built by `npx exposify-supabase generate` against a local/linked project. */
+/** Built by `npx @exposify/supabase generate` against a local/linked project. */
 declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): ExposifyManifest;
 /**
  * Defensive load: a manifest is bundled JSON shipped alongside the function
@@ -217,6 +234,11 @@ declare function loadManifest(raw: unknown): ExposifyManifest | null;
  * appears, silently, exactly like a table PostgREST doesn't know about at
  * all. There is no override: an RLS-less table is invisible even if the
  * owner explicitly lists it in `writes`.
+ *
+ * The OpenAPI document is fetched with the service role key, so it lists
+ * tables the `authenticated` role can't touch. A table `exposify_meta()`
+ * reports no SELECT grant for is left out too: every call to its query tool
+ * would answer 403.
  */
 declare function introspectTables(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[]): TableSchema[];
 

package/dist/index.d.ts

@@ -18,6 +18,18 @@ interface TableSchema {
     /** From `exposify_meta()`'s `table_comment` (a `COMMENT ON TABLE`). */
     description?: string;
     columns: ColumnSchema[];
+    /**
+     * What the `authenticated` role may do on the table (`exposify_meta()`'s
+     * `can_*` columns). Absent when the database still has the older function,
+     * which didn't report grants: then nothing is filtered on them.
+     */
+    grants?: TableGrants;
+}
+interface TableGrants {
+    select: boolean;
+    insert: boolean;
+    update: boolean;
+    delete: boolean;
 }
 /** One row of `exposify_meta()` -- the migration returns one row per column. */
 interface MetaRow {
@@ -26,6 +38,11 @@ interface MetaRow {
     table_comment: string | null;
     column_name: string;
     column_comment: string | null;
+    /** Absent from the older `exposify_meta()` (before the `_v2` migration). */
+    can_select?: boolean;
+    can_insert?: boolean;
+    can_update?: boolean;
+    can_delete?: boolean;
 }
 /** Registered sibling edge function exposed as a tool. */
 interface FunctionToolConfig {
@@ -126,7 +143,7 @@ interface AgentifySupabaseOptions {
     authRequired?: boolean;
     /** Injectable for tests; defaults to global `fetch`. */
     fetchImpl?: typeof fetch;
-    /** Bundled fallback manifest (from `exposify-supabase generate`), used when runtime introspection fails. */
+    /** Bundled fallback manifest (from `@exposify/supabase generate`), used when runtime introspection fails. */
     manifest?: unknown;
     rateLimit?: number;
     rateWindowMs?: number;
@@ -196,7 +213,7 @@ interface ExposifyManifest {
     generatedAt: string;
     tables: TableSchema[];
 }
-/** Built by `npx exposify-supabase generate` against a local/linked project. */
+/** Built by `npx @exposify/supabase generate` against a local/linked project. */
 declare function buildManifest(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[], generatedAt: string): ExposifyManifest;
 /**
  * Defensive load: a manifest is bundled JSON shipped alongside the function
@@ -217,6 +234,11 @@ declare function loadManifest(raw: unknown): ExposifyManifest | null;
  * appears, silently, exactly like a table PostgREST doesn't know about at
  * all. There is no override: an RLS-less table is invisible even if the
  * owner explicitly lists it in `writes`.
+ *
+ * The OpenAPI document is fetched with the service role key, so it lists
+ * tables the `authenticated` role can't touch. A table `exposify_meta()`
+ * reports no SELECT grant for is left out too: every call to its query tool
+ * would answer 403.
  */
 declare function introspectTables(openapi: PostgrestOpenApiDoc, metaRows: MetaRow[]): TableSchema[];
 

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, reportAppLogin, startupLogEnabled } from "@exposify/core";
+import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, readSupabaseAuth, reportAppLogin, startupLogEnabled } from "@exposify/core";
 
 // src/kb.ts
 import { KnowledgeBase } from "@exposify/core";
@@ -70,7 +70,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[exposify-supabase] ${message}`);
+    console.warn(`[@exposify/supabase] ${message}`);
   } catch {
   }
 }
@@ -94,6 +94,22 @@ function resolveSupabaseConfig(options = {}, hostedBroker2 = false) {
     rateWindowMs: options.rateWindowMs
   };
 }
+function writeToolOps(table, opted) {
+  const ops = [];
+  const ungranted = [];
+  const keyless = [];
+  const hasKey = table.columns.some((c) => c.isPrimaryKey);
+  for (const op of WRITE_OPS) {
+    if (!opted?.has(op)) continue;
+    if (table.grants && !table.grants[op]) ungranted.push(op);
+    else if (op !== "insert" && !hasKey) keyless.push(op);
+    else ops.push(op);
+  }
+  return { ops, ungranted, keyless };
+}
+function writeTools(table, cfg) {
+  return writeToolOps(table, cfg.writes.get(table.name));
+}
 
 // src/postgrest-client.ts
 var FORWARDED_HEADERS = ["authorization", "apikey"];
@@ -169,7 +185,7 @@ async function fetchExposifyMeta(postgrestUrl, headers, fetchImpl) {
   });
   if (res.status === 404) {
     throw new MissingExposifyMetaError(
-      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx exposify-supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
+      "exposify_meta() is not reachable at /rpc/exposify_meta (404). Run `npx @exposify/supabase init` (or apply sql/exposify_meta.sql directly) and `supabase db push`, then redeploy the function."
     );
   }
   if (!res.ok) {
@@ -238,6 +254,8 @@ function introspectTables(openapi, metaRows) {
     const rlsEnabled = rows[0].rls_enabled;
     if (!rlsEnabled) continue;
     if (!exposedInOpenApi.has(name)) continue;
+    const grants = grantsOf(rows[0]);
+    if (grants && !grants.select) continue;
     const openApiColumns = new Map(columnsFromOpenApi(openapi, name).map((c) => [c.name, c]));
     const columns = [];
     for (const row of rows) {
@@ -255,11 +273,21 @@ function introspectTables(openapi, metaRows) {
       name,
       rlsEnabled: true,
       description: rows[0].table_comment ?? void 0,
-      columns
+      columns,
+      ...grants ? { grants } : {}
     });
   }
   return tables.sort((a, b) => a.name.localeCompare(b.name));
 }
+function grantsOf(row) {
+  if (typeof row.can_select !== "boolean") return void 0;
+  return {
+    select: row.can_select,
+    insert: row.can_insert === true,
+    update: row.can_update === true,
+    delete: row.can_delete === true
+  };
+}
 function groupByTable(rows) {
   const map = /* @__PURE__ */ new Map();
   for (const row of rows) {
@@ -332,9 +360,16 @@ function buildQueryString(args, maxRows) {
   params.set("limit", String(limit));
   return params.toString();
 }
-function requireFilter(filter) {
-  if (!filter || filter.length === 0) {
-    throw new Error("At least one filter is required -- refusing a table-wide update/delete.");
+function requireKeyFilter(filter, keyColumns2) {
+  if (keyColumns2.length === 0) {
+    throw new Error("This table has no primary key, so a single row can't be named -- refusing the update/delete.");
+  }
+  const pinned = new Set((filter ?? []).filter((f) => f.op === "eq").map((f) => f.column));
+  const unpinned = keyColumns2.filter((c) => !pinned.has(c));
+  if (unpinned.length > 0) {
+    throw new Error(
+      `The filter must include eq on the primary key (${unpinned.join(", ")}), so it changes one row -- refusing a filter that could match many. To change several rows, make one call per row.`
+    );
   }
   return filter;
 }
@@ -408,10 +443,10 @@ function buildSupabaseMcpServer(deps) {
   const taken = /* @__PURE__ */ new Set(["search_docs"]);
   for (const table of tables) {
     registerQueryTool(server, table, client, cfg, taken);
-    const grants = cfg.writes.get(table.name);
-    if (grants?.has("insert")) registerInsertTool(server, table, client, taken);
-    if (grants?.has("update")) registerUpdateTool(server, table, client, taken);
-    if (grants?.has("delete")) registerDeleteTool(server, table, client, taken);
+    const { ops } = writeTools(table, cfg);
+    if (ops.includes("insert")) registerInsertTool(server, table, client, taken);
+    if (ops.includes("update")) registerUpdateTool(server, table, client, taken);
+    if (ops.includes("delete")) registerDeleteTool(server, table, client, taken);
   }
   for (const fn of cfg.rpc) {
     registerRpcTool(server, fn, client, deps.openapi, taken);
@@ -503,23 +538,30 @@ function registerInsertTool(server, table, client, taken) {
     async (args) => toResult(() => client.insert(table.name, args.body))
   );
 }
+function keyColumns(table) {
+  return table.columns.filter((c) => c.isPrimaryKey).map((c) => c.name);
+}
+function keyFilterShape(table, verb) {
+  const keys = keyColumns(table);
+  const message = `The filter must include eq on ${keys.join(", ")} -- refusing ${verb === "update" ? "an update" : "a delete"} that could match many rows.`;
+  return filterShape(table.columns).refine((f) => !!f && keys.every((k) => f.some((x) => x.column === k && x.op === "eq")), { message }).describe(`Filters, ANDed together. Must include eq on ${keys.join(", ")} (the primary key), so one row changes.`);
+}
 function registerUpdateTool(server, table, client, taken) {
   const name = toolName("update", table.name, taken);
   const setShape = {};
   for (const col of table.columns) setShape[col.name] = columnToZod(col).optional();
+  const keys = keyColumns(table);
   server.registerTool(
     name,
     {
-      description: `Update rows in ${table.name}. At least one filter is required.`,
+      description: `Update one row in ${table.name}, named by its primary key (${keys.join(", ")}) with eq in the filter.`,
       inputSchema: {
-        filter: filterShape(table.columns).refine((f) => !!f && f.length > 0, {
-          message: "At least one filter is required -- refusing a table-wide update."
-        }),
+        filter: keyFilterShape(table, "update"),
         set: z2.object(setShape)
       },
       annotations: { readOnlyHint: false, destructiveHint: true }
     },
-    async (args) => toResult(() => client.update(table.name, filterQueryString(requireFilter(args.filter)), args.set))
+    async (args) => toResult(() => client.update(table.name, filterQueryString(requireKeyFilter(args.filter, keys)), args.set))
   );
 }
 function registerDeleteTool(server, table, client, taken) {
@@ -527,15 +569,13 @@ function registerDeleteTool(server, table, client, taken) {
   server.registerTool(
     name,
     {
-      description: `Delete rows from ${table.name}. At least one filter is required.`,
+      description: `Delete one row from ${table.name}, named by its primary key (${keyColumns(table).join(", ")}) with eq in the filter.`,
       inputSchema: {
-        filter: filterShape(table.columns).refine((f) => !!f && f.length > 0, {
-          message: "At least one filter is required -- refusing a table-wide delete."
-        })
+        filter: keyFilterShape(table, "delete")
       },
       annotations: { readOnlyHint: false, destructiveHint: true }
     },
-    async (args) => toResult(() => client.delete(table.name, filterQueryString(requireFilter(args.filter))))
+    async (args) => toResult(() => client.delete(table.name, filterQueryString(requireKeyFilter(args.filter, keyColumns(table)))))
   );
 }
 function registerRpcTool(server, fn, client, openapi, taken) {
@@ -590,7 +630,7 @@ function registerDiagnosticsResource(server, warnings) {
   server.registerResource(
     "exposify-diagnostics",
     "exposify://diagnostics",
-    { title: "exposify-supabase diagnostics", mimeType: "application/json" },
+    { title: "@exposify/supabase diagnostics", mimeType: "application/json" },
     async (uri) => ({ contents: [{ uri: uri.href, text: JSON.stringify(warnings, null, 2) }] })
   );
 }
@@ -664,12 +704,12 @@ function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
 
 // src/startup.ts
 import { formatFailed, formatReady, formatWarning } from "@exposify/core";
-var LOG_PREFIX = "[exposify-supabase]";
-var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `exposify-supabase generate`";
+var LOG_PREFIX = "[@exposify/supabase]";
+var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `npx @exposify/supabase generate`";
 function supabaseToolsPhrase(ladder, cfg, hasDocs) {
   const query = ladder.tables.length;
   let write = 0;
-  for (const table of ladder.tables) write += cfg.writes.get(table.name)?.size ?? 0;
+  for (const table of ladder.tables) write += writeTools(table, cfg).ops.length;
   const rpc = cfg.rpc.length;
   const fn = Object.keys(cfg.functions).length;
   const parts = [`${query} query`];
@@ -696,6 +736,26 @@ function logColdStart(opts) {
     const details = ladder.mode === "manifest" ? ["from the bundled manifest"] : [];
     console.log(formatReady(LOG_PREFIX, { endpoint, tools: supabaseToolsPhrase(ladder, cfg, docs > 0), details, docs, auth }));
   }
+  const keyless = ladder.tables.flatMap((t) => writeTools(t, cfg).keyless.map((op) => `${t.name}.${op}`));
+  if (keyless.length > 0) {
+    console.warn(
+      formatWarning(
+        LOG_PREFIX,
+        `writes opted in on tables without a primary key, so they aren't tools (an update or delete must name its row by key): ${keyless.join(", ")}`,
+        "add a primary key to the table"
+      )
+    );
+  }
+  const ungranted = ladder.tables.flatMap((t) => writeTools(t, cfg).ungranted.map((op) => ({ table: t.name, op })));
+  if (ungranted.length > 0) {
+    console.warn(
+      formatWarning(
+        LOG_PREFIX,
+        `writes opted in but not granted to the authenticated role, so they aren't tools: ${ungranted.map((w) => `${w.table}.${w.op}`).join(", ")}`,
+        ungranted.map((w) => `grant ${w.op} on public.${w.table} to authenticated;`).join(" ")
+      )
+    );
+  }
   if (ladder.mode === "manifest") {
     console.warn(
       formatWarning(LOG_PREFIX, "live schema introspection failed; tools come from the bundled manifest and may be out of date", INTROSPECTION_FIX)
@@ -763,7 +823,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[exposify-supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[@exposify/supabase] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });
@@ -800,7 +860,7 @@ function aiReady(options = {}) {
           return { status: res.status, bodyText: await res.text() };
         };
         return buildSupabaseMcpServer({
-          appName: "exposify-supabase",
+          appName: "@exposify/supabase",
           appVersion: "0.0.0",
           tables: ladder.tables,
           cfg,
@@ -827,6 +887,16 @@ function aiReady(options = {}) {
   const authRequired = options.authRequired ?? (envAuth !== void 0 || isHostedResolver(auth));
   if (!auth) return core;
   const brokerGate = authRequired ? createBrokerGate(auth) : null;
+  const authKey = anonKey || env?.get("SUPABASE_PUBLISHABLE_KEY") || "";
+  let supabaseAuth2;
+  const supabaseAuthOnce = () => {
+    if (!supabaseUrl || !authKey) return Promise.resolve(void 0);
+    supabaseAuth2 ??= readSupabaseAuth(supabaseUrl, authKey, fetchImpl).then((found) => {
+      if (!found) supabaseAuth2 = void 0;
+      return found;
+    });
+    return supabaseAuth2;
+  };
   const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
     let open = false;
@@ -834,7 +904,13 @@ function aiReady(options = {}) {
       const own = publicRequestUrl(req.url, req.headers);
       const isPrm = own.endsWith(PRM_SUFFIX);
       const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
-      open = await reportAppLogin(auth, resource, null, { stacks: ["@supabase/supabase-js"], why: "Supabase Auth sign-in for agents is the Supabase preset in the dashboard's sign-in methods.", log: logReady }) === "open";
+      const supabase = await supabaseAuthOnce();
+      open = await reportAppLogin(auth, resource, null, {
+        stacks: ["@supabase/supabase-js"],
+        why: supabase ? "Your Supabase Auth is turned off for agents in the dashboard." : "Couldn't read your project's Supabase Auth settings (/auth/v1/settings with the anon key), so Connect can't offer it yet.",
+        log: logReady,
+        ...supabase ? { supabase } : {}
+      }) === "open";
       if (open) {
         if (isPrm) return new Response("not found", { status: 404 });
       } else {
@@ -847,7 +923,7 @@ function aiReady(options = {}) {
     try {
       resolved = await auth(req.headers, {});
     } catch (err) {
-      console.error("exposify-supabase: auth resolver failed", err);
+      console.error("@exposify/supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
     if (authRequired && !open && !resolved.get("authorization")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.14",
+    "@exposify/core": "0.3.16",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },

package/sql/exposify_meta.sql

@@ -1,9 +1,13 @@
--- exposify-supabase: schema introspection function.
+-- @exposify/supabase: schema introspection function.
 --
 -- Exposes, per PostgREST's RPC convention (POST /rpc/exposify_meta), one row
 -- per column of every ordinary table in the `public` schema: whether Row
--- Level Security is enabled on its table, and the table/column comments an
--- owner wrote via `COMMENT ON TABLE` / `COMMENT ON COLUMN`.
+-- Level Security is enabled on its table, the table/column comments an
+-- owner wrote via `COMMENT ON TABLE` / `COMMENT ON COLUMN`, and what the
+-- `authenticated` role (the one agents' tool calls run as) is granted on the
+-- table. Without a grant every call answers 403, however the RLS policies
+-- read: Supabase's newer local images no longer grant `anon`/`authenticated`
+-- on new public tables, so a table can have RLS on and still be unreachable.
 --
 -- This is the runtime source of truth for the DB exposure policy (RLS-gated,
 -- reads auto) and for tool/param descriptions -- see the design spec's "DB
@@ -20,13 +24,22 @@
 --   alter function public.agentify_meta() rename to exposify_meta();
 -- or drop the old one after confirming nothing else calls it:
 --   drop function public.agentify_meta();
-create or replace function public.exposify_meta()
+--
+-- The grant columns were added later, as a new migration
+-- (`<timestamp>_exposify_meta_v2.sql`): adding output columns changes the
+-- function's return type, which `create or replace` can't do, hence the drop.
+drop function if exists public.exposify_meta();
+create function public.exposify_meta()
 returns table (
   table_name text,
   rls_enabled boolean,
   table_comment text,
   column_name text,
-  column_comment text
+  column_comment text,
+  can_select boolean,
+  can_insert boolean,
+  can_update boolean,
+  can_delete boolean
 )
 language sql
 security definer
@@ -37,7 +50,12 @@ as $$
     c.relrowsecurity as rls_enabled,
     obj_description(c.oid, 'pg_class') as table_comment,
     a.attname as column_name,
-    col_description(c.oid, a.attnum) as column_comment
+    col_description(c.oid, a.attnum) as column_comment,
+    -- "any column" so a grant on some columns counts, as PostgREST sees it.
+    has_any_column_privilege('authenticated', c.oid, 'SELECT') as can_select,
+    has_any_column_privilege('authenticated', c.oid, 'INSERT') as can_insert,
+    has_any_column_privilege('authenticated', c.oid, 'UPDATE') as can_update,
+    has_table_privilege('authenticated', c.oid, 'DELETE') as can_delete
   from pg_catalog.pg_class c
   join pg_catalog.pg_namespace n on n.oid = c.relnamespace
   join pg_catalog.pg_attribute a on a.attrelid = c.oid