@exposify/supabase 0.3.13 → 0.3.14

package/README.md

@@ -28,15 +28,18 @@ npx @exposify/supabase init
 
 This is safe to re-run; see "Re-running `init`" below. It writes:
 
-- `supabase/migrations/<timestamp>_exposify_meta_v2.sql` — a SQL migration that
+- `supabase/migrations/<timestamp>_exposify_meta_v3.sql` — a SQL migration that
   adds `exposify_meta()`, a `SECURITY DEFINER` function returning, per table,
   whether RLS is enabled, what the `authenticated` role is granted on it
-  (select/insert/update/delete), and any `COMMENT ON TABLE`/`COMMENT ON COLUMN` text
-  you've written. It only ever returns catalog metadata (table/column names,
-  flags, comments) — never row data — which is what makes it safe to grant
-  to `anon`/`authenticated` and call with a low-privilege key. A project with
-  the older `<timestamp>_exposify_meta.sql` (no grants) gets the `_v2` one on
-  the next `init`, which replaces the function.
+  (select/insert/update/delete), whether each column is an identity or
+  generated column (so `insert_<table>` doesn't ask for a `generated always as
+  identity` key the database rejects), and any `COMMENT ON TABLE`/`COMMENT ON
+  COLUMN` text you've written. It only ever returns catalog metadata
+  (table/column names, flags, comments) — never row data — which is what makes
+  it safe to grant to `anon`/`authenticated` and call with a low-privilege key.
+  A project on an older migration (`_exposify_meta.sql` with no grants, or
+  `_exposify_meta_v2.sql` with no identity/generated columns) gets the `_v3`
+  one on the next `init`, which replaces the function.
 - `supabase/functions/mcp/index.ts` — the edge function itself. `init` owns
   the part between `// exposify:begin` and `// exposify:end` (imports and a
   `generated` options object). Everything after that is yours, starting with
@@ -252,6 +255,12 @@ Deno.serve(aiReady({
 ```
 
 Notes:
+- `insert_<table>` takes a `body` with one field per column, but only the
+  columns the caller actually supplies: a column with a `DEFAULT` or a `BY
+  DEFAULT` identity is optional (the database fills it in), and a `GENERATED
+  ALWAYS AS IDENTITY` column or a generated column is left out entirely (the
+  database computes it and rejects any value). So a table whose only
+  caller-supplied column is `body` is inserted with just `{ "body": "..." }`.
 - `update_<table>` and `delete_<table>` change one row: the filter must
   include `eq` on every primary-key column (more filters only narrow it).
   A filter that happens to match everything (`id neq -1`, `item like %`) is
@@ -357,9 +366,9 @@ exits 1 if anything failed, so you can run it in CI.
   readable. It lists which tables became tools, and warns about tables that
   never will: RLS off, or RLS on but no `SELECT` for `authenticated` (with the
   `grant` to run). It warns about writes in the function's config the role
-  isn't granted, about the older `exposify_meta()` that doesn't report
-  grants, and about tables whose missing comments leave tools with thin
-  descriptions.
+  isn't granted, about an older `exposify_meta()` that doesn't report
+  grants or identity/generated columns, and about tables whose missing
+  comments leave tools with thin descriptions.
 - **Deployed function:** speaks MCP to `<project>/functions/v1/mcp`
   (`initialize`, then `tools/list`) and reports the tool count. If the
   function registered `exposify://diagnostics`, which it only does when

package/dist/cli.js

@@ -76,6 +76,10 @@ function columnsFromOpenApi(doc, table) {
     type: TYPE_MAP[prop.type ?? "string"] ?? "string",
     format: prop.format,
     required: required.has(name),
+    // A column with a DEFAULT doesn't have to be supplied on insert even when
+    // it's NOT NULL (the database fills it in). identity/generated aren't in
+    // PostgREST's OpenAPI -- introspect.ts adds those from exposify_meta().
+    hasDefault: prop.default !== void 0,
     isPrimaryKey: isPrimaryKey(prop),
     // Falls back to the OpenAPI-embedded comment (PostgREST mirrors `COMMENT
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
@@ -110,7 +114,13 @@ function introspectTables(openapi, metaRows) {
         ...fromOpenApi,
         // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
-        description: row.column_comment ?? fromOpenApi.description
+        description: row.column_comment ?? fromOpenApi.description,
+        // identity/generated aren't in PostgREST's OpenAPI; they come from
+        // exposify_meta() (the `_v3` migration). Absent on the older function,
+        // leaving these unset -- the insert/update shapes then fall back to
+        // defaults alone, which is the pre-fix behaviour.
+        ...row.identity_kind ? { identity: row.identity_kind } : {},
+        ...row.is_generated === true ? { generated: true } : {}
       });
     }
     if (columns.length === 0) continue;
@@ -741,14 +751,14 @@ async function runDoctor(deps) {
   sections.push({ title: "Project", checks: project });
   const files = [];
   const migrations = await deps.listDir(MIGRATIONS_DIR);
-  const migration = findExistingMigration(migrations, "_exposify_meta_v2.sql");
-  const legacyMigration = findExistingMigration(migrations, "_exposify_meta.sql");
+  const migration = findExistingMigration(migrations, "_exposify_meta_v3.sql");
+  const legacyMigration = findExistingMigration(migrations, "_exposify_meta_v2.sql") || findExistingMigration(migrations, "_exposify_meta.sql");
   files.push(
     migration ? { status: "pass", message: `migration ${MIGRATIONS_DIR}/${migration}` } : legacyMigration ? {
       status: "warn",
-      message: `migration ${MIGRATIONS_DIR}/${legacyMigration} is the older exposify_meta(), which doesn't report grants`,
-      fix: "npx @exposify/supabase init (it adds *_exposify_meta_v2.sql), then supabase db push"
-    } : { status: "fail", message: "no *_exposify_meta_v2.sql migration", fix: "npx @exposify/supabase init" }
+      message: `migration ${MIGRATIONS_DIR}/${legacyMigration} is an older exposify_meta(), which doesn't report identity/generated columns`,
+      fix: "npx @exposify/supabase init (it adds *_exposify_meta_v3.sql), then supabase db push"
+    } : { status: "fail", message: "no *_exposify_meta_v3.sql migration", fix: "npx @exposify/supabase init" }
   );
   const functionSource = await deps.readText(FUNCTION_PATH);
   const authMode = functionSource === null ? null : detectAuthMode(functionSource);
@@ -1000,7 +1010,8 @@ var FUNCTION_DIR = "supabase/functions/mcp";
 var FUNCTION_PATH2 = `${FUNCTION_DIR}/index.ts`;
 var MIGRATIONS_DIR2 = "supabase/migrations";
 var CONFIG_TOML2 = "supabase/config.toml";
-var META_SUFFIX = "_exposify_meta_v2.sql";
+var META_SUFFIX = "_exposify_meta_v3.sql";
+var META_SUFFIX_V2 = "_exposify_meta_v2.sql";
 var LEGACY_META_SUFFIX = "_exposify_meta.sql";
 var COMMENTS_SUFFIX = "_exposify_comments.sql";
 function authLabel(config) {
@@ -1036,7 +1047,7 @@ function planInit(input) {
     changes.push({
       path: `${MIGRATIONS_DIR2}/${name}`,
       action: "create",
-      summary: findExistingMigration(input.migrations, LEGACY_META_SUFFIX) ? "exposify_meta() update: it also reports the authenticated role's grants" : "exposify_meta() migration",
+      summary: findExistingMigration(input.migrations, LEGACY_META_SUFFIX) || findExistingMigration(input.migrations, META_SUFFIX_V2) ? "exposify_meta() update: it also reports identity and generated columns" : "exposify_meta() migration",
       content: input.metaMigrationSql,
       effect: "push"
     });

package/dist/index.cjs

@@ -258,6 +258,10 @@ function columnsFromOpenApi(doc, table) {
     type: TYPE_MAP[prop.type ?? "string"] ?? "string",
     format: prop.format,
     required: required.has(name),
+    // A column with a DEFAULT doesn't have to be supplied on insert even when
+    // it's NOT NULL (the database fills it in). identity/generated aren't in
+    // PostgREST's OpenAPI -- introspect.ts adds those from exposify_meta().
+    hasDefault: prop.default !== void 0,
     isPrimaryKey: isPrimaryKey(prop),
     // Falls back to the OpenAPI-embedded comment (PostgREST mirrors `COMMENT
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
@@ -302,7 +306,13 @@ function introspectTables(openapi, metaRows) {
         ...fromOpenApi,
         // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
-        description: row.column_comment ?? fromOpenApi.description
+        description: row.column_comment ?? fromOpenApi.description,
+        // identity/generated aren't in PostgREST's OpenAPI; they come from
+        // exposify_meta() (the `_v3` migration). Absent on the older function,
+        // leaving these unset -- the insert/update shapes then fall back to
+        // defaults alone, which is the pre-fix behaviour.
+        ...row.identity_kind ? { identity: row.identity_kind } : {},
+        ...row.is_generated === true ? { generated: true } : {}
       });
     }
     if (columns.length === 0) continue;
@@ -527,11 +537,16 @@ function registerQueryTool(server, table, client, cfg, taken) {
     }
   );
 }
+function isDatabaseGenerated(col) {
+  return col.identity === "always" || col.generated === true;
+}
 function insertBodyShape(columns) {
   const shape = {};
   for (const col of columns) {
+    if (isDatabaseGenerated(col)) continue;
     let field = columnToZod(col);
-    if (!col.required) field = field.optional();
+    const databaseFillsIn = col.hasDefault === true || col.identity === "default";
+    if (!col.required || databaseFillsIn) field = field.optional();
     shape[col.name] = field;
   }
   return shape;
@@ -582,7 +597,10 @@ function keyFilterShape(table, verb) {
 function registerUpdateTool(server, table, client, taken) {
   const name = toolName("update", table.name, taken);
   const setShape = {};
-  for (const col of table.columns) setShape[col.name] = columnToZod(col).optional();
+  for (const col of table.columns) {
+    if (isDatabaseGenerated(col)) continue;
+    setShape[col.name] = columnToZod(col).optional();
+  }
   const keys = keyColumns(table);
   server.registerTool(
     name,

package/dist/index.d.cts

@@ -7,7 +7,19 @@ interface ColumnSchema {
     type: ColumnType;
     /** OpenAPI `format`, e.g. "uuid", "timestamp with time zone", "bigint". */
     format?: string;
+    /** NOT NULL per PostgREST's OpenAPI `required`. Whether it must be *given* on insert is a separate question -- see `hasDefault`/`identity` and server.ts's `insertBodyShape`. */
     required: boolean;
+    /** The OpenAPI property carried a `default`, so the database fills the column in when it's omitted -- optional on insert even when NOT NULL. */
+    hasDefault?: boolean;
+    /**
+     * An identity column (`GENERATED ... AS IDENTITY`), from `exposify_meta()`.
+     * `"always"` rejects any supplied value (left out of insert/update entirely);
+     * `"default"` is accepted but optional. Absent on a non-identity column, and
+     * on every column when the database still has the pre-identity `exposify_meta()`.
+     */
+    identity?: "always" | "default";
+    /** A generated column (`GENERATED ALWAYS AS (...) STORED`), from `exposify_meta()`: the database computes it, so it's left out of insert/update. */
+    generated?: boolean;
     /** From `exposify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
     description?: string;
     isPrimaryKey?: boolean;
@@ -43,6 +55,10 @@ interface MetaRow {
     can_insert?: boolean;
     can_update?: boolean;
     can_delete?: boolean;
+    /** `pg_attribute.attidentity` mapped: `"always"` ('a'), `"default"` ('d'), or null/absent. Absent before the `_v3` migration. */
+    identity_kind?: "always" | "default" | null;
+    /** `pg_attribute.attgenerated <> ''` -- a generated (stored) column. Absent before the `_v3` migration. */
+    is_generated?: boolean;
 }
 /** Registered sibling edge function exposed as a tool. */
 interface FunctionToolConfig {
@@ -189,6 +205,8 @@ interface PostgrestColumnProperty {
     type?: string;
     format?: string;
     description?: string;
+    /** PostgREST emits the column's `DEFAULT` expression here (e.g. `"now()"`, `"auth.uid()"`) when it has one. We only care whether it's present. */
+    default?: unknown;
 }
 /**
  * Extracts column schemas for one table from a PostgREST OpenAPI document.

package/dist/index.d.ts

@@ -7,7 +7,19 @@ interface ColumnSchema {
     type: ColumnType;
     /** OpenAPI `format`, e.g. "uuid", "timestamp with time zone", "bigint". */
     format?: string;
+    /** NOT NULL per PostgREST's OpenAPI `required`. Whether it must be *given* on insert is a separate question -- see `hasDefault`/`identity` and server.ts's `insertBodyShape`. */
     required: boolean;
+    /** The OpenAPI property carried a `default`, so the database fills the column in when it's omitted -- optional on insert even when NOT NULL. */
+    hasDefault?: boolean;
+    /**
+     * An identity column (`GENERATED ... AS IDENTITY`), from `exposify_meta()`.
+     * `"always"` rejects any supplied value (left out of insert/update entirely);
+     * `"default"` is accepted but optional. Absent on a non-identity column, and
+     * on every column when the database still has the pre-identity `exposify_meta()`.
+     */
+    identity?: "always" | "default";
+    /** A generated column (`GENERATED ALWAYS AS (...) STORED`), from `exposify_meta()`: the database computes it, so it's left out of insert/update. */
+    generated?: boolean;
     /** From `exposify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
     description?: string;
     isPrimaryKey?: boolean;
@@ -43,6 +55,10 @@ interface MetaRow {
     can_insert?: boolean;
     can_update?: boolean;
     can_delete?: boolean;
+    /** `pg_attribute.attidentity` mapped: `"always"` ('a'), `"default"` ('d'), or null/absent. Absent before the `_v3` migration. */
+    identity_kind?: "always" | "default" | null;
+    /** `pg_attribute.attgenerated <> ''` -- a generated (stored) column. Absent before the `_v3` migration. */
+    is_generated?: boolean;
 }
 /** Registered sibling edge function exposed as a tool. */
 interface FunctionToolConfig {
@@ -189,6 +205,8 @@ interface PostgrestColumnProperty {
     type?: string;
     format?: string;
     description?: string;
+    /** PostgREST emits the column's `DEFAULT` expression here (e.g. `"now()"`, `"auth.uid()"`) when it has one. We only care whether it's present. */
+    default?: unknown;
 }
 /**
  * Extracts column schemas for one table from a PostgREST OpenAPI document.

package/dist/index.js

@@ -221,6 +221,10 @@ function columnsFromOpenApi(doc, table) {
     type: TYPE_MAP[prop.type ?? "string"] ?? "string",
     format: prop.format,
     required: required.has(name),
+    // A column with a DEFAULT doesn't have to be supplied on insert even when
+    // it's NOT NULL (the database fills it in). identity/generated aren't in
+    // PostgREST's OpenAPI -- introspect.ts adds those from exposify_meta().
+    hasDefault: prop.default !== void 0,
     isPrimaryKey: isPrimaryKey(prop),
     // Falls back to the OpenAPI-embedded comment (PostgREST mirrors `COMMENT
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
@@ -265,7 +269,13 @@ function introspectTables(openapi, metaRows) {
         ...fromOpenApi,
         // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
-        description: row.column_comment ?? fromOpenApi.description
+        description: row.column_comment ?? fromOpenApi.description,
+        // identity/generated aren't in PostgREST's OpenAPI; they come from
+        // exposify_meta() (the `_v3` migration). Absent on the older function,
+        // leaving these unset -- the insert/update shapes then fall back to
+        // defaults alone, which is the pre-fix behaviour.
+        ...row.identity_kind ? { identity: row.identity_kind } : {},
+        ...row.is_generated === true ? { generated: true } : {}
       });
     }
     if (columns.length === 0) continue;
@@ -494,11 +504,16 @@ function registerQueryTool(server, table, client, cfg, taken) {
     }
   );
 }
+function isDatabaseGenerated(col) {
+  return col.identity === "always" || col.generated === true;
+}
 function insertBodyShape(columns) {
   const shape = {};
   for (const col of columns) {
+    if (isDatabaseGenerated(col)) continue;
     let field = columnToZod(col);
-    if (!col.required) field = field.optional();
+    const databaseFillsIn = col.hasDefault === true || col.identity === "default";
+    if (!col.required || databaseFillsIn) field = field.optional();
     shape[col.name] = field;
   }
   return shape;
@@ -549,7 +564,10 @@ function keyFilterShape(table, verb) {
 function registerUpdateTool(server, table, client, taken) {
   const name = toolName("update", table.name, taken);
   const setShape = {};
-  for (const col of table.columns) setShape[col.name] = columnToZod(col).optional();
+  for (const col of table.columns) {
+    if (isDatabaseGenerated(col)) continue;
+    setShape[col.name] = columnToZod(col).optional();
+  }
   const keys = keyColumns(table);
   server.registerTool(
     name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.17",
+    "@exposify/core": "0.3.18",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },

package/sql/exposify_meta.sql

@@ -28,6 +28,12 @@
 -- The grant columns were added later, as a new migration
 -- (`<timestamp>_exposify_meta_v2.sql`): adding output columns changes the
 -- function's return type, which `create or replace` can't do, hence the drop.
+-- The `identity_kind`/`is_generated` columns were added later still, as a
+-- third migration (`<timestamp>_exposify_meta_v3.sql`), for the same reason:
+-- they tell the insert/update tools which columns the database computes
+-- itself (an identity or generated column) so they aren't demanded or even
+-- offered -- otherwise `insert_<table>` asks for a `generated always as
+-- identity` primary key and PostgREST rejects any value for it.
 drop function if exists public.exposify_meta();
 create function public.exposify_meta()
 returns table (
@@ -39,7 +45,9 @@ returns table (
   can_select boolean,
   can_insert boolean,
   can_update boolean,
-  can_delete boolean
+  can_delete boolean,
+  identity_kind text,
+  is_generated boolean
 )
 language sql
 security definer
@@ -55,7 +63,11 @@ as $$
     has_any_column_privilege('authenticated', c.oid, 'SELECT') as can_select,
     has_any_column_privilege('authenticated', c.oid, 'INSERT') as can_insert,
     has_any_column_privilege('authenticated', c.oid, 'UPDATE') as can_update,
-    has_table_privilege('authenticated', c.oid, 'DELETE') as can_delete
+    has_table_privilege('authenticated', c.oid, 'DELETE') as can_delete,
+    -- 'a' = GENERATED ALWAYS AS IDENTITY, 'd' = ... BY DEFAULT, '' = not an identity column.
+    case a.attidentity when 'a' then 'always' when 'd' then 'default' else null end as identity_kind,
+    -- 's' = GENERATED ALWAYS AS (...) STORED; '' = ordinary column.
+    (a.attgenerated <> '') as is_generated
   from pg_catalog.pg_class c
   join pg_catalog.pg_namespace n on n.oid = c.relnamespace
   join pg_catalog.pg_attribute a on a.attrelid = c.oid