@exposify/supabase 0.3.13 → 0.3.15

package/README.md

@@ -1,4 +1,4 @@
-# @exposify/supabase — setup guide
+# @exposify/supabase
 
 Make a Supabase-backed app's database and edge functions usable by AI agents:
 one edge function serves MCP, with tools generated from your database
@@ -7,9 +7,42 @@ register. The caller's JWT passes straight through to PostgREST — **RLS is
 the authorization layer**. The agent can do exactly what that logged-in user
 can do, nothing more.
 
-This guide walks through setup end to end. For the design rationale, see
-`docs/superpowers/specs/2026-08-15-agentify-supabase-design.md` in the repo
-root.
+> **Which package?** Use **`@exposify/supabase`** when you want an MCP
+> endpoint served straight from a Supabase **edge function** over PostgREST,
+> with RLS as the authorization layer. If you have a **Next.js app** (even one
+> whose users sign in with Supabase Auth), use
+> [**`@exposify/next`**](https://github.com/ayadagain/agentready/tree/main/packages/next)
+> instead, so tool calls run through your Next server and your own middleware
+> and checks apply.
+
+## Quickstart
+
+From your Supabase project's root (the directory containing `supabase/`):
+
+```bash
+npx @exposify/supabase init          # scaffold the migration + mcp function
+supabase db push                      # apply the exposify_meta() migration
+supabase functions deploy mcp         # deploy the MCP edge function
+```
+
+Then point an MCP client at the function's URL with a user's JWT — e.g. with
+the Claude Code CLI:
+
+```bash
+claude mcp add --transport http my-app \
+  https://<project-ref>.supabase.co/functions/v1/mcp \
+  --header "Authorization: Bearer <user-jwt>"
+```
+
+Every RLS-enabled table you can `SELECT` becomes a `query_<table>` tool
+automatically; writes and RPCs are opt-in. `init` is interactive and can run
+`db push`/`functions deploy` for you, wire in the hosted broker or Supabase
+Auth OAuth (so clients sign in by themselves instead of pasting an hourly
+JWT), and write tool descriptions from your SQL comments — see the sections
+below. Check the whole setup any time with `npx @exposify/supabase doctor`.
+
+The rest of this guide is reference, end to end. For the design rationale, see
+the [design spec](https://github.com/ayadagain/agentready/blob/main/docs/superpowers/specs/2026-08-15-agentify-supabase-design.md).
 
 ## Prerequisites
 
@@ -28,15 +61,18 @@ npx @exposify/supabase init
 
 This is safe to re-run; see "Re-running `init`" below. It writes:
 
-- `supabase/migrations/<timestamp>_exposify_meta_v2.sql` — a SQL migration that
+- `supabase/migrations/<timestamp>_exposify_meta_v3.sql` — a SQL migration that
   adds `exposify_meta()`, a `SECURITY DEFINER` function returning, per table,
   whether RLS is enabled, what the `authenticated` role is granted on it
-  (select/insert/update/delete), and any `COMMENT ON TABLE`/`COMMENT ON COLUMN` text
-  you've written. It only ever returns catalog metadata (table/column names,
-  flags, comments) — never row data — which is what makes it safe to grant
-  to `anon`/`authenticated` and call with a low-privilege key. A project with
-  the older `<timestamp>_exposify_meta.sql` (no grants) gets the `_v2` one on
-  the next `init`, which replaces the function.
+  (select/insert/update/delete), whether each column is an identity or
+  generated column (so `insert_<table>` doesn't ask for a `generated always as
+  identity` key the database rejects), and any `COMMENT ON TABLE`/`COMMENT ON
+  COLUMN` text you've written. It only ever returns catalog metadata
+  (table/column names, flags, comments) — never row data — which is what makes
+  it safe to grant to `anon`/`authenticated` and call with a low-privilege key.
+  A project on an older migration (`_exposify_meta.sql` with no grants, or
+  `_exposify_meta_v2.sql` with no identity/generated columns) gets the `_v3`
+  one on the next `init`, which replaces the function.
 - `supabase/functions/mcp/index.ts` — the edge function itself. `init` owns
   the part between `// exposify:begin` and `// exposify:end` (imports and a
   `generated` options object). Everything after that is yours, starting with
@@ -196,7 +232,7 @@ things:
 Until the project has a sign-in method (the Supabase preset in the
 dashboard), agents use the function signed out, as `anon`, with no sign-in
 asked: there's nothing to sign in with. The log says which it is
-(`[agentready] How agents sign in: ...`), and adding the method takes effect
+(`[exposify] How agents sign in: ...`), and adding the method takes effect
 within a minute.
 
 MCP clients then click Connect and sign in through the broker (or send a
@@ -252,6 +288,12 @@ Deno.serve(aiReady({
 ```
 
 Notes:
+- `insert_<table>` takes a `body` with one field per column, but only the
+  columns the caller actually supplies: a column with a `DEFAULT` or a `BY
+  DEFAULT` identity is optional (the database fills it in), and a `GENERATED
+  ALWAYS AS IDENTITY` column or a generated column is left out entirely (the
+  database computes it and rejects any value). So a table whose only
+  caller-supplied column is `body` is inserted with just `{ "body": "..." }`.
 - `update_<table>` and `delete_<table>` change one row: the filter must
   include `eq` on every primary-key column (more filters only narrow it).
   A filter that happens to match everything (`id neq -1`, `item like %`) is
@@ -357,9 +399,9 @@ exits 1 if anything failed, so you can run it in CI.
   readable. It lists which tables became tools, and warns about tables that
   never will: RLS off, or RLS on but no `SELECT` for `authenticated` (with the
   `grant` to run). It warns about writes in the function's config the role
-  isn't granted, about the older `exposify_meta()` that doesn't report
-  grants, and about tables whose missing comments leave tools with thin
-  descriptions.
+  isn't granted, about an older `exposify_meta()` that doesn't report
+  grants or identity/generated columns, and about tables whose missing
+  comments leave tools with thin descriptions.
 - **Deployed function:** speaks MCP to `<project>/functions/v1/mcp`
   (`initialize`, then `tools/list`) and reports the tool count. If the
   function registered `exposify://diagnostics`, which it only does when
@@ -481,7 +523,7 @@ Supabase user JWTs expire (default 1h) and their refresh tokens rotate; a plain
 MCP client can hold a bearer token but can't refresh it. Exposify's hosted
 broker holds each user's session, refreshes it, and swaps the agent's
 long-lived connection token (`extb_...`) for a live Supabase JWT on every
-call ([`docs/hosted-broker.md`](../../docs/hosted-broker.md)). `init` sets it
+call (see the [hosted broker guide](https://github.com/ayadagain/agentready/blob/main/docs/hosted-broker.md)). `init` sets it
 up (see "Using the hosted broker" above); by hand:
 
 ```sh
@@ -580,7 +622,7 @@ the function prints whether MCP is up. It shows in `supabase functions serve`
 locally and in the function's logs in production:
 
 ```
-[@exposify/supabase] MCP ready at https://<ref>.supabase.co/functions/v1/mcp: 9 tools (5 query, 2 write, 1 rpc, search_docs), 3 docs indexed, auth: passthrough (caller's JWT)
+[exposify] MCP ready at https://<ref>.supabase.co/functions/v1/mcp: 9 tools (5 query, 2 write, 1 rpc, search_docs), 3 docs indexed, auth: passthrough (caller's JWT)
 ```
 
 - **Manifest fallback:** the same line, marked "from the bundled manifest",

package/dist/cli.js

@@ -76,6 +76,10 @@ function columnsFromOpenApi(doc, table) {
     type: TYPE_MAP[prop.type ?? "string"] ?? "string",
     format: prop.format,
     required: required.has(name),
+    // A column with a DEFAULT doesn't have to be supplied on insert even when
+    // it's NOT NULL (the database fills it in). identity/generated aren't in
+    // PostgREST's OpenAPI -- introspect.ts adds those from exposify_meta().
+    hasDefault: prop.default !== void 0,
     isPrimaryKey: isPrimaryKey(prop),
     // Falls back to the OpenAPI-embedded comment (PostgREST mirrors `COMMENT
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
@@ -110,7 +114,13 @@ function introspectTables(openapi, metaRows) {
         ...fromOpenApi,
         // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
-        description: row.column_comment ?? fromOpenApi.description
+        description: row.column_comment ?? fromOpenApi.description,
+        // identity/generated aren't in PostgREST's OpenAPI; they come from
+        // exposify_meta() (the `_v3` migration). Absent on the older function,
+        // leaving these unset -- the insert/update shapes then fall back to
+        // defaults alone, which is the pre-fix behaviour.
+        ...row.identity_kind ? { identity: row.identity_kind } : {},
+        ...row.is_generated === true ? { generated: true } : {}
       });
     }
     if (columns.length === 0) continue;
@@ -569,7 +579,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[@exposify/supabase] ${message}`);
+    console.warn(`[exposify] ${message}`);
   } catch {
   }
 }
@@ -741,14 +751,14 @@ async function runDoctor(deps) {
   sections.push({ title: "Project", checks: project });
   const files = [];
   const migrations = await deps.listDir(MIGRATIONS_DIR);
-  const migration = findExistingMigration(migrations, "_exposify_meta_v2.sql");
-  const legacyMigration = findExistingMigration(migrations, "_exposify_meta.sql");
+  const migration = findExistingMigration(migrations, "_exposify_meta_v3.sql");
+  const legacyMigration = findExistingMigration(migrations, "_exposify_meta_v2.sql") || findExistingMigration(migrations, "_exposify_meta.sql");
   files.push(
     migration ? { status: "pass", message: `migration ${MIGRATIONS_DIR}/${migration}` } : legacyMigration ? {
       status: "warn",
-      message: `migration ${MIGRATIONS_DIR}/${legacyMigration} is the older exposify_meta(), which doesn't report grants`,
-      fix: "npx @exposify/supabase init (it adds *_exposify_meta_v2.sql), then supabase db push"
-    } : { status: "fail", message: "no *_exposify_meta_v2.sql migration", fix: "npx @exposify/supabase init" }
+      message: `migration ${MIGRATIONS_DIR}/${legacyMigration} is an older exposify_meta(), which doesn't report identity/generated columns`,
+      fix: "npx @exposify/supabase init (it adds *_exposify_meta_v3.sql), then supabase db push"
+    } : { status: "fail", message: "no *_exposify_meta_v3.sql migration", fix: "npx @exposify/supabase init" }
   );
   const functionSource = await deps.readText(FUNCTION_PATH);
   const authMode = functionSource === null ? null : detectAuthMode(functionSource);
@@ -1000,7 +1010,8 @@ var FUNCTION_DIR = "supabase/functions/mcp";
 var FUNCTION_PATH2 = `${FUNCTION_DIR}/index.ts`;
 var MIGRATIONS_DIR2 = "supabase/migrations";
 var CONFIG_TOML2 = "supabase/config.toml";
-var META_SUFFIX = "_exposify_meta_v2.sql";
+var META_SUFFIX = "_exposify_meta_v3.sql";
+var META_SUFFIX_V2 = "_exposify_meta_v2.sql";
 var LEGACY_META_SUFFIX = "_exposify_meta.sql";
 var COMMENTS_SUFFIX = "_exposify_comments.sql";
 function authLabel(config) {
@@ -1036,7 +1047,7 @@ function planInit(input) {
     changes.push({
       path: `${MIGRATIONS_DIR2}/${name}`,
       action: "create",
-      summary: findExistingMigration(input.migrations, LEGACY_META_SUFFIX) ? "exposify_meta() update: it also reports the authenticated role's grants" : "exposify_meta() migration",
+      summary: findExistingMigration(input.migrations, LEGACY_META_SUFFIX) || findExistingMigration(input.migrations, META_SUFFIX_V2) ? "exposify_meta() update: it also reports identity and generated columns" : "exposify_meta() migration",
       content: input.metaMigrationSql,
       effect: "push"
     });

package/dist/index.cjs

@@ -107,7 +107,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[@exposify/supabase] ${message}`);
+    console.warn(`[exposify] ${message}`);
   } catch {
   }
 }
@@ -258,6 +258,10 @@ function columnsFromOpenApi(doc, table) {
     type: TYPE_MAP[prop.type ?? "string"] ?? "string",
     format: prop.format,
     required: required.has(name),
+    // A column with a DEFAULT doesn't have to be supplied on insert even when
+    // it's NOT NULL (the database fills it in). identity/generated aren't in
+    // PostgREST's OpenAPI -- introspect.ts adds those from exposify_meta().
+    hasDefault: prop.default !== void 0,
     isPrimaryKey: isPrimaryKey(prop),
     // Falls back to the OpenAPI-embedded comment (PostgREST mirrors `COMMENT
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
@@ -302,7 +306,13 @@ function introspectTables(openapi, metaRows) {
         ...fromOpenApi,
         // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
-        description: row.column_comment ?? fromOpenApi.description
+        description: row.column_comment ?? fromOpenApi.description,
+        // identity/generated aren't in PostgREST's OpenAPI; they come from
+        // exposify_meta() (the `_v3` migration). Absent on the older function,
+        // leaving these unset -- the insert/update shapes then fall back to
+        // defaults alone, which is the pre-fix behaviour.
+        ...row.identity_kind ? { identity: row.identity_kind } : {},
+        ...row.is_generated === true ? { generated: true } : {}
       });
     }
     if (columns.length === 0) continue;
@@ -527,11 +537,16 @@ function registerQueryTool(server, table, client, cfg, taken) {
     }
   );
 }
+function isDatabaseGenerated(col) {
+  return col.identity === "always" || col.generated === true;
+}
 function insertBodyShape(columns) {
   const shape = {};
   for (const col of columns) {
+    if (isDatabaseGenerated(col)) continue;
     let field = columnToZod(col);
-    if (!col.required) field = field.optional();
+    const databaseFillsIn = col.hasDefault === true || col.identity === "default";
+    if (!col.required || databaseFillsIn) field = field.optional();
     shape[col.name] = field;
   }
   return shape;
@@ -582,7 +597,10 @@ function keyFilterShape(table, verb) {
 function registerUpdateTool(server, table, client, taken) {
   const name = toolName("update", table.name, taken);
   const setShape = {};
-  for (const col of table.columns) setShape[col.name] = columnToZod(col).optional();
+  for (const col of table.columns) {
+    if (isDatabaseGenerated(col)) continue;
+    setShape[col.name] = columnToZod(col).optional();
+  }
   const keys = keyColumns(table);
   server.registerTool(
     name,
@@ -737,7 +755,7 @@ function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
 
 // src/startup.ts
 var import_core4 = require("@exposify/core");
-var LOG_PREFIX = "[@exposify/supabase]";
+var LOG_PREFIX = "[exposify]";
 var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `npx @exposify/supabase generate`";
 function supabaseToolsPhrase(ladder, cfg, hasDocs) {
   const query = ladder.tables.length;
@@ -856,7 +874,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[@exposify/supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[exposify] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });

package/dist/index.d.cts

@@ -7,7 +7,19 @@ interface ColumnSchema {
     type: ColumnType;
     /** OpenAPI `format`, e.g. "uuid", "timestamp with time zone", "bigint". */
     format?: string;
+    /** NOT NULL per PostgREST's OpenAPI `required`. Whether it must be *given* on insert is a separate question -- see `hasDefault`/`identity` and server.ts's `insertBodyShape`. */
     required: boolean;
+    /** The OpenAPI property carried a `default`, so the database fills the column in when it's omitted -- optional on insert even when NOT NULL. */
+    hasDefault?: boolean;
+    /**
+     * An identity column (`GENERATED ... AS IDENTITY`), from `exposify_meta()`.
+     * `"always"` rejects any supplied value (left out of insert/update entirely);
+     * `"default"` is accepted but optional. Absent on a non-identity column, and
+     * on every column when the database still has the pre-identity `exposify_meta()`.
+     */
+    identity?: "always" | "default";
+    /** A generated column (`GENERATED ALWAYS AS (...) STORED`), from `exposify_meta()`: the database computes it, so it's left out of insert/update. */
+    generated?: boolean;
     /** From `exposify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
     description?: string;
     isPrimaryKey?: boolean;
@@ -43,6 +55,10 @@ interface MetaRow {
     can_insert?: boolean;
     can_update?: boolean;
     can_delete?: boolean;
+    /** `pg_attribute.attidentity` mapped: `"always"` ('a'), `"default"` ('d'), or null/absent. Absent before the `_v3` migration. */
+    identity_kind?: "always" | "default" | null;
+    /** `pg_attribute.attgenerated <> ''` -- a generated (stored) column. Absent before the `_v3` migration. */
+    is_generated?: boolean;
 }
 /** Registered sibling edge function exposed as a tool. */
 interface FunctionToolConfig {
@@ -189,6 +205,8 @@ interface PostgrestColumnProperty {
     type?: string;
     format?: string;
     description?: string;
+    /** PostgREST emits the column's `DEFAULT` expression here (e.g. `"now()"`, `"auth.uid()"`) when it has one. We only care whether it's present. */
+    default?: unknown;
 }
 /**
  * Extracts column schemas for one table from a PostgREST OpenAPI document.

package/dist/index.d.ts

@@ -7,7 +7,19 @@ interface ColumnSchema {
     type: ColumnType;
     /** OpenAPI `format`, e.g. "uuid", "timestamp with time zone", "bigint". */
     format?: string;
+    /** NOT NULL per PostgREST's OpenAPI `required`. Whether it must be *given* on insert is a separate question -- see `hasDefault`/`identity` and server.ts's `insertBodyShape`. */
     required: boolean;
+    /** The OpenAPI property carried a `default`, so the database fills the column in when it's omitted -- optional on insert even when NOT NULL. */
+    hasDefault?: boolean;
+    /**
+     * An identity column (`GENERATED ... AS IDENTITY`), from `exposify_meta()`.
+     * `"always"` rejects any supplied value (left out of insert/update entirely);
+     * `"default"` is accepted but optional. Absent on a non-identity column, and
+     * on every column when the database still has the pre-identity `exposify_meta()`.
+     */
+    identity?: "always" | "default";
+    /** A generated column (`GENERATED ALWAYS AS (...) STORED`), from `exposify_meta()`: the database computes it, so it's left out of insert/update. */
+    generated?: boolean;
     /** From `exposify_meta()`'s `column_comment` (a `COMMENT ON COLUMN`), not OpenAPI. */
     description?: string;
     isPrimaryKey?: boolean;
@@ -43,6 +55,10 @@ interface MetaRow {
     can_insert?: boolean;
     can_update?: boolean;
     can_delete?: boolean;
+    /** `pg_attribute.attidentity` mapped: `"always"` ('a'), `"default"` ('d'), or null/absent. Absent before the `_v3` migration. */
+    identity_kind?: "always" | "default" | null;
+    /** `pg_attribute.attgenerated <> ''` -- a generated (stored) column. Absent before the `_v3` migration. */
+    is_generated?: boolean;
 }
 /** Registered sibling edge function exposed as a tool. */
 interface FunctionToolConfig {
@@ -189,6 +205,8 @@ interface PostgrestColumnProperty {
     type?: string;
     format?: string;
     description?: string;
+    /** PostgREST emits the column's `DEFAULT` expression here (e.g. `"now()"`, `"auth.uid()"`) when it has one. We only care whether it's present. */
+    default?: unknown;
 }
 /**
  * Extracts column schemas for one table from a PostgREST OpenAPI document.

package/dist/index.js

@@ -70,7 +70,7 @@ function warnOnce(message) {
   if (warned.has(message)) return;
   warned.add(message);
   try {
-    console.warn(`[@exposify/supabase] ${message}`);
+    console.warn(`[exposify] ${message}`);
   } catch {
   }
 }
@@ -221,6 +221,10 @@ function columnsFromOpenApi(doc, table) {
     type: TYPE_MAP[prop.type ?? "string"] ?? "string",
     format: prop.format,
     required: required.has(name),
+    // A column with a DEFAULT doesn't have to be supplied on insert even when
+    // it's NOT NULL (the database fills it in). identity/generated aren't in
+    // PostgREST's OpenAPI -- introspect.ts adds those from exposify_meta().
+    hasDefault: prop.default !== void 0,
     isPrimaryKey: isPrimaryKey(prop),
     // Falls back to the OpenAPI-embedded comment (PostgREST mirrors `COMMENT
     // ON COLUMN` into `description`, then appends its own "Note:\nThis is a
@@ -265,7 +269,13 @@ function introspectTables(openapi, metaRows) {
         ...fromOpenApi,
         // exposify_meta()'s comment wins over OpenAPI's mirrored copy (spec:
         // "Column comments → param descriptions" sourced from the migration).
-        description: row.column_comment ?? fromOpenApi.description
+        description: row.column_comment ?? fromOpenApi.description,
+        // identity/generated aren't in PostgREST's OpenAPI; they come from
+        // exposify_meta() (the `_v3` migration). Absent on the older function,
+        // leaving these unset -- the insert/update shapes then fall back to
+        // defaults alone, which is the pre-fix behaviour.
+        ...row.identity_kind ? { identity: row.identity_kind } : {},
+        ...row.is_generated === true ? { generated: true } : {}
       });
     }
     if (columns.length === 0) continue;
@@ -494,11 +504,16 @@ function registerQueryTool(server, table, client, cfg, taken) {
     }
   );
 }
+function isDatabaseGenerated(col) {
+  return col.identity === "always" || col.generated === true;
+}
 function insertBodyShape(columns) {
   const shape = {};
   for (const col of columns) {
+    if (isDatabaseGenerated(col)) continue;
     let field = columnToZod(col);
-    if (!col.required) field = field.optional();
+    const databaseFillsIn = col.hasDefault === true || col.identity === "default";
+    if (!col.required || databaseFillsIn) field = field.optional();
     shape[col.name] = field;
   }
   return shape;
@@ -549,7 +564,10 @@ function keyFilterShape(table, verb) {
 function registerUpdateTool(server, table, client, taken) {
   const name = toolName("update", table.name, taken);
   const setShape = {};
-  for (const col of table.columns) setShape[col.name] = columnToZod(col).optional();
+  for (const col of table.columns) {
+    if (isDatabaseGenerated(col)) continue;
+    setShape[col.name] = columnToZod(col).optional();
+  }
   const keys = keyColumns(table);
   server.registerTool(
     name,
@@ -704,7 +722,7 @@ function createSupabaseOAuthGate(oauth, supabaseUrl, fetchImpl) {
 
 // src/startup.ts
 import { formatFailed, formatReady, formatWarning } from "@exposify/core";
-var LOG_PREFIX = "[@exposify/supabase]";
+var LOG_PREFIX = "[exposify]";
 var INTROSPECTION_FIX = "check that SUPABASE_SERVICE_ROLE_KEY is available to the function and the exposify_meta migration is applied (`supabase db push`); the reason is logged above. To survive this, bundle a manifest with `npx @exposify/supabase generate`";
 function supabaseToolsPhrase(ladder, cfg, hasDocs) {
   const query = ladder.tables.length;
@@ -823,7 +841,7 @@ function aiReady(options = {}) {
       manifest: options.manifest
     }).then((ladder) => {
       for (const w of ladder.warnings) {
-        console.error(`[@exposify/supabase] degradation ladder: ${w.rung}: ${w.reason}`);
+        console.error(`[exposify] degradation ladder: ${w.rung}: ${w.reason}`);
       }
       return ladder;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.17",
+    "@exposify/core": "0.3.19",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },

package/sql/exposify_meta.sql

@@ -28,6 +28,12 @@
 -- The grant columns were added later, as a new migration
 -- (`<timestamp>_exposify_meta_v2.sql`): adding output columns changes the
 -- function's return type, which `create or replace` can't do, hence the drop.
+-- The `identity_kind`/`is_generated` columns were added later still, as a
+-- third migration (`<timestamp>_exposify_meta_v3.sql`), for the same reason:
+-- they tell the insert/update tools which columns the database computes
+-- itself (an identity or generated column) so they aren't demanded or even
+-- offered -- otherwise `insert_<table>` asks for a `generated always as
+-- identity` primary key and PostgREST rejects any value for it.
 drop function if exists public.exposify_meta();
 create function public.exposify_meta()
 returns table (
@@ -39,7 +45,9 @@ returns table (
   can_select boolean,
   can_insert boolean,
   can_update boolean,
-  can_delete boolean
+  can_delete boolean,
+  identity_kind text,
+  is_generated boolean
 )
 language sql
 security definer
@@ -55,7 +63,11 @@ as $$
     has_any_column_privilege('authenticated', c.oid, 'SELECT') as can_select,
     has_any_column_privilege('authenticated', c.oid, 'INSERT') as can_insert,
     has_any_column_privilege('authenticated', c.oid, 'UPDATE') as can_update,
-    has_table_privilege('authenticated', c.oid, 'DELETE') as can_delete
+    has_table_privilege('authenticated', c.oid, 'DELETE') as can_delete,
+    -- 'a' = GENERATED ALWAYS AS IDENTITY, 'd' = ... BY DEFAULT, '' = not an identity column.
+    case a.attidentity when 'a' then 'always' when 'd' then 'default' else null end as identity_kind,
+    -- 's' = GENERATED ALWAYS AS (...) STORED; '' = ordinary column.
+    (a.attgenerated <> '') as is_generated
   from pg_catalog.pg_class c
   join pg_catalog.pg_namespace n on n.oid = c.relnamespace
   join pg_catalog.pg_attribute a on a.attrelid = c.oid