@exposify/supabase 0.3.6 → 0.3.7

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Ali
+Copyright (c) 2026 Exposify
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -110,6 +110,43 @@ note on introspection below) — without those, `init` can't reach anything to
 introspect and falls back to the fixed scaffold-and-ask-to-deploy flow above,
 same as before this wizard existed.
 
+### Using the hosted broker
+
+If you use the Exposify hosted broker (the dashboard's "Hosted broker" card),
+`init` asks first:
+
+```
+Use the Exposify hosted broker for auth (MCP clients get a long-lived extb_... token instead of a Supabase JWT)? [y/N]
+```
+
+Or skip the question with `--broker-url <url> --broker-project <id>`
+(or `EXPOSIFY_BROKER_URL`/`EXPOSIFY_PROJECT_ID`), which also works
+non-interactively. Saying yes does three things:
+
+1. **Wires the resolver into the function.** Adds
+   `auth: createHostedAuthResolver({ brokerUrl, projectId, licenseKey })` and
+   `authRequired: true` to `aiReady()`. The license key is read from the
+   `EXPOSIFY_LICENSE_KEY` secret and is never written into the file. If
+   `index.ts` already exists, `init` prints the snippet for you to merge in
+   yourself.
+2. **Sets `verify_jwt = false` for `mcp` in `supabase/config.toml`.** An
+   `extb_...` token isn't a JWT, so with the gateway's check on, every request
+   fails with `{"code":"UNAUTHORIZED_ASYMMETRIC_JWT","message":"Invalid JWT"}`
+   before the function runs. The setting goes in config.toml and not just
+   on the deploy command line, because a later plain
+   `supabase functions deploy mcp` would otherwise turn the check back on.
+   With the gateway check off, `authRequired: true` is what rejects requests
+   that have no valid broker token. Otherwise those requests would run as
+   `anon`.
+3. **Deploys with `--no-verify-jwt`**, and adds
+   `supabase secrets set EXPOSIFY_LICENSE_KEY=...` to the printed steps.
+   `init` never sees the license key, so you set that secret yourself.
+   Until you do, every request gets a 401.
+
+MCP clients then send `Authorization: Bearer extb_...`. Don't give the client
+the JWT that `POST /resolve` returns. It's the short-lived Supabase token the
+function swaps in on each request, and it stops working when it expires.
+
 ## 2. Decide what's exposed
 
 **Every RLS-enabled table is automatically readable.** A table only shows up
@@ -253,6 +290,14 @@ Deno.serve(aiReady({ auth: broker.resolver, authRequired: true, writes: ["todos.
   failed refresh. By default the request then runs as the `anon` role (RLS
   decides). Set `authRequired: true` to answer `401` instead. Recommended.
 - A resolver that throws yields a 503.
+- **Turn off the gateway's JWT check for the function**
+  (`[functions.mcp] verify_jwt = false` in `supabase/config.toml`, or
+  `supabase functions deploy mcp --no-verify-jwt`). Otherwise Supabase
+  rejects the `extb_...` token as `Invalid JWT` before your code runs. With
+  the check off, `authRequired: true` stops being optional.
+- For the platform-hosted broker, use `createHostedAuthResolver` in place of
+  `broker.resolver`. `init` can set this up for you; see "Using the hosted
+  broker" above.
 
 **Deployment constraints** (not verified end to end, see HANDOVER):
 

package/dist/cli.js

@@ -198,6 +198,7 @@ function buildCommentStatements(entries) {
   return lines.length > 0 ? `${lines.join("\n")}
 ` : "";
 }
+var LICENSE_KEY_SECRET = "EXPOSIFY_LICENSE_KEY";
 var ANONYMOUS_SIGN_IN_WARNING = `// NOTE: this project has anonymous sign-in enabled. An anonymous Supabase
 // Auth session still gets role: authenticated (with an is_anonymous claim),
 // NOT role: anon -- so it passes any RLS policy scoped to "authenticated"
@@ -208,8 +209,20 @@ var ANONYMOUS_SIGN_IN_WARNING = `// NOTE: this project has anonymous sign-in ena
 function buildFunctionTemplate(opts = {}) {
   const lines = [];
   if (opts.anonymousSignIn) lines.push(ANONYMOUS_SIGN_IN_WARNING);
-  lines.push(`import { aiReady } from "npm:@exposify/supabase";`, "");
+  lines.push(`import { aiReady } from "npm:@exposify/supabase";`);
+  if (opts.broker) lines.push(`import { createHostedAuthResolver } from "npm:@exposify/token-broker";`);
+  lines.push("");
   lines.push("Deno.serve(aiReady({");
+  if (opts.broker) {
+    lines.push(
+      "  auth: createHostedAuthResolver({",
+      `    brokerUrl: ${JSON.stringify(opts.broker.brokerUrl)},`,
+      `    projectId: ${JSON.stringify(opts.broker.projectId)},`,
+      `    licenseKey: Deno.env.get(${JSON.stringify(LICENSE_KEY_SECRET)}) ?? "",`,
+      "  }),",
+      "  authRequired: true,"
+    );
+  }
   lines.push(
     opts.writes && opts.writes.length > 0 ? `  writes: ${JSON.stringify(opts.writes)},` : `  // writes: ["orders.insert", "orders.update"],`
   );
@@ -225,6 +238,50 @@ function buildFunctionTemplate(opts = {}) {
   );
   return lines.join("\n");
 }
+function brokerUrlProblem(brokerUrl) {
+  let url;
+  try {
+    url = new URL(brokerUrl);
+  } catch {
+    return `"${brokerUrl}" is not a valid URL.`;
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol === "https:" || url.protocol === "http:" && local) return null;
+  return `broker URL must be https (http is only allowed for localhost): ${brokerUrl}`;
+}
+function normalizeBrokerUrl(brokerUrl) {
+  return brokerUrl.trim().replace(/\/+$/, "");
+}
+function setFunctionVerifyJwtFalse(toml, name = "mcp") {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const header = new RegExp(`^\\s*\\[\\s*functions\\s*\\.\\s*("?)${escaped}\\1\\s*\\]\\s*(#.*)?$`);
+  const anyHeader = /^\s*\[/;
+  const verifyLine = /^(\s*)verify_jwt\s*=\s*([^#\s]*)(.*)$/;
+  const lines = toml.split("\n");
+  const start = lines.findIndex((l) => header.test(l));
+  if (start === -1) {
+    const sep = toml === "" || toml.endsWith("\n\n") ? "" : toml.endsWith("\n") ? "\n" : "\n\n";
+    return { toml: `${toml}${sep}[functions.${name}]
+verify_jwt = false
+`, changed: true };
+  }
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (anyHeader.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  for (let i = start + 1; i < end; i++) {
+    const m = lines[i].match(verifyLine);
+    if (!m) continue;
+    if (m[2] === "false") return { toml, changed: false };
+    lines[i] = `${m[1]}verify_jwt = false${m[3]}`;
+    return { toml: lines.join("\n"), changed: true };
+  }
+  lines.splice(start + 1, 0, "verify_jwt = false");
+  return { toml: lines.join("\n"), changed: true };
+}
 function findExistingMigration(filenames, suffix) {
   const matches = filenames.filter((f) => f.endsWith(suffix)).sort();
   return matches[0] ?? null;
@@ -249,6 +306,7 @@ function partialConnectionWarning(url, key) {
 var PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 var FUNCTION_DIR = "supabase/functions/mcp";
 var MIGRATIONS_DIR = "supabase/migrations";
+var CONFIG_TOML = "supabase/config.toml";
 var FETCH_TIMEOUT_MS = 1e4;
 function fetchWithTimeout(input, init) {
   return fetch(input, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
@@ -289,22 +347,39 @@ async function promptYesNo(rl, question, defaultYes = false) {
 async function promptText(rl, question) {
   return (await rl.question(question)).trim();
 }
+function deployArgs(broker) {
+  return ["functions", "deploy", "mcp", ...broker ? ["--no-verify-jwt"] : []];
+}
+function clientCredential(broker) {
+  return broker ? "a broker token (extb_..., minted by the hosted broker)" : "a user JWT";
+}
 function printManualCommands(opts = {}) {
+  const broker = opts.broker ?? null;
   console.log("\nRun these to finish setup:");
   const steps = [];
   if (!opts.alreadyPushed) steps.push("supabase db push");
-  if (!opts.alreadyDeployed) steps.push("supabase functions deploy mcp");
+  if (broker) steps.push(`supabase secrets set ${LICENSE_KEY_SECRET}=<your license key (expfy_...)>`);
+  if (!opts.alreadyDeployed) steps.push(`supabase ${deployArgs(broker).join(" ")}`);
   steps.forEach((cmd, i) => console.log(`  ${i + 1}. ${cmd}`));
-  console.log(`  ${steps.length + 1}. Paste the function URL + a user JWT into an MCP client.`);
+  console.log(`  ${steps.length + 1}. Paste the function URL + ${clientCredential(broker)} into an MCP client.`);
+}
+function printLicenseKeyReminder(broker) {
+  if (!broker) return;
+  console.log(
+    `
+If you haven't already: supabase secrets set ${LICENSE_KEY_SECRET}=<your license key (expfy_...)> -- until it's set, every request is rejected with 401.`
+  );
 }
-function pushAndDeploy() {
+function pushAndDeploy(broker) {
   let pushed = false;
   try {
     console.log("\n$ supabase db push");
     execFileSync("supabase", ["db", "push"], { stdio: "inherit" });
     pushed = true;
-    console.log("\n$ supabase functions deploy mcp");
-    execFileSync("supabase", ["functions", "deploy", "mcp"], { stdio: "inherit" });
+    const args = deployArgs(broker);
+    console.log(`
+$ supabase ${args.join(" ")}`);
+    execFileSync("supabase", args, { stdio: "inherit" });
     return { pushed: true, deployed: true };
   } catch (err) {
     return { pushed, deployed: false, error: err };
@@ -438,7 +513,53 @@ async function warnIfNotSupabaseProject() {
     );
   }
 }
+function brokerFromFlags() {
+  const flagUrl = process.env.EXPOSIFY_BROKER_URL ?? argValue("--broker-url");
+  const flagProject = process.env.EXPOSIFY_PROJECT_ID ?? argValue("--broker-project");
+  if (!flagUrl && !flagProject) return void 0;
+  if (!flagUrl || !flagProject) {
+    throw new Error("the hosted broker needs both --broker-url and --broker-project (or EXPOSIFY_BROKER_URL/EXPOSIFY_PROJECT_ID).");
+  }
+  const problem = brokerUrlProblem(flagUrl);
+  if (problem) throw new Error(problem);
+  return { brokerUrl: normalizeBrokerUrl(flagUrl), projectId: flagProject.trim() };
+}
+async function resolveBroker(rl, fromFlags) {
+  if (fromFlags) return fromFlags;
+  if (!rl) return null;
+  const use = await promptYesNo(
+    rl,
+    "\nUse the Exposify hosted broker for auth (MCP clients get a long-lived extb_... token instead of a Supabase JWT)?"
+  );
+  if (!use) return null;
+  let brokerUrl = "";
+  for (; ; ) {
+    brokerUrl = normalizeBrokerUrl(await promptText(rl, "  Broker URL (from the dashboard's Hosted broker card): "));
+    const problem = brokerUrlProblem(brokerUrl);
+    if (!problem) break;
+    console.log(`  ${problem}`);
+  }
+  let projectId = "";
+  while (!projectId) projectId = await promptText(rl, "  Project ID: ");
+  return { brokerUrl, projectId };
+}
+async function disableJwtVerification() {
+  if (!await exists(CONFIG_TOML)) {
+    console.warn(
+      `warn: no ${CONFIG_TOML} to record verify_jwt = false in -- always deploy with \`supabase functions deploy mcp --no-verify-jwt\`, or broker tokens will be rejected with "Invalid JWT".`
+    );
+    return;
+  }
+  const { toml, changed } = setFunctionVerifyJwtFalse(await readFile(CONFIG_TOML, "utf8"));
+  if (!changed) {
+    console.log(`Skipped ${CONFIG_TOML} (verify_jwt already false for mcp)`);
+    return;
+  }
+  await writeFile(CONFIG_TOML, toml);
+  console.log(`Updated ${CONFIG_TOML}: [functions.mcp] verify_jwt = false (broker tokens aren't Supabase JWTs)`);
+}
 async function cmdInit() {
+  const brokerFlags = brokerFromFlags();
   await warnIfNotSupabaseProject();
   const { path: migrationPath, wasNew } = await ensureMetaMigration();
   console.log(wasNew ? `Wrote ${migrationPath}` : `Skipped ${migrationPath} (already scaffolded)`);
@@ -453,31 +574,41 @@ async function cmdInit() {
   if (connWarning) console.warn(`warn: ${connWarning}`);
   const rl = openInteractiveReadline();
   if (!rl) {
+    const broker = await resolveBroker(null, brokerFlags);
+    if (broker) await disableJwtVerification();
     if (!functionExists) {
-      await writeFile(functionPath, buildFunctionTemplate());
+      await writeFile(functionPath, buildFunctionTemplate({ broker: broker ?? void 0 }));
       console.log(`Wrote ${functionPath}`);
     } else {
       console.log(`Skipped ${functionPath} (already exists)`);
+      if (broker) printBrokerMergeHint(functionPath, broker);
     }
-    printManualCommands();
+    printManualCommands({ broker });
     return;
   }
   try {
     const conn = resolveConnectionInfo();
+    const broker = await resolveBroker(rl, brokerFlags);
+    if (broker) await disableJwtVerification();
     const anonymousSignIn = await askAnonymousSignIn(rl, conn);
     let introspection = conn ? await tryIntrospect(conn) : null;
     let alreadyPushed = false;
     let alreadyDeployed = false;
+    let brokerHintShown = false;
     if (!introspection) {
       if (!functionExists) {
-        await writeFile(functionPath, buildFunctionTemplate({ anonymousSignIn }));
+        await writeFile(functionPath, buildFunctionTemplate({ anonymousSignIn, broker: broker ?? void 0 }));
         console.log(`Wrote ${functionPath}`);
       } else {
         console.log(`Skipped ${functionPath} (already exists)`);
+        if (broker) {
+          printBrokerMergeHint(functionPath, broker);
+          brokerHintShown = true;
+        }
       }
       if (!hasSupabaseCli()) {
         console.log("\nSupabase CLI not found on PATH -- install it to run the next steps automatically next time.");
-        printManualCommands();
+        printManualCommands({ broker });
         return;
       }
       const connect = await promptYesNo(
@@ -485,24 +616,26 @@ async function cmdInit() {
         "\nApply the migration and deploy the function to whatever Supabase project is currently linked, now?"
       );
       if (!connect) {
-        printManualCommands();
+        printManualCommands({ broker });
         return;
       }
-      const result2 = pushAndDeploy();
+      const result2 = pushAndDeploy(broker);
       alreadyPushed = result2.pushed;
       alreadyDeployed = result2.deployed;
       if (!result2.deployed) {
         console.error(`
 Supabase CLI command failed: ${result2.error instanceof Error ? result2.error.message : result2.error}`);
-        printManualCommands({ alreadyPushed });
+        printManualCommands({ alreadyPushed, broker });
         return;
       }
+      printLicenseKeyReminder(broker);
       introspection = conn ? await tryIntrospect(conn) : null;
       if (!introspection) {
         console.log(
           "\nDeployed, but couldn't reach the project to introspect tables (no SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY or --url/--key available). Re-run `exposify-supabase init` with those set to configure writes, RPCs, and documentation interactively."
         );
-        console.log("\nDone. Paste the function URL + a user JWT into an MCP client to try it.");
+        console.log(`
+Done. Paste the function URL + ${clientCredential(broker)} into an MCP client to try it.`);
         return;
       }
     }
@@ -513,14 +646,14 @@ Supabase CLI command failed: ${result2.error instanceof Error ? result2.error.me
     const writes = flattenWriteGrants(grants);
     let wroteFunctionFile = false;
     if (!functionExists) {
-      await writeFile(functionPath, buildFunctionTemplate({ writes, rpc, anonymousSignIn }));
+      await writeFile(functionPath, buildFunctionTemplate({ writes, rpc, anonymousSignIn, broker: broker ?? void 0 }));
       console.log(`
 Wrote ${functionPath} with your selections.`);
       wroteFunctionFile = true;
-    } else if (writes.length > 0 || rpc.length > 0) {
+    } else if (writes.length > 0 || rpc.length > 0 || broker && !brokerHintShown) {
       console.log(`
 ${functionPath} already exists -- left untouched. Merge this into your aiReady() config:`);
-      console.log(buildFunctionTemplate({ writes, rpc, anonymousSignIn }));
+      console.log(buildFunctionTemplate({ writes, rpc, anonymousSignIn, broker: broker ?? void 0 }));
     }
     const commentsPath = await writeCommentsMigration(docs);
     if (commentsPath) console.log(`Wrote ${commentsPath}`);
@@ -531,26 +664,33 @@ ${functionPath} already exists -- left untouched. Merge this into your aiReady()
     }
     if (!hasSupabaseCli()) {
       console.log("\nSupabase CLI not found on PATH.");
-      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile });
+      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile, broker });
       return;
     }
     const redeploy = await promptYesNo(rl, "\nApply/deploy these changes now?", true);
     if (!redeploy) {
-      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile });
+      printManualCommands({ alreadyPushed: commentsPath === null, alreadyDeployed: !wroteFunctionFile, broker });
       return;
     }
-    const result = pushAndDeploy();
+    const result = pushAndDeploy(broker);
     if (!result.deployed) {
       console.error(`
 Supabase CLI command failed: ${result.error instanceof Error ? result.error.message : result.error}`);
-      printManualCommands({ alreadyPushed: result.pushed });
+      printManualCommands({ alreadyPushed: result.pushed, broker });
       return;
     }
-    console.log("\nDone. Paste the function URL + a user JWT into an MCP client to try it.");
+    printLicenseKeyReminder(broker);
+    console.log(`
+Done. Paste the function URL + ${clientCredential(broker)} into an MCP client to try it.`);
   } finally {
     rl.close();
   }
 }
+function printBrokerMergeHint(functionPath, broker) {
+  console.log(`
+${functionPath} already exists -- left untouched. Merge the broker wiring into your aiReady() config:`);
+  console.log(buildFunctionTemplate({ broker }));
+}
 async function cmdGenerate() {
   const conn = resolveConnectionInfo();
   if (!conn) {
@@ -588,12 +728,17 @@ async function main() {
   const [, , cmd] = process.argv;
   if (cmd === "init") return cmdInit();
   if (cmd === "generate") return cmdGenerate();
-  console.log("Usage: exposify-supabase <init|generate> [--url <url>] [--key <service-role-key>]");
+  console.log(
+    "Usage: exposify-supabase <init|generate> [--url <url>] [--key <service-role-key>] [--broker-url <url> --broker-project <id>]"
+  );
   console.log("  init      Scaffold the exposify_meta() migration + supabase/functions/mcp/index.ts.");
   console.log("            Interactively offers to run `supabase db push` + `functions deploy`; if a");
   console.log("            project is reachable (SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY env vars, or --url/--key),");
   console.log("            also walks through anonymous sign-in, per-table writes, RPC exposure, and");
-  console.log("            documentation for tables/columns missing a comment.");
+  console.log("            documentation for tables/columns missing a comment. Offers to wire in the hosted");
+  console.log("            broker (or pass --broker-url/--broker-project): adds createHostedAuthResolver to the");
+  console.log("            function, sets verify_jwt = false for it in supabase/config.toml, and deploys with");
+  console.log("            --no-verify-jwt.");
   console.log("  generate  Build exposify.manifest.json from a running local/linked project");
   process.exitCode = cmd ? 1 : 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.10",
+    "@exposify/core": "0.3.11",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },
@@ -40,15 +40,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ayadagain/agentready.git",
-    "directory": "packages/supabase"
-  },
-  "homepage": "https://github.com/ayadagain/agentready/tree/main/packages/supabase#readme",
-  "bugs": {
-    "url": "https://github.com/ayadagain/agentready/issues"
-  },
   "description": "Expose a Supabase-backed app's database and edge functions to AI agents over MCP, generated from PostgREST + Row Level Security — RLS is the authorization layer, so agents can do exactly what the logged-in user can do.",
   "author": "Exposify",
   "keywords": [