@exposify/supabase 0.3.8 → 0.3.9

package/README.md

@@ -159,26 +159,25 @@ re-runs safe:
 
 ### Using the hosted broker
 
-If you use the Exposify hosted broker (the dashboard's "Hosted broker" card),
 `init` asks first:
 
 ```
-Use the Exposify hosted broker for auth (MCP clients get a long-lived extb_... token instead of a Supabase JWT)? [y/N]
+Let agents log in as your users through the Exposify hosted broker (they get a long-lived connection instead of an hourly Supabase JWT)? [y/N]
 ```
 
-Or skip the question with `--broker-url <url> --broker-project <id>`
-(or `EXPOSIFY_BROKER_URL`/`EXPOSIFY_PROJECT_ID`), which also works
-non-interactively. Saying yes does three things:
-
-1. **Wires the resolver into the function.** Adds
-   `auth: createHostedAuthResolver({ brokerUrl, projectId, licenseKey })` and
-   `authRequired: true` to `aiReady()`. The license key is read from the
-   `EXPOSIFY_LICENSE_KEY` secret and is never written into the file. This
-   goes in the managed block, so an existing `index.ts` gets it too, unless
-   its block was hand-edited. In that case `init` prints the block for you to
-   merge, and leaves `verify_jwt` alone until you have.
-2. **Sets `verify_jwt = false` for `mcp` in `supabase/config.toml`.** An
-   `extb_...` token isn't a JWT, so with the gateway's check on, every request
+Or skip the question with `--broker` (`--broker-url <url>`, or
+`EXPOSIFY_BROKER_URL`, also points it at a different broker, for local
+development), which also works non-interactively. Saying yes does three
+things:
+
+1. **Wires the broker into the function.** Adds `auth: hostedBroker()` and
+   `authRequired: true` to `aiReady()`. `hostedBroker()` reads the
+   `EXPOSIFY_KEY` secret, which is never written into the file. This goes in
+   the managed block, so an existing `index.ts` gets it too, unless its block
+   was hand-edited. In that case `init` prints the block for you to merge,
+   and leaves `verify_jwt` alone until you have.
+2. **Sets `verify_jwt = false` for `mcp` in `supabase/config.toml`.** A
+   broker token isn't a Supabase JWT, so with the gateway's check on, every request
    fails with `{"code":"UNAUTHORIZED_ASYMMETRIC_JWT","message":"Invalid JWT"}`
    before the function runs. The setting goes in config.toml and not just
    on the deploy command line, because a later plain
@@ -187,13 +186,14 @@ non-interactively. Saying yes does three things:
    that have no valid broker token. Otherwise those requests would run as
    `anon`.
 3. **Deploys with `--no-verify-jwt`**, and adds
-   `supabase secrets set EXPOSIFY_LICENSE_KEY=...` to the printed steps.
-   `init` never sees the license key, so you set that secret yourself.
+   `supabase secrets set EXPOSIFY_KEY=...` to the printed steps.
+   `init` never sees the key, so you set that secret yourself.
    Until you do, every request gets a 401.
 
-MCP clients then send `Authorization: Bearer extb_...`. Don't give the client
-the JWT that `POST /resolve` returns. It's the short-lived Supabase token the
-function swaps in on each request, and it stops working when it expires.
+MCP clients then click Connect and sign in through the broker (or send a
+pasted `Authorization: Bearer extb_...`). Don't give the client the JWT that
+`POST /resolve` returns. It's the short-lived Supabase token the function
+swaps in on each request, and it stops working when it expires.
 
 ## 2. Decide what's exposed
 
@@ -254,7 +254,7 @@ Other options you can pass to `aiReady()`:
 | Option | Default | What it does |
 |---|---|---|
 | `docs` | `["docs/**/*.md"]` | Glob(s), relative to the function directory, bundled into the knowledge base |
-| `docsAuth` | `"public"` | `"required"` hides `search_docs` until the caller sends *any* `Authorization` header (presence-only, not validated) |
+| `docsAuth` | `"public"` (`"required"` with the hosted broker) | `"required"` hides `search_docs` until the caller sends *any* `Authorization` header (presence-only, not validated) |
 | `maxRows` | `100` | Hard cap applied to every `query_<table>` call |
 | `rateLimit` / `rateWindowMs` | `60` / `60000` | In-memory, per-instance, best-effort rate limit — **not** distributed across edge instances; real limits belong to Supabase's own gateway |
 | `supabaseUrl` / `anonKey` / `serviceRoleKey` | read from `SUPABASE_URL` / `SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY` env vars | Override for local dev/testing; in a deployed function all three env vars are automatic. `serviceRoleKey` is used only for schema introspection — see below. |
@@ -306,7 +306,8 @@ unless you're editing `sql/exposify_meta.sql` directly).
 ## 4. Connect an MCP client
 
 Point any MCP client at the function's URL with a real user's JWT as the
-bearer token (or set up OAuth, below, so the client logs in by itself) — for
+bearer token (or set up OAuth or the hosted broker, below, so the client logs
+in by itself) — for
 example, with the Claude Code CLI:
 
 ```bash
@@ -342,7 +343,7 @@ exits 1 if anything failed, so you can run it in CI.
   (`initialize`, then `tools/list`) and reports the tool count. If the
   function registered `exposify://diagnostics`, which it only does when
   degraded, doctor prints that too. With the broker, it also checks that the
-  `EXPOSIFY_LICENSE_KEY` secret exists (`supabase secrets list`).
+  `EXPOSIFY_KEY` secret exists (`supabase secrets list`).
 
 **How the function check authenticates:** it uses `--token` if you pass one.
 Otherwise it sends no token. If the gateway rejects that (`verify_jwt` on),
@@ -453,29 +454,39 @@ will likely set to the proxy's address, so every client could share one
 60-requests/minute bucket. Rate-limit at the proxy and raise `rateLimit` on
 the function. This setup is untested against a real deployment.
 
-## Long-lived tokens for clients that can't refresh (token broker)
+## Long-lived tokens for clients that can't refresh (the hosted broker)
 
 Supabase user JWTs expire (default 1h) and their refresh tokens rotate; a plain
-MCP client can hold a bearer token but can't refresh it. Pass an `auth`
-resolver (any `(incoming: Headers) => Headers | Promise<Headers>`, such as
-`broker.resolver` from [`@exposify/token-broker`](../token-broker/README.md))
-and the client sends a long-lived broker token instead:
+MCP client can hold a bearer token but can't refresh it. Exposify's hosted
+broker holds each user's session, refreshes it, and swaps the agent's
+long-lived connection token (`extb_...`) for a live Supabase JWT on every
+call ([`docs/hosted-broker.md`](../../docs/hosted-broker.md)). `init` sets it
+up (see "Using the hosted broker" above); by hand:
+
+```sh
+supabase secrets set EXPOSIFY_KEY=exk_...   # the project's secret key from the dashboard
+```
 
 ```ts
 // supabase/functions/mcp/index.ts
-import { aiReady } from "npm:@exposify/supabase";
-import { broker } from "./broker.ts"; // createTokenBroker(...) over a shared store
+import { aiReady, hostedBroker } from "npm:@exposify/supabase";
 
-Deno.serve(aiReady({ auth: broker.resolver, authRequired: true, writes: ["todos.*"] }));
+Deno.serve(aiReady({ auth: hostedBroker(), authRequired: true, writes: ["todos.*"] }));
 ```
 
-- The resolver receives the request's original headers (the `extb_...` token)
-  and its result **replaces** them for PostgREST and `functions` calls, so RLS
-  applies as that user and the broker token is never forwarded. `apikey` and a
+With the `EXPOSIFY_KEY` secret set, `aiReady()` uses the broker even without
+`auth`, and `authRequired` defaults to on; `hostedBroker()` just says so in
+the code, and never throws (a missing secret refuses every call with one
+warning).
+
+- `auth` takes any resolver (`(incoming: Headers) => Headers | Promise<Headers>`).
+  It receives the request's original headers (the `extb_...` token) and its
+  result **replaces** them for PostgREST and `functions` calls, so RLS applies
+  as that user and the connection token is never forwarded. `apikey` and a
   missing `authorization` still fall back to the anon key.
-- `docsAuth: "required"` checks the raw incoming headers, so a broker token
-  counts as authenticated.
-- A broker resolver returns empty headers for an unknown/revoked token or a
+- `docsAuth: "required"` checks the raw incoming headers, so a connection
+  token counts as authenticated.
+- The resolver returns empty headers for an unknown or revoked token or a
   failed refresh. By default the request then runs as the `anon` role (RLS
   decides). Set `authRequired: true` to answer `401` instead. Recommended.
 - A resolver that throws yields a 503.
@@ -483,24 +494,7 @@ Deno.serve(aiReady({ auth: broker.resolver, authRequired: true, writes: ["todos.
   (`[functions.mcp] verify_jwt = false` in `supabase/config.toml`, or
   `supabase functions deploy mcp --no-verify-jwt`). Otherwise Supabase
   rejects the `extb_...` token as `Invalid JWT` before your code runs. With
-  the check off, `authRequired: true` stops being optional.
-- For the platform-hosted broker, use `createHostedAuthResolver` in place of
-  `broker.resolver`. `init` can set this up for you; see "Using the hosted
-  broker" above.
-
-**Deployment constraints** (not verified end to end, see HANDOVER):
-
-- The broker's OAuth server (`listenTokenBroker`) is a Node HTTP server and
-  can't run in an Edge Function; run it as a separate service.
-- The edge function builds its own `createTokenBroker(...)` over the **same
-  persistent `TokenStore`** (Redis/Postgres, see the token-broker README's
-  `ioredis` example) and the same `TOKEN_BROKER_ENCRYPTION_KEY`. The in-memory
-  store is per-process and won't work.
-- The broker service does proactive refresh; short-lived edge instances rely on
-  the resolver's lazy refresh when `expiresAt` has passed.
-- `@exposify/token-broker` imports `node:crypto` (`scryptSync`, AES-256-GCM,
-  RS256). Whether that works under Supabase's Deno runtime has **not** been
-  tested; try `supabase functions serve` before depending on it.
+  the check off, `authRequired: true` stops being optional. `init` does both.
 
 ## Knowledge base
 

package/dist/cli.js

@@ -400,7 +400,7 @@ async function discoverConnection(deps) {
 }
 
 // bin/function-file.ts
-var LICENSE_KEY_SECRET = "EXPOSIFY_LICENSE_KEY";
+var KEY_SECRET = "EXPOSIFY_KEY";
 var EMPTY_CONFIG = { writes: [], rpc: [], anonymousSignIn: false, broker: null, oauth: false };
 function bypassesGatewayJwt(config) {
   return config.broker !== null || config.oauth;
@@ -426,18 +426,12 @@ function buildManagedBlock(config) {
     `// everything down to exposify:end when you re-run it. Add your own code below.`
   ];
   if (config.anonymousSignIn) lines.push(...ANONYMOUS_SIGN_IN_WARNING);
-  lines.push(
-    config.oauth ? `import { aiReady, supabaseAuth } from "npm:@exposify/supabase";` : `import { aiReady } from "npm:@exposify/supabase";`
-  );
-  if (config.broker) lines.push(`import { createHostedAuthResolver } from "npm:@exposify/token-broker";`);
+  const imports = ["aiReady", ...config.oauth ? ["supabaseAuth"] : [], ...config.broker ? ["hostedBroker"] : []];
+  lines.push(`import { ${imports.join(", ")} } from "npm:@exposify/supabase";`);
   lines.push("", "const generated = {");
   if (config.broker) {
     lines.push(
-      "  auth: createHostedAuthResolver({",
-      `    brokerUrl: ${JSON.stringify(config.broker.brokerUrl)},`,
-      `    projectId: ${JSON.stringify(config.broker.projectId)},`,
-      `    licenseKey: Deno.env.get(${JSON.stringify(LICENSE_KEY_SECRET)}) ?? "",`,
-      "  }),",
+      config.broker.brokerUrl ? `  auth: hostedBroker({ brokerUrl: ${JSON.stringify(config.broker.brokerUrl)} }),` : "  auth: hostedBroker(),",
       "  authRequired: true,"
     );
   }
@@ -487,13 +481,19 @@ function readStringField(text, key) {
   }
 }
 function readConfig(text) {
-  const brokerUrl = readStringField(text, "brokerUrl");
-  const projectId = readStringField(text, "projectId");
+  const inline = /\bhostedBroker\(\{\s*brokerUrl:\s*("(?:[^"\\]|\\.)*")\s*\}\)/.exec(text);
+  let brokerUrl = null;
+  try {
+    brokerUrl = inline ? JSON.parse(inline[1]) : readStringField(text, "brokerUrl");
+  } catch {
+    brokerUrl = null;
+  }
   return {
     writes: readStringArray(text, "writes") ?? [],
     rpc: readStringArray(text, "rpc") ?? [],
     anonymousSignIn: text.includes(ANONYMOUS_MARKER),
-    broker: /\bcreateHostedAuthResolver\s*\(/.test(text) && brokerUrl && projectId ? { brokerUrl, projectId } : null,
+    // hostedBroker() today; createHostedAuthResolver(...) in files from before the one-key setup.
+    broker: /\b(hostedBroker|createHostedAuthResolver)\s*\(/.test(text) ? brokerUrl ? { brokerUrl } : {} : null,
     oauth: /^\s*oauth:\s*supabaseAuth\(\s*\)\s*,?\s*$/m.test(text)
   };
 }
@@ -522,7 +522,7 @@ function replaceManagedBlock(text, config) {
 }
 function configsEqual(a, b) {
   const sameSet = (x, y) => x.length === y.length && [...x].sort().join("\0") === [...y].sort().join("\0");
-  return sameSet(a.writes, b.writes) && sameSet(a.rpc, b.rpc) && a.anonymousSignIn === b.anonymousSignIn && a.broker?.brokerUrl === b.broker?.brokerUrl && a.broker?.projectId === b.broker?.projectId && a.oauth === b.oauth;
+  return sameSet(a.writes, b.writes) && sameSet(a.rpc, b.rpc) && a.anonymousSignIn === b.anonymousSignIn && a.broker === null === (b.broker === null) && a.broker?.brokerUrl === b.broker?.brokerUrl && a.oauth === b.oauth;
 }
 
 // bin/doctor.ts
@@ -532,7 +532,7 @@ var MIGRATIONS_DIR = "supabase/migrations";
 var CONFIG_TOML = "supabase/config.toml";
 var DIAGNOSTICS_URI = "exposify://diagnostics";
 function detectAuthMode(functionSource) {
-  if (/\bcreateHostedAuthResolver\s*\(/.test(functionSource)) return "broker";
+  if (/\b(hostedBroker|createHostedAuthResolver)\s*\(/.test(functionSource)) return "broker";
   return /\boauth:\s*supabaseAuth\s*\(/.test(functionSource) ? "oauth" : "jwt";
 }
 function bypassesGatewayJwt2(mode) {
@@ -824,18 +824,18 @@ function probeChecks(url, outcome, authMode, local) {
 }
 function licenseSecretCheck(deps) {
   if (!deps.runSupabase || !deps.projectRef) {
-    return { status: "skip", message: `${LICENSE_KEY_SECRET} secret not checked (needs the Supabase CLI and a linked project)` };
+    return { status: "skip", message: `${KEY_SECRET} secret not checked (needs the Supabase CLI and a linked project)` };
   }
   let names = null;
   try {
     names = parseSecretNames(deps.runSupabase(["secrets", "list", "--project-ref", deps.projectRef, "-o", "json"]));
   } catch {
   }
-  if (names === null) return { status: "skip", message: `${LICENSE_KEY_SECRET} secret not checked (\`supabase secrets list\` failed)` };
-  return names.includes(LICENSE_KEY_SECRET) ? { status: "pass", message: `${LICENSE_KEY_SECRET} secret is set` } : {
+  if (names === null) return { status: "skip", message: `${KEY_SECRET} secret not checked (\`supabase secrets list\` failed)` };
+  return names.includes(KEY_SECRET) ? { status: "pass", message: `${KEY_SECRET} secret is set` } : {
     status: "fail",
-    message: `${LICENSE_KEY_SECRET} secret is missing; every request will 401`,
-    fix: `supabase secrets set ${LICENSE_KEY_SECRET}=<your license key (expfy_...)>`
+    message: `${KEY_SECRET} secret is missing; every request will 401`,
+    fix: `supabase secrets set ${KEY_SECRET}=<your secret key from the Exposify dashboard (exk_...)>`
   };
 }
 var SYMBOL = { pass: "\u2713", warn: "!", fail: "\u2717", skip: "-" };
@@ -887,7 +887,7 @@ function describeConfigChange(from, to) {
   }
   if (authLabel(from) !== authLabel(to)) {
     parts.push(`auth: ${authLabel(from)} -> ${authLabel(to)}`);
-  } else if (from.broker?.brokerUrl !== to.broker?.brokerUrl || from.broker?.projectId !== to.broker?.projectId) {
+  } else if (from.broker?.brokerUrl !== to.broker?.brokerUrl) {
     parts.push("hosted broker settings");
   }
   return parts.join("; ");
@@ -1121,14 +1121,14 @@ function deployArgs(auth) {
 }
 function clientStep(auth) {
   if (auth.oauth) return "Add the function URL to an MCP client; it opens a Supabase Auth login on connect.";
-  const credential = auth.broker ? "a broker token (extb_..., minted by the hosted broker)" : "a user JWT";
+  const credential = auth.broker ? "a connection token (extb_..., from the hosted broker)" : "a user JWT";
   return `Paste the function URL + ${credential} into an MCP client.`;
 }
 function printManualCommands(steps, auth) {
   console.log("\nRun these to finish setup:");
   const lines = [];
   if (steps.push) lines.push("supabase db push");
-  if (auth.broker) lines.push(`supabase secrets set ${LICENSE_KEY_SECRET}=<your license key (expfy_...)>`);
+  if (auth.broker) lines.push(`supabase secrets set ${KEY_SECRET}=<your secret key from the Exposify dashboard (exk_...)>`);
   if (auth.oauth) lines.push(OAUTH_DASHBOARD_STEP);
   if (steps.deploy) lines.push(`supabase ${deployArgs(auth).join(" ")}`);
   lines.forEach((cmd, i) => console.log(`  ${i + 1}. ${cmd}`));
@@ -1138,7 +1138,7 @@ function printLicenseKeyReminder(auth) {
   if (!auth.broker) return;
   console.log(
     `
-If you haven't already: supabase secrets set ${LICENSE_KEY_SECRET}=<your license key (expfy_...)> -- until it's set, every request is rejected with 401.`
+If you haven't already: supabase secrets set ${KEY_SECRET}=<your secret key (exk_...)> -- until it's set, every request is rejected with 401.`
   );
 }
 function runSteps(steps, auth) {
@@ -1335,19 +1335,16 @@ async function warnIfNotSupabaseProject() {
 }
 function brokerFromFlags() {
   const flagUrl = argValue("--broker-url") ?? process.env.EXPOSIFY_BROKER_URL;
-  const flagProject = argValue("--broker-project") ?? process.env.EXPOSIFY_PROJECT_ID;
-  if (!flagUrl && !flagProject) return void 0;
-  if (!flagUrl || !flagProject) {
-    throw new Error("the hosted broker needs both --broker-url and --broker-project (or EXPOSIFY_BROKER_URL/EXPOSIFY_PROJECT_ID).");
-  }
+  if (!flagUrl && !process.argv.includes("--broker")) return void 0;
+  if (!flagUrl) return {};
   const problem = brokerUrlProblem(flagUrl);
   if (problem) throw new Error(problem);
-  return { brokerUrl: normalizeBrokerUrl(flagUrl), projectId: flagProject.trim() };
+  return { brokerUrl: normalizeBrokerUrl(flagUrl) };
 }
 function authFromFlags() {
   const broker = brokerFromFlags();
   const oauth = process.argv.includes("--oauth") || process.env.EXPOSIFY_OAUTH === "1";
-  if (broker && oauth) throw new Error("--oauth can't be combined with the hosted broker flags; pick one.");
+  if (broker && oauth) throw new Error("--oauth can't be combined with --broker; pick one.");
   if (broker) return { broker, oauth: false };
   if (oauth) return { broker: null, oauth: true };
   return void 0;
@@ -1365,25 +1362,11 @@ async function askAuth(rl, current) {
 async function askBroker(rl, current) {
   const use = await promptYesNo(
     rl,
-    "\nUse the Exposify hosted broker for auth (MCP clients get a long-lived extb_... token instead of a Supabase JWT)?",
+    "\nLet agents log in as your users through the Exposify hosted broker (they get a long-lived connection instead of an hourly Supabase JWT)?",
     current !== null
   );
   if (!use) return null;
-  let brokerUrl = "";
-  for (; ; ) {
-    const hint = current ? ` [${current.brokerUrl}]` : "";
-    const answer = await promptText(rl, `  Broker URL (from the dashboard's Hosted broker card)${hint}: `);
-    brokerUrl = normalizeBrokerUrl(answer || current?.brokerUrl || "");
-    const problem = brokerUrlProblem(brokerUrl);
-    if (!problem) break;
-    console.log(`  ${problem}`);
-  }
-  let projectId = "";
-  while (!projectId) {
-    const hint = current ? ` [${current.projectId}]` : "";
-    projectId = await promptText(rl, `  Project ID${hint}: `) || current?.projectId || "";
-  }
-  return { brokerUrl, projectId };
+  return current?.brokerUrl ? { brokerUrl: current.brokerUrl } : {};
 }
 async function readLocalState() {
   const migrations = await listFilesOrEmpty(MIGRATIONS_DIR2);
@@ -1604,13 +1587,13 @@ async function main() {
   if (cmd === "generate") return cmdGenerate();
   if (cmd === "doctor") return cmdDoctor();
   console.log(
-    "Usage: exposify-supabase <init|generate|doctor> [--url <url>] [--key <service-role-key>] [--local|--linked] [--broker-url <url> --broker-project <id> | --oauth] [--token <token>] [--check]"
+    "Usage: exposify-supabase <init|generate|doctor> [--url <url>] [--key <service-role-key>] [--local|--linked] [--broker [--broker-url <url>] | --oauth] [--token <token>] [--check]"
   );
   console.log("  init      Scaffold the exposify_meta() migration + supabase/functions/mcp/index.ts, then (when the");
   console.log("            project is reachable) walk through anonymous sign-in, per-table writes, RPC exposure, and");
   console.log("            documentation. Safe to re-run: answers default to what's already configured, only the");
   console.log("            exposify:begin/end block of index.ts is ever rewritten, and a run that changes nothing");
-  console.log("            says so and stops. Offers the hosted broker (or --broker-url/--broker-project), or");
+  console.log("            says so and stops. Offers the hosted broker (or --broker; it reads the EXPOSIFY_KEY secret), or");
   console.log("            Supabase Auth sign-in (--oauth): adds oauth: supabaseAuth(), so MCP clients open a login");
   console.log("            on connect. Either way it sets verify_jwt = false for mcp and deploys --no-verify-jwt.");
   console.log("            --check: change nothing, exit 1 if a run would change a file.");

package/dist/index.cjs

@@ -25,8 +25,11 @@ __export(index_exports, {
   aiReady: () => aiReady,
   buildManifest: () => buildManifest,
   columnsFromOpenApi: () => columnsFromOpenApi,
+  completeMcpLogin: () => import_core6.completeMcpLogin,
+  createHostedAuthResolver: () => import_core6.createHostedAuthResolver,
   fetchExposifyMeta: () => fetchExposifyMeta,
   fetchOpenApi: () => fetchOpenApi,
+  hostedBroker: () => import_core6.hostedBroker,
   introspectTables: () => introspectTables,
   loadManifest: () => loadManifest,
   rpcArgSchema: () => rpcArgSchema,
@@ -108,7 +111,7 @@ function warnOnce(message) {
   } catch {
   }
 }
-function resolveSupabaseConfig(options = {}) {
+function resolveSupabaseConfig(options = {}, hostedBroker2 = false) {
   if (options.oauth) {
     if (options.docsAuth === "public") {
       throw new Error('docsAuth: "public" cannot be combined with oauth (the whole MCP endpoint requires a token)');
@@ -122,7 +125,7 @@ function resolveSupabaseConfig(options = {}) {
     rpc: options.rpc ?? [],
     functions: options.functions ?? {},
     docs: options.docs ?? ["docs/**/*.md"],
-    docsAuth: options.docsAuth ?? (options.oauth ? "required" : "public"),
+    docsAuth: options.docsAuth ?? (options.oauth || hostedBroker2 ? "required" : "public"),
     maxRows: options.maxRows ?? 100,
     rateLimit: options.rateLimit,
     rateWindowMs: options.rateWindowMs
@@ -735,11 +738,13 @@ function logColdStart(opts) {
 }
 
 // src/index.ts
+var import_core6 = require("@exposify/core");
 function denoEnv() {
   return globalThis.Deno?.env;
 }
 function aiReady(options = {}) {
-  const cfg = resolveSupabaseConfig(options);
+  const brokerOn = (0, import_core5.isHostedResolver)(options.auth) || !options.auth && !options.oauth && Boolean((0, import_core5.readEnv)("EXPOSIFY_KEY"));
+  const cfg = resolveSupabaseConfig(options, brokerOn);
   const fetchImpl = options.fetchImpl ?? fetch;
   const env = denoEnv();
   const supabaseUrl = options.supabaseUrl ?? env?.get("SUPABASE_URL");
@@ -749,7 +754,7 @@ function aiReady(options = {}) {
   const logReady = (0, import_core5.startupLogEnabled)(options.startupLog);
   const functionName = functionNameFromMainModule();
   const endpoint = gate?.metadata.resource ?? (supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : "this function");
-  const authLabel = gate ? `oauth (${String(gate.metadata.authorization_servers[0])})` : options.auth ? "custom resolver" : "passthrough (caller's JWT)";
+  const authLabel = gate ? `oauth (${String(gate.metadata.authorization_servers[0])})` : brokerOn ? "hosted broker (EXPOSIFY_KEY)" : options.auth ? "custom resolver" : "passthrough (caller's JWT)";
   if (!supabaseUrl) {
     console.error(
       (0, import_core5.formatFailed)(LOG_PREFIX, "SUPABASE_URL is not set", "deployed functions get it automatically; for local dev pass { supabaseUrl }")
@@ -851,9 +856,21 @@ function aiReady(options = {}) {
       return result.ok ? core(req) : result.response;
     };
   }
-  const auth = options.auth;
+  const envAuth = options.auth || options.oauth ? void 0 : (0, import_core5.hostedResolverFromEnv)();
+  const auth = options.auth ?? envAuth;
+  const authRequired = options.authRequired ?? (envAuth !== void 0 || (0, import_core5.isHostedResolver)(auth));
   if (!auth) return core;
+  const brokerGate = authRequired ? (0, import_core5.createBrokerGate)(auth) : null;
+  const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
+    if (brokerGate) {
+      const own = (0, import_core5.publicRequestUrl)(req.url, req.headers);
+      const isPrm = own.endsWith(PRM_SUFFIX);
+      const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
+      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+      if (!result.ok) return result.response;
+    }
     let resolved;
     try {
       resolved = await auth(req.headers, {});
@@ -861,7 +878,7 @@ function aiReady(options = {}) {
       console.error("exposify-supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (options.authRequired && !resolved.get("authorization")) {
+    if (authRequired && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);
@@ -875,8 +892,11 @@ function aiReady(options = {}) {
   aiReady,
   buildManifest,
   columnsFromOpenApi,
+  completeMcpLogin,
+  createHostedAuthResolver,
   fetchExposifyMeta,
   fetchOpenApi,
+  hostedBroker,
   introspectTables,
   loadManifest,
   rpcArgSchema,

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import { OAuthOptions, AuthResolver, WebMcpHandler } from '@exposify/core';
+export { HostedAuthResolverConfig, completeMcpLogin, createHostedAuthResolver, hostedBroker } from '@exposify/core';
 
 type ColumnType = "string" | "number" | "integer" | "boolean" | "object" | "array";
 interface ColumnSchema {
@@ -109,8 +110,8 @@ interface AgentifySupabaseOptions {
     serviceRoleKey?: string;
     /**
      * Resolves the caller's incoming headers into the headers used for
-     * PostgREST and edge-function calls, e.g. `broker.resolver` from
-     * `@exposify/token-broker` to swap a long-lived `extb_...` token for a live
+     * PostgREST and edge-function calls, e.g. `createHostedAuthResolver` (Exposify's
+     * hosted broker) to swap a long-lived `extb_...` token for a live
      * Supabase JWT. Only `authorization`/`apikey` from the result are used; a
      * missing `authorization` falls back to the anon key (unless
      * `authRequired`). Absent: the caller's own `authorization`/`apikey` are

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { OAuthOptions, AuthResolver, WebMcpHandler } from '@exposify/core';
+export { HostedAuthResolverConfig, completeMcpLogin, createHostedAuthResolver, hostedBroker } from '@exposify/core';
 
 type ColumnType = "string" | "number" | "integer" | "boolean" | "object" | "array";
 interface ColumnSchema {
@@ -109,8 +110,8 @@ interface AgentifySupabaseOptions {
     serviceRoleKey?: string;
     /**
      * Resolves the caller's incoming headers into the headers used for
-     * PostgREST and edge-function calls, e.g. `broker.resolver` from
-     * `@exposify/token-broker` to swap a long-lived `extb_...` token for a live
+     * PostgREST and edge-function calls, e.g. `createHostedAuthResolver` (Exposify's
+     * hosted broker) to swap a long-lived `extb_...` token for a live
      * Supabase JWT. Only `authorization`/`apikey` from the result are used; a
      * missing `authorization` falls back to the anon key (unless
      * `authRequired`). Absent: the caller's own `authorization`/`apikey` are

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { createWebMcpHandler, formatFailed as formatFailed2, formatWarning as formatWarning2, startupLogEnabled } from "@exposify/core";
+import { createBrokerGate, createWebMcpHandler, formatFailed as formatFailed2, publicRequestUrl, formatWarning as formatWarning2, hostedResolverFromEnv, isHostedResolver, readEnv, startupLogEnabled } from "@exposify/core";
 
 // src/kb.ts
 import { KnowledgeBase } from "@exposify/core";
@@ -74,7 +74,7 @@ function warnOnce(message) {
   } catch {
   }
 }
-function resolveSupabaseConfig(options = {}) {
+function resolveSupabaseConfig(options = {}, hostedBroker2 = false) {
   if (options.oauth) {
     if (options.docsAuth === "public") {
       throw new Error('docsAuth: "public" cannot be combined with oauth (the whole MCP endpoint requires a token)');
@@ -88,7 +88,7 @@ function resolveSupabaseConfig(options = {}) {
     rpc: options.rpc ?? [],
     functions: options.functions ?? {},
     docs: options.docs ?? ["docs/**/*.md"],
-    docsAuth: options.docsAuth ?? (options.oauth ? "required" : "public"),
+    docsAuth: options.docsAuth ?? (options.oauth || hostedBroker2 ? "required" : "public"),
     maxRows: options.maxRows ?? 100,
     rateLimit: options.rateLimit,
     rateWindowMs: options.rateWindowMs
@@ -704,11 +704,13 @@ function logColdStart(opts) {
 }
 
 // src/index.ts
+import { completeMcpLogin, createHostedAuthResolver, hostedBroker } from "@exposify/core";
 function denoEnv() {
   return globalThis.Deno?.env;
 }
 function aiReady(options = {}) {
-  const cfg = resolveSupabaseConfig(options);
+  const brokerOn = isHostedResolver(options.auth) || !options.auth && !options.oauth && Boolean(readEnv("EXPOSIFY_KEY"));
+  const cfg = resolveSupabaseConfig(options, brokerOn);
   const fetchImpl = options.fetchImpl ?? fetch;
   const env = denoEnv();
   const supabaseUrl = options.supabaseUrl ?? env?.get("SUPABASE_URL");
@@ -718,7 +720,7 @@ function aiReady(options = {}) {
   const logReady = startupLogEnabled(options.startupLog);
   const functionName = functionNameFromMainModule();
   const endpoint = gate?.metadata.resource ?? (supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : "this function");
-  const authLabel = gate ? `oauth (${String(gate.metadata.authorization_servers[0])})` : options.auth ? "custom resolver" : "passthrough (caller's JWT)";
+  const authLabel = gate ? `oauth (${String(gate.metadata.authorization_servers[0])})` : brokerOn ? "hosted broker (EXPOSIFY_KEY)" : options.auth ? "custom resolver" : "passthrough (caller's JWT)";
   if (!supabaseUrl) {
     console.error(
       formatFailed2(LOG_PREFIX, "SUPABASE_URL is not set", "deployed functions get it automatically; for local dev pass { supabaseUrl }")
@@ -820,9 +822,21 @@ function aiReady(options = {}) {
       return result.ok ? core(req) : result.response;
     };
   }
-  const auth = options.auth;
+  const envAuth = options.auth || options.oauth ? void 0 : hostedResolverFromEnv();
+  const auth = options.auth ?? envAuth;
+  const authRequired = options.authRequired ?? (envAuth !== void 0 || isHostedResolver(auth));
   if (!auth) return core;
+  const brokerGate = authRequired ? createBrokerGate(auth) : null;
+  const functionUrl = supabaseUrl && functionName ? `${supabaseUrl.replace(/\/+$/, "")}/functions/v1/${functionName}` : null;
   return async (req) => {
+    if (brokerGate) {
+      const own = publicRequestUrl(req.url, req.headers);
+      const isPrm = own.endsWith(PRM_SUFFIX);
+      const resource = brokerGate.resourceFor(functionUrl ?? (isPrm ? own.slice(0, -PRM_SUFFIX.length) : own));
+      if (isPrm) return brokerGate.metadataResponse(req.method, resource);
+      const result = await brokerGate.check(req.headers, resource, `${resource}${PRM_SUFFIX}`);
+      if (!result.ok) return result.response;
+    }
     let resolved;
     try {
       resolved = await auth(req.headers, {});
@@ -830,7 +844,7 @@ function aiReady(options = {}) {
       console.error("exposify-supabase: auth resolver failed", err);
       return Response.json({ error: "internal MCP server error" }, { status: 503 });
     }
-    if (options.authRequired && !resolved.get("authorization")) {
+    if (authRequired && !resolved.get("authorization")) {
       return Response.json({ error: "unauthorized" }, { status: 401, headers: { "www-authenticate": "Bearer" } });
     }
     resolvedAuth.set(req, resolved);
@@ -843,8 +857,11 @@ export {
   aiReady,
   buildManifest,
   columnsFromOpenApi,
+  completeMcpLogin,
+  createHostedAuthResolver,
   fetchExposifyMeta,
   fetchOpenApi,
+  hostedBroker,
   introspectTables,
   loadManifest,
   rpcArgSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exposify/supabase",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,7 +27,7 @@
     "prepack": "yarn build"
   },
   "dependencies": {
-    "@exposify/core": "0.3.12",
+    "@exposify/core": "0.3.13",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },