tablefacts 0.1.0 → 0.2.0

package/.env.example

@@ -1,3 +1,5 @@
+# Supabase > Connect > Session pooler (this tool holds one connection and reads information_schema).
+# Bypasses row level security: keep it here, never in a browser-exposed variable.
 SUPABASE_DB_URL=SUPABASE_DB_POOLER_URL
 
 # Menus that are only pictures (tablefacts menu raw) are read by a vision model. Fill in

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.2.0
+
+- The menu importers no longer write hardcoded `public.menu_*` tables. A restaurant's config (or the
+  new `--table-prefix` flag) selects the prefixed table set, so several restaurants can share one
+  Supabase database without touching each other's tables. The shipped Cluvi and picture configs now
+  set `cannario_`/`mombasa_`, so those two commands target their prefixed tables by default.
+- New safety guards before any write: the importer checks all three target tables exist, and with no
+  prefix stops when another restaurant's prefixed `_menu_categories` tables are present
+  (`--allow-unprefixed` overrides it for a single-restaurant database).
+- `replaceAll` names the exact tables it will empty and requires `--yes`; it never runs on the
+  unprefixed tables while another restaurant's tables are present. `inspect()` reports the resolved
+  tables and the row counts it would delete.
+- `--dry-run` runs the same checks and sends only `select`s (no write transaction).
+- New options `tablePrefix`, `allowUnprefixed` and `yes` on `importMenu`/`importCluvi`/
+  `importImageMenu`; new `menuTables`/`validateTablePrefix` helpers in `src/menu/lib/tables.mjs`; the
+  result's `database` now carries `tables`.
+- Docs recommend the Supabase **Session pooler** URL and explain the prefix convention; the full model,
+  checks, errors and a migration checklist are in [`docs/MENU_TABLE_PREFIX.md`](docs/MENU_TABLE_PREFIX.md).
+
+### Research (`tablefacts research`)
+
+- New key-free web-search source (DuckDuckGo Lite, with the HTML endpoint as fallback). It runs only when
+  Google Places and OpenStreetMap find no place or no website, and its candidate links (website, Instagram,
+  TripAdvisor, Maps, link-in-bio) feed the existing "sources find each other" chain, so a bare name and place
+  no longer produces an empty report.
+- Instagram is read from the public share card, the web profile API and oEmbed, and its bio/counts are filled
+  from a search-engine snippet when a surface answers without them. Requests identify honestly: no login and
+  no user-agent impersonation; a walled profile stays blocked.
+- A blocked TripAdvisor link is kept and stated at the top of the report, and its URL slug gives a name and
+  location hint without fetching the page.
+- The CLI summary separates facts discovered from sources, values only echoed from your input, and
+  low-confidence guesses. Guesses are marked "low (guess)" and left blank in `setup-answers.txt`, so setup
+  keeps the template's placeholder.
+- Similar-name runs (e.g. "Makibar" vs "Maki Bar") are noted, and `.tablefacts/research/latest.json` points at
+  the newest report; the pointer is only written in the default output layout.
+- The report leads "Ask the client" with one prioritized next question, flattens web-sourced text so it cannot
+  forge report structure, and warns when Google returns several places with the same name.
+- New shared `decodeHtml` and `instagramHandle` helpers in the research lib, reused by the website reader.
+
 ## 0.1.0
 
 First release as an npm library.

package/README.md

@@ -4,6 +4,9 @@ Data extraction tools for restaurant sites, shared by every Cannario template. G
 place and it gathers the public facts; point it at an Instagram or TripAdvisor page and it downloads the photos;
 point it at a Cluvi menu (or pictures of a paper menu) and it loads the menu into Supabase.
 
+Research needs no key: Google Places and OpenStreetMap run first, and a key-free web search (DuckDuckGo) fills in
+candidate links when they find no place or no website, so a bare name and place still produces a useful report.
+
 Everything works two ways: as a **command line** (`tablefacts <tool>`) and as a **JavaScript library**
 (`import { research } from 'tablefacts'`). Both do the same work; the CLI is a thin layer over the functions.
 
@@ -76,8 +79,8 @@ npx tablefacts photos tripadvisor --out ./photos --dry-run <restaurant-link>
 | `--no-google` | Skip Google even if `GOOGLE_PLACES_API_KEY` is set |
 | `--out <dir>` | Output folder (default `.tablefacts/research/<slug>`; relative paths are relative to the project) |
 
-Writes `report.md`, `profile.json` and `setup-answers.txt`. Details, sources and trust rules:
-[src/research/README.md](src/research/README.md).
+Writes `report.md`, `profile.json` and `setup-answers.txt`, and keeps `latest.json` next to the `<slug>` folders
+pointing at the newest run. Details, sources and trust rules: [src/research/README.md](src/research/README.md).
 
 ### `photos instagram`
 
@@ -116,7 +119,10 @@ Both share these options (and replace the menu in Supabase unless `--dry-run`):
 | --- | --- |
 | `--dry-run` | Extract and check, show what would change, write nothing |
 | `--json <file>` | Also save the extracted menu as JSON |
-| `--replace-all` | Replace the whole menu, not only the categories in this import |
+| `--table-prefix <prefix>` | This restaurant's tables in a shared database, e.g. `makibar_` (overrides the config). Required when other restaurants' tables exist |
+| `--allow-unprefixed` | Override the shared-database check and write the unprefixed `menu_*` tables, only when this restaurant owns them |
+| `--replace-all` | Replace the whole menu, not only the categories in this import. Requires `--yes` (except with `--dry-run`) |
+| `--yes` | Confirm `--replace-all`, which empties the target tables (`<prefix>menu_categories`, `<prefix>menu_sections`, `<prefix>menu_products`) |
 | `--force` | Write even if the import has fewer than half the products it replaces |
 
 `tablefacts menu cluvi [menu-url] [--service on_table|delivery|take_away] [--lang es]`
@@ -143,7 +149,7 @@ environment win. [.env.example](.env.example) is the template.
 
 | Variable | Used by | Meaning |
 | --- | --- | --- |
-| `SUPABASE_DB_URL` | `menu cluvi`, `menu raw` | Postgres connection string (Supabase *Transaction pooler* URL, with the real password). **Bypasses row level security:** keep it in `.env`, never in a browser-exposed variable |
+| `SUPABASE_DB_URL` | `menu cluvi`, `menu raw` | Postgres connection string, with the real password. Use the **Session pooler** URL (Supabase dashboard > Connect > Session pooler): this tool holds one connection and reads `information_schema`, which the *Transaction pooler* is not meant for. **Bypasses row level security:** keep it in `.env`, never in a browser-exposed variable |
 | `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, `GROQ_API_KEY` | `menu raw` | Key of the vision provider that reads the pictures |
 | `MENU_VISION_PROVIDER` | `menu raw` | Provider when `--provider` is not given: `anthropic` (default), `gemini` or `groq` |
 | `GOOGLE_PLACES_API_KEY` | `research` | Optional. Enables Google Maps (Places API (New)); without it OpenStreetMap and the web pages still work |
@@ -188,7 +194,7 @@ default output folder, browser profiles, the menu transcription cache, and where
 | `research({ name, location, country, website, instagram, tripadvisor, linktree, photos, render, google, googleKey, env, out, projectDir, log })` | Gathers public facts; writes `profile.json`, `report.md`, `setup-answers.txt`. Returns `{ profile, notes, photos, outDir, files }` | `GOOGLE_PLACES_API_KEY` is optional; `render` needs Playwright |
 | `downloadInstagram({ links, file, out, profile, pages, cdp, edgeDir, viaGoogle, browser, userDataDir, headed, dryRun, debug, projectDir, log })` | Downloads post or profile photos (give `links`, `file` or `profile`). Returns `{ saved, skipped, failed: [{ item, reason }], found? }` | Playwright |
 | `downloadTripadvisor({ links, out, cdp, edgeDir, max, dryRun, debug, projectDir, log })` | Downloads a restaurant page's photos. Same result | Playwright |
-| `importMenu({ menu, notes, title, dryRun, json, replaceAll, force, databaseUrl, env, projectDir, log })` | Validates a menu and writes it to Supabase. Returns `{ totals, notes, written, dryRun, database }`, `database` being `{ label, current: { categories, products, kept } }` or `null` when it was not reached | `SUPABASE_DB_URL` unless `dryRun` |
+| `importMenu({ menu, notes, title, dryRun, json, tablePrefix, allowUnprefixed, replaceAll, yes, force, databaseUrl, env, projectDir, log })` | Validates a menu and writes it to Supabase. Returns `{ totals, notes, written, dryRun, database }`, `database` being `{ label, tables, current: { categories, products, kept } }` or `null` when it was not reached | `SUPABASE_DB_URL` unless `dryRun` |
 | `importCluvi({ url, service, lang, config, ...importMenu options })` | Reads a Cluvi menu, then `importMenu` | `SUPABASE_DB_URL` unless `dryRun` |
 | `importImageMenu({ urls, only, provider, model, minWidth, refresh, apiKey, config, ...importMenu options })` | Transcribes menu pictures with a vision model, then `importMenu` | A vision key (see [Configuration](#configuration)) |
 | `listMenuImages({ urls, only, minWidth, config })` | Lists the menu pictures found on pages (numbered as `--list` shows) | none |
@@ -255,7 +261,7 @@ folder tablefacts is installed in, so one install serves every template.
 | What | Where |
 | --- | --- |
 | `.env` | `<project>/.env`, then `<project>/data/.env` (older templates) |
-| Research output | `<project>/.tablefacts/research/<slug>/` |
+| Research output | `<project>/.tablefacts/research/<slug>/`, with `latest.json` next to the folders |
 | Menu transcription cache and downloaded page images | `<project>/.tablefacts/cache/<host>/` |
 | Fallback browser profile | `<project>/.tablefacts/instagram-profile` |
 | Photos | The `--out` folder you give |
@@ -266,7 +272,7 @@ hosts) are read from the template's `frontend/src/content` and skipped silently
 
 ### Supabase tables
 
-`menu cluvi` and `menu raw` write to these tables, which your project must already have (the Cannario
+`menu cluvi` and `menu raw` write to three tables, which your project must already have (the Cannario
 templates ship the migration `supabase/migrations/0001_menu.sql`):
 
 | Table | Columns written |
@@ -275,9 +281,31 @@ templates ship the migration `supabase/migrations/0001_menu.sql`):
 | `public.menu_sections` | `id` (uuid), `category_id`, `name`, `sort_order` |
 | `public.menu_products` | `section_id`, `name`, `description`, `price` (numeric), `currency`, `image_url`, `recommended`, `sort_order` |
 
+**Several restaurants can share one Supabase database.** Each restaurant then keeps its own prefixed copies
+of those three tables — `cannario_menu_categories`, `cannario_menu_sections`, `cannario_menu_products`, and
+likewise `mombasa_menu_*` and `makibar_menu_*` — while the unprefixed `menu_*` tables belong to a single,
+older site. Set the restaurant's prefix in its `config.mjs` (`tablePrefix: "makibar_"`) or pass
+`--table-prefix makibar_`; the flag overrides the config. The prefix must be lowercase letters, digits and
+underscores ending in `_`, or empty.
+
+Before it writes anything, the importer **checks which menu tables exist**:
+
+- all three target tables must exist, or it stops and names the ones missing (apply the migration);
+- with **no prefix**, it lists every `public` table ending in `_menu_categories`. If another restaurant's
+  prefixed set exists, it stops with `ECONFIG` and names those tables, so an import cannot silently write
+  into the wrong site. `--allow-unprefixed` overrides that check, and is only correct when this restaurant
+  really owns the unprefixed tables.
+
 The write is **one transaction** and replaces only the categories in the import (their sections and products go
-with them), so re-running never duplicates. `--replace-all` empties the whole menu first. An import with no
-products, or with under half the products it replaces, is refused unless `--force`. Always run `--dry-run` first.
+with them), so re-running never duplicates. The run prints the resolved target tables and the row counts it
+would delete. `--replace-all` empties the whole menu and is refused without `--yes`; it also names the exact
+tables it will empty, and never runs on the unprefixed tables while another restaurant's tables are present.
+An import with no products, or with under half the products it replaces, is refused unless `--force`. Always
+run `--dry-run` first: it runs the same checks and prints what would be written without opening a write
+transaction (only `select`s are sent).
+
+The full model — prefix rules, every check, the error codes and how to migrate a restaurant to its own prefixed
+tables — is in [docs/MENU_TABLE_PREFIX.md](docs/MENU_TABLE_PREFIX.md).
 
 ## Limits
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tablefacts",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Data extraction tools for restaurant sites: public-facts research, photos (Instagram, TripAdvisor) and menu import",
   "keywords": [
     "restaurant",
@@ -61,7 +61,7 @@
     "pg": "^8.23.1"
   },
   "devDependencies": {
-    "@types/node": "^24.19.1",
+    "@types/node": "^26.6.4",
     "playwright": "^1.63.0",
     "typescript": "^7.0.2",
     "vitest": "^5.0.3"

package/src/lib/types.mjs

@@ -137,7 +137,10 @@
  * @typedef {object} ImportOptions
  * @property {boolean} [dryRun] Check and report, write nothing.
  * @property {string} [json] Also save the extracted menu as JSON at this path (resolved against projectDir).
- * @property {boolean} [replaceAll] Replace the whole menu, not only the categories in this import.
+ * @property {string} [tablePrefix] This restaurant's table prefix (e.g. "makibar_"); empty for the unprefixed menu_* tables. Default "": importCluvi/importImageMenu fall back to the source config's.
+ * @property {boolean} [allowUnprefixed] Write the unprefixed menu_* tables even when other restaurants' prefixed tables exist. Only for a single-restaurant database.
+ * @property {boolean} [yes] Confirm a destructive `replaceAll`, which empties the target tables.
+ * @property {boolean} [replaceAll] Replace the whole menu, not only the categories in this import. Needs `yes`.
  * @property {boolean} [force] Write even if the import has far fewer products than it replaces.
  * @property {string} [databaseUrl] Default: env.SUPABASE_DB_URL.
  * @property {Env} [env] Environment the database URL and keys are read from. Default process.env.
@@ -151,7 +154,7 @@
  * @property {string[]} notes
  * @property {boolean} written
  * @property {boolean} dryRun
- * @property {{ label: string, current: { categories: number, products: number, kept: string[] } } | null} database Null when the database was not reached.
+ * @property {{ label: string, tables: string[], current: { categories: number, products: number, kept: string[] } } | null} database Null when the database was not reached.
  */
 
 /**
@@ -161,6 +164,7 @@
 /**
  * Restaurant-specific part of the Cluvi source (src/menu/cluvi/config.mjs).
  * @typedef {object} CluviConfig
+ * @property {string} [tablePrefix] This restaurant's table prefix in a shared database (e.g. "cannario_"); empty for the unprefixed menu_* tables.
  * @property {string} [url] Any page of the restaurant's Cluvi menu.
  * @property {{ slug: string, name: string, from: string[] }[]} [categories] Cluvi main categories folded into each site category.
  * @property {Record<string, string>} [sections] Cluvi subcategory to section name.
@@ -169,6 +173,7 @@
 /**
  * Restaurant-specific part of the picture-menu source (src/menu/raw/config.mjs).
  * @typedef {object} RawConfig
+ * @property {string} [tablePrefix] This restaurant's table prefix in a shared database (e.g. "mombasa_"); empty for the unprefixed menu_* tables.
  * @property {string} [url] Page with the menu pictures, or a direct image URL.
  * @property {string} currency ISO code of the prices.
  * @property {string} [thousands] Thousands separator the menu prints. Default ".".

package/src/menu/README.md

@@ -22,26 +22,50 @@ await importCluvi({
 const pictures = await listMenuImages({ urls: ['https://example.com/carta'], config: { currency: 'COP' } })
 ```
 
-- **Cluvi `config`**: `{ url?, categories: [{ slug, name, from[] }], sections: { 'Cluvi subcategory': 'SECTION NAME' } }`.
-- **Picture `config`**: `{ url?, currency, thousands, decimal, scale, categories: [{ slug, name, groups: ['food' | 'drink'] }], placeIn, sections, skipSections }`. `currency` is required.
-- **Options every import takes**: `dryRun`, `json` (relative paths resolve against `projectDir`), `replaceAll`, `force`, `databaseUrl` (default `env.SUPABASE_DB_URL`), `env`, `projectDir` and `log(message, level)` (`'info'`, `'warn'` for notes, `'error'`).
-- **Result**: `{ totals, notes, written, dryRun, database }`; `database` is `{ label, current: { categories, products, kept } }` once the database was inspected, and `null` when it was not reached (a dry run without a URL).
-- **Errors** are `TablefactsError`: `ECONFIG` (no URL, unknown provider, no key, bad currency), `EFAILED` (invalid menu, no products, import refused without `force`), `EUSAGE` (bad `only`). `err.option` names the option; the CLI shows the flag (`--force`, `--only`) and exits `2` for `EUSAGE`, `1` otherwise.
+- **Cluvi `config`**: `{ tablePrefix?, url?, categories: [{ slug, name, from[] }], sections: { 'Cluvi subcategory': 'SECTION NAME' } }`.
+- **Picture `config`**: `{ tablePrefix?, url?, currency, thousands, decimal, scale, categories: [{ slug, name, groups: ['food' | 'drink'] }], placeIn, sections, skipSections }`. `currency` is required.
+- **Options every import takes**: `dryRun`, `json` (relative paths resolve against `projectDir`), `tablePrefix` (overrides the config's; the restaurant's table set on a shared database), `allowUnprefixed` (override the shared-database check and write the unprefixed `menu_*` tables, only when this restaurant owns them), `replaceAll`, `yes` (confirms a whole-menu `replaceAll`), `force`, `databaseUrl` (default `env.SUPABASE_DB_URL`), `env`, `projectDir` and `log(message, level)` (`'info'`, `'warn'` for notes, `'error'`).
+- **Result**: `{ totals, notes, written, dryRun, database }`; `database` is `{ label, tables, current: { categories, products, kept } }` once the database was inspected, and `null` when it was not reached (a dry run without a URL).
+- **Errors** are `TablefactsError`: `ECONFIG` (no URL, unknown provider, no key, bad currency, a bad `tablePrefix`, another restaurant's tables on an unprefixed import), `EFAILED` (invalid menu, no products, import refused without `force`), `EUSAGE` (bad `only`, `replaceAll` without `yes`). `err.option` names the option; the CLI shows the flag (`--force`, `--only`) and exits `2` for `EUSAGE`, `1` otherwise.
 
 ## Setup
 
 1. Install the package in the project (`npm install --save-dev tablefacts`); it brings `pg`. Run the commands from the project's folder.
 2. Apply the migration to your Supabase project.
-3. `cp .env.example .env` and set `SUPABASE_DB_URL` to the pooler URL from the Supabase dashboard (Connect > Transaction pooler), with the real password.
+3. `cp .env.example .env` and set `SUPABASE_DB_URL` to the pooler URL from the Supabase dashboard (Connect > **Session pooler**), with the real password. Use the Session pooler, not the Transaction pooler: the importer holds one connection and reads `information_schema`. On a shared database, also set `tablePrefix` in the source's `config.mjs` (below).
 
 `SUPABASE_DB_URL` bypasses row level security. It stays in `.env` (git-ignored). Never copy it into a browser-exposed variable (such as `NEXT_PUBLIC_*`): the site only uses the publishable key.
 
+## Shared database
+
+Several restaurants can live in one Supabase project. Each then owns prefixed tables — `cannario_menu_*`,
+`mombasa_menu_*`, `makibar_menu_*` — and the unprefixed `menu_*` tables belong to a different, older site.
+Set the restaurant's `tablePrefix` in its `config.mjs`, or pass `--table-prefix <prefix>` for one run (the
+flag wins). The prefix may be empty, or lowercase letters, digits and underscores ending in `_`.
+
+Before any write the importer:
+
+- checks all three prefixed tables exist, or stops naming the missing ones and the migration to apply;
+- with **no prefix**, lists the `public` tables ending in `_menu_categories` and, if another restaurant's set
+  is there, stops with an `ECONFIG` error that names them — rather than guessing which tables are yours.
+  `--allow-unprefixed` overrides that check only when this restaurant owns the unprefixed tables;
+- prints the resolved table names and the row counts it would delete, and refuses `--replace-all` without
+  `--yes`. A whole-menu replace never runs on the unprefixed tables while another restaurant's tables exist.
+
+`--dry-run` runs all of these checks and prints what would be written, but only sends `select`s (no `begin`).
+
+The full model — prefix rules, every check, the error codes and a migration checklist — is in
+[docs/MENU_TABLE_PREFIX.md](../../docs/MENU_TABLE_PREFIX.md).
+
 ## Run (Cluvi)
 
 ```bash
-tablefacts menu cluvi --dry-run        # extract and check, show what would change, write nothing
-tablefacts menu cluvi                     # replace the menu in Supabase
-tablefacts menu cluvi <menu-url>       # another restaurant
+tablefacts menu cluvi --dry-run                     # extract and check, show what would change, write nothing
+tablefacts menu cluvi                               # replace this restaurant's menu in Supabase
+tablefacts menu cluvi <menu-url>                    # another restaurant
+tablefacts menu cluvi --table-prefix makibar_       # override the config's table prefix for one run
+tablefacts menu cluvi --replace-all --yes           # empty this restaurant's tables first, then write
+tablefacts menu cluvi --allow-unprefixed            # the unprefixed menu_* tables (single-restaurant database only)
 tablefacts menu cluvi --help
 ```
 
@@ -64,8 +88,10 @@ tablefacts menu raw --list                 # show the pictures found; no key nee
 tablefacts menu raw --dry-run              # read the pages, show the menu and the checks, write nothing
 tablefacts menu raw --only 3,9 --dry-run   # try two pages first
 tablefacts menu raw --provider gemini --dry-run   # the same, read by Gemini
-tablefacts menu raw                           # replace the menu in Supabase
+tablefacts menu raw                           # replace this restaurant's menu in Supabase
 tablefacts menu raw <page-or-image-url>... # another restaurant
+tablefacts menu raw --table-prefix makibar_ # override the config's table prefix for one run
+tablefacts menu raw --replace-all --yes     # empty this restaurant's tables first, then write
 ```
 
 Edit `raw/config.mjs` first: the URL, the currency, how the menu prints prices (`$95.000` is `thousands: "."`, `decimal: ","`) and which category each section goes to.
@@ -81,7 +107,7 @@ Edit `raw/config.mjs` first: the URL, the currency, how the menu prints prices (
 ## What it does (Cluvi)
 
 - Cluvi main category > site category, subcategory > section (name in UPPERCASE), product > product. Products keep the order Cluvi shows (its `order` field). Cluvi's "important" flag is `recommended`. Descriptions are converted from HTML to text.
-- The write is one transaction. By default only the categories in the import are replaced (their sections and products with them), so re-running never duplicates. `--replace-all` replaces the whole menu, which also removes the template's sample categories.
+- The write is one transaction. By default only the categories in the import are replaced (their sections and products with them), so re-running never duplicates. `--replace-all` empties the whole menu first, which also removes the template's sample categories; it needs `--yes` and is refused when it would empty the unprefixed tables on a shared database.
 - It refuses an import with no products, or with under half the products it replaces (`--force` overrides), so a broken extraction cannot empty the menu.
 - Photos stay on Cluvi's CDN: `image_url` holds the Cluvi URL, and your site must allow `images.cluvi.com` and `images-mini.cluvi.com` as image hosts (a template with `menuImageHosts` in `frontend/src/content/site.ts` gets a warning from the run when they are missing). If the restaurant leaves Cluvi, the photos must be re-hosted (Supabase Storage needs a different credential than the DB URL).
 

package/src/menu/cluvi/config.mjs

@@ -1,6 +1,12 @@
 // Everything restaurant-specific about the Cluvi import. Edit this file, not
 // source.mjs, when the menu is organised differently.
 export default {
+  // This restaurant's tables in a shared Supabase database: the import writes
+  // public.cannario_menu_categories / _menu_sections / _menu_products. Change
+  // it (or pass `--table-prefix`) when importing another restaurant; leave it
+  // empty only when this restaurant owns the unprefixed menu_* tables.
+  tablePrefix: "cannario_",
+
   // Any page of the restaurant's Cluvi menu. Only the first path segment is
   // used (the supplier, here "cannario"). `tablefacts menu cluvi <url>`
   // overrides it for one run.

package/src/menu/cluvi/import.mjs

@@ -17,6 +17,8 @@ export async function fetchCluviMenu({ url, service, lang, config = defaultConfi
     menu,
     notes,
     title: `Cluvi: ${supplier.label} (id ${supplier.id}), ${fetched.service} menu in ${currency}`,
+    // The restaurant's own table set, so a shared database is never touched by accident.
+    tablePrefix: config.tablePrefix,
   };
 }
 
@@ -25,6 +27,8 @@ export async function fetchCluviMenu({ url, service, lang, config = defaultConfi
  * @param {import('../../lib/types.mjs').ImportCluviOptions} [options]
  * @returns {Promise<import('../../lib/types.mjs').ImportResult>}
  */
-export async function importCluvi({ url, service, lang, config, ...importOptions } = {}) {
-  return importMenu({ ...(await fetchCluviMenu({ url, service, lang, config })), ...importOptions });
+export async function importCluvi({ url, service, lang, config = defaultConfig, ...importOptions } = {}) {
+  const fetched = await fetchCluviMenu({ url, service, lang, config });
+  // An explicit `tablePrefix` (or the CLI's --table-prefix) wins over the config's.
+  return importMenu({ ...fetched, ...importOptions, tablePrefix: importOptions.tablePrefix ?? config.tablePrefix });
 }

package/src/menu/lib/db.mjs

@@ -1,5 +1,8 @@
 // Writes a menu (see lib/menu.mjs) into the Supabase tables of
 // supabase/migrations/0001_menu.sql over a direct Postgres connection.
+// The tables are the restaurant's own set (lib/tables.mjs): on a shared
+// database each restaurant has a `<prefix>_menu_*` set, and assertTarget()
+// refuses to guess before anything is written.
 //
 // The connection string (SUPABASE_DB_URL) is a privileged credential: it
 // bypasses row level security, which only allows public reads. It lives in
@@ -8,6 +11,7 @@
 import { randomUUID } from "node:crypto";
 import { resolveEnv } from "../../lib/env.mjs";
 import { TablefactsError } from "../../lib/errors.mjs";
+import { menuTables, validateTablePrefix } from "./tables.mjs";
 
 /** Opens the connection. `label` names the target without the credentials. */
 export async function connect(url, { env } = {}) {
@@ -15,7 +19,7 @@ export async function connect(url, { env } = {}) {
   if (!/^postgres(ql)?:\/\//i.test(url ?? "")) {
     throw new TablefactsError(
       "SUPABASE_DB_URL is not set to a postgres:// connection string.\n" +
-        "Copy .env.example to .env and paste the pooler URL from the Supabase dashboard (Connect > Transaction pooler).",
+        "Copy .env.example to .env and paste the pooler URL from the Supabase dashboard (Connect > Session pooler).",
       "ECONFIG",
     );
   }
@@ -42,31 +46,89 @@ export async function connect(url, { env } = {}) {
 }
 
 /** Says what is wrong when the migration has not been applied to this database. */
-function explain(error) {
+function explain(error, tables) {
   if (error.code === "42P01") {
-    error.message = "The menu tables do not exist. Apply supabase/migrations/0001_menu.sql to this database first.";
+    error.message = `The menu tables do not exist. Apply supabase/migrations/0001_menu.sql to this database first (expected ${Object.values(tables).join(", ")}).`;
   }
   return error;
 }
 
+/**
+ * Refuses to touch another site's tables before anything is written.
+ *
+ * Checks the three target tables exist (pointing at the migration when they do not). Then, when
+ * no prefix is set, lists the other restaurants' `<prefix>_menu_categories` tables: any of them
+ * means this database is shared, so the import stops unless the caller confirmed it targets the
+ * one unprefixed set with `allowUnprefixed`. A whole-menu `replaceAll` is refused in that case
+ * whatever the flags say, because deleting every unprefixed row could destroy another site.
+ * Only reads; returns `{ prefix, tables, others }`.
+ * @param {any} client
+ * @param {{ tablePrefix?: string, allowUnprefixed?: boolean, replaceAll?: boolean }} [options]
+ */
+export async function assertTarget(client, { tablePrefix = "", allowUnprefixed = false, replaceAll = false } = {}) {
+  const prefix = validateTablePrefix(tablePrefix);
+  const tables = menuTables(prefix);
+  const short = Object.values(tables).map((name) => name.replace(/^public\./, ""));
+
+  const { rows } = await client.query(
+    "select table_name from information_schema.tables where table_schema = 'public' and table_name = any($1::text[])",
+    [short],
+  );
+  const present = new Set(rows.map((row) => row.table_name));
+  const missing = short.filter((name) => !present.has(name));
+  if (missing.length) {
+    throw new TablefactsError(
+      `The menu tables do not exist. Apply supabase/migrations/0001_menu.sql to this database first (expected ${Object.values(tables).join(", ")}; missing ${missing.map((name) => `public.${name}`).join(", ")}).`,
+      "ECONFIG",
+    );
+  }
+
+  if (prefix) return { prefix, tables, others: [] };
+
+  // `_` is a LIKE wildcard, so the query is only a coarse filter: it can also return names such as
+  // "xmenu_categories". The endsWith check keeps only real `<prefix>_menu_categories` tables (and
+  // excludes the unprefixed "menu_categories" itself); without it a table like "xmenu_categories"
+  // would be mistaken for another restaurant's set.
+  const existing = await client.query(
+    "select table_name from information_schema.tables where table_schema = 'public' and table_name like '%_menu_categories' order by table_name",
+  );
+  const others = existing.rows.map((row) => row.table_name).filter((name) => name.endsWith("_menu_categories"));
+  if (!others.length) return { prefix, tables, others };
+
+  if (replaceAll) {
+    throw new TablefactsError(
+      `Refusing to replace the whole menu: this database has other restaurants' menu tables (${others.join(", ")}). Set \`tablePrefix\` in your config so the delete targets only this restaurant's tables.`,
+      "ECONFIG",
+    );
+  }
+  if (!allowUnprefixed) {
+    throw new TablefactsError(
+      `This database has other restaurants' menu tables (${others.join(", ")}). Set tablePrefix in your config or pass --table-prefix so the import cannot touch the wrong tables.`,
+      "ECONFIG",
+    );
+  }
+  return { prefix, tables, others };
+}
+
 /** What an import would replace: the categories it writes, or the whole menu. */
-export async function inspect(client, menu, { replaceAll = false } = {}) {
+export async function inspect(client, menu, { replaceAll = false, tablePrefix = "" } = {}) {
+  const tables = menuTables(tablePrefix);
   const slugs = replaceAll ? null : menu.map((category) => category.slug);
   try {
     const { rows } = await client.query(
       `select count(distinct c.id)::int as categories, count(p.id)::int as products
-         from public.menu_categories c
-         left join public.menu_sections s on s.category_id = c.id
-         left join public.menu_products p on p.section_id = s.id
+         from ${tables.categories} c
+         left join ${tables.sections} s on s.category_id = c.id
+         left join ${tables.products} p on p.section_id = s.id
         where $1::text[] is null or c.slug = any($1)`,
       [slugs],
     );
     const kept = slugs
-      ? (await client.query("select slug from public.menu_categories where slug <> all($1) order by sort_order", [slugs])).rows.map((row) => row.slug)
+      ? (await client.query(`select slug from ${tables.categories} where slug <> all($1) order by sort_order`, [slugs])).rows.map((row) => row.slug)
       : [];
     return { ...rows[0], kept };
   } catch (error) {
-    throw explain(error);
+    throw explain(error, tables);
   }
 }
 
@@ -75,9 +137,11 @@ export async function inspect(client, menu, { replaceAll = false } = {}) {
  * one and a failure changes nothing. By default only the categories in `menu`
  * are replaced (deleting a category cascades to its sections and products);
  * `replaceAll` empties the menu first. Ids are generated here so the rows can
- * be inserted in bulk, a column at a time.
+ * be inserted in bulk, a column at a time. `tablePrefix` is the restaurant's
+ * own table set; the delete is scoped to it, never to another site's tables.
  */
-export async function replaceMenu(client, menu, { replaceAll = false } = {}) {
+export async function replaceMenu(client, menu, { replaceAll = false, tablePrefix = "" } = {}) {
+  const tables = menuTables(tablePrefix);
   const categories = menu.map((c, i) => ({ id: randomUUID(), slug: c.slug, name: c.name, sort_order: i + 1 }));
   const sections = menu.flatMap((c, ci) =>
     c.sections.map((s, si) => ({ id: randomUUID(), category_id: categories[ci].id, name: s.name, sort_order: si + 1, products: s.products })),
@@ -88,20 +152,20 @@ export async function replaceMenu(client, menu, { replaceAll = false } = {}) {
 
   try {
     await client.query("begin");
-    if (replaceAll) await client.query("delete from public.menu_categories");
-    else await client.query("delete from public.menu_categories where slug = any($1::text[])", [column(categories, "slug")]);
+    if (replaceAll) await client.query(`delete from ${tables.categories}`);
+    else await client.query(`delete from ${tables.categories} where slug = any($1::text[])`, [column(categories, "slug")]);
 
     const inserted = [
       await client.query(
-        "insert into public.menu_categories (id, slug, name, sort_order) select * from unnest($1::uuid[], $2::text[], $3::text[], $4::int[])",
+        `insert into ${tables.categories} (id, slug, name, sort_order) select * from unnest($1::uuid[], $2::text[], $3::text[], $4::int[])`,
         ["id", "slug", "name", "sort_order"].map((key) => column(categories, key)),
       ),
       await client.query(
-        "insert into public.menu_sections (id, category_id, name, sort_order) select * from unnest($1::uuid[], $2::uuid[], $3::text[], $4::int[])",
+        `insert into ${tables.sections} (id, category_id, name, sort_order) select * from unnest($1::uuid[], $2::uuid[], $3::text[], $4::int[])`,
         ["id", "category_id", "name", "sort_order"].map((key) => column(sections, key)),
       ),
       await client.query(
-        `insert into public.menu_products (section_id, name, description, price, currency, image_url, recommended, sort_order)
+        `insert into ${tables.products} (section_id, name, description, price, currency, image_url, recommended, sort_order)
          select * from unnest($1::uuid[], $2::text[], $3::text[], $4::numeric[], $5::text[], $6::text[], $7::boolean[], $8::int[])`,
         ["section_id", "name", "description", "price", "currency", "image_url", "recommended", "sort_order"].map((key) => column(products, key)),
       ),
@@ -114,6 +178,6 @@ export async function replaceMenu(client, menu, { replaceAll = false } = {}) {
     return { categories: categories.length, sections: sections.length, products: products.length };
   } catch (error) {
     await client.query("rollback").catch(() => {});
-    throw explain(error);
+    throw explain(error, tables);
   }
 }

package/src/menu/lib/import.mjs

@@ -7,8 +7,9 @@ import { resolveEnv } from "../../lib/env.mjs";
 import { optionError, TablefactsError } from "../../lib/errors.mjs";
 import { normalizeLog } from "../../lib/log.mjs";
 import { projectRoot, resolveIn } from "../../lib/project.mjs";
-import { connect, inspect, replaceMenu } from "./db.mjs";
+import { assertTarget, connect, inspect, replaceMenu } from "./db.mjs";
 import { countMenu, validateMenu } from "./menu.mjs";
+import { validateTablePrefix } from "./tables.mjs";
 
 /** Things the site needs that this menu does not give it, read from the template's own files. */
 export async function templateHints(menu, { projectDir } = {}) {
@@ -67,6 +68,9 @@ export async function importMenu({
   json,
   replaceAll = false,
   force = false,
+  tablePrefix = "",
+  allowUnprefixed = false,
+  yes = false,
   databaseUrl,
   env,
   projectDir,
@@ -74,6 +78,8 @@ export async function importMenu({
 } = {}) {
   const log = normalizeLog(logOption);
   databaseUrl ??= resolveEnv(env).SUPABASE_DB_URL;
+  // Before anything is opened: an invalid prefix must never reach the SQL builder.
+  const prefix = validateTablePrefix(tablePrefix);
   let client;
   try {
     validateMenu(menu);
@@ -98,14 +104,25 @@ export async function importMenu({
       log("\nDry run: SUPABASE_DB_URL is not set, so the database was not checked. Nothing was written.", "warn");
       return result;
     }
+    // A whole-menu replace empties every row of the target tables: it needs an explicit confirmation.
+    if (replaceAll && !yes && !dryRun) {
+      throw optionError("yes", "`replaceAll` empties every row in the target tables and needs confirmation: pass `yes`.", "EUSAGE");
+    }
+
+    // Only the fields that are set: this keeps the default call shape unchanged for callers and tests.
+    const scope = { replaceAll: !!replaceAll, ...(prefix ? { tablePrefix: prefix } : {}) };
 
-    const scope = { replaceAll: !!replaceAll };
     let label;
     ({ client, label } = await connect(databaseUrl, { env }));
+    const target = await assertTarget(client, { tablePrefix: prefix, allowUnprefixed: !!allowUnprefixed, replaceAll: !!replaceAll });
     const current = await inspect(client, menu, scope);
-    result.database = { label, current };
+    result.database = { label, tables: Object.values(target.tables), current };
     log(`\nDatabase ${label}`);
+    log(`  Target tables: ${Object.values(target.tables).join(", ")}`);
     log(`  ${scope.replaceAll ? "Replaces the whole menu" : `Replaces the categories this import writes`}: ${current.categories} categories and ${current.products} products now, ${totals.categories} and ${totals.products} after.`);
+    if (scope.replaceAll) {
+      log(`  --replace-all will empty ${target.tables.categories}, ${target.tables.sections} and ${target.tables.products} (${current.categories} categories, ${current.products} products).`, "warn");
+    }
     if (current.kept.length) log(`  Left untouched (not part of this import): ${current.kept.join(", ")}. Use \`replaceAll\` to remove them.`, "warn");
 
     if (current.products > 0 && totals.products < current.products / 2 && !force) {

package/src/menu/lib/run.mjs

@@ -12,6 +12,9 @@ export const menuFlags = {
   provider: "--provider",
   model: "--model",
   minWidth: "--min-width",
+  tablePrefix: "--table-prefix <prefix>",
+  allowUnprefixed: "--allow-unprefixed",
+  yes: "--yes",
   replaceAll: "--replace-all",
   force: "--force",
   dryRun: "--dry-run",
@@ -34,7 +37,10 @@ const commonOptions = `
 Options:
   --dry-run       extract and check, show what would change, write nothing
   --json <file>   also save the extracted menu as JSON
+  --table-prefix <prefix>  this restaurant's table prefix (e.g. makibar_); overrides the config
+  --allow-unprefixed       write the unprefixed menu_* tables on a single-restaurant database
   --replace-all   replace the whole menu, not only the categories in this import
+  --yes           confirm --replace-all (it empties the target tables)
   --force         write even if the import has far fewer products than it replaces
   -h, --help      show this help
 
@@ -54,7 +60,10 @@ export async function runImport({ usage, options = {}, fetchMenu }) {
       options: {
         "dry-run": { type: "boolean" },
         json: { type: "string" },
+        "table-prefix": { type: "string" },
+        "allow-unprefixed": { type: "boolean" },
         "replace-all": { type: "boolean" },
+        yes: { type: "boolean" },
         force: { type: "boolean" },
         help: { type: "boolean", short: "h" },
         ...options,
@@ -67,12 +76,18 @@ export async function runImport({ usage, options = {}, fetchMenu }) {
 
     loadEnv();
     const fetched = await fetchMenu({ values, positionals });
+    // `tablePrefix` is only passed when the flag is given, so it overrides the source's config
+    // instead of replacing it with undefined.
+    const overrides = values["table-prefix"] === undefined ? {} : { tablePrefix: values["table-prefix"] };
     await importMenu({
       ...fetched,
       dryRun: !!values["dry-run"],
       json: values.json,
       replaceAll: !!values["replace-all"],
       force: !!values.force,
+      allowUnprefixed: !!values["allow-unprefixed"],
+      yes: !!values.yes,
+      ...overrides,
       log: cliLog,
     });
   } catch (error) {