[meal-planning] Shared server can't deploy as shipped (route pattern + reserved secret prefix) + RLS doc inconsistency in family-calendar

[homeacc]

Which contribution?

extensions/meal-planning

What happened?

Context

I built OB1 from a frozen checkout at 6779106 on a clean Supabase project, following the curated extension path end to end (foundation → agent-memory → extensions 1–6). Everything works as documented except the meal-planning shared server, which cannot deploy as shipped. Each finding below was verified live on Supabase Edge Functions.

1. Shared server route never matches — every request 404s

extensions/meal-planning/shared-server.ts (line 23) registers:

app.post("/mcp", async (c) => {

The Edge Functions runtime keeps the function-name prefix in the request path, so the Hono route /mcp never matches — every POST returns 404 (and with no GET route, health checks 404 too). The main server already uses the correct pattern (extensions/meal-planning/index.ts, line 9):

app.post("*", async (c) => {

Fix (1 line): change app.post("/mcp", ...) to app.post("*", ...) in shared-server.ts.

2. Secret name uses the reserved SUPABASE_ prefix — the CLI refuses to set it

shared-server.ts (line 32) reads:

Deno.env.get("SUPABASE_HOUSEHOLD_KEY")!

but the Supabase CLI rejects creating that secret:

Env name cannot start with SUPABASE_, skipping: SUPABASE_HOUSEHOLD_KEY

so the documented deploy path can never provide the key. Fix (1 line + README): rename it, e.g. HOUSEHOLD_SUPABASE_KEY, in code and docs.

3. Doc inconsistency: RLS claim in the family-calendar README

extensions/family-calendar/README.md (line 26) says:

This extension doesn't use Row Level Security. RLS is introduced in Extension 4 (Meal Planning), where shared household access makes it necessary. Extensions 1-3 are single-user systems.

But extensions 1 and 2 already ship full RLS: both household-knowledge/schema.sql and home-maintenance/schema.sql ENABLE ROW LEVEL SECURITY with complete per-user policies. Only family-calendar lacks RLS. Suggest rewording (e.g. "Extensions 1-2 include RLS; this extension omits it for simplicity").

---

Happy to open a PR with the two 1-line fixes if useful.

---

Generated by Claude Code

What did you expect?

Shared server deploys and responds as documented in the README. Also, the family-calendar README note about RLS should match what the schemas actually ship.

Steps to reproduce

1. Deploy extensions/meal-planning/shared-server.ts as a Supabase Edge Function per the meal-planning README.
2. Try to set its secret: supabase secrets set SUPABASE_HOUSEHOLD_KEY=... — the CLI rejects it ("Env name cannot start with SUPABASE_").
3. POST to the deployed function URL — every request returns 404, because the Hono route is "/mcp" while the Edge runtime keeps the function-name prefix in the path.

Environment

• Supabase CLI 2.98.2, Edge Functions (Deno)
• OB1 at commit 6779106