1tube 0.1.41 → 0.1.42

package/deno.lock

@@ -20,8 +20,8 @@
     "npm:es-module-lexer@2": "2.1.0",
     "npm:esbuild@~0.25.5": "0.25.12",
     "npm:esbuild@~0.28.1": "0.28.1",
-    "npm:hono@4": "4.12.25",
-    "npm:hono@^4.12.25": "4.12.25",
+    "npm:hono@4": "4.12.27",
+    "npm:hono@^4.12.27": "4.12.27",
     "npm:typescript@latest": "6.0.3",
     "npm:zod@^3.23.0": "3.25.76"
   },
@@ -515,8 +515,8 @@
         "resolve-pkg-maps"
       ]
     },
-    "hono@4.12.25": {
-      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ=="
+    "hono@4.12.27": {
+      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q=="
     },
     "jiti@2.6.1": {
       "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
@@ -555,7 +555,7 @@
       "dependencies": [
         "npm:drizzle-kit@1.0.0-rc.3",
         "npm:drizzle-orm@1.0.0-rc.3",
-        "npm:hono@^4.12.25"
+        "npm:hono@^4.12.27"
       ]
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",
@@ -62,7 +62,7 @@
   },
   "dependencies": {
     "drizzle-orm": "1.0.0-rc.3",
-    "hono": "^4.12.25"
+    "hono": "^4.12.27"
   },
   "devDependencies": {
     "drizzle-kit": "1.0.0-rc.3"

package/src/backends/deno/worker-host.ts

@@ -63,8 +63,20 @@ export interface DenoWorkerHostOptions {
   supervisor: FunctionSupervisor;
   /** Debounce window in ms for batched fs change events. Defaults to 200ms. */
   debounceMs?: number;
-  /** Max concurrent worker spawns at boot/reload. Defaults to 8. */
+  /**
+   * Max concurrent worker spawns at boot/reload. Defaults to the host's
+   * CPU count clamped to [8, 16] so multi-core dev machines boot a large
+   * function set faster, while smaller boxes keep the historical 8.
+   */
   concurrency?: number;
+  /**
+   * Grace window (ms) granted to a superseded worker on HMR reload so its
+   * in-flight requests can finish before it is terminated. The fresh
+   * worker already serves new traffic, so the reload never waits on this
+   * — it runs in the background. Defaults to 10000; 0 reverts to the
+   * legacy "terminate immediately" behaviour (drops in-flight responses).
+   */
+  reloadDrainMs?: number;
   /**
    * Parsed `imports` from the host project's deno.json. Forwarded to the
    * dep-graph so import-map aliases resolve to the right file URLs. Optional.
@@ -166,6 +178,44 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
     const pending = new Map<number, PendingRequest>();
     let nextId = 1;
     let booted = false;
+    let terminated = false;
+
+    // Graceful-drain plumbing. `drainWaiters` are notified whenever a
+    // pending request settles (so a `terminate({ drainMs })` can finish
+    // the moment the worker goes idle) AND on hard termination (so an
+    // in-flight drain resolves instead of leaking timers). `drainTimers`
+    // tracks the drain's own timers so hard termination can cancel them.
+    const drainWaiters = new Set<() => void>();
+    const drainTimers = new Set<number>();
+
+    /** Fire drain waiters once the worker has no in-flight requests left. */
+    const notifyDrained = () => {
+      if (pending.size !== 0 || drainWaiters.size === 0) return;
+      for (const w of [...drainWaiters]) w();
+    };
+
+    /**
+     * Immediate teardown: kill the worker, reject everything still
+     * pending, and release any drain waiters. Idempotent — safe to call
+     * from the crash handler, a drain timeout, or host.stop() racing an
+     * in-flight drain.
+     */
+    const hardTerminate = () => {
+      if (terminated) return;
+      terminated = true;
+      try {
+        worker.terminate();
+      } catch { /* already dead */ }
+      for (const p of pending.values()) {
+        p.reject(new Error(`Worker for "${opts.name}" terminated`));
+      }
+      pending.clear();
+      for (const t of drainTimers) clearTimeout(t);
+      drainTimers.clear();
+      const waiters = [...drainWaiters];
+      drainWaiters.clear();
+      for (const w of waiters) w();
+    };
 
     const finishBoot = (handle: InternalHandle) => {
       booted = true;
@@ -190,9 +240,13 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
           new Error(`Worker for "${opts.name}" failed to start: ${message}`),
         );
       } else {
-        // Drain any in-flight callers — the worker is dead.
+        // Crashed after boot — reject in-flight callers with the real
+        // error, then mark the worker terminated so later dispatches
+        // fast-fail and any graceful drain in progress resolves instead
+        // of hanging on a dead worker.
         for (const p of pending.values()) p.reject(new Error(message));
         pending.clear();
+        hardTerminate();
       }
       e.preventDefault?.();
     };
@@ -216,6 +270,13 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
             if (signal.aborted) {
               throw new DOMException("Aborted", "AbortError");
             }
+            if (terminated) {
+              // Worker already torn down (HMR drain grace expired, a
+              // crash, or shutdown). Fail fast with a clear signal rather
+              // than posting into a dead worker and stalling until the
+              // request timeout fires.
+              throw new Error(`Worker for "${opts.name}" terminated`);
+            }
             const id = nextId++;
             const headers: Array<[string, string]> = [];
             req.headers.forEach((v, k) => headers.push([k, v]));
@@ -231,6 +292,7 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
               if (p) {
                 pending.delete(id);
                 p.reject(new DOMException("Aborted", "AbortError"));
+                notifyDrained();
               }
             };
             signal.addEventListener("abort", onAbort, { once: true });
@@ -251,6 +313,7 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
             } catch (err) {
               pending.delete(id);
               signal.removeEventListener("abort", onAbort);
+              notifyDrained();
               throw err;
             }
             try {
@@ -259,15 +322,56 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
               signal.removeEventListener("abort", onAbort);
             }
           },
-          terminate() {
-            try {
-              worker.terminate();
-            } catch { /* already dead */ }
-            for (const p of pending.values()) {
-              p.reject(new Error(`Worker for "${opts.name}" terminated`));
+          terminate(termOpts) {
+            const drainMs = termOpts?.drainMs ?? 0;
+            if (terminated) return Promise.resolve();
+            // No grace requested → tear down immediately.
+            if (drainMs <= 0) {
+              hardTerminate();
+              return Promise.resolve();
             }
-            pending.clear();
-            return Promise.resolve();
+            // Graceful handoff: keep serving the requests already in
+            // flight, then kill the worker once it goes idle (plus a
+            // short linger so a just-posted response body finishes
+            // flushing to the host) or the grace window expires —
+            // whichever comes first.
+            const lingerMs = Math.min(500, drainMs);
+            return new Promise<void>((resolveDrain) => {
+              let settled = false;
+              let lingerTimer: number | undefined;
+              const finish = () => {
+                if (settled) return;
+                settled = true;
+                drainWaiters.delete(waiter);
+                clearTimeout(hardCap);
+                drainTimers.delete(hardCap);
+                if (lingerTimer !== undefined) {
+                  clearTimeout(lingerTimer);
+                  drainTimers.delete(lingerTimer);
+                }
+                hardTerminate();
+                resolveDrain();
+              };
+              const armLinger = () => {
+                if (lingerTimer !== undefined || settled) return;
+                lingerTimer = setTimeout(finish, lingerMs) as unknown as number;
+                drainTimers.add(lingerTimer);
+              };
+              // Invoked both on each pending-request settle and on hard
+              // termination (where `terminated` is already true).
+              const waiter = () => {
+                if (terminated) {
+                  finish();
+                  return;
+                }
+                if (pending.size === 0) armLinger();
+              };
+              drainWaiters.add(waiter);
+              const hardCap = setTimeout(finish, drainMs) as unknown as number;
+              drainTimers.add(hardCap);
+              // Nothing in flight at swap time → go straight to linger.
+              if (pending.size === 0) armLinger();
+            });
           },
         };
         finishBoot(handle);
@@ -292,6 +396,10 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
         const wantsBody = status >= 200 && status !== 204 && status !== 205 &&
           status !== 304;
         p.resolve(new Response(wantsBody ? body : null, { status, headers }));
+        // After resolve, never before: a drain may hard-terminate the
+        // worker here, and the response body is a stream we just handed
+        // to the caller — let it land first.
+        notifyDrained();
         return;
       }
 
@@ -303,6 +411,7 @@ function spawnWorker(opts: SpawnOpts): Promise<InternalHandle> {
         const err = new Error(String(m.message ?? "handler error"));
         if (m.stack) (err as Error).stack = String(m.stack);
         p.reject(err);
+        notifyDrained();
         return;
       }
 
@@ -412,6 +521,14 @@ export interface SpawnProgress {
 }
 
 export interface StartOptions {
+  /**
+   * Fired as functions are discovered on disk, BEFORE any worker spawns,
+   * with the running count. Drives the live "scanning" line so a project
+   * with a slow/large function tree doesn't look hung during the
+   * stat + manifest sweep. `phase` distinguishes the directory scan from
+   * the (shared-rewrite only) batch dep-graph build that follows it.
+   */
+  onScanProgress?: (p: { found: number; phase: "scan" | "graph" }) => void;
   /** Fired before each worker spawn begins. */
   onSpawnStart?: (p: { index: number; total: number; name: string }) => void;
   /** Fired after each worker either becomes ready or errors out. */
@@ -502,29 +619,68 @@ interface DiscoveredCandidate {
   manifest: FunctionManifest;
 }
 
+/**
+ * Lightweight fs metadata is cheap individually but ruinous in series:
+ * a stat + manifest read per function, one after another, is the single
+ * biggest "boot looks stuck" contributor on large projects (Windows
+ * especially). 64 lanes saturate the filesystem without exhausting
+ * handles.
+ */
+const DISCOVERY_CONCURRENCY = 64;
+
+/** Run `fn` over `items` with at most `limit` in flight at once. */
+async function forEachBounded<T>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T) => Promise<void>,
+): Promise<void> {
+  let cursor = 0;
+  const lanes = Array.from(
+    { length: Math.min(limit, items.length) },
+    async () => {
+      while (true) {
+        const i = cursor++;
+        if (i >= items.length) return;
+        await fn(items[i]);
+      }
+    },
+  );
+  await Promise.all(lanes);
+}
+
 async function discoverCandidates(
-  functionsDir: string,
+  resolved: string,
+  onFound?: (count: number) => void,
 ): Promise<DiscoveredCandidate[]> {
-  const resolved = await Deno.realPath(functionsDir);
-  const out: DiscoveredCandidate[] = [];
+  // Phase 1: cheap directory listing (single syscall stream).
+  const names: string[] = [];
   for await (const entry of Deno.readDir(resolved)) {
     if (!entry.isDirectory) continue;
     if (entry.name.startsWith("_") || entry.name.endsWith("_shared")) continue;
-    const indexPath = join(resolved, entry.name, "index.ts");
+    names.push(entry.name);
+  }
+  // Phase 2: stat + manifest in parallel. Was sequential, which made a
+  // big function set crawl one fs round-trip at a time.
+  const out: DiscoveredCandidate[] = [];
+  let found = 0;
+  await forEachBounded(names, DISCOVERY_CONCURRENCY, async (name) => {
+    const indexPath = join(resolved, name, "index.ts");
     try {
-      await Deno.stat(indexPath);
+      const st = await Deno.stat(indexPath);
+      if (!st.isFile) return;
     } catch {
-      continue;
+      return;
     }
-    const manifest = await loadManifest(resolved, entry.name).catch(() =>
+    const manifest = await loadManifest(resolved, name).catch(() =>
       defaultManifest()
     );
     out.push({
-      name: entry.name,
+      name,
       entryUrl: pathToFileURL(indexPath).href,
       manifest,
     });
-  }
+    onFound?.(++found);
+  });
   out.sort((a, b) => a.name.localeCompare(b.name));
   return out;
 }
@@ -536,10 +692,9 @@ async function discoverCandidates(
  * 100 stat + manifest reads (which are painfully slow on Windows).
  */
 async function discoverNamed(
-  functionsDir: string,
+  resolved: string,
   names: ReadonlySet<string>,
 ): Promise<DiscoveredCandidate[]> {
-  const resolved = await Deno.realPath(functionsDir);
   const out: DiscoveredCandidate[] = [];
   await Promise.all([...names].map(async (name) => {
     if (name.startsWith("_") || name.endsWith("_shared")) return;
@@ -576,11 +731,59 @@ export function createDenoWorkerHost(
       }
       : undefined,
   );
-  const concurrency = Math.max(1, opts.concurrency ?? 8);
+  // Scale boot/reload spawn concurrency to the machine: a 32-function
+  // project boots far faster with 12-16 lanes on a modern dev box, while
+  // small machines keep the historical 8. Deno 2.9's much lower per-
+  // worker RSS makes the higher ceiling safe.
+  const defaultConcurrency = (() => {
+    const hc = Math.floor(globalThis.navigator?.hardwareConcurrency ?? 0);
+    return hc > 0 ? Math.max(8, Math.min(hc, 16)) : 8;
+  })();
+  const concurrency = Math.max(1, opts.concurrency ?? defaultConcurrency);
+  const reloadDrainMs = Math.max(0, opts.reloadDrainMs ?? 10_000);
 
   const sharedRuntime = opts.sharedRuntime;
   const rewriteCache = opts.rewriteCache;
 
+  // Canonical functions root, resolved once. Both discovery paths used
+  // to `Deno.realPath()` on every boot AND every HMR reload — needless
+  // syscalls (slow on Windows) since the directory never moves. Cache
+  // it, but don't memoize a transient failure so a missing dir can heal.
+  let functionsRootPromise: Promise<string> | null = null;
+  function functionsRoot(): Promise<string> {
+    if (!functionsRootPromise) {
+      functionsRootPromise = Deno.realPath(opts.functionsDir).catch((err) => {
+        functionsRootPromise = null;
+        throw err;
+      });
+    }
+    return functionsRootPromise;
+  }
+
+  // Workers superseded by an HMR reload but still draining their
+  // in-flight requests. Held so `stop()` can reap them promptly instead
+  // of waiting out each one's grace window.
+  const drainingHandles = new Set<InternalHandle>();
+
+  /**
+   * Retire a worker that has been replaced or removed. Hands it the
+   * configured drain grace so in-flight requests finish, and tracks it
+   * for shutdown. Fire-and-forget: the caller (reload/respawn) must not
+   * block on the drain.
+   */
+  function retireHandle(h: InternalHandle): void {
+    if (reloadDrainMs <= 0) {
+      void h.terminate().catch(() => {});
+      return;
+    }
+    drainingHandles.add(h);
+    void h.terminate({ drainMs: reloadDrainMs })
+      .catch(() => {})
+      .finally(() => {
+        drainingHandles.delete(h);
+      });
+  }
+
   // -------------------------------------------------------------------
   // Boot state machine (shared by eager + deferred boot and reload)
   // -------------------------------------------------------------------
@@ -845,7 +1048,12 @@ export function createDenoWorkerHost(
         });
       }
       if (old) {
-        await old.terminate().catch(() => {});
+        // Graceful handoff: new requests already route to the fresh
+        // worker (registry + handles swapped above), so let the previous
+        // one finish whatever it had in flight before terminating. This
+        // is the fix for HMR dropping in-flight responses under load —
+        // and it runs in the background so the reload returns instantly.
+        retireHandle(old);
       }
       // If the dep-graph was kicked off in parallel (no shared
       // runtime case), make sure it lands before we return —
@@ -890,7 +1098,10 @@ export function createDenoWorkerHost(
   }
 
   async function start(startOpts: StartOptions = {}) {
-    const candidates = await discoverCandidates(opts.functionsDir);
+    const candidates = await discoverCandidates(
+      await functionsRoot(),
+      (found) => startOpts.onScanProgress?.({ found, phase: "scan" }),
+    );
     const loaded: string[] = [];
     const errors: Array<{ name: string; error: string }> = [];
     const total = candidates.length;
@@ -900,6 +1111,7 @@ export function createDenoWorkerHost(
     );
 
     if (useSharedRewrite && candidates.length > 0) {
+      startOpts.onScanProgress?.({ found: total, phase: "graph" });
       const graphStart = performance.now();
       await depGraph.refreshMany(
         candidates.map((c) => ({ name: c.name, entryFileUrl: c.entryUrl })),
@@ -1021,7 +1233,10 @@ export function createDenoWorkerHost(
   async function startDeferred(
     startOpts: StartOptions = {},
   ): Promise<DeferredStart> {
-    const candidates = await discoverCandidates(opts.functionsDir);
+    const candidates = await discoverCandidates(
+      await functionsRoot(),
+      (found) => startOpts.onScanProgress?.({ found, phase: "scan" }),
+    );
     // MRU-first warm-up: the background queue boots the functions the
     // developer was hitting most recently (seeded from the invocation
     // log store across restarts) before the ones nobody calls. Ties —
@@ -1107,11 +1322,12 @@ export function createDenoWorkerHost(
     reason = "fs change",
   ): Promise<ReloadSummary> {
     const start = performance.now();
+    const root = await functionsRoot();
     // Targeted re-discovery: only stat/load the affected names. The
     // full-scan path is reserved for "all" (initial boot semantics).
     const candidates = names === "all"
-      ? await discoverCandidates(opts.functionsDir)
-      : await discoverNamed(opts.functionsDir, names);
+      ? await discoverCandidates(root)
+      : await discoverNamed(root, names);
     const candByName = new Map(candidates.map((c) => [c.name, c]));
 
     const targetNames = names === "all"
@@ -1133,7 +1349,9 @@ export function createDenoWorkerHost(
 
     for (const n of removed) {
       const h = handles.get(n);
-      if (h) await h.terminate().catch(() => {});
+      // Drop the routing handle first so no new request reaches it, then
+      // let it drain its in-flight requests in the background.
+      if (h) retireHandle(h);
       handles.delete(n);
       opts.registry.clearWorkerHandle(n);
       // Deferred boot may have registered a candidate for this name;
@@ -1209,8 +1427,12 @@ export function createDenoWorkerHost(
   }
 
   async function stop() {
-    const all = [...handles.values()];
+    // Include workers still draining from a recent reload. Hard-terminate
+    // everything (no drain grace) so shutdown stays prompt; each handle's
+    // in-flight graceful drain resolves the instant its worker is killed.
+    const all = [...handles.values(), ...drainingHandles];
     handles.clear();
+    drainingHandles.clear();
     await Promise.all(all.map((h) => h.terminate().catch(() => {})));
   }
 

package/src/boot-progress.ts

@@ -129,3 +129,102 @@ export function createBootProgress(
     },
   };
 }
+
+/**
+ * Live "scanning" indicator for the pre-spawn boot phase (directory
+ * discovery + the optional batch dep-graph build).
+ *
+ * Unlike {@link createBootProgress}, this DOES redraw a single line in
+ * place — and that's safe here precisely because it only runs before any
+ * function module is imported, so there are no foreign `console.log()`
+ * writers to corrupt the frame yet. {@link stop} clears the line so the
+ * append-only boot progress (or the final summary) starts on a clean
+ * row. On a non-TTY sink it renders nothing at all: a `\r`-spinner piped
+ * to a file or CI log is just noise.
+ */
+export interface ScanProgress {
+  /** Begin rendering and arm the elapsed-time ticker. */
+  start(): void;
+  /** Update the discovered-function count (scan phase). */
+  setFound(found: number): void;
+  /** Switch the phase label (e.g. "scan" → "graph"). */
+  setPhase(phase: "scan" | "graph"): void;
+  /** Clear the line and stop ticking. Idempotent. */
+  stop(): void;
+}
+
+export interface ScanProgressOptions {
+  /** Redraw cadence in ms. Default 120 — smooth elapsed counter. */
+  tickMs?: number;
+}
+
+export function createScanProgress(
+  sink: Sink = Deno.stdout,
+  opts: ScanProgressOptions = {},
+): ScanProgress {
+  const enc = new TextEncoder();
+  const tickMs = opts.tickMs ?? 120;
+  const isTty = (() => {
+    try {
+      return sink.isTerminal?.() ?? false;
+    } catch {
+      return false;
+    }
+  })();
+
+  let found = 0;
+  let phase: "scan" | "graph" = "scan";
+  let startedAt = 0;
+  let timer: number | undefined;
+  let active = false;
+
+  const write = (s: string) => {
+    try {
+      sink.writeSync(enc.encode(s));
+    } catch {
+      // Closed pipe — never crash boot over a broken stdout.
+    }
+  };
+
+  const render = () => {
+    if (!isTty || !active) return;
+    const elapsed = ((performance.now() - startedAt) / 1000).toFixed(1);
+    const body = phase === "graph"
+      ? `Building dependency graph… ${
+        found > 0 ? `${found} function${found === 1 ? "" : "s"} ` : ""
+      }`
+      : `Scanning functions… ${found > 0 ? `found ${found} ` : ""}`;
+    // \r → column 0, \x1b[2K → clear the whole line, then repaint.
+    write(`\r\x1b[2K[1tube] ${body}\x1b[2m(${elapsed}s)\x1b[0m`);
+  };
+
+  return {
+    start() {
+      if (active) return;
+      active = true;
+      startedAt = performance.now();
+      render();
+      if (isTty && tickMs > 0) {
+        timer = setInterval(render, tickMs) as unknown as number;
+      }
+    },
+    setFound(n) {
+      found = n;
+      render();
+    },
+    setPhase(p) {
+      phase = p;
+      render();
+    },
+    stop() {
+      if (!active) return;
+      active = false;
+      if (timer !== undefined) {
+        clearInterval(timer);
+        timer = undefined;
+      }
+      // Wipe the line so the next writer starts clean.
+      if (isTty) write("\r\x1b[2K");
+    },
+  };
+}

package/src/gateway/cors.ts

@@ -9,43 +9,119 @@
  * absence of the env var is reported and CORS is disabled (no
  * `Access-Control-*` headers are emitted, browsers will refuse cross-origin
  * requests).
+ *
+ * Everything else about the CORS response is configurable too, with the
+ * historical values as defaults (so an existing deployment that sets none
+ * of these behaves exactly as before):
+ *   - `1TUBE_CORS_ALLOW_HEADERS`  — replaces the default `Access-Control-
+ *     Allow-Headers` allowlist.
+ *   - `1TUBE_CORS_ALLOW_METHODS`  — replaces the default methods list.
+ *   - `1TUBE_CORS_EXPOSE_HEADERS` — ADDED to (never replaces) the internal
+ *     `x-1tube-*` set, so operators can expose extra response headers
+ *     without breaking the warming/stale overlay.
+ *   - `1TUBE_CORS_MAX_AGE`        — seconds for `Access-Control-Max-Age`
+ *     (preflight cache). Unset = header omitted (unchanged default).
+ *   - `1TUBE_CORS_ALLOW_CREDENTIALS` — force credentials on/off. Unset =
+ *     the historical behaviour (on for an explicit allowlist, off for `*`).
  */
 
 import type { Context, Next } from "npm:hono@4";
 
-const ALLOWED_HEADERS =
+const DEFAULT_ALLOWED_HEADERS =
   "authorization, x-client-info, apikey, content-type, x-application-name, user-agent";
-const ALLOWED_METHODS = "POST, GET, OPTIONS, PUT, PATCH, DELETE";
+const DEFAULT_ALLOWED_METHODS = "POST, GET, OPTIONS, PUT, PATCH, DELETE";
 // Headers browser JS must be able to read on cross-origin responses.
 // `x-1tube-warming` drives the "backend is warming up" overlay;
 // `x-1tube-stale` marks a response served by a pre-edit worker while
 // its HMR respawn is still in flight; `retry-after` lets clients
-// honour the gateway's suggested backoff.
-const EXPOSED_HEADERS = "x-1tube-warming, x-1tube-stale, retry-after";
+// honour the gateway's suggested backoff. These are always exposed —
+// operator config only ADDS to them.
+const INTERNAL_EXPOSED_HEADERS = "x-1tube-warming, x-1tube-stale, retry-after";
 
 interface CorsConfig {
   /** "*" means allow any. Empty array means CORS disabled. */
   allowAny: boolean;
   allowList: string[];
   wildcardList: string[];
+  allowHeaders: string;
+  allowMethods: string;
+  exposeHeaders: string;
+  /** Seconds for Access-Control-Max-Age, or null to omit the header. */
+  maxAge: string | null;
+  /** Explicit credentials override; null = derive from allowAny. */
+  allowCredentials: boolean | null;
 }
 
 let _config: CorsConfig | null = null;
 
+/** Merge comma-lists, dedupe case-insensitively, keep first-seen order. */
+function mergeHeaderList(base: string, extra: string): string {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (
+    const part of `${base},${extra}`.split(",").map((s) => s.trim()).filter(
+      Boolean,
+    )
+  ) {
+    const key = part.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(part);
+  }
+  return out.join(", ");
+}
+
+function readBoolEnv(name: string): boolean | null {
+  const v = Deno.env.get(name);
+  if (v === undefined) return null;
+  const t = v.trim().toLowerCase();
+  if (t === "1" || t === "true") return true;
+  if (t === "0" || t === "false") return false;
+  return null;
+}
+
+/** Headers/methods/etc. are independent of the origin allowlist branch. */
+function loadResponseShape(): Pick<
+  CorsConfig,
+  "allowHeaders" | "allowMethods" | "exposeHeaders" | "maxAge" | "allowCredentials"
+> {
+  const allowHeaders =
+    (Deno.env.get("1TUBE_CORS_ALLOW_HEADERS") || DEFAULT_ALLOWED_HEADERS).trim();
+  const allowMethods =
+    (Deno.env.get("1TUBE_CORS_ALLOW_METHODS") || DEFAULT_ALLOWED_METHODS).trim();
+  const exposeHeaders = mergeHeaderList(
+    INTERNAL_EXPOSED_HEADERS,
+    (Deno.env.get("1TUBE_CORS_EXPOSE_HEADERS") || "").trim(),
+  );
+  const maxAgeRaw = (Deno.env.get("1TUBE_CORS_MAX_AGE") || "").trim();
+  const maxAgeNum = parseInt(maxAgeRaw, 10);
+  const maxAge = maxAgeRaw !== "" && Number.isFinite(maxAgeNum) && maxAgeNum >= 0
+    ? String(maxAgeNum)
+    : null;
+  return {
+    allowHeaders,
+    allowMethods,
+    exposeHeaders,
+    maxAge,
+    allowCredentials: readBoolEnv("1TUBE_CORS_ALLOW_CREDENTIALS"),
+  };
+}
+
 function loadConfig(): CorsConfig {
   if (_config) return _config;
   const raw = (Deno.env.get("1TUBE_CORS_ORIGIN") || "").trim();
   const isDev = Deno.env.get("1TUBE_DEV") === "1";
+  const shape = loadResponseShape();
 
   if (!raw) {
     if (isDev) {
-      _config = { allowAny: true, allowList: [], wildcardList: [] };
+      _config = { allowAny: true, allowList: [], wildcardList: [], ...shape };
     } else {
       console.warn(
         "[1tube] 1TUBE_CORS_ORIGIN not set — CORS disabled. Set it to '*' or a " +
           "comma-separated domain allowlist (e.g. app.example.com,*.example.com).",
       );
-      _config = { allowAny: false, allowList: [], wildcardList: [] };
+      _config = { allowAny: false, allowList: [], wildcardList: [], ...shape };
     }
     return _config;
   }
@@ -54,7 +130,7 @@ function loadConfig(): CorsConfig {
   const wildcardList: string[] = [];
   for (const entry of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
     if (entry === "*") {
-      _config = { allowAny: true, allowList: [], wildcardList: [] };
+      _config = { allowAny: true, allowList: [], wildcardList: [], ...shape };
       return _config;
     }
     const domain = normalizeDomainPattern(entry);
@@ -67,6 +143,7 @@ function loadConfig(): CorsConfig {
     allowAny: false,
     allowList,
     wildcardList,
+    ...shape,
   };
   return _config;
 }
@@ -118,14 +195,21 @@ function buildCorsHeaders(reqOrigin: string | null): Record<string, string> | nu
 
   const headers: Record<string, string> = {
     "Access-Control-Allow-Origin": allowed,
-    "Access-Control-Allow-Headers": ALLOWED_HEADERS,
-    "Access-Control-Allow-Methods": ALLOWED_METHODS,
-    "Access-Control-Expose-Headers": EXPOSED_HEADERS,
+    "Access-Control-Allow-Headers": cfg.allowHeaders,
+    "Access-Control-Allow-Methods": cfg.allowMethods,
+    "Access-Control-Expose-Headers": cfg.exposeHeaders,
   };
   if (allowed !== "*") {
     headers["Vary"] = "Origin";
   }
-  if (!cfg.allowAny) {
+  if (cfg.maxAge !== null) {
+    headers["Access-Control-Max-Age"] = cfg.maxAge;
+  }
+  // Default (override unset): credentials on for an explicit allowlist,
+  // off in `*` mode. An explicit override wins — but never claim
+  // credentials alongside a literal `*` origin, which browsers reject.
+  const wantCredentials = cfg.allowCredentials ?? !cfg.allowAny;
+  if (wantCredentials && allowed !== "*") {
     headers["Access-Control-Allow-Credentials"] = "true";
   }
   return headers;

package/src/gateway/logging.ts

@@ -11,6 +11,7 @@
 
 import type { Context, Next } from "npm:hono@4";
 import { logError, logInfo } from "../log-buffer.ts";
+import { getRoutePrefix, routeRemainder } from "./route-prefix.ts";
 import { uuidv7 } from "../logs/id.ts";
 import type {
   InvocationErrorKind,
@@ -95,7 +96,7 @@ export function setInvocationError(c: Context, info: InvocationErrorInfo): void
 export async function loggingMiddleware(c: Context, next: Next) {
   const start = performance.now();
   const startedAtMs = Date.now();
-  const fnName = safeFnName(c.req.path.replace("/functions/v1/", "") || "unknown");
+  const fnName = safeFnName(routeRemainder(c.req.path) || "unknown");
   // UUIDv7: time-ordered, so the persisted id doubles as a stable sort
   // tiebreaker. Assigned for every request — even when persistence is
   // off the header is useful for support tickets / client-side traces.
@@ -157,7 +158,7 @@ export async function loggingMiddleware(c: Context, next: Next) {
 
   // Note: only method, function name, status, duration, and a truncated user
   // id are logged. No headers (esp. Authorization), no body, no query string.
-  const line = `\x1b[36m[1tube]${reset} ${c.req.method} /functions/v1/${fnName} → ${statusColor}${status}${reset} ${dim}(${durationMs}ms)${reset}${userTag}`;
+  const line = `\x1b[36m[1tube]${reset} ${c.req.method} ${getRoutePrefix()}/${fnName} → ${statusColor}${status}${reset} ${dim}(${durationMs}ms)${reset}${userTag}`;
 
   if (isError) {
     logError(line);

package/src/gateway/rate-limit.ts

@@ -11,6 +11,7 @@
 import type { Context, Next } from "npm:hono@4";
 import { getConnInfo } from "npm:hono@4/deno";
 import type { FunctionRegistry } from "../registry.ts";
+import { routeRemainder } from "./route-prefix.ts";
 
 interface Bucket {
   tokens: number;
@@ -131,14 +132,11 @@ export function createRateLimiter(config: Partial<RateLimitConfig> = {}) {
   _activeMaxBuckets = cfg.maxBuckets;
 
   return async (c: Context, next: Next) => {
-    // Middleware is mounted on `/functions/v1/*`, so c.req.param() won't see
-    // the trailing segments. Parse the function name out of the path
-    // ourselves — first segment after the prefix, before any nested route.
-    const path = c.req.path;
-    const after = path.startsWith("/functions/v1/")
-      ? path.slice("/functions/v1/".length)
-      : "";
-    const fnName = after.split("/", 1)[0] || "";
+    // Middleware is mounted on the function route wildcard, so
+    // c.req.param() won't see the trailing segments. Parse the function
+    // name out of the path ourselves — first segment after the
+    // (configurable) prefix, before any nested route.
+    const fnName = routeRemainder(c.req.path).split("/", 1)[0] || "";
 
     const manifestRpm = fnName ? cfg.registry?.manifestFor(fnName)?.rpm : undefined;
     const rpm = manifestRpm ?? ((fnName && cfg.overrides[fnName]) || cfg.defaultRpm);

package/src/gateway/route-prefix.ts

@@ -0,0 +1,83 @@
+/**
+ * Configurable function route prefix.
+ *
+ * The gateway has always served functions under Supabase's
+ * `/functions/v1/<name>` convention. That prefix is now configurable
+ * (`--route-prefix` / `1TUBE_ROUTE_PREFIX`) so the gateway can sit
+ * behind a different path convention (e.g. `/api`, `/edge/v2`) without a
+ * reverse-proxy rewrite. The default is unchanged, so existing
+ * deployments keep working with zero config.
+ *
+ * The prefix is process-global module state, set once at boot BEFORE any
+ * route is mounted. It lives here (rather than threaded through every
+ * call site) because the logging and rate-limit middleware � whose
+ * public signatures we don't want to break � must strip the exact same
+ * prefix the router mounts on. There is one gateway per process, so a
+ * single shared value is correct; tests that need a custom prefix call
+ * {@link setRoutePrefix} and reset it afterwards (or re-import the
+ * module fresh).
+ */
+
+/** Supabase Edge Runtime convention � the historical, unchanged default. */
+export const DEFAULT_ROUTE_PREFIX = "/functions/v1";
+
+let _prefix = DEFAULT_ROUTE_PREFIX;
+
+/**
+ * Canonicalize a raw prefix: guarantee exactly one leading slash, no
+ * trailing slash, and no duplicate inner slashes. Empty / root-only
+ * inputs fall back to the default � the router can't mount on bare `/`
+ * without swallowing `/health`, `/1tube/*`, and friends.
+ */
+export function normalizeRoutePrefix(raw: string | undefined | null): string {
+  let v = (raw ?? "").trim();
+  if (!v) return DEFAULT_ROUTE_PREFIX;
+  if (!v.startsWith("/")) v = "/" + v;
+  v = v.replace(/\/{2,}/g, "/").replace(/\/+$/, "");
+  return v === "" ? DEFAULT_ROUTE_PREFIX : v;
+}
+
+/** Set the process-wide route prefix. Returns the normalized value used. */
+export function setRoutePrefix(raw: string | undefined | null): string {
+  _prefix = normalizeRoutePrefix(raw);
+  return _prefix;
+}
+
+/** Current normalized prefix (leading slash, no trailing slash). */
+export function getRoutePrefix(): string {
+  return _prefix;
+}
+
+/** Hono wildcard mount pattern for middleware, e.g. `/functions/v1/*`. */
+export function routeWildcard(): string {
+  return `${_prefix}/*`;
+}
+
+/** Hono dispatch pattern capturing the function name + nested path. */
+export function routeDispatchPattern(): string {
+  return `${_prefix}/:name{.+}`;
+}
+
+/**
+ * Function name + nested path that follows `${prefix}/`. Returns "" when
+ * the path isn't under the prefix. Used by logging + rate-limit to pull
+ * the function name out of the request path (the middleware is mounted on
+ * the wildcard, so `c.req.param()` can't see it).
+ */
+export function routeRemainder(path: string): string {
+  if (path.startsWith(_prefix + "/")) return path.slice(_prefix.length + 1);
+  return "";
+}
+
+/**
+ * Strip the prefix off a full pathname, KEEPING the leading slash of the
+ * remainder (`/functions/v1/hello/world` ? `/hello/world`,
+ * `/functions/v1` ? ""). This is the URL the function/worker should see,
+ * mirroring Supabase Edge Runtime behaviour. Callers fall back to "/" for
+ * the empty result.
+ */
+export function stripRoutePrefixFromPathname(pathname: string): string {
+  if (pathname === _prefix) return "";
+  if (pathname.startsWith(_prefix + "/")) return pathname.slice(_prefix.length);
+  return pathname;
+}

package/src/registry.ts

@@ -104,7 +104,13 @@ export interface WorkerFunctionHandle {
      */
     invocationId?: string,
   ): Promise<Response>;
-  terminate(): Promise<void>;
+  /**
+   * Tear down the worker. With `drainMs > 0`, in-flight requests are
+   * allowed to finish (up to `drainMs`) before the worker is killed —
+   * the graceful HMR handoff path. Omitting it (or passing 0) hard-
+   * terminates immediately, rejecting anything still pending.
+   */
+  terminate(opts?: { drainMs?: number }): Promise<void>;
 }
 
 export class FunctionRegistry {

package/src/server.ts

@@ -35,6 +35,14 @@ import { createLogQuery } from "./logs/query.ts";
 import { registerLogRoutes } from "./logs/api.ts";
 import { parseMarkedConsoleLine } from "./logs/console-marker.ts";
 import { createRateLimiter } from "./gateway/rate-limit.ts";
+import {
+  getRoutePrefix,
+  normalizeRoutePrefix,
+  routeDispatchPattern,
+  routeWildcard,
+  setRoutePrefix,
+  stripRoutePrefixFromPathname,
+} from "./gateway/route-prefix.ts";
 import { createHealthHandler, createMetricsHandler } from "./health.ts";
 import { FunctionSupervisor } from "./supervisor.ts";
 import { installEnvScope } from "./env-scope.ts";
@@ -66,7 +74,7 @@ import {
   createRewriteCache,
   type RewriteCache,
 } from "./backends/deno/source-rewriter.ts";
-import { createBootProgress } from "./boot-progress.ts";
+import { createBootProgress, createScanProgress } from "./boot-progress.ts";
 import {
   createWorkerdWatchdog,
   recommendedBudgetBytes,
@@ -114,6 +122,13 @@ interface CliOpts {
   port: number;
   host: string;
   functionsPath: string;
+  /**
+   * URL prefix every function is served under. Defaults to Supabase's
+   * `/functions/v1`. Override with `--route-prefix <p>` /
+   * `1TUBE_ROUTE_PREFIX` to mount functions at e.g. `/api` or `/edge/v2`.
+   * Normalized to a single leading slash, no trailing slash.
+   */
+  routePrefix: string;
   defaultTimeoutMs: number;
   bodyLimitBytes: number;
   /**
@@ -179,6 +194,13 @@ interface CliOpts {
   workerdShared?: readonly string[];
   /** Max concurrent Deno Worker spawns during eager boot/reload. */
   denoWorkerConcurrency?: number;
+  /**
+   * Grace window (ms) an HMR-superseded Deno worker keeps serving its
+   * in-flight requests before it is terminated. Prevents a reload under
+   * load from dropping responses. `1TUBE_HMR_DRAIN_MS`, default 10000;
+   * 0 reverts to terminate-immediately. Deno backend only.
+   */
+  denoReloadDrainMs?: number;
   /**
    * First loopback port workerd may use for per-function sockets.
    * The backend reserves a second generation range at +500 during
@@ -306,6 +328,12 @@ function parseArgs(): CliOpts {
     const n = parseInt(v, 10);
     return Number.isFinite(n) && n > 0 ? n : undefined;
   })();
+  let denoReloadDrainMs: number | undefined = (() => {
+    const v = Deno.env.get("1TUBE_HMR_DRAIN_MS");
+    if (!v) return undefined;
+    const n = parseInt(v, 10);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+  })();
   let workerdBasePort: number | undefined = (() => {
     const v = Deno.env.get("1TUBE_WORKERD_BASE_PORT");
     if (!v) return undefined;
@@ -373,6 +401,9 @@ function parseArgs(): CliOpts {
   let port = parseInt(Deno.env.get("PORT") || "3100", 10);
   let host = (Deno.env.get("1TUBE_HOST") || "127.0.0.1").trim();
   let functionsPath = Deno.env.get("FUNCTIONS_PATH") || "./supabase/functions";
+  // Normalized at the end via setRoutePrefix(); kept raw here so an
+  // explicit CLI flag can still override the env var.
+  let routePrefix = Deno.env.get("1TUBE_ROUTE_PREFIX") || "/functions/v1";
   let defaultTimeoutMs = parseInt(
     Deno.env.get("FUNCTION_TIMEOUT_MS") || "150000",
     10,
@@ -395,6 +426,10 @@ function parseArgs(): CliOpts {
       host = args[++i];
     } else if (a === "--functions" && args[i + 1]) {
       functionsPath = args[++i];
+    } else if (a === "--route-prefix" && args[i + 1]) {
+      routePrefix = args[++i];
+    } else if (a.startsWith("--route-prefix=")) {
+      routePrefix = a.slice("--route-prefix=".length);
     } else if (a === "--timeout" && args[i + 1]) {
       defaultTimeoutMs = parseInt(args[++i], 10);
     } else if (a === "--dev") {
@@ -459,6 +494,12 @@ function parseArgs(): CliOpts {
     } else if (a.startsWith("--deno-worker-concurrency=")) {
       const n = parseInt(a.slice("--deno-worker-concurrency=".length), 10);
       if (Number.isFinite(n) && n > 0) denoWorkerConcurrency = n;
+    } else if (a === "--hmr-drain-ms" && args[i + 1]) {
+      const n = parseInt(args[++i], 10);
+      if (Number.isFinite(n) && n >= 0) denoReloadDrainMs = n;
+    } else if (a.startsWith("--hmr-drain-ms=")) {
+      const n = parseInt(a.slice("--hmr-drain-ms=".length), 10);
+      if (Number.isFinite(n) && n >= 0) denoReloadDrainMs = n;
     } else if (a === "--workerd-base-port" && args[i + 1]) {
       const n = parseInt(args[++i], 10);
       if (Number.isFinite(n) && n > 0) workerdBasePort = n;
@@ -574,6 +615,7 @@ function parseArgs(): CliOpts {
     port,
     host,
     functionsPath,
+    routePrefix: normalizeRoutePrefix(routePrefix),
     defaultTimeoutMs,
     bodyLimitBytes: Math.max(0, Math.floor(bodyLimitMb * 1024 * 1024)),
     bodyReadIdleMs: Math.max(0, bodyReadIdleMs),
@@ -589,6 +631,7 @@ function parseArgs(): CliOpts {
     workerdEnv,
     workerdShared,
     denoWorkerConcurrency,
+    denoReloadDrainMs,
     workerdBasePort,
     workerdInspector,
     workerdMaxHeapMB,
@@ -1360,6 +1403,9 @@ if (opts.backend === "workerd") {
     ...(opts.denoWorkerConcurrency
       ? { concurrency: opts.denoWorkerConcurrency }
       : {}),
+    ...(opts.denoReloadDrainMs !== undefined
+      ? { reloadDrainMs: opts.denoReloadDrainMs }
+      : {}),
     ...(denoImportMapOptions ?? {}),
     ...(denoSharedRuntime ? { sharedRuntime: denoSharedRuntime } : {}),
     ...(denoRewriteCache ? { rewriteCache: denoRewriteCache } : {}),
@@ -1375,6 +1421,11 @@ if (opts.backend === "workerd") {
   // already enough signal.
   const bootStart = performance.now();
   const progress = createBootProgress(Deno.stdout, { pulseMs: 2000 });
+  // Live in-place "scanning" line for the pre-spawn phase (directory
+  // discovery + batch dep-graph). Safe to redraw in place here because no
+  // function module has been imported yet, so nothing else is writing to
+  // the TTY. Cleared the instant the first worker spawn line prints.
+  const scanProgress = createScanProgress(Deno.stdout);
   const bootProfile = Deno.env.get("1TUBE_BOOT_PROFILE") === "1" ||
     Deno.env.get("1TUBE_BOOT_PROFILE")?.toLowerCase() === "true";
   let started = false;
@@ -1387,6 +1438,10 @@ if (opts.backend === "workerd") {
   // duration; the only thing that changes is the column we display.
   let printOrder = 0;
   const startCallbacks = {
+    onScanProgress: (p: { found: number; phase: "scan" | "graph" }) => {
+      scanProgress.setPhase(p.phase);
+      scanProgress.setFound(p.found);
+    },
     onBatchGraph: (p: { total: number; durationMs: number }) => {
       if (bootProfile) {
         console.log(
@@ -1397,6 +1452,9 @@ if (opts.backend === "workerd") {
       }
     },
     onSpawnStart: (p: { index: number; total: number; name: string }) => {
+      // Clear the scanning line before the first append-only spawn line
+      // lands, so the two never collide on the same TTY row.
+      scanProgress.stop();
       if (!started) {
         progress.start(p.total);
         started = true;
@@ -1440,6 +1498,7 @@ if (opts.backend === "workerd") {
     }
   };
 
+  scanProgress.start();
   if (opts.deferBoot) {
     // Deferred boot: the gateway starts serving right away; Workers spawn
     // in the background. A request for a not-yet-ready function bumps it
@@ -1447,6 +1506,9 @@ if (opts.backend === "workerd") {
     const { discovered, done } = await denoWorkerHost.startDeferred(
       startCallbacks,
     );
+    // Scan is done by the time startDeferred resolves (spawns continue in
+    // the background); clear the line before the deferred-boot message.
+    scanProgress.stop();
     console.log(
       `[1tube] Deferred boot: ${discovered.length} function(s) warming in ` +
         `the background — gateway is accepting requests now ` +
@@ -1458,6 +1520,7 @@ if (opts.backend === "workerd") {
     });
   } else {
     const { loaded, errors } = await denoWorkerHost.start(startCallbacks);
+    scanProgress.stop();
     progress.stop();
     logBootSummary(loaded, errors, "Loaded");
   }
@@ -1506,6 +1569,16 @@ const rateLimiter = createRateLimiter({
   ...(rpmOverride !== null ? { defaultRpm: rpmOverride } : {}),
 });
 
+// Lock in the (configurable) function route prefix BEFORE mounting any
+// route — the logging + rate-limit middleware read the same global to
+// strip it back off. `fnRouteWildcard` is the Hono mount pattern shared
+// by every middleware below (`<prefix>/*`).
+setRoutePrefix(opts.routePrefix);
+const fnRouteWildcard = routeWildcard();
+if (opts.routePrefix !== "/functions/v1") {
+  console.log(`[1tube] Function route prefix: ${opts.routePrefix}`);
+}
+
 // Middleware order matters:
 //   1. CORS (handle preflight before anything else can short-circuit)
 //   2. Fast-fail unknown function names (no auth/rate-limit cost for scans)
@@ -1514,7 +1587,7 @@ const rateLimiter = createRateLimiter({
 //   5. JWT auth probe (sets c.userId when token is valid; does NOT enforce
 //      auth here — the dispatcher decides per function based on `isPublic`)
 //   6. Rate limiter (now sees a real userId for per-user keying)
-app.use("/functions/v1/*", corsMiddleware);
+app.use(fnRouteWildcard, corsMiddleware);
 // Backend-aware function-existence probe. On the workerd backend the
 // bundled-set captured at boot is the source; on the deno backend the
 // registry's worker-handle map is. Both expose the same Map-lookup-cost
@@ -1522,12 +1595,12 @@ app.use("/functions/v1/*", corsMiddleware);
 const functionExists = (name: string): boolean =>
   opts.backend === "workerd" ? workerdNames.has(name) : registry.has(name);
 
-app.use("/functions/v1/*", async (c, next) => {
+app.use(fnRouteWildcard, async (c, next) => {
   // Fast-fail unknown function names before paying for logging, auth, body
   // limit, and rate-limit. Without this, a scanner hammering random names
   // exhausts rate-limit buckets keyed by IP and pollutes the log stream.
   const path = c.req.path;
-  const prefix = "/functions/v1/";
+  const prefix = getRoutePrefix() + "/";
   if (path.length > prefix.length) {
     const after = path.slice(prefix.length);
     const slash = after.indexOf("/");
@@ -1538,9 +1611,9 @@ app.use("/functions/v1/*", async (c, next) => {
   }
   await next();
 });
-app.use("/functions/v1/*", loggingMiddleware);
+app.use(fnRouteWildcard, loggingMiddleware);
 app.use(
-  "/functions/v1/*",
+  fnRouteWildcard,
   bodyLimit({
     maxSize: opts.bodyLimitBytes,
     onError: (c) =>
@@ -1553,7 +1626,7 @@ app.use(
       ),
   }),
 );
-app.use("/functions/v1/*", async (c, next) => {
+app.use(fnRouteWildcard, async (c, next) => {
   // Probe-only auth: validate the bearer token if present, but don't reject
   // unauthenticated requests here. Public functions need to pass through and
   // rate-limit by IP; protected functions are gated below in the dispatcher.
@@ -1568,13 +1641,15 @@ app.use("/functions/v1/*", async (c, next) => {
   }
   await next();
 });
-app.use("/functions/v1/*", rateLimiter);
+app.use(fnRouteWildcard, rateLimiter);
 
-// Function dispatch
-app.all("/functions/v1/:name{.+}", async (c) => {
+// Function dispatch. The pattern is built from the configurable prefix, so
+// Hono can't statically infer the `:name` param — hence the `?? ""` guard
+// (the `{.+}` matcher guarantees a non-empty value at runtime anyway).
+app.all(routeDispatchPattern(), async (c) => {
   // c.req.param("name") greedily captures the trailing path with the {.+}
   // matcher; restrict it to the first segment.
-  const rawName = c.req.param("name");
+  const rawName = c.req.param("name") ?? "";
   const name = rawName.split("/", 1)[0];
 
   // Workerd backend dispatch path. Same gateway pipeline (CORS, auth
@@ -1618,12 +1693,12 @@ app.all("/functions/v1/:name{.+}", async (c) => {
       }).body
       : null;
     // Mirror the Deno-path URL rewrite: user code expects to see the
-    // pathname without the `/functions/v1` prefix, matching Supabase
+    // pathname without the gateway route prefix, matching Supabase
     // Edge Runtime behaviour. Without this strip, hello/echo see the
     // gateway prefix in their `new URL(req.url).pathname`.
     const originalUrl = new URL(c.req.raw.url);
     const rewrittenPath =
-      originalUrl.pathname.replace(/^\/functions\/v1/, "") || "/";
+      stripRoutePrefixFromPathname(originalUrl.pathname) || "/";
     const rewrittenUrl = new URL(
       rewrittenPath + originalUrl.search,
       originalUrl.origin,
@@ -1831,9 +1906,9 @@ app.all("/functions/v1/:name{.+}", async (c) => {
   const timeoutMs = handle.timeoutMs ?? handle.manifest.timeoutMs ??
     opts.defaultTimeoutMs;
 
-  // Strip /functions/v1 prefix to match Supabase Edge Runtime behavior.
+  // Strip the gateway route prefix to match Supabase Edge Runtime behavior.
   const originalUrl = new URL(c.req.raw.url);
-  const rewrittenPath = originalUrl.pathname.replace(/^\/functions\/v1/, "") ||
+  const rewrittenPath = stripRoutePrefixFromPathname(originalUrl.pathname) ||
     "/";
   const rewrittenUrl = new URL(
     rewrittenPath + originalUrl.search,