@plutocms/supabase 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.14.0](https://github.com/plutocms/supabase/compare/v0.13.0...v0.14.0) (2026-10-27)
+
+
+### ⚠ BREAKING CHANGES
+
+* the routes `/api/access/**`, `/api/auth/signup`, `/api/migrations/**`, `/api/permissions/me`, `/api/profile/locale`, `/api/settings/**`, `/api/setup/create` and `/api/users/**` moved under `/api/_pluto/supabase/` (see the README), and failures are HTTP errors.
+
+### Features
+
+* move the internal routes under /api/_pluto/supabase, and support the public API ([#104](https://github.com/plutocms/supabase/issues/104)) ([e7bf91c](https://github.com/plutocms/supabase/commit/e7bf91cd5a802247b4ec3b6938389b94a06ce3e3))
+
+## [0.13.0](https://github.com/plutocms/supabase/compare/v0.12.0...v0.13.0) (2026-10-25)
+
+
+### Features
+
+* **deps:** raise @plutocms/pluto to ^0.20.0 ([#101](https://github.com/plutocms/supabase/issues/101)) ([ef39fb7](https://github.com/plutocms/supabase/commit/ef39fb717114f4302dd01a0877a8b2a68cf53613))
+
 ## [0.12.0](https://github.com/plutocms/supabase/compare/v0.11.3...v0.12.0) (2026-10-25)
 
 

package/FEATURES.md

@@ -15,7 +15,8 @@ policies shared by every project here.
   link, roles editor), invites through Pluto mail, and a guide for the Supabase sign-in emails.
   @.claude/skills/users-and-roles/SKILL.md
 - Content adapter: a Supabase/PostgREST-backed `PlutoContentAdapter`, plugging any layer's
-  declared content type into `@plutocms/pluto`'s generic content routes.
+  declared content type into `@plutocms/pluto`'s generic content routes. It supports query
+  filters, puts the timestamps on items, and reads the public API of core with an anonymous client.
   @.claude/skills/content-adapter/SKILL.md
 - Auth driver: plugs Supabase sign-in into the admin shell that pluto core owns (navbar, sign-in
   page, route guard), and keeps the setup guard in the driver.

package/README.md

@@ -1,6 +1,6 @@
-# Supabase Layer for Pluto CMS
+# Supabase Layer for Pluto
 
-This layer integrates Supabase as a backend service for Pluto CMS, providing a robust and scalable solution for managing content and data.
+This layer integrates Supabase as a backend service for Pluto, providing a robust and scalable solution for managing content and data.
 
 ## Installation
 
@@ -14,28 +14,19 @@ SUPABASE_URL=your-supabase-url
 SUPABASE_KEY=your-publishable-supabase-key
 ```
 
-2. Add the `@nuxtjs/supabase` and `supabase` dependencies to your project:
+2. Install the layer. It brings `@nuxtjs/supabase`, `@plutocms/pluto` and `@plutocms/utils`, so you do not add them:
 
 ```bash
-## NPM
-npm i @nuxtjs/supabase supabase
-
-## Yarn
-yarn add @nuxtjs/supabase supabase
-
-## PNPM
-pnpm add @nuxtjs/supabase supabase
-
-## Bun
-bun add @nuxtjs/supabase supabase
+npm i @plutocms/supabase
+# or pnpm add @plutocms/supabase, or bun add @plutocms/supabase
 ```
 
-3. Include the Pluto Supabase layer via `extends` option in your `nuxt.config.ts`:
+3. Include the Pluto Supabase layer via `extends` option in your `nuxt.config.ts`. It is the only Pluto layer the app lists:
 
 ```ts
 // nuxt.config.ts
 export default defineNuxtConfig({
-  extends: [['github:plutocms/supabase', { install: true }]],
+  extends: [['@plutocms/supabase', { install: true }]],
 })
 ```
 
@@ -59,7 +50,7 @@ entries. See "Migrating an app" in that skill.
 ### Invite users (access API)
 
 An admin invites a user by email and gives the user one or more roles. The routes are under
-`/api/access/**`. Every write needs an admin. This needs the migration
+`/api/_pluto/supabase/access/**`. Every write needs an admin. This needs the migration
 `008_users_and_roles_admin.sql`, which the admin applies from `/admin/migrations`.
 
 Invites need no setup. Check one thing: in the Supabase dashboard (Authentication, then URL
@@ -116,19 +107,36 @@ come from Supabase. The Email tab has a guide to send them through Resend too.
 
 ### API Routes
 
-The layer includes API routes for interacting with Supabase services, such as authentication and media management.
-
-- GET `/api/settings`
-- POST `/api/settings/update`
-- POST `/api/auth/signup`
-- GET `/api/access/users`, GET `/api/access/roles` (permission `users:read`)
-- POST `/api/access/users/invite`, POST `/api/access/users/:id/resend` (admin; `locale` is the
+The layer includes API routes for interacting with Supabase services, such as authentication and settings.
+Every route lives under `/api/_pluto/supabase/`. Core blocks a cross-site write to `/api/_pluto/**`, so
+a page of another site cannot call them. A failure is an HTTP error with a translation key, never a
+`200` with `success: false`. These routes serve the admin. They are not a public API.
+
+### Public content API
+
+The public content of the Supabase layers is read through the public API of core,
+`GET /api/pluto/v1/content/<type>` (and `/<id or slug>`). See
+[the public API](https://pluto.vulmix.dev/core/public-api). The routes are anonymous. This layer
+reads for them with an anon client that has no user session, so Row Level Security applies as for
+an anonymous visitor, and the answer is the same for everyone. A CDN can cache it. The adapter
+never uses the service role key for a read. The adapter also supports the `filters` of a public
+query, and puts the created, updated and published-at columns on each item, so a public list can
+sort by date.
+
+- GET and PUT `/api/_pluto/supabase/settings` (PUT needs `settings:manage`; it answers `{ message, data }`)
+- POST `/api/_pluto/supabase/auth/signup`
+- GET `/api/_pluto/supabase/migrations`, POST `/api/_pluto/supabase/migrations/run` (admin)
+- GET `/api/_pluto/supabase/me/capabilities`
+- GET and PUT `/api/_pluto/supabase/me/locale`
+- GET `/api/_pluto/supabase/setup` (the setup state), POST `/api/_pluto/supabase/setup` (runs the first setup)
+- GET `/api/_pluto/supabase/access/users`, GET `/api/_pluto/supabase/access/roles` (permission `users:read`)
+- POST `/api/_pluto/supabase/access/users/invite`, POST `/api/_pluto/supabase/access/users/:id/resend` (admin; `locale` is the
   optional language of the email)
-- POST `/api/access/users/invite-link` (admin; needs the service role key; returns a one-time link
+- POST `/api/_pluto/supabase/access/users/invite-link` (admin; needs the service role key; returns a one-time link
   and sends no email)
-- GET `/api/access/capabilities` (admin; says whether the service key and Pluto mail are set)
-- PUT and DELETE `/api/access/users/:id/roles` (admin; DELETE revokes the access)
-- POST `/api/access/roles`, PUT and DELETE `/api/access/roles/:key` (admin)
+- GET `/api/_pluto/supabase/access/capabilities` (admin; says whether the service key and Pluto mail are set)
+- PUT and DELETE `/api/_pluto/supabase/access/users/:id/roles` (admin; DELETE revokes the access)
+- POST `/api/_pluto/supabase/access/roles`, PUT and DELETE `/api/_pluto/supabase/access/roles/:key` (admin)
 
 ### Types
 

package/app/components/access/DeleteRoleModal.vue

@@ -23,7 +23,7 @@ async function remove() {
   working.value = true
 
   try {
-    await $fetch(`/api/access/roles/${props.role.key}`, { method: 'DELETE' })
+    await $fetch(`/api/_pluto/supabase/access/roles/${props.role.key}`, { method: 'DELETE' })
 
     toast.add({
       title: t('supabase.access.toasts.roleDeleted'),

package/app/components/access/EditRolesSlideover.vue

@@ -61,7 +61,7 @@ async function save() {
   saving.value = true
 
   try {
-    await $fetch(`/api/access/users/${props.user.id}/roles`, {
+    await $fetch(`/api/_pluto/supabase/access/users/${props.user.id}/roles`, {
       method: 'PUT',
       body: { roleKeys: roleKeys.value },
     })

package/app/components/access/InviteModal.vue

@@ -85,7 +85,7 @@ async function submit() {
   mailProblem.value = null
 
   try {
-    const result = await $fetch<AccessInviteResult>('/api/access/users/invite', {
+    const result = await $fetch<AccessInviteResult>('/api/_pluto/supabase/access/users/invite', {
       method: 'POST',
       body: { ...body(), locale: emailLocale.value },
     })
@@ -140,7 +140,7 @@ async function copyLink() {
 
   try {
     const result = await $fetch<{ status: 'invited' | 'granted', link: string | null }>(
-      '/api/access/users/invite-link',
+      '/api/_pluto/supabase/access/users/invite-link',
       { method: 'POST', body: body() }
     )
 

package/app/components/access/RevokeModal.vue

@@ -27,7 +27,7 @@ async function revoke() {
   working.value = true
 
   try {
-    await $fetch(`/api/access/users/${props.user.id}/roles`, { method: 'DELETE' })
+    await $fetch(`/api/_pluto/supabase/access/users/${props.user.id}/roles`, { method: 'DELETE' })
 
     toast.add({
       title: t('supabase.access.toasts.revoked'),

package/app/components/access/RoleSlideover.vue

@@ -131,12 +131,12 @@ async function save() {
 
   try {
     if (creating.value) {
-      await $fetch('/api/access/roles', {
+      await $fetch('/api/_pluto/supabase/access/roles', {
         method: 'POST',
         body: { ...body, key: key.value },
       })
     } else {
-      await $fetch(`/api/access/roles/${props.role!.key}`, { method: 'PUT', body })
+      await $fetch(`/api/_pluto/supabase/access/roles/${props.role!.key}`, { method: 'PUT', body })
     }
 
     toast.add({

package/app/composables/migrations.ts

@@ -53,7 +53,7 @@ export function useMigrations() {
     error,
     status: fetchStatus,
     refresh,
-  } = useFetch<MigrationsStatusResponse>('/api/migrations/status', {
+  } = useFetch<MigrationsStatusResponse>('/api/_pluto/supabase/migrations', {
     key: 'pluto-migrations-status',
   })
 
@@ -70,10 +70,30 @@ export function useMigrations() {
   const pendingCount = computed(() => status.value?.pending.length ?? 0)
 
   async function runMigrations(connectionString?: string) {
-    const result = await $fetch<RunMigrationsResponse>('/api/migrations/run', {
-      method: 'POST',
-      body: connectionString ? { connectionString } : undefined,
-    })
+    let result: RunMigrationsResponse
+
+    try {
+      result = await $fetch<RunMigrationsResponse>('/api/_pluto/supabase/migrations/run', {
+        method: 'POST',
+        body: connectionString ? { connectionString } : undefined,
+      })
+    } catch (error) {
+      // The route answers a failed run with an HTTP error that carries
+      // `needsConnectionString` or `error` in its data. Turn it back into
+      // a failed result, so the page shows it as before. Any other error
+      // (for example a dropped connection) goes on to the caller.
+      const failure = failureData(error)
+
+      if (failure?.needsConnectionString !== true && typeof failure?.error !== 'string') {
+        throw error
+      }
+
+      result = {
+        success: false,
+        needsConnectionString: failure.needsConnectionString === true ? true : undefined,
+        error: typeof failure.error === 'string' ? failure.error : undefined,
+      }
+    }
 
     await refresh()
 

package/app/pages/admin/(auth)/signup.vue

@@ -3,7 +3,7 @@ definePageMeta({
   layout: 'auth',
 })
 
-const { t } = usePlutoI18n()
+const { t, te } = usePlutoI18n()
 const errorText = usePlutoErrorText()
 
 useHead({
@@ -36,7 +36,7 @@ async function submitForm() {
   isSubmitting.value = true
 
   try {
-    await $fetch('/api/auth/signup', {
+    await $fetch('/api/_pluto/supabase/auth/signup', {
       method: 'POST',
       body: {
         email: form.value.email,
@@ -59,7 +59,14 @@ async function submitForm() {
 
     toast.add({
       title: t('supabase.auth.signup.failed'),
-      description: errorText(error, 'supabase.auth.errors.unknown'),
+      description: resolveAuthErrorText(
+        {
+          code: failureData(error)?.code,
+          message: (error as { data?: { statusMessage?: string } }).data?.statusMessage
+            ?? errorText(error, 'supabase.auth.errors.unknown'),
+        },
+        { t, te }
+      ),
       icon: 'lucide:circle-x',
       color: 'error',
     })

package/app/pages/admin/settings/roles.vue

@@ -29,7 +29,7 @@ async function load() {
   }
 
   try {
-    const response = await $fetch<{ roles: AccessRole[] }>('/api/access/roles')
+    const response = await $fetch<{ roles: AccessRole[] }>('/api/_pluto/supabase/access/roles')
 
     roles.value = response.roles
     status.value = 'ready'

package/app/pages/admin/settings/users.vue

@@ -50,8 +50,8 @@ async function load() {
 
   try {
     const [usersResponse, rolesResponse] = await Promise.all([
-      $fetch<{ users: AccessUser[] }>('/api/access/users'),
-      $fetch<{ roles: AccessRole[] }>('/api/access/roles'),
+      $fetch<{ users: AccessUser[] }>('/api/_pluto/supabase/access/users'),
+      $fetch<{ roles: AccessRole[] }>('/api/_pluto/supabase/access/roles'),
     ])
 
     users.value = usersResponse.users
@@ -65,7 +65,7 @@ async function load() {
 
 async function loadCapabilities() {
   try {
-    capabilities.value = await $fetch<AccessCapabilities>('/api/access/capabilities')
+    capabilities.value = await $fetch<AccessCapabilities>('/api/_pluto/supabase/access/capabilities')
   } catch {
     // The invite works without it. Only the "Copy invite link" action hides.
     capabilities.value = null
@@ -134,7 +134,7 @@ async function copyLink(user: AccessUser) {
   }
 
   try {
-    const result = await $fetch<{ link: string | null }>('/api/access/users/invite-link', {
+    const result = await $fetch<{ link: string | null }>('/api/_pluto/supabase/access/users/invite-link', {
       method: 'POST',
       body: { email: user.email, roleKeys: user.roles },
     })
@@ -164,7 +164,7 @@ async function copyLink(user: AccessUser) {
 async function resend(user: AccessUser) {
   try {
     const result = await $fetch<{ emailSent?: boolean, link?: string }>(
-      `/api/access/users/${user.id}/resend`,
+      `/api/_pluto/supabase/access/users/${user.id}/resend`,
       { method: 'POST', body: { locale: locale.value } }
     )
 

package/app/pages/admin/setup.vue

@@ -74,7 +74,7 @@ const currentStepSubmitLabel = computed(() => {
 })
 
 /**
- * Polls /api/settings/first_setup until the dev server responds again, and
+ * Polls /api/_pluto/supabase/setup until the dev server responds again, and
  * advances the stepper once it does.
  *
  * Used only to wait out the restart described in the `catch` block of
@@ -89,7 +89,7 @@ async function waitForServerAndAdvance(): Promise<boolean> {
     await new Promise((resolve) => setTimeout(resolve, delayMs))
 
     try {
-      await $fetch('/api/settings/first_setup')
+      await $fetch('/api/_pluto/supabase/setup')
 
       toast.add({
         title: t('supabase.connection.reconnected'),
@@ -118,24 +118,13 @@ async function completeDatabaseSetup() {
       encodeURIComponent(databaseForm.value.password)
     )
 
-    const data = await $fetch<any>('/api/setup/create', {
+    const data = await $fetch<any>('/api/_pluto/supabase/setup', {
       method: 'POST',
       body: {
         connectionString,
       },
     })
 
-    if (data.success === false) {
-      toast.add({
-        title: t('supabase.setup.failed'),
-        description: t('supabase.setup.failedDescription'),
-        icon: 'lucide:circle-x',
-        color: 'error',
-      })
-
-      return
-    }
-
     if (data.persisted === false) {
       envNotPersisted.value = true
       submittedConnectionString.value = connectionString
@@ -150,7 +139,20 @@ async function completeDatabaseSetup() {
 
     stepper.value?.next()
   } catch (error) {
-    // Writing DATABASE_URL to .env (the last step of /api/setup/create,
+    // The route answers a failed setup with an HTTP error that carries the
+    // scrubbed database error in its data.
+    if (typeof failureData(error)?.error === 'string') {
+      toast.add({
+        title: t('supabase.setup.failed'),
+        description: t('supabase.setup.failedDescription'),
+        icon: 'lucide:circle-x',
+        color: 'error',
+      })
+
+      return
+    }
+
+    // Writing DATABASE_URL to .env (the last step of /api/_pluto/supabase/setup,
     // after the schema and every layer migration already succeeded)
     // restarts the dev server. The response can be cut off by that
     // restart even though the setup itself worked. A dropped connection
@@ -326,7 +328,7 @@ function handleStepChange(step: number) {
                                 >
                                   <template #route>
                                     <ULink
-                                      to="https://github.com/plutocms/supabase/blob/feat/setup-wizard/server/api/setup/create.post.ts"
+                                      to="https://github.com/plutocms/supabase/blob/main/server/api/_pluto/supabase/setup/index.post.ts"
                                       target="_blank"
                                       class="underline"
                                     >

package/app/plugins/pluto-extension.ts

@@ -36,7 +36,7 @@ export default defineNuxtPlugin(() => {
   async function loadSiteSettings() {
     try {
       const response = await $fetch<{ settings: Record<string, string> }>(
-        '/api/settings'
+        '/api/_pluto/supabase/settings'
       )
       siteSettings.value = response.settings
     } catch {
@@ -53,7 +53,7 @@ export default defineNuxtPlugin(() => {
     let state: SetupState = 'unknown'
     try {
       state = setupStateFromResponse(
-        await $fetch('/api/settings/first_setup')
+        await $fetch('/api/_pluto/supabase/setup')
       )
     } catch (error) {
       if (import.meta.dev) {
@@ -200,13 +200,13 @@ export default defineNuxtPlugin(() => {
       id: 'supabase',
       load: async () => {
         const response = await $fetch<{ settings: Record<string, string> }>(
-          '/api/settings'
+          '/api/_pluto/supabase/settings'
         )
         return response.settings
       },
       save: async (patch) => {
-        await $fetch('/api/settings/update', {
-          method: 'POST',
+        await $fetch('/api/_pluto/supabase/settings', {
+          method: 'PUT',
           body: patch,
         })
 
@@ -229,12 +229,12 @@ export default defineNuxtPlugin(() => {
     localeDriver: {
       id: 'supabase',
       load: async () => {
-        const response = await $fetch<{ locale: string | null }>('/api/profile/locale')
+        const response = await $fetch<{ locale: string | null }>('/api/_pluto/supabase/me/locale')
         return response.locale
       },
       save: async (locale) => {
         try {
-          await $fetch('/api/profile/locale', { method: 'POST', body: { locale } })
+          await $fetch('/api/_pluto/supabase/me/locale', { method: 'PUT', body: { locale } })
         } catch (error) {
           throw new Error(errorText(error))
         }
@@ -243,7 +243,7 @@ export default defineNuxtPlugin(() => {
     permissionsDriver: {
       id: 'supabase',
       load: async () => {
-        const response = await $fetch<{ capabilities: string[] }>('/api/permissions/me')
+        const response = await $fetch<{ capabilities: string[] }>('/api/_pluto/supabase/me/capabilities')
         return response.capabilities
       },
     },

package/app/utils/api-failure.ts

@@ -0,0 +1,16 @@
+// Reads the extra data of a failed call to this layer's routes. This file does
+// not use Nuxt auto-imports, so plain Vitest can import it.
+
+/**
+ * Returns the `data` that a route put in its `createPlutoError`. A `$fetch`
+ * error holds the whole response body in `data`, so the extra data sits in
+ * `data.data`. Returns `undefined` when the error has none.
+ */
+export function failureData(error: unknown): Record<string, unknown> | undefined {
+  const body = (error as { data?: unknown } | null | undefined)?.data
+  const data = (body as { data?: unknown } | null | undefined)?.data
+
+  return typeof data === 'object' && data !== null
+    ? (data as Record<string, unknown>)
+    : undefined
+}

package/app/utils/auth-driver.ts

@@ -67,11 +67,11 @@ export const SUPABASE_PUBLIC_PATHS: PlutoAuthPublicPath[] = [
 /** The page that opens after a sign-in with no (safe) redirect. */
 export const SUPABASE_SIGN_IN_FALLBACK = '/admin/home'
 
-/** The setup state that the setup guard reads from `/api/settings/first_setup`. */
+/** The setup state that the setup guard reads from `/api/_pluto/supabase/setup`. */
 export type SetupState = 'pending' | 'done' | 'unknown'
 
 /**
- * Reads the answer of `/api/settings/first_setup`. A failed call, or a
+ * Reads the answer of `/api/_pluto/supabase/setup`. A failed call, or a
  * response with no `is_first_setup` flag, is `unknown`.
  */
 export function setupStateFromResponse(data: unknown): SetupState {

package/i18n/locales/en.json

@@ -9,12 +9,17 @@
       "missingPermission": "Your account is missing the \"{capability}\" permission.",
       "setupCompleted": "Setup has already been completed.",
       "coreSchemaMissing": "Core schema not found. Reinstall @plutocms/supabase and restart the dev server.",
-      "fetchUsers": "Error fetching users: {message}",
-      "fetchUser": "Error fetching user: {message}",
       "localeUnsupported": "This language is not supported.",
       "duplicateRecord": "A record with this value already exists.",
       "missingReference": "This references a record that does not exist.",
-      "migrationStatus": "Error reading migration status: {message}"
+      "migrationStatus": "Error reading migration status: {message}",
+      "signupFailed": "Could not create the account.",
+      "connectionStringRequired": "A database connection string is required.",
+      "migrationsFailed": "Migrations failed: {message}",
+      "setupFailed": "Database setup failed: {message}",
+      "setupStateRead": "Could not read the setup state: {message}",
+      "settingsSave": "Could not save the settings: {message}",
+      "localeSave": "Could not save your language: {message}"
     },
     "auth": {
       "backToLogin": "Back to Login",

package/i18n/locales/pt-BR.json

@@ -9,12 +9,17 @@
       "missingPermission": "Sua conta não tem a permissão \"{capability}\".",
       "setupCompleted": "A configuração já foi concluída.",
       "coreSchemaMissing": "Esquema principal não encontrado. Reinstale @plutocms/supabase e reinicie o servidor de desenvolvimento.",
-      "fetchUsers": "Erro ao buscar os usuários: {message}",
-      "fetchUser": "Erro ao buscar o usuário: {message}",
       "localeUnsupported": "Este idioma não está disponível.",
       "duplicateRecord": "Já existe um registro com este valor.",
       "missingReference": "Isto aponta para um registro que não existe.",
-      "migrationStatus": "Erro ao ler o status das migrações: {message}"
+      "migrationStatus": "Erro ao ler o status das migrações: {message}",
+      "signupFailed": "Não foi possível criar a conta.",
+      "connectionStringRequired": "Informe a string de conexão do banco de dados.",
+      "migrationsFailed": "As migrações falharam: {message}",
+      "setupFailed": "A configuração do banco de dados falhou: {message}",
+      "setupStateRead": "Não foi possível ler o estado da configuração: {message}",
+      "settingsSave": "Não foi possível salvar as configurações: {message}",
+      "localeSave": "Não foi possível salvar o seu idioma: {message}"
     },
     "auth": {
       "backToLogin": "Voltar para o login",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -11,7 +11,7 @@
     "unrs-resolver",
     "vue-demi"
   ],
-  "description": "Supabase backend layer for Pluto CMS",
+  "description": "Supabase backend layer for Pluto",
   "author": "Victor Ribeiro",
   "homepage": "https://github.com/plutocms/supabase#readme",
   "repository": {
@@ -39,7 +39,7 @@
     "@nuxt/eslint": "^1.17.0",
     "@nuxt/ui": "^4.12.0",
     "@nuxtjs/supabase": "^2.1.0",
-    "@plutocms/pluto": "^0.18.0",
+    "@plutocms/pluto": "^0.27.0",
     "@plutocms/utils": "^0.2.1",
     "@supabase/supabase-js": "^2.117.3",
     "postgres": "^3.4.9",

package/server/api/{access → _pluto/supabase/access}/capabilities.get.ts

@@ -1,6 +1,6 @@
-import { plutoMailReady } from '../../utils/access-mail'
-import { requireAdminRole } from '../../utils/admin-role-guard'
-import { optionalServiceClient } from '../../utils/service-client'
+import { plutoMailReady } from '../../../../utils/access-mail'
+import { requireAdminRole } from '../../../../utils/admin-role-guard'
+import { optionalServiceClient } from '../../../../utils/service-client'
 
 /**
  * What the invite UI can offer, for an admin: whether the service role key is

package/server/api/{access → _pluto/supabase/access}/roles/[key].delete.ts

@@ -1,6 +1,6 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../utils/access-errors'
-import { requireAdminRole } from '../../../utils/admin-role-guard'
+import { mapAccessError } from '../../../../../utils/access-errors'
+import { requireAdminRole } from '../../../../../utils/admin-role-guard'
 
 /** Deletes a role. It answers with the number of users who lost the role. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/roles/[key].put.ts

@@ -1,8 +1,8 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../../utils/access-errors'
-import { roleBodySchema } from '../../../utils/access-invite'
-import { requireAdminRole } from '../../../utils/admin-role-guard'
-import { parseBody } from '../../../utils/validate'
+import { mapAccessError } from '../../../../../utils/access-errors'
+import { roleBodySchema } from '../../../../../utils/access-invite'
+import { requireAdminRole } from '../../../../../utils/admin-role-guard'
+import { parseBody } from '../../../../../utils/validate'
 
 /** Edits a role and replaces its capabilities. The `admin` role is refused. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/roles.get.ts

@@ -1,6 +1,6 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../utils/access-errors'
-import { requireCapability } from '../../utils/capability-guard'
+import { mapAccessError } from '../../../../utils/access-errors'
+import { requireCapability } from '../../../../utils/capability-guard'
 
 /** The roles, with their capabilities and the number of users. */
 export default defineEventHandler(async (event) => {

package/server/api/{access → _pluto/supabase/access}/roles.post.ts

@@ -1,8 +1,8 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { mapAccessError } from '../../utils/access-errors'
-import { createRoleBodySchema } from '../../utils/access-invite'
-import { requireAdminRole } from '../../utils/admin-role-guard'
-import { parseBody } from '../../utils/validate'
+import { mapAccessError } from '../../../../utils/access-errors'
+import { createRoleBodySchema } from '../../../../utils/access-invite'
+import { requireAdminRole } from '../../../../utils/admin-role-guard'
+import { parseBody } from '../../../../utils/validate'
 
 /** Creates a role. A new role cannot hold the wildcard. */
 export default defineEventHandler(async (event) => {