@polardbx/pxbaas 0.1.0-beta.2 → 0.1.0-beta.3

package/dist/db/introspect.js

@@ -0,0 +1,140 @@
+/**
+ * Schema introspection shared by `db tables`, `db schema`, and `gen types`.
+ *
+ * Why this exists (fixes defect C1): those three commands used the Meta API
+ * (`MetaDriver` -> `/pg/*`) unconditionally. In multi-tenant mode `/pg/*` only
+ * accepts the platform/global service_role key, so a per-tenant key is rejected
+ * with 401 (`Authentication failed`) — even though the same credentials work for
+ * `db query` (which already routes through tenant-ddl), `data *` (REST), and
+ * `storage`. See `db/apply-schema.ts` ("per-tenant keys are rejected 401 on
+ * /pg/query").
+ *
+ * The fix keeps single-tenant behavior EXACTLY as before (Meta API) and adds a
+ * multi-tenant path that runs the same portable `information_schema` queries
+ * through `TenantDdlDriver` (which the tenant key CAN call). The introspection
+ * SQL is backend-agnostic, so it is factored into pure functions that take an
+ * injectable `SqlRunner` — trivial to unit-test without a network.
+ */
+import { MetaDriver, TenantDdlDriver, } from '@polardbx/pxbaas-client';
+/** Escape a single-quoted SQL string literal. */
+function esc(value) {
+    return value.replace(/'/g, "''");
+}
+/**
+ * Schema predicate for information_schema filters. An explicit schema filters by
+ * name; otherwise scope to the connection's current database via DATABASE() —
+ * correct for multi-tenant, where the tenant-ddl connection is bound to the
+ * tenant's own database (tenant_<id>), not a Postgres-style `public`.
+ */
+function schemaPredicate(schema) {
+    return schema && schema !== ''
+        ? `table_schema = '${esc(schema)}'`
+        : 'table_schema = DATABASE()';
+}
+function toBool(v) {
+    return v === 1 || v === true || v === '1';
+}
+/** List tables/views via information_schema (portable across both drivers). */
+export async function listTablesViaSql(run, schema) {
+    const sql = `SELECT table_schema AS \`schema\`, table_name AS \`name\`, table_type AS \`type\`, ` +
+        `table_rows AS \`rowCount\`, table_comment AS \`comment\` ` +
+        `FROM information_schema.tables ` +
+        `WHERE ${schemaPredicate(schema)} AND table_type IN ('BASE TABLE','VIEW') ` +
+        `ORDER BY table_name`;
+    const rows = await run(sql);
+    return rows.map((t) => ({
+        schema: String(t.schema ?? ''),
+        name: String(t.name ?? ''),
+        type: String(t.type ?? '').toUpperCase() === 'VIEW' ? 'view' : 'table',
+        rowCount: t.rowCount != null ? Number(t.rowCount) : undefined,
+        comment: t.comment != null && t.comment !== '' ? String(t.comment) : undefined,
+    }));
+}
+/** List a table's columns via information_schema (mirrors MetaDriver SQL). */
+export async function getTableColumnsViaSql(run, table, schema) {
+    const sql = `SELECT column_name AS \`name\`, data_type AS \`dataType\`, ` +
+        `CASE WHEN is_nullable='YES' THEN 1 ELSE 0 END AS \`isNullable\`, ` +
+        `column_default AS \`defaultValue\`, ` +
+        `CASE WHEN column_key='PRI' THEN 1 ELSE 0 END AS \`isPrimaryKey\`, ` +
+        `column_comment AS \`comment\` ` +
+        `FROM information_schema.columns ` +
+        `WHERE ${schemaPredicate(schema)} AND table_name='${esc(table)}' ` +
+        `ORDER BY ordinal_position`;
+    const rows = await run(sql);
+    return rows.map((row) => ({
+        name: String(row.name),
+        dataType: String(row.dataType),
+        isNullable: toBool(row.isNullable),
+        defaultValue: row.defaultValue == null ? null : String(row.defaultValue),
+        isPrimaryKey: toBool(row.isPrimaryKey),
+        comment: row.comment != null && row.comment !== '' ? String(row.comment) : undefined,
+    }));
+}
+/** List a table's indexes via information_schema (mirrors MetaDriver SQL). */
+export async function getTableIndexesViaSql(run, table, schema) {
+    const sql = `SELECT index_name AS \`name\`, ` +
+        `GROUP_CONCAT(column_name ORDER BY seq_in_index) AS \`cols\`, ` +
+        `CASE WHEN MIN(non_unique)=0 THEN 1 ELSE 0 END AS \`isUnique\`, ` +
+        `CASE WHEN index_name='PRIMARY' THEN 1 ELSE 0 END AS \`isPrimary\` ` +
+        `FROM information_schema.statistics ` +
+        `WHERE ${schemaPredicate(schema)} AND table_name='${esc(table)}' ` +
+        `GROUP BY index_name`;
+    const rows = await run(sql);
+    return rows.map((row) => ({
+        name: String(row.name),
+        columns: row.cols != null && row.cols !== '' ? String(row.cols).split(',') : [],
+        isUnique: toBool(row.isUnique),
+        isPrimary: toBool(row.isPrimary),
+        type: 'BTREE',
+    }));
+}
+/**
+ * Build the mode-appropriate introspector.
+ * - multi-tenant: TenantDdlDriver + information_schema scoped to DATABASE().
+ * - single-tenant: the existing MetaDriver behavior, unchanged.
+ */
+export function makeIntrospector(opts) {
+    if (opts.mode === 'multi-tenant') {
+        if (!opts.tenantId) {
+            throw new Error('Multi-tenant profile is missing tenantId; re-run "pxbaas login --tenant-id <id>" with per-tenant keys.');
+        }
+        const tenantDriver = new TenantDdlDriver({
+            endpoint: opts.endpoint,
+            serviceRoleKey: opts.serviceRoleKey,
+        });
+        const run = async (sql) => (await tenantDriver.query(sql));
+        let cachedSchema = null;
+        return {
+            async currentSchema() {
+                if (cachedSchema == null) {
+                    const rows = await run('SELECT DATABASE() AS db');
+                    cachedSchema = rows.length > 0 ? String(rows[0].db ?? '') : '';
+                }
+                return cachedSchema;
+            },
+            listTables: () => listTablesViaSql(run),
+            getColumns: (table) => getTableColumnsViaSql(run, table),
+            getIndexes: (table) => getTableIndexesViaSql(run, table),
+        };
+    }
+    const metaDriver = new MetaDriver({
+        endpoint: opts.endpoint,
+        anonKey: opts.anonKey,
+        serviceRoleKey: opts.serviceRoleKey,
+        tenantId: opts.tenantId,
+    });
+    const schema = opts.schema ?? 'public';
+    const useServiceRole = opts.useServiceRole ?? true;
+    return {
+        async currentSchema() {
+            return schema;
+        },
+        async listTables() {
+            const all = await metaDriver.listTables(useServiceRole);
+            return all.filter((t) => t.schema === schema);
+        },
+        getColumns: (table) => metaDriver.getTableColumns(table, schema, useServiceRole),
+        getIndexes: (table) => metaDriver.getTableIndexes(table, schema, useServiceRole),
+    };
+}
+//# sourceMappingURL=introspect.js.map

package/dist/db/introspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.js","sourceRoot":"","sources":["../../src/db/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,UAAU,EACV,eAAe,GAIhB,MAAM,yBAAyB,CAAC;AAMjC,iDAAiD;AACjD,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAe;IACtC,OAAO,MAAM,IAAI,MAAM,KAAK,EAAE;QAC5B,CAAC,CAAC,mBAAmB,GAAG,CAAC,MAAM,CAAC,GAAG;QACnC,CAAC,CAAC,2BAA2B,CAAC;AAClC,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc,EACd,MAAe;IAEf,MAAM,GAAG,GACP,qFAAqF;QACrF,2DAA2D;QAC3D,iCAAiC;QACjC,SAAS,eAAe,CAAC,MAAM,CAAC,2CAA2C;QAC3E,qBAAqB,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACtE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAc,EACd,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GACP,6DAA6D;QAC7D,mEAAmE;QACnE,sCAAsC;QACtC,oEAAoE;QACpE,gCAAgC;QAChC,kCAAkC;QAClC,SAAS,eAAe,CAAC,MAAM,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,IAAI;QAClE,2BAA2B,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACxE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAc,EACd,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GACP,iCAAiC;QACjC,+DAA+D;QAC/D,iEAAiE;QACjE,oEAAoE;QACpE,qCAAqC;QACrC,SAAS,eAAe,CAAC,MAAM,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,IAAI;QAClE,qBAAqB,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/E,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE,OAAO;KACd,CAAC,CAAC,CAAC;AACN,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAwB;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAc,KAAK,EAAE,GAAG,EAAE,EAAE,CACnC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAA8B,CAAC;QAC/D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,OAAO;YACL,KAAK,CAAC,aAAa;gBACjB,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBAClD,YAAY,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,CAAC;gBACD,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACvC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;YACxD,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACnD,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC;QAChF,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC;KACjF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polardbx/pxbaas",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "description": "PolarDB-X BaaS CLI application",
   "keywords": [
     "polardbx",
@@ -35,7 +35,7 @@
     "inquirer": "^9.2.0",
     "jsonwebtoken": "^9.0.0",
     "keytar": "^7.9.0",
-    "@polardbx/pxbaas-client": "0.1.0-beta.2"
+    "@polardbx/pxbaas-client": "0.1.0-beta.3"
   },
   "devDependencies": {
     "@types/inquirer": "^9.0.0",

package/skills/pxbaas-app-spec/references/runtime-contract.md

@@ -98,7 +98,7 @@ Apps may declare `frontend.fallback: "worker"` in app.json: static-miss non-`/ap
 - **React SSR emits no event handlers**: `renderToString` drops every `on*` prop (lowercase `onclick` included). Wire interactivity with `data-*` attributes (passed through verbatim) plus one client-side delegated listener; verify by grepping the served HTML for the attribute, not by reading component code.
 - **MUST** fetch data client-side after hydration (relative `./api/*` or the instance REST/Auth URLs with the user's JWT) for the default SSR-shell shape. For server-side data fetching (L3 full SSR / SEO first paint), **MUST** use the platform-injected `SUPABASE_INTERNAL_URL` as the base — it is the ONLY origin reachable from inside the sandbox (the public `SUPABASE_URL` is egress-filtered and cluster service names do not resolve). The platform derives `SUPABASE_INTERNAL_URL` from the public host via DX-12 (edge-runtime `app-env.ts`, MR #30497903); the worker just reads it and **MUST NOT** re-derive from `SUPABASE_URL` or fetch `SUPABASE_URL` directly. Use `SUPABASE_ANON_KEY` (or the forwarded user JWT) as the credential; server-side RLS still applies on the internal base. These three public keys reach App candidate workers only on sandbox images carrying MR #30497903 — degrade gracefully (render the shell without server data) when `SUPABASE_INTERNAL_URL` is empty.
 - SSR responses are `private, no-cache` with the platform CSP (inline hydrate scripts allowed); do not rely on shared caching of rendered pages.
-- **Path shapes (interim contract while `APP_WORKER_PATH_REWRITE` is off)**: the `/api/*` branch delivers the STRIPPED logical path to the worker (`/apps/{m}/api/data` → worker sees `/data`), while static-miss fallthrough delivers the FULL logical path (`/apps/{m}/page` → worker sees `/page`). Workers MUST register both the stripped and `/api`-prefixed shapes for every JSON endpoint (the `ssr-hono` template does); hydrate scripts calling `./api/*` from an SSR page rely on the stripped shape being routed.
+- **Path shapes (current default, `APP_WORKER_PATH_REWRITE` OFF)**: the proxy forwards EVERY worker request as `/<candidateSlug>/<logicalPath>` — the candidate slug prefix is **not** stripped at runtime. So `/apps/{m}/api/data` reaches the worker as `/<candidateSlug>/data`, and a static-miss fallthrough `/apps/{m}/page` reaches it as `/<candidateSlug>/page` (the `/api` segment is consumed by the proxy; the slug is prepended for edge-runtime function routing). The stripped logical path is delivered ONLY via the `X-Pxbaas-Worker-Path` header when `APP_WORKER_PATH_REWRITE` is ON, which is **disabled by default** (the runtime `new Request(url, req)` rewrite crashes with a streamRid TypeError on current sandbox binaries — D18). Workers MUST therefore normalize the leading `/<candidateSlug>` prefix and match on the logical path, e.g. `const p = new URL(req.url).pathname.replace(/^\/app_[^/]+/, "")` then dispatch on `p` (the `ssr-hono`, `ssr-shop`, `ssr-blog`, `csr-bff` templates all do this). A literal `app.get("/data")` will NOT match; do not rely on the declared `pathMode: "strip-app-api-prefix"` being honored at runtime yet. Hydrate scripts calling `./api/*` from an SSR page are routed the same way (browser `/apps/{m}/api/data` → worker `/<candidateSlug>/data`).
 - Start from the `ssr-hono` template (`pxbaas app new --template ssr-hono`); spec-lint enforces the rules above (`ssr-probe-declared`, `ssr-self-contained`, `ssr-marker-present`, `ssr-no-browser-globals`, `ssr-lib-not-allowed`).
 
 ## Lifecycle & cold start

package/skills/pxbaas-cli/references/data-postgrest.md

@@ -83,3 +83,18 @@ pxbaas rest POST "/todos" --data '{"title":"x"}' --role anon --json
 ```
 
 > REST endpoint details, embedding/RPC constraints: fetch `${endpoint}/docs` — see api-reference.md.
+
+## Schema cache after DDL
+
+The REST layer (`/rest/v1`) caches each table's column list. After a DDL change
+(`ALTER TABLE ... ADD/DROP/MODIFY COLUMN`, or `CREATE`/`DROP TABLE`) the cache
+re-introspects automatically: immediately where the platform wires DDL to a
+cache reload, otherwise within one refresh interval (~30s). Until then:
+
+- `select=*` (and `Prefer: return=representation` bodies) may still omit a
+  just-added column. This is a stale column list, not an error — the row is
+  returned, only the new field is missing.
+- Workaround: enumerate columns explicitly (`?select=id,room_id,board`) instead
+  of `*`, or retry after a few seconds.
+
+`pxbaas db add-column` / `db create-table` print a reminder about this.

package/templates/webapp/react-vite-hono/backend/index.ts

@@ -10,10 +10,27 @@ app.use("*", async (context, next) => {
 });
 
 app.options("*", (context) => context.body(null, 204));
-app.get("/health", (context) => context.json({ ok: true, app: "{{SLUG}}" }));
-app.get("/hello", (context) =>
-  context.json({ message: "Hello from {{APP_NAME}}" }),
-);
+
+// Path contract (APP_WORKER_PATH_REWRITE off = current default): the proxy
+// forwards /apps/{mount}/api/<x> to the worker as /<candidateSlug>/<x>, so a
+// literal app.get("/health") never matches at runtime. Normalize the candidate
+// slug prefix away and dispatch on the logical path (same convention as the
+// ssr-shop / ssr-blog / csr-bff templates).
+function norm(path: string): string {
+  return path.replace(/^\/app_[^/]+/, "") || path;
+}
+
+app.get("*", (context) => {
+  const p = norm(new URL(context.req.url).pathname);
+  if (p === "/health" || p === "/api/health") {
+    return context.json({ ok: true, app: "{{SLUG}}" });
+  }
+  if (p === "/hello" || p === "/api/hello") {
+    return context.json({ message: "Hello from {{APP_NAME}}" });
+  }
+  return context.json({ code: "NOT_FOUND", message: "Route not found", path: p }, 404);
+});
+
 app.notFound((context) =>
   context.json({ code: "NOT_FOUND", message: "Route not found" }, 404),
 );

package/templates/webapp/ssr-hono/backend/index.ts

@@ -37,30 +37,45 @@ function esc(s: string): string {
     .split(String.fromCharCode(34)).join(""");
 }
 
-// L3 shape demo: server-side fetch of DB content via the derived internal base
-// (anon key from env; RLS enforced server-side). Degrades gracefully so the
-// shell still renders if the internal entry is ever unreachable.
-app.get("/ssr-data", async (c) => {
-  let rows: Array<Record<string, unknown>> = [];
-  let note = "";
-  try {
-    const r = await fetch(internalBase() + "/rest/v1/?select=1", {
-      headers: { apikey: Deno.env.get("SUPABASE_ANON_KEY") || "" },
-    });
-    note = `internal base reachable: http-${r.status}`;
-  } catch (e) {
-    note = `internal base unreachable: ${String(e).slice(0, 60)}`;
-  }
-  return c.html(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>L3 demo</title></head><body>
+// Path contract (APP_WORKER_PATH_REWRITE off = current default): the proxy
+// forwards /apps/{mount}/api/<x> to the worker as /<candidateSlug>/<x> — the
+// candidate slug prefix is NOT stripped at runtime (the stripped path is only
+// delivered via X-Pxbaas-Worker-Path when the rewrite kill-switch is ON, which
+// is disabled by default due to the D18 streamRid regression). Normalize the
+// slug prefix away and match on the logical path, so handlers resolve under ANY
+// prefix shape (/{slug}/x, /api/x, or /x) and still work if the switch flips on.
+// Same convention as the ssr-shop / ssr-blog / csr-bff templates.
+function norm(path: string): string {
+  return path.replace(/^\/app_[^/]+/, "") || path;
+}
+
+app.get("*", async (c) => {
+  const p = norm(new URL(c.req.url).pathname);
+
+  // L3 shape demo: server-side fetch of DB content via the derived internal base
+  // (anon key from env; RLS enforced server-side). Degrades gracefully so the
+  // shell still renders if the internal entry is ever unreachable.
+  if (p === "/ssr-data") {
+    let rows: Array<Record<string, unknown>> = [];
+    let note = "";
+    try {
+      const r = await fetch(internalBase() + "/rest/v1/?select=1", {
+        headers: { apikey: Deno.env.get("SUPABASE_ANON_KEY") || "" },
+      });
+      note = `internal base reachable: http-${r.status}`;
+    } catch (e) {
+      note = `internal base unreachable: ${String(e).slice(0, 60)}`;
+    }
+    return c.html(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>L3 demo</title></head><body>
 <div id="__ssr" data-ssr="v1"><h1>L3 full-SSR demo</h1><p>${esc(note)}</p><pre>${esc(JSON.stringify(rows))}</pre></div>
 </body></html>`);
-});
+  }
 
-app.get("/page", (c) => {
-  const theme = c.req.query("theme") === "dark" ? "dark" : "light";
-  const bg = theme === "dark" ? "#111" : "#fafafa";
-  const fg = theme === "dark" ? "#eee" : "#222";
-  const html = `<!DOCTYPE html><html><head><meta charset="utf-8">
+  if (p === "/page") {
+    const theme = c.req.query("theme") === "dark" ? "dark" : "light";
+    const bg = theme === "dark" ? "#111" : "#fafafa";
+    const fg = theme === "dark" ? "#eee" : "#222";
+    const html = `<!DOCTYPE html><html><head><meta charset="utf-8">
 <title>{{APP_NAME}} SSR</title>
 <style>body{font-family:sans-serif;max-width:720px;margin:40px auto;background:${bg};color:${fg}}</style>
 </head><body>
@@ -77,16 +92,20 @@ app.get("/page", (c) => {
 })();
 </script>
 </body></html>`;
-  return c.html(html);
-});
+    return c.html(html);
+  }
+
+  // JSON API. /apps/{m}/api/data and /api/health normalize to /data and /health
+  // after the slug strip; the /api-prefixed shapes are kept as a defensive
+  // fallback for deployments that deliver the logical path un-stripped.
+  if (p === "/data" || p === "/api/data") {
+    return c.json({ ok: true, engine: "hono", now: new Date().toISOString() });
+  }
+  if (p === "/health" || p === "/api/health") {
+    return c.json({ ok: true });
+  }
 
-// Path contract (APP_WORKER_PATH_REWRITE off, current default): the /api/* branch
-// delivers the STRIPPED logical path (/data, /health) while static-miss
-// fallthrough delivers the FULL logical path (/page). Register both shapes so
-// the worker behaves identically when the rewrite kill-switch is flipped back on.
-app.get("/data", (c) => c.json({ ok: true, engine: "hono", now: new Date().toISOString() }));
-app.get("/api/data", (c) => c.json({ ok: true, engine: "hono", now: new Date().toISOString() }));
-app.get("/health", (c) => c.json({ ok: true }));
-app.get("/api/health", (c) => c.json({ ok: true }));
+  return c.json({ ok: false, error: "not_found", path: p }, 404);
+});
 
 Deno.serve(app.fetch);