@protobase/server 0.30.2 → 0.31.0

package/dist/admin-options.d.ts

@@ -14,8 +14,8 @@ export type AdminOptions = {
   /** Default `/api/v1`. */
   basePath?: string;
   /**
-   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/rest/v1` and the
-   * Realtime-compatible `/realtime/v1` and the Storage-compatible `/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
+   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/api/sb/rest/v1` and the
+   * Realtime-compatible `/api/sb/realtime/v1` and the Storage-compatible `/api/sb/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
    * `PROTOBASE_SECRET_KEY`. Without either, or with `false`, the app serves neither.
    */
   apiKeys?: ApiKeysOptions | false;

package/dist/api-keys/caller-settings.js

@@ -1,6 +1,6 @@
 //#region src/api-keys/caller-settings.ts
 /**
-* The transaction settings a request admitted by key (`/rest/v1`, `/storage/v1`) runs with, as Supabase's PostgREST
+* The transaction settings a request admitted by key (`/api/sb/rest/v1`, `/api/sb/storage/v1`) runs with, as Supabase's PostgREST
 * sets them: `role`, which is `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
 * `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
 * database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the

package/dist/create-admin.d.ts

@@ -72,11 +72,11 @@ export type CreateAdminInput = {
   formsDifficulty?: Difficulty;
   /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
   commentUsers?: CommentUsers;
-  /** @internal Verifies a user's token on `/rest/v1`, `/realtime/v1` and `/storage/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
+  /** @internal Verifies a user's token on `/api/sb/rest/v1`, `/api/sb/realtime/v1` and `/api/sb/storage/v1` and gives its claims, which tests fake; those `/api/sb/auth/v1` signs otherwise. */
   verifyToken?: (token: string) => Promise<JWTPayload>;
   /**
    * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves
-   * supabase-js's Realtime at `/realtime/v1/websocket`; without it, the app serves none.
+   * supabase-js's Realtime at `/api/sb/realtime/v1/websocket`; without it, the app serves none.
    */
   upgradeWebSocket?: UpgradeWebSocket;
 };

package/dist/create-admin.js

@@ -19,6 +19,7 @@ import { realtimeApp } from "./realtime/realtime-app.js";
 import { restRoutes } from "./rest/rest-routes.js";
 import { storageRoutes } from "./storage/storage-routes.js";
 import { readAppName } from "./app-name.js";
+import { realtimePath, restPath, storagePath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
@@ -237,7 +238,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			skip
 		});
 		app.use(`${systemPath}/*`, cors);
-		if (auth && !"/auth/v1".startsWith(`${systemPath}/`)) app.use(`${goTruePath}/*`, cors);
+		if ((servesKeys || auth) && !"/api/sb".startsWith(`${systemPath}/`)) app.use(`${supabasePath}/*`, cors);
 	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth, {
@@ -288,19 +289,18 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		schema: changes,
 		report
 	});
-	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
 	if (servesKeys) {
 		const verify = verifyToken ?? (auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens")));
 		const caller = apiKeyCaller({
 			keys: apiKeys,
 			verify
 		});
-		app.route("/rest/v1", restRoutes({
+		app.route(restPath, restRoutes({
 			deps,
 			caller,
 			report
 		}));
-		if (upgradeWebSocket) app.route("/realtime/v1", realtimeApp({
+		if (upgradeWebSocket) app.route(realtimePath, realtimeApp({
 			deps,
 			feed,
 			upgradeWebSocket,
@@ -317,12 +317,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 				maxBytes: files.storage.maxBytes,
 				caller
 			};
-			app.route("/storage/v1", storageRoutes({
+			app.route(storagePath, storageRoutes({
 				deps: storage,
 				report
 			}));
 		}
 	}
+	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));

package/dist/files/options.d.ts

@@ -23,9 +23,9 @@ export type FilesOptions = {
    */
   trustedHosts?: string[];
   /**
-   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/storage/v1` when it has an API key
+   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/api/sb/storage/v1` when it has an API key
    * (see `apiKeys`): `provider` names one of the providers, default `private`, and `maxFileSize` caps every upload, as
-   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/storage/v1`.
+   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/api/sb/storage/v1`.
    */
   storage?: {
     provider?: string;

package/dist/files/runtime.js

@@ -10,7 +10,7 @@ import { parseSize } from "@protobase/schema/internal";
 const ticketSeconds = 86400;
 const imageFields = (models) => models.flatMap((model) => Object.values(model.fields).flatMap(({ name, file }) => file && (file.variants || file.original || file.placeholder !== void 0) ? [`${model.name}.${name}`] : []));
 /**
-* The runtime, when a resource has a file field, the config names providers or the app serves `/storage/v1`. It fails at startup when a field's
+* The runtime, when a resource has a file field, the config names providers or the app serves `/api/sb/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
 const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
@@ -23,7 +23,7 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: se
 	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
 	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields and /storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
 	const images = imageFields(models);
 	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
 	const providers = resolveProviders(options, env, used);

package/dist/files/storage-provider.d.ts

@@ -2,7 +2,7 @@ import { FileProvider } from "./store.js";
 import { FilesOptions } from "./options.js";
 //#region src/files/storage-provider.d.ts
 /**
- * The provider `/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
+ * The provider `/api/sb/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
  * command that writes them, such as `protobase import supabase`. Fails when `files.storage` is `false`.
  */
 export declare const storageProvider: (options: FilesOptions, env: Record<string, string | undefined>) => {

package/dist/files/storage-provider.js

@@ -1,9 +1,9 @@
 import { resolveProviders } from "./providers.js";
 //#region src/files/storage-provider.ts
-/** The provider `/storage/v1` keeps object bytes in: `files.storage.provider`, default `private`. */
+/** The provider `/api/sb/storage/v1` keeps object bytes in: `files.storage.provider`, default `private`. */
 const storageProviderName = (options) => options.storage === false ? void 0 : options.storage?.provider ?? "private";
 /**
-* The provider `/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
+* The provider `/api/sb/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
 * command that writes them, such as `protobase import supabase`. Fails when `files.storage` is `false`.
 */
 const storageProvider = (options, env) => {

package/dist/gotrue/keys.js

@@ -1,6 +1,7 @@
+import { supabasePath } from "../supabase-paths.js";
 //#region src/gotrue/keys.ts
 /** Where the GoTrue-compatible endpoints are served, below the app's origin. */
-const goTruePath = "/auth/v1";
+const goTruePath = `${supabasePath}/auth/v1`;
 /** The key pair the JWT plugin keeps beside its EdDSA one for these tokens; it makes it on the first token. */
 const goTrueKeyPair = { alg: "ES256" };
 const goTrueAlgorithm = goTrueKeyPair.alg;

package/dist/realtime/change-checker.js

@@ -24,7 +24,7 @@ const seen = (entry, filters, rows) => new Map(rows.map((row) => [encodeKey(keyC
 }]));
 /**
 * Checks which changes callers may see, for every group in one read-only transaction: per group it sets the role and
-* claims as `/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
+* claims as `/api/sb/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
 * each filter in Postgres, as the column's type compares. The transaction holds one pooled connection only while it
 * runs. A group whose check fails is checked again in a transaction of its own, so it costs only its own callers the
 * batch.

package/dist/realtime/realtime-app.js

@@ -3,7 +3,7 @@ import { changeHub } from "./change-hub.js";
 import { realtimeRoutes } from "./realtime-routes.js";
 //#region src/realtime/realtime-app.ts
 /**
-* `/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
+* `/api/sb/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
 * the tables' RLS policies before it is sent, and broadcasts and presence between the channels of the process.
 */
 const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {

package/dist/realtime/realtime-routes.js

@@ -10,7 +10,7 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 	...token !== void 0 && { authorization: `Bearer ${token}` }
 } });
 /**
-* `GET /realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
+* `GET /api/sb/realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
 * resources, and broadcasts and presence between the sockets of this process (see `realtimeSocket`). A missing or wrong
 * key is refused before the upgrade, with 401.
 */

package/dist/realtime/realtime-socket.js

@@ -11,7 +11,7 @@ const refusal = (error) => {
 	throw error;
 };
 /**
-* One WebSocket of `/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
+* One WebSocket of `/api/sb/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
 * `postgres_changes` bindings and an access token, token refreshes on an open channel, broadcasts with their `self`
 * and `ack` options, presence tracking, and leaves. A channel's token ends it when it expires, unless a newer one came
 * first. Messages are handled one at a time, in order. Private channels are refused for now.

package/dist/rest/caller-settings.js

@@ -1,6 +1,6 @@
 //#region src/rest/caller-settings.ts
 /**
-* The transaction settings a `/rest/v1` request runs with, as Supabase's PostgREST sets them: `role`, which is
+* The transaction settings a `/api/sb/rest/v1` request runs with, as Supabase's PostgREST sets them: `role`, which is
 * `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
 * `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
 * database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the

package/dist/rest/foreign-keys.js

@@ -15,7 +15,7 @@ const readForeignKeys = async (db) => {
 	return rows;
 };
 /**
-* The foreign keys of the `public` schema, which `/rest/v1` embeds through, read from the catalog once and kept for the
+* The foreign keys of the `public` schema, which `/api/sb/rest/v1` embeds through, read from the catalog once and kept for the
 * process lifetime, as the scan guard keeps indexes: migrations run before a new version serves.
 */
 const foreignKeyCache = (db) => {

package/dist/rest/parse-select.js

@@ -7,7 +7,7 @@ const embedPattern = /^(?:([^:(!]+):(?!:))?([^!(]+)((?:![^!(]+)*)\(([\s\S]*)\)$/
 const parseEmbed = (item) => {
 	const [, alias, nameText = "", modifiers = "", inner = ""] = embedPattern.exec(item) ?? [];
 	const name = nameText.trim();
-	if (!name || name.startsWith("...") || name.includes(".") || name === "count") throw restError(400, "PGRST100", `"${item}" spreads a resource or calls an aggregate, which /rest/v1 does not support yet`);
+	if (!name || name.startsWith("...") || name.includes(".") || name === "count") throw restError(400, "PGRST100", `"${item}" spreads a resource or calls an aggregate, which /api/sb/rest/v1 does not support yet`);
 	const flags = modifiers.split("!").slice(1).map((flag) => flag.trim());
 	const hint = flags.find((flag) => flag !== "inner" && flag !== "left");
 	return {

package/dist/rest/rest-error.js

@@ -1,6 +1,6 @@
 import { isDatabaseError } from "../error-handler.js";
 //#region src/rest/rest-error.ts
-/** A `/rest/v1` error: its status, the body, and headers such as `Content-Range`. Thrown anywhere below the route. */
+/** A `/api/sb/rest/v1` error: its status, the body, and headers such as `Content-Range`. Thrown anywhere below the route. */
 var RestError = class RestError extends Error {
 	status;
 	body;
@@ -66,7 +66,7 @@ const databaseStatus = (code, message, anonymous) => {
 	return codeStatus[code] ?? prefixStatus.find(([prefix]) => code.startsWith(prefix))?.[1] ?? 400;
 };
 /**
-* The `/rest/v1` error an error stands for: its own, or a database error with PostgREST's status and the error's
+* The `/api/sb/rest/v1` error an error stands for: its own, or a database error with PostgREST's status and the error's
 * message, detail and hint, which PostgREST passes on as they are. Other errors give `undefined`. Refusing a write by
 * RLS is 401 for an anonymous caller and 403 for others, as on Supabase.
 */

package/dist/rest/rest-routes.js

@@ -7,7 +7,7 @@ import { tableRoutes } from "./table-routes.js";
 import { Hono } from "hono";
 //#region src/rest/rest-routes.ts
 /**
-* The PostgREST-compatible API supabase-js's `from()` and `rpc()` call, mounted at `/rest/v1`. Each request runs in one
+* The PostgREST-compatible API supabase-js's `from()` and `rpc()` call, mounted at `/api/sb/rest/v1`. Each request runs in one
 * transaction as `anon`, `authenticated` or the app's own role, so the tables' RLS policies decide what it may read and
 * write. Errors come back as PostgREST's `{ code, details, hint, message }`; an unexpected one as a 500 that names
 * nothing of it.

package/dist/rest/rpc-route.js

@@ -38,7 +38,7 @@ const call = async (deps, c) => {
 		const source = callSource(chosen, args);
 		const query = parseQuery(params, c.req.header("range") ?? null, new Set(given));
 		const shape = query.select.map((item) => {
-			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /rest/v1 does not support yet`);
+			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /api/sb/rest/v1 does not support yet`);
 			return item;
 		});
 		if (chosen.info.returns === "void") {

package/dist/rest/table-routes.js

@@ -13,7 +13,7 @@ import { Hono } from "hono";
 import { sql } from "kysely";
 //#region src/rest/table-routes.ts
 /**
-* The resource whose table `name` is, in the `public` schema or the search path's: `/rest/v1` serves the tables the app
+* The resource whose table `name` is, in the `public` schema or the search path's: `/api/sb/rest/v1` serves the tables the app
 * declares as resources, as PostgREST serves those of its exposed schema. Any other is 404 (PGRST205).
 */
 const servedEntry = (deps, name) => deps.registry.entries.find((one) => one.model.table.name === name && (one.model.table.schema ?? "public") === "public");
@@ -181,7 +181,7 @@ const remove = async (deps, foreignKeys, c) => {
 	return withHeaders(writeResponse(written, object, 200, 204, `*/${counted(prefer, written.total) ?? "*"}`), warning);
 };
 /**
-* `/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
+* `/api/sb/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
 * and the rows a write returns embed related rows through `foreignKeys`.
 */
 const tableRoutes = (deps, foreignKeys) => {

package/dist/storage/storage-db.js

@@ -3,7 +3,7 @@ import { callerSettings } from "../api-keys/caller-settings.js";
 import { sql } from "kysely";
 //#region src/storage/storage-db.ts
 /**
-* Makes the rest of the transaction run as `caller`: its role and claims, as `/rest/v1` sets them (see
+* Makes the rest of the transaction run as `caller`: its role and claims, as `/api/sb/rest/v1` sets them (see
 * `callerSettings`), so the restored `storage.objects` and `storage.buckets` policies decide what it reads and writes.
 * What runs before it runs as the app's own role, which owns the tables.
 */

package/dist/storage/storage-routes.js

@@ -5,7 +5,7 @@ import { signedRoutes } from "./signed-routes.js";
 import { Hono } from "hono";
 //#region src/storage/storage-routes.ts
 /**
-* The Storage-compatible API `supabase.storage` calls, mounted at `/storage/v1`, over the app's storage provider. Every
+* The Storage-compatible API `supabase.storage` calls, mounted at `/api/sb/storage/v1`, over the app's storage provider. Every
 * read and write of `storage.objects` and `storage.buckets` runs as the request's caller (`anon`, `authenticated` or
 * the app's own role), so the policies restored with them decide; public buckets and signed URLs need no key. Errors
 * come back as Supabase Storage's `{ statusCode, error, message }`; an unexpected one as a 500 that names nothing of it.

package/dist/supabase-paths.js

@@ -0,0 +1,11 @@
+//#region src/supabase-paths.ts
+/** Where the Supabase-compatible endpoints live, below the app's origin: supabase-js takes `<origin>/api/sb` as its URL. */
+const supabasePath = "/api/sb";
+/** The PostgREST-compatible API of `from()` and `rpc()`. */
+const restPath = `${supabasePath}/rest/v1`;
+/** The Realtime-compatible socket of `channel()`. */
+const realtimePath = `${supabasePath}/realtime/v1`;
+/** The Storage-compatible API of `storage`. */
+const storagePath = `${supabasePath}/storage/v1`;
+//#endregion
+export { realtimePath, restPath, storagePath, supabasePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.30.2",
+  "version": "0.31.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.30.2",
-    "@protobase/query": "0.30.2",
-    "@protobase/schema": "0.30.2",
+    "@protobase/layout": "0.31.0",
+    "@protobase/query": "0.31.0",
+    "@protobase/schema": "0.31.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",