@protobase/server 0.30.2 → 0.31.1

package/dist/admin-options.d.ts

@@ -1,10 +1,10 @@
 import { AuditQueue, PipelineHook, ScanGuardMode } from "./types.js";
+import { ApiKeysOptions } from "./api-keys/api-key-settings.js";
 import { ErrorReportingOptions } from "./error-reporting/error-reporting-settings.js";
 import { MapOptions } from "./maps/map-settings.js";
 import { PluginOption } from "./plugins/plugin-settings.js";
 import { SourceOption } from "./sources/source-settings.js";
 import { CorsOrigins } from "./api-cors.js";
-import { ApiKeysOptions } from "./api-keys/api-key-settings.js";
 import { AssistantOptions } from "./assistant/assistant-settings.js";
 import { LocaleOption } from "./locale/locale-option.js";
 import { RuntimeOptions } from "./runtime/runtime-settings.js";
@@ -14,8 +14,8 @@ export type AdminOptions = {
   /** Default `/api/v1`. */
   basePath?: string;
   /**
-   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/rest/v1` and the
-   * Realtime-compatible `/realtime/v1` and the Storage-compatible `/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
+   * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/api/sb/rest/v1` and the
+   * Realtime-compatible `/api/sb/realtime/v1` and the Storage-compatible `/api/sb/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
    * `PROTOBASE_SECRET_KEY`. Without either, or with `false`, the app serves neither.
    */
   apiKeys?: ApiKeysOptions | false;

package/dist/api-keys/caller-settings.js

@@ -1,6 +1,6 @@
 //#region src/api-keys/caller-settings.ts
 /**
-* The transaction settings a request admitted by key (`/rest/v1`, `/storage/v1`) runs with, as Supabase's PostgREST
+* The transaction settings a request admitted by key (`/api/sb/rest/v1`, `/api/sb/storage/v1`) runs with, as Supabase's PostgREST
 * sets them: `role`, which is `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
 * `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
 * database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the

package/dist/create-admin.d.ts

@@ -72,11 +72,11 @@ export type CreateAdminInput = {
   formsDifficulty?: Difficulty;
   /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
   commentUsers?: CommentUsers;
-  /** @internal Verifies a user's token on `/rest/v1`, `/realtime/v1` and `/storage/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
+  /** @internal Verifies a user's token on `/api/sb/rest/v1`, `/api/sb/realtime/v1` and `/api/sb/storage/v1` and gives its claims, which tests fake; those `/api/sb/auth/v1` signs otherwise. */
   verifyToken?: (token: string) => Promise<JWTPayload>;
   /**
    * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves
-   * supabase-js's Realtime at `/realtime/v1/websocket`; without it, the app serves none.
+   * supabase-js's Realtime at `/api/sb/realtime/v1/websocket`; without it, the app serves none.
    */
   upgradeWebSocket?: UpgradeWebSocket;
 };

package/dist/create-admin.js

@@ -19,6 +19,7 @@ import { realtimeApp } from "./realtime/realtime-app.js";
 import { restRoutes } from "./rest/rest-routes.js";
 import { storageRoutes } from "./storage/storage-routes.js";
 import { readAppName } from "./app-name.js";
+import { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePath } from "./supabase-paths.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
 import { organizationRoutes } from "./better-auth/organizations/admin-routes.js";
@@ -55,6 +56,7 @@ import { fileRoutes } from "./files/routes.js";
 import { formRoutes } from "./forms/routes.js";
 import { createFormsRuntime } from "./forms/runtime.js";
 import { functionRoutes } from "./functions/routes.js";
+import { supabaseFunctionRoutes } from "./functions/supabase-routes.js";
 import { localeSetting } from "./locale/locale-option.js";
 import { mapSettings } from "./maps/map-settings.js";
 import { pluginOptions, pluginsBeforeSignIn } from "./plugins/plugin-settings.js";
@@ -229,7 +231,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const corsOrigins = withMobileOrigins(options.cors ?? readCorsOrigins(globalThis.process?.env ?? {}), Boolean(mobile));
 	const ownOrigins = auth?.origins ?? [];
 	if (corsOrigins !== void 0 || ownOrigins.length > 1) {
-		const answering = [authBasePath, ...Object.entries(apiFunctions).filter(([, fn]) => fn.options.cors).map(([name]) => `${systemPath}/functions/${name}`)];
+		const answering = [authBasePath, ...Object.entries(apiFunctions).filter(([, fn]) => fn.options.cors).flatMap(([name]) => [`${systemPath}/functions/${name}`, `${supabaseFunctionsPath}/${name}`])];
 		const skip = (path) => answering.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 		const cors = apiCors({
 			own: ownOrigins,
@@ -237,7 +239,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			skip
 		});
 		app.use(`${systemPath}/*`, cors);
-		if (auth && !"/auth/v1".startsWith(`${systemPath}/`)) app.use(`${goTruePath}/*`, cors);
+		if ((servesKeys || auth) && !"/api/sb".startsWith(`${systemPath}/`)) app.use(`${supabasePath}/*`, cors);
 	}
 	if (auth) {
 		app.route(authBasePath, statusRoute(auth, {
@@ -279,6 +281,17 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		onError,
 		wake: () => wakeDispatch(deps)
 	}));
+	const verifyGoTrue = auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens"));
+	app.route("/", supabaseFunctionRoutes({
+		functions: apiFunctions,
+		db,
+		keys: apiKeys,
+		caller: apiKeyCaller({
+			keys: apiKeys,
+			verify: verifyGoTrue
+		}),
+		onError
+	}));
 	app.route("/", batchRoute(deps, authenticate, meta));
 	app.route("/", fileRoutes(deps, authenticate));
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
@@ -288,19 +301,18 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		schema: changes,
 		report
 	});
-	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
 	if (servesKeys) {
 		const verify = verifyToken ?? (auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens")));
 		const caller = apiKeyCaller({
 			keys: apiKeys,
 			verify
 		});
-		app.route("/rest/v1", restRoutes({
+		app.route(restPath, restRoutes({
 			deps,
 			caller,
 			report
 		}));
-		if (upgradeWebSocket) app.route("/realtime/v1", realtimeApp({
+		if (upgradeWebSocket) app.route(realtimePath, realtimeApp({
 			deps,
 			feed,
 			upgradeWebSocket,
@@ -317,12 +329,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 				maxBytes: files.storage.maxBytes,
 				caller
 			};
-			app.route("/storage/v1", storageRoutes({
+			app.route(storagePath, storageRoutes({
 				deps: storage,
 				report
 			}));
 		}
 	}
+	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));

package/dist/files/options.d.ts

@@ -23,9 +23,9 @@ export type FilesOptions = {
    */
   trustedHosts?: string[];
   /**
-   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/storage/v1` when it has an API key
+   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/api/sb/storage/v1` when it has an API key
    * (see `apiKeys`): `provider` names one of the providers, default `private`, and `maxFileSize` caps every upload, as
-   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/storage/v1`.
+   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/api/sb/storage/v1`.
    */
   storage?: {
     provider?: string;

package/dist/files/runtime.js

@@ -10,7 +10,7 @@ import { parseSize } from "@protobase/schema/internal";
 const ticketSeconds = 86400;
 const imageFields = (models) => models.flatMap((model) => Object.values(model.fields).flatMap(({ name, file }) => file && (file.variants || file.original || file.placeholder !== void 0) ? [`${model.name}.${name}`] : []));
 /**
-* The runtime, when a resource has a file field, the config names providers or the app serves `/storage/v1`. It fails at startup when a field's
+* The runtime, when a resource has a file field, the config names providers or the app serves `/api/sb/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
 const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
@@ -23,7 +23,7 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: se
 	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
 	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields and /storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	if (!secret) throw new Error("File fields and /api/sb/storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
 	const images = imageFields(models);
 	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
 	const providers = resolveProviders(options, env, used);

package/dist/files/storage-provider.d.ts

@@ -2,7 +2,7 @@ import { FileProvider } from "./store.js";
 import { FilesOptions } from "./options.js";
 //#region src/files/storage-provider.d.ts
 /**
- * The provider `/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
+ * The provider `/api/sb/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
  * command that writes them, such as `protobase import supabase`. Fails when `files.storage` is `false`.
  */
 export declare const storageProvider: (options: FilesOptions, env: Record<string, string | undefined>) => {

package/dist/files/storage-provider.js

@@ -1,9 +1,9 @@
 import { resolveProviders } from "./providers.js";
 //#region src/files/storage-provider.ts
-/** The provider `/storage/v1` keeps object bytes in: `files.storage.provider`, default `private`. */
+/** The provider `/api/sb/storage/v1` keeps object bytes in: `files.storage.provider`, default `private`. */
 const storageProviderName = (options) => options.storage === false ? void 0 : options.storage?.provider ?? "private";
 /**
-* The provider `/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
+* The provider `/api/sb/storage/v1` keeps object bytes in, as the app resolves it from the config and the environment, for a
 * command that writes them, such as `protobase import supabase`. Fails when `files.storage` is `false`.
 */
 const storageProvider = (options, env) => {

package/dist/functions/define-function.d.ts

@@ -1,4 +1,5 @@
 import { Session } from "../types.js";
+import { Caller } from "../api-keys/resolve-caller.js";
 import { FunctionRecords } from "./records.js";
 import { Capability } from "@protobase/schema";
 import { Db } from "@protobase/query";
@@ -20,6 +21,13 @@ export type FunctionCaller = {
 };
 /** What a function that needs a signed-in caller gets: the caller resolved before it runs. */
 export type FunctionContext = PublicFunctionContext & FunctionCaller;
+/** What a function gets at `/api/sb/functions/v1/<name>`, where supabase-js calls it: the caller its keys and token make. */
+export type KeyFunctionContext = {
+  name: string;
+  db: Db;
+  /** The caller of the `apikey` header and bearer token: rejects with a 401 problem when they admit nobody. */
+  caller: () => Promise<Caller>;
+};
 /** A Web-standard handler. Its request's path is the part after `/api/functions/<name>`: `/` or `/more/parts`. */
 export type FunctionHandler = (request: Request, context: FunctionContext) => Response | Promise<Response>;
 export type PublicFunctionHandler = (request: Request, context: PublicFunctionContext) => Response | Promise<Response>;

package/dist/functions/routes.js

@@ -59,4 +59,4 @@ const functionRoutes = ({ basePath, functions, authenticate, access, db, records
 	return app;
 };
 //#endregion
-export { functionRoutes };
+export { functionRoutes, relativeRequest };

package/dist/functions/supabase-routes.js

@@ -0,0 +1,49 @@
+import { notFound, unauthorized } from "../problem.js";
+import { supabaseFunctionsPath } from "../supabase-paths.js";
+import { invokeFunction } from "./define-function.js";
+import { runInBackground } from "../background-work.js";
+import { relativeRequest } from "./routes.js";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+//#region src/functions/supabase-routes.ts
+/**
+* The app's functions again at `/api/sb/functions/v1/<name>`, as Supabase serves Edge Functions. A protected function lets in
+* a request its app's keys admit, as Supabase's `verify_jwt` does, and a public one anyone. Either gets the key-made
+* caller, not the app's session, so a function with `roles` is served at `/api/functions/<name>` only. As on Supabase,
+* the function sees the path from its name on, `/<name>/more/parts`, and a CORS preflight, which carries no key,
+* reaches it unchecked.
+*/
+const supabaseFunctionRoutes = ({ functions, db, keys, caller, onError }) => {
+	const app = new Hono().basePath(supabaseFunctionsPath);
+	app.onError(onError);
+	const hasKeys = keys.publishable !== void 0 || keys.secret !== void 0;
+	for (const [name, fn] of Object.entries(functions)) {
+		const { options } = fn;
+		if (options.cors) app.use(`/${name}/*`, cors(options.cors));
+		app.all(`/${name}/*`, (c) => runInBackground(async () => {
+			if (!options.public && options.roles) throw notFound(`The function "${name}" checks roles, so it is served at /api/functions/${name} only`);
+			const request = relativeRequest(c.req.raw, supabaseFunctionsPath);
+			if (options.public || c.req.method === "OPTIONS") {
+				let resolved;
+				return invokeFunction(name, fn, request, {
+					name,
+					db,
+					caller: () => resolved ??= caller(c.req.raw)
+				});
+			}
+			if (!hasKeys) throw unauthorized("This app has no keys, so only its public functions answer here");
+			const resolved = await caller(c.req.raw);
+			return invokeFunction(name, fn, request, {
+				name,
+				db,
+				caller: async () => resolved
+			});
+		}));
+	}
+	app.all("/*", (c) => {
+		throw notFound(`There is no function at ${c.req.path}`);
+	});
+	return app;
+};
+//#endregion
+export { supabaseFunctionRoutes };

package/dist/functions/wait-until.d.ts

@@ -0,0 +1,10 @@
+//#region src/functions/wait-until.d.ts
+/**
+ * Keeps the process up until `work` settles, as Supabase's `EdgeRuntime.waitUntil`: a function answers at once and
+ * goes on working after its response. A graceful shutdown awaits the work (`backgroundSettled`); a process killed
+ * before it settles loses it. A rejection is printed, as nobody awaits the work to see it.
+ */
+export declare const waitUntil: (work: Promise<unknown>) => void;
+/** Resolves once every `waitUntil` work has settled, including work started while it waits. */
+export declare const backgroundSettled: () => Promise<void>;
+//#endregion

package/dist/functions/wait-until.js

@@ -0,0 +1,18 @@
+//#region src/functions/wait-until.ts
+const pending = /* @__PURE__ */ new Set();
+/**
+* Keeps the process up until `work` settles, as Supabase's `EdgeRuntime.waitUntil`: a function answers at once and
+* goes on working after its response. A graceful shutdown awaits the work (`backgroundSettled`); a process killed
+* before it settles loses it. A rejection is printed, as nobody awaits the work to see it.
+*/
+const waitUntil = (work) => {
+	const tracked = work.then(() => void 0, (error) => console.error(error));
+	pending.add(tracked);
+	tracked.then(() => pending.delete(tracked));
+};
+/** Resolves once every `waitUntil` work has settled, including work started while it waits. */
+const backgroundSettled = async () => {
+	while (pending.size > 0) await Promise.all(pending);
+};
+//#endregion
+export { backgroundSettled, waitUntil };

package/dist/gotrue/keys.d.ts

@@ -0,0 +1,5 @@
+import "jose";
+//#region src/gotrue/keys.d.ts
+/** Where the GoTrue-compatible endpoints are served, below the app's origin. */
+export declare const goTruePath = "/api/sb/auth/v1";
+//#endregion

package/dist/gotrue/keys.js

@@ -1,6 +1,7 @@
+import { supabasePath } from "../supabase-paths.js";
 //#region src/gotrue/keys.ts
 /** Where the GoTrue-compatible endpoints are served, below the app's origin. */
-const goTruePath = "/auth/v1";
+const goTruePath = `${supabasePath}/auth/v1`;
 /** The key pair the JWT plugin keeps beside its EdDSA one for these tokens; it makes it on the first token. */
 const goTrueKeyPair = { alg: "ES256" };
 const goTrueAlgorithm = goTrueKeyPair.alg;

package/dist/index.d.ts

@@ -22,6 +22,8 @@ import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, Subsc
 import { Sharp, renderVariant, thumbHash } from "./files/images.js";
 import { FileProvider, FileStore, StoredObject } from "./files/store.js";
 import { FilesOptions } from "./files/options.js";
+import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
+import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { ErrorReportingOptions, ErrorReportingSettings, errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { ChatMessage, ChatTextPart, Completion, CompletionOptions, ModelError, ModelSettings, ReasoningDetail, ReasoningEffort, ToolCall, ToolSpec, streamChatCompletion } from "./assistant/chat-completions.js";
 import { CleanupEntry, CleanupSchedule, ScheduledDelete, storageCleanupSchedule } from "./files/cleanup-schedule.js";
@@ -33,9 +35,8 @@ import { ResourceSource, configExports } from "./resource-source.js";
 import { SourceOption, SourceRef, checkSourceNames, sourceOptions, sourcesFor, sourcesVariable } from "./sources/source-settings.js";
 import { RecordKeyInput, ToolRecord, ToolRecords } from "./assistant/records.js";
 import { FunctionRecords, ListParams, RecordPage } from "./functions/records.js";
-import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
+import { ApiFunction, CorsOptions, FunctionApp, FunctionCaller, FunctionContext, FunctionHandler, FunctionOptions, FunctionSource, KeyFunctionContext, ProtectedFunctionOptions, PublicFunctionContext, PublicFunctionHandler, PublicFunctionOptions, defineFunction } from "./functions/define-function.js";
 import { CorsOrigins } from "./api-cors.js";
-import { ApiKeys, ApiKeysOptions, apiKeySettings, apiKeyVariables } from "./api-keys/api-key-settings.js";
 import { ConversationRecord, ConversationStore } from "./assistant/conversation-store.js";
 import { Conversation, ConversationsOptions, conversationKey, createConversations } from "./assistant/conversations.js";
 import { ApprovalAnswer, ApprovalRequest, requestApproval } from "./assistant/approval.js";
@@ -50,7 +51,6 @@ import { checkViewQueries } from "./check-view-queries.js";
 import { ProjectConfig, defineConfig, mergeConfig } from "./project-config.js";
 import { consoleAuditQueue } from "./audit/console-queue.js";
 import { JwtOptions, JwtVerifyOptions, jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
-import { Caller, CallerOptions, apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { HttpProblem, MissingCredentials, badRequest, forbidden, notFound, unauthorized } from "./problem.js";
 import { TrustedApp, withTrustedApps } from "./better-auth/app-tokens.js";
 import { BetterAuthAuthenticatorOptions, betterAuthAuthenticator, betterAuthTokens } from "./better-auth/authenticator.js";
@@ -58,6 +58,8 @@ import { parseRoles } from "./better-auth/parse-roles.js";
 import { LinkedAccount, NewUser, StoredUser, createUser, deleteUser, hasUsers, listUsers, roleChoices, setUserBanned, setUserRole } from "./better-auth/users.js";
 import { IssueTokenOptions, issueToken, maxTokenTtlSeconds } from "./better-auth/tokens.js";
 import { webauthnPath } from "./better-auth/origins.js";
+import { goTruePath } from "./gotrue/keys.js";
+import { supabasePath } from "./supabase-paths.js";
 import { defaultAppName } from "./app-name.js";
 import { authSchemaMigration, checkAuthSchema } from "./better-auth/auth-schema.js";
 import { changesMigration, checkChanges, migrationCommand } from "./changes/capture-schema.js";
@@ -86,6 +88,7 @@ import { startErrorReporting } from "./error-reporting/error-reporter.js";
 import { FunctionEnv, PublicFunctionEnv, functionApp } from "./functions/function-app.js";
 import { SignatureOptions, StandardWebhookOptions, verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
+import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { FileLimits, limitedFileStore, storeUsage } from "./files/limits.js";
 import { LocalFilesOptions, localFileStore, localFiles } from "./files/local-files.js";
 import { StoreFileInput, storeFile } from "./files/store-file.js";
@@ -102,4 +105,4 @@ import { isSchedule } from "./jobs/schedule.js";
 import { DrainResult, JobsRuntime, StartJobsOptions, startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
 import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type AppIcons, type AppIdentity, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type MemberInput, MissingCredentials, type MobileConfig, ModelError, type ModelSettings, type NewOrganization, type NewUser, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReasoningDetail, type ReasoningEffort, type RecordKeyInput, type RecordPage, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/index.js

@@ -23,6 +23,8 @@ import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtAuthenticator, jwtVerifier } from "./auth/jwt.js";
 import { objectKey } from "./storage/object-key.js";
 import { defaultAppName } from "./app-name.js";
+import { supabasePath } from "./supabase-paths.js";
+import { goTruePath } from "./gotrue/keys.js";
 import { defaultSignInPolicy, signInPolicyMethods } from "./better-auth/sign-in-policy.js";
 import { parseRoles } from "./better-auth/parse-roles.js";
 import { readOperatorSettings } from "./better-auth/operator-provider.js";
@@ -71,10 +73,11 @@ import { functionApp } from "./functions/function-app.js";
 import { readJson } from "./functions/read-json.js";
 import { verifySignature, verifyStandardWebhook } from "./functions/verify-signature.js";
 import { requireEnv } from "./functions/require-env.js";
+import { backgroundSettled, waitUntil } from "./functions/wait-until.js";
 import { storeFile } from "./files/store-file.js";
 import { createFileCleanup } from "./files/file-cleanup.js";
 import { aspectRatio, fileSize, fileType, imageSize, processor } from "./files/processors.js";
 import { defineEmail } from "./mail/define-email.js";
 import { startJobs } from "./jobs/runtime.js";
 import { jobsDrainApp } from "./jobs/drain-route.js";
-export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };
+export { FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, backgroundSettled, badRequest, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createFileCleanup, createOrganization, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteUser, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, goTruePath, handleDroppedConnections, hasUsers, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listUsers, localFileStore, localFiles, mapSettings, mapStyleUrl, mapStyleVariable, maxTokenTtlSeconds, maxWidgetPropsBytes, mergeConfig, migrationCommand, newWebhookSecret, normalizeRoles, notFound, objectKey, parseColumns, parseRoles, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, processor, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readWriteQueryTool, recordOf, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, setMemberRoles, setUserBanned, setUserRole, signInPolicyMethods, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, variantPath, verifySignature, verifyStandardWebhook, waitUntil, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps };

package/dist/realtime/change-checker.js

@@ -24,7 +24,7 @@ const seen = (entry, filters, rows) => new Map(rows.map((row) => [encodeKey(keyC
 }]));
 /**
 * Checks which changes callers may see, for every group in one read-only transaction: per group it sets the role and
-* claims as `/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
+* claims as `/api/sb/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
 * each filter in Postgres, as the column's type compares. The transaction holds one pooled connection only while it
 * runs. A group whose check fails is checked again in a transaction of its own, so it costs only its own callers the
 * batch.

package/dist/realtime/realtime-app.js

@@ -3,7 +3,7 @@ import { changeHub } from "./change-hub.js";
 import { realtimeRoutes } from "./realtime-routes.js";
 //#region src/realtime/realtime-app.ts
 /**
-* `/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
+* `/api/sb/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
 * the tables' RLS policies before it is sent, and broadcasts and presence between the channels of the process.
 */
 const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {

package/dist/realtime/realtime-routes.js

@@ -10,7 +10,7 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 	...token !== void 0 && { authorization: `Bearer ${token}` }
 } });
 /**
-* `GET /realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
+* `GET /api/sb/realtime/v1/websocket?apikey=…&vsn=…`: Supabase Realtime's socket, for `postgres_changes` of the live
 * resources, and broadcasts and presence between the sockets of this process (see `realtimeSocket`). A missing or wrong
 * key is refused before the upgrade, with 401.
 */

package/dist/realtime/realtime-socket.js

@@ -11,7 +11,7 @@ const refusal = (error) => {
 	throw error;
 };
 /**
-* One WebSocket of `/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
+* One WebSocket of `/api/sb/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
 * `postgres_changes` bindings and an access token, token refreshes on an open channel, broadcasts with their `self`
 * and `ack` options, presence tracking, and leaves. A channel's token ends it when it expires, unless a newer one came
 * first. Messages are handled one at a time, in order. Private channels are refused for now.

package/dist/rest/caller-settings.js

@@ -1,6 +1,6 @@
 //#region src/rest/caller-settings.ts
 /**
-* The transaction settings a `/rest/v1` request runs with, as Supabase's PostgREST sets them: `role`, which is
+* The transaction settings a `/api/sb/rest/v1` request runs with, as Supabase's PostgREST sets them: `role`, which is
 * `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
 * `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
 * database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the

package/dist/rest/foreign-keys.js

@@ -15,7 +15,7 @@ const readForeignKeys = async (db) => {
 	return rows;
 };
 /**
-* The foreign keys of the `public` schema, which `/rest/v1` embeds through, read from the catalog once and kept for the
+* The foreign keys of the `public` schema, which `/api/sb/rest/v1` embeds through, read from the catalog once and kept for the
 * process lifetime, as the scan guard keeps indexes: migrations run before a new version serves.
 */
 const foreignKeyCache = (db) => {

package/dist/rest/parse-select.js

@@ -7,7 +7,7 @@ const embedPattern = /^(?:([^:(!]+):(?!:))?([^!(]+)((?:![^!(]+)*)\(([\s\S]*)\)$/
 const parseEmbed = (item) => {
 	const [, alias, nameText = "", modifiers = "", inner = ""] = embedPattern.exec(item) ?? [];
 	const name = nameText.trim();
-	if (!name || name.startsWith("...") || name.includes(".") || name === "count") throw restError(400, "PGRST100", `"${item}" spreads a resource or calls an aggregate, which /rest/v1 does not support yet`);
+	if (!name || name.startsWith("...") || name.includes(".") || name === "count") throw restError(400, "PGRST100", `"${item}" spreads a resource or calls an aggregate, which /api/sb/rest/v1 does not support yet`);
 	const flags = modifiers.split("!").slice(1).map((flag) => flag.trim());
 	const hint = flags.find((flag) => flag !== "inner" && flag !== "left");
 	return {

package/dist/rest/rest-error.js

@@ -1,6 +1,6 @@
 import { isDatabaseError } from "../error-handler.js";
 //#region src/rest/rest-error.ts
-/** A `/rest/v1` error: its status, the body, and headers such as `Content-Range`. Thrown anywhere below the route. */
+/** A `/api/sb/rest/v1` error: its status, the body, and headers such as `Content-Range`. Thrown anywhere below the route. */
 var RestError = class RestError extends Error {
 	status;
 	body;
@@ -66,7 +66,7 @@ const databaseStatus = (code, message, anonymous) => {
 	return codeStatus[code] ?? prefixStatus.find(([prefix]) => code.startsWith(prefix))?.[1] ?? 400;
 };
 /**
-* The `/rest/v1` error an error stands for: its own, or a database error with PostgREST's status and the error's
+* The `/api/sb/rest/v1` error an error stands for: its own, or a database error with PostgREST's status and the error's
 * message, detail and hint, which PostgREST passes on as they are. Other errors give `undefined`. Refusing a write by
 * RLS is 401 for an anonymous caller and 403 for others, as on Supabase.
 */

package/dist/rest/rest-routes.js

@@ -7,7 +7,7 @@ import { tableRoutes } from "./table-routes.js";
 import { Hono } from "hono";
 //#region src/rest/rest-routes.ts
 /**
-* The PostgREST-compatible API supabase-js's `from()` and `rpc()` call, mounted at `/rest/v1`. Each request runs in one
+* The PostgREST-compatible API supabase-js's `from()` and `rpc()` call, mounted at `/api/sb/rest/v1`. Each request runs in one
 * transaction as `anon`, `authenticated` or the app's own role, so the tables' RLS policies decide what it may read and
 * write. Errors come back as PostgREST's `{ code, details, hint, message }`; an unexpected one as a 500 that names
 * nothing of it.

package/dist/rest/rpc-route.js

@@ -38,7 +38,7 @@ const call = async (deps, c) => {
 		const source = callSource(chosen, args);
 		const query = parseQuery(params, c.req.header("range") ?? null, new Set(given));
 		const shape = query.select.map((item) => {
-			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /rest/v1 does not support yet`);
+			if (item.kind === "embed") throw restError(400, "PGRST100", `"${item.name}" embeds a resource in a function's rows, which /api/sb/rest/v1 does not support yet`);
 			return item;
 		});
 		if (chosen.info.returns === "void") {

package/dist/rest/table-routes.js

@@ -13,7 +13,7 @@ import { Hono } from "hono";
 import { sql } from "kysely";
 //#region src/rest/table-routes.ts
 /**
-* The resource whose table `name` is, in the `public` schema or the search path's: `/rest/v1` serves the tables the app
+* The resource whose table `name` is, in the `public` schema or the search path's: `/api/sb/rest/v1` serves the tables the app
 * declares as resources, as PostgREST serves those of its exposed schema. Any other is 404 (PGRST205).
 */
 const servedEntry = (deps, name) => deps.registry.entries.find((one) => one.model.table.name === name && (one.model.table.schema ?? "public") === "public");
@@ -181,7 +181,7 @@ const remove = async (deps, foreignKeys, c) => {
 	return withHeaders(writeResponse(written, object, 200, 204, `*/${counted(prefer, written.total) ?? "*"}`), warning);
 };
 /**
-* `/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
+* `/api/sb/rest/v1/<table>`: read with GET and HEAD, insert and upsert with POST, update with PATCH, delete with DELETE. Reads
 * and the rows a write returns embed related rows through `foreignKeys`.
 */
 const tableRoutes = (deps, foreignKeys) => {

package/dist/storage/storage-db.js

@@ -3,7 +3,7 @@ import { callerSettings } from "../api-keys/caller-settings.js";
 import { sql } from "kysely";
 //#region src/storage/storage-db.ts
 /**
-* Makes the rest of the transaction run as `caller`: its role and claims, as `/rest/v1` sets them (see
+* Makes the rest of the transaction run as `caller`: its role and claims, as `/api/sb/rest/v1` sets them (see
 * `callerSettings`), so the restored `storage.objects` and `storage.buckets` policies decide what it reads and writes.
 * What runs before it runs as the app's own role, which owns the tables.
 */

package/dist/storage/storage-routes.js

@@ -5,7 +5,7 @@ import { signedRoutes } from "./signed-routes.js";
 import { Hono } from "hono";
 //#region src/storage/storage-routes.ts
 /**
-* The Storage-compatible API `supabase.storage` calls, mounted at `/storage/v1`, over the app's storage provider. Every
+* The Storage-compatible API `supabase.storage` calls, mounted at `/api/sb/storage/v1`, over the app's storage provider. Every
 * read and write of `storage.objects` and `storage.buckets` runs as the request's caller (`anon`, `authenticated` or
 * the app's own role), so the policies restored with them decide; public buckets and signed URLs need no key. Errors
 * come back as Supabase Storage's `{ statusCode, error, message }`; an unexpected one as a 500 that names nothing of it.

package/dist/supabase-paths.d.ts

@@ -0,0 +1,4 @@
+//#region src/supabase-paths.d.ts
+/** Where the Supabase-compatible endpoints live, below the app's origin: supabase-js takes `<origin>/api/sb` as its URL. */
+export declare const supabasePath = "/api/sb";
+//#endregion

package/dist/supabase-paths.js

@@ -0,0 +1,13 @@
+//#region src/supabase-paths.ts
+/** Where the Supabase-compatible endpoints live, below the app's origin: supabase-js takes `<origin>/api/sb` as its URL. */
+const supabasePath = "/api/sb";
+/** The PostgREST-compatible API of `from()` and `rpc()`. */
+const restPath = `${supabasePath}/rest/v1`;
+/** The Realtime-compatible socket of `channel()`. */
+const realtimePath = `${supabasePath}/realtime/v1`;
+/** The Storage-compatible API of `storage`. */
+const storagePath = `${supabasePath}/storage/v1`;
+/** Where `functions.invoke` calls a function: `<origin>/api/sb/functions/v1/<name>`. */
+const supabaseFunctionsPath = `${supabasePath}/functions/v1`;
+//#endregion
+export { realtimePath, restPath, storagePath, supabaseFunctionsPath, supabasePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.30.2",
+  "version": "0.31.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.30.2",
-    "@protobase/query": "0.30.2",
-    "@protobase/schema": "0.30.2",
+    "@protobase/layout": "0.31.1",
+    "@protobase/query": "0.31.1",
+    "@protobase/schema": "0.31.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",