vibecarbon 0.1.7 → 0.2.1

package/services/metabase/scripts/setup.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# Metabase Auto-Setup Script
+# Automatically configures Metabase with admin user and app database connection
+# Added via: vibecarbon add metabase
+
+set -e
+
+METABASE_URL="${METABASE_URL:-http://metabase:3000}"
+MAX_RETRIES=60
+RETRY_INTERVAL=5
+
+# Admin credentials (from environment)
+ADMIN_EMAIL="${METABASE_ADMIN_EMAIL:-admin@localhost}"
+ADMIN_PASSWORD="${METABASE_ADMIN_PASSWORD}"
+ADMIN_FIRST_NAME="${METABASE_ADMIN_FIRST_NAME:-Admin}"
+ADMIN_LAST_NAME="${METABASE_ADMIN_LAST_NAME:-User}"
+
+# App database connection details
+APP_DB_HOST="${APP_DB_HOST:-db}"
+APP_DB_PORT="${APP_DB_PORT:-5432}"
+APP_DB_NAME="${APP_DB_NAME:-postgres}"
+APP_DB_USER="${APP_DB_USER:-postgres}"
+APP_DB_PASSWORD="${DB_PASSWORD}"
+
+log() {
+  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >&2
+}
+
+wait_for_metabase() {
+  log "Waiting for Metabase to be ready..."
+  for i in $(seq 1 $MAX_RETRIES); do
+    if curl -sf "${METABASE_URL}/api/health" > /dev/null 2>&1; then
+      log "Metabase is healthy"
+      return 0
+    fi
+    log "Attempt $i/$MAX_RETRIES - Metabase not ready, waiting ${RETRY_INTERVAL}s..."
+    sleep $RETRY_INTERVAL
+  done
+  log "ERROR: Metabase failed to become healthy after $((MAX_RETRIES * RETRY_INTERVAL)) seconds"
+  exit 1
+}
+
+get_setup_token() {
+  curl -sf "${METABASE_URL}/api/session/properties" | jq -r '.["setup-token"] // empty'
+}
+
+check_setup_complete() {
+  local props
+  props=$(curl -sf "${METABASE_URL}/api/session/properties")
+  local setup_token
+  setup_token=$(echo "$props" | jq -r '.["setup-token"] // empty')
+  # Setup is truly complete only when there's no setup token left
+  [ -z "$setup_token" ]
+}
+
+run_initial_setup() {
+  log "Running initial Metabase setup..."
+
+  local setup_token
+  setup_token=$(get_setup_token)
+
+  if [ -z "$setup_token" ]; then
+    log "No setup token found — setup already complete."
+    return 1
+  fi
+
+  log "Got setup token, creating admin user and database connection..."
+
+  # Complete entire setup in one call: admin user + database + preferences.
+  # This properly consumes the setup token so Metabase won't show the wizard.
+  local payload
+  payload=$(cat <<EOF
+{
+  "token": "${setup_token}",
+  "user": {
+    "email": "${ADMIN_EMAIL}",
+    "password": "${ADMIN_PASSWORD}",
+    "first_name": "${ADMIN_FIRST_NAME}",
+    "last_name": "${ADMIN_LAST_NAME}",
+    "site_name": "{{PROJECT_NAME}}"
+  },
+  "database": {
+    "engine": "postgres",
+    "name": "Application Data",
+    "details": {
+      "host": "${APP_DB_HOST}",
+      "port": ${APP_DB_PORT},
+      "dbname": "${APP_DB_NAME}",
+      "user": "${APP_DB_USER}",
+      "password": "${APP_DB_PASSWORD}",
+      "ssl": false
+    }
+  },
+  "prefs": {
+    "site_name": "{{PROJECT_NAME}}",
+    "site_locale": "en",
+    "allow_tracking": false
+  }
+}
+EOF
+)
+
+  local response
+  response=$(curl -sf -X POST "${METABASE_URL}/api/setup" \
+    -H "Content-Type: application/json" \
+    -d "$payload")
+
+  if [ $? -eq 0 ]; then
+    log "Initial setup complete (admin user + database connection)"
+    echo "$response" | jq -r '.id // empty'
+  else
+    log "ERROR: Initial setup failed"
+    return 1
+  fi
+}
+
+main() {
+  log "Starting Metabase auto-setup..."
+
+  # Validate required environment variables
+  if [ -z "$ADMIN_PASSWORD" ]; then
+    log "ERROR: METABASE_ADMIN_PASSWORD is required"
+    exit 1
+  fi
+
+  if [ -z "$DB_PASSWORD" ]; then
+    log "ERROR: DB_PASSWORD is required"
+    exit 1
+  fi
+
+  # Wait for Metabase to be ready
+  wait_for_metabase
+
+  # Try to complete the full setup (consumes the setup token).
+  # The /api/setup endpoint creates admin user + database connection in one call.
+  if ! check_setup_complete; then
+    local session_id
+    session_id=$(run_initial_setup)
+
+    if [ -n "$session_id" ]; then
+      log "Metabase auto-setup complete!"
+      exit 0
+    fi
+
+    log "ERROR: Initial setup failed and setup token is still present"
+    exit 1
+  fi
+
+  log "Metabase setup already complete, nothing to do."
+}
+
+main "$@"

package/services/n8n/compose/docker-compose.override.yml

@@ -0,0 +1,14 @@
+# Development overrides for n8n
+# Use with: docker compose -f docker-compose.yml -f docker-compose.n8n.yml -f docker-compose.n8n.override.yml up -d
+
+services:
+  n8n:
+    labels:
+      # Dev: No auth required (same as studio/traefik in local dev)
+      # Production uses ForwardAuth via docker-compose.n8n.yml labels
+      # Empty middlewares override removes ForwardAuth requirement
+      - "traefik.enable=true"
+      - "traefik.http.routers.n8n.rule=Host(`n8n.localhost`)"
+      - "traefik.http.routers.n8n.entrypoints=web"
+      - "traefik.http.routers.n8n.middlewares="
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

package/services/n8n/compose/docker-compose.prod.yml

@@ -0,0 +1,32 @@
+# n8n Production Overrides
+# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.n8n.yml -f docker-compose.n8n.prod.yml up -d
+#
+# Adds:
+# - SSL subdomain routing for n8n (n8n.yourdomain.com)
+# - ForwardAuth (super_admin role required)
+# - HTTP to HTTPS redirect
+
+services:
+  n8n:
+    environment:
+      # Override URLs for production subdomain
+      - N8N_HOST=n8n.${DOMAIN}
+      - N8N_PROTOCOL=https
+      - WEBHOOK_URL=https://n8n.${DOMAIN}/
+      - N8N_EDITOR_BASE_URL=https://n8n.${DOMAIN}/
+      - N8N_SECURE_COOKIE=true
+    ports: []  # Reached via Traefik over the compose network; no host port in prod
+    labels:
+      # Production Traefik routing with SSL
+      - "traefik.enable=true"
+      # HTTPS router with super_admin auth + security headers
+      - "traefik.http.routers.n8n.rule=Host(`n8n.${DOMAIN}`)"
+      - "traefik.http.routers.n8n.entrypoints=websecure"
+      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.n8n.middlewares=super-admin-auth@file,security-headers@file"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.n8n-http.rule=Host(`n8n.${DOMAIN}`)"
+      - "traefik.http.routers.n8n-http.entrypoints=web"
+      - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"

package/services/n8n/compose/docker-compose.yml

@@ -0,0 +1,99 @@
+# n8n Workflow Automation - Docker Compose Override
+# Use with: docker compose -f docker-compose.yml -f docker-compose.n8n.yml up -d
+
+services:
+  # Extend db service to add n8n database initialization
+  db:
+    volumes:
+      - ./volumes/db/n8n-init.sh:/docker-entrypoint-initdb.d/zz-n8n-init.sh:Z
+
+  n8n:
+    image: n8nio/n8n:latest
+    container_name: ${PROJECT_NAME}-n8n
+    restart: unless-stopped
+    ports:
+      - "5678:5678"
+    environment:
+      # n8n Configuration
+      - N8N_HOST=0.0.0.0
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=http
+      - N8N_SECURE_COOKIE=false
+      - NODE_ENV=production
+      - WEBHOOK_URL=http://localhost:5678/
+      - GENERIC_TIMEZONE=UTC
+      # ForwardAuth SSO hook
+      - EXTERNAL_HOOK_FILES=/home/node/.n8n/hooks.js
+
+      # Database Configuration (n8n workflow storage)
+      # Uses dedicated 'n8n' user created by n8n-init.sh
+      - DB_TYPE=postgresdb
+      - DB_POSTGRESDB_HOST=db
+      - DB_POSTGRESDB_PORT=5432
+      - DB_POSTGRESDB_DATABASE=n8n
+      - DB_POSTGRESDB_USER=n8n
+      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
+
+      # Supabase Integration (for workflows)
+      # Use these in your n8n workflows to connect to your app's backend
+      - SUPABASE_URL=http://kong:8000
+      - SUPABASE_ANON_KEY=${SUPABASE_ANON_KEY}
+      - SUPABASE_SERVICE_ROLE_KEY=${SUPABASE_SERVICE_ROLE_KEY}
+      - SUPABASE_DB_HOST=db
+      - SUPABASE_DB_PORT=5432
+      - SUPABASE_DB_NAME=postgres
+      - SUPABASE_DB_USER=supabase_admin
+      - SUPABASE_DB_PASSWORD=${POSTGRES_PASSWORD}
+
+      # Queue mode (requires Redis — added automatically with n8n)
+      - EXECUTIONS_MODE=queue
+      - QUEUE_BULL_REDIS_HOST=redis
+      - QUEUE_BULL_REDIS_PORT=6379
+      - QUEUE_BULL_REDIS_PASSWORD=${REDIS_PASSWORD:-}
+
+      # Metrics for Prometheus (optional)
+      - N8N_METRICS=true
+      - N8N_METRICS_PREFIX=n8n_
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:5678/healthz || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    volumes:
+      - n8n_data:/home/node/.n8n
+      - ./volumes/n8n/hooks.js:/home/node/.n8n/hooks.js:ro
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+    labels:
+      # Traefik routing with ForwardAuth (super_admin only)
+      - "traefik.enable=true"
+      - "traefik.http.routers.n8n.rule=Host(`n8n.localhost`)"
+      - "traefik.http.routers.n8n.entrypoints=web"
+      - "traefik.http.routers.n8n.middlewares=super-admin-auth@file"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+  n8n-setup:
+    image: alpine:latest
+    container_name: ${PROJECT_NAME}-n8n-setup
+    volumes:
+      - ./volumes/n8n/scripts:/scripts:ro
+    environment:
+      - N8N_ADMIN_EMAIL=${N8N_ADMIN_EMAIL:-${ADMIN_EMAIL}}
+      - N8N_DB_HOST=db
+      - N8N_DB_NAME=n8n
+      - N8N_DB_USER=n8n
+      - N8N_DB_PASSWORD=${POSTGRES_PASSWORD}
+    entrypoint: ["/bin/sh", "-c", "apk add --no-cache postgresql16-client && sh /scripts/setup.sh"]
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - vibecarbon-network
+    restart: "no"
+
+volumes:
+  n8n_data:

package/services/n8n/db/init.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -e
+
+# n8n Database Initialization
+# Creates dedicated n8n user and database for workflow automation
+# Password is injected from POSTGRES_PASSWORD env var at runtime (never hardcoded)
+
+# Create n8n role if it doesn't exist (quoted heredoc — no variable expansion)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<'EOSQL'
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'n8n') THEN
+        CREATE ROLE n8n WITH LOGIN;
+    END IF;
+END
+$$;
+EOSQL
+
+# Set password and create database (unquoted heredoc — POSTGRES_PASSWORD is expanded)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<EOSQL
+ALTER ROLE n8n WITH PASSWORD '${POSTGRES_PASSWORD}';
+SELECT 'CREATE DATABASE n8n WITH OWNER n8n ENCODING ''UTF8'' TEMPLATE template0'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'n8n')\gexec
+GRANT ALL PRIVILEGES ON DATABASE n8n TO n8n;
+EOSQL

package/services/n8n/docs/SSO.md

@@ -0,0 +1,124 @@
+# n8n Single Sign-On via Traefik ForwardAuth
+
+## How it works
+
+### Production (real domains)
+
+In production, the app and n8n share a parent domain (e.g., `app.example.com` and `n8n.example.com`). The Supabase auth cookie is set with `domain=.example.com`, so it's sent to all subdomains. The flow:
+
+1. User visits `n8n.example.com`
+2. Traefik applies `super-admin-auth@file` middleware (ForwardAuth)
+3. `verify-role.ts` reads the `sb-auth-token` cookie, validates the JWT, checks `super_admin` role
+4. On success, Traefik forwards `X-User-Email` header to n8n
+5. `hooks.js` middleware reads the header, finds/creates the n8n user, issues `n8n-auth` session cookie
+6. User sees the n8n editor — no login page
+
+### Development (localhost)
+
+In dev, `localhost` and `n8n.localhost` are treated as **separate domains** by browsers (`.localhost` is a public suffix). Cookies set on `localhost` are NOT sent to `n8n.localhost`. This means ForwardAuth can't work — the auth cookie never reaches the verify-role endpoint.
+
+Instead, n8n uses its **own built-in auth** in dev:
+
+1. `setup.sh` sidecar creates an owner user with a random password hash (stored in the n8n database)
+2. User visits `http://n8n.localhost` → sees n8n's login page
+3. Logs in with their admin email and the password configured at project creation
+
+The SSO hook (`hooks.js`) is still loaded but has no effect since ForwardAuth headers are absent — it calls `next()` and falls through to n8n's normal auth.
+
+## Architecture
+
+```
+Production:
+  Browser → Traefik → ForwardAuth (verify-role) → n8n (hooks.js sets cookie)
+                           │                            │
+                      Reads sb-auth-token          Reads X-User-Email
+                      Sets X-User-* headers        Issues n8n-auth cookie
+
+Development:
+  Browser → Traefik → n8n (no ForwardAuth, native login)
+```
+
+## Components
+
+| Component | File | Purpose |
+|-----------|------|---------|
+| SSO hook | `volumes/n8n/hooks.js` | Express middleware: reads `X-User-Email`, auto-creates user, issues session cookie |
+| DB setup sidecar | `volumes/n8n/scripts/setup.sh` | Creates owner user in PostgreSQL so setup wizard is skipped |
+| ForwardAuth config (prod) | `volumes/traefik/middlewares.yml` | Chains header stripping → role verification |
+| ForwardAuth config (dev) | `volumes/traefik/middlewares.dev.yml` | Same, routes to `host.docker.internal:3000` |
+| Verify-role endpoint | `src/server/routes/_internal/verify-role.ts` | Validates JWT, checks role, sets `X-User-*` headers |
+| Compose (dev) | `docker-compose.n8n.yml` | No ForwardAuth middleware on n8n router |
+| Compose (prod) | Production overlay adds `super-admin-auth@file` middleware label |
+
+## Key implementation details
+
+### hooks.js (n8n v2.x / Express 5)
+
+- **Export format**: `{ n8n: { ready: [fn] } }` — two-level nested, NOT `{ 'n8n.ready': [fn] }`
+- **Router access**: Express 5 uses `app.router.stack` (not `app._router.stack`)
+- **Layer creation**: Must use `require('router/lib/layer')` to create proper Layer instances (plain objects cause `layer.match is not a function`)
+- **User repository**: Available via `this.dbCollections.User` (provided by hook context)
+- **Session cookies**: Use `Container.get(AuthService).issueCookie()` from `@n8n/di` (not `@n8n/api` which doesn't exist)
+- **User role column**: n8n v2.x uses `roleSlug` (FK to `role` table), not `role`
+- **User lookup**: Must include `relations: ['role']` for `issueCookie()` to work
+
+### setup.sh (n8n v2.x schema)
+
+n8n v2.x auto-creates a skeleton owner row (no email) during migration. The setup script:
+
+1. Waits for n8n's `user` table to exist
+2. UPDATEs the skeleton owner to set email, name, bcrypt password, and `lastActiveAt`
+3. Falls back to INSERT if no skeleton owner exists
+4. Sets `userManagement.isInstanceOwnerSetUp = true` in the `settings` table
+
+All three are required to skip the setup wizard:
+- `hasInstanceOwner()` checks: `password IS NOT NULL` OR `lastActiveAt IS NOT NULL`
+- `showSetupOnFirstLoad` checks: `!(await hasInstanceOwner())`
+- Frontend also checks the `isInstanceOwnerSetUp` setting
+
+### DB password
+
+The n8n compose uses `POSTGRES_PASSWORD` (the project's DB password) for the n8n DB connection. This matches what `n8n-init.sh` sets for the `n8n` PostgreSQL role. Do NOT use a separate `N8N_DB_PASSWORD` with a different default.
+
+## Troubleshooting
+
+### n8n crash loop: "Problem loading external hook file"
+
+Check the export format. n8n's `loadHooks()` expects `{ resource: { operation: [fn] } }`. A flat key like `'n8n.ready'` causes `Spread syntax requires ...iterable[Symbol.iterator]` because it tries to spread a function.
+
+### n8n crash loop: "layer.match is not a function"
+
+The hooks.js spliced a plain object into Express 5's router stack. Use `require('router/lib/layer')` to create proper Layer instances.
+
+### Setup wizard still appears
+
+Check all three conditions:
+```bash
+# 1. Owner has password or lastActiveAt
+docker compose exec db psql -U supabase_admin -d n8n -c \
+  "SELECT email, password IS NOT NULL, \"lastActiveAt\" FROM \"user\" WHERE \"roleSlug\" = 'global:owner';"
+
+# 2. Setting is true
+docker compose exec db psql -U supabase_admin -d n8n -c \
+  "SELECT value FROM settings WHERE key = 'userManagement.isInstanceOwnerSetUp';"
+
+# 3. REST API confirms
+curl -s http://n8n.localhost/rest/settings | python3 -m json.tool | grep showSetup
+```
+
+### "password authentication failed for user n8n"
+
+The n8n compose DB password doesn't match what `n8n-init.sh` set. Ensure both use `${POSTGRES_PASSWORD}`.
+
+### ForwardAuth returns 401 in production
+
+1. Check the `sb-auth-token` cookie is set with the correct domain (`.example.com`)
+2. Check `authRequestHeaders` includes `Cookie`, `Authorization`, and `Accept`
+3. Check the user has `super_admin` in `app_metadata.role`
+
+### SSO hook doesn't fire (no log output)
+
+1. Verify hooks.js is mounted: `docker exec <n8n> cat /home/node/.n8n/hooks.js`
+2. Check `EXTERNAL_HOOK_FILES` env var is set
+3. Check for `[hooks.js] ForwardAuth SSO middleware installed` in logs
+4. If middleware installed but not firing, check for stale `n8n-auth` cookie (hook skips when present)

package/services/n8n/docs/integration.md

@@ -0,0 +1,155 @@
+# n8n Integration with Supabase
+
+This guide shows how to connect n8n workflows to your Vibecarbon application's Supabase backend.
+
+## Overview
+
+n8n is pre-configured with:
+- Dedicated PostgreSQL database (`n8n`) for workflow storage
+- Environment variables for easy Supabase integration
+- Network access to all your app's services
+
+## Quick Start
+
+### 1. Access n8n
+
+```bash
+# Start services (if not already running)
+pnpm docker:up
+
+# Open n8n
+open http://n8n.localhost
+```
+
+**Login:** Use your admin email and the password set during project creation. In development, n8n uses its own built-in authentication (ForwardAuth SSO only applies in production).
+
+### 2. Use Supabase in Workflows
+
+n8n has the following environment variables available:
+
+```bash
+SUPABASE_URL=http://kong:8000          # Internal Supabase API Gateway
+SUPABASE_ANON_KEY=your_anon_key        # Public API key
+SUPABASE_SERVICE_ROLE_KEY=your_key     # Admin API key
+SUPABASE_DB_HOST=db                    # Direct database access
+SUPABASE_DB_PORT=5432
+SUPABASE_DB_NAME=postgres
+SUPABASE_DB_USER=postgres
+SUPABASE_DB_PASSWORD=your_password
+```
+
+## Example Workflows
+
+### Example 1: Query Supabase Database
+
+Use the **Postgres** node:
+
+```
+Connection Settings:
+- Host: {{$env.SUPABASE_DB_HOST}}
+- Port: {{$env.SUPABASE_DB_PORT}}
+- Database: {{$env.SUPABASE_DB_NAME}}
+- User: {{$env.SUPABASE_DB_USER}}
+- Password: {{$env.SUPABASE_DB_PASSWORD}}
+
+Query:
+SELECT * FROM users WHERE created_at > NOW() - INTERVAL '1 day';
+```
+
+### Example 2: Call Supabase REST API
+
+Use the **HTTP Request** node:
+
+```
+Method: POST
+URL: {{$env.SUPABASE_URL}}/rest/v1/todos
+
+Headers:
+- apikey: {{$env.SUPABASE_SERVICE_ROLE_KEY}}
+- Authorization: Bearer {{$env.SUPABASE_SERVICE_ROLE_KEY}}
+- Content-Type: application/json
+
+Body (JSON):
+{
+  "title": "New todo from n8n",
+  "completed": false
+}
+```
+
+### Example 3: Listen to Supabase Webhooks
+
+1. Create a **Webhook** node in n8n
+2. Copy the webhook URL (e.g., `http://localhost:5678/webhook/my-webhook`)
+3. In Supabase (or your app), configure a webhook to call this URL
+
+### Example 4: Trigger on Database Changes
+
+Use **Postgres Trigger** node:
+
+```
+Connection Settings: (use environment variables as above)
+
+Trigger: On Row Insert
+Table: users
+
+Returns:
+- NEW row data
+```
+
+## Common Use Cases
+
+### User Onboarding
+
+```
+Trigger: Postgres Trigger (users table insert)
+Action 1: Send welcome email (Email node)
+Action 2: Create user profile (HTTP Request to your API)
+Action 3: Add to analytics (HTTP Request to analytics service)
+```
+
+### Scheduled Reports
+
+```
+Trigger: Cron (daily at 9 AM)
+Action 1: Query database for metrics (Postgres node)
+Action 2: Generate report (Code node)
+Action 3: Send email (Email node)
+```
+
+### API Integration
+
+```
+Trigger: Webhook (from external service)
+Action 1: Transform data (Code node)
+Action 2: Insert into Supabase (HTTP Request or Postgres node)
+Action 3: Notify users (Push notification)
+```
+
+## Best Practices
+
+### 1. Use Environment Variables
+
+Instead of hardcoding credentials, always use:
+```
+{{$env.SUPABASE_URL}}
+{{$env.SUPABASE_SERVICE_ROLE_KEY}}
+```
+
+### 2. Error Handling
+
+Add **Error Trigger** nodes to handle failures gracefully.
+
+### 3. Testing
+
+Use the **Manual Trigger** node during development.
+
+### 4. Security
+
+- Use `SUPABASE_SERVICE_ROLE_KEY` only for admin operations
+- Use `SUPABASE_ANON_KEY` for public operations
+- Never expose service role key in client-side workflows
+
+## Learn More
+
+- [n8n Documentation](https://docs.n8n.io/)
+- [Supabase API Reference](https://supabase.com/docs/reference/javascript/introduction)