fix: align every remaining /api/ reference to /api/v1/

The v0.7.0 versioning sprint left a long tail of non-route references
to the old unversioned paths in:

  Runtime fetches missed by the original sed:
    sdk-js/src/codegen/flags.ts        — vb-flags CLI 404'd against admin
    admin/src/theme.ts                 — public theme endpoint, fixed in b3348a2

  Display strings + UI labels:
    admin/src/pages/{Settings,Hooks,Records,CollectionEdit,
                     NewCollectionModal,AuditLog}.tsx
    admin/src/components/CodeEditor.tsx
    admin/src/stores/auth.ts
    admin/src/App.tsx
    admin/src/pages/Setup.tsx

  Server-side comments + log strings:
    src/api/{audit-log,auth,flags,security,theme,webhooks}.ts
    src/core/{audit-log,collections,routes,update-check,version}.ts
    src/db/schema.ts
    src/realtime/{manager,sse}.ts

  SDK help/doc strings:
    sdk-js/src/codegen/{bin,generate}.ts
    sdk-js/src/flags/manager.ts
    sdk-js/src/realtime/manager.ts
    sdk-js/README.md

The path-introspection sites in src/api/ratelimit.ts and
src/core/audit-log.ts SKIP_PATHS are intentionally left referencing
'/api/admin/...' (without /v1/) because they run after normalizeApiPath
strips the version prefix. Comments document this; tests verify it.

637 + 65 tests pass; vaultbase + admin + sdk + docs all build clean.

Author: khalidsheet

admin/src/App.tsx

@@ -45,7 +45,7 @@ function RequireUnauth({ children }: { children: React.ReactNode }) {
  * Boot-time check: probe whether any admin exists. Runs once at app mount.
  *   - No admin yet  → force redirect to /_/setup (any other route bounces).
  *   - Admin exists  → /_/setup is closed; bounce to /_/login (or /_/ if authed).
- * Status endpoint is read-only (`GET /api/admin/setup/status`) so the probe
+ * Status endpoint is read-only (`GET /api/v1/admin/setup/status`) so the probe
  * doesn't write to logs or trip rate limits.
  */
 function SetupRedirect({ children }: { children: React.ReactNode }) {

admin/src/components/CodeEditor.tsx

@@ -412,7 +412,7 @@ interface RouteContext {
   req: Request;
   /** HTTP method (GET, POST, …) */
   method: string;
-  /** Inner path (after the /api/custom prefix) */
+  /** Inner path (after the /api/v1/custom prefix) */
   path: string;
   /** Path params from :name segments */
   params: Record<string, string>;

admin/src/pages/AuditLog.tsx

@@ -157,7 +157,7 @@ export default function AuditLog() {
           onRowClick={(e) => setOpen(e.data as AuditEntry)}
           selection={open}
           dataKey="id"
-          emptyMessage="No audit entries yet. State-changing /api/admin/* requests show up here."
+          emptyMessage="No audit entries yet. State-changing /api/v1/admin/* requests show up here."
           style={{ fontSize: 13 }}
         >
           <Column

admin/src/pages/CollectionEdit.tsx

@@ -1024,7 +1024,7 @@ function FieldOptionsBody({
               <div style={{ fontSize: 13, fontWeight: 500 }}>Protected</div>
               <div className="muted" style={{ fontSize: 11, marginTop: 2 }}>
                 Public GETs return 401. Issue a 1h access token via{" "}
-                <span className="mono">POST /api/files/.../token</span>, then pass <span className="mono">?token=</span>.
+                <span className="mono">POST /api/v1/files/.../token</span>, then pass <span className="mono">?token=</span>.
               </div>
             </div>
             <Toggle

admin/src/pages/Hooks.tsx

@@ -129,7 +129,7 @@ const ROUTE_METHODS = ["GET", "POST", "PATCH", "PUT", "DELETE"] as const;
 const ROUTE_TEMPLATE = `// Available context:
 //   ctx.req         — raw Request
 //   ctx.method      — "GET" | "POST" | …
-//   ctx.path        — inner path after /api/custom
+//   ctx.path        — inner path after /api/v1/custom
 //   ctx.params      — { id: "..." } from :name segments
 //   ctx.query       — query string params
 //   ctx.body        — parsed JSON body (or text/null)
@@ -570,7 +570,7 @@ function RoutesTab() {
   async function handleDelete(r: CustomRoute) {
     const ok = await confirm({
       title: "Delete custom route",
-      message: `Delete the route ${r.method} /api/custom${r.path}?`,
+      message: `Delete the route ${r.method} /api/v1/custom${r.path}?`,
       danger: true,
     });
     if (!ok) return;
@@ -593,7 +593,7 @@ function RoutesTab() {
             <div className="empty">Loading…</div>
           ) : routes.length === 0 ? (
             <div className="empty">
-              No custom routes. Routes mount under <code style={{ fontFamily: "var(--font-mono)" }}>/api/custom/&lt;your-path&gt;</code>.
+              No custom routes. Routes mount under <code style={{ fontFamily: "var(--font-mono)" }}>/api/v1/custom/&lt;your-path&gt;</code>.
             </div>
           ) : (
             <table className="table">
@@ -621,7 +621,7 @@ function RoutesTab() {
                       <span className={`badge method-${r.method.toLowerCase()}`}>{r.method}</span>
                     </td>
                     <td className="mono-cell" onClick={() => setEditing(r)} style={{ cursor: "pointer" }}>
-                      <span style={{ color: "var(--text-muted)" }}>/api/custom</span>
+                      <span style={{ color: "var(--text-muted)" }}>/api/v1/custom</span>
                       <span style={{ color: "var(--accent-light)" }}>{r.path}</span>
                     </td>
                     <td
@@ -788,7 +788,7 @@ function RouteEditor({
           </div>
           <div style={{ display: "flex", flexDirection: "column", gap: 4, flex: 1, minWidth: 240 }}>
             <span style={{ fontSize: 10.5, color: "var(--text-muted)", textTransform: "uppercase", letterSpacing: "0.06em" }}>
-              Path <span className="muted" style={{ textTransform: "none", letterSpacing: 0 }}>(mounts under /api/custom)</span>
+              Path <span className="muted" style={{ textTransform: "none", letterSpacing: 0 }}>(mounts under /api/v1/custom)</span>
             </span>
             <input
               className="input mono"
@@ -828,7 +828,7 @@ function RouteEditor({
           <div className="muted" style={{ fontSize: 11, display: "flex", gap: 16, flexWrap: "wrap" }}>
             <span>Type <span className="mono">ctx.</span> for autocomplete</span>
             <span>·</span>
-            <span>Mounts at <span className="mono" style={{ color: "var(--accent-light)" }}>{method} /api/custom{path}</span></span>
+            <span>Mounts at <span className="mono" style={{ color: "var(--accent-light)" }}>{method} /api/v1/custom{path}</span></span>
             <span>·</span>
             <span>Throw or call <span className="mono">ctx.helpers.abort(msg)</span> → 422</span>
           </div>

admin/src/pages/NewCollectionModal.tsx

@@ -243,7 +243,7 @@ export default function NewCollectionModal({
             ))}
           </div>
           <div className="muted" style={{ fontSize: 11, marginTop: 4 }}>
-            {type === "auth" && <>Email + password sign-up via <span className="mono">/api/auth/{collName || "name"}/register</span>. Field names <span className="mono">email</span>, <span className="mono">password</span>, <span className="mono">verified</span> are managed by the implicit auth schema and cannot be redefined.</>}
+            {type === "auth" && <>Email + password sign-up via <span className="mono">/api/v1/auth/{collName || "name"}/register</span>. Field names <span className="mono">email</span>, <span className="mono">password</span>, <span className="mono">verified</span> are managed by the implicit auth schema and cannot be redefined.</>}
             {type === "view" && <>Read-only collection backed by a SQL <span className="mono">SELECT</span>. Defaults to admin-only access — open it up via the API rules after creation. Writes return 405.</>}
             {type === "base" && <>Standard records collection. CRUD via <span className="mono">/api/{collName || "name"}</span>.</>}
           </div>

admin/src/pages/Records.tsx

@@ -164,7 +164,7 @@ function useRelationCache(fields: FieldDef[], enabled: boolean): RelationCache {
 
 /**
  * In-memory cache of protected-file tokens keyed by filename. Tokens are
- * minted lazily via `POST /api/files/:collection/:recordId/:field/:filename/token`
+ * minted lazily via `POST /api/v1/files/:collection/:recordId/:field/:filename/token`
  * and reused until they expire (~1h server-side). We refresh ~60s before
  * expiry to dodge edge-of-window failures.
  *
@@ -826,7 +826,7 @@ export default function Records() {
               onClick={() => setShowNew(true)}
               disabled={!collection || collection.type === "auth" || collection.type === "view"}
               title={
-                collection?.type === "auth" ? "Users register via POST /api/auth/<collection>/register"
+                collection?.type === "auth" ? "Users register via POST /api/v1/auth/<collection>/register"
                 : collection?.type === "view" ? "View collections are read-only"
                 : undefined
               }

admin/src/pages/Settings.tsx

@@ -1160,7 +1160,7 @@ function MetricsSection() {
       <div className="settings-section-head" style={{ justifyContent: "space-between" }}>
         <div style={{ display: "flex", alignItems: "center", gap: 10 }}>
           <h3>Health &amp; metrics</h3>
-          <span className="meta">Prometheus exposition at <code style={codeStyle}>/api/metrics</code></span>
+          <span className="meta">Prometheus exposition at <code style={codeStyle}>/api/v1/metrics</code></span>
         </div>
         <div style={{ display: "flex", alignItems: "center", gap: 8 }}>
           <Toggle on={enabled} onChange={setEnabled} />
@@ -1174,7 +1174,7 @@ function MetricsSection() {
           <label className="label">Bearer token (optional)</label>
           <div className="help">
             When set, scrapers must send <code style={codeStyle}>Authorization: Bearer &lt;token&gt;</code>.
-            Leave blank to expose <code style={codeStyle}>/api/metrics</code> publicly — only do this
+            Leave blank to expose <code style={codeStyle}>/api/v1/metrics</code> publicly — only do this
             if the endpoint is protected at the proxy layer.
           </div>
         </div>
@@ -1760,7 +1760,7 @@ function EmailTemplatesSection() {
         <div className="label-block span2">
           <label className="label">Verification email</label>
           <div className="help">
-            Sent on registration and via <code style={codeStyle}>POST /api/auth/:collection/request-verify</code>.
+            Sent on registration and via <code style={codeStyle}>POST /api/v1/auth/:collection/request-verify</code>.
             Variables: <code style={codeStyle}>{`{{email}}`}</code> <code style={codeStyle}>{`{{token}}`}</code> <code style={codeStyle}>{`{{link}}`}</code> <code style={codeStyle}>{`{{appUrl}}`}</code> <code style={codeStyle}>{`{{collection}}`}</code>
           </div>
         </div>
@@ -1792,7 +1792,7 @@ function EmailTemplatesSection() {
         <div className="label-block span2">
           <label className="label">Password reset email</label>
           <div className="help">
-            Sent via <code style={codeStyle}>POST /api/auth/:collection/request-password-reset</code>. Same variables as above.
+            Sent via <code style={codeStyle}>POST /api/v1/auth/:collection/request-password-reset</code>. Same variables as above.
           </div>
         </div>
         <div className="label-block">
@@ -1840,25 +1840,25 @@ const AUTH_FEATURES: AuthFeatureRow[] = [
     key: "otp",
     label: "OTP / magic link",
     defaultOn: false,
-    description: <>Passwordless sign-in via email — both a 6-digit code and a magic link. Requires SMTP. Endpoints: <code style={codeStyle}>POST /api/auth/&lt;col&gt;/otp/&#123;request,auth&#125;</code>.</>,
+    description: <>Passwordless sign-in via email — both a 6-digit code and a magic link. Requires SMTP. Endpoints: <code style={codeStyle}>POST /api/v1/auth/&lt;col&gt;/otp/&#123;request,auth&#125;</code>.</>,
   },
   {
     key: "mfa",
     label: "MFA / TOTP (2FA)",
     defaultOn: true,
-    description: <>RFC 6238 TOTP with authenticator apps. Disabling blocks new enrollment but lets existing users still sign in and disable their own MFA. Endpoints: <code style={codeStyle}>POST /api/auth/&lt;col&gt;/totp/&#123;setup,confirm,disable&#125;</code>.</>,
+    description: <>RFC 6238 TOTP with authenticator apps. Disabling blocks new enrollment but lets existing users still sign in and disable their own MFA. Endpoints: <code style={codeStyle}>POST /api/v1/auth/&lt;col&gt;/totp/&#123;setup,confirm,disable&#125;</code>.</>,
   },
   {
     key: "anonymous",
     label: "Anonymous sign-in",
     defaultOn: false,
-    description: <>Mints a guest user with no email/password — useful for guest carts or onboarding before signup. Sessions live 30 days. Endpoint: <code style={codeStyle}>POST /api/auth/&lt;col&gt;/anonymous</code>.</>,
+    description: <>Mints a guest user with no email/password — useful for guest carts or onboarding before signup. Sessions live 30 days. Endpoint: <code style={codeStyle}>POST /api/v1/auth/&lt;col&gt;/anonymous</code>.</>,
   },
   {
     key: "impersonation",
     label: "Admin impersonation",
     defaultOn: true,
-    description: <>Admin mints a 1-hour user JWT for support purposes. JWT carries <code style={codeStyle}>impersonated_by</code> for audit. Endpoint: <code style={codeStyle}>POST /api/admin/impersonate/&lt;col&gt;/&lt;userId&gt;</code>.</>,
+    description: <>Admin mints a 1-hour user JWT for support purposes. JWT carries <code style={codeStyle}>impersonated_by</code> for audit. Endpoint: <code style={codeStyle}>POST /api/v1/admin/impersonate/&lt;col&gt;/&lt;userId&gt;</code>.</>,
   },
 ];
 
@@ -1956,12 +1956,12 @@ interface SessionKindRow {
 }
 
 const SESSION_KINDS: SessionKindRow[] = [
-  { kind: "anonymous",   label: "Anonymous", description: "Guest sessions minted by POST /api/auth/:collection/anonymous.",            defaultSeconds: 30 * 24 * 3600 },
+  { kind: "anonymous",   label: "Anonymous", description: "Guest sessions minted by POST /api/v1/auth/:collection/anonymous.",            defaultSeconds: 30 * 24 * 3600 },
   { kind: "user",        label: "User",      description: "Standard user JWTs (login, register, OAuth2, magic link).",                  defaultSeconds:  7 * 24 * 3600 },
-  { kind: "admin",       label: "Admin",     description: "Admin JWTs minted by POST /api/admin/auth/login.",                            defaultSeconds:  7 * 24 * 3600 },
+  { kind: "admin",       label: "Admin",     description: "Admin JWTs minted by POST /api/v1/admin/auth/login.",                            defaultSeconds:  7 * 24 * 3600 },
   { kind: "impersonate", label: "Impersonate", description: "JWTs issued by admin impersonation. Keep short — these escalate access.",  defaultSeconds:       3600 },
   { kind: "refresh",     label: "Refresh",   description: "Window applied when /refresh re-mints a token. Acts as the sliding ratchet.", defaultSeconds:  7 * 24 * 3600 },
-  { kind: "file",        label: "File access", description: "Protected-file URLs minted via POST /api/files/.../token.",                defaultSeconds:       3600 },
+  { kind: "file",        label: "File access", description: "Protected-file URLs minted via POST /api/v1/files/.../token.",                defaultSeconds:       3600 },
 ];
 
 function fmtDuration(seconds: number): string {
@@ -2244,9 +2244,9 @@ function OAuth2Section() {
       <div className="settings-section-body" style={{ gridTemplateColumns: "1fr", padding: "10px 14px" }}>
         <div className="muted" style={{ fontSize: 11, marginBottom: 10 }}>
           Enable a provider to expose it via{" "}
-          <code style={codeStyle}>GET /api/auth/&lt;collection&gt;/oauth2/providers</code>
+          <code style={codeStyle}>GET /api/v1/auth/&lt;collection&gt;/oauth2/providers</code>
           {" · "}your app drives the popup + state, then POSTs the code to{" "}
-          <code style={codeStyle}>/api/auth/&lt;collection&gt;/oauth2/exchange</code>.
+          <code style={codeStyle}>/api/v1/auth/&lt;collection&gt;/oauth2/exchange</code>.
         </div>
 
         {OAUTH_PROVIDERS.map((p) => {

admin/src/stores/auth.ts

@@ -8,7 +8,7 @@ interface AuthState {
   loaded: boolean;
   /** Pull auth state from the server (cookie-based). */
   load: () => Promise<void>;
-  /** Called after a successful POST /api/admin/auth/login. */
+  /** Called after a successful POST /api/v1/admin/auth/login. */
   signIn: (_token?: string) => Promise<void>;
   signOut: () => Promise<void>;
   refresh: () => Promise<void>;

src/api/audit-log.ts

@@ -14,7 +14,7 @@ async function getAdmin(request: Request, jwtSecret: string): Promise<{ id: stri
 export function makeAuditLogPlugin(jwtSecret: string) {
   return new Elysia({ name: "audit-log" })
     // ── Globally-scoped onAfterHandle: capture every state-changing
-    //    /api/admin/* request. Only writes on AUDITED_METHODS — read GETs
+    //    /api/v1/admin/* request. Only writes on AUDITED_METHODS — read GETs
     //    are skipped inside recordAuditEntry.
     .onAfterHandle({ as: "global" }, async ({ request, set }) => {
       // No need to skip non-admin paths here — recordAuditEntry filters.