Capabilities
Eight modules. One backend. Generate → live.
A complete inventory of what Nubase ships out of the box — the modules an AI-written app needs to go online: Database · Auth · Storage · Assets · Functions · AI Gateway · Memory · cron. Detailed reference lives in the docs.
Database
Every project gets a dedicated PostgreSQL database — not a schema in a shared instance. Full SQL access, RLS by default, REST API generated for every table.
Isolation
- Database-level multi-tenancy via RoutingDataSource + HikariCP per tenant
- GuardianDataSource refuses any unauthenticated DB access
- Per-tenant encrypted credentials, JWT secrets, role mapping
REST API
- PostgREST-compatible /rest/v1/* implemented in Java (no separate process)
- select / filter / order / limit / offset / range pagination
- Schema metadata cache, refreshed via PostgreSQL NOTIFY
Security
- RLS executed via SET LOCAL ROLE + request.jwt.claims GUC variable
- service_role / authenticated / anon role separation, BYPASSRLS for admin
- @RequireServiceRole AOP guard for management endpoints
Auth
Supabase GoTrue-compatible: email/password, OAuth, JWT issuance, refresh-token rotation. Per-tenant JWT secrets mean a breach of one tenant cannot forge tokens for another.
Identity
- Email + password sign-up / sign-in / recovery
- OAuth providers: Google, GitHub (extensible via OAuthProvider interface)
- MFA / TOTP, OTP & magic links, anonymous sign-in
Tokens
- JWT access token signed with per-tenant secret (no cross-tenant forgery)
- Refresh token rotation with parent-link tracking
- Two-layer apikey: tenant-level (ref claim) + user-level (Bearer)
Admin
- Provision new tenant databases via POST /auth/v1/admin/init/database
- Service-role token generation, schema/RLS DDL export
- Ad-hoc SQL execution and admin user CRUD
Storage
S3-compatible object storage with metadata in Postgres. Bucket policies, signed URLs, RLS-aware ACLs — all under the same JWT model your app already uses.
Buckets & objects
- Create/list/update/delete buckets via /storage/v1/bucket
- Public vs. private buckets, per-bucket size limits + MIME allow-list
- File metadata stored in storage.objects with RLS policies
Backend
- AWS S3 SDK — works with Cloudflare R2, MinIO, LocalStack, any S3-compatible
- Per-tenant key prefix layout under one global bucket
- Signed URLs for time-limited public access
Vector storage (optional)
- Separate AWS S3 Vectors integration for large file-content vectors
- Independent from Memory module — used for document/asset embeddings
Assets
Where the generated frontend goes live. Your agent uploads static files and serves them from a public CDN — no separate static host, same project token model as everything else.
Publish
- Upload / list / delete via /assets/admin/v1 and MCP assets_upload
- UTF-8 text or base64 bodies; Content-Type inferred from the path
- Returns the resolved public URL for every asset
Deliver
- Public read at /assets/v1/{path} — no apikey, tenant from subdomain
- Cache-Control / ETag / Last-Modified with 304 conditional GETs
- Per-project default cache policy + optional custom CDN domain
Modes
- CDN mode: a dedicated R2 bucket behind a custom domain
- Backend mode: served by Nubase under a reserved key prefix
Functions
Deploy AI-written backend logic as edge functions, with Nubase as the public gateway. Secrets, logs and rate limits included.
Deploy
- Scaffold / deploy / invoke via CLI and MCP functions_deploy
- TypeScript bundled with esbuild; every deploy kept as a version
- Local executor or Cloudflare Workers for Platforms dispatcher
Invoke
- Public path /functions/v1/{slug} with verify_jwt
- Per-project & per-function rate limits, invocation logs
- service_role never injected by default
Secrets
- Per-function secrets encrypted in the metadata DB
- Set by name via functions_secrets_set; values never returned
- Injected as env / Worker secret_text bindings
AI Gateway
Route model calls through Nubase with per-project keys and usage tracking — bring your own model.
Endpoints
- OpenAI-compatible /v1 and Anthropic-compatible /v1/messages
- Streaming + token counting passthrough
- Model routing across providers
Keys & usage
- Per-project nbk_ keys (issue / revoke)
- Token, request and cost analytics per key and model
- Daily and by-model breakdowns
Memory
A first-class LLM memory layer — not bolted on. mem0-compatible API, multi-signal retrieval, audit history, and per-tenant isolation that rides the same auth model as the rest of nubase.
Write & decide
- POST /mem/v1/memories with infer=true: LLM extracts facts and emits ADD / UPDATE / DELETE / NONE per fact
- infer=false path stores raw messages verbatim
- Per-call user / agent / run scope; deduplication by content hash
- Per-fact entity extraction in the same LLM call (no extra round-trip)
Retrieve
- Hybrid fusion: pgvector cosine top-K + BM25 (ts_rank_cd) + entity-link boost
- Spread-attenuated entity boost (mem0 v3 algorithm)
- PG text-search config configurable (simple / english / zhparser for CJK)
- Advanced metadata filters: eq/ne/gt/gte/lt/lte/in/nin/contains/icontains + AND/OR/NOT
Manage & audit
- Full audit history (ADD/UPDATE/DELETE) per memory id
- Entity store with linked_memory_ids array, hard cap for hot entities
- Batch delete by owner, full tenant reset with double-confirm
- Admin Studio: list, search, edit, history, entities, settings, danger zone
Providers
- Chat: OpenAI · Anthropic · any OpenAI-compatible (DashScope, DeepSeek, Moonshot, vLLM, Ollama)
- Embeddings: OpenAI · generic OpenAI-compatible (1536-dim default, configurable)
- In-process Caffeine cache for embeddings (content-addressed, safe across tenants)
- Pre-flight isAvailable() — no wasted HTTP when keys missing
cron
Recurring jobs run by the control plane — invoke an edge function or a database function on a schedule, safely across instances.
Schedule
- Crontab (UTC); 5-field and 6-field forms accepted
- Targets: edge_function, or a named db_function with JSON args
- Per-job timeout; manage via /cron/admin/v1 and MCP cron_create
Semantics
- Control-plane scheduler with a row-level claim — no double-run
- Run history per job with status / duration / error
- Pause / resume without a catch-up storm