@hot-updater/supabase 0.36.7 → 1.0.0-rc.0

package/supabase/edge-functions/runtime.docker.integration.spec.ts

@@ -16,15 +16,16 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolvePackageVersion, transformEnv } from "@hot-updater/cli-tools";
 import {
   type Bundle,
-  type GetBundlesArgs,
   NIL_UUID,
-  type UpdateInfo,
+  createReleaseCatalogScopeKey,
+  encodeChannelKey,
 } from "@hot-updater/core";
-import { createHotUpdater } from "@hot-updater/server";
 import {
-  setupBsdiffManifestUpdateInfoTestSuite,
-  setupGetUpdateInfoTestSuite,
-} from "@hot-updater/test-utils";
+  commitReleaseCatalogMutations,
+  createDatabaseClient,
+  createUUIDv7,
+} from "@hot-updater/plugin-core";
+import { createHotUpdater, registerApiKey } from "@hot-updater/server";
 import { createClient } from "@supabase/supabase-js";
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 
@@ -34,10 +35,10 @@ import {
   runCheckedCommand,
   spawnRuntime,
   stopRuntime,
-  formatRuntimeLogs,
   waitForHttpOk,
 } from "../../../../packages/test-utils/src/runtimeProcess";
 import { supabaseDatabase } from "../../src/supabaseDatabase";
+import { SUPABASE_V1_TABLE_NAMES } from "../../src/supabaseInfrastructureNames";
 import { supabaseStorage } from "../../src/supabaseStorage";
 
 const __filename = fileURLToPath(import.meta.url);
@@ -45,8 +46,7 @@ const __dirname = path.dirname(__filename);
 const WORKSPACE_ROOT = path.resolve(__dirname, "../../../..");
 const FUNCTION_NAME = "hot-updater-function";
 const FUNCTION_BASE_PATH = `/${FUNCTION_NAME}`;
-const HOT_UPDATER_BASE_PATH = "/";
-const LEGACY_HOT_UPDATER_BASE_PATH = "/api/check-update";
+const API_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
 const BUCKET_NAME = "hot-updater-bundles";
 const DENO_DOCKER_IMAGE = "denoland/deno:alpine";
 const DENO_CACHE_VOLUME = "hot-updater-supabase-deno-cache";
@@ -98,28 +98,6 @@ const ensureBuiltArtifacts = async (
   }
 };
 
-const createCanonicalPath = (args: GetBundlesArgs) => {
-  const channel = args.channel ?? "production";
-  const minBundleId = args.minBundleId ?? NIL_UUID;
-  const cohortSegment = args.cohort
-    ? `/${encodeURIComponent(args.cohort)}`
-    : "";
-  const joinHotUpdaterPath = (routePath: string) =>
-    HOT_UPDATER_BASE_PATH === "/"
-      ? routePath
-      : `${HOT_UPDATER_BASE_PATH}${routePath}`;
-
-  if (args._updateStrategy === "appVersion") {
-    return joinHotUpdaterPath(
-      `/app-version/${encodeURIComponent(args.platform)}/${encodeURIComponent(args.appVersion)}/${encodeURIComponent(channel)}/${encodeURIComponent(minBundleId)}/${encodeURIComponent(args.bundleId)}${cohortSegment}`,
-    );
-  }
-
-  return joinHotUpdaterPath(
-    `/fingerprint/${encodeURIComponent(args.platform)}/${encodeURIComponent(args.fingerprintHash)}/${encodeURIComponent(channel)}/${encodeURIComponent(minBundleId)}/${encodeURIComponent(args.bundleId)}${cohortSegment}`,
-  );
-};
-
 const toRuntimeBundle = (bundle: Bundle): Bundle => {
   return {
     ...bundle,
@@ -127,6 +105,80 @@ const toRuntimeBundle = (bundle: Bundle): Bundle => {
   };
 };
 
+const runtimeBundle = (id: string, overrides: Partial<Bundle> = {}): Bundle =>
+  toRuntimeBundle({
+    platform: "ios",
+    fileHash: `hash-${id}`,
+    gitCommitHash: null,
+    storageUri: "storage://unused",
+    archiveByteSize: 3_000_000_001,
+    ...overrides,
+    id,
+  });
+
+const seedProductionRelease = async ({
+  bundle,
+  database,
+}: {
+  readonly bundle: Bundle;
+  readonly database: ReturnType<typeof supabaseDatabase>;
+}) => {
+  const channelName = "production";
+  const channelKey = encodeChannelKey(channelName);
+  const channel = (
+    await database.models.channels.insert({
+      row: { id: `channel:${channelKey}`, name: channelName },
+      onConflict: "returnExisting",
+    })
+  ).row;
+  const scopeKey = createReleaseCatalogScopeKey({
+    channelKey,
+    platform: bundle.platform,
+    strategy: "APP_VERSION",
+  });
+  const now = Date.now();
+  await commitReleaseCatalogMutations({
+    database,
+    mutations: [
+      {
+        mutation: {
+          operation: "insert",
+          row: {
+            bundle_id: bundle.id,
+            channel_id: channel.id,
+            created_at_ms: now,
+            enabled: true,
+            fingerprint_hash: null,
+            id: createUUIDv7(),
+            kind: "BUNDLE",
+            message: "hello",
+            operation: "DEPLOY",
+            platform: bundle.platform,
+            revision: 1,
+            rollout_cohort_count: 1_000,
+            scope_key: scopeKey,
+            should_force_update: false,
+            source_release_id: null,
+            strategy: "APP_VERSION",
+            target_app_version: "1.0",
+            target_cohorts: [],
+            updated_at_ms: now,
+          },
+        },
+        scope: {
+          channelId: channel.id,
+          channelName,
+          fingerprintHash: null,
+          platform: bundle.platform,
+          scopeKey,
+          strategy: "APP_VERSION",
+        },
+        updatedAtMs: now,
+      },
+    ],
+  });
+};
+
 describe.sequential("supabase edge runtime acceptance", () => {
   let runtimeRoot: string | undefined;
   let storageRepoPath = "";
@@ -136,9 +188,37 @@ describe.sequential("supabase edge runtime acceptance", () => {
   let edgePort = 0;
   let gatewayBaseUrl = "";
   let edgeRuntime: ReturnType<typeof spawnRuntime> | undefined;
+  let database: ReturnType<typeof supabaseDatabase>;
   let seedHotUpdater: ReturnType<typeof createHotUpdater>;
+  let databaseClient: ReturnType<typeof createDatabaseClient>;
   let supabaseAdmin: ReturnType<typeof createClient>;
 
+  const runDatabaseSql = (statement: string): void => {
+    runCheckedCommand({
+      command: "docker",
+      args: [
+        "compose",
+        "-p",
+        composeProjectName,
+        "-f",
+        composeFilePath,
+        "exec",
+        "-T",
+        "db",
+        "psql",
+        "-U",
+        "postgres",
+        "-d",
+        POSTGRES_DB,
+        "-v",
+        "ON_ERROR_STOP=1",
+        "-c",
+        statement,
+      ],
+      cwd: WORKSPACE_ROOT,
+    });
+  };
+
   beforeAll(async () => {
     await ensureBuiltArtifacts(REQUIRED_BUILD_ARTIFACTS);
 
@@ -226,23 +306,27 @@ describe.sequential("supabase edge runtime acceptance", () => {
     supabaseAdmin = createClient(gatewayBaseUrl, SERVICE_ROLE_KEY);
     await ensureBucketExists(supabaseAdmin);
 
+    database = supabaseDatabase({
+      supabaseUrl: gatewayBaseUrl,
+      supabaseServiceRoleKey: SERVICE_ROLE_KEY,
+    });
+    await registerApiKey({
+      apiKey: API_KEY,
+      apiKeys: database.models.apiKeys,
+      name: "Runtime acceptance",
+    });
+    databaseClient = createDatabaseClient(database);
+
     seedHotUpdater = createHotUpdater({
-      database: supabaseDatabase({
-        supabaseUrl: gatewayBaseUrl,
-        supabaseAnonKey: SERVICE_ROLE_KEY,
-      }),
-      storages: [
+      database,
+      clientAccess: { type: "public" },
+      storage: [
         supabaseStorage({
           supabaseUrl: gatewayBaseUrl,
-          supabaseAnonKey: SERVICE_ROLE_KEY,
+          supabaseServiceRoleKey: SERVICE_ROLE_KEY,
           bucketName: BUCKET_NAME,
         }),
       ],
-      basePath: HOT_UPDATER_BASE_PATH,
-      routes: {
-        updateCheck: true,
-        bundles: false,
-      },
     });
 
     edgeRuntime = spawnRuntime({
@@ -299,13 +383,18 @@ describe.sequential("supabase edge runtime acceptance", () => {
       throw new Error("Supabase admin client was not initialized.");
     }
 
-    const { error } = await supabaseAdmin
-      .from("bundles")
-      .delete()
-      .neq("id", NIL_UUID);
-
-    if (error) {
-      throw error;
+    for (const [table, key] of [
+      [SUPABASE_V1_TABLE_NAMES.releaseCatalogs, "scope_key"],
+      [SUPABASE_V1_TABLE_NAMES.releases, "id"],
+      [SUPABASE_V1_TABLE_NAMES.bundlePatches, "id"],
+      [SUPABASE_V1_TABLE_NAMES.bundles, "id"],
+      [SUPABASE_V1_TABLE_NAMES.channels, "id"],
+    ] as const) {
+      const { error } = await supabaseAdmin
+        .from(table)
+        .delete()
+        .neq(key, NIL_UUID);
+      if (error) throw error;
     }
   });
 
@@ -336,193 +425,314 @@ describe.sequential("supabase edge runtime acceptance", () => {
     }
   }, 60_000);
 
-  const seedRuntimeBundles = async (bundles: Bundle[]) => {
-    for (const bundle of bundles.map(toRuntimeBundle)) {
-      await seedHotUpdater.insertBundle(bundle);
-    }
-  };
+  it("returns one canonical Channel row under concurrent inserts", async () => {
+    const database = supabaseDatabase({
+      supabaseUrl: gatewayBaseUrl,
+      supabaseServiceRoleKey: SERVICE_ROLE_KEY,
+    });
+    const channelName = "concurrent-channel";
+    const results = await Promise.all([
+      database.models.channels.insert({
+        row: {
+          id: "00000000-0000-0000-0000-000000000091",
+          name: channelName,
+        },
+        onConflict: "returnExisting",
+      }),
+      database.models.channels.insert({
+        row: {
+          id: "00000000-0000-0000-0000-000000000092",
+          name: channelName,
+        },
+        onConflict: "returnExisting",
+      }),
+    ]);
+
+    expect(new Set(results.map(({ row }) => row.id)).size).toBe(1);
+    expect(results.filter(({ inserted }) => inserted)).toHaveLength(1);
+    const stored = await supabaseAdmin
+      .from("hot_updater_v1_channels")
+      .select("id, name")
+      .eq("name", channelName);
+    if (stored.error) throw stored.error;
+    expect(stored.data).toEqual([results[0]?.row]);
+  });
 
-  const requestUpdateInfo = async (
-    args: GetBundlesArgs,
-  ): Promise<UpdateInfo | null> => {
-    const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}${createCanonicalPath(args)}`,
+  it("rolls back a patch-bearing insert when one base bundle is missing", async () => {
+    const base = runtimeBundle("00000000-0000-0000-0000-000000000101");
+    const owner = {
+      ...base,
+      id: "00000000-0000-0000-0000-000000000102",
+      fileHash: "hash-owner",
+      patches: [
+        {
+          baseBundleId: base.id,
+          baseFileHash: base.fileHash,
+          patchFileHash: "hash-valid-patch",
+          patchStorageUri: "storage://valid-patch",
+          byteSize: 3_000_000_002,
+        },
+        {
+          baseBundleId: "00000000-0000-0000-0000-000000000199",
+          baseFileHash: "hash-missing-base",
+          patchFileHash: "hash-invalid-patch",
+          patchStorageUri: "storage://invalid-patch",
+          byteSize: 3_000_000_003,
+        },
+      ],
+    } satisfies Bundle;
+    await databaseClient.insertBundle(base);
+
+    await expect(
+      databaseClient.mutate((database) => database.insertBundle(owner)),
+    ).rejects.toBeDefined();
+
+    const ownerResult = await supabaseAdmin
+      .from("hot_updater_v1_bundles")
+      .select("id")
+      .eq("id", owner.id)
+      .maybeSingle();
+    if (ownerResult.error) throw ownerResult.error;
+    expect(ownerResult.data).toBeNull();
+    const patchResult = await supabaseAdmin
+      .from("hot_updater_v1_bundle_patches")
+      .select("id")
+      .eq("bundle_id", owner.id);
+    if (patchResult.error) throw patchResult.error;
+    expect(patchResult.data).toEqual([]);
+  });
+
+  it("preserves extension defaults and generated values during atomic inserts", async () => {
+    runDatabaseSql(
+      [
+        "ALTER TABLE public.hot_updater_v1_bundles",
+        "ADD COLUMN tenant_tag text NOT NULL DEFAULT 'default-tenant',",
+        "ADD COLUMN file_hash_upper text GENERATED ALWAYS AS (upper(file_hash)) STORED",
+      ].join(" "),
     );
 
-    if (!response.ok) {
-      throw new Error(
-        [
-          `Edge runtime returned ${response.status} ${response.statusText}`,
-          await response.text(),
-          edgeRuntime ? formatRuntimeLogs(edgeRuntime.logs) : "",
-        ].join("\n\n"),
+    try {
+      const base = runtimeBundle("00000000-0000-0000-0000-000000000151");
+      const owner = {
+        ...base,
+        id: "00000000-0000-0000-0000-000000000152",
+        fileHash: "hash-owner",
+        patches: [
+          {
+            baseBundleId: base.id,
+            baseFileHash: base.fileHash,
+            patchFileHash: "hash-patch",
+            patchStorageUri: "storage://patch",
+            byteSize: 3_000_000_002,
+          },
+        ],
+      } satisfies Bundle;
+      await databaseClient.insertBundle(base);
+
+      await databaseClient.insertBundle(owner);
+
+      const result = await supabaseAdmin
+        .from("hot_updater_v1_bundles")
+        .select("tenant_tag, file_hash_upper")
+        .eq("id", owner.id)
+        .single();
+      if (result.error) throw result.error;
+      expect(result.data).toEqual({
+        tenant_tag: "default-tenant",
+        file_hash_upper: "HASH-OWNER",
+      });
+    } finally {
+      runDatabaseSql(
+        "ALTER TABLE public.hot_updater_v1_bundles DROP COLUMN tenant_tag, DROP COLUMN file_hash_upper",
       );
     }
+  });
 
-    return response.json();
-  };
+  it("does not resolve public-schema JSON function shadows in atomic RPCs", async () => {
+    runDatabaseSql(`
+      CREATE FUNCTION public.jsonb_populate_record(public.hot_updater_v1_bundles, jsonb)
+      RETURNS public.hot_updater_v1_bundles
+      LANGUAGE plpgsql
+      AS $$
+      BEGIN
+        RAISE EXCEPTION 'public jsonb_populate_record shadow executed';
+      END;
+      $$
+    `);
 
-  const getUpdateInfo = async (bundles: Bundle[], args: GetBundlesArgs) => {
-    if (!supabaseAdmin) {
-      throw new Error("Supabase admin client was not initialized.");
-    }
+    try {
+      const base = runtimeBundle("00000000-0000-0000-0000-000000000551");
+      const owner = {
+        ...base,
+        id: "00000000-0000-0000-0000-000000000552",
+        fileHash: "hash-owner",
+        patches: [
+          {
+            baseBundleId: base.id,
+            baseFileHash: base.fileHash,
+            patchFileHash: "hash-patch",
+            patchStorageUri: "storage://patch",
+            byteSize: 3_000_000_002,
+          },
+        ],
+      } satisfies Bundle;
+      await databaseClient.insertBundle(base);
 
-    for (const bundle of bundles) {
-      await uploadBundleObject(supabaseAdmin, bundle.id);
-    }
-    await seedRuntimeBundles(bundles);
-    return requestUpdateInfo(args);
-  };
+      await databaseClient.insertBundle(owner);
 
-  setupGetUpdateInfoTestSuite({
-    getUpdateInfo,
-    manifestArtifacts: {
-      prepareArtifacts: async (fixture) => {
-        await Promise.all([
-          uploadStorageObject(
-            supabaseAdmin,
-            `${fixture.currentBundleId}/manifest.json`,
-            JSON.stringify(fixture.currentManifest),
-            "application/json",
-          ),
-          uploadStorageObject(
-            supabaseAdmin,
-            `${fixture.nextBundleId}/manifest.json`,
-            JSON.stringify(fixture.nextManifest),
-            "application/json",
-          ),
-          uploadStorageObject(
-            supabaseAdmin,
-            `${fixture.nextBundleId}/files/${fixture.changedAssetPath}.br`,
-            "next-bundle-bytes",
-            "application/javascript",
-          ),
-        ]);
-
-        return {
-          currentArtifacts: {
-            assetBaseStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.currentBundleId}/files`,
-            manifestFileHash: "sig:manifest-current",
-            manifestStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.currentBundleId}/manifest.json`,
-          },
-          nextArtifacts: {
-            assetBaseStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.nextBundleId}/files`,
-            manifestFileHash: "sig:manifest-next",
-            manifestStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.nextBundleId}/manifest.json`,
-          },
-        };
-      },
-      expectFileUrl: (fileUrl, fixture) => {
-        expect(fileUrl).toContain(
-          `/storage/v1/object/sign/${BUCKET_NAME}/${fixture.nextBundleId}/files/${fixture.changedAssetPath}.br`,
-        );
-      },
-      expectManifestUrl: (manifestUrl, fixture) => {
-        expect(manifestUrl).toContain(
-          `/storage/v1/object/sign/${BUCKET_NAME}/${fixture.nextBundleId}/manifest.json`,
-        );
-      },
-    },
+      await expect(
+        databaseClient.getBundleById(owner.id),
+      ).resolves.toMatchObject({ id: owner.id, patches: owner.patches });
+    } finally {
+      runDatabaseSql(
+        "DROP FUNCTION public.jsonb_populate_record(public.hot_updater_v1_bundles, jsonb)",
+      );
+    }
   });
 
-  setupBsdiffManifestUpdateInfoTestSuite({
-    seedBundles: seedRuntimeBundles,
-    getUpdateInfo: requestUpdateInfo,
-    prepareArtifacts: async (fixture) => {
-      await Promise.all([
-        uploadStorageObject(
-          supabaseAdmin,
-          `${fixture.currentBundleId}/manifest.json`,
-          JSON.stringify(fixture.currentManifest),
-          "application/json",
-        ),
-        uploadStorageObject(
-          supabaseAdmin,
-          `${fixture.nextBundleId}/manifest.json`,
-          JSON.stringify(fixture.nextManifest),
-          "application/json",
-        ),
-        uploadStorageObject(
-          supabaseAdmin,
-          `${fixture.nextBundleId}/files/${fixture.assetPath}`,
-          "next-bundle-bytes",
-          "application/javascript",
-        ),
-        uploadStorageObject(
-          supabaseAdmin,
-          fixture.patchPath,
-          "patch-bytes",
-          "application/octet-stream",
-        ),
-        uploadBundleObject(supabaseAdmin, fixture.currentBundleId),
-        uploadBundleObject(supabaseAdmin, fixture.nextBundleId),
-      ]);
-
-      return {
-        currentArtifacts: {
-          assetBaseStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.currentBundleId}/files`,
-          manifestFileHash: "sig:manifest-current",
-          manifestStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.currentBundleId}/manifest.json`,
+  it("rolls back scalar and patch replacement when a new base is missing", async () => {
+    const base = runtimeBundle("00000000-0000-0000-0000-000000000201");
+    const owner = {
+      ...base,
+      id: "00000000-0000-0000-0000-000000000202",
+      fileHash: "hash-owner",
+      gitCommitHash: "before",
+      patches: [
+        {
+          baseBundleId: base.id,
+          baseFileHash: base.fileHash,
+          patchFileHash: "hash-old-patch",
+          patchStorageUri: "storage://old-patch",
+          byteSize: 3_000_000_002,
         },
-        nextArtifacts: {
-          assetBaseStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.nextBundleId}/files`,
-          manifestFileHash: "sig:manifest-next",
-          manifestStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.nextBundleId}/manifest.json`,
+      ],
+    } satisfies Bundle;
+    await databaseClient.insertBundle(base);
+    await databaseClient.insertBundle(owner);
+
+    await expect(
+      databaseClient.mutate((database) =>
+        database.updateBundleById(owner.id, {
+          gitCommitHash: "after",
           patches: [
             {
-              baseBundleId: fixture.currentBundleId,
-              baseFileHash: "hash-old-bundle",
-              patchFileHash: "hash-bsdiff",
-              patchStorageUri: `supabase-storage://${BUCKET_NAME}/${fixture.patchPath}`,
+              baseBundleId: "00000000-0000-0000-0000-000000000299",
+              baseFileHash: "hash-missing-base",
+              patchFileHash: "hash-invalid-patch",
+              patchStorageUri: "storage://invalid-patch",
+              byteSize: 3_000_000_003,
             },
           ],
+        }),
+      ),
+    ).rejects.toBeDefined();
+
+    await expect(databaseClient.getBundleById(owner.id)).resolves.toMatchObject(
+      {
+        gitCommitHash: "before",
+        patches: owner.patches,
+      },
+    );
+  });
+
+  it("atomically applies explicit nulls and an empty patch list", async () => {
+    const base = runtimeBundle("00000000-0000-0000-0000-000000000301");
+    const owner = {
+      ...base,
+      id: "00000000-0000-0000-0000-000000000302",
+      fileHash: "hash-owner",
+      gitCommitHash: "before",
+      patches: [
+        {
+          baseBundleId: base.id,
+          baseFileHash: base.fileHash,
+          patchFileHash: "hash-old-patch",
+          patchStorageUri: "storage://old-patch",
+          byteSize: 3_000_000_002,
         },
-      };
-    },
-    expectPatchUrl: (patchUrl, fixture) => {
-      expect(patchUrl).toContain(
-        `/storage/v1/object/sign/${BUCKET_NAME}/${fixture.patchPath}`,
-      );
-    },
+      ],
+    } satisfies Bundle;
+    await databaseClient.insertBundle(base);
+    await databaseClient.insertBundle(owner);
+
+    await databaseClient.mutate((database) =>
+      database.updateBundleById(owner.id, {
+        gitCommitHash: null,
+        patches: [],
+      }),
+    );
+
+    await expect(databaseClient.getBundleById(owner.id)).resolves.toMatchObject(
+      {
+        gitCommitHash: null,
+        patches: [],
+      },
+    );
+  });
+
+  it("maps a missing aggregate update to the public not-found error", async () => {
+    const result = databaseClient.updateBundleById(
+      "00000000-0000-0000-0000-000000000401",
+      { patches: [] },
+    );
+
+    await expect(result).rejects.toMatchObject({
+      name: "DatabaseBundleNotFoundError",
+      bundleId: "00000000-0000-0000-0000-000000000401",
+    });
+  });
+
+  it("denies the generic commit RPC to the anonymous role", async () => {
+    const response = await fetch(
+      `${gatewayBaseUrl}/rest/v1/rpc/hot_updater_v1_commit`,
+      {
+        method: "POST",
+        headers: {
+          apikey: ANON_KEY,
+          Authorization: `Bearer ${ANON_KEY}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ p_commit: { changes: [] } }),
+      },
+    );
+
+    expect(response.ok).toBe(false);
   });
 
-  it("serves canonical routes from the edge function entrypoint", async () => {
+  it("serves unversioned Release Catalog routes from the edge function entrypoint", async () => {
     const bundle = toRuntimeBundle({
       id: "00000000-0000-0000-0000-000000000001",
       platform: "ios",
-      targetAppVersion: "1.0",
-      shouldForceUpdate: false,
-      enabled: true,
       fileHash: "hash",
       gitCommitHash: null,
-      message: "hello",
-      channel: "production",
       storageUri: "storage://unused",
-      fingerprintHash: null,
+      archiveByteSize: 3_000_000_001,
     });
 
     await uploadBundleObject(supabaseAdmin, bundle.id);
     await seedHotUpdater.insertBundle(bundle);
+    await seedProductionRelease({ bundle, database });
+
+    const unauthorized = await fetch(
+      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0`,
+    );
+    expect(unauthorized.status).toBe(401);
 
     const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}${createCanonicalPath({
-        appVersion: "1.0",
-        bundleId: NIL_UUID,
-        platform: "ios",
-        _updateStrategy: "appVersion",
-      })}`,
+      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0`,
+      { headers: { "x-api-key": API_KEY } },
     );
 
     expect(response.ok).toBe(true);
     await expect(response.json()).resolves.toMatchObject({
-      id: "00000000-0000-0000-0000-000000000001",
-      status: "UPDATE",
+      catalogId: expect.stringMatching(/^[0-9a-f-]{36}$/),
+      releases: [{ bundleId: "00000000-0000-0000-0000-000000000001" }],
     });
   });
 
   it("does not support the legacy exact path", async () => {
     const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}${LEGACY_HOT_UPDATER_BASE_PATH}`,
+      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/api/check-update`,
     );
 
     expect(response.status).toBe(404);
@@ -530,7 +740,7 @@ describe.sequential("supabase edge runtime acceptance", () => {
 
   it("does not expose management routes from the edge function entrypoint", async () => {
     const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/api/bundles`,
+      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/admin/bundles`,
     );
 
     expect(response.status).toBe(404);
@@ -597,7 +807,7 @@ const waitForRestApiReady = async (baseUrl: string, timeoutMs = 90_000) => {
   while (Date.now() < deadline) {
     try {
       const response = await fetch(
-        `${baseUrl}/rest/v1/bundles?select=id&limit=1`,
+        `${baseUrl}/rest/v1/${SUPABASE_V1_TABLE_NAMES.bundles}?select=id&limit=1`,
         {
           headers: {
             apikey: SERVICE_ROLE_KEY,
@@ -747,12 +957,16 @@ ${storageMigrations.join("\n\n")}
 SET search_path TO public;
 
 GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
-GRANT USAGE ON TYPE platforms TO anon, authenticated, service_role;
 GRANT SELECT ON ALL TABLES IN SCHEMA public TO anon, authenticated;
 GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO service_role;
 GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO anon, authenticated, service_role;
 GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO anon, authenticated, service_role;
 
+REVOKE EXECUTE ON FUNCTION public.hot_updater_v1_commit(jsonb)
+  FROM anon, authenticated;
+REVOKE EXECUTE ON FUNCTION public.hot_updater_v1_delete_channel(text)
+  FROM anon, authenticated;
+
 ALTER DEFAULT PRIVILEGES IN SCHEMA public
   GRANT SELECT ON TABLES TO anon, authenticated;
 ALTER DEFAULT PRIVILEGES IN SCHEMA public
@@ -924,6 +1138,7 @@ const writeSupabaseRuntimeFiles = async ({
       "plugins/supabase/supabase/edge-functions/index.ts",
     ),
     {
+      BUCKET_NAME,
       FUNCTION_NAME,
     },
   );
@@ -932,7 +1147,7 @@ const writeSupabaseRuntimeFiles = async ({
       "@hot-updater/server": pathToFileURL(
         path.join(WORKSPACE_ROOT, "packages/server/dist/index.mjs"),
       ).href,
-      "@hot-updater/supabase": pathToFileURL(
+      "@hot-updater/supabase/edge": pathToFileURL(
         path.join(runtimeRoot, "hot-updater-supabase-edge.ts"),
       ).href,
       hono: `npm:hono@${resolvePackageVersion("hono", {
@@ -944,8 +1159,8 @@ const writeSupabaseRuntimeFiles = async ({
   await writeFile(
     path.join(runtimeRoot, "hot-updater-supabase-edge.ts"),
     `
-export { supabaseEdgeFunctionDatabase } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/supabaseEdgeFunctionDatabase.ts")).href)};
-export { supabaseEdgeFunctionStorage } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/supabaseEdgeFunctionStorage.ts")).href)};
+export { supabaseDatabase } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/supabaseDatabase.ts")).href)};
+export { supabaseEdgeFunctionStorage as supabaseStorage } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/supabaseEdgeFunctionStorage.ts")).href)};
 `.trim(),
   );
   await writeFile(