@hot-updater/supabase 1.0.0-rc.18 → 1.0.0-rc.21

package/supabase/edge-functions/runtime.docker.integration.spec.ts

@@ -1,1301 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { createHmac } from "node:crypto";
-import {
-  access,
-  mkdir,
-  mkdtemp,
-  readdir,
-  readFile,
-  rm,
-  symlink,
-  writeFile,
-} from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-import { resolvePackageVersion, transformEnv } from "@hot-updater/cli-tools";
-import type { Bundle } from "@hot-updater/core";
-import { type HotUpdaterCoreApi, rowToBundle } from "@hot-updater/plugin-core";
-import { createHotUpdater } from "@hot-updater/server";
-import {
-  createDatabaseEngine,
-  createSqlAdapter,
-  type RetryOptions,
-  toolingTargetOf,
-} from "@hot-updater/server/database";
-import {
-  createDatabaseCoreApi,
-  createDatabasePluginApis,
-} from "@hot-updater/server/db";
-import type { CoreReader } from "@hot-updater/server/plugins";
-import { apiKeys } from "@hot-updater/server/plugins/api-keys";
-import {
-  createInsightsModel,
-  insights,
-  insightsSchema,
-  type BundleEventRow,
-} from "@hot-updater/server/plugins/insights";
-import { insightsTestSuite } from "@hot-updater/server/plugins/insights/testing";
-import {
-  runContentionHarness,
-  setupDatabaseTestSuite,
-  startHttpTestServer,
-  withAdapterLatency,
-} from "@hot-updater/test-utils";
-import { createClient } from "@supabase/supabase-js";
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
-
-import {
-  assertDockerComposeAvailable,
-  findOpenPort,
-  runCheckedCommand,
-  spawnRuntime,
-  stopRuntime,
-  waitForHttpOk,
-} from "../../../../packages/test-utils/src/runtimeProcess";
-import { plugins } from "../../src/plugins";
-import { supabaseDatabase } from "../../src/supabaseDatabase";
-import { supabaseExecutor } from "../../src/supabaseExecutor";
-import {
-  SUPABASE_SETTINGS_TABLE,
-  SUPABASE_TABLE_PREFIX,
-  supabaseTableNames,
-} from "../../src/supabaseSchema";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const WORKSPACE_ROOT = path.resolve(__dirname, "../../../..");
-const FUNCTION_NAME = "hot-updater-function";
-const FUNCTION_BASE_PATH = `/${FUNCTION_NAME}`;
-const API_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
-const BUCKET_NAME = "hot-updater-bundles";
-const DENO_DOCKER_IMAGE = "denoland/deno:alpine";
-const DENO_CACHE_VOLUME = "hot-updater-supabase-deno-cache";
-const POSTGRES_IMAGE = "postgres:15-alpine";
-const POSTGREST_IMAGE = "postgrest/postgrest:v14.6";
-const STORAGE_IMAGE = "supabase/storage-api:v1.44.2";
-const IMGPROXY_IMAGE = "darthsim/imgproxy:v3.30.1";
-const NGINX_IMAGE = "nginx:1.27-alpine";
-const POSTGRES_PASSWORD = "postgres";
-const POSTGRES_DB = "postgres";
-const JWT_SECRET = "super-secret-jwt-token-with-at-least-32-chars";
-const JWT_EXPIRY_SECONDS = 60 * 60 * 24 * 365;
-const ANON_KEY = createLegacyJwt("anon");
-const SERVICE_ROLE_KEY = createLegacyJwt("service_role");
-const REQUIRED_BUILD_ARTIFACTS = [
-  {
-    command: "pnpm --filter @hot-updater/core build",
-    path: path.join(WORKSPACE_ROOT, "packages/core/dist/index.mjs"),
-  },
-  {
-    command: "pnpm --filter @hot-updater/server build",
-    path: path.join(WORKSPACE_ROOT, "packages/server/dist/index.mjs"),
-  },
-  {
-    command: "pnpm --filter @hot-updater/plugin-core build",
-    path: path.join(WORKSPACE_ROOT, "plugins/plugin-core/dist/index.mjs"),
-  },
-  {
-    command: "pnpm --filter @hot-updater/supabase build",
-    path: path.join(WORKSPACE_ROOT, "plugins/supabase/dist/index.mjs"),
-  },
-] as const;
-
-assertDockerComposeAvailable(
-  "supabase edge runtime acceptance requires Docker Compose and a running Docker daemon.",
-);
-
-const ensureBuiltArtifacts = async (
-  artifacts: ReadonlyArray<{ command: string; path: string }>,
-) => {
-  for (const artifact of artifacts) {
-    try {
-      await access(artifact.path);
-    } catch {
-      throw new Error(
-        `Missing built artifact at ${artifact.path}. Run \`${artifact.command}\` before running this test.`,
-      );
-    }
-  }
-};
-
-const toRuntimeBundle = (bundle: Bundle): Bundle => {
-  return {
-    ...bundle,
-    manifestStorageUri: `supabase-storage://${BUCKET_NAME}/${bundle.id}/manifest.json`,
-    assetBaseStorageUri: `supabase-storage://${BUCKET_NAME}/assets`,
-  };
-};
-
-const assetHashForBundle = (bundleId: string) => `asset-hash-${bundleId}`;
-
-const runtimeBundle = (id: string, overrides: Partial<Bundle> = {}): Bundle =>
-  toRuntimeBundle({
-    platform: "ios",
-    gitCommitHash: null,
-    manifestStorageUri: "storage://unused/manifest.json",
-    manifestFileHash: `manifest-hash-${id}`,
-    assetBaseStorageUri: "storage://unused/assets",
-    ...overrides,
-    id,
-  });
-
-/**
- * PRD D6: B3's rollout moves through the apply RPC, measured and recorded in
- * plans/evidence/supabase-ingestion-ceiling.md.
- * HOT_UPDATER_INGESTION_CEILING=1 runs the whole ladder of rates. The stack
- * runs in local Docker, so the figures describe this host and setup, not a
- * Supabase project's limits.
- */
-const INGESTION_LADDER = process.env.HOT_UPDATER_INGESTION_CEILING === "1";
-const INGESTION_MOVES = INGESTION_LADDER ? 600 : 200;
-const INGESTION_RATES = INGESTION_LADDER ? [50, 100, 200, 400, 800] : [50];
-const INGESTION_WRITERS = 16;
-const INGESTION_LATENCY_MS = 5;
-
-/** Event `n` moves installation `install` onto release `release` on one channel. */
-const rolloutMove = (
-  n: number,
-  install: number,
-  release: "a" | "b",
-  receivedAt: number,
-) =>
-  ({
-    id: `01900000-0000-7000-8000-${String(n).padStart(12, "0")}`,
-    type: "UPDATE_APPLIED",
-    install_id: `install-${install}`,
-    user_id: `user-${install}`,
-    from_release_id: release === "b" ? "release-a" : "release-0",
-    from_bundle_id: release === "b" ? "bundle-a" : "bundle-0",
-    to_release_id: `release-${release}`,
-    to_bundle_id: `bundle-${release}`,
-    platform: "ios",
-    app_version: "1.0.0",
-    channel: "production",
-    metadata: {
-      cohort: "1",
-      update_strategy: "appVersion",
-      fingerprint_hash: null,
-      sdk_version: null,
-    },
-    received_at_ms: receivedAt,
-  }) as BundleEventRow;
-
-/** Writes `bundle` with an enabled production release for app version 1.0. */
-const deployToProduction = (core: HotUpdaterCoreApi, bundle: Bundle) =>
-  core.deploy([
-    {
-      bundle,
-      release: {
-        channel: "production",
-        enabled: true,
-        fingerprintHash: null,
-        message: "hello",
-        shouldForceUpdate: false,
-        targetAppVersion: "1.0",
-      },
-    },
-  ]);
-
-/** A stored bundle, in the shape it was deployed in. */
-const storedBundle = async (core: HotUpdaterCoreApi, id: string) => {
-  const detail = await core.getBundle(id);
-  return detail && rowToBundle(detail.bundle, detail.patches);
-};
-
-describe.sequential("supabase edge runtime acceptance", () => {
-  let runtimeRoot: string | undefined;
-  let storageRepoPath = "";
-  let composeFilePath = "";
-  let composeProjectName = "";
-  let gatewayPort = 0;
-  let edgePort = 0;
-  let gatewayBaseUrl = "";
-  let edgeRuntime: ReturnType<typeof spawnRuntime> | undefined;
-  let database: ReturnType<typeof supabaseDatabase>;
-  let core: HotUpdaterCoreApi;
-  let supabaseAdmin: ReturnType<typeof createClient>;
-
-  /** Registers the API key the edge function's client routes accept. */
-  const registerRuntimeApiKey = () =>
-    createDatabasePluginApis(database, [apiKeys()]).apiKeys.register({
-      apiKey: API_KEY,
-      name: "Runtime acceptance",
-    });
-
-  const runDatabaseSql = (statement: string): void => {
-    runCheckedCommand({
-      command: "docker",
-      args: [
-        "compose",
-        "-p",
-        composeProjectName,
-        "-f",
-        composeFilePath,
-        "exec",
-        "-T",
-        "db",
-        "psql",
-        "-U",
-        "postgres",
-        "-d",
-        POSTGRES_DB,
-        "-v",
-        "ON_ERROR_STOP=1",
-        "-c",
-        statement,
-      ],
-      cwd: WORKSPACE_ROOT,
-    });
-  };
-
-  /** Empties every data table but `keep`, the managed plugins' included; the settings rows stay. */
-  const truncateDataTables = (keep: readonly string[] = []) => {
-    const tables = supabaseTableNames(toolingTargetOf(plugins).schema)
-      .filter(
-        (table) => table !== SUPABASE_SETTINGS_TABLE && !keep.includes(table),
-      )
-      .map((table) => `public."${table}"`);
-    runDatabaseSql(`TRUNCATE ${tables.join(", ")} CASCADE`);
-  };
-
-  beforeAll(async () => {
-    await ensureBuiltArtifacts(REQUIRED_BUILD_ARTIFACTS);
-
-    runtimeRoot = await mkdtemp(
-      path.join(WORKSPACE_ROOT, "plugins/supabase/runtime-acceptance-"),
-    );
-    storageRepoPath = path.join(runtimeRoot, "storage-repo");
-    gatewayPort = await findOpenPort();
-    edgePort = await findOpenPort();
-    gatewayBaseUrl = `http://127.0.0.1:${gatewayPort}`;
-    composeProjectName = `hot-updater-supabase-${process.pid}-${Date.now()}`;
-    composeFilePath = path.join(runtimeRoot, "docker-compose.yml");
-
-    runCheckedCommand({
-      command: "git",
-      args: [
-        "clone",
-        "--depth",
-        "1",
-        "https://github.com/supabase/storage.git",
-        storageRepoPath,
-      ],
-      cwd: WORKSPACE_ROOT,
-    });
-
-    await writeSupabaseRuntimeFiles({
-      runtimeRoot,
-      gatewayPort,
-      storageRepoPath,
-    });
-
-    try {
-      runCheckedCommand({
-        command: "docker",
-        args: [
-          "compose",
-          "-p",
-          composeProjectName,
-          "-f",
-          composeFilePath,
-          "up",
-          "-d",
-        ],
-        cwd: WORKSPACE_ROOT,
-      });
-    } catch (error) {
-      let dbLogs = "";
-
-      try {
-        const result = spawnSync(
-          "docker",
-          [
-            "compose",
-            "-p",
-            composeProjectName,
-            "-f",
-            composeFilePath,
-            "logs",
-            "--no-color",
-            "db",
-          ],
-          {
-            cwd: WORKSPACE_ROOT,
-            encoding: "utf8",
-          },
-        );
-        dbLogs = [result.stdout, result.stderr].filter(Boolean).join("\n");
-      } catch {
-        dbLogs = "failed to collect database logs";
-      }
-
-      throw new Error(
-        [
-          error instanceof Error ? error.message : String(error),
-          "",
-          "Database logs:",
-          dbLogs,
-        ].join("\n"),
-      );
-    }
-
-    await waitForRestApiReady(gatewayBaseUrl, 180_000);
-    await waitForUrlOk(`${gatewayBaseUrl}/storage/v1/status`, 180_000);
-
-    supabaseAdmin = createClient(gatewayBaseUrl, SERVICE_ROLE_KEY);
-    await ensureBucketExists(supabaseAdmin);
-
-    database = supabaseDatabase({
-      supabaseUrl: gatewayBaseUrl,
-      supabaseServiceRoleKey: SERVICE_ROLE_KEY,
-    });
-    await registerRuntimeApiKey();
-    core = createDatabaseCoreApi(database);
-
-    edgeRuntime = spawnRuntime({
-      command: "docker",
-      args: [
-        "run",
-        "--rm",
-        "--network",
-        `${composeProjectName}_default`,
-        "--add-host",
-        "host.docker.internal:host-gateway",
-        "-p",
-        `127.0.0.1:${edgePort}:8000`,
-        "-e",
-        `SUPABASE_URL=http://host.docker.internal:${gatewayPort}`,
-        "-e",
-        `SUPABASE_SERVICE_ROLE_KEY=${SERVICE_ROLE_KEY}`,
-        "-e",
-        "DENO_DIR=/deno-dir",
-        "-v",
-        `${WORKSPACE_ROOT}:${WORKSPACE_ROOT}:ro`,
-        "-v",
-        `${runtimeRoot}:${runtimeRoot}`,
-        "-v",
-        `${DENO_CACHE_VOLUME}:/deno-dir`,
-        "-w",
-        runtimeRoot,
-        DENO_DOCKER_IMAGE,
-        "run",
-        "--no-lock",
-        "--node-modules-dir=manual",
-        "--allow-env",
-        "--allow-net",
-        "--allow-read",
-        "--allow-sys",
-        "--unstable-sloppy-imports",
-        "--import-map",
-        path.join(runtimeRoot, "import_map.json"),
-        path.join(runtimeRoot, "supabase/edge-functions/index.ts"),
-      ],
-      cwd: WORKSPACE_ROOT,
-    });
-
-    await waitForHttpOk({
-      url: `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/ping`,
-      child: edgeRuntime.child,
-      logs: edgeRuntime.logs,
-      timeoutMs: 90_000,
-    });
-  }, 300_000);
-
-  beforeEach(async () => {
-    if (!supabaseAdmin) {
-      throw new Error("Supabase admin client was not initialized.");
-    }
-
-    // The API key the suite registers last serves the edge function's routes.
-    truncateDataTables([`${SUPABASE_TABLE_PREFIX}api_keys`]);
-  });
-
-  afterAll(async () => {
-    if (edgeRuntime) {
-      await stopRuntime(edgeRuntime.child);
-    }
-
-    if (composeFilePath) {
-      runCheckedCommand({
-        command: "docker",
-        args: [
-          "compose",
-          "-p",
-          composeProjectName,
-          "-f",
-          composeFilePath,
-          "down",
-          "-v",
-          "--remove-orphans",
-        ],
-        cwd: WORKSPACE_ROOT,
-      });
-    }
-
-    if (runtimeRoot) {
-      await rm(runtimeRoot, { recursive: true, force: true });
-    }
-  }, 60_000);
-
-  setupDatabaseTestSuite({
-    name: "Supabase PostgreSQL and PostgREST conformance",
-    createDatabase: () => database,
-    migrate: () => undefined,
-    reset: () => truncateDataTables(),
-    dispose: async () => {
-      await registerRuntimeApiKey();
-    },
-    createHttpClient: (options) =>
-      startHttpTestServer(
-        createHotUpdater({
-          ...options,
-          plugins: [insights()],
-          clientAccess: "public",
-        }).handlers,
-      ),
-    plugins: [
-      insightsTestSuite({
-        createModel: (database) =>
-          createInsightsModel(
-            createDatabasePluginApis(database, [insights()]).insights,
-          ),
-      }),
-    ],
-  });
-
-  it("returns one canonical Channel row under concurrent inserts", async () => {
-    const core = createDatabaseCoreApi(
-      supabaseDatabase({
-        supabaseUrl: gatewayBaseUrl,
-        supabaseServiceRoleKey: SERVICE_ROLE_KEY,
-      }),
-    );
-    const channelName = "concurrent-channel";
-    const results = await Promise.all([
-      core.ensureChannel(channelName),
-      core.ensureChannel(channelName),
-    ]);
-
-    expect(new Set(results.map(({ id }) => id)).size).toBe(1);
-    const stored = await supabaseAdmin
-      .from("hot_updater_v1_channels")
-      .select("id, name")
-      .eq("name", channelName);
-    if (stored.error) throw stored.error;
-    expect(stored.data).toEqual([results[0]]);
-  });
-
-  it("rolls back a patch-bearing insert when one base bundle is missing", async () => {
-    const base = runtimeBundle("00000000-0000-0000-0000-000000000101");
-    const owner = {
-      ...base,
-      id: "00000000-0000-0000-0000-000000000102",
-      manifestFileHash: "manifest-hash-owner",
-      patches: [
-        {
-          baseBundleId: base.id,
-          baseFileHash: assetHashForBundle(base.id),
-          patchFileHash: "hash-valid-patch",
-          patchStorageUri: "storage://valid-patch",
-          byteSize: 3_000_000_002,
-        },
-        {
-          baseBundleId: "00000000-0000-0000-0000-000000000199",
-          baseFileHash: "hash-missing-base",
-          patchFileHash: "hash-invalid-patch",
-          patchStorageUri: "storage://invalid-patch",
-          byteSize: 3_000_000_003,
-        },
-      ],
-    } satisfies Bundle;
-    await deployToProduction(core, base);
-
-    await expect(deployToProduction(core, owner)).rejects.toBeDefined();
-
-    const ownerResult = await supabaseAdmin
-      .from("hot_updater_v1_bundles")
-      .select("id")
-      .eq("id", owner.id)
-      .maybeSingle();
-    if (ownerResult.error) throw ownerResult.error;
-    expect(ownerResult.data).toBeNull();
-    const patchResult = await supabaseAdmin
-      .from("hot_updater_v1_bundle_patches")
-      .select("id")
-      .eq("bundle_id", owner.id);
-    if (patchResult.error) throw patchResult.error;
-    expect(patchResult.data).toEqual([]);
-  });
-
-  it("preserves extension defaults and generated values during atomic inserts", async () => {
-    runDatabaseSql(
-      [
-        "ALTER TABLE public.hot_updater_v1_bundles",
-        "ADD COLUMN tenant_tag text NOT NULL DEFAULT 'default-tenant',",
-        "ADD COLUMN manifest_file_hash_upper text GENERATED ALWAYS AS (upper(manifest_file_hash)) STORED",
-      ].join(" "),
-    );
-
-    try {
-      const base = runtimeBundle("00000000-0000-0000-0000-000000000151");
-      const owner = {
-        ...base,
-        id: "00000000-0000-0000-0000-000000000152",
-        manifestFileHash: "manifest-hash-owner",
-        patches: [
-          {
-            baseBundleId: base.id,
-            baseFileHash: assetHashForBundle(base.id),
-            patchFileHash: "hash-patch",
-            patchStorageUri: "storage://patch",
-            byteSize: 3_000_000_002,
-          },
-        ],
-      } satisfies Bundle;
-      await deployToProduction(core, base);
-
-      await deployToProduction(core, owner);
-
-      const result = await supabaseAdmin
-        .from("hot_updater_v1_bundles")
-        .select("tenant_tag, manifest_file_hash_upper")
-        .eq("id", owner.id)
-        .single();
-      if (result.error) throw result.error;
-      expect(result.data).toEqual({
-        tenant_tag: "default-tenant",
-        manifest_file_hash_upper: "MANIFEST-HASH-OWNER",
-      });
-    } finally {
-      runDatabaseSql(
-        "ALTER TABLE public.hot_updater_v1_bundles DROP COLUMN tenant_tag, DROP COLUMN manifest_file_hash_upper",
-      );
-    }
-  });
-
-  it("does not resolve public-schema JSON function shadows in atomic RPCs", async () => {
-    runDatabaseSql(`
-      CREATE FUNCTION public.jsonb_populate_record(public.hot_updater_v1_bundles, jsonb)
-      RETURNS public.hot_updater_v1_bundles
-      LANGUAGE plpgsql
-      AS $$
-      BEGIN
-        RAISE EXCEPTION 'public jsonb_populate_record shadow executed';
-      END;
-      $$
-    `);
-
-    try {
-      const base = runtimeBundle("00000000-0000-0000-0000-000000000551");
-      const owner = {
-        ...base,
-        id: "00000000-0000-0000-0000-000000000552",
-        manifestFileHash: "manifest-hash-owner",
-        patches: [
-          {
-            baseBundleId: base.id,
-            baseFileHash: assetHashForBundle(base.id),
-            patchFileHash: "hash-patch",
-            patchStorageUri: "storage://patch",
-            byteSize: 3_000_000_002,
-          },
-        ],
-      } satisfies Bundle;
-      await deployToProduction(core, base);
-
-      await deployToProduction(core, owner);
-
-      await expect(storedBundle(core, owner.id)).resolves.toMatchObject({
-        id: owner.id,
-        patches: owner.patches,
-      });
-    } finally {
-      runDatabaseSql(
-        "DROP FUNCTION public.jsonb_populate_record(public.hot_updater_v1_bundles, jsonb)",
-      );
-    }
-  });
-
-  it("rolls back scalar and patch replacement when a new base is missing", async () => {
-    const base = runtimeBundle("00000000-0000-0000-0000-000000000201");
-    const owner = {
-      ...base,
-      id: "00000000-0000-0000-0000-000000000202",
-      manifestFileHash: "manifest-hash-owner",
-      gitCommitHash: "before",
-      patches: [
-        {
-          baseBundleId: base.id,
-          baseFileHash: assetHashForBundle(base.id),
-          patchFileHash: "hash-old-patch",
-          patchStorageUri: "storage://old-patch",
-          byteSize: 3_000_000_002,
-        },
-      ],
-    } satisfies Bundle;
-    await deployToProduction(core, base);
-    await deployToProduction(core, owner);
-
-    await expect(
-      core.updateBundle(owner.id, {
-        gitCommitHash: "after",
-        patches: [
-          {
-            baseBundleId: "00000000-0000-0000-0000-000000000299",
-            baseFileHash: "hash-missing-base",
-            patchFileHash: "hash-invalid-patch",
-            patchStorageUri: "storage://invalid-patch",
-            byteSize: 3_000_000_003,
-          },
-        ],
-      }),
-    ).rejects.toBeDefined();
-
-    await expect(storedBundle(core, owner.id)).resolves.toMatchObject({
-      gitCommitHash: "before",
-      patches: owner.patches,
-    });
-  });
-
-  it("atomically applies explicit nulls and an empty patch list", async () => {
-    const base = runtimeBundle("00000000-0000-0000-0000-000000000301");
-    const owner = {
-      ...base,
-      id: "00000000-0000-0000-0000-000000000302",
-      manifestFileHash: "manifest-hash-owner",
-      gitCommitHash: "before",
-      patches: [
-        {
-          baseBundleId: base.id,
-          baseFileHash: assetHashForBundle(base.id),
-          patchFileHash: "hash-old-patch",
-          patchStorageUri: "storage://old-patch",
-          byteSize: 3_000_000_002,
-        },
-      ],
-    } satisfies Bundle;
-    await deployToProduction(core, base);
-    await deployToProduction(core, owner);
-
-    await core.updateBundle(owner.id, {
-      gitCommitHash: null,
-      patches: [],
-    });
-
-    await expect(storedBundle(core, owner.id)).resolves.toMatchObject({
-      gitCommitHash: null,
-      patches: [],
-    });
-  });
-
-  it("maps a missing aggregate update to the public not-found error", async () => {
-    const result = core.updateBundle("00000000-0000-0000-0000-000000000401", {
-      patches: [],
-    });
-
-    await expect(result).rejects.toMatchObject({
-      name: "DatabaseBundleNotFoundError",
-      bundleId: "00000000-0000-0000-0000-000000000401",
-    });
-  });
-
-  it("denies the apply RPC to the anonymous role", async () => {
-    const response = await fetch(
-      `${gatewayBaseUrl}/rest/v1/rpc/hot_updater_v1_apply`,
-      {
-        method: "POST",
-        headers: {
-          apikey: ANON_KEY,
-          Authorization: `Bearer ${ANON_KEY}`,
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ p_statements: [] }),
-      },
-    );
-
-    expect(response.ok).toBe(false);
-  });
-
-  it("records the Insights ingestion ceiling through the apply RPC", async () => {
-    const adapter = createSqlAdapter({
-      executor: supabaseExecutor(
-        createClient(gatewayBaseUrl, SERVICE_ROLE_KEY),
-      ),
-      tablePrefix: SUPABASE_TABLE_PREFIX,
-    });
-    const module = { id: "insights", schema: insightsSchema } as const;
-    const apiOf = (latencyMs: number, retry?: RetryOptions) =>
-      insights().init({
-        db: createDatabaseEngine({
-          adapter:
-            latencyMs > 0 ? withAdapterLatency(adapter, latencyMs) : adapter,
-          schema: toolingTargetOf([insights()]).schema,
-          ...(retry === undefined ? {} : { retry }),
-        }).database(module),
-        // Insights never reads core.
-        core: {} as CoreReader,
-        now: Date.now,
-      }).api;
-    const seeded = apiOf(0, { attempts: 64, baseDelayMs: 1, maxDelayMs: 20 });
-    const start = Date.now() - 2 * 3_600_000;
-    const steps = [];
-    for (const [step, rate] of INGESTION_RATES.entries()) {
-      // Each step moves its own installations, first onto A, then A→B.
-      const first = step * INGESTION_MOVES;
-      const seed = await runContentionHarness({
-        transactions: INGESTION_MOVES,
-        ratePerSecond: 5000,
-        concurrency: 4,
-        run: (i) =>
-          seeded.recordEvent(
-            rolloutMove(2 * first + i, first + i, "a", start + first + i),
-          ),
-      });
-      expect(seed.errors).toEqual({});
-      const retries = { rerun: 0, resend: 0, retriedTransactions: 0 };
-      const api = apiOf(INGESTION_LATENCY_MS, {
-        onRetry: (kind, attempt) => {
-          retries[kind] += 1;
-          if (attempt === 1) retries.retriedTransactions += 1;
-        },
-      });
-      const report = await runContentionHarness({
-        transactions: INGESTION_MOVES,
-        ratePerSecond: rate,
-        concurrency: INGESTION_WRITERS,
-        run: (i) =>
-          api.recordEvent(
-            rolloutMove(
-              2 * first + INGESTION_MOVES + i,
-              first + i,
-              "b",
-              Date.now(),
-            ),
-          ),
-      });
-      steps.push({
-        rate,
-        ...report,
-        ...retries,
-        retried: retries.retriedTransactions / INGESTION_MOVES,
-        achieved: Math.round(report.committed / (report.durationMs / 1000)),
-      });
-    }
-    // The ceiling: the highest rate kept up with, no errors and at most 5% retried.
-    const ceiling = steps
-      .filter(
-        (step) =>
-          Object.keys(step.errors).length === 0 &&
-          step.retried <= 0.05 &&
-          step.achieved >= step.rate * 0.9,
-      )
-      .at(-1)?.rate;
-    console.info(
-      "supabase-ingestion-ceiling",
-      JSON.stringify({
-        writers: INGESTION_WRITERS,
-        latencyMs: INGESTION_LATENCY_MS,
-        ceiling,
-        steps,
-      }),
-    );
-    for (const { committed, errors } of steps) {
-      // Under contention a move may run out of retries, and nothing else fails.
-      const { DatabaseConflictError: conflicts = 0, ...others } = errors;
-      expect(others).toEqual({});
-      expect(committed + conflicts).toBe(INGESTION_MOVES);
-    }
-  }, 600_000);
-
-  it("serves unversioned Release Catalog routes from the edge function entrypoint", async () => {
-    const bundle = toRuntimeBundle({
-      id: "00000000-0000-0000-0000-000000000001",
-      platform: "ios",
-      gitCommitHash: null,
-      manifestStorageUri: "storage://unused/manifest.json",
-      manifestFileHash: "manifest-hash",
-      assetBaseStorageUri: "storage://unused/assets",
-    });
-
-    await uploadBundleObject(supabaseAdmin, bundle.id);
-    await deployToProduction(core, bundle);
-
-    const unauthorized = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0`,
-    );
-    expect(unauthorized.status).toBe(401);
-
-    const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/release-catalogs/app-version/ios/cHJvZHVjdGlvbg/1.0.0`,
-      { headers: { "x-api-key": API_KEY } },
-    );
-
-    expect(response.ok).toBe(true);
-    await expect(response.json()).resolves.toMatchObject({
-      catalogId: expect.stringMatching(/^[0-9a-f-]{36}$/),
-      releases: [{ bundleId: "00000000-0000-0000-0000-000000000001" }],
-    });
-  });
-
-  it("does not support the legacy exact path", async () => {
-    const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/api/check-update`,
-    );
-
-    expect(response.status).toBe(404);
-  });
-
-  it("does not expose management routes from the edge function entrypoint", async () => {
-    const response = await fetch(
-      `http://127.0.0.1:${edgePort}${FUNCTION_BASE_PATH}/admin/bundles`,
-    );
-
-    expect(response.status).toBe(404);
-    await expect(response.json()).resolves.toEqual({
-      error: "Not found",
-    });
-  });
-});
-
-function base64UrlEncode(value: string | Buffer) {
-  return Buffer.from(value)
-    .toString("base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/g, "");
-}
-
-function createLegacyJwt(role: "anon" | "service_role") {
-  const header = base64UrlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
-  const payload = base64UrlEncode(
-    JSON.stringify({
-      role,
-      iss: "supabase-test",
-      iat: Math.floor(Date.now() / 1000),
-      exp: Math.floor(Date.now() / 1000) + JWT_EXPIRY_SECONDS,
-    }),
-  );
-  const signature = createHmac("sha256", JWT_SECRET)
-    .update(`${header}.${payload}`)
-    .digest("base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/g, "");
-
-  return `${header}.${payload}.${signature}`;
-}
-
-const waitForUrlOk = async (url: string, timeoutMs = 90_000) => {
-  const deadline = Date.now() + timeoutMs;
-  let lastError = "no response";
-
-  while (Date.now() < deadline) {
-    try {
-      const response = await fetch(url);
-      if (response.ok) {
-        return;
-      }
-
-      lastError = `${response.status} ${response.statusText}`;
-    } catch (error) {
-      lastError = error instanceof Error ? error.message : String(error);
-    }
-
-    await sleep(500);
-  }
-
-  throw new Error(`Timed out waiting for ${url}: ${lastError}`);
-};
-
-const waitForRestApiReady = async (baseUrl: string, timeoutMs = 90_000) => {
-  const deadline = Date.now() + timeoutMs;
-  let lastError = "no response";
-
-  while (Date.now() < deadline) {
-    try {
-      const response = await fetch(
-        `${baseUrl}/rest/v1/${SUPABASE_TABLE_PREFIX}bundles?select=id&limit=1`,
-        {
-          headers: {
-            apikey: SERVICE_ROLE_KEY,
-            Authorization: `Bearer ${SERVICE_ROLE_KEY}`,
-          },
-        },
-      );
-      if (response.ok) {
-        return;
-      }
-
-      lastError = `${response.status} ${response.statusText}: ${await response.text()}`;
-    } catch (error) {
-      lastError = error instanceof Error ? error.message : String(error);
-    }
-
-    await sleep(500);
-  }
-
-  throw new Error(`Timed out waiting for PostgREST: ${lastError}`);
-};
-
-const sleep = async (ms: number) => {
-  await new Promise((resolve) => setTimeout(resolve, ms));
-};
-
-const ensureBucketExists = async (
-  supabaseAdmin: ReturnType<typeof createClient>,
-) => {
-  const { data: buckets, error: listError } =
-    await supabaseAdmin.storage.listBuckets();
-
-  if (listError) {
-    throw listError;
-  }
-
-  if (buckets.some((bucket) => bucket.name === BUCKET_NAME)) {
-    return;
-  }
-
-  const { error } = await supabaseAdmin.storage.createBucket(BUCKET_NAME);
-
-  if (error) {
-    throw error;
-  }
-};
-
-const uploadBundleObject = async (
-  supabaseAdmin: ReturnType<typeof createClient>,
-  bundleId: string,
-) => {
-  await uploadStorageObject(
-    supabaseAdmin,
-    `${bundleId}/manifest.json`,
-    JSON.stringify({ bundleId, assets: {} }),
-    "application/json",
-  );
-};
-
-const uploadStorageObject = async (
-  supabaseAdmin: ReturnType<typeof createClient>,
-  key: string,
-  body: string | Buffer,
-  contentType: string,
-) => {
-  const { error } = await supabaseAdmin.storage
-    .from(BUCKET_NAME)
-    .upload(key, body, {
-      contentType,
-      cacheControl: "31536000",
-      upsert: true,
-    });
-
-  if (error) {
-    throw error;
-  }
-};
-
-const loadSupabaseInitSql = async (storageRepoPath: string) => {
-  const storageMigrationsDir = path.join(storageRepoPath, "migrations/tenant");
-  const storageMigrationFiles = (await readdir(storageMigrationsDir))
-    .filter((file) => file.endsWith(".sql"))
-    .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
-  const storageMigrations = await Promise.all(
-    storageMigrationFiles.map(async (file) => {
-      const contents = await readFile(
-        path.join(storageMigrationsDir, file),
-        "utf8",
-      );
-      const trimmed = contents.trimEnd();
-      return trimmed.endsWith(";") ? trimmed : `${trimmed};`;
-    }),
-  );
-
-  const migrationsDir = path.join(
-    WORKSPACE_ROOT,
-    "plugins/supabase/supabase/migrations",
-  );
-  const migrationFiles = (await readdir(migrationsDir))
-    .filter((file) => file.endsWith(".sql"))
-    .sort();
-  const migrations = await Promise.all(
-    migrationFiles.map(async (file) => {
-      const contents = await readFile(path.join(migrationsDir, file), "utf8");
-      return contents.replaceAll("%%BUCKET_NAME%%", BUCKET_NAME);
-    }),
-  );
-
-  return `
-CREATE EXTENSION IF NOT EXISTS pgcrypto;
-
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
-    CREATE ROLE anon NOLOGIN NOINHERIT;
-  END IF;
-
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
-    CREATE ROLE authenticated NOLOGIN NOINHERIT;
-  END IF;
-
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
-    CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;
-  END IF;
-
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticator') THEN
-    CREATE ROLE authenticator LOGIN PASSWORD '${POSTGRES_PASSWORD}' NOINHERIT;
-  END IF;
-
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_roles WHERE rolname = 'supabase_storage_admin'
-  ) THEN
-    CREATE ROLE supabase_storage_admin LOGIN PASSWORD '${POSTGRES_PASSWORD}' SUPERUSER;
-  END IF;
-END $$;
-
-GRANT anon TO authenticator;
-GRANT authenticated TO authenticator;
-GRANT service_role TO authenticator;
-
-${migrations.join("\n\n")}
-
-SET search_path TO storage, public, extensions;
-
-${storageMigrations.join("\n\n")}
-
-SET search_path TO public;
-
-GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
-GRANT SELECT ON ALL TABLES IN SCHEMA public TO anon, authenticated;
-GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO service_role;
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO anon, authenticated, service_role;
-GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO anon, authenticated, service_role;
-
-REVOKE EXECUTE ON FUNCTION public.hot_updater_v1_apply(jsonb)
-  FROM anon, authenticated;
-
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
-  GRANT SELECT ON TABLES TO anon, authenticated;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
-  GRANT ALL PRIVILEGES ON TABLES TO service_role;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
-  GRANT USAGE, SELECT ON SEQUENCES TO anon, authenticated, service_role;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
-  GRANT EXECUTE ON FUNCTIONS TO anon, authenticated, service_role;
-`.trim();
-};
-
-const createComposeFile = ({
-  gatewayPort,
-  runtimeRoot,
-}: {
-  gatewayPort: number;
-  runtimeRoot: string;
-}) => {
-  return `
-services:
-  db:
-    image: ${POSTGRES_IMAGE}
-    environment:
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: ${POSTGRES_DB}
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U postgres -d ${POSTGRES_DB}"]
-      interval: 5s
-      timeout: 5s
-      retries: 20
-    volumes:
-      - ${path.join(runtimeRoot, "db-init")}:/docker-entrypoint-initdb.d:ro
-
-  rest:
-    image: ${POSTGREST_IMAGE}
-    depends_on:
-      db:
-        condition: service_healthy
-    environment:
-      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
-      PGRST_DB_SCHEMAS: public,storage
-      PGRST_DB_MAX_ROWS: 1000
-      PGRST_DB_EXTRA_SEARCH_PATH: public
-      PGRST_DB_ANON_ROLE: anon
-      PGRST_JWT_SECRET: ${JWT_SECRET}
-      PGRST_DB_USE_LEGACY_GUCS: "false"
-      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
-      PGRST_APP_SETTINGS_JWT_EXP: "3600"
-
-  imgproxy:
-    image: ${IMGPROXY_IMAGE}
-    environment:
-      IMGPROXY_BIND: ":5001"
-      IMGPROXY_LOCAL_FILESYSTEM_ROOT: /
-      IMGPROXY_USE_ETAG: "true"
-
-  storage:
-    image: ${STORAGE_IMAGE}
-    restart: on-failure
-    depends_on:
-      db:
-        condition: service_healthy
-      rest:
-        condition: service_started
-      imgproxy:
-        condition: service_started
-    environment:
-      ANON_KEY: ${ANON_KEY}
-      SERVICE_KEY: ${SERVICE_ROLE_KEY}
-      POSTGREST_URL: http://rest:3000
-      AUTH_JWT_SECRET: ${JWT_SECRET}
-      DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
-      STORAGE_PUBLIC_URL: http://gateway:8000
-      REQUEST_ALLOW_X_FORWARDED_PATH: "true"
-      FILE_SIZE_LIMIT: 52428800
-      STORAGE_BACKEND: file
-      GLOBAL_S3_BUCKET: ${BUCKET_NAME}
-      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
-      TENANT_ID: stub
-      REGION: stub
-      ENABLE_IMAGE_TRANSFORMATION: "false"
-      IMGPROXY_URL: http://imgproxy:5001
-      S3_PROTOCOL_ACCESS_KEY_ID: stub
-      S3_PROTOCOL_ACCESS_KEY_SECRET: stub
-    volumes:
-      - storage-data:/var/lib/storage
-
-  gateway:
-    image: ${NGINX_IMAGE}
-    depends_on:
-      storage:
-        condition: service_started
-      rest:
-        condition: service_started
-    ports:
-      - "0.0.0.0:${gatewayPort}:8000"
-    volumes:
-      - ${path.join(runtimeRoot, "nginx.conf")}:/etc/nginx/nginx.conf:ro
-
-volumes:
-  storage-data:
-`.trim();
-};
-
-const createNginxConfig = () => {
-  return `
-events {}
-
-http {
-  client_max_body_size 100m;
-
-  server {
-    listen 8000;
-
-    location /rest/v1/ {
-      proxy_pass http://rest:3000/;
-      proxy_http_version 1.1;
-      proxy_set_header Host $host;
-      proxy_set_header Authorization $http_authorization;
-      proxy_set_header apikey $http_apikey;
-      proxy_set_header Content-Profile $http_content_profile;
-      proxy_set_header Accept-Profile $http_accept_profile;
-      proxy_set_header Prefer $http_prefer;
-      proxy_set_header Range $http_range;
-      proxy_set_header Range-Unit $http_range_unit;
-      proxy_set_header Content-Type $http_content_type;
-    }
-
-    location /storage/v1/ {
-      proxy_pass http://storage:5000/;
-      proxy_http_version 1.1;
-      proxy_set_header Host $host;
-      proxy_set_header Authorization $http_authorization;
-      proxy_set_header apikey $http_apikey;
-      proxy_set_header x-forwarded-path $request_uri;
-      proxy_set_header Content-Type $http_content_type;
-      proxy_set_header Content-Length $content_length;
-    }
-  }
-}
-`.trim();
-};
-
-const writeSupabaseRuntimeFiles = async ({
-  runtimeRoot,
-  gatewayPort,
-  storageRepoPath,
-}: {
-  runtimeRoot: string;
-  gatewayPort: number;
-  storageRepoPath: string;
-}) => {
-  await mkdir(path.join(runtimeRoot, "db-init"), { recursive: true });
-  await mkdir(path.join(runtimeRoot, "supabase/edge-functions"), {
-    recursive: true,
-  });
-  await symlink(
-    path.join(WORKSPACE_ROOT, "plugins/supabase/src"),
-    path.join(runtimeRoot, "src"),
-  );
-  await symlink(
-    path.join(WORKSPACE_ROOT, "plugins/supabase/node_modules"),
-    path.join(runtimeRoot, "node_modules"),
-  );
-
-  const transformedEntry = transformEnv(
-    path.join(
-      WORKSPACE_ROOT,
-      "plugins/supabase/supabase/edge-functions/index.ts",
-    ),
-    {
-      BUCKET_NAME,
-      FUNCTION_NAME,
-    },
-  );
-  const importMap = {
-    imports: {
-      "@hot-updater/server": pathToFileURL(
-        path.join(WORKSPACE_ROOT, "packages/server/dist/index.mjs"),
-      ).href,
-      ...Object.fromEntries(
-        ["api-keys", "insights"].map((plugin) => [
-          `@hot-updater/server/plugins/${plugin}`,
-          pathToFileURL(
-            path.join(
-              WORKSPACE_ROOT,
-              `packages/server/dist/plugins/${plugin}/index.mjs`,
-            ),
-          ).href,
-        ]),
-      ),
-      "@hot-updater/supabase/edge": pathToFileURL(
-        path.join(runtimeRoot, "hot-updater-supabase-edge.ts"),
-      ).href,
-      hono: `npm:hono@${resolvePackageVersion("hono", {
-        searchFrom: path.join(WORKSPACE_ROOT, "plugins/supabase"),
-      })}`,
-    },
-  };
-
-  await writeFile(
-    path.join(runtimeRoot, "hot-updater-supabase-edge.ts"),
-    `
-export { plugins } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/plugins.ts")).href)};
-export { supabaseDatabase } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/supabaseDatabase.ts")).href)};
-export { supabaseEdgeFunctionStorage as supabaseStorage } from ${JSON.stringify(pathToFileURL(path.join(WORKSPACE_ROOT, "plugins/supabase/src/supabaseEdgeFunctionStorage.ts")).href)};
-`.trim(),
-  );
-  await writeFile(
-    path.join(runtimeRoot, "supabase/edge-functions/index.ts"),
-    transformedEntry,
-  );
-  await writeFile(
-    path.join(runtimeRoot, "import_map.json"),
-    JSON.stringify(importMap),
-  );
-  await writeFile(
-    path.join(runtimeRoot, "db-init/00-init.sql"),
-    await loadSupabaseInitSql(storageRepoPath),
-  );
-  await writeFile(
-    path.join(runtimeRoot, "docker-compose.yml"),
-    createComposeFile({ runtimeRoot, gatewayPort }),
-  );
-  await writeFile(path.join(runtimeRoot, "nginx.conf"), createNginxConfig());
-};