@specific.dev/spectest 0.38.0 → 0.41.0

package/dist/components/supabase.js

@@ -51,7 +51,7 @@
 import { createHmac } from "node:crypto";
 import { existsSync } from "node:fs";
 import { readdir, stat } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { serviceGroup, } from "../index.js";
 import { SQL } from "../sql.js";
 import { email, emailHelpers } from "./email.js";
@@ -70,7 +70,17 @@ const IMAGES = {
     imgproxy: "darthsim/imgproxy:v3.30.1",
     meta: "supabase/postgres-meta:v0.96.6",
     studio: "supabase/studio:2026.07.07-sha-a6a04f2",
+    functions: "supabase/edge-runtime:v1.74.0",
 };
+/**
+ * The project root inside the VM. A service's `volumes[].source` is a static
+ * string in the wire config, so the edge runtime's bind mount cannot go
+ * through `ctx.projectRoot` (which only exists once a hook runs) — this is
+ * the same value, read the same way the harness reads it.
+ */
+function projectRootPath() {
+    return process.env.SPECTEST_WORKSPACE ?? "/workspace";
+}
 // Supabase's well-known demo secret (≥32 chars). Local-only; override via opts.
 const DEFAULT_JWT_SECRET = "your-super-secret-jwt-token-with-at-least-32-characters-long";
 // Fixed issued-at / expiry for the derived API keys. Constant (not `Date.now`)
@@ -147,6 +157,32 @@ function buildBootstrapSql(dbPassword, jwtSecret, withRealtime) {
 // as `apikey` header, `Authorization: Bearer <key>`, or the websocket
 // `?apikey=` query param) is swapped for the corresponding *derived JWT*
 // before proxying, so the upstream services still see a validly-signed token.
+//
+// SPECTEST DEVIATION — the `apikey` **query parameter** is a first-class
+// credential here, not just a websocket one. Kong's key-auth already accepts
+// it (`key_in_query` defaults on), but upstream saw only the header, so a
+// query-param request reached PostgREST as the anon role. A browser is the
+// reason this matters: `browser.goto(url)` sends no headers, so a top-level
+// navigation to a gated URL can carry a key ONLY in the query string (and a
+// 401 there surfaces as Chromium's opaque `ERR_INVALID_AUTH_CREDENTIALS`,
+// not a status code).
+//
+// The rest/graphql routes additionally `remove.querystring: [apikey]` in
+// their request-transformer, because PostgREST reads every unknown query
+// parameter as a column filter and answers `400 PGRST100` on the leftover
+// key. `hide_credentials: true` on key-auth would strip it (and the header)
+// far earlier — before this request-transformer runs — which would break
+// both the header swap above and the realtime websocket route, whose own
+// expression reads `query_params.apikey`. So the strip belongs here, on the
+// one upstream that cannot tolerate the parameter.
+//
+// MEASURED CONSEQUENCE — request-transformer removes the query parameter
+// BEFORE it renders the Authorization template, so on `/rest/v1` the JWT
+// never reaches PostgREST and the request runs as **anon**, whichever key
+// was sent. Verified against an RLS-protected table: the service-role key
+// as a header returned the row, the same key in the query returned `[]`.
+// Anon is the right privilege for the browser navigation this exists for;
+// anything needing service-role must send the header.
 function buildLuaExprs(extra) {
     // Keep a client's `Authorization: Bearer <extraKey>` from winning the
     // header-passthrough clause with the raw (non-JWT) key.
@@ -154,9 +190,9 @@ function buildLuaExprs(extra) {
         .map((m) => ` and headers.authorization ~= 'Bearer ${m.key}'`)
         .join("");
     const mappings = extra
-        .map((m) => ` or ((headers.apikey == '${m.key}' or headers.authorization == 'Bearer ${m.key}') and 'Bearer ${m.jwt}')`)
+        .map((m) => ` or ((headers.apikey == '${m.key}' or headers.authorization == 'Bearer ${m.key}' or query_params.apikey == '${m.key}') and 'Bearer ${m.jwt}')`)
         .join("");
-    const auth = `$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_'${guards} and headers.authorization)${mappings} or headers.apikey)`;
+    const auth = `$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_'${guards} and headers.authorization)${mappings} or headers.apikey or query_params.apikey)`;
     const wsMappings = extra
         .map((m) => `(query_params.apikey == '${m.key}' and '${m.jwt}') or `)
         .join("");
@@ -287,6 +323,9 @@ services:
           replace:
             headers:
               - "Authorization: $LUA_AUTH_EXPR"
+          remove:
+            querystring:
+              - apikey
       - name: acl
         config:
           hide_groups_header: true
@@ -312,6 +351,9 @@ services:
           replace:
             headers:
               - "Authorization: $LUA_AUTH_EXPR"
+          remove:
+            querystring:
+              - apikey
       - name: acl
         config:
           hide_groups_header: true
@@ -339,6 +381,9 @@ services:
           replace:
             headers:
               - "Authorization: $LUA_AUTH_EXPR"
+          remove:
+            querystring:
+              - apikey
       - name: acl
         config:
           hide_groups_header: true
@@ -450,6 +495,7 @@ services:
               if auth == nil or auth == "" or auth:find("^%s*$") then
                 kong.service.request.clear_header("authorization")
               end
+  # >>> functions (dropped when the edge runtime is off)
   - name: functions-v1
     url: http://functions:9000/
     read_timeout: 150000
@@ -460,6 +506,7 @@ services:
           - /functions/v1/
     plugins:
       - name: cors
+  # <<< functions
   - name: well-known-oauth
     url: http://auth:9999/.well-known/oauth-authorization-server
     routes:
@@ -498,11 +545,125 @@ services:
         config:
           hide_credentials: true
 `;
+// ──────────────────────────────────────────────────────────────────────────
+// Edge functions — the runtime's "main service": the request router that
+// spawns one user worker per function directory.
+//
+// Upstream ships an equivalent file in the repo the user is expected to copy
+// (`docker/volumes/functions/main/index.ts`). We inject our own instead, for
+// two reasons: the project's `supabase/functions/` holds the user's
+// functions and should not need a `main/` of ours in it; and upstream's
+// router imports `jsr:@panva/jose` at boot, which is a network fetch inside
+// an otherwise hermetic VM. HS256 is the only algorithm this stack signs
+// with, and Web Crypto verifies it in a few lines with no dependency.
+// ──────────────────────────────────────────────────────────────────────────
+const FUNCTIONS_MAIN_TS = String.raw `// spectest-generated edge-functions router. Do not edit.
+const FUNCTIONS_DIR = "/home/deno/functions";
+const JWT_SECRET = Deno.env.get("JWT_SECRET") ?? "";
+const VERIFY_JWT = Deno.env.get("VERIFY_JWT") === "true";
+
+function json(body: unknown, status: number): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function base64UrlToBytes(s: string): Uint8Array {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+// HS256 only — every token this stack mints (the anon/service-role API keys
+// and every GoTrue access token) is signed with the shared JWT secret.
+async function validJwt(token: string): Promise<boolean> {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !JWT_SECRET) return false;
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(JWT_SECRET),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"],
+    );
+    const signed = new TextEncoder().encode(parts[0] + "." + parts[1]);
+    if (!(await crypto.subtle.verify("HMAC", key, base64UrlToBytes(parts[2]), signed))) {
+      return false;
+    }
+    const claims = JSON.parse(new TextDecoder().decode(base64UrlToBytes(parts[1])));
+    if (typeof claims.exp === "number" && claims.exp * 1000 < Date.now()) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+Deno.serve(async (req: Request) => {
+  const { pathname } = new URL(req.url);
+
+  // Ready probe — answered before any auth check, so bring-up never needs a
+  // token, and never treated as a function name.
+  if (pathname === "/_spectest/health") return new Response("ok");
+
+  const name = pathname.split("/")[1] ?? "";
+  if (name === "") return json({ msg: "missing function name in request" }, 400);
+
+  if (VERIFY_JWT && req.method !== "OPTIONS") {
+    const header = req.headers.get("authorization") ?? "";
+    const [scheme, token] = header.split(" ");
+    if (scheme !== "Bearer" || !token || !(await validJwt(token))) {
+      return json({ msg: "Invalid JWT" }, 401);
+    }
+  }
+
+  const servicePath = FUNCTIONS_DIR + "/" + name;
+  try {
+    const worker = await EdgeRuntime.userWorkers.create({
+      servicePath,
+      memoryLimitMb: 256,
+      workerTimeoutMs: 5 * 60 * 1000,
+      noModuleCache: false,
+      importMapPath: null,
+      envVars: Object.entries(Deno.env.toObject()),
+    });
+    return await worker.fetch(req);
+  } catch (e) {
+    // A missing directory lands here too, so say which function was asked
+    // for — the runtime's own message names only the path.
+    return json({ msg: String(e), function: name, servicePath }, 500);
+  }
+});
+`;
+/** Keep or drop a `# >>> <tag>` … `# <<< <tag>` block, and always remove the
+ *  marker lines themselves. */
+function stripMarkedBlock(yaml, tag, keep) {
+    const out = [];
+    let inside = false;
+    for (const line of yaml.split("\n")) {
+        if (line.trim().startsWith(`# >>> ${tag}`)) {
+            inside = true;
+            continue;
+        }
+        if (line.trim().startsWith(`# <<< ${tag}`)) {
+            inside = false;
+            continue;
+        }
+        if (inside && !keep)
+            continue;
+        out.push(line);
+    }
+    return out.join("\n");
+}
 /** Produce the final Kong declarative config: rewrite upstream bare hostnames
  *  to the group's final service DNS names, substitute the API keys / dashboard
  *  credentials / Lua expressions, and drop the empty opaque-key lines. */
 function buildKongYaml(key, vals) {
     let y = KONG_YML_RAW;
+    y = stripMarkedBlock(y, "functions", vals.functions);
     // Extra API keys land where kong-entrypoint.sh's opaque keys would: as
     // additional keyauth credentials on the matching consumer. The template's
     // placeholder lines are either expanded here or dropped by the filter below.
@@ -542,73 +703,126 @@ function buildKongYaml(key, vals) {
         .join("\n");
     return y;
 }
-// ──────────────────────────────────────────────────────────────────────────
-// Migration application (runs in the db service's `setup`, after the DB is
-// ready and before any dependent service starts). Uses the setup context's
-// `exec` (docker exec with piped stdin) and `projectRoot` — no hand-rolled
-// child_process, no hard-coded workspace path.
-// ──────────────────────────────────────────────────────────────────────────
 /** Pipe one SQL file's contents into `psql` inside the db container. Uses
  *  `psql -f -` (stdin) so multi-statement files and non-transactional DDL
  *  (e.g. `CREATE INDEX CONCURRENTLY`) behave exactly as `supabase db reset`
  *  applies them — not wrapped in a single transaction. `ON_ERROR_STOP=1` fails
  *  fast on the first bad statement. */
-async function applySqlFile(ctx, sql, label, user) {
-    const res = await ctx.exec(ctx.name, ["psql", "-v", "ON_ERROR_STOP=1", "-U", user, "-d", "postgres", "-f", "-"], { stdin: sql, timeoutMs: 300_000 });
+async function applySqlFile(ctx, sql, label, user, 
+/** The db service to run `psql` in. Defaults to the hook's own service,
+ *  which is the db only for the bootstrap; the project's migrations run
+ *  from the group hook, where `ctx.name` is the gateway. */
+service = ctx.name) {
+    const res = await ctx.exec(service, ["psql", "-v", "ON_ERROR_STOP=1", "-U", user, "-d", "postgres", "-f", "-"], { stdin: sql, timeoutMs: 300_000 });
     if (res.exitCode !== 0) {
         throw new Error(`supabase: applying ${label} failed (psql rc=${res.exitCode}):\n${res.stderr.trim() || res.stdout.trim()}`);
     }
 }
-/** Resolve, sort, and apply the project's Supabase migrations + seed against
- *  the running db container as the `postgres` role (matching `supabase db
- *  reset` — tables end up owned by postgres). No-op when nothing is
- *  configured/present. */
-async function applyMigrations(ctx, cfg) {
-    // Migrations directory. An *explicitly configured* path that doesn't
-    // resolve is a hard error — a silent no-op here surfaces much later as a
-    // baffling `relation "public.…" does not exist`. Only the `true` default
-    // (conventional `supabase/migrations/`) is allowed to be absent.
-    if (cfg.migrations !== false) {
-        const explicit = typeof cfg.migrations === "string";
-        const dir = explicit
-            ? cfg.migrations.startsWith("/")
-                ? cfg.migrations
-                : join(ctx.projectRoot, cfg.migrations)
-            : join(ctx.projectRoot, "supabase", "migrations");
-        if (existsSync(dir) && (await stat(dir)).isDirectory()) {
-            const files = (await readdir(dir))
-                .filter((f) => f.endsWith(".sql"))
-                .sort();
-            for (const f of files) {
-                const sql = await ctx.readProjectFile(join(dir, f));
-                await applySqlFile(ctx, sql, `migration ${f}`, "postgres");
-            }
-        }
-        else if (explicit) {
-            throw new Error(`supabase: configured migrations path ${JSON.stringify(cfg.migrations)} does not resolve to a directory (looked at ${dir}). ` +
-                `Fix the \`migrations\` option, or remove it to use the default ` +
-                `supabase/migrations/. Note the path is resolved inside the uploaded ` +
-                `project — check it isn't ignored (e.g. via .spectestignore).`);
-        }
+/** Resolve, sort, and apply the project's Supabase migrations — and the
+ *  `seed.sql` the standard layout puts beside them — against the running db
+ *  container as the `postgres` role (matching `supabase db reset`: tables end
+ *  up owned by postgres).
+ *
+ *  Only ever called with a path the user gave: there is no assumed location,
+ *  so this never applies SQL nobody asked for. */
+async function applyMigrations(ctx, migrations, 
+/** Where `psql` runs — the db part, named from the group hook. */
+db) {
+    const dir = migrations.startsWith("/")
+        ? migrations
+        : join(ctx.projectRoot, migrations);
+    // A path that doesn't resolve is a hard error: a silent no-op here
+    // surfaces much later as a baffling `relation "public.…" does not exist`.
+    if (!existsSync(dir) || !(await stat(dir)).isDirectory()) {
+        throw new Error(`supabase: migrations path ${JSON.stringify(migrations)} does not ` +
+            `resolve to a directory (looked at ${dir}). The path is resolved ` +
+            `inside the uploaded project — check it isn't ignored (e.g. via ` +
+            `.spectestignore).`);
+    }
+    const files = (await readdir(dir)).filter((f) => f.endsWith(".sql")).sort();
+    for (const f of files) {
+        const sql = await ctx.readProjectFile(join(dir, f));
+        await applySqlFile(ctx, sql, `migration ${f}`, "postgres", db);
+    }
+    // `seed.sql` sits next to the migrations directory in the layout the
+    // Supabase CLI creates, so it needs no option of its own — pointing at
+    // the migrations is enough to say where the project's SQL lives. Absent
+    // is fine: plenty of projects have migrations and no seed.
+    const seedPath = join(dirname(dir), "seed.sql");
+    if (existsSync(seedPath)) {
+        const sql = await ctx.readProjectFile(seedPath);
+        await applySqlFile(ctx, sql, "seed.sql", "postgres", db);
     }
-    // Seed file — same contract: only the conventional default may be absent.
-    if (cfg.seed !== false) {
-        const explicit = typeof cfg.seed === "string";
-        const seedPath = explicit
-            ? cfg.seed.startsWith("/")
-                ? cfg.seed
-                : join(ctx.projectRoot, cfg.seed)
-            : join(ctx.projectRoot, "supabase", "seed.sql");
-        if (existsSync(seedPath)) {
-            const sql = await ctx.readProjectFile(seedPath);
-            await applySqlFile(ctx, sql, "seed.sql", "postgres");
+}
+/**
+ * Make PostgREST serve the schema the migrations just created, and do not
+ * return until it does so **stably**.
+ *
+ * PostgREST reads the schema once, at boot, and now boots before the
+ * project's migrations run. Without this, the first REST call for a new
+ * table answers `PGRST205 Could not find the table` — the failure the user
+ * would otherwise have to diagnose and work around themselves.
+ *
+ * Two things make this more than one request:
+ *
+ *  - **A rebuild is not atomic from the outside.** While PostgREST reloads,
+ *    a request can still miss the table. So a single successful check is not
+ *    proof; the cache has to answer correctly several times in a row.
+ *  - **Reloads are already in flight.** The `supabase/postgres` image ships
+ *    `pgrst_ddl_watch`, an event trigger that notifies on every DDL, so a
+ *    migration run queues several reloads of its own. Ours goes *first* and
+ *    the settle loop then waits them all out — checking before sending the
+ *    notify was a real bug: the poll passed, our own notify landed after it,
+ *    and a test raced the rebuild it caused.
+ *
+ * The expectation comes from the database itself: every base table in the
+ * exposed `public` schema should be listed. A stack with no public tables
+ * has nothing to wait for.
+ */
+async function reloadPostgrestSchema(ctx, db, rest) {
+    // Ours first, so every reload — ours and the DDL trigger's — is already
+    // queued before we start watching for the result.
+    await applySqlFile(ctx, "notify pgrst, 'reload schema';\n", "schema reload", "postgres", db);
+    const listed = await ctx.exec(db, [
+        "psql", "-U", "postgres", "-d", "postgres", "-t", "-A", "-c",
+        "select table_name from information_schema.tables " +
+            "where table_schema = 'public' and table_type = 'BASE TABLE' order by 1",
+    ], { timeoutMs: 60_000 });
+    const tables = String(listed.stdout)
+        .split("\n")
+        .map((t) => t.trim())
+        .filter(Boolean);
+    if (tables.length === 0)
+        return;
+    /** One check: are all the tables served right now? */
+    const served = async () => {
+        const res = await fetch(`http://${rest}:3000/`);
+        if (!res.ok)
+            return tables;
+        const spec = (await res.json());
+        const paths = Object.keys(spec.paths ?? {});
+        return tables.filter((t) => !paths.includes(`/${t}`));
+    };
+    const SETTLE = 3;
+    const deadline = Date.now() + 30_000;
+    let streak = 0;
+    let missing = tables;
+    while (Date.now() < deadline) {
+        try {
+            missing = await served();
+            streak = missing.length === 0 ? streak + 1 : 0;
+            if (streak >= SETTLE)
+                return;
         }
-        else if (explicit) {
-            throw new Error(`supabase: configured seed path ${JSON.stringify(cfg.seed)} not found ` +
-                `(looked at ${seedPath}). Fix the \`seed\` option or remove it to ` +
-                `use the default supabase/seed.sql.`);
+        catch {
+            // Mid-reload PostgREST can refuse the connection outright.
+            streak = 0;
         }
+        await new Promise((r) => setTimeout(r, 150));
     }
+    throw new Error(`supabase: PostgREST did not settle on the migrated schema within 30s ` +
+        `(still missing: ${missing.join(", ") || "nothing, but not stably"}). ` +
+        `The migrations applied — this is the REST schema cache, not your SQL.`);
 }
 /**
  * A ready-to-use self-hosted Supabase stack. Mount `.group` at the key
@@ -642,6 +856,26 @@ export function supabase(opts = {}) {
     // `mailKey` is the SMTP host GoTrue mails through — the in-group part
     // (`<name>-mail`) or a user-declared `email()` service shared with the app
     // under test.
+    // Edge functions — like `migrations`, a path the caller gives or nothing
+    // at all. A directory that doesn't resolve is an error rather than an
+    // empty runtime whose every call 500s much later.
+    const fnOpts = opts.functions === undefined
+        ? null
+        : typeof opts.functions === "string"
+            ? { dir: opts.functions }
+            : opts.functions;
+    const withFunctions = fnOpts !== null;
+    const fnDir = fnOpts === null
+        ? ""
+        : fnOpts.dir.startsWith("/")
+            ? fnOpts.dir
+            : join(projectRootPath(), fnOpts.dir);
+    if (withFunctions && !existsSync(fnDir)) {
+        throw new Error(`supabase(): functions path ${JSON.stringify(fnOpts.dir)} does not ` +
+            `resolve to a directory (looked at ${fnDir}). It should hold one ` +
+            `subdirectory per function. The path is resolved inside the uploaded ` +
+            `project — check it isn't ignored (e.g. via .spectestignore).`);
+    }
     const withMail = opts.mail !== false;
     const mailOpts = typeof opts.mail === "object" ? opts.mail : {};
     const mailExternal = mailOpts.service !== undefined;
@@ -710,18 +944,16 @@ export function supabase(opts = {}) {
                 // baked init-scripts and starts serving for real.
                 readyCheck: { type: "exec", command: "pg_isready -U postgres -h 127.0.0.1 -p 5432", timeoutSecs: 180 },
                 setup: async (ctx) => {
-                    // Bootstrap first (role passwords / JWT GUC / _realtime schema),
-                    // then the project's own migrations + seed — both before any
-                    // dependent service.
+                    // Only the database's own bootstrap (role passwords / JWT GUC /
+                    // `_realtime` schema) runs here: the other services need it before
+                    // they can start. The project's migrations run later, from the
+                    // group hook, once the whole stack is up — see the migration
+                    // section above for why.
                     await applySqlFile(ctx, buildBootstrapSql(dbPassword, jwtSecret, withRealtime), "supabase bootstrap", 
                     // The bootstrap alters reserved roles (authenticator, …) and the
                     // database — superuser-only. `postgres` is deliberately NOT a
                     // superuser in modern supabase/postgres; `supabase_admin` is.
                     "supabase_admin");
-                    await applyMigrations(ctx, {
-                        migrations: opts.migrations ?? true,
-                        seed: opts.seed ?? true,
-                    });
                 },
             };
             parts.db = dbDef;
@@ -772,11 +1004,16 @@ export function supabase(opts = {}) {
                         GOTRUE_JWT_ISSUER: apiExternalUrl,
                         GOTRUE_EXTERNAL_EMAIL_ENABLED: "true",
                         GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: "true",
-                        // Autoconfirm defaults ON (one-step signups, no confirmation
-                        // mail) so the always-on mailbox is purely additive; the mail
-                        // option's `autoconfirm: false` opts into real confirmation
-                        // flows.
-                        GOTRUE_MAILER_AUTOCONFIRM: withMail && !mailAutoconfirm ? "false" : "true",
+                        // Autoconfirm is ON by default: a signup completes in one step
+                        // and sends no confirmation mail, so the always-on mailbox is
+                        // purely additive and a suite that only needs accounts to exist
+                        // writes nothing. `autoconfirm: false` opts into the real
+                        // confirmation flow, which the mailbox is there to drive.
+                        //
+                        // Always ON when there is no mailbox (`mail: false`), whatever
+                        // was asked for: the confirmation would be sent nowhere and no
+                        // account could ever be used.
+                        GOTRUE_MAILER_AUTOCONFIRM: !withMail || mailAutoconfirm ? "true" : "false",
                         GOTRUE_EXTERNAL_PHONE_ENABLED: "false",
                         GOTRUE_SMS_AUTOCONFIRM: "true",
                         ...(withMail
@@ -892,6 +1129,41 @@ export function supabase(opts = {}) {
                     },
                 };
             }
+            // ── functions (edge runtime) ────────────────────────────────────
+            if (withFunctions) {
+                parts.functions = {
+                    image: { type: "registry", reference: IMAGES.functions },
+                    // The repo's own function directory, mounted where the runtime
+                    // looks. Read-only: the runtime only ever reads the sources, and
+                    // a function that writes into its own directory would be writing
+                    // into the user's checkout.
+                    volumes: [{ source: fnDir, target: "/home/deno/functions", readOnly: true }],
+                    // Our router (see FUNCTIONS_MAIN_TS) sits outside that mount, so
+                    // the project never has to carry a `main/` function of ours.
+                    files: [{ path: "/home/deno/main/index.ts", content: FUNCTIONS_MAIN_TS }],
+                    args: ["start", "--main-service", "/home/deno/main", "--port", "9000"],
+                    env: {
+                        JWT_SECRET: jwtSecret,
+                        VERIFY_JWT: (fnOpts.verifyJwt ?? true) ? "true" : "false",
+                        // A function calls back into its own project through the
+                        // gateway, exactly as it does when hosted.
+                        SUPABASE_URL: `http://${g.name}:8000`,
+                        SUPABASE_PUBLIC_URL: url,
+                        SUPABASE_ANON_KEY: anonKey,
+                        SUPABASE_SERVICE_ROLE_KEY: serviceRoleKey,
+                        SUPABASE_DB_URL: `postgresql://postgres:${dbPassword}@${db}:5432/postgres`,
+                        ...(fnOpts.env ?? {}),
+                    },
+                    ports: [9000],
+                    dependsOn: ["db"],
+                    readyCheck: {
+                        type: "http",
+                        port: 9000,
+                        path: "/_spectest/health",
+                        timeoutSecs: 120,
+                    },
+                };
+            }
             // ── meta (postgres-meta) ────────────────────────────────────────
             if (withMeta) {
                 parts.meta = {
@@ -966,6 +1238,7 @@ export function supabase(opts = {}) {
                             dashboardPassword,
                             extraAnonKeys,
                             extraServiceRoleKeys,
+                            functions: withFunctions,
                         }),
                     },
                 ],
@@ -975,6 +1248,16 @@ export function supabase(opts = {}) {
             };
             return parts;
         },
+        // The project's own SQL, applied with the whole stack up (the group
+        // hook chains after the primary, and the primary is the group's
+        // dependency sink). Still inside bring-up, so the result is captured
+        // into the cached environment like everything else.
+        setup: async (ctx) => {
+            if (opts.migrations === undefined)
+                return;
+            await applyMigrations(ctx, opts.migrations, dbKey);
+            await reloadPostgrestSchema(ctx, dbKey, `${name}-rest`);
+        },
         // The group's consolidated handle at `ctx.svc.<name>`.
         helpers: () => ({
             sql: new SQL(adminDbUrl, { label: name }),

package/dist/daemon.d.ts

@@ -1 +1,39 @@
+import { type MethodTable } from "./harness/methods.js";
+/**
+ * Mutual exclusion between the operations that cannot overlap.
+ *
+ * One harness process holds one environment, so a second test running
+ * beside the first would share its containers, its fake state and its
+ * recorder. These flags are what make "already running" a refusal rather
+ * than a corruption.
+ */
+interface RouteState {
+    inFlightTest: Promise<unknown> | null;
+    inFlightBootstrap: Promise<unknown> | null;
+    inFlightProjectSetup: Promise<unknown> | null;
+}
+/**
+ * Everything the harness can be asked to do.
+ *
+ * Transport-neutral by construction: params in, plain result out, failures
+ * as {@link HarnessError}. The HTTP router below and the supervisor's frame
+ * dispatcher both drive this same table, so a change reaches both — which
+ * is the property that makes it safe to run the two side by side during the
+ * cutover.
+ */
+export declare function harnessMethods(state: RouteState): MethodTable;
+/**
+ * The method table for this process.
+ *
+ * Built once, so the mutual-exclusion slots are process-wide: `run` refuses
+ * a second case while one is in flight, and that guarantee has to hold for
+ * the process, not per caller. Two tables would each enforce the rule and
+ * together break it — which is why this is a value and not a factory the
+ * caller invokes.
+ *
+ * The harness (`sdk/src/harness/main.ts`) serves this over frames. It used
+ * to be served over HTTP as well, by a listener in this file; that was the
+ * in-VM daemon, and it is gone.
+ */
+export declare const METHODS: MethodTable;
 export {};