@specific.dev/spectest 0.97.0 → 0.99.0

package/README.md

@@ -15,39 +15,10 @@ Install the [Spectest CLI](https://github.com/specific-dev/spectest/releases/lat
 and run `spectest docs /installation` for project setup and authentication.
 `spectest docs` contains the complete offline authoring guide.
 
-## Google Cloud Pub/Sub
-
-Google Cloud components are available from `@specific.dev/spectest/components/gcp`.
-The existing Pub/Sub exports from `/components` remain supported.
-
-`pubsub()` runs Google's local emulator and creates topics/subscriptions before
-dependent services start:
-
-```ts
-import { pubsub } from "@specific.dev/spectest/components/gcp";
-
-const services = {
-  messages: pubsub({
-    projectId: "local-orders",
-    subscriptions: { "orders-worker": { topic: "orders" } },
-  }),
-};
-```
-
-The default endpoint is `https://pubsub.googleapis.com`, with trusted TLS and
-gRPC support. Keep your application's normal endpoint configuration, supply
-local test credentials and project `local-orders`, and use
-`dependsOn: ["messages"]`. Tests can call
-`ctx.svc.messages.publish()`, `pull()` and `acknowledge()`. VM snapshots preserve
-the emulator's live state. See `examples/google-pubsub` and
-`spectest docs /components/pubsub` for test credential setup and options.
-Set `tls: false` to use explicit plaintext emulator mode instead.
-
-Push subscriptions support HTTPS, `pushConfig.oidcToken`, `deadLetterPolicy`,
-and `retryPolicy`. Add the `google()` component for locally signed service-account
-ID tokens verified through Google’s normal certificate endpoints. Declare
-authenticated subscriptions in `subscriptions` or through the component’s
-`createSubscription` helper; raw emulator API calls do not add authentication.
+Pub/Sub integrations are project-owned as of SDK 0.98.0. The former
+`pubsub`/`pubsubClient` exports and `/components/gcp` entry point are removed.
+Use a local service definition or `serviceGroup()` wrapper; the repository’s
+`examples/google-pubsub` demonstrates this using public SDK APIs.
 
 ## HTTP assertions
 
@@ -156,4 +127,36 @@ Clients use trusted TLS on port 443. The ingress selects HTTP/2 with ALPN,
 routes each stream by `:authority`, and preserves streaming bodies, metadata,
 trailers, and cancellation. HTTP/1.1 requests still use the existing HTTP proxy.
 Runtime services support the same option. HTTP/2 streams currently bypass
-`ctx.intercept` and HTTP request recording. `pubsub()` enables this by default.
+`ctx.intercept` and HTTP request recording.
+
+### CORS at ingress
+
+Fake and service ingress default to `cors: "passthrough"`: OPTIONS requests
+reach the handler or upstream through `ctx.intercept`, and response CORS headers
+are preserved, including their absence on rejections or responses with no CORS
+policy. Allowed credentialed requests depend on the application's own headers.
+
+Automatic CORS is opt-in per fake or service hostname:
+
+```ts
+defineFake({ name: "api", hostnames: ["api.test"], cors: "permissive", handler });
+// On a boot or runtime service:
+tls: [{ hostname: "api.test", port: 3000, cors: "permissive" }]
+// On a Supabase gateway (including responses from interceptors):
+supabase({ hostname: "supabase.example.com", cors: "permissive" });
+// On a low-level component proxy:
+proxy("api.test", { service: "api", port: 3000, cors: "permissive" });
+```
+
+Permissive HTTP/1 ingress answers CORS preflights before interceptors and adds
+reflected allow-origin plus allow-credentials to responses without allow-origin,
+including errors. Ordinary OPTIONS still reaches the handler. Use passthrough
+when testing application CORS policies. HTTP/2 streams always pass CORS through.
+
+Prefer the application's production hostnames for the frontend and API inside
+the environment: Spectest resolves declared names to its test services and
+provides certificates trusted inside the environment. This preserves existing
+origin allowlists and cookie relationships. Different subdomains are still
+different origins; a synthetic response must still supply the intended CORS
+headers. Permissive mode is a convenience override and should not be used to
+verify application CORS restrictions.

package/dist/components/index.d.ts

@@ -1,4 +1,3 @@
-export { pubsub, pubsubClient, type PubSubOptions, type PubSubOidcToken, type PubSubPushConfig, type PubSubDeadLetterPolicy, type PubSubRetryPolicy, type PubSubClient, type PubSubHelpers, type PubSubSubscriptionOptions, type PubSubMessage, type PubSubReceivedMessage } from "./pubsub.js";
 export { temporal, temporalClient, type TemporalOptions, type TemporalClient, type TemporalNamespace, type TemporalWorkerOptions, type TemporalPoller, type TemporalSearchAttributeType, type TemporalTaskType } from "./temporal.js";
 export { postgres, type PostgresOptions, type PostgresHelpers, } from "./postgres.js";
 export { s3, type S3Options, type S3Helpers, } from "./s3.js";

package/dist/components/index.js

@@ -1,5 +1,4 @@
 // Reusable, pre-built service definitions for common dependencies.
-export { pubsub, pubsubClient } from "./pubsub.js";
 export { temporal, temporalClient } from "./temporal.js";
 //
 // Each component returns a fully-formed `ServiceDefinition` ready to

package/dist/components/supabase.d.ts

@@ -1,4 +1,4 @@
-import { type ServiceDefinition, type ServiceGroup, type ServicesMap } from "../index.js";
+import { type CorsMode, type ServiceDefinition, type ServiceGroup, type ServicesMap } from "../index.js";
 import { type SqlClient } from "../sql.js";
 import { type EmailHelpers } from "./email.js";
 export type { MailTemplateId, MailTemplateSpec } from "./supabase-config.js";
@@ -63,6 +63,10 @@ export interface SupabaseOptions {
      * test hardcodes a Supabase URL it cannot be told to override.
      */
     hostname?: string;
+    /** CORS handling at the daemon ingress for `hostname`. Defaults to
+     * "passthrough", preserving gateway/interceptor policy. "permissive"
+     * restores automatic preflight replies and credentialed CORS headers. */
+    cors?: CorsMode;
     /**
      * Capture GoTrue's outgoing mail (signup confirmations, magic links, OTPs,
      * password recovery, invites) with the standard `email()` component. **On

package/dist/components/supabase.js

@@ -55,6 +55,7 @@ import { excludeAllBut, functionsReach } from "./supabase-functions-reach.js";
 import { readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { serviceGroup, } from "../index.js";
+import { validateCorsMode } from "../ingress.js";
 import { SQL } from "../sql.js";
 import { apple } from "./apple.js";
 import { email, emailHelpers } from "./email.js";
@@ -1211,6 +1212,7 @@ db) {
  * for hitting the REST/auth/storage APIs through the gateway.
  */
 export function supabase(opts = {}) {
+    validateCorsMode(opts.cors);
     const name = opts.name ?? "supabase";
     const dbPassword = opts.dbPassword ?? "postgres";
     const jwtSecret = opts.jwtSecret ?? DEFAULT_JWT_SECRET;
@@ -1866,7 +1868,7 @@ export function supabase(opts = {}) {
                     },
                 ],
                 ports: [8000, 8443],
-                ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000 }] } : {}),
+                ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000, ...(opts.cors ? { cors: opts.cors } : {}) }] } : {}),
                 readyCheck: { type: "exec", command: "kong health", timeoutSecs: 90 },
             };
             return parts;

package/dist/daemon.js

@@ -56,7 +56,7 @@ import { installFetchWrapper, isTransportError } from "./harness/fetch.js";
 import { bindInstrumentationScope, createInstrumentationScope, runInstrumented, runUninstrumented, } from "./harness/instrumentation-scope.js";
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
-import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, upstreamRequestHeaders, } from "./harness/http-proxy.js";
+import { HOP_BY_HOP_HEADERS, withIngressCors, upstreamRequestHeaders, } from "./harness/http-proxy.js";
 import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
@@ -1707,7 +1707,7 @@ async function startIngress() {
     if (LOWERED.proxies.length > 0) {
         const routes = ensurePort(INGRESS_HTTP_PORT);
         for (const p of LOWERED.proxies) {
-            routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+            routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
         }
     }
     // The :443 route table mirrors every handler whose hostname a cert
@@ -1724,7 +1724,7 @@ async function startIngress() {
         }
         for (const p of LOWERED.proxies) {
             if (certCovers(p.hostname)) {
-                httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+                httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
             }
         }
     }
@@ -1876,16 +1876,16 @@ function certCovers(hostname) {
  * per-test snapshot exactly like fake state — a `dependsOn` child inherits
  * it, siblings forked from an earlier snapshot never see it.
  */
-async function bindRuntimeTls(hostname, service, port, http2) {
+async function bindRuntimeTls(hostname, service, port, http2, cors) {
     // Reuse the boot primitives for validation + lowercasing; throws on a
     // malformed hostname / upstream just like a boot `tls` would at load.
-    const decl = makeProxyDecl(hostname, { service, port, http2 });
+    const decl = makeProxyDecl(hostname, { service, port, http2, cors });
     const host = decl.hostname;
     if (!existsSync(CA_PATH) || !existsSync(CA_KEY_PATH)) {
         throw new Error(`runtime tls for ${JSON.stringify(host)} requires the in-VM root CA at ${CA_PATH}`);
     }
     const Bun = requireBun();
-    const route = { kind: "proxy", service, port, http2 };
+    const route = { kind: "proxy", service, port, http2, cors };
     // Decide the cost before mutating anything: an already-covered hostname
     // (an exact duplicate, or one under a boot wildcard) needs only a route.
     const plan = planBind(INGRESS, host, {
@@ -2030,12 +2030,6 @@ server, byHost, listenerLabel, proto) {
     if (!route) {
         return new Response(`spectest-daemon: no ingress route bound to Host=${JSON.stringify(host)} on ${listenerLabel}\n`, { status: 404, headers: { "content-type": "text/plain" } });
     }
-    // Answer CORS preflights at the ingress (see corsPreflightResponse) so a
-    // cross-origin browser request carrying any header — Authorization,
-    // Cache-Control, Pragma, … — isn't rejected by whatever the upstream happens
-    // to list in Access-Control-Allow-Headers.
-    if (isCorsPreflight(req))
-        return corsPreflightResponse(req);
     // The real answer — a fake handled in-process, or the proxied container.
     const upstream = async (current) => {
         if (route.kind === "fake") {
@@ -2049,15 +2043,15 @@ server, byHost, listenerLabel, proto) {
         }
         return proxyToService(current, server, route.service, route.port, listenerLabel, proto);
     };
-    // `ctx.intercept` middleware runs first, in registration order, and reaches
-    // the upstream through `next()`. The CORS headers go on *after* the chain,
-    // so a forced 500 reaches the browser as a 500 and not as a CORS error —
-    // the trap `page.route`-style interception falls into.
-    const chain = INTERCEPTORS.chainFor(host, new URL(req.url).pathname);
-    const res = chain.length === 0
-        ? await upstream(req)
-        : await runChain(chain, req, upstream, recordInterceptedRequest);
-    return augmentCorsResponse(req, res);
+    // Passthrough (the default) lets middleware and the upstream handle every
+    // request and preserves their CORS policy, including absent headers.
+    const cors = route.kind === "fake" ? route.fake.def.cors : route.cors;
+    return withIngressCors(req, cors, async (current) => {
+        const chain = INTERCEPTORS.chainFor(host, new URL(current.url).pathname);
+        return chain.length === 0
+            ? upstream(current)
+            : runChain(chain, current, upstream, recordInterceptedRequest);
+    });
 }
 /**
  * The address to report as the client's in `X-Forwarded-For`.
@@ -2619,7 +2613,7 @@ async function startRuntimeService(spec) {
         // `tls` is the runtime twin of a boot service's: stand up a
         // TLS-terminating reverse proxy at https://<hostname>/ → this container.
         for (const entry of svc.tls ?? []) {
-            await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2);
+            await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2, entry.cors);
         }
         RUNTIME_SERVICES.set(svc.name, svc);
         recordEnv({

package/dist/harness/http-proxy.d.ts

@@ -1,3 +1,4 @@
+import type { CorsMode } from "../ingress.js";
 /**
  * HTTP semantics the ingress proxy has to get right: which headers must
  * not be forwarded, and how CORS is answered.
@@ -37,9 +38,8 @@ export declare function isCorsPreflight(req: {
     };
 }): boolean;
 /**
- * Answer a preflight permissively — the environment is hermetic, so
- * there is nothing here to protect from itself, and a test failing on
- * CORS teaches nothing about the app.
+ * Answer a preflight for explicitly permissive ingress only. Passthrough
+ * must let the application or interceptor decide, including rejecting it.
  *
  * The one rule that is not a matter of taste: the **specific** origin is
  * echoed rather than `*`. `Allow-Origin: *` together with
@@ -53,15 +53,15 @@ export declare function corsPreflightResponse(req: {
     };
 }): Response;
 /**
- * Add CORS headers to a proxied response, without overriding the
- * upstream's own.
- *
- * An app that already sets `Access-Control-Allow-Origin` has an opinion —
- * possibly a deliberately restrictive one that a test is checking — and
- * replacing it would make the environment lie about the app's behaviour.
+ * Add CORS headers only when permissive ingress was explicitly requested.
+ * An absent allow-origin can be a deliberate rejection; callers must never
+ * use this augmentation in passthrough mode. Existing allow-origin is kept.
  */
 export declare function augmentCorsResponse(req: {
     headers: {
         get(n: string): string | null;
     };
 }, res: Response): Response;
+/** Apply the same policy around the entire fake/proxy + interceptor chain.
+ * Passthrough forwards even preflights and preserves the response unchanged. */
+export declare function withIngressCors(req: Request, cors: CorsMode | undefined, handle: (req: Request) => Response | Promise<Response>): Promise<Response>;

package/dist/harness/http-proxy.js

@@ -64,9 +64,8 @@ export function isCorsPreflight(req) {
         req.headers.has("access-control-request-method"));
 }
 /**
- * Answer a preflight permissively — the environment is hermetic, so
- * there is nothing here to protect from itself, and a test failing on
- * CORS teaches nothing about the app.
+ * Answer a preflight for explicitly permissive ingress only. Passthrough
+ * must let the application or interceptor decide, including rejecting it.
  *
  * The one rule that is not a matter of taste: the **specific** origin is
  * echoed rather than `*`. `Allow-Origin: *` together with
@@ -88,15 +87,13 @@ export function corsPreflightResponse(req) {
     // one origin's preflight to another.
     headers.append("vary", "Origin");
     headers.append("vary", "Access-Control-Request-Headers");
+    headers.append("vary", "Access-Control-Request-Method");
     return new Response(null, { status: 204, headers });
 }
 /**
- * Add CORS headers to a proxied response, without overriding the
- * upstream's own.
- *
- * An app that already sets `Access-Control-Allow-Origin` has an opinion —
- * possibly a deliberately restrictive one that a test is checking — and
- * replacing it would make the environment lie about the app's behaviour.
+ * Add CORS headers only when permissive ingress was explicitly requested.
+ * An absent allow-origin can be a deliberate rejection; callers must never
+ * use this augmentation in passthrough mode. Existing allow-origin is kept.
  */
 export function augmentCorsResponse(req, res) {
     const origin = req.headers.get("origin");
@@ -116,3 +113,11 @@ export function augmentCorsResponse(req, res) {
     }
     return res;
 }
+/** Apply the same policy around the entire fake/proxy + interceptor chain.
+ * Passthrough forwards even preflights and preserves the response unchanged. */
+export async function withIngressCors(req, cors, handle) {
+    if (cors === "permissive" && isCorsPreflight(req))
+        return corsPreflightResponse(req);
+    const res = await handle(req);
+    return cors === "permissive" ? augmentCorsResponse(req, res) : res;
+}

package/dist/harness/ingress-table.d.ts

@@ -41,6 +41,7 @@
  * thing {@link planBind} still has to say is whether the listener exists
  * yet.
  */
+import type { CorsMode } from "../ingress.js";
 /**
  * One hostname's upstream: a fake handled in-process, or a container.
  *
@@ -56,6 +57,7 @@ export type Route<F = unknown> = {
     service: string;
     port: number;
     http2?: boolean;
+    cors?: CorsMode;
 };
 /** A PEM leaf + key, as handed to `Bun.serve`'s TLS config. */
 export interface Leaf {

package/dist/index.d.ts

@@ -29,8 +29,8 @@ export { type CoverageAdapter, type CoverageCaptureContext, type CoverageConfigu
 import { type ServiceCoverage } from "./coverage.js";
 export { ca } from "./environment-ca.js";
 export { certificate, dnsName, proxy, provides, lowerIngress, isWildcard, SELF_SERVICE_TOKEN, } from "./ingress.js";
-export type { CertificateDecl, DnsDecl, ProxyDecl, IngressDecl, DnsTarget, LoweredIngress, } from "./ingress.js";
-import type { DnsTarget } from "./ingress.js";
+export type { CorsMode, CertificateDecl, DnsDecl, ProxyDecl, IngressDecl, DnsTarget, LoweredIngress, } from "./ingress.js";
+import { type CorsMode, type DnsTarget } from "./ingress.js";
 import type { InterceptHandler, InterceptNext, InterceptedRequest } from "./harness/intercept.js";
 export type { InterceptHandler, InterceptNext, InterceptedRequest };
 /**
@@ -744,6 +744,9 @@ export interface ServiceTls {
     /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
      * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
     http2?: boolean;
+    /** Preserve upstream CORS policy by default. "permissive" opts HTTP/1
+     * ingress into answering preflights and adding credentialed CORS headers. */
+    cors?: CorsMode;
 }
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
 export type NormalizedServiceImage = {
@@ -1458,6 +1461,9 @@ export interface FakeDefinition<S = any, H extends Record<string, unknown> = Rec
     hostnames: readonly string[];
     /** TCP port the fake listens on. Default `80`. */
     port?: number;
+    /** Preserve handler/interceptor CORS policy by default. "permissive"
+     * answers preflights and adds credentialed CORS headers at ingress. */
+    cors?: CorsMode;
     /**
      * Build the fake's initial state. Called once when the project loads.
      * The returned value lives in daemon memory for the rest of the

package/dist/index.js

@@ -49,6 +49,7 @@ export { ca } from "./environment-ca.js";
 // `tls` / `hostnames` fields and `defineFake(...)` are built on. See
 // `ingress.ts`.
 export { certificate, dnsName, proxy, provides, lowerIngress, isWildcard, SELF_SERVICE_TOKEN, } from "./ingress.js";
+import { validateCorsMode } from "./ingress.js";
 import { isWildcard as isWildcardHost } from "./ingress.js";
 // ──────────────────────────────────────────────────────────────────────────
 // Service groups — one services-map entry that expands to several services.
@@ -363,6 +364,7 @@ function validateEnvironmentConfig(config) {
             }
             if (entry.http2 !== undefined && typeof entry.http2 !== "boolean")
                 throw new Error(`service "${name}" tls http2 must be a boolean`);
+            validateCorsMode(entry.cors);
             const h = entry.hostname.toLowerCase();
             if (!HOSTNAME_RE.test(hostPatternBody(h))) {
                 throw new Error(`service "${name}" tls hostname ${JSON.stringify(entry.hostname)} is not a multi-label DNS name or wildcard (e.g. "app.test", "*.us-east-1.amazonaws.com")`);
@@ -408,6 +410,7 @@ export function defineFake(opts) {
             throw new Error(`defineFake(${opts.name}): hostname ${JSON.stringify(h)} ends in reserved ".internal" TLD`);
         }
     }
+    validateCorsMode(opts.cors);
     if (typeof opts.handler !== "function") {
         throw new Error(`defineFake(${opts.name}): \`handler\` is required`);
     }

package/dist/ingress.d.ts

@@ -7,6 +7,11 @@ export type DnsTarget = {
 } | {
     service: string;
 };
+/** Passthrough preserves application CORS policy (the default). Permissive
+ * answers preflights and adds credentialed CORS headers at HTTP/1 ingress. */
+export type CorsMode = "passthrough" | "permissive";
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export declare function validateCorsMode(cors: unknown): void;
 export interface CertificateDecl {
     kind: "certificate";
     /** Hostnames the leaf cert's SANs cover. One cert is minted per decl. */
@@ -24,6 +29,7 @@ export interface ProxyDecl {
         service: string;
         port: number;
         http2?: boolean;
+        cors?: CorsMode;
     };
 }
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -71,6 +77,7 @@ export declare function proxy(hostname: string, upstream: {
     service: string;
     port: number;
     http2?: boolean;
+    cors?: CorsMode;
 }): ProxyDecl;
 /**
  * Attach low-level ingress decls to a service definition a component
@@ -100,6 +107,7 @@ export interface LoweredIngress {
         service: string;
         port: number;
         http2?: boolean;
+        cors?: CorsMode;
     }[];
     /** Hostnames that resolve to the daemon ingress gateway (DNS registry
      *  + `--add-host` on every container). Covers fakes, TLS proxies, and

package/dist/ingress.js

@@ -17,6 +17,12 @@
 // deserialises: the decls live on the `Project` (daemon-side only) and,
 // when attached to a service, ride on a Symbol key that `JSON.stringify`
 // drops — so Rust's `deny_unknown_fields` never sees them.
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export function validateCorsMode(cors) {
+    if (cors !== undefined && cors !== "passthrough" && cors !== "permissive") {
+        throw new Error('cors must be "passthrough" or "permissive"');
+    }
+}
 /** Token a component can use in a decl where it can't know its own
  *  services-map key yet — resolved to that key during `lowerIngress`.
  *  Mirrors the `{{SPECTEST_SERVICE}}` token honoured in `files`. */
@@ -101,6 +107,7 @@ export function proxy(hostname, upstream) {
     }
     if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean")
         throw new Error("proxy(): http2 must be a boolean");
+    validateCorsMode(upstream.cors);
     return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 /** Symbol key under which `provides(...)` stashes a component's ingress
@@ -165,7 +172,7 @@ export function lowerIngress(project) {
                 break;
             case "proxy": {
                 const service = resolveSelf(decl.upstream.service, selfKey);
-                proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
+                proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}), ...(decl.upstream.cors ? { cors: decl.upstream.cors } : {}) });
                 // A proxied hostname must route to the daemon. A wildcard one can
                 // only be answered by the resolver (there is no `--add-host` for a
                 // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -204,7 +211,7 @@ export function lowerIngress(project) {
         // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
         for (const entry of svc.tls ?? []) {
             applyDecl(certificate([entry.hostname]), name);
-            applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
+            applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}), ...(entry.cors ? { cors: entry.cors } : {}) }), name);
         }
         // `hostnames: [h]` → plain peer alias (no daemon hop).
         for (const h of svc.hostnames ?? []) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.97.0",
+  "version": "0.99.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",
@@ -16,11 +16,6 @@
       "bun": "./src/components/index.ts",
       "default": "./dist/components/index.js"
     },
-    "./components/gcp": {
-      "types": "./dist/components/gcp.d.ts",
-      "bun": "./src/components/gcp.ts",
-      "default": "./dist/components/gcp.js"
-    },
     "./coverage": {
       "types": "./dist/coverage.d.ts",
       "bun": "./src/coverage.ts",

package/src/components/index.ts

@@ -1,6 +1,4 @@
 // Reusable, pre-built service definitions for common dependencies.
-export { pubsub, pubsubClient, type PubSubOptions, type PubSubOidcToken, type PubSubPushConfig, type PubSubDeadLetterPolicy, type PubSubRetryPolicy, type PubSubClient, type PubSubHelpers,
-  type PubSubSubscriptionOptions, type PubSubMessage, type PubSubReceivedMessage } from "./pubsub.js";
 export { temporal, temporalClient, type TemporalOptions, type TemporalClient,
   type TemporalNamespace, type TemporalWorkerOptions, type TemporalPoller,
   type TemporalSearchAttributeType, type TemporalTaskType } from "./temporal.js";

package/src/components/supabase.ts

@@ -58,11 +58,13 @@ import { dirname, join } from "node:path";
 
 import {
   serviceGroup,
+  type CorsMode,
   type ServiceDefinition,
   type ServiceGroup,
   type ServiceSetupContext,
   type ServicesMap,
 } from "../index.js";
+import { validateCorsMode } from "../ingress.js";
 import { SQL, type SqlClient } from "../sql.js";
 import { apple } from "./apple.js";
 import type { OAuthClient } from "./emulate/service.js";
@@ -280,6 +282,10 @@ export interface SupabaseOptions {
    * test hardcodes a Supabase URL it cannot be told to override.
    */
   hostname?: string;
+  /** CORS handling at the daemon ingress for `hostname`. Defaults to
+   * "passthrough", preserving gateway/interceptor policy. "permissive"
+   * restores automatic preflight replies and credentialed CORS headers. */
+  cors?: CorsMode;
 
   /**
    * Capture GoTrue's outgoing mail (signup confirmations, magic links, OTPs,
@@ -1640,6 +1646,7 @@ async function applyMigrations(
  * for hitting the REST/auth/storage APIs through the gateway.
  */
 export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
+  validateCorsMode(opts.cors);
   const name = opts.name ?? "supabase";
   const dbPassword = opts.dbPassword ?? "postgres";
   const jwtSecret = opts.jwtSecret ?? DEFAULT_JWT_SECRET;
@@ -2366,7 +2373,7 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
           },
         ],
         ports: [8000, 8443],
-        ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000 }] } : {}),
+        ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000, ...(opts.cors ? { cors: opts.cors } : {}) }] } : {}),
         readyCheck: { type: "exec", command: "kong health", timeoutSecs: 90 },
       };
 

package/src/daemon.ts

@@ -41,7 +41,7 @@ import {
   normalizeServiceImage,
   proxy as makeProxyDecl,
 } from "./index.js";
-import type { DnsTarget, LoweredIngress } from "./index.js";
+import type { CorsMode, DnsTarget, LoweredIngress } from "./index.js";
 import {
   COVERAGE_CONTAINER_DIR,
   coverageBundleRef,
@@ -127,9 +127,7 @@ import {
 } from "./harness/intercept.js";
 import {
   HOP_BY_HOP_HEADERS,
-  augmentCorsResponse,
-  corsPreflightResponse,
-  isCorsPreflight,
+  withIngressCors,
   upstreamRequestHeaders,
 } from "./harness/http-proxy.js";
 import {
@@ -2146,7 +2144,7 @@ async function startIngress(): Promise<void> {
   if (LOWERED.proxies.length > 0) {
     const routes = ensurePort(INGRESS_HTTP_PORT);
     for (const p of LOWERED.proxies) {
-      routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+      routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
     }
   }
   // The :443 route table mirrors every handler whose hostname a cert
@@ -2162,7 +2160,7 @@ async function startIngress(): Promise<void> {
     }
     for (const p of LOWERED.proxies) {
       if (certCovers(p.hostname)) {
-        httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+        httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
       }
     }
   }
@@ -2319,10 +2317,10 @@ function certCovers(hostname: string): boolean {
  * per-test snapshot exactly like fake state — a `dependsOn` child inherits
  * it, siblings forked from an earlier snapshot never see it.
  */
-async function bindRuntimeTls(hostname: string, service: string, port: number, http2?: boolean): Promise<void> {
+async function bindRuntimeTls(hostname: string, service: string, port: number, http2?: boolean, cors?: CorsMode): Promise<void> {
   // Reuse the boot primitives for validation + lowercasing; throws on a
   // malformed hostname / upstream just like a boot `tls` would at load.
-  const decl = makeProxyDecl(hostname, { service, port, http2 });
+  const decl = makeProxyDecl(hostname, { service, port, http2, cors });
   const host = decl.hostname;
   if (!existsSync(CA_PATH) || !existsSync(CA_KEY_PATH)) {
     throw new Error(
@@ -2330,7 +2328,7 @@ async function bindRuntimeTls(hostname: string, service: string, port: number, h
     );
   }
   const Bun = requireBun();
-  const route: Route = { kind: "proxy", service, port, http2 };
+  const route: Route = { kind: "proxy", service, port, http2, cors };
 
   // Decide the cost before mutating anything: an already-covered hostname
   // (an exact duplicate, or one under a boot wildcard) needs only a route.
@@ -2500,11 +2498,6 @@ async function dispatchIngress(
       { status: 404, headers: { "content-type": "text/plain" } },
     );
   }
-  // Answer CORS preflights at the ingress (see corsPreflightResponse) so a
-  // cross-origin browser request carrying any header — Authorization,
-  // Cache-Control, Pragma, … — isn't rejected by whatever the upstream happens
-  // to list in Access-Control-Allow-Headers.
-  if (isCorsPreflight(req)) return corsPreflightResponse(req);
   // The real answer — a fake handled in-process, or the proxied container.
   const upstream = async (current: Request): Promise<Response> => {
     if (route.kind === "fake") {
@@ -2522,16 +2515,15 @@ async function dispatchIngress(
     }
     return proxyToService(current, server, route.service, route.port, listenerLabel, proto);
   };
-  // `ctx.intercept` middleware runs first, in registration order, and reaches
-  // the upstream through `next()`. The CORS headers go on *after* the chain,
-  // so a forced 500 reaches the browser as a 500 and not as a CORS error —
-  // the trap `page.route`-style interception falls into.
-  const chain = INTERCEPTORS.chainFor(host, new URL(req.url).pathname);
-  const res =
-    chain.length === 0
-      ? await upstream(req)
-      : await runChain(chain, req, upstream, recordInterceptedRequest);
-  return augmentCorsResponse(req, res);
+  // Passthrough (the default) lets middleware and the upstream handle every
+  // request and preserves their CORS policy, including absent headers.
+  const cors = route.kind === "fake" ? route.fake.def.cors : route.cors;
+  return withIngressCors(req, cors, async (current) => {
+    const chain = INTERCEPTORS.chainFor(host, new URL(current.url).pathname);
+    return chain.length === 0
+      ? upstream(current)
+      : runChain(chain, current, upstream, recordInterceptedRequest);
+  });
 }
 
 /**
@@ -3152,7 +3144,7 @@ async function startRuntimeService(spec: RuntimeServiceSpec): Promise<RuntimeSer
     // `tls` is the runtime twin of a boot service's: stand up a
     // TLS-terminating reverse proxy at https://<hostname>/ → this container.
     for (const entry of svc.tls ?? []) {
-      await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2);
+      await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2, entry.cors);
     }
     RUNTIME_SERVICES.set(svc.name, svc);
     recordEnv({