feat(cli): port supabase start command to native TypeScript

apps/cli/src/legacy/commands/config/push/config-sync/api.sync.ts

@@ -2,6 +2,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { encodeToml, type TomlField, type TomlValue } from "./config-sync.toml.ts";
+import { legacyStrToArr } from "../../../../shared/legacy-local-config-values.ts";
 import { intToUint } from "../../../../shared/legacy-size-units.ts";
 
 /**
@@ -56,11 +57,6 @@ export interface RemoteApiConfig {
   readonly max_rows: number;
 }
 
-/** Go `strToArr`: empty string → `[]`, else comma-split (no trimming here). */
-function strToArr(v: string): Array<string> {
-  return v.length === 0 ? [] : v.split(",");
-}
-
 /** Projects the loaded `config.api` into the push subset. */
 export function apiSubsetFromConfig(config: ProjectConfig): ApiSubset {
   const api = config.api;
@@ -94,8 +90,8 @@ function applyRemoteApiConfig(local: ApiSubset, remote: RemoteApiConfig): ApiSub
   return {
     ...local,
     enabled: true,
-    schemas: strToArr(remote.db_schema).map((s) => s.trim()),
-    extra_search_path: strToArr(remote.db_extra_search_path).map((s) => s.trim()),
+    schemas: legacyStrToArr(remote.db_schema).map((s) => s.trim()),
+    extra_search_path: legacyStrToArr(remote.db_extra_search_path).map((s) => s.trim()),
     max_rows: intToUint(remote.max_rows),
   };
 }

apps/cli/src/legacy/commands/config/push/config-sync/auth.sync.ts

@@ -13,6 +13,7 @@ import type { ProjectConfig } from "@supabase/config";
 
 import { diff } from "./config-sync.diff.ts";
 import { type TomlField, type TomlValue, encodeToml } from "./config-sync.toml.ts";
+import { legacyStrToArr } from "../../../../shared/legacy-local-config-values.ts";
 import { intToUint } from "../../../../shared/legacy-size-units.ts";
 import { durationString, parseDuration, secondsToDurationString } from "./config-sync.duration.ts";
 import type { AuthEmailContent } from "./config-sync.auth-email-content.ts";
@@ -838,11 +839,6 @@ const AUTH_FIELDS: ReadonlyArray<TomlField> = [
 // Helpers
 // ---------------------------------------------------------------------------
 
-/** Go `strToArr`: empty string → `[]`, else comma-split. */
-function strToArr(v: string): Array<string> {
-  return v.length === 0 ? [] : v.split(",");
-}
-
 /** Go `cast.IntToUint`: clamp negatives to 0. */
 function valOrDefault<T>(v: T | null | undefined, def: T): T {
   return v == null ? def : v;
@@ -1299,7 +1295,7 @@ export function applyRemoteAuthConfig(local: AuthSubset, remote: RemoteAuthConfi
 
   // Base scalar fields
   const siteUrl = valOrDefault(remote.site_url, "");
-  const additionalRedirectUrls = strToArr(valOrDefault(remote.uri_allow_list, ""));
+  const additionalRedirectUrls = legacyStrToArr(valOrDefault(remote.uri_allow_list, ""));
   const jwtExpiry = intToUint(valOrDefault(remote.jwt_exp, 0));
   const enableRefreshTokenRotation = valOrDefault(remote.refresh_token_rotation_enabled, false);
   const refreshTokenReuseInterval = intToUint(
@@ -1322,7 +1318,7 @@ export function applyRemoteAuthConfig(local: AuthSubset, remote: RemoteAuthConfi
     webauthn = {
       rp_display_name: valOrDefault(remote.webauthn_rp_display_name, ""),
       rp_id: valOrDefault(remote.webauthn_rp_id, ""),
-      rp_origins: strToArr(valOrDefault(remote.webauthn_rp_origins, "")),
+      rp_origins: legacyStrToArr(valOrDefault(remote.webauthn_rp_origins, "")),
     };
   }
 
@@ -1786,7 +1782,7 @@ export function applyRemoteAuthConfig(local: AuthSubset, remote: RemoteAuthConfi
 
 /** Port of Go `sms.fromAuthConfig` → `envToMap`. */
 function envToMap(input: string): Record<string, string> {
-  const env = strToArr(input);
+  const env = legacyStrToArr(input);
   const result: Record<string, string> = {};
   for (const kv of env) {
     const eqIdx = kv.indexOf("=");

apps/cli/src/legacy/commands/functions/serve/serve.integration.test.ts

@@ -637,6 +637,87 @@ describe("legacy functions serve integration", () => {
     });
   });
 
+  it.live(
+    "cleans up a stale multiline-env directory from a previous run even when this run has no multiline secrets",
+    () => {
+      deployMockState.runHandler = (command, args) => {
+        if (command !== "docker") {
+          throw new Error(`unexpected process: ${command}`);
+        }
+        if (args[0] === "container" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "container" && args[1] === "rm") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "run") {
+          return { exitCode: 0, stdout: "edge-runtime-id\n", stderr: "" };
+        }
+        if (args[0] === "exec") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        throw new Error(`unexpected docker args: ${args.join(" ")}`);
+      };
+
+      const childSpawner = mockDockerLogSpawner([
+        {
+          exitCode: 1,
+          stderr: "error running container: exit 1",
+        },
+      ]);
+
+      const staleMultilineEnvDir = join(
+        tempRoot.current,
+        "supabase",
+        ".temp",
+        "start-secrets",
+        "supabase_edge_runtime_test-project",
+        "multiline-env",
+      );
+
+      return Effect.gen(function* () {
+        yield* Effect.promise(() =>
+          writeProjectConfig(['project_id = "test-project"', ""].join("\n")),
+        );
+        yield* Effect.promise(() =>
+          writeFunctionFile("hello", "index.ts", 'Deno.serve(() => new Response("hello"))\n'),
+        );
+        yield* Effect.promise(() =>
+          writeProjectFile(join("supabase", "functions", ".env"), ["HELLO=WORLD", ""].join("\n")),
+        );
+        // Simulate a stale directory left behind by an earlier run that DID have multiline secrets.
+        yield* Effect.promise(async () => {
+          await mkdir(join(staleMultilineEnvDir, "values"), { recursive: true, mode: 0o700 });
+          await writeFile(join(staleMultilineEnvDir, "multiline-env.sh"), "stale script\n");
+          await writeFile(join(staleMultilineEnvDir, "values", "env-0"), "stale secret\n");
+        });
+
+        const { layer } = setupServe({ childSpawner });
+
+        const error = yield* legacyFunctionsServe(baseFlags()).pipe(
+          Effect.provide(layer),
+          Effect.flip,
+        );
+        expect(error).toBeInstanceOf(Error);
+
+        expect(existsSync(staleMultilineEnvDir)).toBe(false);
+
+        const dockerRun = deployMockState.runCalls.find(
+          (call) => call.command === "docker" && call.args[0] === "run",
+        );
+        expect(dockerRun).toBeDefined();
+        if (dockerRun === undefined) {
+          throw new Error("expected docker run call");
+        }
+        expect(
+          extractFlagValues(dockerRun.args, "-v").some((value) =>
+            value.endsWith(":/root/.supabase/multiline-env:ro"),
+          ),
+        ).toBe(false);
+      });
+    },
+  );
+
   it.live("fails before startup when a multiline env name is not a shell identifier", () => {
     return Effect.gen(function* () {
       yield* Effect.promise(() =>
@@ -1024,6 +1105,19 @@ describe("legacy functions serve integration", () => {
         ),
       ).toHaveLength(2);
       expect(out.stderrText).toContain("File change detected:");
+
+      // `functions serve`'s restart wrapper (`startEdgeRuntime`, Go's
+      // `restartEdgeRuntime`) reloads Kong after each successful bring-up —
+      // once for the initial start, once for the file-change-triggered restart.
+      expect(
+        deployMockState.runCalls.filter(
+          (call) =>
+            call.command === "docker" &&
+            call.args[0] === "exec" &&
+            call.args.includes("supabase_kong_test-project") &&
+            call.args.includes("reload"),
+        ),
+      ).toHaveLength(2);
     });
   });
 
@@ -1518,6 +1612,98 @@ describe("legacy functions serve integration", () => {
     },
   );
 
+  it.live(
+    "does not fail startup on a malformed third-party provider config when auth is disabled",
+    () => {
+      // Go's `Auth.ThirdParty.validate()` (the "required field" check) only runs inside
+      // `Config.Validate`'s `if Auth.Enabled` block — `functions serve`'s own JWKS resolution
+      // discards `ResolveJWKS`'s error unconditionally, regardless of `auth.enabled`. So a
+      // workos provider enabled without an `issuer_url` must not block startup here.
+      deployMockState.runHandler = (command, args) => {
+        if (command !== "docker") {
+          throw new Error(`unexpected process: ${command}`);
+        }
+        if (args[0] === "container" && args[1] === "inspect") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "container" && args[1] === "rm") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        if (args[0] === "run") {
+          return { exitCode: 0, stdout: "edge-runtime-id\n", stderr: "" };
+        }
+        if (args[0] === "exec") {
+          return { exitCode: 0, stdout: "", stderr: "" };
+        }
+        throw new Error(`unexpected docker args: ${args.join(" ")}`);
+      };
+
+      const childSpawner = mockDockerLogSpawner([{ exitCode: 1, stderr: "jwks logs failed" }]);
+
+      return Effect.gen(function* () {
+        const fetchMock = vi.spyOn(globalThis, "fetch");
+
+        yield* Effect.addFinalizer(() =>
+          Effect.sync(() => {
+            fetchMock.mockRestore();
+          }),
+        );
+
+        yield* Effect.promise(() =>
+          writeProjectConfig(
+            [
+              'project_id = "test-project"',
+              "",
+              "[auth]",
+              "enabled = false",
+              "",
+              "[auth.third_party.workos]",
+              "enabled = true",
+              "",
+            ].join("\n"),
+          ),
+        );
+        yield* Effect.promise(() =>
+          writeFunctionFile("hello", "index.ts", 'Deno.serve(() => new Response("hello"))\n'),
+        );
+        yield* Effect.promise(() => writeFunctionFile("hello", "deno.json", '{"imports":{}}\n'));
+
+        const { layer } = setupServe({ childSpawner });
+        const error = yield* legacyFunctionsServe(baseFlags()).pipe(
+          Effect.provide(layer),
+          Effect.flip,
+        );
+
+        expect(error).toBeInstanceOf(Error);
+        if (error instanceof Error) {
+          expect(error.message).toContain("jwks logs failed");
+        }
+        expect(fetchMock).not.toHaveBeenCalled();
+
+        const dockerRun = deployMockState.runCalls.find(
+          (call) => call.command === "docker" && call.args[0] === "run",
+        );
+        expect(dockerRun).toBeDefined();
+        if (dockerRun === undefined) {
+          throw new Error("expected docker run call");
+        }
+
+        const envs = yield* Effect.promise(() => extractDockerEnvEntries(dockerRun));
+        const jwks = envs.find((entry) => entry.startsWith("SUPABASE_JWKS="));
+        expect(jwks).toBeDefined();
+        if (jwks === undefined) {
+          throw new Error("missing SUPABASE_JWKS");
+        }
+        expect(JSON.parse(jwks.slice("SUPABASE_JWKS=".length))).toEqual({
+          keys: expect.arrayContaining([
+            expect.objectContaining({ kid: "b81269f1-21d8-4f2e-b719-c2240a840d90" }),
+            expect.objectContaining({ kty: "oct" }),
+          ]),
+        });
+      });
+    },
+  );
+
   it.live("includes config-defined edge runtime secrets in the runtime env", () => {
     deployMockState.runHandler = (command, args) => {
       if (command !== "docker") {

apps/cli/src/legacy/commands/services/services.handler.ts

@@ -10,7 +10,7 @@ import { LegacyTelemetryState } from "../../telemetry/legacy-telemetry-state.ser
 import { legacyReadDbToml } from "../../shared/legacy-db-config.toml-read.ts";
 import { legacyResolveDbImage } from "../../shared/legacy-db-image.ts";
 import { legacyResolveEdgeRuntimeImage } from "../../shared/legacy-edge-runtime-image.ts";
-import { legacyTempPaths } from "../../shared/legacy-temp-paths.ts";
+import { readLegacyServiceVersionOverrides } from "../../shared/legacy-service-version-overrides.ts";
 import { LegacyOutputFlag } from "../../../shared/legacy/global-flags.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { encodeGoJson, encodeToml, encodeYaml } from "../../shared/legacy-go-output.encoders.ts";
@@ -20,8 +20,6 @@ import {
   formatServicesWarning,
   listLocalServiceVersions,
   type LocalServiceImageOverrides,
-  type LocalServiceVersionName,
-  type LocalServiceVersionOverrides,
   mergeRemoteServiceVersions,
   renderServicesTable,
   renderServicesWarning,
@@ -185,42 +183,3 @@ export const legacyServices = Effect.fn("legacy.services")(function* (_flags: Le
 function formatConfigLoadError(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
-
-const LEGACY_VERSION_FILES = [
-  ["auth", "gotrue-version", (majorVersion: number | undefined) => (majorVersion ?? 17) > 14],
-  ["postgrest", "rest-version", (majorVersion: number | undefined) => (majorVersion ?? 17) > 14],
-  ["storage", "storage-version"],
-  ["realtime", "realtime-version"],
-  ["studio", "studio-version"],
-  ["pgmeta", "pgmeta-version"],
-  ["analytics", "logflare-version"],
-  ["pooler", "pooler-version"],
-] as const satisfies ReadonlyArray<
-  readonly [LocalServiceVersionName, string, ((majorVersion: number | undefined) => boolean)?]
->;
-
-const readLegacyServiceVersionOverrides = Effect.fnUntraced(function* (
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-  workdir: string,
-  majorVersion: number | undefined,
-) {
-  const paths = legacyTempPaths(path, workdir);
-  const versions: LocalServiceVersionOverrides = {};
-
-  for (const [service, fileName, shouldRead] of LEGACY_VERSION_FILES) {
-    if (shouldRead !== undefined && !shouldRead(majorVersion)) {
-      continue;
-    }
-
-    const version = yield* fs.readFileString(path.join(paths.tempDir, fileName)).pipe(
-      Effect.map((content) => content.trim()),
-      Effect.orElseSucceed(() => ""),
-    );
-    if (version.length > 0) {
-      versions[service] = version;
-    }
-  }
-
-  return versions;
-});