feat(stack): replace the experimental runtime and integrate CLI commands

.github/scripts/sync-workload-catalog.test.ts

@@ -16,32 +16,28 @@ const realCatalog = await Bun.file(CATALOG_PATH).text();
 
 /** A trimmed catalog carrying both entry shapes the script has to rewrite. */
 const fixture = `const workloadCatalog = {
-  "database:database": native(
+  "database:database": definition(
     "postgres",
     "17.6.1.168",
     "ghcr.io/supabase/cli/postgres:17.6.1.168@sha256:${"9".repeat(64)}",
     "bin/supabase-postgres-start",
     ["bin/supabase-postgres-start"],
     {
-      additionalReleases: {
         "15.14.1.168":
           "ghcr.io/supabase/cli/postgres:15.14.1.168@sha256:${"f".repeat(64)}",
-      },
-      containerAlias: "supabase-database",
     },
   ),
-  "rest:rest": native(
+  "rest:rest": definition(
     "postgrest",
     "v16.2",
     "ghcr.io/supabase/cli/postgrest:v16.2",
     "bin/postgrest",
     ["bin/postgrest"],
-    { containerAlias: "supabase-rest" },
   ),
-  "auth:auth": native("auth", "v2.196.0", "ghcr.io/supabase/cli/auth:v2.196.0", "bin/auth", [
+  "auth:auth": definition("auth", "v2.196.0", "ghcr.io/supabase/cli/auth:v2.196.0", "bin/auth", [
     "bin/auth",
   ]),
-  "studio:studio": native(
+  "studio:studio": definition(
     "studio",
     "2026.09.04-sha-5a67366",
     "ghcr.io/supabase/cli/studio:2026.09.04-sha-5a67366@sha256:${"c".repeat(64)}",
@@ -101,7 +97,7 @@ describe("planCatalogUpdate", () => {
     expect(plan.previousVersion).toBe("v2.196.0");
     expect(plan.target).toBe("default");
     expect(plan.source).toContain(
-      `native("auth", "v2.197.0", "ghcr.io/supabase/cli/auth:v2.197.0@${DIGEST_A}", "bin/auth"`,
+      `definition("auth", "v2.197.0", "ghcr.io/supabase/cli/auth:v2.197.0@${DIGEST_A}", "bin/auth"`,
     );
     expect(plan.source).not.toContain("v2.196.0");
   });
@@ -259,7 +255,7 @@ describe("against the real catalog", () => {
     // Derived from the catalog, so a new workload is covered without editing this.
     const services = [
       ...new Set(
-        [...realCatalog.matchAll(/native\(\s*"([a-z][a-z0-9-]*)",/g)].map(
+        [...realCatalog.matchAll(/definition\(\s*"([a-z][a-z0-9-]*)",/g)].map(
           (match) => match[1] ?? "",
         ),
       ),

.github/scripts/sync-workload-catalog.ts

@@ -1,5 +1,5 @@
 /**
- * Pins one workload in `packages/stack/src/model/WorkloadCatalog.ts` to a
+ * Pins one workload in `packages/stack/src/Artifacts.ts` to a
  * slim-services release, driven by the same `mirror-slim-image` dispatch as the
  * ECR mirror (`mirror-slim-image.yml`).
  *
@@ -13,7 +13,7 @@
  * service or release line is a successful no-op.
  */
 
-export const CATALOG_PATH = "packages/stack/src/model/WorkloadCatalog.ts";
+export const CATALOG_PATH = "packages/stack/src/Artifacts.ts";
 
 /** Mirrors the payload validation in `mirror-slim-image.yml`. */
 const SERVICE_PATTERN = /^[a-z][a-z0-9-]*$/;
@@ -70,15 +70,15 @@ export function validatePayload(input: {
   }
 }
 
-/** `native("<service>", "<version>", "<image>"` — image anchored so postgres != postgrest. */
+/** `definition("<service>", "<version>", "<image>"` — image anchored so postgres != postgrest. */
 function defaultEntryPattern(service: string): RegExp {
   const s = escapeRegExp(service);
   return new RegExp(
-    `(native\\(\\s*"${s}",\\s*")([^"]+)("\\s*,\\s*")(${escapeRegExp(SLIM_IMAGE_PREFIX)}${s}:[^"]+)(")`,
+    `(definition\\(\\s*"${s}",\\s*")([^"]+)("\\s*,\\s*")(${escapeRegExp(SLIM_IMAGE_PREFIX)}${s}:[^"]+)(")`,
   );
 }
 
-/** `additionalReleases` entries: `"<version>": "<image>"`. The `:` is what distinguishes them. */
+/** Additional release entries: `"<version>": "<image>"`. The `:` is what distinguishes them. */
 function additionalEntryPattern(service: string, version?: string): RegExp {
   const s = escapeRegExp(service);
   const key = version === undefined ? `[^"]+` : escapeRegExp(version);

.github/workflows/github-scripts-ci.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - ".github/scripts/**"
+      - "packages/stack/src/Artifacts.ts"
       - ".github/workflows/ai-review.yml"
       - ".github/workflows/github-scripts-ci.yml"
 

.github/workflows/sync-stack-workload-catalog.yml

@@ -1,6 +1,6 @@
 name: Sync Stack Workload Catalog
 
-# Pins `packages/stack/src/model/WorkloadCatalog.ts` to slim-services releases,
+# Pins `packages/stack/src/Artifacts.ts` to slim-services releases,
 # off the same `mirror-slim-image` dispatch that drives the ECR mirror.
 # Dependabot owns the Dockerfile and cannot own this table: these pins carry
 # image digests, which tag resolution never produces (ADR 0017).
@@ -69,24 +69,31 @@ jobs:
       - name: Check for catalog changes
         id: check
         run: |
-          if git diff --exit-code --quiet packages/stack/src/model/WorkloadCatalog.ts; then
+          if git diff --exit-code --quiet packages/stack/src/Artifacts.ts; then
             echo "Workload catalog is already in sync."
             echo "has_changes=false" >> "$GITHUB_OUTPUT"
           else
             echo "Workload catalog updated."
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
-      # Prove the rewritten pin compiles and passes the catalog's own tests.
+      # Prove the rewritten pin compiles and the affected catalog surfaces pass.
       - name: Type-check stack
         if: steps.check.outputs.has_changes == 'true'
         run: pnpm types:check
         working-directory: packages/stack
 
       - name: Test catalog
         if: steps.check.outputs.has_changes == 'true'
-        run: pnpm run test:unit && pnpm run test:integration
-        working-directory: packages/stack
+        run: pnpm run test:github-scripts
+
+      - name: Test affected stack preparation
+        if: steps.check.outputs.has_changes == 'true'
+        run: >-
+          pnpm --filter @supabase/stack test:integration:run
+          src/preparation/artifacts.integration.test.ts
+          src/preparation/slim-services.integration.test.ts
+          --passWithNoTests=false
 
       - name: Generate token
         if: steps.check.outputs.has_changes == 'true'
@@ -106,7 +113,7 @@ jobs:
           commit-message: "chore(stack): pin ${{ github.event.client_payload.service || inputs.service }} to ${{ github.event.client_payload.version || inputs.version }}"
           title: "chore(stack): pin ${{ github.event.client_payload.service || inputs.service }} to ${{ github.event.client_payload.version || inputs.version }}"
           body: |
-            Pins `packages/stack/src/model/WorkloadCatalog.ts` to the
+            Pins `packages/stack/src/Artifacts.ts` to the
             `${{ github.event.client_payload.service || inputs.service }}` `${{ github.event.client_payload.version || inputs.version }}`
             slim-services release and its image digest.
 

.github/workflows/test.yml

@@ -148,12 +148,14 @@ jobs:
         working-directory: packages/stack
         run: >-
           pnpm test:integration
-          src/state/ports.integration.test.ts
-          src/state/registry-lease.integration.test.ts
-          src/state/state-store.integration.test.ts
-          src/supervisor/host-listener.integration.test.ts
-          src/supervisor/ingress.integration.test.ts
-          src/gateway/startup-transports.integration.test.ts
+          src/Ports.integration.test.ts
+          src/State.integration.test.ts
+          src/State.process.integration.test.ts
+          src/HostProcess.integration.test.ts
+          src/Network.integration.test.ts
+          src/Proxy.integration.test.ts
+          src/HttpProxy.integration.test.ts
+          --passWithNoTests=false
 
   test-summary:
     if: |
@@ -238,7 +240,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runtime: [native, container]
+        runtime: [native, docker]
     steps:
       - name: Checkout
         uses: useblacksmith/checkout@6fd481652155169ed4d2f25ebaf97464f685175f # v1.0.0-beta
@@ -249,9 +251,17 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Run stack end-to-end tests
-        run: pnpm --filter @supabase/stack test:e2e:run
-        env:
-          SUPABASE_STACK_E2E_RUNTIME: ${{ matrix.runtime }}
+        run: >-
+          pnpm --filter @supabase/stack test:e2e:run
+          src/whole-stack.${{ matrix.runtime }}.e2e.test.ts
+          --passWithNoTests=false
+
+      - name: Run public stack end-to-end tests
+        if: matrix.runtime == 'native'
+        run: >-
+          pnpm --filter @supabase/stack test:e2e:run
+          src/public.e2e.test.ts
+          --passWithNoTests=false
 
   # Summary job that gates branch protection. It preserves the original check
   # name and succeeds iff every CLI shard and stack runtime succeeded.