refactor(stack): make functions configuration explicit

apps/cli/src/next/commands/functions/dev/functions-dev-config.ts

@@ -1,6 +1,13 @@
-import { basename, dirname, resolve } from "node:path";
-import type { FunctionsConfig } from "@supabase/stack/effect";
-import { Effect, Option } from "effect";
+import {
+  inferFunctionsManifest,
+  loadDotEnvFile,
+  loadProjectConfig,
+  loadProjectEnvironment,
+  resolveProjectSubtree,
+} from "@supabase/config";
+import type { ResolvedFunctionsBundle } from "@supabase/stack/effect";
+import { Effect, Option, Redacted } from "effect";
+import { basename, dirname, join, resolve } from "node:path";
 import { ProjectHome } from "../../../config/project-home.service.ts";
 import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
 
@@ -14,16 +21,80 @@ export interface FunctionsDevWatchPath {
   readonly names?: ReadonlyArray<string>;
 }
 
-export function toStackFunctionsConfig(opts: FunctionsDevConfigOptions): FunctionsConfig {
-  return {
-    envFile: Option.match(opts.envFile, {
-      onNone: () => undefined,
-      onSome: (path) => path,
-    }),
-    noVerifyJwt: opts.noVerifyJwt,
-  };
+function reveal(value: string | Redacted.Redacted<string>): string {
+  return Redacted.isRedacted(value) ? Redacted.value(value) : value;
+}
+
+function absoluteProjectPath(supabaseDir: string, path: string): string {
+  const withoutDotSlash = path.startsWith("./") ? path.slice(2) : path;
+  return resolve(supabaseDir, withoutDotSlash);
 }
 
+export const resolveFunctionsBundle = Effect.fnUntraced(function* (
+  opts: FunctionsDevConfigOptions,
+) {
+  const projectHome = yield* ProjectHome;
+  const runtimeInfo = yield* RuntimeInfo;
+  const projectEnvironment = yield* loadProjectEnvironment({
+    cwd: projectHome.projectRoot,
+    baseEnv: process.env,
+  });
+  const loadedConfig = yield* loadProjectConfig(projectHome.projectRoot);
+  const projectConfig =
+    projectEnvironment === null || loadedConfig === null
+      ? undefined
+      : {
+          ...loadedConfig.config,
+          functions: Object.fromEntries(
+            Object.entries(
+              yield* resolveProjectSubtree(
+                loadedConfig.config.functions,
+                projectEnvironment,
+                "functions",
+              ),
+            ).map(([name, config]) => [
+              name,
+              {
+                ...config,
+                entrypoint: reveal(config.entrypoint),
+                import_map: reveal(config.import_map),
+                static_files: config.static_files.map(reveal),
+                env: Object.fromEntries(
+                  Object.entries(config.env).map(([key, value]) => [key, reveal(value)]),
+                ),
+              },
+            ]),
+          ),
+        };
+  const manifest = yield* inferFunctionsManifest({
+    cwd: projectHome.projectRoot,
+    ...(projectConfig === undefined ? {} : { config: projectConfig }),
+  });
+  const envFilePath = Option.match(opts.envFile, {
+    onNone: () => join(projectHome.supabaseDir, "functions", ".env"),
+    onSome: (path) => resolve(runtimeInfo.cwd, path),
+  });
+
+  return {
+    env: yield* loadDotEnvFile(envFilePath),
+    functions: Object.entries(manifest)
+      .filter(([, config]) => config.enabled)
+      .map(([name, config]) => ({
+        name,
+        verifyJWT: opts.noVerifyJwt ? false : config.verify_jwt,
+        entrypointPath: absoluteProjectPath(projectHome.supabaseDir, config.entrypoint),
+        importMapPath:
+          config.import_map === ""
+            ? null
+            : absoluteProjectPath(projectHome.supabaseDir, config.import_map),
+        staticFiles: config.static_files.map((path) =>
+          absoluteProjectPath(projectHome.supabaseDir, path),
+        ),
+        env: config.env,
+      })),
+  } satisfies ResolvedFunctionsBundle;
+});
+
 export const functionsDevWatchPaths = Effect.fnUntraced(function* (envFile: Option.Option<string>) {
   const projectHome = yield* ProjectHome;
   const runtimeInfo = yield* RuntimeInfo;

apps/cli/src/next/commands/functions/dev/functions-dev-config.unit.test.ts

@@ -7,11 +7,7 @@ import { join } from "node:path";
 import { Effect, Exit, Layer, Option } from "effect";
 import { ProjectHome } from "../../../config/project-home.service.ts";
 import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts";
-import {
-  functionsDevWatchPaths,
-  toStackFunctionsConfig,
-  type FunctionsDevConfigOptions,
-} from "./functions-dev-config.ts";
+import { functionsDevWatchPaths, resolveFunctionsBundle } from "./functions-dev-config.ts";
 import {
   FunctionsDevEdgeRuntimeDisabledError,
   resolveFunctionsDevEdgeRuntimeConfig,
@@ -61,16 +57,60 @@ describe("functions dev config", () => {
     expect(connectOrStartFunctionsDevStack).toBeTypeOf("function");
   });
 
-  it("converts CLI options to stack Functions config", () => {
-    const opts: FunctionsDevConfigOptions = {
-      envFile: Option.some("./custom.env"),
-      noVerifyJwt: true,
-    };
+  it.live("resolves project functions, environment and absolute paths before stack handoff", () => {
+    const cwd = makeTempProject();
+
+    return Effect.gen(function* () {
+      yield* Effect.tryPromise(() =>
+        mkdir(join(cwd, "supabase", "functions", "hello", "assets"), { recursive: true }),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(cwd, "supabase", "functions", "hello", "index.ts"), "export {};\n"),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(cwd, "supabase", "functions", "hello", "deno.json"), "{}\n"),
+      );
+      yield* Effect.tryPromise(() =>
+        writeFile(join(cwd, "supabase", ".env"), "FUNCTION_VALUE=resolved-secret\n"),
+      );
+      yield* Effect.tryPromise(() => writeFile(join(cwd, "custom.env"), "SHARED=custom\n"));
+      yield* Effect.tryPromise(() =>
+        writeFile(
+          join(cwd, "supabase", "config.toml"),
+          `[functions.hello]
+verify_jwt = true
+entrypoint = "./functions/hello/index.ts"
+import_map = "./functions/hello/deno.json"
+static_files = ["./functions/hello/assets/*"]
+
+[functions.hello.env]
+FUNCTION_VALUE = "env(FUNCTION_VALUE)"
+`,
+        ),
+      );
 
-    expect(toStackFunctionsConfig(opts)).toEqual({
-      envFile: "./custom.env",
-      noVerifyJwt: true,
-    });
+      const bundle = yield* resolveFunctionsBundle({
+        envFile: Option.some("./custom.env"),
+        noVerifyJwt: true,
+      });
+
+      expect(bundle).toEqual({
+        env: { SHARED: "custom" },
+        functions: [
+          {
+            name: "hello",
+            verifyJWT: false,
+            entrypointPath: join(cwd, "supabase", "functions", "hello", "index.ts"),
+            importMapPath: join(cwd, "supabase", "functions", "hello", "deno.json"),
+            staticFiles: [join(cwd, "supabase", "functions", "hello", "assets", "*")],
+            env: { FUNCTION_VALUE: "resolved-secret" },
+          },
+        ],
+      });
+    }).pipe(
+      Effect.ensuring(Effect.tryPromise(() => rm(cwd, { recursive: true, force: true }))),
+      Effect.provide(projectLayer(cwd)),
+    );
   });
 
   it.live("selects supabase and explicit env directory watch paths", () => {

apps/cli/src/next/commands/functions/dev/functions-dev-runtime.ts

@@ -30,7 +30,7 @@ import { RuntimeInfo } from "../../../../shared/runtime/runtime-info.service.ts"
 import { startStackWithProgress } from "../../../stack/stack.shared.ts";
 import {
   functionsDevWatchPaths,
-  toStackFunctionsConfig,
+  resolveFunctionsBundle,
   type FunctionsDevConfigOptions,
   type FunctionsDevWatchPath,
 } from "./functions-dev-config.ts";
@@ -76,7 +76,6 @@ const startFullStack = Effect.fnUntraced(function* (opts: FunctionsDevStackOptio
       projectStateRoot: projectHome.projectHomeDir,
       name: opts.stack,
       edgeRuntime: opts.edgeRuntime,
-      functions: toStackFunctionsConfig(opts),
       ...versionsFromContext(serviceVersionContext),
     },
     daemonEntryPoint,
@@ -180,9 +179,9 @@ function reloadEdgeRuntime(
   opts: FunctionsDevRuntimeOptions,
   edgeRuntime: EdgeRuntimeConfig,
 ) {
-  return stack.reloadEdgeRuntime({
-    edgeRuntime,
-    functions: toStackFunctionsConfig(opts),
+  return Effect.gen(function* () {
+    const functions = yield* resolveFunctionsBundle(opts);
+    yield* stack.reloadEdgeRuntime({ edgeRuntime, functions });
   });
 }
 
@@ -226,49 +225,51 @@ export const runFunctionsDevRuntime = Effect.fnUntraced(function* (
     ...opts,
     edgeRuntime: edgeRuntimeState.config,
   });
-  yield* ensureFunctionsDirectory();
-  yield* reloadEdgeRuntime(stack, opts, edgeRuntimeState.config);
-  const info = yield* stack.getInfo();
-  const watchPathList = yield* functionsDevWatchPaths(opts.envFile);
-
-  yield* output.success("Edge Functions dev server is running.", {
-    functions_url: `${info.url}/functions/v1`,
-  });
-  yield* output.info(`Functions URL: ${info.url}/functions/v1/<function-name>`);
-
-  const restartOnChange = watchPaths(watchPathList).pipe(
-    Stream.runForEach((change) =>
-      Effect.gen(function* () {
-        const result = yield* applyWatchedChange(edgeRuntimeState, change);
-        if (result.action === "edge-runtime") {
-          yield* output.info("Edge runtime config changed. Restarting edge-runtime...");
-          yield* reloadEdgeRuntime(stack, opts, result.state.config);
+  const restoreFunctions = startedByCommand
+    ? undefined
+    : yield* resolveFunctionsBundle({ envFile: Option.none(), noVerifyJwt: false });
+
+  yield* Effect.gen(function* () {
+    yield* ensureFunctionsDirectory();
+    yield* reloadEdgeRuntime(stack, opts, edgeRuntimeState.config);
+    const info = yield* stack.getInfo();
+    const watchPathList = yield* functionsDevWatchPaths(opts.envFile);
+
+    yield* output.success("Edge Functions dev server is running.", {
+      functions_url: `${info.url}/functions/v1`,
+    });
+    yield* output.info(`Functions URL: ${info.url}/functions/v1/<function-name>`);
+
+    const restartOnChange = watchPaths(watchPathList).pipe(
+      Stream.runForEach((change) =>
+        Effect.gen(function* () {
+          const result = yield* applyWatchedChange(edgeRuntimeState, change);
+          if (result.action === "edge-runtime") {
+            yield* output.info("Edge runtime config changed. Restarting edge-runtime...");
+            yield* reloadEdgeRuntime(stack, opts, result.state.config);
+            edgeRuntimeState = result.state;
+            return;
+          }
           edgeRuntimeState = result.state;
-          return;
-        }
-        edgeRuntimeState = result.state;
-        yield* output.info("Function files changed. Restarting edge-runtime...");
-        yield* stack.reloadFunctions(toStackFunctionsConfig(opts));
-      }).pipe(
-        Effect.catch((error) =>
-          output.error(error instanceof Error ? error.message : String(error)),
+          yield* output.info("Function files changed. Restarting edge-runtime...");
+          yield* stack.reloadFunctions({ functions: yield* resolveFunctionsBundle(opts) });
+        }).pipe(
+          Effect.catch((error) =>
+            output.error(error instanceof Error ? error.message : String(error)),
+          ),
         ),
       ),
-    ),
-  );
+    );
 
-  const logs = logEntryStream(stack).pipe(Stream.runForEach((event) => output.event(event)));
-  const shutdown = processControl.awaitShutdown;
+    const logs = logEntryStream(stack).pipe(Stream.runForEach((event) => output.event(event)));
+    const shutdown = processControl.awaitShutdown;
 
-  yield* Effect.raceFirst(Effect.raceFirst(restartOnChange, logs), shutdown).pipe(
+    yield* Effect.raceFirst(Effect.raceFirst(restartOnChange, logs), shutdown);
+  }).pipe(
     Effect.ensuring(
-      Effect.gen(function* () {
-        if (startedByCommand) {
-          yield* stack.dispose().pipe(Effect.ignore);
-        } else {
-          yield* stack.reloadFunctions({}).pipe(Effect.ignore);
-        }
-      }),
+      startedByCommand
+        ? stack.dispose().pipe(Effect.ignore)
+        : stack.reloadFunctions({ functions: restoreFunctions }).pipe(Effect.ignore),
     ),
   );
 });

packages/config/src/index.ts

@@ -37,6 +37,7 @@ export {
   type ProjectEnvironment,
   type ResolvedProjectValue,
   type ResolveProjectOptions,
+  loadDotEnvFile,
   loadProjectEnvironment,
   resolveProjectSubtree,
   resolveProjectValue,

packages/config/src/project.ts

@@ -166,6 +166,15 @@ function parseDotEnv(
   });
 }
 
+/** Parse one explicit dotenv file without applying ambient or project-local precedence. */
+export const loadDotEnvFile = Effect.fnUntraced(function* (path: string) {
+  const fs = yield* FileSystem.FileSystem;
+  if (!(yield* fs.exists(path))) {
+    return {};
+  }
+  return yield* parseDotEnv(path, yield* fs.readFileString(path));
+});
+
 function applySource(
   target: Record<string, string>,
   sources: Record<string, "ambient" | ".env" | ".env.local">,

packages/stack/README.md

@@ -130,6 +130,40 @@ const stack = await createStack({
 });
 ```
 
+### Edge Functions
+
+The stack accepts an explicit, fully resolved Functions bundle. Paths must be absolute and the
+caller owns project-file discovery, environment-file parsing, and manifest interpretation:
+
+```typescript
+const projectDir = "/absolute/project";
+const stack = await createStack({
+  projectDir,
+  functions: {
+    env: { SHARED_VALUE: "available to every function" },
+    functions: [
+      {
+        name: "hello",
+        verifyJWT: true,
+        entrypointPath: "/absolute/project/supabase/functions/hello/index.ts",
+        importMapPath: null,
+        staticFiles: [],
+        env: { FUNCTION_VALUE: "available only to hello" },
+      },
+    ],
+  },
+});
+```
+
+Every referenced path must be contained by `projectDir` so the same bundle works when Edge Runtime
+runs in Docker and the project directory is bind-mounted into the container.
+
+Per-function environment values override shared values. Stack-owned runtime URLs and credentials
+take final precedence. To update the active bundle, call
+`reloadFunctions({ functions: nextBundle })`; `reloadFunctions()` preserves and reapplies the most
+recent bundle. `reloadEdgeRuntime()` follows the same preservation rule when its optional
+`functions` field is omitted.
+
 ## Docker Mode
 
 Set `mode: "docker"` to force all services to run in Docker containers, bypassing native binary resolution: