fix(cli): serve edge functions offline by bundling the runtime template

[jgoux]

What

Makes supabase functions serve start fully offline. The edge-runtime bootstrap template (apps/cli/src/shared/functions/serve.main.ts) imported three modules that Deno resolved over the network on every container start:

• https://deno.land/std/http/status.ts
• https://deno.land/std/path/posix/mod.ts
• jsr:@panva/jose@6

With no network these fail to resolve and the worker never boots — the offline failure reported in supabase/supabase#45570.

How

The two deno.land/std imports are trivially eliminable; jose is the only real dependency. So:

• Inline the std deps — STATUS_CODE/STATUS_TEXT and posix join/dirname/toFileUrl move into a new, normally-typed, unit-tested serve-main-deps.ts (the template imports it relatively).
• Bundle jose locally — a new serve-main-bundler.ts uses esbuild (platform: browser → jose's Web Crypto build) to bundle serve.main.ts into a single self-contained ES module with jose and the helpers inlined. Deno/EdgeRuntime stay as free globals.
• Delivery is unchanged in shape — compiled binaries embed the pre-bundled template via the existing SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE define (now produced by the bundler in build.ts and the new build-binary.ts used by build:next/build:legacy). Running from source bundles on demand via a lazy import, so esbuild is never loaded by shipped binaries. The container launch path (heredoc → /root/index.ts, edge-runtime start --main-service=/root) is untouched — only the template contents differ.

Why this approach (and not a pre-bundled eszip)

The edge-functions team suggested shipping the template as a pre-bundled eszip (as hosted ef-ingress does). That works, but for the CLI it couples the eszip to a single edge-runtime version while users can override edge_runtime.image / supabase/.temp/edge-runtime-version, and it adds a Docker bundling step to every release. Local bundling avoids both: no version coupling, no release-pipeline change, and the template stays readable source. jose is explicitly cross-runtime (Web Crypto), confirmed running under edge-runtime:v1.74.1's Deno.

Scope

• Only the legacy TS native serve is affected — functions serve is ported, so the Go template is not on the released path, and the next/packages/stack local-dev path already has a remote-import-free bootstrap.
• This fixes the runtime bootstrap. User functions with their own remote imports still fetch on first run (Deno-cached after); the edge-runtime image itself must also be pulled online once.

Closes supabase/supabase#45570

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@383b5bcaf7f8d3b2746c7f19f0806ee18c609fbc

Preview package for commit 383b5bc.