chore(supabase): stop publishing unused Capgo cloud edge functions

.github/workflows/build_and_deploy.yml

@@ -92,7 +92,11 @@ jobs:
       - name: Update functions
         env:
           SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_TOKEN }}
-        run: supabase functions deploy
+        # Capgo cloud only publishes functions still needed on Supabase (pg_net entry).
+        # Self-hosting keeps deploying all functions via `supabase functions deploy`.
+        run: |
+          mapfile -t FUNCTIONS < <(bun scripts/supabase-cloud-functions.ts list)
+          supabase functions deploy "${FUNCTIONS[@]}"
 
   read_replica_schema:
     needs: changes

README.md

@@ -77,8 +77,10 @@ We support both deployments for practical reasons:
 
 In production, we route most traffic through Cloudflare Workers for cost and
 scale, while Supabase remains the reference backend and the default for
-self-hosted deployments. Private endpoints and trigger/CRON workloads still run
-on Supabase in production.
+self-hosted deployments. Capgo cloud still publishes the `triggers` Supabase
+function so Postgres `pg_net` can reach `queue_consumer`; cron/trigger work is
+then forwarded to Cloudflare when configured. Private, public, plugin, and files
+endpoints are not published on Capgo cloud Supabase anymore.
 
 ## Project structure (self-hosting map)
 
@@ -448,7 +450,21 @@ Seed the secret for functions:
 supabase secrets set --env-file supabase/functions/.env
 ```
 
-Push the functions to the cloud:
+### Deploy Capgo Cloud Supabase functions
+
+Capgo Cloud (prod / preprod / alpha) only publishes allowlisted Supabase
+functions from `scripts/supabase-cloud-functions.ts` (currently `triggers`, for
+`pg_net` / queue-consumer entry). Public API, plugin, private, and files traffic
+runs on Cloudflare Workers.
+
+```bash
+bun run deploy:supabase:prod
+# or: bunx supabase functions deploy $(bun scripts/supabase-cloud-functions.ts deploy-args) --project-ref <ref>
+```
+
+### Deploy self-hosted Supabase functions
+
+Self-hosted installs should keep deploying every function:
 
 ```bash
 supabase functions deploy

package.json

@@ -184,8 +184,8 @@
     "deploy:cloudflare_env:plugin_me:prod": "bunx wrangler secret bulk internal/cloudflare/.env.prod --config cloudflare_workers/plugin/wrangler.jsonc --env=prod_me",
     "deploy:cloudflare_env:plugin_hk:prod": "bunx wrangler secret bulk internal/cloudflare/.env.prod --config cloudflare_workers/plugin/wrangler.jsonc --env=prod_hk",
     "deploy:cloudflare_env:plugin_jp:prod": "bunx wrangler secret bulk internal/cloudflare/.env.prod --config cloudflare_workers/plugin/wrangler.jsonc --env=prod_jp",
-    "deploy:supabase:prod": "bunx supabase functions deploy --project-ref xvwzpoazmxkqosrdewyv",
-    "deploy:supabase:preprod": "bunx supabase functions deploy --project-ref ibwjdnhknbkcqfbabwei",
+    "deploy:supabase:prod": "bunx supabase functions deploy $(bun scripts/supabase-cloud-functions.ts deploy-args) --project-ref xvwzpoazmxkqosrdewyv",
+    "deploy:supabase:preprod": "bunx supabase functions deploy $(bun scripts/supabase-cloud-functions.ts deploy-args) --project-ref ibwjdnhknbkcqfbabwei",
     "deploy:supabase_env:prod": "bunx supabase secrets set --project-ref xvwzpoazmxkqosrdewyv --env-file internal/cloudflare/.env.prod",
     "deploy:supabase_env:preprod": "bunx supabase secrets set --project-ref ibwjdnhknbkcqfbabwei --env-file internal/cloudflare/.env.preprod",
     "deploy:supabase_env:dev": "bunx supabase secrets set --project-ref aucsybvnhavogdmzwtcw --env-file internal/cloudflare/.env.alpha",

scripts/supabase-cloud-functions.ts

@@ -0,0 +1,62 @@
+import { readdirSync } from 'node:fs'
+import { join } from 'node:path'
+import process from 'node:process'
+
+/**
+ * Capgo cloud (prod/preprod/alpha) only publishes Supabase Edge Functions that
+ * still receive traffic from Postgres (pg_net) or other non-Cloudflare callers.
+ *
+ * Public API, plugin, private, and files traffic runs on Cloudflare Workers.
+ * Self-hosted installs keep deploying every function under supabase/functions/.
+ */
+export const CAPGO_CLOUD_SUPABASE_FUNCTIONS = [
+  'triggers',
+] as const
+
+export type CapgoCloudSupabaseFunction = typeof CAPGO_CLOUD_SUPABASE_FUNCTIONS[number]
+
+const SKIP_FUNCTION_DIRS = new Set([
+  '_backend',
+  'shared',
+  'plugin_runtime',
+])
+
+export function listLocalSupabaseFunctions(functionsDir = join(process.cwd(), 'supabase', 'functions')): string[] {
+  return readdirSync(functionsDir, { withFileTypes: true })
+    .filter(entry => entry.isDirectory() && !entry.name.startsWith('.') && !SKIP_FUNCTION_DIRS.has(entry.name))
+    .map(entry => entry.name)
+    .sort()
+}
+
+export function listCapgoCloudSkippedSupabaseFunctions(localFunctions = listLocalSupabaseFunctions()): string[] {
+  const keep = new Set<string>(CAPGO_CLOUD_SUPABASE_FUNCTIONS)
+  return localFunctions.filter(name => !keep.has(name))
+}
+
+export function buildCapgoCloudSupabaseDeployArgs(
+  functions: readonly string[] = CAPGO_CLOUD_SUPABASE_FUNCTIONS,
+): string[] {
+  if (functions.length === 0)
+    throw new Error('CAPGO_CLOUD_SUPABASE_FUNCTIONS must not be empty')
+  return [...functions]
+}
+
+if (import.meta.main) {
+  const mode = process.argv[2] ?? 'deploy-args'
+  if (mode === 'list') {
+    for (const name of CAPGO_CLOUD_SUPABASE_FUNCTIONS)
+      console.log(name)
+    process.exit(0)
+  }
+  if (mode === 'skip-list') {
+    for (const name of listCapgoCloudSkippedSupabaseFunctions())
+      console.log(name)
+    process.exit(0)
+  }
+  if (mode === 'deploy-args') {
+    console.log(buildCapgoCloudSupabaseDeployArgs().join(' '))
+    process.exit(0)
+  }
+  console.error(`Unknown mode: ${mode}. Use deploy-args | list | skip-list`)
+  process.exit(1)
+}

tests/supabase-cloud-functions.unit.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import {
+  buildCapgoCloudSupabaseDeployArgs,
+  CAPGO_CLOUD_SUPABASE_FUNCTIONS,
+  listCapgoCloudSkippedSupabaseFunctions,
+  listLocalSupabaseFunctions,
+} from '../scripts/supabase-cloud-functions.ts'
+
+describe('supabase cloud function allowlist', () => {
+  it('keeps only triggers for Capgo cloud deploys', () => {
+    expect([...CAPGO_CLOUD_SUPABASE_FUNCTIONS]).toEqual(['triggers'])
+    expect(buildCapgoCloudSupabaseDeployArgs()).toEqual(['triggers'])
+  })
+
+  it('rejects an empty explicit deploy list', () => {
+    expect(() => buildCapgoCloudSupabaseDeployArgs([])).toThrow(/must not be empty/)
+  })
+
+  it('passes through multiple explicit deploy targets', () => {
+    expect(buildCapgoCloudSupabaseDeployArgs(['triggers', 'ok'])).toEqual(['triggers', 'ok'])
+  })
+
+  it('skips every local function except the Capgo cloud allowlist', () => {
+    const local = listLocalSupabaseFunctions()
+    expect(local).toContain('triggers')
+    expect(local).toContain('updates')
+    expect(local).toContain('stats')
+    expect(local).toContain('private')
+
+    const skipped = listCapgoCloudSkippedSupabaseFunctions(local)
+    expect(skipped).not.toContain('triggers')
+    expect(skipped).toContain('updates')
+    expect(skipped).toContain('stats')
+    expect(skipped).toContain('channel_self')
+    expect(skipped).toContain('private')
+    expect(skipped).toContain('files')
+    expect(skipped.length).toBe(local.length - CAPGO_CLOUD_SUPABASE_FUNCTIONS.length)
+  })
+})