fix(stack,stack-supabase): edge-safe shared seam — process-free adapter-kit + structural v3 columns - #799

The precondition for retrying #798 stage 4, not a consequence of it.

Stage 4 was reverted because the WASM entry threw `ReferenceError: process is
not defined` on import — it had begun importing `@/utils/logger`, whose
`initStackLogger()` read `process.env` at module scope. The useful part is not
the defect but what missed it: 1073 unit tests, the type tests and the
bundle-isolation test were all green while the entry was unusable in every
runtime it exists for.

Nothing could have caught it. `wasm-inline-bundle-isolation.test.ts` reads
import SPECIFIERS, so a global is invisible to it. The Deno e2e runs under
Deno, which provides `process`. The unit suites run under Node, likewise.

So this points the harness #799 built for `dist/adapter-kit.js` at
`dist/wasm-inline.js` — which that test's own docblock anticipated ("the
portable-entry plan will point the same harness at the WASM entry"). It matters
more here than there: the shared operation layer widens this entry's transitive
graph, and anything that graph reaches ships to the edge.

The harness gains an allowed-externals argument. `adapter-kit` has no bare
specifiers; the WASM entry has two, the `/wasm-inline` subpaths of protect-ffi
and auth, which Deno and Workers resolve through an import map (and
`e2e/wasm/deno.json` maps exactly those). They are STUBBED rather than loaded:
the question is whether the graph evaluates without `process`, and loading the
real binding adds a megabyte of unrelated behaviour and its own globals for no
extra signal. Stub exports are `undefined` on purpose — module-scope code that
calls into an external at import time is itself a portability defect and should
fail loudly. Anything not named is still rejected, so a new external on this
entry fails here too, which is the same native-leak class the isolation test
guards.

Verified by breaking it: injecting an unguarded module-scope `process.env` read
into `wasm-inline.ts` and rebuilding makes this fail with the ReferenceError
above. Passing today at 56 exports.

Addresses review on #799.

- ColumnMap now throws at construction when a builder in an AnyV3Table's
  columnBuilders fails the structural v3 probe, instead of silently
  omitting it. An omitted column dropped out of v3Columns and its filter
  operands went to PostgREST as plaintext — the exact leak this work
  closes, from the other direction. Regression tests prove construction
  throws and no PostgREST request is issued.
- Harden the logger env guard against a process defined without env.

Addresses review on #799.

- ColumnMap now throws at construction when a builder in an AnyV3Table's
  columnBuilders fails the structural v3 probe, instead of silently
  omitting it. An omitted column dropped out of v3Columns and its filter
  operands went to PostgREST as plaintext — the exact leak this work
  closes, from the other direction. Regression tests prove construction
  throws and no PostgREST request is issued.
- Harden the logger env guard against a process defined without env.

Blocking fix. `readDatabaseUrlFromEnv()` was consulted on the edge entry too,
where `introspector` is null by construction, and the refusal keyed on the
RESOLVED url — so an ambient `DATABASE_URL` made a declared-mode client throw
"drop `databaseUrl`" at a caller who passed none. Unactionable (nothing in
their code fixes it) and ordinary rather than exotic: every runtime exposing
`process.env` reaches it, and `DATABASE_URL` is the variable a Supabase
project already has.

- The ambient read is gated on `introspector`; the refusal keys on
  `options.databaseUrl`, so it can only fire for an option someone wrote.
- The no-schemas error branches per build: telling an edge caller to set
  `DATABASE_URL` sent them to a variable that build cannot read.
- Four regression tests that SET the variable. Both suites previously pinned
  the ENVIRONMENT to keep declared mode working — the Deno test asserted
  `DATABASE_URL` was unset — which routed around the coupling instead of
  testing it. That assertion now sets the variable and expects construction
  to succeed anyway. Verified the new tests fail against 83179d5.

Also from the same review:

- `packages/stack-supabase/turbo.json` makes `test` depend on this package's
  own `build`. Without it `turbo run test` never built the package, so the
  emitted-bundle edge-safety gate reported 4 skipped and a regression putting
  the native engine back in the edge graph would have shipped green. Same fix
  and same reason as packages/stack/turbo.json (#799).
- Reverted the `pg` peer floor to `>=8`. The `>=8.16.3` bump was for
  pg-cloudflare, which this PR does not wire up (#808), and the edge entry
  carries no `pg` at all — so it narrowed a range for every consumer and
  bought nothing reachable today.
- Dropped the dead `introspection && introspector` conjunct.

Claude-Session: https://claude.ai/code/session_01AwM5Cm5ddasXozb6stxPR1

…try (#708) (#912)

* supabase: construct without a Postgres connection, and add an edge entry (#708)

`encryptedSupabase` derived every column's encryption config by introspecting
the database, so it always needed a Postgres connection. That made it
unconstructible anywhere a TCP socket to Postgres is unavailable, and cost a
second, more privileged credential even on Node -- the caller already had an
authenticated Supabase client.

The rule now: declare your schemas and it runs anywhere; omit them and we
discover them for you, which needs a connection and is therefore Node-only.

Two independent mechanisms had to go, and fixing either alone leaves the
wrapper broken:

- Introspection. Passing `schemas` skips it entirely. The gate is the
  database URL, NOT the absence of `schemas`, so every existing caller keeps
  introspection and keeps its drift check; "pass `databaseUrl` as well" is how
  you declare types and still verify them.
- The native engine. `src/index.ts` statically imported `@cipherstash/stack`,
  which loads protect-ffi and `@cipherstash/auth` (both Node-API) on import
  whether or not you encrypt. The new `./wasm-inline` entry binds the WASM
  `Encryption` instead. The introspector is injected for the same reason: a
  dynamic `import('pg')` is still a specifier a bundler resolves at build
  time, so the edge entry must not reach the module at all.

What declared mode gives up, it gives up loudly: `select('*')` and bare
`select()` are refused, `from()` on an undeclared table throws naming the
declaration, and `queryDomainsRequired` is forced rather than detected.

Also fixed: a read awaited with no `.select()` sent a raw `*` to PostgREST,
bypassing the refusal `select('*')` has always performed -- so encrypted
columns came back with no `::jsonb` casts.

Evidence rather than assertion: `e2e/wasm/supabase-declared.test.ts` runs the
emitted entry under real Deno with `ffi: false` and no database, and
`wasm-entry-edge-safety.test.ts` scans the emitted bundle for the specifiers
that must not be there -- verified to fail when the entry is pointed back at
the native engine.

Claude-Session: https://claude.ai/code/session_01AwM5Cm5ddasXozb6stxPR1

* Address the two review passes on #708

Claude Code /code-review (10 findings) and GPT-5.6 Sol (2 P1s). The two
converged on the same thing from different directions, and it was the
important one: the edge entry CONSTRUCTED but could not run a query.

- The WASM client is now adapted, not cast (both P1s, finding 5). The engines
  differ in ways that are silent at construction: `decryptModel` requires the
  table on WASM and derives it from payloads on native (both call sites now
  pass it, which native ignores); WASM operations are plain Results with no
  `withLockContext`/`audit`, so both are attached and throw a sentence naming
  the gap; `bulkEncrypt` is not forwarded, selecting the supported per-term
  fallback over a mismatched signature. The edge entry's options now require
  `schemas` and a `WasmClientConfig`, so omitting credentials is a type error
  rather than a TypeError from inside the engine.
- Reverted the await-without-`.select()` change (finding 1). Routing it
  through `expandStarOrThrow` skipped the cast/alias step, broke declared
  renames with a 42703, and pinned the column list at construction. The raw
  `*` is restored and the pre-existing wart documented.
- Ambient `DATABASE_URL` no longer overrules a declaration (finding 2), and
  says so when it is ignored rather than changing mode in silence (finding 9).
- Documented the one declared-mode tradeoff that is NOT loud: an encrypted
  column missing from the declaration is treated as plaintext (finding 3).
- The Deno suite now encrypts a filter operand and decrypts a row through
  WASM, which is what its header always claimed (finding 6).
- CLI: `readOreState` gates on the installed version instead of reporting
  healthy skewed installs as damage (4); `CASTS_SQL` OR-matches EQL endpoints
  (7); the bundle parser throws on statement forms no handler models rather
  than failing open (8); the `--database-url` message moves to messages.ts
  (10).

Claude-Session: https://claude.ai/code/session_01AwM5Cm5ddasXozb6stxPR1

* Close finding 9 properly, and fix a suppression that did nothing

Two gaps found while checking whether the review comments could be resolved.

- Finding 9 was not actually addressed. The warning fired only when an
  ambient DATABASE_URL existed and was ignored — but the finding's scenario
  is that variable going MISSING, where it stayed silent. It now fires
  whenever the native entry enters declared mode implicitly, which covers
  both callers: the one who declared deliberately and the one who just lost
  their env var and used to get a boot throw. Gated on the introspector, so
  the edge entry — where declared mode is the only mode — stays quiet.
- The `biome-ignore` in wasm-client-adapter sat on the closing line of the
  cast while the diagnostic anchors to the start of the expression, so it
  suppressed nothing and was itself reported as an unused suppression.
  Moved. Type-erasure warnings in this package are now 11, against 16 on
  main.

Claude-Session: https://claude.ai/code/session_01AwM5Cm5ddasXozb6stxPR1

* Address James's review: never resolve an ambient URL a build cannot use

Blocking fix. `readDatabaseUrlFromEnv()` was consulted on the edge entry too,
where `introspector` is null by construction, and the refusal keyed on the
RESOLVED url — so an ambient `DATABASE_URL` made a declared-mode client throw
"drop `databaseUrl`" at a caller who passed none. Unactionable (nothing in
their code fixes it) and ordinary rather than exotic: every runtime exposing
`process.env` reaches it, and `DATABASE_URL` is the variable a Supabase
project already has.

- The ambient read is gated on `introspector`; the refusal keys on
  `options.databaseUrl`, so it can only fire for an option someone wrote.
- The no-schemas error branches per build: telling an edge caller to set
  `DATABASE_URL` sent them to a variable that build cannot read.
- Four regression tests that SET the variable. Both suites previously pinned
  the ENVIRONMENT to keep declared mode working — the Deno test asserted
  `DATABASE_URL` was unset — which routed around the coupling instead of
  testing it. That assertion now sets the variable and expects construction
  to succeed anyway. Verified the new tests fail against 83179d5.

Also from the same review:

- `packages/stack-supabase/turbo.json` makes `test` depend on this package's
  own `build`. Without it `turbo run test` never built the package, so the
  emitted-bundle edge-safety gate reported 4 skipped and a regression putting
  the native engine back in the edge graph would have shipped green. Same fix
  and same reason as packages/stack/turbo.json (#799).
- Reverted the `pg` peer floor to `>=8`. The `>=8.16.3` bump was for
  pg-cloudflare, which this PR does not wire up (#808), and the edge entry
  carries no `pg` at all — so it narrowed a range for every consumer and
  bought nothing reachable today.
- Dropped the dead `introspection && introspector` conjunct.

Claude-Session: https://claude.ai/code/session_01AwM5Cm5ddasXozb6stxPR1