fix: resolve npm: supabase-js specifier for offline edge-runtime image

[Ziinc]

Summary

• CI (Supabase Docker workflow, single-tenant self-hosted image job) was failing: exchange-desktop-token and github-webhook edge functions returned 500 for every request instead of proper 400/401 validation responses.
• Root cause: feat: implementation of sprites, update to use npm: #513 switched edge function imports to npm:@supabase/supabase-js@2.95.3, but the offline fat image only remapped the old esm.sh specifier to a vendored bundle. The npm: specifier fell through to a live registry fetch, which the offline edge-runtime container can't do, so every function invocation threw.
• Rather than just patching the import-map remap, replaced the esbuild+Node vendor-bundle approach entirely: a build stage now pre-warms Deno's own npm cache (DENO_DIR) for the pinned @supabase/supabase-js version via deno cache, and that cache is shipped directly in the image. No node_modules, no bundling step, no import-map remapping — functions resolve their npm: import from disk like they would with a normal Deno cache.

Changes

• supabase/docker/Dockerfile: removed the Node+esbuild vendor stage; added an npm-cache stage (denoland/deno:alpine-2.1.4) that runs deno cache and copies the resulting DENO_DIR into the final image.
• supabase/docker/deno.json: dropped the import-map remapping; now only pins "nodeModulesDir": "none" so the shipped image never falls back to a local node_modules directory.
• supabase/docker/openrc/run-edge-runtime.sh, README.md, versions.env: updated comments/docs to match.

Test plan

• Verified the new npm-cache build stage in isolation (docker build --target npm-cache): correctly resolves and caches @supabase/supabase-js@2.95.3 and its full dependency tree.
• Full docker build of the fat image could not be completed in the dev sandbox (unrelated pre-existing Alpine/apk TLS limitation in that sandbox, reproduced against a bare alpine:3.23 image too) — needs confirmation from the real CI run, which doesn't have that constraint.
• supabase/docker/test/verify-self-hosted.sh (exchange-desktop-token / github-webhook checks) should be re-verified green in CI.
  🤖 Generated with Claude Code
  https://claude.ai/code/session_01T81HxmDYzHnYp5kg24ByLX
  Generated by Claude Code

[Ziinc]

Inline notes on the two files with non-obvious rationale.

---

Generated by Claude Code

[Ziinc]

Replaced the vendor stage (Node + esbuild bundling @supabase/supabase-js into a single .mjs) with an npm-cache stage that runs deno cache against the pinned npm:@supabase/supabase-js@2.95.3 specifier.

• The functions already import via npm:... (feat: implementation of sprites, update to use npm: #513); the vendor bundle's import-map remap only covered the old esm.sh URL, so every function call was hitting a live registry fetch at runtime and failing with 500 — this is the actual CI fix.
• DENO_DIR is a stable Deno cache format, so warming it with the plain deno CLI and copying it into the image (same DENO_DIR path edge-runtime already uses) is compatible without needing edge-runtime itself at build time.
• No node_modules, no esbuild, one fewer toolchain in the build.

---

Generated by Claude Code

[Ziinc]

Dropped the imports remap entirely — no code imports the bare @supabase/supabase-js or esm.sh specifiers anymore, so there was nothing left to remap.

• "nodeModulesDir": "none" is the important part: this file is copied over functions/deno.json (which sets nodeModulesDir: "auto" for local dev), so without this override the image would fall back to creating a local node_modules — exactly what pre-warming DENO_DIR is meant to avoid.

---

Generated by Claude Code