feat(integrations): add supabase Stripe catalog provider

crates/stackless-integrations/src/providers/mod.rs

@@ -1,18 +1,14 @@
 pub mod clerk;
 pub mod cloudflare;
+pub mod supabase;
 
 #[cfg(test)]
 mod tests {
     use stackless_provider_sdk::CatalogResource;
     use stackless_provider_sdk::Hostable;
 
-    use crate::providers::cloudflare;
+    use crate::providers::{cloudflare, supabase};
 
-    /// `Hostable::OUTPUTS` (the names referenceable as `${integrations.*.<out>}`)
-    /// must stay in lockstep with the names column of `OUTPUT_FIELDS` — the two
-    /// are co-located but hand-written, so this makes drift a test failure rather
-    /// than a silent validation bug. Bespoke providers (Clerk) aren't
-    /// `CatalogResource`, so they're out of scope here by construction.
     fn assert_outputs_match<T: CatalogResource>() {
         let fields: Vec<&str> = T::OUTPUT_FIELDS.iter().map(|(_, name, _)| *name).collect();
         let outputs: Vec<&str> = <T as Hostable>::OUTPUTS.to_vec();
@@ -34,5 +30,6 @@ mod tests {
         assert_outputs_match::<cloudflare::workers::CloudflareWorkers>();
         assert_outputs_match::<cloudflare::workers_ai::CloudflareWorkersAi>();
         assert_outputs_match::<cloudflare::browser_run::CloudflareBrowserRun>();
+        assert_outputs_match::<supabase::project::SupabaseProject>();
     }
 }

crates/stackless-integrations/src/providers/supabase/mod.rs

@@ -0,0 +1,11 @@
+//! Supabase catalog resources via Stripe Projects.
+//!
+//! Output envelopes are provisional until pinned by `xtask discover`.
+
+pub mod project;
+
+#[allow(unused_imports)]
+pub(crate) use crate::resource::{
+    CatalogResource as FamilyResource, bool_optional, bool_required, int_optional, int_required,
+    integration_config, interp_optional, interp_required,
+};

crates/stackless-integrations/src/providers/supabase/project.rs

@@ -0,0 +1,148 @@
+//! `supabase/project` integration.
+
+use std::collections::BTreeMap;
+
+use serde::Serialize;
+use stackless_stripe_projects::catalog::verify::CatalogService;
+use stackless_stripe_projects::provision::ProvisionContext;
+
+use super::FamilyResource;
+use crate::error::IntegrationError;
+use crate::hostable::{ConfigScope, Hostable, IntegrationHosting};
+
+pub const RESOURCE_KIND: &str = "integration-supabase";
+
+#[derive(Debug, Serialize)]
+pub struct SupabaseProjectConfig {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub region: Option<String>,
+}
+
+impl CatalogService for SupabaseProjectConfig {
+    const REFERENCE: &'static str = "supabase/project";
+}
+
+#[derive(Debug)]
+pub struct SupabaseProject;
+
+impl Hostable for SupabaseProject {
+    const PROVIDER: &'static str = "supabase";
+    const HOSTING: IntegrationHosting = IntegrationHosting::Managed;
+    const CONFIG_SCOPE: ConfigScope = ConfigScope::GlobalOnly;
+    const RESOURCE_KIND: &'static str = RESOURCE_KIND;
+    const OUTPUTS: &'static [&'static str] = &["url", "anon_key", "service_role_key"];
+}
+
+impl FamilyResource for SupabaseProject {
+    type Config = SupabaseProjectConfig;
+    const PROVIDER_PREFIX: &'static str = "SUPABASE";
+    // Provisional until pinned by `mise run discover supabase/project`.
+    const OUTPUT_FIELDS: &'static [(&'static str, &'static str, bool)] = &[
+        ("URL", "url", true),
+        ("ANON_KEY", "anon_key", true),
+        ("SERVICE_ROLE_KEY", "service_role_key", false),
+    ];
+
+    fn build_config(ctx: &ProvisionContext<'_>) -> Result<SupabaseProjectConfig, IntegrationError> {
+        let config = super::integration_config(ctx)?;
+        Ok(SupabaseProjectConfig {
+            name: super::interp_optional(ctx, &config, "name")?,
+            region: super::interp_optional(ctx, &config, "region")?,
+        })
+    }
+}
+
+pub fn validate_config(
+    name: &str,
+    config: &BTreeMap<String, toml::Value>,
+) -> Result<(), IntegrationError> {
+    let _ = (name, config);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ProviderOps;
+    use crate::resource::ResourcePayload;
+    use stackless_core::def::StackDef;
+    use stackless_stripe_projects::stripe::StripeProjects;
+    use stackless_stripe_projects::test_support;
+
+    #[test]
+    fn config_matches_catalog() {
+        const FIXTURE: &str = include_str!(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/../stackless-stripe-projects/tests/fixtures/catalog.json"
+        ));
+        let catalog = stackless_stripe_projects::Catalog::from_json_envelope(FIXTURE).unwrap();
+        let failures = stackless_stripe_projects::verify_service(
+            &catalog,
+            &SupabaseProjectConfig {
+                name: None,
+                region: None,
+            },
+        );
+        assert!(
+            failures.is_empty(),
+            "supabase/project catalog gaps:\n{}",
+            failures.join("\n")
+        );
+    }
+
+    const CATALOG_ENVELOPE: &str = r##"{"ok":true,"command":"projects catalog","data":{"last_updated":"2026-07-11T00:00:00Z","services":[{"id":"prvsvc_project","object":"v2.provisioning.provider_service_detail","provider_id":"prvdr_supabase","provider_name":"Supabase","service_id":"project","categories":["database"],"kind":"deployable","scope":"project","availability":"available","development":false,"livemode":true,"pricing":{"type":"component"},"configuration_schema":{"properties":{"name":{"maxLength":60,"minLength":1,"type":"string"},"region":{"default":"americas","enum":["americas","emea","apac"],"type":"string"}},"required":[],"type":"object"}}]}}"##;
+
+    fn test_def() -> StackDef {
+        StackDef::parse(
+            r#"
+[stack]
+name = "atto"
+[stack.projects.stripe]
+project = "project_1"
+[integrations.res]
+provider = "supabase"
+[services.api]
+source = { repo = "r", ref = "main" }
+env = { OUT = "${integrations.res.url}" }
+health = { path = "/health" }
+[services.api.local]
+run = "true"
+"#,
+        )
+        .unwrap()
+    }
+
+    #[tokio::test]
+    async fn provision_records_outputs() {
+        let runner = test_support::provision_script(
+            CATALOG_ENVELOPE,
+            serde_json::json!({"SUPABASE_URL": "val_url", "SUPABASE_ANON_KEY": "val_anon_key", "SUPABASE_SERVICE_ROLE_KEY": "val_service_role_key"}),
+            0,
+        );
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("stackless.toml"),
+            "[stack]\nname=\"atto\"\n",
+        )
+        .unwrap();
+        let stripe = StripeProjects::new(&runner, dir.path());
+
+        let resource = SupabaseProject
+            .provision(
+                &stripe.as_dyn(),
+                &test_def(),
+                dir.path(),
+                "demo",
+                "res",
+                "local",
+                false,
+            )
+            .await
+            .unwrap();
+        assert_eq!(resource.resource_kind, "integration-supabase");
+        let payload: ResourcePayload = serde_json::from_str(&resource.payload).unwrap();
+        assert_eq!(payload.outputs["url"], "val_url");
+    }
+}

crates/stackless-integrations/src/registry.rs

@@ -76,6 +76,7 @@ register_providers! {
     (cloudflare::workers, CloudflareWorkers),
     (cloudflare::workers_ai, CloudflareWorkersAi),
     (cloudflare::browser_run, CloudflareBrowserRun),
+    (supabase::project, SupabaseProject),
 }
 
 fn lookup(provider: &str) -> Option<&'static ProviderEntry> {

crates/stackless-provider-sdk/src/resource.rs

@@ -249,6 +249,48 @@ pub fn int_required(
         })
 }
 
+/// Read an optional integer field from the effective config.
+pub fn int_optional(
+    ctx: &ProvisionContext<'_>,
+    config: &BTreeMap<String, toml::Value>,
+    key: &str,
+) -> Result<Option<i64>, IntegrationError> {
+    match config.get(key) {
+        None => Ok(None),
+        Some(value) => value
+            .as_integer()
+            .map(Some)
+            .ok_or_else(|| cfg_invalid(ctx, key, format!("{key} must be an integer when set"))),
+    }
+}
+
+/// Read a required boolean field from the effective config.
+pub fn bool_required(
+    ctx: &ProvisionContext<'_>,
+    config: &BTreeMap<String, toml::Value>,
+    key: &str,
+) -> Result<bool, IntegrationError> {
+    config
+        .get(key)
+        .and_then(toml::Value::as_bool)
+        .ok_or_else(|| cfg_invalid(ctx, key, format!("{key} is required and must be a boolean")))
+}
+
+/// Read an optional boolean field from the effective config.
+pub fn bool_optional(
+    ctx: &ProvisionContext<'_>,
+    config: &BTreeMap<String, toml::Value>,
+    key: &str,
+) -> Result<Option<bool>, IntegrationError> {
+    match config.get(key) {
+        None => Ok(None),
+        Some(value) => value
+            .as_bool()
+            .map(Some)
+            .ok_or_else(|| cfg_invalid(ctx, key, format!("{key} must be a boolean when set"))),
+    }
+}
+
 fn cfg_invalid(ctx: &ProvisionContext<'_>, key: &str, detail: String) -> IntegrationError {
     IntegrationError::ConfigInvalid {
         location: format!("integrations.{}.{key}", ctx.logical_name),

docs/ADDING-A-PROVIDER.md

@@ -1,5 +1,8 @@
 # Adding a provider
 
+For parallel catalog rollouts (waves, merge gates, exclusions), see
+[PROVIDER-WAVES.md](PROVIDER-WAVES.md).
+
 stackless has two provider families. Adding one touches **exactly one
 registration site** plus the provider's own module/crate — the engine, core, and
 sibling providers stay untouched (core never names a provider).

docs/DECISIONS.md

@@ -4,6 +4,29 @@ Architecture decisions and the reasoning behind them. Newest first.
 
 ---
 
+## 3. Catalog-first for every Stripe provider; substrates later
+
+**Date:** 2026-07-11
+
+**Decision.** Every Stripe Projects **deployable** gets a Phase 1
+`CatalogResource` integration (one PR per provider family; see
+[PROVIDER-WAVES.md](PROVIDER-WAVES.md)). New `--on` substrates (railway, gitlab,
+laravel cloud, wordpress.com, cloudflare workers) are Phase 2 and stay
+unchecked on the stack-host list until those crates land.
+
+**Exclusions (never auto-provision / never smoke):**
+
+- `cloudflare/containers`, `cloudflare/registrar:domain`
+- `cloudflare/workers:free`, `cloudflare/workers:paid` (plans)
+- `squarespace/domain`, `wordpress.com/domain` (non-refundable domain purchase;
+  Squarespace has no other deployable, so it has no adapter)
+
+**Rationale.** Catalog integrations parallelize cleanly and give
+`up`/`observe`/`down` via Stripe for the whole catalog. Substrate crates need
+provider REST clients and live smoke; they do not block catalog coverage.
+
+---
+
 ## 2. Extract `stackless-provider-sdk` as the provider extension surface
 
 **Date:** 2026-07-02

docs/PROVIDER-WAVES.md

@@ -0,0 +1,69 @@
+# Provider wave protocol
+
+How we land Stripe Projects catalog integrations in parallel without merge hell.
+See [ADDING-A-PROVIDER.md](ADDING-A-PROVIDER.md) for the per-provider code pattern.
+
+## Phase 1 vs Phase 2
+
+- **Phase 1** — Catalog integrations (`CatalogResource` + `register_providers!`).
+  One PR per provider family. Hosting-shaped refs (`railway/hosting`,
+  `gitlab/project`, …) are integrations first; they do **not** add `--on`.
+- **Phase 2** — Cloud substrates (`--on railway`, gitlab, laravel cloud,
+  wordpress.com, cloudflare). Serialized; live smoke required.
+
+## Exclusions
+
+Never auto-provision or smoke:
+
+- `cloudflare/containers`, `cloudflare/registrar:domain`
+- `cloudflare/workers:free`, `cloudflare/workers:paid` (plans, not integrations)
+- `squarespace/domain`, `wordpress.com/domain` (non-refundable domain purchase)
+
+Plan-tier catalog entries (`*/hobby`, `*/pro`, …) are not adapters.
+
+## Fixed-base wave
+
+1. Pick a wave base commit on `main` (or the previous landed wave tip).
+2. For each family in the wave, branch `feat/integration-<family>` from that
+   **same** base — no mid-wave rebases onto each other.
+3. Each family PR contains only:
+   - `crates/stackless-integrations/src/providers/<family>/…`
+   - its `register_providers!` row(s) and `pub mod` declarations
+   - gap + hermetic tests
+   - README/SCHEMA checklist tick for that family
+4. Keep `mise.toml` / `.github/workflows/smoke.yml` out of family PRs. Add smoke
+   fixtures and tasks in the **wave landing** commit when a provider is linked.
+
+## Landing
+
+Either:
+
+- **Serial merge:** merge family PRs one-by-one; resolve the single additive
+  conflict in `registry.rs` / `providers/mod.rs` (union-sort rows).
+- **Landing branch:** cherry-pick approved family commits onto `wave-N`,
+  union-sort registry rows, run `mise run check` +
+  `cargo nextest run -p stackless-integrations`, then one PR to `main`.
+
+Do not invent codegen solely to avoid one-line registry conflicts.
+
+## Merge gate (Phase 1 family PR)
+
+1. Config + `CatalogService::REFERENCE` matches catalog schema (gap test).
+2. `Hostable` + `CatalogResource` (or Clerk-shaped bespoke `ProviderOps`).
+3. Registry row(s) + uniqueness tests green.
+4. Hermetic provision test via `provision_script`.
+5. `OUTPUT_FIELDS` pinned by live `mise run discover <ref>` when credentials
+   exist; otherwise provisional suffixes (same posture as Hyperdrive) with a
+   comment, and discover before first live smoke.
+6. Live smoke fixture **not** required per PR.
+
+## Suggested waves
+
+| Wave | Families |
+|------|----------|
+| 1 | Neon, Supabase, Turso, Upstash, Auth0, WorkOS, Privy, Prisma |
+| 2 | PlanetScale, ClickHouse, Chroma, Sentry, PostHog, Amplitude, Mixpanel, Algolia |
+| 3 | OpenRouter, Exa, Firecrawl, Parallel, ElevenLabs, HeyGen, HuggingFace, Inngest |
+| 4 | E2B, Daytona, Browserbase, Blaxel, Runloop, KERNEL, AgentMail, AgentPhone |
+| 5 | Railway, GitLab, Laravel_Cloud, WordPress.com (site), Base44_Projects, Wix, PostalForm, Metronome, Supermemory |
+| 6 | Render (`render/postgres`), Flyio (`flyio/mpg`, `flyio/sprite`) |