From 4c07df1a48501c8484001bc336a5dc199256cdb5 Mon Sep 17 00:00:00 2001
From: Mert YEREKAPAN <33198490+myerekapan@users.noreply.github.com>
Date: Wed, 3 Jun 2026 11:18:36 +0200
Subject: [PATCH 01/23] feat(studio): surface affected project in metric
 advisories (#46203)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Resolves [GROWTH-865](https://linear.app/supabase/issue/GROWTH-865) on
the Studio side. Companion backend PR:
[supabase/platform#33086](https://github.com/supabase/platform/pull/33086).

Resource-exhaustion advisories (CPU, Disk IO, Memory) currently give
users a list of identical-looking messages with no project context. This
PR makes the affected project visible in the advisor panel and hardens
the "Check consumption" deep-link.

### Changes

**Advisor list view** — `AdvisorPanel.utils.ts`,
`AdvisorPanel.types.ts`, `AdvisorPanel.tsx`, `AdvisorPanelBody.tsx`
- `AdvisorNotificationItem` now carries `project_ref`.
- `getAdvisorItemSecondaryText` accepts an optional `projectNameByRef`
map and returns the resolved project name (falling back to the ref if
the lookup hasn't loaded). Falls through to the existing date string for
notifications without a project.
- `AdvisorPanel.tsx` builds the map from `useProjectsInfiniteQuery` and
threads it through `AdvisorPanelBody`.

**NotificationDetail** — `NotificationDetail.tsx`
- `[ref]` / `[slug]` substitution in action URLs falls back to
`data.project_ref` / `data.org_slug` before the `_` literal. This fixes
the universal-link bug Tim reported where "Check consumption" sometimes
resolved to `/project/_/...` while `useProjectDetailQuery` was still
loading.

The companion backend PR updates the notification copy so the
title/message also name the project. Both PRs degrade gracefully if
landed independently.

## Test plan

- [x] `pnpm test:studio -- AdvisorPanel.utils.test.ts` — 6/6 pass (4 new
tests cover the notification branch of `getAdvisorItemSecondaryText`)
- [x] `pnpm typecheck` passes for apps/studio
- [x] `pnpm exec eslint components/ui/AdvisorPanel/` passes
- [ ] Local Studio smoke test: open Advisor → Messages, confirm project
name shows under each notification and "Check consumption" deep-links to
the correct project even if the project detail query is slow

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Advisor Panel notifications now display resolved project names when
available for clearer context.

* **Bug Fixes**
* Notification action URLs now prefer stored project and organization
refs/slugs with improved fallbacks, making action links more reliable.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46203?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../ui/AdvisorPanel/AdvisorPanel.tsx          | 14 +++++++
 .../ui/AdvisorPanel/AdvisorPanel.types.ts     |  1 +
 .../AdvisorPanel/AdvisorPanel.utils.test.ts   | 40 +++++++++++++++++++
 .../ui/AdvisorPanel/AdvisorPanel.utils.ts     | 11 ++++-
 .../ui/AdvisorPanel/AdvisorPanelBody.tsx      |  4 +-
 .../ui/AdvisorPanel/NotificationDetail.tsx    |  4 +-
 6 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.tsx b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.tsx
index fde0e64638f..7622d057825 100644
--- a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.tsx
+++ b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.tsx
@@ -15,6 +15,7 @@ import { SIDEBAR_KEYS } from '@/components/layouts/ProjectLayout/LayoutSidebar/L
 import { useProjectLintsQuery } from '@/data/lint/lint-query'
 import { Notification, useNotificationsV2Query } from '@/data/notifications/notifications-v2-query'
 import { useNotificationsV2UpdateMutation } from '@/data/notifications/notifications-v2-update-mutation'
+import { useProjectsInfiniteQuery } from '@/data/projects/projects-infinite-query'
 import { useSelectedProjectQuery } from '@/hooks/misc/useSelectedProject'
 import { IS_PLATFORM } from '@/lib/constants'
 import { useTrack } from '@/lib/telemetry/track'
@@ -95,6 +96,18 @@ export const AdvisorPanel = () => {
     return notificationsData?.pages.flatMap((page) => page) ?? []
   }, [notificationsData?.pages])
 
+  const { data: projectsData } = useProjectsInfiniteQuery({}, { enabled: shouldLoadNotifications })
+
+  const projectNameByRef = useMemo(() => {
+    const map = new Map<string, string>()
+    projectsData?.pages.forEach((page) => {
+      page.projects.forEach((project) => {
+        if (project.ref) map.set(project.ref, project.name)
+      })
+    })
+    return map
+  }, [projectsData?.pages])
+
   const markNotificationsRead = () => {
     if (markedRead.current.length > 0) {
       updateNotifications({ ids: markedRead.current, status: 'seen' })
@@ -282,6 +295,7 @@ export const AdvisorPanel = () => {
               hiddenItemsCount={hiddenItemsCount}
               hasAnyFilters={hasAnyFilters}
               hasProjectRef={hasProjectRef}
+              projectNameByRef={projectNameByRef}
             />
           </div>
         </>
diff --git a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.types.ts b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.types.ts
index c9281727c77..17f8fd43ea2 100644
--- a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.types.ts
+++ b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.types.ts
@@ -26,6 +26,7 @@ export type AdvisorLintItem = AdvisorBaseItem & {
 export type AdvisorNotificationItem = AdvisorBaseItem & {
   source: 'notification'
   original: Notification
+  project_ref?: string
 }
 
 export type AdvisorSignalItem = AdvisorBaseItem & {
diff --git a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.test.ts b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.test.ts
index d9e9eb5eff3..23366adc4ec 100644
--- a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.test.ts
+++ b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.test.ts
@@ -71,4 +71,44 @@ describe('AdvisorPanel.utils', () => {
     const bannedIpSignal = createBannedIPSignalItem('203.0.113.10')
     expect(getAdvisorItemSecondaryText(bannedIpSignal)).toBe('Database · 203.0.113.10')
   })
+
+  describe('notification secondary text', () => {
+    const [notificationWithProject] = createAdvisorNotificationItems([
+      createNotification({
+        id: 'notification-with-project',
+        data: {
+          title: 'CPU usage is high on my-project.',
+          message: 'Project my-project has high CPU usage.',
+          project_ref: 'abcd1234',
+          actions: [],
+        },
+      }),
+    ])
+
+    const [notificationWithoutProject] = createAdvisorNotificationItems([
+      createNotification({
+        id: 'notification-without-project',
+        data: { title: 'Generic notification', message: 'Body', actions: [] },
+      }),
+    ])
+
+    it('returns the resolved project name when available in the map', () => {
+      const projectNameByRef = new Map([['abcd1234', 'my-production-db']])
+      expect(getAdvisorItemSecondaryText(notificationWithProject, projectNameByRef)).toBe(
+        'my-production-db'
+      )
+    })
+
+    it('falls back to the project ref when the name is missing from the map', () => {
+      expect(getAdvisorItemSecondaryText(notificationWithProject, new Map())).toBe('abcd1234')
+    })
+
+    it('falls back to the project ref when no map is provided', () => {
+      expect(getAdvisorItemSecondaryText(notificationWithProject)).toBe('abcd1234')
+    })
+
+    it('returns undefined for notifications without a project_ref', () => {
+      expect(getAdvisorItemSecondaryText(notificationWithoutProject)).toBeUndefined()
+    })
+  })
 })
diff --git a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.ts b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.ts
index dc0f8a9a765..9ee683d0e20 100644
--- a/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.ts
+++ b/apps/studio/components/ui/AdvisorPanel/AdvisorPanel.utils.ts
@@ -83,6 +83,7 @@ export const createAdvisorNotificationItems = (
       tab: 'messages' as const,
       source: 'notification' as const,
       original: notification,
+      project_ref: data.project_ref,
     }
   })
 }
@@ -129,7 +130,10 @@ export const getAdvisorPanelItemDisplayTitle = (item: AdvisorItem): string => {
   return getAdvisorItemDisplayTitle(item)
 }
 
-export const getAdvisorItemSecondaryText = (item: AdvisorItem): string | undefined => {
+export const getAdvisorItemSecondaryText = (
+  item: AdvisorItem,
+  projectNameByRef?: ReadonlyMap<string, string>
+): string | undefined => {
   if (item.source === 'lint') {
     return getLintEntityString(item.original)
   }
@@ -138,6 +142,11 @@ export const getAdvisorItemSecondaryText = (item: AdvisorItem): string | undefin
     return `Database · ${item.sourceData.ip}`
   }
 
+  if (item.source === 'notification') {
+    if (!item.project_ref) return undefined
+    return projectNameByRef?.get(item.project_ref) ?? item.project_ref
+  }
+
   return undefined
 }
 
diff --git a/apps/studio/components/ui/AdvisorPanel/AdvisorPanelBody.tsx b/apps/studio/components/ui/AdvisorPanel/AdvisorPanelBody.tsx
index dda95a37fa0..af5efd141a9 100644
--- a/apps/studio/components/ui/AdvisorPanel/AdvisorPanelBody.tsx
+++ b/apps/studio/components/ui/AdvisorPanel/AdvisorPanelBody.tsx
@@ -41,6 +41,7 @@ interface AdvisorPanelBodyProps {
   hiddenItemsCount: number
   hasAnyFilters: boolean
   hasProjectRef?: boolean
+  projectNameByRef?: ReadonlyMap<string, string>
 }
 
 export const AdvisorPanelBody = ({
@@ -54,6 +55,7 @@ export const AdvisorPanelBody = ({
   hiddenItemsCount,
   hasAnyFilters,
   hasProjectRef = true,
+  projectNameByRef,
 }: AdvisorPanelBodyProps) => {
   // Show notice if no project ref and trying to view project-specific tabs
   if (!hasProjectRef && activeTab !== 'messages' && activeTab !== 'all') {
@@ -101,7 +103,7 @@ export const AdvisorPanelBody = ({
           const isUnread = notification?.status === 'new'
 
           const primaryText = getAdvisorPanelItemDisplayTitle(item)
-          const secondaryText = getAdvisorItemSecondaryText(item)
+          const secondaryText = getAdvisorItemSecondaryText(item, projectNameByRef)
           const metadataText =
             secondaryText ?? (item.createdAt ? formatItemDate(item.createdAt) : undefined)
           // Date strings (e.g. "a few seconds ago") come from formatItemDate and
diff --git a/apps/studio/components/ui/AdvisorPanel/NotificationDetail.tsx b/apps/studio/components/ui/AdvisorPanel/NotificationDetail.tsx
index b7e6606a163..acae061fdd4 100644
--- a/apps/studio/components/ui/AdvisorPanel/NotificationDetail.tsx
+++ b/apps/studio/components/ui/AdvisorPanel/NotificationDetail.tsx
@@ -70,9 +70,9 @@ export const NotificationDetail = ({ notification, onUpdateStatus }: Notificatio
           const key = `${notification.id}-action-${idx}`
           if (action.url !== undefined) {
             const url = action.url.includes('[ref]')
-              ? action.url.replace('[ref]', project?.ref ?? '_')
+              ? action.url.replace('[ref]', project?.ref ?? data.project_ref ?? '_')
               : action.url.includes('[slug]')
-                ? action.url.replace('[slug]', organization?.slug ?? '_')
+                ? action.url.replace('[slug]', organization?.slug ?? data.org_slug ?? '_')
                 : action.url
             return (
               <Button key={key} type="default" icon={<ExternalLink strokeWidth={1.5} />} asChild>

From 86076c07f721e4fa2d8daf27a1d388b77ca9c828 Mon Sep 17 00:00:00 2001
From: Aleksi Immonen <aleksi@supabase.io>
Date: Wed, 3 Jun 2026 12:25:06 +0300
Subject: [PATCH 02/23] redirect /blog/pricing to /pricing (#46160)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

- Adds a 301 redirect from `/blog/pricing` to `/pricing`
- The 2021 beta pricing post has an "Out of date" banner but still ranks
~position 2 for pricing queries, sending users to stale plans
- Redirect passes accumulated link equity to the canonical pricing page

## Changes

- `apps/www/lib/redirects.js` — one entry added at the top of the array

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Improvements**
* Added permanent redirect routing to direct users from the blog pricing
page to the main pricing page, ensuring seamless navigation.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46160?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jordi Enric <jordi.err@gmail.com>
---
 apps/www/lib/redirects.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/apps/www/lib/redirects.js b/apps/www/lib/redirects.js
index 551a7613f9a..df951603836 100644
--- a/apps/www/lib/redirects.js
+++ b/apps/www/lib/redirects.js
@@ -1,4 +1,9 @@
 module.exports = [
+  {
+    permanent: true,
+    source: '/blog/pricing',
+    destination: '/pricing',
+  },
   {
     permanent: true,
     source: '/ui/docs/ai-editors-rules/prompts',

From e33331fa92c8ff731ed351a4c3c3626c69a486d4 Mon Sep 17 00:00:00 2001
From: Raminder Singh <romi_ssk@yahoo.co.in>
Date: Wed, 3 Jun 2026 14:57:38 +0530
Subject: [PATCH 03/23] feat: use the new timestamp published at and built by
 columns (#46552)

This PR starts using the new `built_by`, `published_in_marketplace_at`,
and `published_in_catalog_at` columns in preparation for removing the
old deprecated fields `publish_marketplace`, `publish_dashboard`.

- [x] Test dashboard changes in preview.
- [x] Test www changes in preview.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Updated marketplace integration identification to use publication
status instead of publish flags for more accurate filtering and display.
* Corrected the developer attribution field displayed for technology
partner integrations to reflect accurate authorship information.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../Landing/useAvailableIntegrations.tsx          |  4 ++--
 .../studio/data/marketplace/integrations-query.ts |  5 ++++-
 apps/www/lib/marketplaceDb.ts                     | 15 +++++++++------
 apps/www/pages/partners/integrations/[slug].tsx   |  2 +-
 apps/www/types/partners.ts                        |  4 ++--
 packages/common/marketplace-client.ts             |  1 +
 packages/common/marketplace.types.ts              | 14 +++++++++++++-
 7 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/apps/studio/components/interfaces/Integrations/Landing/useAvailableIntegrations.tsx b/apps/studio/components/interfaces/Integrations/Landing/useAvailableIntegrations.tsx
index 82d1a407f7f..581c4cf3e15 100644
--- a/apps/studio/components/interfaces/Integrations/Landing/useAvailableIntegrations.tsx
+++ b/apps/studio/components/interfaces/Integrations/Landing/useAvailableIntegrations.tsx
@@ -81,7 +81,7 @@ export const useAvailableIntegrations = () => {
             edge_function_secret_name: edgeFunctionSecretName,
             images,
             content,
-            partner_name: authorName,
+            built_by: authorName,
             listing_logo: listingLogo,
           } = integration
 
@@ -175,7 +175,7 @@ export const useAvailableIntegrations = () => {
         documentation_url: docsUrl,
         website_url: siteUrl,
         images,
-        partner_name: authorName,
+        built_by: authorName,
         listing_logo: listingLogo,
       } = marketplaceWrapper
 
diff --git a/apps/studio/data/marketplace/integrations-query.ts b/apps/studio/data/marketplace/integrations-query.ts
index 199adae42be..23fab820637 100644
--- a/apps/studio/data/marketplace/integrations-query.ts
+++ b/apps/studio/data/marketplace/integrations-query.ts
@@ -9,7 +9,10 @@ export type MarketplaceIntegration = Listing
 
 export async function getMarketplaceIntegrations(signal?: AbortSignal) {
   const marketplaceClient = createMarketplaceClient()
-  let query = marketplaceClient.from('listings').select('*').is('publish_dashboard', true)
+  let query = marketplaceClient
+    .from('listings')
+    .select('*')
+    .not('published_in_marketplace_at', 'is', null)
   if (signal) query = query.abortSignal(signal)
   const { data, error } = await query
 
diff --git a/apps/www/lib/marketplaceDb.ts b/apps/www/lib/marketplaceDb.ts
index 18420cedf8d..a287b353068 100644
--- a/apps/www/lib/marketplaceDb.ts
+++ b/apps/www/lib/marketplaceDb.ts
@@ -17,7 +17,7 @@ function toPartner(listing: Listing): Partner {
     featured,
     slug,
     title,
-    partner_name,
+    built_by,
     description,
     content,
     website_url,
@@ -34,7 +34,7 @@ function toPartner(listing: Listing): Partner {
     type: 'technology',
     slug,
     title,
-    partnerName: partner_name,
+    builtBy: built_by,
     description,
     content,
     websiteUrl: website_url,
@@ -50,7 +50,7 @@ async function getMarketplaceListings(): Promise<Partner[]> {
   const { data } = await marketplaceClient
     .from('listings')
     .select('*')
-    .is('publish_marketplace', true)
+    .not('published_in_catalog_at', 'is', null)
 
   return data?.map(toPartner) ?? []
 }
@@ -78,7 +78,7 @@ async function getMarketplaceListingSlugs(): Promise<string[]> {
   const { data } = await marketplaceClient
     .from('listings')
     .select('slug')
-    .is('publish_marketplace', true)
+    .not('published_in_catalog_at', 'is', null)
 
   return data?.map((row) => row.slug) ?? []
 }
@@ -102,7 +102,10 @@ export async function listPartnerSlugs(): Promise<string[]> {
 
 async function searchMarketplaceListings(search: string): Promise<Partner[] | null> {
   const searchTerm = search.trim()
-  let query = marketplaceClient.from('listings').select('*').is('publish_marketplace', true)
+  let query = marketplaceClient
+    .from('listings')
+    .select('*')
+    .not('published_in_catalog_at', 'is', null)
 
   if (searchTerm) {
     const searchPattern = `%${searchTerm}%`
@@ -157,7 +160,7 @@ async function getMarketplaceListing(slug: string): Promise<Partner | null> {
     .from('listings')
     .select('*')
     .eq('slug', slug)
-    .is('publish_marketplace', true)
+    .not('published_in_catalog_at', 'is', null)
     .single()
 
   return data ? toPartner(data) : null
diff --git a/apps/www/pages/partners/integrations/[slug].tsx b/apps/www/pages/partners/integrations/[slug].tsx
index 67c92d244fa..97daaffb42d 100644
--- a/apps/www/pages/partners/integrations/[slug].tsx
+++ b/apps/www/pages/partners/integrations/[slug].tsx
@@ -246,7 +246,7 @@ const PartnerDetails = ({ partner }: { partner: Partner }) => {
           {partner.type === 'technology' && (
             <div className="flex items-center justify-between py-2">
               <span className="text-foreground-lighter">Developer</span>
-              <span className="text-foreground">{partner.partnerName}</span>
+              <span className="text-foreground">{partner.builtBy}</span>
             </div>
           )}
 
diff --git a/apps/www/types/partners.ts b/apps/www/types/partners.ts
index bdcef594446..7c55692b860 100644
--- a/apps/www/types/partners.ts
+++ b/apps/www/types/partners.ts
@@ -13,7 +13,7 @@ export type Partner = {
   type: 'technology' | 'expert'
   slug: string
   title: string
-  partnerName: string
+  builtBy: string
   description: string
   content: string
   websiteUrl: string
@@ -47,7 +47,7 @@ export function toPartner(dbPartner: DbPartner): Partner {
     type,
     slug,
     title,
-    partnerName: developer,
+    builtBy: developer,
     description,
     content: overview,
     websiteUrl: website,
diff --git a/packages/common/marketplace-client.ts b/packages/common/marketplace-client.ts
index a690f030424..db0b34749e1 100644
--- a/packages/common/marketplace-client.ts
+++ b/packages/common/marketplace-client.ts
@@ -23,6 +23,7 @@ export type Database = MergeDeep<
             // See https://github.com/orgs/supabase/discussions/14151
             featured: boolean
             partner_name: string
+            built_by: string
             slug: string
             title: string
             description: string
diff --git a/packages/common/marketplace.types.ts b/packages/common/marketplace.types.ts
index 6b459ba685a..a5f625aebd2 100644
--- a/packages/common/marketplace.types.ts
+++ b/packages/common/marketplace.types.ts
@@ -30,6 +30,7 @@ export type Database = {
       listings: {
         Row: {
           aud: string | null
+          built_by: string | null
           categories: Json | null
           content: string | null
           description: string | null
@@ -50,18 +51,29 @@ export type Database = {
           listing_tsv: unknown
           marketplace_url: string | null
           oauth_client_id: string | null
+          partner_id: string | null
           partner_logo: string | null
           partner_name: string | null
           partner_slug: string | null
           publish_dashboard: boolean | null
           publish_marketplace: boolean | null
+          published_in_catalog_at: string | null
+          published_in_marketplace_at: string | null
           secret_key_prefix: string | null
           slug: string | null
           title: string | null
           website_url: string | null
           youtube_id: string | null
         }
-        Relationships: []
+        Relationships: [
+          {
+            foreignKeyName: 'listings_partner_id_fkey'
+            columns: ['partner_id']
+            isOneToOne: false
+            referencedRelation: 'partners'
+            referencedColumns: ['id']
+          },
+        ]
       }
       partners: {
         Row: {

From a7dda67549a283ff3e5f5b6f1710578415dd2d8e Mon Sep 17 00:00:00 2001
From: Jordi Enric <37541088+jordienr@users.noreply.github.com>
Date: Wed, 3 Jun 2026 12:00:19 +0200
Subject: [PATCH 04/23] feat(studio): add Multigres logs collection for HA
 projects (#46499)

## Problem

High availability (Multigres) projects don't expose Multigres service
logs in the Studio logs UI, so users on HA projects have no entry point
to inspect them.

## Fix

Add a `Multigres` logs collection, gated behind the `multigresLogs`
ConfigCat flag **and** the project's `high_availability` flag
(`useShowMultigresLogs`):

- New `Multigres` entry in the logs sidebar `Collections`, linking to a
new `multigres-logs` page that queries the `multigres_logs` table.
- Wire `multigres_logs` through the logs constants, types, table SQL,
query type, and service labels.
- Row formatting: parse the JSON `event_message` and render `level`
through `SeverityFormatter` and `msg` through `TextFormatter`, matching
the other service collections (instead of dumping raw JSON).
- `WARN` severity is now styled like `WARNING` (amber), since Multigres
emits `level: WARN`.
- Log detail drawer: parse the JSON `event_message` and spread its keys
onto the log so each field (level, msg, query, error, connection_id,
etc.) renders as its own collapsible row.
- Single-log query omits the `metadata` column for `multigres_logs` (the
table has no such column), fixing an `INVALID_ARGUMENT` error when
opening the detail drawer.
- Event chart: parse the level out of `event_message` via `JSON_VALUE`
so error/warning bars are counted (the table has no top-level level
column).
- Add the `multigres_logs` source schema to the Field Reference drawer,
same gating.

## Why a feature flag

`high_availability` is an existing product feature that predates
Multigres, so existing HA projects could otherwise see a broken
collection querying a `multigres_logs` table they don't have. Requiring
the `multigresLogs` flag ships the feature dark and decouples rollout
from HA status. The flag must be created in ConfigCat before enabling;
until then `useFlag` returns false and the feature stays hidden.

## How to test

- Enable the `multigresLogs` flag (or override locally) and open a
project where `high_availability` is `true`.
- Navigate to `Logs`. Confirm a `Multigres` entry appears under
`Collections` (after `Replication`).
- Open it: the page loads at `/project/<ref>/logs/multigres-logs` and
queries `multigres_logs`.
- Confirm rows show a colored severity pill (including amber `WARN`) and
a readable message rather than raw JSON.
- Confirm the chart counts error/warning bars correctly.
- Click a row: the detail drawer shows each parsed field as its own row,
with no error.
- Open the Field Reference drawer and confirm `Multigres` is listed as a
source.
- With the flag off, or on a non-HA project, confirm the collection and
Field Reference source are both hidden.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Multigres added as a dedicated log source with its own Logs page,
sidebar entry, and query type.
* Log list and preview now parse Multigres payloads to surface
timestamp, severity, and formatted message.
* Multigres integrated into charting, prompt labels, and field-reference
UI (hidden unless enabled).
* New hook controls showing Multigres UI only when feature flag + HA
project condition are met.
* **Bug Fixes**
  * Severity rendering treats "WARN" the same as "WARNING".
* **Tests**
  * Unit tests added for Multigres parsing and the show-Multigres hook.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
---
 .../MultigresColumnRender.tsx                 | 34 +++++++++++
 .../interfaces/Settings/Logs/LogSelection.tsx | 14 ++++-
 .../interfaces/Settings/Logs/LogTable.tsx     |  4 ++
 .../Settings/Logs/Logs.constants.ts           |  3 +
 .../interfaces/Settings/Logs/Logs.types.ts    |  1 +
 .../Settings/Logs/Logs.utils.test.ts          | 37 ++++++++++++
 .../interfaces/Settings/Logs/Logs.utils.ts    | 31 +++++++++-
 .../Settings/Logs/LogsFormatters.tsx          |  1 +
 .../Settings/Logs/LogsQueryPanel.tsx          | 11 +++-
 .../layouts/LogsLayout/LogsSidebarMenuV2.tsx  | 10 ++++
 .../hooks/misc/useShowMultigresLogs.test.ts   | 60 +++++++++++++++++++
 .../studio/hooks/misc/useShowMultigresLogs.ts | 24 ++++++++
 .../project/[ref]/logs/multigres-logs.tsx     | 28 +++++++++
 packages/shared-data/log-constants.ts         | 18 ++++++
 14 files changed, 270 insertions(+), 6 deletions(-)
 create mode 100644 apps/studio/components/interfaces/Settings/Logs/LogColumnRenderers/MultigresColumnRender.tsx
 create mode 100644 apps/studio/hooks/misc/useShowMultigresLogs.test.ts
 create mode 100644 apps/studio/hooks/misc/useShowMultigresLogs.ts
 create mode 100644 apps/studio/pages/project/[ref]/logs/multigres-logs.tsx

diff --git a/apps/studio/components/interfaces/Settings/Logs/LogColumnRenderers/MultigresColumnRender.tsx b/apps/studio/components/interfaces/Settings/Logs/LogColumnRenderers/MultigresColumnRender.tsx
new file mode 100644
index 00000000000..71022e17b06
--- /dev/null
+++ b/apps/studio/components/interfaces/Settings/Logs/LogColumnRenderers/MultigresColumnRender.tsx
@@ -0,0 +1,34 @@
+import { Column } from 'react-data-grid'
+import { TimestampInfo } from 'ui-patterns/TimestampInfo'
+
+import type { LogData } from '../Logs.types'
+import { parseMultigresEventMessage } from '../Logs.utils'
+import { RowLayout, SeverityFormatter, TextFormatter } from '../LogsFormatters'
+import { defaultRenderCell } from './DefaultPreviewColumnRenderer'
+
+const columns: Column<LogData>[] = [
+  {
+    name: 'multigres-first-column',
+    key: 'multigres-first-column',
+    renderHeaderCell: () => null,
+    renderCell: (props) => {
+      const parsed = parseMultigresEventMessage(props.row.event_message)
+      const level = typeof parsed?.level === 'string' ? parsed.level : undefined
+      const msg = typeof parsed?.msg === 'string' ? parsed.msg : undefined
+
+      if (!level && !msg) {
+        return defaultRenderCell(props)
+      }
+
+      return (
+        <RowLayout>
+          {props.row.timestamp && <TimestampInfo utcTimestamp={props.row.timestamp} />}
+          {level && <SeverityFormatter value={level} />}
+          <TextFormatter className="w-full" value={msg ?? props.row.event_message} />
+        </RowLayout>
+      )
+    },
+  },
+]
+
+export default columns
diff --git a/apps/studio/components/interfaces/Settings/Logs/LogSelection.tsx b/apps/studio/components/interfaces/Settings/Logs/LogSelection.tsx
index db9895400c8..d53c652d3f7 100644
--- a/apps/studio/components/interfaces/Settings/Logs/LogSelection.tsx
+++ b/apps/studio/components/interfaces/Settings/Logs/LogSelection.tsx
@@ -12,8 +12,8 @@ import {
 import { CodeBlock } from 'ui-patterns/CodeBlock'
 import { GenericSkeletonLoader } from 'ui-patterns/ShimmeringLoader'
 
-import type { LogData, QueryType } from './Logs.types'
-import { apiKey, role as extractRole, jwtAPIKey } from './Logs.utils'
+import type { LogData, PreviewLogData, QueryType } from './Logs.types'
+import { apiKey, role as extractRole, jwtAPIKey, parseMultigresEventMessage } from './Logs.utils'
 import DefaultPreviewSelectionRenderer from './LogSelectionRenderers/DefaultPreviewSelectionRenderer'
 import { ButtonTooltip } from '@/components/ui/ButtonTooltip'
 
@@ -70,6 +70,16 @@ const LogSelection = ({ log, onClose, queryType, isLoading, error }: LogSelectio
 
         return <DefaultPreviewSelectionRenderer log={apiLog} />
 
+      case 'multigres': {
+        const parsedMultigresMessage = parseMultigresEventMessage(log.event_message)
+        // Spread the log last so its canonical fields (id, timestamp, event_message)
+        // always win over any same-named keys inside the parsed event_message.
+        const multigresLog = (
+          parsedMultigresMessage ? { ...parsedMultigresMessage, ...log } : log
+        ) as PreviewLogData
+        return <DefaultPreviewSelectionRenderer log={multigresLog} />
+      }
+
       case 'database':
         const hint = log?.metadata?.[0]?.parsed?.[0]?.hint
         const detail = log?.metadata?.[0]?.parsed?.[0]?.detail
diff --git a/apps/studio/components/interfaces/Settings/Logs/LogTable.tsx b/apps/studio/components/interfaces/Settings/Logs/LogTable.tsx
index d09662119bf..4052f11372d 100644
--- a/apps/studio/components/interfaces/Settings/Logs/LogTable.tsx
+++ b/apps/studio/components/interfaces/Settings/Logs/LogTable.tsx
@@ -24,6 +24,7 @@ import DatabasePostgresColumnRender from './LogColumnRenderers/DatabasePostgresC
 import DefaultPreviewColumnRenderer from './LogColumnRenderers/DefaultPreviewColumnRenderer'
 import FunctionsEdgeColumnRender from './LogColumnRenderers/FunctionsEdgeColumnRender'
 import FunctionsLogsColumnRender from './LogColumnRenderers/FunctionsLogsColumnRender'
+import MultigresColumnRender from './LogColumnRenderers/MultigresColumnRender'
 import type { LogData, LogQueryError, QueryType } from './Logs.types'
 import {
   formatLogsAsCsv,
@@ -265,6 +266,9 @@ export const LogTable = ({
       case 'pg_cron':
         columns = DatabasePostgresColumnRender
         break
+      case 'multigres':
+        columns = MultigresColumnRender
+        break
       default:
         if (firstRow && isDefaultLogPreviewFormat(firstRow)) {
           columns = DefaultPreviewColumnRenderer
diff --git a/apps/studio/components/interfaces/Settings/Logs/Logs.constants.ts b/apps/studio/components/interfaces/Settings/Logs/Logs.constants.ts
index 5cf09e190c3..4a00919e14b 100644
--- a/apps/studio/components/interfaces/Settings/Logs/Logs.constants.ts
+++ b/apps/studio/components/interfaces/Settings/Logs/Logs.constants.ts
@@ -396,6 +396,7 @@ export enum LogsTableName {
   PG_UPGRADE = 'pg_upgrade_logs',
   PG_CRON = 'pg_cron_logs',
   ETL = 'etl_replication_logs',
+  MULTIGRES = 'multigres_logs',
 }
 
 export const LOGS_TABLES = {
@@ -412,6 +413,7 @@ export const LOGS_TABLES = {
   pg_cron: LogsTableName.POSTGRES,
   pgbouncer: LogsTableName.PGBOUNCER,
   etl: LogsTableName.ETL,
+  multigres: LogsTableName.MULTIGRES,
 }
 
 export const LOGS_SOURCE_DESCRIPTION = {
@@ -429,6 +431,7 @@ export const LOGS_SOURCE_DESCRIPTION = {
   [LogsTableName.PG_UPGRADE]: 'Logs generated by the Postgres version upgrade process',
   [LogsTableName.PG_CRON]: 'Postgres logs from pg_cron cron jobs',
   [LogsTableName.ETL]: 'Logs from the replication process',
+  [LogsTableName.MULTIGRES]: 'Logs from the Multigres high availability service',
 }
 
 export const FILTER_OPTIONS: FilterTableSet = {
diff --git a/apps/studio/components/interfaces/Settings/Logs/Logs.types.ts b/apps/studio/components/interfaces/Settings/Logs/Logs.types.ts
index 1ce297b8aaa..f29dc87a703 100644
--- a/apps/studio/components/interfaces/Settings/Logs/Logs.types.ts
+++ b/apps/studio/components/interfaces/Settings/Logs/Logs.types.ts
@@ -96,6 +96,7 @@ export type QueryType =
   | 'pg_cron'
   | 'pgbouncer'
   | 'etl'
+  | 'multigres'
 
 export type Mode = 'simple' | 'custom'
 
diff --git a/apps/studio/components/interfaces/Settings/Logs/Logs.utils.test.ts b/apps/studio/components/interfaces/Settings/Logs/Logs.utils.test.ts
index 8023a487d1f..5022103693b 100644
--- a/apps/studio/components/interfaces/Settings/Logs/Logs.utils.test.ts
+++ b/apps/studio/components/interfaces/Settings/Logs/Logs.utils.test.ts
@@ -7,6 +7,7 @@ import {
   formatLogsAsCsv,
   formatLogsAsJson,
   formatLogsAsMarkdown,
+  parseMultigresEventMessage,
 } from './Logs.utils'
 
 const createLog = (overrides: Partial<LogData> = {}): LogData => ({
@@ -182,4 +183,40 @@ describe('Logs.utils', () => {
       expect(extractEdgeFunctionName('/functions/v1/hello-world-1/')).toBe('hello-world-1')
     })
   })
+
+  describe('parseMultigresEventMessage', () => {
+    test('parses a JSON object event_message into a plain object', () => {
+      const eventMessage = JSON.stringify({
+        time: '2026-06-02T15:44:52.84043038Z',
+        level: 'ERROR',
+        msg: 'Failed to write heartbeat',
+        error: 'context deadline exceeded',
+      })
+      expect(parseMultigresEventMessage(eventMessage)).toEqual({
+        time: '2026-06-02T15:44:52.84043038Z',
+        level: 'ERROR',
+        msg: 'Failed to write heartbeat',
+        error: 'context deadline exceeded',
+      })
+    })
+
+    test('returns null when event_message is not valid JSON', () => {
+      expect(parseMultigresEventMessage('connection closed')).toBeNull()
+    })
+
+    test('returns null when event_message parses to an array', () => {
+      expect(parseMultigresEventMessage('[1, 2, 3]')).toBeNull()
+    })
+
+    test('returns null when event_message parses to a primitive', () => {
+      expect(parseMultigresEventMessage('42')).toBeNull()
+      expect(parseMultigresEventMessage('"a string"')).toBeNull()
+    })
+
+    test('returns null for non-string input', () => {
+      expect(parseMultigresEventMessage(undefined)).toBeNull()
+      expect(parseMultigresEventMessage(null)).toBeNull()
+      expect(parseMultigresEventMessage(42)).toBeNull()
+    })
+  })
 })
diff --git a/apps/studio/components/interfaces/Settings/Logs/Logs.utils.ts b/apps/studio/components/interfaces/Settings/Logs/Logs.utils.ts
index 0636cd65fbf..4c9a90e720a 100644
--- a/apps/studio/components/interfaces/Settings/Logs/Logs.utils.ts
+++ b/apps/studio/components/interfaces/Settings/Logs/Logs.utils.ts
@@ -303,13 +303,34 @@ export const LOG_TABLE_SQL: Record<LogsTableName, SafeLogSqlFragment> = {
   [LogsTableName.PG_UPGRADE]: safeSql`pg_upgrade_logs`,
   [LogsTableName.PG_CRON]: safeSql`pg_cron_logs`,
   [LogsTableName.ETL]: safeSql`etl_replication_logs`,
+  [LogsTableName.MULTIGRES]: safeSql`multigres_logs`,
 }
 
 /**
  * SQL query to retrieve only one log
  */
-export const genSingleLogQuery = (table: LogsTableName, id: string): SafeLogSqlFragment =>
-  safeSql`select id, timestamp, event_message, metadata from ${LOG_TABLE_SQL[table]} where id = ${analyticsLiteral(id)} limit 1`
+export const genSingleLogQuery = (table: LogsTableName, id: string): SafeLogSqlFragment => {
+  // multigres logs have no metadata column
+  const metadataColumn = table === LogsTableName.MULTIGRES ? safeSql`` : safeSql`, metadata`
+  return safeSql`select id, timestamp, event_message${metadataColumn} from ${LOG_TABLE_SQL[table]} where id = ${analyticsLiteral(id)} limit 1`
+}
+
+/**
+ * Multigres logs store their structured payload as a JSON string in
+ * `event_message`. Parse it into a plain object, returning `null` when the
+ * value is missing, not valid JSON, or not a plain object (e.g. an array).
+ */
+export const parseMultigresEventMessage = (
+  eventMessage: unknown
+): Record<string, unknown> | null => {
+  if (typeof eventMessage !== 'string') return null
+  try {
+    const parsed = JSON.parse(eventMessage)
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null
+  } catch {
+    return null
+  }
+}
 
 /**
  * Determine if we should show the user an upgrade prompt while browsing logs
@@ -699,6 +720,8 @@ function getErrorCondition(table: LogsTableName): SafeLogSqlFragment {
       return safeSql`metadata.level IN ('error', 'fatal')`
     case 'pg_cron_logs':
       return safeSql`parsed.error_severity IN ('ERROR', 'FATAL', 'PANIC')`
+    case 'multigres_logs':
+      return safeSql`JSON_VALUE(event_message, '$.level') IN ('ERROR', 'FATAL', 'PANIC')`
     default:
       return safeSql`false`
   }
@@ -716,6 +739,8 @@ function getWarningCondition(table: LogsTableName): SafeLogSqlFragment {
       return safeSql`response.status_code >= 400 AND response.status_code < 500`
     case 'function_logs':
       return safeSql`metadata.level IN ('warning')`
+    case 'multigres_logs':
+      return safeSql`JSON_VALUE(event_message, '$.level') IN ('WARN', 'WARNING')`
     default:
       return safeSql`false`
   }
@@ -830,6 +855,7 @@ const QUERY_TYPE_LABELS: Record<QueryType, string> = {
   pg_cron: 'pg_cron',
   pgbouncer: 'PgBouncer',
   etl: 'ETL',
+  multigres: 'Multigres',
 }
 
 const LOG_TABLE_TO_SERVICE_LABEL: Record<LogsTableName, string> = {
@@ -847,6 +873,7 @@ const LOG_TABLE_TO_SERVICE_LABEL: Record<LogsTableName, string> = {
   pg_upgrade_logs: 'Postgres upgrade',
   pg_cron_logs: 'pg_cron',
   etl_replication_logs: 'ETL',
+  multigres_logs: 'Multigres',
 }
 
 const isLogsTableName = (value: string): value is LogsTableName =>
diff --git a/apps/studio/components/interfaces/Settings/Logs/LogsFormatters.tsx b/apps/studio/components/interfaces/Settings/Logs/LogsFormatters.tsx
index 0f1f279c725..cda950344e3 100644
--- a/apps/studio/components/interfaces/Settings/Logs/LogsFormatters.tsx
+++ b/apps/studio/components/interfaces/Settings/Logs/LogsFormatters.tsx
@@ -185,6 +185,7 @@ export const SeverityFormatter = ({
       )
       break
 
+    case 'WARN':
     case 'WARNING':
       return (
         <Layout className="gap-1">
diff --git a/apps/studio/components/interfaces/Settings/Logs/LogsQueryPanel.tsx b/apps/studio/components/interfaces/Settings/Logs/LogsQueryPanel.tsx
index 61492a08984..335fa7d4916 100644
--- a/apps/studio/components/interfaces/Settings/Logs/LogsQueryPanel.tsx
+++ b/apps/studio/components/interfaces/Settings/Logs/LogsQueryPanel.tsx
@@ -38,6 +38,7 @@ import { DatePickerValue, LogsDatePicker } from './Logs.DatePickers'
 import { LogsWarning, LogTemplate } from './Logs.types'
 import Table from '@/components/to-be-cleaned/Table'
 import { useIsFeatureEnabled } from '@/hooks/misc/useIsFeatureEnabled'
+import { useShowMultigresLogs } from '@/hooks/misc/useShowMultigresLogs'
 import { DOCS_URL } from '@/lib/constants'
 
 export interface LogsQueryPanelProps {
@@ -98,7 +99,13 @@ const LogsQueryPanel = ({
   }, [value.from, value.to, value.text, value.isHelper])
 
   const [open, setOpen] = useState(false)
-  const [selectedSchema, setSelectedSchema] = useState(logConstants.schemas[0])
+
+  const showMultigresLogs = useShowMultigresLogs()
+  const schemas = logConstants.schemas.filter(
+    (schema) => schema.reference !== 'multigres_logs' || showMultigresLogs
+  )
+
+  const [selectedSchema, setSelectedSchema] = useState(schemas[0])
 
   return (
     <div className="flex items-center border-b bg-surface-100 h-(--header-height)">
@@ -285,7 +292,7 @@ const LogsQueryPanel = ({
                     <CommandList>
                       <CommandEmpty>No source found.</CommandEmpty>
                       <CommandGroup>
-                        {logConstants.schemas.map((schema) => (
+                        {schemas.map((schema) => (
                           <CommandItem
                             key={schema.reference}
                             value={schema.reference}
diff --git a/apps/studio/components/layouts/LogsLayout/LogsSidebarMenuV2.tsx b/apps/studio/components/layouts/LogsLayout/LogsSidebarMenuV2.tsx
index b152f6abb09..b2daa4da0f3 100644
--- a/apps/studio/components/layouts/LogsLayout/LogsSidebarMenuV2.tsx
+++ b/apps/studio/components/layouts/LogsLayout/LogsSidebarMenuV2.tsx
@@ -34,6 +34,7 @@ import { useContentQuery } from '@/data/content/content-query'
 import { useReplicationSourcesQuery } from '@/data/replication/sources-query'
 import { useCheckEntitlements } from '@/hooks/misc/useCheckEntitlements'
 import { useIsFeatureEnabled } from '@/hooks/misc/useIsFeatureEnabled'
+import { useShowMultigresLogs } from '@/hooks/misc/useShowMultigresLogs'
 
 export function SidebarCollapsible({
   children,
@@ -100,6 +101,7 @@ export function LogsSidebarMenuV2() {
   const showETLLogs = enablePgReplicate && (etlData?.sources?.length ?? 0) > 0 && !isETLLoading
 
   const { hasAccess: hasDedicatedPooler } = useCheckEntitlements('dedicated_pooler')
+  const showMultigresLogs = useShowMultigresLogs()
 
   const { data: savedQueriesRes, isPending: savedQueriesLoading } = useContentQuery({
     projectRef: ref,
@@ -193,6 +195,14 @@ export function LogsSidebarMenuV2() {
           items: [],
         }
       : null,
+    showMultigresLogs
+      ? {
+          name: 'Multigres',
+          key: 'multigres-logs',
+          url: `/project/${ref}/logs/multigres-logs`,
+          items: [],
+        }
+      : null,
   ].filter((x) => x !== null)
 
   const OPERATIONAL_COLLECTIONS = IS_PLATFORM
diff --git a/apps/studio/hooks/misc/useShowMultigresLogs.test.ts b/apps/studio/hooks/misc/useShowMultigresLogs.test.ts
new file mode 100644
index 00000000000..27082f99ea1
--- /dev/null
+++ b/apps/studio/hooks/misc/useShowMultigresLogs.test.ts
@@ -0,0 +1,60 @@
+import { renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { useShowMultigresLogs } from './useShowMultigresLogs'
+
+const mockUseFlag = vi.fn()
+const mockUseIsHighAvailability = vi.fn()
+
+vi.mock('common', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('common')>()),
+  useFlag: (name: string) => mockUseFlag(name),
+}))
+
+vi.mock('./useSelectedProject', () => ({
+  useIsHighAvailability: () => mockUseIsHighAvailability(),
+}))
+
+describe('useShowMultigresLogs', () => {
+  beforeEach(() => {
+    mockUseFlag.mockReset()
+    mockUseIsHighAvailability.mockReset()
+  })
+
+  it('returns true only when the multigresLogs flag and high availability are both enabled', () => {
+    mockUseFlag.mockReturnValue(true)
+    mockUseIsHighAvailability.mockReturnValue(true)
+
+    const { result } = renderHook(() => useShowMultigresLogs())
+
+    expect(result.current).toBe(true)
+    expect(mockUseFlag).toHaveBeenCalledWith('multigresLogs')
+  })
+
+  it('returns false when the flag is off, even on a high availability project', () => {
+    mockUseFlag.mockReturnValue(false)
+    mockUseIsHighAvailability.mockReturnValue(true)
+
+    const { result } = renderHook(() => useShowMultigresLogs())
+
+    expect(result.current).toBe(false)
+  })
+
+  it('returns false when the project is not high availability, even with the flag on', () => {
+    mockUseFlag.mockReturnValue(true)
+    mockUseIsHighAvailability.mockReturnValue(false)
+
+    const { result } = renderHook(() => useShowMultigresLogs())
+
+    expect(result.current).toBe(false)
+  })
+
+  it('returns false when both the flag and high availability are off', () => {
+    mockUseFlag.mockReturnValue(false)
+    mockUseIsHighAvailability.mockReturnValue(false)
+
+    const { result } = renderHook(() => useShowMultigresLogs())
+
+    expect(result.current).toBe(false)
+  })
+})
diff --git a/apps/studio/hooks/misc/useShowMultigresLogs.ts b/apps/studio/hooks/misc/useShowMultigresLogs.ts
new file mode 100644
index 00000000000..7975cafb22e
--- /dev/null
+++ b/apps/studio/hooks/misc/useShowMultigresLogs.ts
@@ -0,0 +1,24 @@
+import { useFlag } from 'common'
+
+import { useIsHighAvailability } from './useSelectedProject'
+
+/**
+ * Whether to surface the Multigres logs collection (sidebar, page, and Field
+ * Reference source).
+ *
+ * Gated on both:
+ * - the `multigresLogs` feature flag, so rollout is decoupled from HA status
+ *   and the feature ships dark until explicitly enabled, and
+ * - the project's `high_availability` flag, since Multigres only runs on HA
+ *   projects.
+ *
+ * Note: `high_availability` is an existing product feature that predates
+ * Multigres, so the flag is required to avoid showing a broken collection to
+ * existing HA projects that don't have a `multigres_logs` table.
+ */
+export const useShowMultigresLogs = () => {
+  const multigresLogsEnabled = useFlag('multigresLogs')
+  const isHighAvailability = useIsHighAvailability()
+
+  return multigresLogsEnabled && isHighAvailability
+}
diff --git a/apps/studio/pages/project/[ref]/logs/multigres-logs.tsx b/apps/studio/pages/project/[ref]/logs/multigres-logs.tsx
new file mode 100644
index 00000000000..768b40b4a37
--- /dev/null
+++ b/apps/studio/pages/project/[ref]/logs/multigres-logs.tsx
@@ -0,0 +1,28 @@
+import { useParams } from 'common'
+
+import { LogsTableName } from '@/components/interfaces/Settings/Logs/Logs.constants'
+import { LogsPreviewer } from '@/components/interfaces/Settings/Logs/LogsPreviewer'
+import DefaultLayout from '@/components/layouts/DefaultLayout'
+import LogsLayout from '@/components/layouts/LogsLayout/LogsLayout'
+import type { NextPageWithLayout } from '@/types'
+
+export const LogPage: NextPageWithLayout = () => {
+  const { ref } = useParams()
+
+  return (
+    <LogsPreviewer
+      condensedLayout
+      queryType="multigres"
+      projectRef={ref as string}
+      tableName={LogsTableName.MULTIGRES}
+    />
+  )
+}
+
+LogPage.getLayout = (page) => (
+  <DefaultLayout>
+    <LogsLayout title="Multigres Logs">{page}</LogsLayout>
+  </DefaultLayout>
+)
+
+export default LogPage
diff --git a/packages/shared-data/log-constants.ts b/packages/shared-data/log-constants.ts
index 6ed5d53175c..a7c214981fb 100644
--- a/packages/shared-data/log-constants.ts
+++ b/packages/shared-data/log-constants.ts
@@ -12,6 +12,7 @@ type LogTable =
   | 'pgbouncer_logs'
   | 'pg_cron_logs'
   | 'pg_upgrade_logs'
+  | 'multigres_logs'
 
 type LogSchema = {
   name: string
@@ -324,6 +325,23 @@ const schemas: LogSchema[] = [
       { path: 'timestamp', type: 'datetime' },
     ],
   },
+  {
+    name: 'Multigres',
+    reference: 'multigres_logs',
+    fields: [
+      { path: 'cluster', type: 'string' },
+      { path: 'component', type: 'string' },
+      { path: 'event_message', type: 'string' },
+      { path: 'id', type: 'string' },
+      { path: 'namespace', type: 'string' },
+      { path: 'node_name', type: 'string' },
+      { path: 'pod_name', type: 'string' },
+      { path: 'project', type: 'string' },
+      { path: 'region', type: 'string' },
+      { path: 'stack', type: 'string' },
+      { path: 'timestamp', type: 'datetime' },
+    ],
+  },
 ]
 
 export default {

From 98e057242391dd54b9c7b5ea1fcf57754a910ddc Mon Sep 17 00:00:00 2001
From: Katerina Skroumpelou <mandarini@users.noreply.github.com>
Date: Wed, 3 Jun 2026 13:08:36 +0300
Subject: [PATCH 05/23] fix(docs): generate new reference pipeline output
 before embeddings (#46611)

The embeddings workflow started failing after #46163 with `ENOENT: ...
content/reference/javascript/v2/sections.json`. That PR routed the JS v2
search ingest through the new reference pipeline
(`loadClientLibReferenceFromNewPipeline` in
`apps/docs/scripts/search/sources/reference-doc.ts`), and updated
`predev` and `prebuild` to run both `codegen:references` and
`codegen:references:new`, but missed `preembeddings`. This chains
`codegen:references:new` into `preembeddings` so `pnpm run embeddings`
(and the `:nimbus` / `:refresh` variants that fan out to it) produces
the new pipeline output before the search ingest reads it.
---
 apps/docs/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/docs/package.json b/apps/docs/package.json
index eb7450ad900..baef799f723 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -31,7 +31,7 @@
     "postbuild": "pnpm run build:sitemap && pnpm run build:llms && ./../../scripts/upload-static-assets.sh",
     "prebuild": "pnpm run codegen:graphql && pnpm run codegen:references && pnpm run codegen:references:new && pnpm run codegen:examples && pnpm run build:guides-markdown && pnpm run build:gz-archive",
     "predev": "pnpm run codegen:graphql && pnpm run codegen:references && pnpm run codegen:references:new && pnpm run codegen:examples",
-    "preembeddings": "pnpm run codegen:references",
+    "preembeddings": "pnpm run codegen:references && pnpm run codegen:references:new",
     "preinstall": "npx only-allow pnpm",
     "presync": "pnpm run codegen:graphql",
     "pretest": "pnpm run codegen:examples",

From 9a78130e42db972cd52560fd94a027da2291d473 Mon Sep 17 00:00:00 2001
From: "Andrey A." <56412611+aantti@users.noreply.github.com>
Date: Wed, 3 Jun 2026 13:25:48 +0200
Subject: [PATCH 06/23] chore(self-hosted): update 2026-06-03 (#46610)

---
 docker/CHANGELOG.md               | 123 +++++++++++++++++++++---------
 docker/CONFIG.md                  |   2 +-
 docker/docker-compose.yml         |   2 +-
 docker/utils/add-new-auth-keys.sh |   2 +-
 docker/versions.md                |  89 +++++++++++----------
 5 files changed, 142 insertions(+), 76 deletions(-)

diff --git a/docker/CHANGELOG.md b/docker/CHANGELOG.md
index e4e98cb9820..0149332603a 100644
--- a/docker/CHANGELOG.md
+++ b/docker/CHANGELOG.md
@@ -2,10 +2,9 @@
 
 All notable changes to the Supabase self-hosted Docker configuration.
 
-Changes are grouped by service rather than by change type. See [versions.md](./versions.md) 
-for complete image version history and rollback information.
+Changes are grouped by service rather than by change type. See [versions.md](./versions.md) for complete image version history and rollback information.
 
-See per-service updates below for details.
+See per-service updates below for details. Only the most important changes relevant to [self-hosted Supabase](https://supabase.com/docs/guides/self-hosting) are included here. For the full list of changes, refer to the release notes and changelogs of each individual service.
 
 **Note:** Configuration updates marked with "requires [...] update" are already included in the latest version of the repository. Pull the latest changes or refer to the linked PR for manual updates. After updating `docker-compose.yml`, pull the latest images and recreate containers - use `docker compose pull && docker compose down && docker compose up -d`.
 
@@ -15,16 +14,74 @@ See per-service updates below for details.
 
 ⚠️ **Upcoming changes:** Check the main Supabase [changelog](https://github.com/orgs/supabase/discussions/categories/changelog?discussions_q=is%3Aopen+category%3AChangelog+label%3Aself-hosted) for updates:
 
-- [Making Analytics and Vector opt-in](https://github.com/orgs/supabase/discussions/46084)
 - [Upgrading from PG 15 to 17 (breaking change)](https://github.com/orgs/supabase/discussions/46080)
 - [Switching Studio from `supabase_admin` to `postgres` (breaking change)](https://github.com/orgs/supabase/discussions/46081)
 
 ---
 
+## [2026-06-03]
+
+⚠️ **Note:** This update includes **important changes**. Please check the details below.
+
+### Configuration
+- ⚠️ Logs and analytics are now [optional](https://github.com/orgs/supabase/discussions/46084) and were removed from the default `docker-compose.yml`. A new `docker-compose.logs.yml` override has been added. Check the main [configuration guide](https://supabase.com/docs/guides/self-hosting/docker#enabling-analytics) and the changes to Studio below for more information - PR [#45327](https://github.com/supabase/supabase/pull/45327) (via [@luizfelmach](https://github.com/luizfelmach/))
+- ⚠️ Added `COMPOSE_FILE` to `.env.example` for configuring compose overrides (also used by `run.sh`) - PR [#45603](https://github.com/supabase/supabase/pull/45603)
+
+### Documentation
+- Added a new [reference list](https://github.com/supabase/supabase/blob/master/docker/CONFIG.md) of all configuration environment variables - PR [#46124](https://github.com/supabase/supabase/pull/46124)
+- Updated the main installation and configuration [guide](https://supabase.com/docs/guides/self-hosting/docker) (added "quick start" path and opt-in for logs and analytics; removed the legacy JWT secrets generator) - PR [#46416](https://github.com/supabase/supabase/pull/46416), PR [#45359](https://github.com/supabase/supabase/pull/45359)
+- Updated the logs and analytics [how-to guide](https://supabase.com/docs/reference/self-hosting-analytics/introduction) - PR [#46452](https://github.com/supabase/supabase/pull/46452)
+
+### Utils
+- Added `setup.sh` and `run.sh` to support quick start and easier management of the compose configuration - PR [#45603](https://github.com/supabase/supabase/pull/45603)
+- Updated `utils/add-new-auth-keys.sh` and `utils/rotate-new-api-key.sh` to remove the dependency on OpenSSL and Node.js - PR [#45941](https://github.com/supabase/supabase/pull/45941)
+- Updated `tests/test-container-logs.sh` to skip checks for `kong`, `analytics` and `vector` when the services are not running - PR [#46099](https://github.com/supabase/supabase/pull/46099)
+
+### API gateway
+- Updated Envoy version to `1.38.0` (see `docker-compose.envoy.yml`) - PR [#46023](https://github.com/supabase/supabase/pull/46023)
+- Updated Envoy configuration to address a discrepancy in API key checking (requires `volumes/api/envoy` update) - PR [#46023](https://github.com/supabase/supabase/pull/46023)
+
+### Studio
+- Updated to `2026.06.03-sha-0bca601`
+- ⚠️ Added `ENABLED_FEATURES_LOGS_ALL` to Studio service configuration (requires `docker-compose.yml` update) - PR [#45327](https://github.com/supabase/supabase/pull/45327)
+- ⚠️ Added `SUPABASE_PUBLISHABLE_KEY` and `SUPABASE_SECRET_KEY` to Studio service configuration (requires `docker-compose.yml` update) - PR [#46173](https://github.com/supabase/supabase/pull/46173)
+- ⚠️ Added `start_period` to Studio healthcheck for more reliable cold-boot on slower hosts (requires `docker-compose.yml` update) - PR [#45327](https://github.com/supabase/supabase/pull/45327)
+- Fixed incorrect connection strings in the connect sheet for self-hosted environments - PR [#46217](https://github.com/supabase/supabase/pull/46217)
+- Updated project home and functions page, and added a minimal project settings implementation - PR [#46544](https://github.com/supabase/supabase/pull/46544), PR [#46550](https://github.com/supabase/supabase/pull/46550), PR [#46554](https://github.com/supabase/supabase/pull/46554)
+
+### Auth
+- Updated to `v2.189.0` - [Changelog](https://github.com/supabase/auth/blob/master/CHANGELOG.md) | [Release](https://github.com/supabase/auth/releases/tag/v2.189.0)
+- ⚠️ Added `GOTRUE_JWT_ISSUER` to Auth service configuration (requires `docker-compose.yml` update) - PR [#46020](https://github.com/supabase/supabase/pull/46020)
+
+### PostgREST
+- Updated to `v14.12` - [Changelog](https://github.com/PostgREST/postgrest/blob/main/CHANGELOG.md) | [Release](https://github.com/PostgREST/postgrest/releases/tag/v14.12)
+
+### Realtime
+- Updated to `v2.102.3` - [Release](https://github.com/supabase/realtime/releases/tag/v2.102.3)
+
+### Storage
+- Updated to `v1.60.4` - [Release](https://github.com/supabase/storage/releases/tag/v1.60.4)
+
+### Postgres Meta
+- Updated to `v0.96.6` - [Release](https://github.com/supabase/postgres-meta/releases/tag/v0.96.6)
+
+### Edge Runtime
+- Updated to `v1.74.0` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.74.0)
+
+### Supavisor
+- Updated to `2.9.5` - [Release](https://github.com/supabase/supavisor/releases/tag/v2.9.5)
+- Added `POSTGRES_HOST` to Supavisor service configuration (requires `docker-compose.yml` and `volumes/pooler/pooler.exs` update) - PR [#41273](https://github.com/supabase/supabase/pull/41273)
+
+### Analytics (Logflare)
+- Updated to `1.43.1` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.43.1)
+- ⚠️ Changed default `docker-compose.yml` to no longer include logs & analytics. Read more in Supabase's [changelog](https://github.com/orgs/supabase/discussions/46084) - PR [#45327](https://github.com/supabase/supabase/pull/45327)
+
+---
+
 ## [2026-04-27]
 
 ### Configuration
-- ⚠️ Added `docker-compose.envoy.yml` and `volumes/api/envoy` - PR [#43838](https://github.com/supabase/supabase/pull/43838). See also the API gateway updates below
+- ⚠️ Added `docker-compose.envoy.yml` and `volumes/api/envoy`. See also the API gateway updates below - PR [#43838](https://github.com/supabase/supabase/pull/43838)
 - ⚠️ Changed Studio healthcheck and some other configuration for better compatibility with Podman (requires `docker-compose.yml` update) - PR [#44754](https://github.com/supabase/supabase/pull/44754)
 - ⚠️ Changed Studio configuration to bind to all IPv4 interfaces only (requires `docker-compose.yml` update) - PR [#44772](https://github.com/supabase/supabase/pull/44772)
 
@@ -34,16 +91,15 @@ See per-service updates below for details.
 - Updated the main [setup guide](https://supabase.com/docs/guides/self-hosting/docker) and the how-tos to reflect the state of the self-hosted Supabase configuration - PR [#45011](https://github.com/supabase/supabase/pull/45011)
 
 ### Utils
-- ⚠️ Added `reassign-owner.sh` to update database objects - PR [#42975](https://github.com/supabase/supabase/pull/42975). Read more in the "[Remove superuser access](https://supabase.com/docs/guides/self-hosting/remove-superuser-access)" how-to guide
-- ⚠️ Changed `add-new-auth-keys.sh` to also update `docker-compose.yml` - PR [#45056](https://github.com/supabase/supabase/pull/45056)
-
-### Studio
-- Updated to `2026.04.27-sha-5f60601`
-- ⚠️ Added 4 new lints to the Security Advisor - PR [#45253](https://github.com/supabase/supabase/pull/45253), PR [#45260](https://github.com/supabase/supabase/pull/45260). Read more about lint rules 0026 - 0029 in the [Performance and Security Advisors](https://supabase.com/docs/guides/database/database-advisors?queryGroups=lint&lint=0026_pg_graphql_anon_table_exposed) section of the Supabase documentation
+- ⚠️ Added `utils/reassign-owner.sh` to update database objects. Read more in the "[Remove superuser access](https://supabase.com/docs/guides/self-hosting/remove-superuser-access)" how-to guide - PR [#42975](https://github.com/supabase/supabase/pull/42975)
+- ⚠️ Changed `utils/add-new-auth-keys.sh` to also update `docker-compose.yml` - PR [#45056](https://github.com/supabase/supabase/pull/45056)
 
 ### API gateway
 - ⚠️ Added Envoy as the new optional API gateway (requires `docker-compose.envoy.yml`, `volumes/api/envoy`, and `volumes/logs/vector.yml` update) - PR [#43838](https://github.com/supabase/supabase/pull/43838) (via [@luizfelmach](https://github.com/luizfelmach/))
 
+### Studio
+- Updated to `2026.04.27-sha-5f60601`
+- ⚠️ Added 4 new lints to the Security Advisor. Read more about lint rules 0026 - 0029 in the [Performance and Security Advisors](https://supabase.com/docs/guides/database/database-advisors?queryGroups=lint&lint=0026_pg_graphql_anon_table_exposed) section of the Supabase documentation - PR [#45253](https://github.com/supabase/supabase/pull/45253), PR [#45260](https://github.com/supabase/supabase/pull/45260)
 ---
 
 ## [2026-04-08]
@@ -52,14 +108,14 @@ See per-service updates below for details.
 - Added new how-to guides for configuring [custom email templates](https://supabase.com/docs/guides/self-hosting/custom-email-templates), setting up [SAML SSO](https://supabase.com/docs/guides/self-hosting/self-hosted-saml-sso), and [using Postgres 17](https://supabase.com/docs/guides/self-hosting/postgres-upgrade-17) - PR [#42832](https://github.com/supabase/supabase/pull/42832), PR [#43386](https://github.com/supabase/supabase/pull/43386), PR [#44147](https://github.com/supabase/supabase/pull/44147)
 
 ### Utils
-- ⚠️ Added `upgrade-pg17.sh` - PR [#44147](https://github.com/supabase/supabase/pull/44147). Read more in the "[Upgrade to Postgres 17](https://supabase.com/docs/guides/self-hosting/postgres-upgrade-17)" how-to guide
-
-### Studio
-- Updated to `2026.04.08-sha-205cbe7`
+- ⚠️ Added `utils/upgrade-pg17.sh`. Read more in the "[Upgrade to Postgres 17](https://supabase.com/docs/guides/self-hosting/postgres-upgrade-17)" how-to guide - PR [#44147](https://github.com/supabase/supabase/pull/44147)
 
 ### API gateway
 - ⚠️ Added configuration for SAML SSO (requires `.env`, `docker-compose.yml` and `volumes/api/kong.yml` update) - PR [#43385](https://github.com/supabase/supabase/pull/43385) (via [@luizfelmach](https://github.com/luizfelmach/))
 
+### Studio
+- Updated to `2026.04.08-sha-205cbe7`
+
 ### PostgREST
 - Updated to `v14.8` - [Changelog](https://github.com/PostgREST/postgrest/blob/main/CHANGELOG.md) | [Release](https://github.com/PostgREST/postgrest/releases/tag/v14.8)
 
@@ -73,11 +129,11 @@ See per-service updates below for details.
 - Updated to `v0.96.3` - [Release](https://github.com/supabase/postgres-meta/releases/tag/v0.96.3)
 
 ### Analytics (Logflare)
-- Updated to `v1.36.1` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.36.1)
+- Updated to `1.36.1` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.36.1)
 
 ### Postgres
 - ⚠️ Added `docker-compose.pg17.yml` override - PR [#44147](https://github.com/supabase/supabase/pull/44147)
-- ⚠️ Added `upgrade-pg17.sh` - PR [#44147](https://github.com/supabase/supabase/pull/44147)
+- ⚠️ Added `utils/upgrade-pg17.sh` - PR [#44147](https://github.com/supabase/supabase/pull/44147)
 - ⚠️ Added [documentation](https://supabase.com/docs/guides/self-hosting/postgres-upgrade-17) explaining the upgrade to Postgres 17
 
 ---
@@ -87,15 +143,15 @@ See per-service updates below for details.
 ⚠️ **Note:** This update includes **important changes**. Please check the details below. The following configuration files have been added/updated: `utils/add-new-auth-keys.sh`, `utils/rotate-new-api-keys.sh`, `docker-compose.yml`, `.env.example`, `docker-compose.s3.yml`, `docker-compose.rustfs.yml`, `volumes/api/kong.yml`, `volumes/api/kong-entrypoint.sh`, `docker-compose.caddy.yml`, `docker-compose.nginx.yml`, `volumes/functions/main/index.ts`, and `volumes/proxy`.
 
 ### Configuration
-- ⚠️ Added scripts and templates to support the new API key format (`sb_` API keys) and the new asymmetric authentication - PR [#43554](https://github.com/supabase/supabase/pull/43554); see the [how-to guide](https://supabase.com/docs/guides/self-hosting/self-hosted-auth-keys) for detailed instructions
-- Added optional proxy configuration for Caddy and nginx - PR [#43291](https://github.com/supabase/supabase/pull/43291); read the [how-to guide](https://supabase.com/docs/guides/self-hosting/self-hosted-proxy-https) to learn more
+- ⚠️ Added scripts and templates to support the new API key format (`sb_` API keys) and the new asymmetric authentication. Check the [how-to guide](https://supabase.com/docs/guides/self-hosting/self-hosted-auth-keys) for detailed instructions - PR [#43554](https://github.com/supabase/supabase/pull/43554)
+- Added optional proxy configuration for Caddy and nginx. Read the [how-to guide](https://supabase.com/docs/guides/self-hosting/self-hosted-proxy-https) to learn more - PR [#43291](https://github.com/supabase/supabase/pull/43291)
 
 ### Documentation
 - Added several new how-to guides to the self-hosted Supabase [documentation](https://supabase.com/docs/guides/self-hosting) - PR [#42745](https://github.com/supabase/supabase/pull/42745), PR [#42953](https://github.com/supabase/supabase/pull/42953), PR [#43177](https://github.com/supabase/supabase/pull/43177), PR [#43286](https://github.com/supabase/supabase/pull/43286), PR [#43293](https://github.com/supabase/supabase/pull/43293)
 
 ### Utils and tests
-- Added `add-new-auth-keys.sh` and `rotate-new-api-keys.sh` - PR [#43554](https://github.com/supabase/supabase/pull/43554)
-- Added `./tests` with 100+ test cases - PR [#43573](https://github.com/supabase/supabase/pull/43573)
+- Added `utils/add-new-auth-keys.sh` and `utils/rotate-new-api-keys.sh` - PR [#43554](https://github.com/supabase/supabase/pull/43554)
+- Added `tests/` with 100+ test cases - PR [#43573](https://github.com/supabase/supabase/pull/43573)
 
 ### Studio
 - Updated to `2026.03.16-sha-5528817`
@@ -112,7 +168,6 @@ See per-service updates below for details.
 - Updated to `v14.6` - [Changelog](https://github.com/PostgREST/postgrest/blob/main/CHANGELOG.md) | [Release](https://github.com/PostgREST/postgrest/releases/tag/v14.6)
 
 ### Realtime
-
 - ⚠️ Added **mandatory** `METRICS_JWT_SECRET` environment variable (requires `docker-compose.s3.yml` update) - PR [realtime#1729](https://github.com/supabase/realtime/pull/1729)
 
 ### Storage
@@ -172,7 +227,7 @@ See per-service updates below for details.
 - Updated to `v1.70.3` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.70.3)
 
 ### Analytics (Logflare)
-- Updated to `v1.31.2` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.31.2)
+- Updated to `1.31.2` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.31.2)
 - ⚠️ Changed default configuration to disable Logflare on `0.0.0.0:4000` to prevent access to `/dashboard` (requires `docker-compose.yml` update). Read more in the "Production Recommendations" section of Logflare [documentation](https://supabase.com/docs/reference/self-hosting-analytics/introduction) - PR [#42857](https://github.com/supabase/supabase/pull/42857)
 - ⚠️ Changed Kong routes to not include `/analytics/v1` by default (requires `/volumes/api/kong.yml` update) - PR [#42857](https://github.com/supabase/supabase/pull/42857)
 
@@ -225,7 +280,7 @@ See per-service updates below for details.
 - Updated to `v1.70.0` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.70.0)
 
 ### Analytics (Logflare)
-- Updated to `v1.30.3` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.30.3)
+- Updated to `1.30.3` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.30.3)
 
 ### Postgres
 - No image update
@@ -239,8 +294,8 @@ See per-service updates below for details.
 - Updated self-hosting installation and configuration guide - PR [#40901](https://github.com/supabase/supabase/pull/40901), PR [#41438](https://github.com/supabase/supabase/pull/41438)
 
 ### Utils
-- Added `generate-keys.sh` - PR [#41363](https://github.com/supabase/supabase/pull/41363)
-- Added `db-passwd.sh` - PR [#41432](https://github.com/supabase/supabase/pull/41432)
+- Added `utils/generate-keys.sh` - PR [#41363](https://github.com/supabase/supabase/pull/41363)
+- Added `utils/db-passwd.sh` - PR [#41432](https://github.com/supabase/supabase/pull/41432)
 - Changed `reset.sh` to POSIX and added more checks - PR [#41361](https://github.com/supabase/supabase/pull/41361)
 
 ### Studio
@@ -258,7 +313,7 @@ See per-service updates below for details.
 - Updated to `v0.95.1` - [Release](https://github.com/supabase/postgres-meta/releases/tag/v0.95.1)
 
 ### Analytics (Logflare)
-- Updated to `v1.27.0` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.27.0)
+- Updated to `1.27.0` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.27.0)
 - Fixed multiple issues, including a race condition
 
 ---
@@ -287,7 +342,7 @@ See per-service updates below for details.
 - Updated to `v1.69.28` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.69.28)
 
 ### Analytics (Logflare)
-- Updated to `v1.26.25` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.26.25)
+- Updated to `1.26.25` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.26.25)
 
 ---
 
@@ -312,7 +367,7 @@ See per-service updates below for details.
 - Updated to `v2.65.3` - [Release](https://github.com/supabase/realtime/releases/tag/v2.65.3)
 
 ### Analytics (Logflare)
-- Updated to `v1.26.13` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.26.13)
+- Updated to `1.26.13` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.26.13)
 - Fixed crashdump when `POSTGRES_BACKEND_URL` is malformed - PR [logflare#2954](https://github.com/Logflare/logflare/pull/2954)
 
 ---
@@ -340,7 +395,7 @@ See per-service updates below for details.
 - Updated to `v1.69.25` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.69.25)
 
 ### Analytics (Logflare)
-- Updated to `v1.26.12` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.26.12)
+- Updated to `1.26.12` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.26.12)
 - Fixed Auth logs query - PR [logflare#2936](https://github.com/Logflare/logflare/pull/2936)
 - Fixed build configuration to prevent crashes with "Illegal instruction (core dumped)" - PR [logflare#2942](https://github.com/Logflare/logflare/pull/2942)
 
@@ -374,7 +429,7 @@ See per-service updates below for details.
 - Updated to `v1.69.23` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.69.23)
 
 ### Supavisor
-- Updated to `v2.7.4` - [Release](https://github.com/supabase/supavisor/releases/tag/v2.7.4)
+- Updated to `2.7.4` - [Release](https://github.com/supabase/supavisor/releases/tag/v2.7.4)
 
 ---
 
@@ -438,14 +493,14 @@ See per-service updates below for details.
 - Updated to `v1.69.14` - [Release](https://github.com/supabase/edge-runtime/releases/tag/v1.69.14)
 
 ### Supavisor
-- Updated to `v2.7.3` - [Release](https://github.com/supabase/supavisor/releases/tag/v2.7.3)
+- Updated to `2.7.3` - [Release](https://github.com/supabase/supavisor/releases/tag/v2.7.3)
 
 ---
 
 ## [2025-10-13]
 
 ### Analytics (Logflare)
-- Updated to `v1.22.6` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.22.6)
+- Updated to `1.22.6` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.22.6)
 
 ---
 
@@ -472,7 +527,7 @@ See per-service updates below for details.
 - Updated to `v0.91.6` - [Release](https://github.com/supabase/postgres-meta/releases/tag/v0.91.6)
 
 ### Analytics (Logflare)
-- Updated to `v1.22.4` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.22.4)
+- Updated to `1.22.4` - [Release](https://github.com/Logflare/logflare/releases/tag/v1.22.4)
 
 ### Postgres
 - Updated to `15.8.1.085` - [Release](https://github.com/supabase/postgres/releases/tag/15.8.1.085)
diff --git a/docker/CONFIG.md b/docker/CONFIG.md
index 025da3430e3..d139fc984e6 100644
--- a/docker/CONFIG.md
+++ b/docker/CONFIG.md
@@ -850,7 +850,7 @@ The fields below are repeated for each provider. Substitute `<PROVIDER>` with on
 
 | Variable | Type | Set by | Description | Notes |
 |---|---|---|---|---|
-| `API_JWT_JWKS` | JWT | Both | JWKS JSON used to verify tenant JWTs during self-host seeding. Read by `priv/repo/seeds.exs` and `priv/repo/dev_seeds.exs`. | Used only by the seed script (`SEED_SELF_HOST=true`). Required when using the new API keys and new auth. |
+| `API_JWT_JWKS` | JWKS | Both | JSON Web Key Set used to verify tenant JWTs during self-host seeding. Read by `priv/repo/seeds.exs` and `priv/repo/dev_seeds.exs`. | Used only by the seed script (`SEED_SELF_HOST=true`). Required when using the new API keys and new auth. |
 | `API_JWT_SECRET` | string | Both | Symmetric HS256 secret used to sign tokens for the tenant management API and the default self-host tenant. | Required for the tenant management API in production. |
 | `API_TOKEN_BLOCKLIST` | string (CSV) | Self-hosted | Comma-separated list of tokens blocked from tenant management API access. | Default: empty list. |
 | `APP_NAME` | string | Both | Application/node name. Used to build the Phoenix endpoint URL host, libcluster DNS basename, and Erlang `RELEASE_NODE`. | Required - raises `APP_NAME not available` if empty. Default: empty (build) / `realtime` (Erlang release script). |
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 3f7ea8bfa90..3e522ccd67d 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -14,7 +14,7 @@ services:
 
   studio:
     container_name: supabase-studio
-    image: supabase/studio:2026.06.01-sha-a4334a2
+    image: supabase/studio:2026.06.03-sha-0bca601
     restart: unless-stopped
     healthcheck:
       test:
diff --git a/docker/utils/add-new-auth-keys.sh b/docker/utils/add-new-auth-keys.sh
index 67a28486441..b728237b7c0 100644
--- a/docker/utils/add-new-auth-keys.sh
+++ b/docker/utils/add-new-auth-keys.sh
@@ -163,7 +163,7 @@ echo "JWT_KEYS=${JWT_KEYS}"
 echo ""
 echo "JWT_JWKS=${JWT_JWKS}"
 echo ""
-echo "To enable asymmetric key pair, the following should be enabled in docker-compose.yml:"
+echo "Ensure the following configuration is uncommented in docker-compose.yml for the asymmetric key pair to work:"
 echo ""
 echo "  Auth:     GOTRUE_JWT_KEYS: \${JWT_KEYS:-[]}"
 echo "  Realtime: API_JWT_JWKS: \${JWT_JWKS:-{\"keys\":[]}}"
diff --git a/docker/versions.md b/docker/versions.md
index 9f330dd5583..ee520129b25 100644
--- a/docker/versions.md
+++ b/docker/versions.md
@@ -1,5 +1,16 @@
 # Docker Image Versions
 
+## 2026-06-03
+- supabase/studio:2026.06.03-sha-0bca601 (prev supabase/studio:2026.04.27-sha-5f60601)
+- supabase/gotrue:v2.189.0 (prev supabase/gotrue:v2.186.0)
+- postgrest/postgrest:v14.12 (prev postgrest/postgrest:v14.8)
+- supabase/realtime:v2.102.3 (prev supabase/realtime:v2.76.5)
+- supabase/storage-api:v1.60.4 (prev supabase/storage-api:v1.48.26)
+- supabase/postgres-meta:v0.96.6 (prev supabase/postgres-meta:v0.96.3)
+- supabase/edge-runtime:v1.74.0 (prev supabase/edge-runtime:v1.71.2)
+- supabase/supavisor:2.9.5 (prev supabase/supavisor:2.7.4)
+- supabase/logflare:1.43.1 (prev supabase/logflare:1.36.1)
+
 ## 2026-04-27
 - supabase/studio:2026.04.27-sha-5f60601 (prev supabase/studio:2026.04.08-sha-205cbe7)
 
@@ -69,56 +80,56 @@
 - supabase/logflare:1.26.12 (prev supabase/logflare:1.22.6)
 
 ## 2025-11-12
-- supabase/studio:2025.11.10-sha-5291fe3 (prev 2025.10.27-sha-85b84e0)
-- supabase/gotrue:v2.182.1 (prev v2.180.0)
-- supabase/realtime:v2.63.0 (prev v2.57.2)
-- supabase/storage-api:v1.29.0 (prev v1.28.2)
-- supabase/edge-runtime:v1.69.23 (prev v1.69.15)
-- supabase/supavisor:2.7.4 (prev 2.7.3)
+- supabase/studio:2025.11.10-sha-5291fe3 (prev supabase/studio:2025.10.27-sha-85b84e0)
+- supabase/gotrue:v2.182.1 (prev supabase/gotrue:v2.180.0)
+- supabase/realtime:v2.63.0 (prev supabase/realtime:v2.57.2)
+- supabase/storage-api:v1.29.0 (prev supabase/storage-api:v1.28.2)
+- supabase/edge-runtime:v1.69.23 (prev supabase/edge-runtime:v1.69.15)
+- supabase/supavisor:2.7.4 (prev supabase/supavisor:2.7.3)
 
 ## 2025-10-28
-- supabase/studio:2025.10.27-sha-85b84e0 (prev 2025.10.20-sha-5005fc6)
-- supabase/realtime:v2.57.2 (prev v2.56.0)
-- supabase/storage-api:v1.28.2 (prev v1.28.1)
-- supabase/postgres-meta:v0.93.1 (prev v0.93.0)
-- supabase/edge-runtime:v1.69.15 (prev v1.69.14)
+- supabase/studio:2025.10.27-sha-85b84e0 (prev supabase/studio:2025.10.20-sha-5005fc6)
+- supabase/realtime:v2.57.2 (prev supabase/realtime:v2.56.0)
+- supabase/storage-api:v1.28.2 (prev supabase/storage-api:v1.28.1)
+- supabase/postgres-meta:v0.93.1 (prev supabase/postgres-meta:v0.93.0)
+- supabase/edge-runtime:v1.69.15 (prev supabase/edge-runtime:v1.69.14)
 
 ## 2025-10-21
-- supabase/studio:2025.10.20-sha-5005fc6 (prev 2025.10.01-sha-8460121)
-- supabase/realtime:v2.56.0 (prev v2.51.11)
-- supabase/storage-api:v1.28.1 (prev v1.28.0)
-- supabase/postgres-meta:v0.93.0 (prev v0.91.6)
-- supabase/edge-runtime:v1.69.14 (prev v1.69.6)
-- supabase/supavisor:2.7.3 (prev 2.7.0)
+- supabase/studio:2025.10.20-sha-5005fc6 (prev supabase/studio:2025.10.01-sha-8460121)
+- supabase/realtime:v2.56.0 (prev supabase/realtime:v2.51.11)
+- supabase/storage-api:v1.28.1 (prev supabase/storage-api:v1.28.0)
+- supabase/postgres-meta:v0.93.0 (prev supabase/postgres-meta:v0.91.6)
+- supabase/edge-runtime:v1.69.14 (prev supabase/edge-runtime:v1.69.6)
+- supabase/supavisor:2.7.3 (prev supabase/supavisor:2.7.0)
 
 ## 2025-10-13
-- supabase/logflare:1.22.6 (prev 1.22.4)
+- supabase/logflare:1.22.6 (prev supabase/logflare:1.22.4)
 
 ## 2025-10-08
-- supabase/studio:2025.10.01-sha-8460121 (prev 2025.06.30-sha-6f5982d)
-- supabase/gotrue:v2.180.0 (prev v2.177.0)
-- postgrest/postgrest:v13.0.7 (prev v12.2.12)
-- supabase/realtime:v2.51.11 (prev v2.34.47)
-- supabase/storage-api:v1.28.0 (prev v1.25.7)
-- supabase/postgres-meta:v0.91.6 (prev v0.91.0)
-- supabase/logflare:1.22.4 (prev 1.14.2)
-- supabase/postgres:15.8.1.085 (prev 15.8.1.060)
-- supabase/supavisor:2.7.0 (prev 2.5.7)
+- supabase/studio:2025.10.01-sha-8460121 (prev supabase/studio:2025.06.30-sha-6f5982d)
+- supabase/gotrue:v2.180.0 (prev supabase/gotrue:v2.177.0)
+- postgrest/postgrest:v13.0.7 (prev postgrest/postgrest:v12.2.12)
+- supabase/realtime:v2.51.11 (prev supabase/realtime:v2.34.47)
+- supabase/storage-api:v1.28.0 (prev supabase/storage-api:v1.25.7)
+- supabase/postgres-meta:v0.91.6 (prev supabase/postgres-meta:v0.91.0)
+- supabase/logflare:1.22.4 (prev supabase/logflare:1.14.2)
+- supabase/postgres:15.8.1.085 (prev supabase/postgres:15.8.1.060)
+- supabase/supavisor:2.7.0 (prev supabase/supavisor:2.5.7)
 
 ## 2025-07-15
-- supabase/gotrue:v2.177.0 (prev v2.176.1)
-- supabase/storage-api:v1.25.7 (prev v1.24.7)
-- supabase/postgres-meta:v0.91.0 (prev v0.89.3)
-- supabase/supavisor:2.5.7 (prev 2.5.6)
+- supabase/gotrue:v2.177.0 (prev supabase/gotrue:v2.176.1)
+- supabase/storage-api:v1.25.7 (prev supabase/storage-api:v1.24.7)
+- supabase/postgres-meta:v0.91.0 (prev supabase/postgres-meta:v0.89.3)
+- supabase/supavisor:2.5.7 (prev supabase/supavisor:2.5.6)
 
 ## 2025-07-02
-- supabase/studio:2025.06.30-sha-6f5982d (prev 2025.06.02-sha-8f2993d)
-- supabase/gotrue:v2.176.1 (prev v2.174.0)
-- supabase/storage-api:v1.24.7 (prev v1.23.0)
-- supabase/supavisor:2.5.6 (prev 2.5.1)
+- supabase/studio:2025.06.30-sha-6f5982d (prev supabase/studio:2025.06.02-sha-8f2993d)
+- supabase/gotrue:v2.176.1 (prev supabase/gotrue:v2.174.0)
+- supabase/storage-api:v1.24.7 (prev supabase/storage-api:v1.23.0)
+- supabase/supavisor:2.5.6 (prev supabase/supavisor:2.5.1)
 
 ## 2025-06-03
-- supabase/studio:2025.06.02-sha-8f2993d (prev 2025.05.19-sha-3487831)
-- supabase/gotrue:v2.174.0 (prev v2.172.1)
-- supabase/storage-api:v1.23.0 (prev v1.22.17)
-- supabase/postgres-meta:v0.89.3 (prev v0.89.0)
+- supabase/studio:2025.06.02-sha-8f2993d (prev supabase/studio:2025.05.19-sha-3487831)
+- supabase/gotrue:v2.174.0 (prev supabase/gotrue:v2.172.1)
+- supabase/storage-api:v1.23.0 (prev supabase/storage-api:v1.22.17)
+- supabase/postgres-meta:v0.89.3 (prev supabase/postgres-meta:v0.89.0)

From 19e6e17257d489c67161184fed3a56f4915e750b Mon Sep 17 00:00:00 2001
From: Tina Ha <tina.ha@supabase.io>
Date: Wed, 3 Jun 2026 08:02:48 -0400
Subject: [PATCH 07/23] docs(access-control): footnote first-branch admin
 requirement for git flow (#46473)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

  Docs update

  ## What is the current behavior?

The access-control permissions matrix shows Developer-role users can
create development branches, but doesn't mention the implicit
production-branch registration step that runs on the first "Create
branch" click for a gitless project — which is
Owner/Administrator only. Customers reading the matrix conclude
Developers can branch from the start; in reality, an
Owner/Administrator has to perform the first branch creation to register
the production branch.

  ## What is the new behavior?

Adds a footnote on the "Development Branches → Create" row that flags
the one-time first-branch admin requirement and links to the
dashboard branching guide for the full explanation. Short cross-link
only — long-form mechanism explanation lives on the dashboard
  branching guide (companion PR #46471).

  ## Additional context

- Companion PR adding the long-form admonition on the branching guide
page: #46471

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Clarified branching permissions for dashboard (gitless) workflows: the
first branch creation (one-time) without a GitHub integration requires
Owner or Administrator to register the production branch; after that
initial step, Developers may create, update, and delete branches as
normal.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
---
 apps/docs/content/guides/platform/access-control.mdx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/docs/content/guides/platform/access-control.mdx b/apps/docs/content/guides/platform/access-control.mdx
index e3490f0d70c..73bea005159 100644
--- a/apps/docs/content/guides/platform/access-control.mdx
+++ b/apps/docs/content/guides/platform/access-control.mdx
@@ -264,7 +264,7 @@ The table below shows the actions each role can take on the resources belonging
 | Production Branch                                                                                      | Read                   | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |             <IconCheck size={14} color="#3FCF8E" />             |
 |                                                                                                        | Write                  | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |                       <IconX size={14} />                       |
 | Development Branches                                                                                   | List                   | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |             <IconCheck size={14} color="#3FCF8E" />             |
-|                                                                                                        | Create                 | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |                       <IconX size={14} />                       |
+|                                                                                                        | Create[^8]             | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |                       <IconX size={14} />                       |
 |                                                                                                        | Update                 | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |                       <IconX size={14} />                       |
 |                                                                                                        | Delete                 | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> | <IconCheck size={14} color="#3FCF8E" /> |                       <IconX size={14} />                       |
 
@@ -281,3 +281,5 @@ The table below shows the actions each role can take on the resources belonging
 [^6]: Listed permissions are for the API and Dashboard.
 
 [^7]: Limited to executing SELECT queries. SQL Query Snippets run by the Read-Only role are run against the database using the **supabase_read_only_user**. This role has the [predefined Postgres role pg_read_all_data](https://www.postgresql.org/docs/current/predefined-roles.html).
+
+[^8]: When using dashboard branching without a GitHub integration, the first branch creation also registers the project's production branch — a one-time step that requires Owner or Administrator. See [Branching via the dashboard](/docs/guides/deployment/branching/dashboard) for details. Developers can create, update, and delete branches normally after that.

From 87f880e6696cba968052d29bd91663d2ecc1391f Mon Sep 17 00:00:00 2001
From: Katerina Skroumpelou <mandarini@users.noreply.github.com>
Date: Wed, 3 Jun 2026 15:40:53 +0300
Subject: [PATCH 08/23] docs: add guide on reading error.hint in supabase-js
 (#46556)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New guide at `/guides/api/handling-errors-in-supabase-js` that leads
with `error.hint` as the most useful field on a Postgres error. When the
database knows the fix (a `GRANT` statement to run for a `42501`, a
column name you probably meant), it puts the literal SQL in `hint`.
Logging only `error.message` hides it.

The guide covers the `PostgrestError` shape (fields ordered by
usefulness: hint first, message last), branching on `error.code`, and
parallel patterns for Auth, Storage, Edge Functions, and Realtime.
Linked from the API > Guides sidebar next to the existing PostgREST
error codes reference.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added a comprehensive guide on handling errors in supabase-js,
explaining the {data, error} pattern and recommending logging full error
objects.
* Provides a recommended error-handling pattern, guidance to branch on
error codes, and example error fields.
* Adds component-specific advice for Auth, Storage, Edge Functions, and
Realtime, plus a “Related” links section.
* Added a navigation entry so the guide appears in the API guides
submenu.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../NavigationMenu.constants.ts               |   4 +
 .../api/handling-errors-in-supabase-js.mdx    | 145 ++++++++++++++++++
 2 files changed, 149 insertions(+)
 create mode 100644 apps/docs/content/guides/api/handling-errors-in-supabase-js.mdx

diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
index 86b77a82876..55bef3f1bf7 100644
--- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
+++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
@@ -1571,6 +1571,10 @@ export const api: NavMenuConstant = {
         { name: 'Generating TypeScript Types', url: '/guides/api/rest/generating-types' },
         { name: 'Generating Python Types', url: '/guides/api/rest/generating-python-types' },
         { name: 'Error Codes', url: '/guides/api/rest/postgrest-error-codes' },
+        {
+          name: 'Handling Errors in supabase-js',
+          url: '/guides/api/handling-errors-in-supabase-js',
+        },
       ],
     },
     {
diff --git a/apps/docs/content/guides/api/handling-errors-in-supabase-js.mdx b/apps/docs/content/guides/api/handling-errors-in-supabase-js.mdx
new file mode 100644
index 00000000000..3e816f35b86
--- /dev/null
+++ b/apps/docs/content/guides/api/handling-errors-in-supabase-js.mdx
@@ -0,0 +1,145 @@
+---
+id: handling-errors-in-supabase-js
+title: 'Handling errors in `supabase-js`'
+subtitle: 'Read `error.hint` first — Postgres often tells you the exact fix. Log the full error so you actually see it.'
+---
+
+Every `supabase-js` call returns a `{ data, error }` pair instead of throwing. When something fails, the single most useful field on `error` is usually `hint` — Postgres returns the _fix_, not just a description of the problem. Logging only `error.message` hides it.
+
+## Usage of `message` and `hint` properties
+
+Consider a `42501` permission-denied error on a table where default `GRANT`s have been revoked from `anon`:
+
+```
+message: "permission denied for table users"
+hint:    "Grant the required privileges to the current role with: GRANT SELECT ON public.users TO anon;"
+```
+
+The `message` exposes the error reason, and `hint` gives you the literal SQL statement to run in the dashboard SQL editor to fix it.
+
+The same pattern shows up across many Postgres errors — missing column? `hint` suggests the column name you probably meant. Type mismatch? `hint` shows the expected type. Whenever Postgres knows the fix, it puts it in `hint`.
+
+<Admonition type="tip">Log the full `error` object, not just `error.message`.</Admonition>
+
+## The recommended pattern
+
+Read `{ data, error }` from the response, check `error`, log the whole object, and return early.
+
+```ts
+const { data, error } = await supabase.from('users').select()
+if (error) {
+  console.error(error)
+  return
+}
+```
+
+In the case of a permission-denied error, the response body will look like this:
+
+```json
+{
+  "error": {
+    "code": "42501",
+    "message": "permission denied for table users",
+    "details": null,
+    "hint": "Grant the required privileges to the current role with: GRANT SELECT ON public.users TO anon;"
+  },
+  "status": 401,
+  "statusText": "Unauthorized"
+}
+```
+
+`postgrest-js` passes the body through verbatim, so `error.hint` is the exact string Postgres produced. Treat it as the answer the database is giving you, not as a suggestion to file away.
+
+## The `PostgrestError` fields, by usefulness
+
+Database calls (`select`, `insert`, `update`, `upsert`, `delete`, `rpc`) return a `PostgrestError` with four fields. Read them in roughly this order:
+
+| Field     | Read it when                                                                                                       |
+| --------- | ------------------------------------------------------------------------------------------------------------------ |
+| `hint`    | Always check first. When Postgres includes one, it's the actionable fix (a `GRANT` to run, a column name, a type). |
+| `code`    | When branching in code. Codes are stable across versions; `message` text isn't.                                    |
+| `details` | When `hint` and `message` aren't enough. Often contains the offending value, key, or row.                          |
+| `message` | As the human summary. Useful in UI strings, less useful for debugging.                                             |
+
+A full list of PostgREST error codes is in the [Error Codes reference](/guides/api/rest/postgrest-error-codes).
+
+## Branch on `error.code`, not `error.message`
+
+`error.code` is more reliable than `error.message` for programmatic branching: messages change between Postgres and PostgREST versions, but codes are stable.
+
+```ts
+const { data, error } = await supabase.from('users').select()
+if (error) {
+  console.error(error)
+  if (error.code === '42501') {
+    // Permission denied. error.hint usually contains the GRANT to run.
+  }
+  return
+}
+```
+
+## Errors from Auth, Storage, and Edge Functions
+
+The same rule applies across the SDK — log the whole error object — but the shape differs by client.
+
+### Auth
+
+`AuthError` exposes `error.code` (e.g. `'invalid_credentials'`, `'email_not_confirmed'`) and `error.status`. Branch on `code`; log the whole thing.
+
+```ts
+const { data, error } = await supabase.auth.signInWithPassword({
+  email: 'example@email.com',
+  password: 'example-password',
+})
+if (error) {
+  console.error(error)
+  return
+}
+```
+
+### Storage
+
+`StorageError` exposes `error.statusCode` (HTTP status as a string) and a structured `error` name (e.g. `'Duplicate'`, `'NotFound'`).
+
+```ts
+const { data, error } = await supabase.storage
+  .from('avatars')
+  .upload('public/avatar1.png', avatarFile)
+if (error) {
+  console.error(error)
+  return
+}
+```
+
+### Edge Functions
+
+Functions errors arrive as one of three subclasses. Narrow with `instanceof`; for `FunctionsHttpError`, parse the body to get the function's own error payload.
+
+```ts
+import { FunctionsFetchError, FunctionsHttpError, FunctionsRelayError } from '@supabase/supabase-js'
+
+const { data, error } = await supabase.functions.invoke('hello')
+if (error instanceof FunctionsHttpError) {
+  console.error('Function error', await error.context.json())
+} else if (error) {
+  console.error(error)
+}
+```
+
+### Realtime
+
+The `subscribe()` callback receives a `status` and, on failure, an `err` argument. Log the whole `err` — its `cause` often holds the underlying reason.
+
+```ts
+supabase.channel('room1').subscribe((status, err) => {
+  if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT') {
+    console.error(status, err)
+  }
+})
+```
+
+## Related
+
+- [PostgREST Error Codes](/guides/api/rest/postgrest-error-codes)
+- [Automatic retries with `supabase-js`](/guides/api/automatic-retries-in-supabase-js)
+- [Securing your API](/guides/api/securing-your-api)

From f8a3a2e28c0235242a10fd77236fc31d28974d88 Mon Sep 17 00:00:00 2001
From: Pamela Chia <pamelachiamayyee@gmail.com>
Date: Wed, 3 Jun 2026 21:07:45 +0800
Subject: [PATCH 09/23] feat(billing): label logs ingest/query in restriction
 banners (#46609)

---
 apps/studio/data/usage/constants.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/studio/data/usage/constants.ts b/apps/studio/data/usage/constants.ts
index 873e889bbd3..61aeabb6e2a 100644
--- a/apps/studio/data/usage/constants.ts
+++ b/apps/studio/data/usage/constants.ts
@@ -8,5 +8,7 @@ export const VIOLATION_TYPE_LABELS: Record<string, string> = {
   exceed_realtime_connection_count_quota: 'Realtime Connection Count Exceeded',
   exceed_realtime_message_count_quota: 'Realtime Message Count Exceeded',
   exceed_storage_size_quota: 'Storage Size Exceeded',
+  exceed_log_ingestion_quota: 'Logs Ingest Exceeded',
+  exceed_log_query_quota: 'Logs Query Exceeded',
   overdue_payment: 'Overdue Payment',
 }

From 04501d2f85af9a8381397f1131cbc65f96211d78 Mon Sep 17 00:00:00 2001
From: Chris Chinchilla <chris.ward@supabase.io>
Date: Wed, 3 Jun 2026 15:22:38 +0200
Subject: [PATCH 10/23] docs: Allow partial variables to be optional (#46585)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Behavior Changes**
* Partial directives now render unprovided variables as empty strings
instead of throwing validation errors
* Escaped placeholders (preceded by backslash) are preserved and not
substituted
  * Unused provided variables are silently ignored

* **Tests**
* Updated test coverage to validate the new permissive variable
substitution behavior and removed prior error-focused assertions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 apps/docs/features/directives/Partial.test.ts |  87 +++++++++------
 apps/docs/features/directives/Partial.ts      | 100 +++++-------------
 2 files changed, 78 insertions(+), 109 deletions(-)

diff --git a/apps/docs/features/directives/Partial.test.ts b/apps/docs/features/directives/Partial.test.ts
index 5217554a15c..9e0124ddc6e 100644
--- a/apps/docs/features/directives/Partial.test.ts
+++ b/apps/docs/features/directives/Partial.test.ts
@@ -1,7 +1,6 @@
-import { describe, it, expect } from 'vitest'
-
 import { mdxToMarkdown } from 'mdast-util-mdx'
 import { toMarkdown } from 'mdast-util-to-markdown'
+import { describe, expect, it } from 'vitest'
 
 import { partialsRemark } from './Partial'
 import { fromDocsMarkdown } from './utils.server'
@@ -116,7 +115,12 @@ Some more text.
     await expect(partialsRemark()(mdast)).rejects.toThrowError(/valid JSON/)
   })
 
-  it('should error when required variable is missing', async () => {
+  it('should render an unprovided variable as an empty string', async () => {
+    // The variables.mdx fixture reads "Here is a partial that takes a {{ .var }}."
+    // When `var` is not provided, the `{{ .var }}` placeholder is replaced with
+    // an empty string rather than throwing. The trailing " ." in the expected
+    // output is the intended result: the placeholder is gone, leaving nothing
+    // between "a" and the period.
     const markdown = `
 # Embed partial
 
@@ -126,27 +130,48 @@ Some more text.
 `.trim()
 
     const mdast = fromDocsMarkdown(markdown)
-    await expect(partialsRemark()(mdast)).rejects.toThrowError(
-      /Missing required variable in \$Partial ".*variables\.mdx": "var"/
-    )
+    const transformed = await partialsRemark()(mdast)
+    const output = toMarkdown(transformed, { extensions: [mdxToMarkdown()] })
+
+    // Note the empty gap where `{{ .var }}` used to be — this is deliberate.
+    const expected = `
+# Embed partial
+
+Here is a partial that takes a .
+
+Some more text.
+`.trimStart()
+
+    expect(output).toEqual(expected)
+    // The placeholder must be fully removed, not left as literal `{{ .var }}`.
+    expect(output).not.toContain('{{')
   })
 
-  it('should error when unexpected variable is provided', async () => {
+  it('should ignore a variable that is not referenced in the partial', async () => {
+    // The variables.mdx fixture only references `var`. Providing an additional
+    // `extra` variable that the partial never uses is silently ignored rather
+    // than throwing — `var` is substituted and `extra` leaves no trace.
     const markdown = `
 # Embed partial
 
-<$Partial path="/_fixtures/variables.mdx" variables={{ "var": "correct", "extra": "unexpected" }} />
+<$Partial path="/_fixtures/variables.mdx" variables={{ "var": "correct", "extra": "unused" }} />
 
 Some more text.
 `.trim()
 
     const mdast = fromDocsMarkdown(markdown)
-    await expect(partialsRemark()(mdast)).rejects.toThrowError(
-      /Unexpected variable in \$Partial ".*variables\.mdx": "extra"/
-    )
+    const transformed = await partialsRemark()(mdast)
+    const output = toMarkdown(transformed, { extensions: [mdxToMarkdown()] })
+
+    expect(output).toContain('Here is a partial that takes a correct.')
+    expect(output).not.toContain('unused')
   })
 
-  it('should error with detailed message for multiple missing variables', async () => {
+  it('should render only the unprovided variables as empty when some are provided', async () => {
+    // The multiple-variables.mdx fixture reads:
+    //   "This partial has {{ .var1 }}, {{ .var2 }}, and {{ .var3 }}."
+    // Only `var1` is provided here, so `var2` and `var3` collapse to empty
+    // strings while `var1` is substituted normally.
     const markdown = `
 # Embed partial
 
@@ -156,24 +181,13 @@ Some more text.
 `.trim()
 
     const mdast = fromDocsMarkdown(markdown)
-    await expect(partialsRemark()(mdast)).rejects.toThrowError(
-      /Missing required variables.*"var2".*"var3".*Expected variables.*"var1".*"var2".*"var3".*Provided variable: "var1"/s
-    )
-  })
+    const transformed = await partialsRemark()(mdast)
+    const output = toMarkdown(transformed, { extensions: [mdxToMarkdown()] })
 
-  it('should error with detailed message for multiple unexpected variables', async () => {
-    const markdown = `
-# Embed partial
-
-<$Partial path="/_fixtures/variables.mdx" variables={{ "var": "correct", "extra1": "wrong", "extra2": "also wrong" }} />
-
-Some more text.
-`.trim()
-
-    const mdast = fromDocsMarkdown(markdown)
-    await expect(partialsRemark()(mdast)).rejects.toThrowError(
-      /Unexpected variables.*"extra1".*"extra2".*Expected variable: "var".*Provided variables.*"var".*"extra1".*"extra2"/s
-    )
+    // Provided variable is substituted; the two unprovided ones leave empty gaps.
+    expect(output).toContain('This partial has value1, , and .')
+    // No placeholder text survives for the unprovided variables.
+    expect(output).not.toContain('{{')
   })
 
   it('should succeed when all variables match exactly', async () => {
@@ -212,7 +226,12 @@ Some more text.
     expect(output).toContain('alphanumeric value')
   })
 
-  it('should error when hyphenated variable is missing', async () => {
+  it('should render unprovided hyphenated variables as empty', async () => {
+    // The hyphenated-variables.mdx fixture reads:
+    //   "This partial has {{ .my-var }}, {{ .another_var }}, and {{ .myVar123 }}."
+    // Only `my-var` is provided, so the underscore and alphanumeric variables
+    // collapse to empty strings — confirming the empty-substitution behavior
+    // applies to all supported variable name styles.
     const markdown = `
 # Embed partial
 
@@ -222,8 +241,10 @@ Some more text.
 `.trim()
 
     const mdast = fromDocsMarkdown(markdown)
-    await expect(partialsRemark()(mdast)).rejects.toThrowError(
-      /Missing required variables.*"another_var".*"myVar123".*Expected variables.*"my-var".*"another_var".*"myVar123".*Provided variable: "my-var"/s
-    )
+    const transformed = await partialsRemark()(mdast)
+    const output = toMarkdown(transformed, { extensions: [mdxToMarkdown()] })
+
+    expect(output).toContain('This partial has value, , and .')
+    expect(output).not.toContain('{{')
   })
 })
diff --git a/apps/docs/features/directives/Partial.ts b/apps/docs/features/directives/Partial.ts
index 15d40004f54..86001a7ade8 100644
--- a/apps/docs/features/directives/Partial.ts
+++ b/apps/docs/features/directives/Partial.ts
@@ -7,6 +7,10 @@
  * Simple string replacement is supported. The replacement strings are
  * specified using the `variables` field.
  *
+ * Variable substitution is optional. Any variable referenced in the partial
+ * content but not provided is rendered as an empty string, and any variable
+ * provided but not referenced in the content is ignored.
+ *
  * ## Examples
  *
  * ### Simple partial
@@ -33,14 +37,14 @@
  * ```
  */
 
-import { type Root } from 'mdast'
-import type { MdxJsxFlowElement } from 'mdast-util-mdx-jsx'
 import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
+import { PARTIALS_DIRECTORY } from '~/lib/docs'
+import { type Root } from 'mdast'
+import type { MdxJsxFlowElement } from 'mdast-util-mdx-jsx'
 import { type Parent } from 'unist'
 import { visitParents } from 'unist-util-visit-parents'
 
-import { PARTIALS_DIRECTORY } from '~/lib/docs'
 import { fromDocsMarkdown, getAttributeValue, getAttributeValueExpression } from './utils.server'
 
 export function partialsRemark() {
@@ -74,67 +78,19 @@ function toFilePath(node: MdxJsxFlowElement) {
 }
 
 /**
- * Extracts all variable names expected in the partial content.
- * Returns a Set of variable names found in {{ .variableName }} patterns.
- * Variable names can contain alphanumeric characters, hyphens, and underscores.
+ * Substitutes provided variables into the partial content. Variable
+ * substitution is optional: any variable referenced in the content but not
+ * provided is replaced with an empty string, and any variable provided but not
+ * referenced is ignored. The leading `\` escape (`\{{ .var }}`) opts a
+ * placeholder out of substitution.
  */
-function extractExpectedVariables(content: string): Set<string> {
-  const variablePattern = /(?<!\\)\{\{\s*\.([\w-]+)\s*\}\}/g
-  const variables = new Set<string>()
-  let match
-
-  while ((match = variablePattern.exec(content)) !== null) {
-    variables.add(match[1])
-  }
-
-  return variables
-}
-
-/**
- * Validates that all expected variables are provided and no unexpected variables are included.
- * Throws descriptive errors if validation fails.
- */
-function validateVariables(
-  content: string,
-  vars: Record<string, string> | undefined,
-  partialPath: string
-) {
-  const expectedVars = extractExpectedVariables(content)
-  const providedVars = vars ? new Set(Object.keys(vars)) : new Set<string>()
-
-  // Check for missing variables
-  const missingVars = [...expectedVars].filter((v) => !providedVars.has(v))
-  if (missingVars.length > 0) {
-    const varList = missingVars.map((v) => `"${v}"`).join(', ')
-    const plural = missingVars.length > 1
-    throw new Error(
-      `Missing required variable${plural ? 's' : ''} in $Partial "${partialPath}": ${varList}\n` +
-        `Expected variable${expectedVars.size > 1 ? 's' : ''}: ${[...expectedVars].map((v) => `"${v}"`).join(', ')}\n` +
-        `Provided variable${providedVars.size !== 1 ? 's' : ''}: ${providedVars.size > 0 ? [...providedVars].map((v) => `"${v}"`).join(', ') : 'none'}`
-    )
-  }
-
-  // Check for unexpected variables
-  const unexpectedVars = [...providedVars].filter((v) => !expectedVars.has(v))
-  if (unexpectedVars.length > 0) {
-    const varList = unexpectedVars.map((v) => `"${v}"`).join(', ')
-    const plural = unexpectedVars.length > 1
-    throw new Error(
-      `Unexpected variable${plural ? 's' : ''} in $Partial "${partialPath}": ${varList}\n` +
-        `Expected variable${expectedVars.size !== 1 ? 's' : ''}: ${expectedVars.size > 0 ? [...expectedVars].map((v) => `"${v}"`).join(', ') : 'none'}\n` +
-        `Provided variable${plural ? 's' : ''}: ${[...providedVars].map((v) => `"${v}"`).join(', ')}`
-    )
-  }
-}
-
 function substituteVars(content: string, vars: Record<string, string> | undefined) {
-  if (vars === undefined) {
-    return content
-  }
-
-  for (const [key, value] of Object.entries(vars)) {
+  for (const [key, value] of Object.entries(vars ?? {})) {
     content = content.replace(new RegExp(`(?<!\\\\)\\{\\{\\s*\\.${key}\\s*\\}\\}`, 'g'), value)
   }
+
+  // Clear any remaining (unprovided) placeholders.
+  content = content.replace(/(?<!\\)\{\{\s*\.[\w-]+\s*\}\}/g, '')
   return content
 }
 
@@ -159,12 +115,7 @@ function getVariables(node: MdxJsxFlowElement): undefined | Record<string, strin
 
 async function fetchPartialsContent(tree: Root) {
   // INVARIANT: These must be pushed to in the same order because the index is // used to keep track of the relationship.
-  const partialNodes = [] as [
-    Parent,
-    MdxJsxFlowElement,
-    undefined | Record<string, string>,
-    string,
-  ][]
+  const partialNodes = [] as [Parent, MdxJsxFlowElement, undefined | Record<string, string>][]
   const pendingFetches = [] as Promise<string>[]
 
   visitParents(tree, 'mdxJsxFlowElement', (node: MdxJsxFlowElement, ancestors) => {
@@ -174,9 +125,8 @@ async function fetchPartialsContent(tree: Root) {
     const filePath = toFilePath(node)
     const variables = getVariables(node)
     const fetchTask = readFile(filePath, 'utf-8')
-    const partialPath = getAttributeValue(node, 'path') as string
 
-    partialNodes.push([parent, node, variables, partialPath])
+    partialNodes.push([parent, node, variables])
     pendingFetches.push(fetchTask)
   })
 
@@ -184,21 +134,19 @@ async function fetchPartialsContent(tree: Root) {
 
   const nodeContentMap = new Map<
     MdxJsxFlowElement,
-    [Parent, string, undefined | Record<string, string>, string]
+    [Parent, string, undefined | Record<string, string>]
   >()
-  partialNodes.forEach(([parent, node, variables, partialPath], index) => {
-    nodeContentMap.set(node, [parent, resolvedContent[index], variables, partialPath])
+  partialNodes.forEach(([parent, node, variables], index) => {
+    nodeContentMap.set(node, [parent, resolvedContent[index], variables])
   })
   return nodeContentMap
 }
 
 function rewriteNodes(
-  contentMap: Map<MdxJsxFlowElement, [Parent, string, undefined | Record<string, string>, string]>
+  contentMap: Map<MdxJsxFlowElement, [Parent, string, undefined | Record<string, string>]>
 ) {
-  for (const [node, [parent, rawContent, vars, partialPath]] of contentMap) {
-    const trimmedContent = rawContent.trim()
-    validateVariables(trimmedContent, vars, partialPath)
-    let content = substituteVars(trimmedContent, vars)
+  for (const [node, [parent, rawContent, vars]] of contentMap) {
+    const content = substituteVars(rawContent.trim(), vars)
     const replacementContent = fromDocsMarkdown(content)
     parent.children.splice(parent.children.indexOf(node), 1, replacementContent)
   }

From c582d3749c292cdcd5521bc1c5c875b9b8614544 Mon Sep 17 00:00:00 2001
From: Julien Goux <hi@jgoux.dev>
Date: Wed, 3 Jun 2026 16:31:42 +0200
Subject: [PATCH 11/23] fix(studio): update S3 Vectors docs links (#46617)

## What changed

Updated the S3 Vectors wrapper docs links in Studio to use the canonical
`s3_vectors` docs slug instead of `s3-vectors`.

## Why

The docs route on current `master` uses
`/guides/database/extensions/wrappers/s3_vectors`, so these Studio links
should point to the existing page.

## Validation

Skipped local checks at request: this is a two-line URL-only update.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Fixed documentation links for S3 Vectors integration to direct users
to the correct reference guides.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Ali Waseem <waseema393@gmail.com>
---
 .../interfaces/Integrations/Wrappers/Wrappers.constants.ts      | 2 +-
 .../Storage/VectorBuckets/CreateVectorBucketDialog.tsx          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/studio/components/interfaces/Integrations/Wrappers/Wrappers.constants.ts b/apps/studio/components/interfaces/Integrations/Wrappers/Wrappers.constants.ts
index 30146f8a57c..3c3a48f045c 100644
--- a/apps/studio/components/interfaces/Integrations/Wrappers/Wrappers.constants.ts
+++ b/apps/studio/components/interfaces/Integrations/Wrappers/Wrappers.constants.ts
@@ -1427,7 +1427,7 @@ export const WRAPPERS: WrapperMeta[] = [
     description: 'Cloud storage service for high-dimensional vectors',
     extensionName: 'S3VectorsFdw',
     label: 'S3 Vectors',
-    docsUrl: `${DOCS_URL}/guides/database/extensions/wrappers/s3-vectors`,
+    docsUrl: `${DOCS_URL}/guides/database/extensions/wrappers/s3_vectors`,
     categories: ['ai_vectors', 'storage'],
     minimumExtensionVersion: '0.5.6',
     server: {
diff --git a/apps/studio/components/interfaces/Storage/VectorBuckets/CreateVectorBucketDialog.tsx b/apps/studio/components/interfaces/Storage/VectorBuckets/CreateVectorBucketDialog.tsx
index fb0f8c40c42..f62723970cc 100644
--- a/apps/studio/components/interfaces/Storage/VectorBuckets/CreateVectorBucketDialog.tsx
+++ b/apps/studio/components/interfaces/Storage/VectorBuckets/CreateVectorBucketDialog.tsx
@@ -209,7 +209,7 @@ export const CreateVectorBucketDialog = ({
                   Supabase will install the{' '}
                   {wrappersExtensionState !== 'installed' ? 'Wrappers extension and ' : ''}
                   S3 Vectors Wrapper integration on your behalf.{' '}
-                  <InlineLink href={`${DOCS_URL}/guides/database/extensions/wrappers/s3-vectors`}>
+                  <InlineLink href={`${DOCS_URL}/guides/database/extensions/wrappers/s3_vectors`}>
                     Learn more
                   </InlineLink>
                   .

From e3be344f5c88609eb2c828cdb9692d1999104e31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Pozo?= <tomaspozo@users.noreply.github.com>
Date: Wed, 3 Jun 2026 11:05:20 -0500
Subject: [PATCH 12/23] fix(examples): read new API keys directly from parsed
 SUPABASE_SECRET_KEYS (#46604)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

Edge Function examples that use the new publishable/secret API keys read
them with a double lookup:

```ts
const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
const secretKey = Deno.env.get(SUPABASE_SECRET_KEYS['default']) // ❌ returns undefined
```

`SUPABASE_SECRET_KEYS` / `SUPABASE_PUBLISHABLE_KEYS` are a JSON object
that maps a key name to the **actual key value** (e.g.
`{"default":"sb_secret_..."}`), confirmed by:
- the self-hosted injection in `docker/docker-compose.yml`
(`SUPABASE_SECRET_KEYS: "{\"default\":\"${SUPABASE_SECRET_KEY:-}\"}"`)
- the `@supabase/server` SDK README

So `SUPABASE_SECRET_KEYS['default']` is already the key. Wrapping it in
another `Deno.env.get(...)` looks up an env var named `sb_secret_...`,
which doesn't exist, so the value is `undefined` and the examples fail
at runtime.

## Fix

Unwrap the outer `Deno.env.get(...)` so the key is read directly:

```ts
const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
const secretKey = SUPABASE_SECRET_KEYS['default'] // ✅
```

Applied across 23 files (example functions, the
`examples/prompts/edge-functions.md` codegen guidance, and two docs
guides). The correct `JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)`
declaration line is untouched. The generated `apps/docs/examples/` copy
regenerates from `examples/` at build time.

## Notes

- Docs context:
[#46600](https://github.com/supabase/supabase/pull/46600), which
documents the same key model.
- Follow-up (not in this PR): a few examples send the secret key on the
`Authorization: Bearer` header, which the new keys reject. Worth a
separate audit.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Clarified examples and guides for correctly reading parsed Supabase
secret and publishable key maps.

* **Examples**
* Standardized credential usage across Edge Functions and samples so
Supabase clients consistently receive keys from the parsed key maps
rather than indirect lookups.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
---
 .../guides/ai/examples/huggingface-image-captioning.mdx      | 2 +-
 .../functions/examples/elevenlabs-transcribe-speech.mdx      | 2 +-
 .../supabase/functions/image_gen/index.ts                    | 2 +-
 .../supabase/functions/generate-embedding/index.ts           | 2 +-
 .../ai/edge-functions/supabase/functions/search/index.ts     | 2 +-
 .../supabase/functions/background-upload-storage/index.ts    | 5 +----
 .../supabase/functions/elevenlabs-speech-to-text/index.ts    | 2 +-
 .../supabase/functions/elevenlabs-text-to-speech/index.ts    | 5 +----
 .../supabase/functions/file-upload-storage/index.ts          | 2 +-
 .../supabase/functions/get-tshirt-competition/index.ts       | 2 +-
 .../supabase/functions/huggingface-image-captioning/index.ts | 2 +-
 .../supabase/functions/og-image-with-storage-cdn/handler.tsx | 2 +-
 .../supabase/functions/openai-image-generation/index.ts      | 2 +-
 .../edge-functions/supabase/functions/read-storage/index.ts  | 2 +-
 .../edge-functions/supabase/functions/restful-tasks/index.ts | 2 +-
 .../functions/select-from-table-with-auth-rls/index.ts       | 2 +-
 examples/edge-functions/supabase/functions/sentry/index.ts   | 5 +----
 .../supabase/functions/tweet-to-image/handler.tsx            | 2 +-
 .../supabase/functions/upstash-redis-ratelimit/index.ts      | 2 +-
 examples/prompts/edge-functions.md                           | 2 +-
 .../protomaps/supabase/functions/maps-private/index.ts       | 2 +-
 .../supabase/functions/create-upload-token/index.ts          | 2 +-
 .../expo-push-notifications/supabase/functions/push/index.ts | 5 +----
 23 files changed, 23 insertions(+), 35 deletions(-)

diff --git a/apps/docs/content/guides/ai/examples/huggingface-image-captioning.mdx b/apps/docs/content/guides/ai/examples/huggingface-image-captioning.mdx
index b6b7b05ea47..a0f89695d59 100644
--- a/apps/docs/content/guides/ai/examples/huggingface-image-captioning.mdx
+++ b/apps/docs/content/guides/ai/examples/huggingface-image-captioning.mdx
@@ -65,7 +65,7 @@ Deno.serve(async (req) => {
     // Supabase API URL - env var exported by default when deployed.
     Deno.env.get('SUPABASE_URL') ?? '',
     // Supabase API SECRET KEY - env var exported by default when deployed.
-    Deno.env.get(SUPABASE_SECRET_KEYS['default']) ?? ''
+    SUPABASE_SECRET_KEYS['default'] ?? ''
   )
 
   // Construct image url from storage
diff --git a/apps/docs/content/guides/functions/examples/elevenlabs-transcribe-speech.mdx b/apps/docs/content/guides/functions/examples/elevenlabs-transcribe-speech.mdx
index db8248876c3..6cdc51f58ca 100644
--- a/apps/docs/content/guides/functions/examples/elevenlabs-transcribe-speech.mdx
+++ b/apps/docs/content/guides/functions/examples/elevenlabs-transcribe-speech.mdx
@@ -120,7 +120,7 @@ const elevenLabsClient = new ElevenLabsClient({
 const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 const supabase = createClient(
   Deno.env.get('SUPABASE_URL') || '',
-  Deno.env.get(SUPABASE_SECRET_KEYS['default']) || ''
+  SUPABASE_SECRET_KEYS['default'] || ''
 )
 
 async function scribe({
diff --git a/examples/ai/aws_bedrock_image_gen/supabase/functions/image_gen/index.ts b/examples/ai/aws_bedrock_image_gen/supabase/functions/image_gen/index.ts
index 5e7ffc82034..e20b971cfd5 100644
--- a/examples/ai/aws_bedrock_image_gen/supabase/functions/image_gen/index.ts
+++ b/examples/ai/aws_bedrock_image_gen/supabase/functions/image_gen/index.ts
@@ -58,7 +58,7 @@ Deno.serve(async (req) => {
       // Supabase API URL - env var exported by default.
       Deno.env.get('SUPABASE_URL')!,
       // Supabase API SECRET KEY - env var exported by default.
-      Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
+      SUPABASE_SECRET_KEYS['default']!
     )
 
     const { data: upload, error: uploadError } = await supabaseClient.storage
diff --git a/examples/ai/edge-functions/supabase/functions/generate-embedding/index.ts b/examples/ai/edge-functions/supabase/functions/generate-embedding/index.ts
index 43143fbcab4..034bed58306 100644
--- a/examples/ai/edge-functions/supabase/functions/generate-embedding/index.ts
+++ b/examples/ai/edge-functions/supabase/functions/generate-embedding/index.ts
@@ -15,7 +15,7 @@ const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 
 const supabase = createClient<Database>(
   Deno.env.get('SUPABASE_URL')!,
-  Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
+  SUPABASE_SECRET_KEYS['default']!
 )
 
 const model = new Supabase.ai.Session('gte-small')
diff --git a/examples/ai/edge-functions/supabase/functions/search/index.ts b/examples/ai/edge-functions/supabase/functions/search/index.ts
index bd003be2f3b..2497e88b4fa 100644
--- a/examples/ai/edge-functions/supabase/functions/search/index.ts
+++ b/examples/ai/edge-functions/supabase/functions/search/index.ts
@@ -7,7 +7,7 @@ const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 
 const supabase = createClient<Database>(
   Deno.env.get('SUPABASE_URL')!,
-  Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
+  SUPABASE_SECRET_KEYS['default']!
 )
 
 const model = new Supabase.ai.Session('gte-small')
diff --git a/examples/edge-functions/supabase/functions/background-upload-storage/index.ts b/examples/edge-functions/supabase/functions/background-upload-storage/index.ts
index 49d5d9a99c7..49fdb1ea55c 100644
--- a/examples/edge-functions/supabase/functions/background-upload-storage/index.ts
+++ b/examples/edge-functions/supabase/functions/background-upload-storage/index.ts
@@ -4,10 +4,7 @@ import OpenAI from 'https://deno.land/x/openai@v4.68.2/mod.ts'
 const client = new OpenAI({ apiKey: Deno.env.get('OPENAI_API_KEY')! })
 const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 
-const supabase = createClient(
-  Deno.env.get('SUPABASE_URL')!,
-  Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
-)
+const supabase = createClient(Deno.env.get('SUPABASE_URL')!, SUPABASE_SECRET_KEYS['default']!)
 
 type StorageFileApi = ReturnType<typeof supabase.storage.from>
 type StorageUploadPromise = ReturnType<StorageFileApi['upload']>
diff --git a/examples/edge-functions/supabase/functions/elevenlabs-speech-to-text/index.ts b/examples/edge-functions/supabase/functions/elevenlabs-speech-to-text/index.ts
index 6623cb3b5e4..56905387d63 100644
--- a/examples/edge-functions/supabase/functions/elevenlabs-speech-to-text/index.ts
+++ b/examples/edge-functions/supabase/functions/elevenlabs-speech-to-text/index.ts
@@ -19,7 +19,7 @@ const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 
 const supabase = createClient(
   Deno.env.get('SUPABASE_URL') || '',
-  Deno.env.get(SUPABASE_SECRET_KEYS['default']) || ''
+  SUPABASE_SECRET_KEYS['default'] || ''
 )
 
 async function scribe({
diff --git a/examples/edge-functions/supabase/functions/elevenlabs-text-to-speech/index.ts b/examples/edge-functions/supabase/functions/elevenlabs-text-to-speech/index.ts
index 972e449ef8b..b142f0b0f10 100644
--- a/examples/edge-functions/supabase/functions/elevenlabs-text-to-speech/index.ts
+++ b/examples/edge-functions/supabase/functions/elevenlabs-text-to-speech/index.ts
@@ -5,10 +5,7 @@ import { ElevenLabsClient } from 'npm:elevenlabs@1.52.0'
 import * as hash from 'npm:object-hash'
 
 const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
-const supabase = createClient(
-  Deno.env.get('SUPABASE_URL')!,
-  Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
-)
+const supabase = createClient(Deno.env.get('SUPABASE_URL')!, SUPABASE_SECRET_KEYS['default']!)
 
 const client = new ElevenLabsClient({
   apiKey: Deno.env.get('ELEVENLABS_API_KEY'),
diff --git a/examples/edge-functions/supabase/functions/file-upload-storage/index.ts b/examples/edge-functions/supabase/functions/file-upload-storage/index.ts
index 37dee7427f9..80bef78d864 100644
--- a/examples/edge-functions/supabase/functions/file-upload-storage/index.ts
+++ b/examples/edge-functions/supabase/functions/file-upload-storage/index.ts
@@ -29,7 +29,7 @@ app.use(async (ctx) => {
     // Supabase API URL - env var exported by default.
     Deno.env.get('SUPABASE_URL')!,
     // Supabase publishable key - env var exported by default.
-    Deno.env.get(SUPABASE_PUBLISHABLE_KEYS['default'])!
+    SUPABASE_PUBLISHABLE_KEYS['default']!
   )
 
   //upload image to Storage
diff --git a/examples/edge-functions/supabase/functions/get-tshirt-competition/index.ts b/examples/edge-functions/supabase/functions/get-tshirt-competition/index.ts
index de5dc1c2b02..20e8f0d4f5d 100644
--- a/examples/edge-functions/supabase/functions/get-tshirt-competition/index.ts
+++ b/examples/edge-functions/supabase/functions/get-tshirt-competition/index.ts
@@ -61,7 +61,7 @@ Deno.serve(async (req) => {
       // Supabase API URL - env var exported by default when deployed.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase API SECRET KEY - env var exported by default when deployed.
-      Deno.env.get(SUPABASE_SECRET_KEYS['default']) ?? ''
+      SUPABASE_SECRET_KEYS['default'] ?? ''
     )
     // Submit email to draw
     const { error } = await supabaseAdminClient.from('get-tshirt-competition-2').upsert(
diff --git a/examples/edge-functions/supabase/functions/huggingface-image-captioning/index.ts b/examples/edge-functions/supabase/functions/huggingface-image-captioning/index.ts
index 15455577c2b..790ee619019 100644
--- a/examples/edge-functions/supabase/functions/huggingface-image-captioning/index.ts
+++ b/examples/edge-functions/supabase/functions/huggingface-image-captioning/index.ts
@@ -23,7 +23,7 @@ Deno.serve(async (req) => {
     // Supabase API URL - env var exported by default when deployed.
     Deno.env.get('SUPABASE_URL') ?? '',
     // Supabase API SECRET KEY - env var exported by default when deployed.
-    Deno.env.get(SUPABASE_SECRET_KEYS['default']) ?? ''
+    SUPABASE_SECRET_KEYS['default'] ?? ''
   )
 
   // Construct image url from storage
diff --git a/examples/edge-functions/supabase/functions/og-image-with-storage-cdn/handler.tsx b/examples/edge-functions/supabase/functions/og-image-with-storage-cdn/handler.tsx
index 3cea004a04c..1252b04c072 100644
--- a/examples/edge-functions/supabase/functions/og-image-with-storage-cdn/handler.tsx
+++ b/examples/edge-functions/supabase/functions/og-image-with-storage-cdn/handler.tsx
@@ -201,7 +201,7 @@ export async function handler(req: Request) {
       // Supabase API URL - env var exported by default when deployed.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase API SECRET KEY - env var exported by default when deployed.
-      Deno.env.get(SUPABASE_SECRET_KEYS['default']) ?? ''
+      SUPABASE_SECRET_KEYS['default'] ?? ''
     )
 
     // Upload image to storage.
diff --git a/examples/edge-functions/supabase/functions/openai-image-generation/index.ts b/examples/edge-functions/supabase/functions/openai-image-generation/index.ts
index 8117c2edf72..0c5f46aaa3f 100644
--- a/examples/edge-functions/supabase/functions/openai-image-generation/index.ts
+++ b/examples/edge-functions/supabase/functions/openai-image-generation/index.ts
@@ -85,7 +85,7 @@ Deno.serve(async (req) => {
     // Upload the generated image to Supabase Storage
     const supabaseClient = createClient(
       Deno.env.get('SUPABASE_URL') || '',
-      Deno.env.get(SUPABASE_SECRET_KEYS['default']) || ''
+      SUPABASE_SECRET_KEYS['default'] || ''
     )
 
     // Create a unique identifier for this generation
diff --git a/examples/edge-functions/supabase/functions/read-storage/index.ts b/examples/edge-functions/supabase/functions/read-storage/index.ts
index 443bf721a15..d0063546b70 100644
--- a/examples/edge-functions/supabase/functions/read-storage/index.ts
+++ b/examples/edge-functions/supabase/functions/read-storage/index.ts
@@ -25,7 +25,7 @@ Deno.serve(async (req) => {
       // Supabase API URL - env var exported by default.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase API publishable key - env var exported by default.
-      Deno.env.get(SUPABASE_PUBLISHABLE_KEYS['default']) ?? '',
+      SUPABASE_PUBLISHABLE_KEYS['default'] ?? '',
       // Create client with Auth context of the user that called the function.
       // This way your row-level-security (RLS) policies are applied.
       {
diff --git a/examples/edge-functions/supabase/functions/restful-tasks/index.ts b/examples/edge-functions/supabase/functions/restful-tasks/index.ts
index 2182334fc6a..0b4527abde8 100644
--- a/examples/edge-functions/supabase/functions/restful-tasks/index.ts
+++ b/examples/edge-functions/supabase/functions/restful-tasks/index.ts
@@ -82,7 +82,7 @@ Deno.serve(async (req) => {
       // Supabase API URL - env var exported by default.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase publishable key - env var exported by default.
-      Deno.env.get(SUPABASE_PUBLISHABLE_KEYS['default']) ?? '',
+      SUPABASE_PUBLISHABLE_KEYS['default'] ?? '',
       // Create client with Auth context of the user that called the function.
       // This way your row-level-security (RLS) policies are applied.
       {
diff --git a/examples/edge-functions/supabase/functions/select-from-table-with-auth-rls/index.ts b/examples/edge-functions/supabase/functions/select-from-table-with-auth-rls/index.ts
index a9badc940b1..c0c1e62b03c 100644
--- a/examples/edge-functions/supabase/functions/select-from-table-with-auth-rls/index.ts
+++ b/examples/edge-functions/supabase/functions/select-from-table-with-auth-rls/index.ts
@@ -23,7 +23,7 @@ Deno.serve(async (req: Request) => {
       // Supabase API URL - env var exported by default.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase API PUBLISHABLE KEY - env var exported by default.
-      Deno.env.get(SUPABASE_PUBLISHABLE_KEYS['default']) ?? '',
+      SUPABASE_PUBLISHABLE_KEYS['default'] ?? '',
       // Create client with Auth context of the user that called the function.
       // This way your row-level-security (RLS) policies are applied.
       {
diff --git a/examples/edge-functions/supabase/functions/sentry/index.ts b/examples/edge-functions/supabase/functions/sentry/index.ts
index abdddd9b97d..23a04024a92 100644
--- a/examples/edge-functions/supabase/functions/sentry/index.ts
+++ b/examples/edge-functions/supabase/functions/sentry/index.ts
@@ -9,10 +9,7 @@ import * as Sentry from 'https://deno.land/x/sentry@7.102.0/index.mjs'
 
 const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 
-const supabase = createClient(
-  Deno.env.get('SUPABASE_URL')!,
-  Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
-)
+const supabase = createClient(Deno.env.get('SUPABASE_URL')!, SUPABASE_SECRET_KEYS['default']!)
 
 Sentry.init({
   dsn: Deno.env.get('SENTRY_DSN'),
diff --git a/examples/edge-functions/supabase/functions/tweet-to-image/handler.tsx b/examples/edge-functions/supabase/functions/tweet-to-image/handler.tsx
index ddd9c340c2b..00e16086f49 100644
--- a/examples/edge-functions/supabase/functions/tweet-to-image/handler.tsx
+++ b/examples/edge-functions/supabase/functions/tweet-to-image/handler.tsx
@@ -70,7 +70,7 @@ export async function handler(req: Request) {
       // Supabase API URL - env var exported by default when deployed.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase API SECRET KEY - env var exported by default when deployed.
-      Deno.env.get(SUPABASE_SECRET_KEYS['default']) ?? ''
+      SUPABASE_SECRET_KEYS['default'] ?? ''
     )
 
     // Upload image to storage.
diff --git a/examples/edge-functions/supabase/functions/upstash-redis-ratelimit/index.ts b/examples/edge-functions/supabase/functions/upstash-redis-ratelimit/index.ts
index ef5727c3b22..0c8a05e10de 100644
--- a/examples/edge-functions/supabase/functions/upstash-redis-ratelimit/index.ts
+++ b/examples/edge-functions/supabase/functions/upstash-redis-ratelimit/index.ts
@@ -12,7 +12,7 @@ Deno.serve(async (req) => {
       // Supabase API URL - env var exported by default.
       Deno.env.get('SUPABASE_URL') ?? '',
       // Supabase publishable key - env var exported by default.
-      Deno.env.get(SUPABASE_PUBLISHABLE_KEYS['default']) ?? '',
+      SUPABASE_PUBLISHABLE_KEYS['default'] ?? '',
       // Create client with Auth context of the user that called the function.
       // This way your row-level-security (RLS) policies are applied.
       {
diff --git a/examples/prompts/edge-functions.md b/examples/prompts/edge-functions.md
index ba48db3fa8e..87447d7a997 100644
--- a/examples/prompts/edge-functions.md
+++ b/examples/prompts/edge-functions.md
@@ -23,7 +23,7 @@ You're an expert in writing TypeScript and Deno JavaScript runtime. Generate **h
    - SUPABASE_SECRET_KEYS
    - SUPABASE_DB_URL
 
-You then need to use `JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)` or `JSON.parse(Deno.env.get('SUPABASE_PUBLISHABLE_KEYS')!)` to access the actual keys in the code. For example, `Deno.env.get(SUPABASE_SECRET_KEYS['default'])` to access the default service key. 9. To set other environment variables (ie. secrets) users can put them in a env file and run the `supabase secrets set --env-file path/to/env-file` 10. A single Edge Function can handle multiple routes. It is recommended to use a library like Express or Hono to handle the routes as it's easier for developer to understand and maintain. Each route must be prefixed with `/function-name` so they are routed correctly. 11. File write operations are ONLY permitted on `/tmp` directory. You can use either Deno or Node File APIs. 12. Use `EdgeRuntime.waitUntil(promise)` static method to run long-running tasks in the background without blocking response to a request. Do NOT assume it is available in the request / execution context.
+You then need to parse them with `JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)` or `JSON.parse(Deno.env.get('SUPABASE_PUBLISHABLE_KEYS')!)` to access the actual keys in the code. For example, assign the parsed map first with `const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)` and then index it with `SUPABASE_SECRET_KEYS['default']` to access the default secret key. 9. To set other environment variables (ie. secrets) users can put them in a env file and run the `supabase secrets set --env-file path/to/env-file` 10. A single Edge Function can handle multiple routes. It is recommended to use a library like Express or Hono to handle the routes as it's easier for developer to understand and maintain. Each route must be prefixed with `/function-name` so they are routed correctly. 11. File write operations are ONLY permitted on `/tmp` directory. You can use either Deno or Node File APIs. 12. Use `EdgeRuntime.waitUntil(promise)` static method to run long-running tasks in the background without blocking response to a request. Do NOT assume it is available in the request / execution context.
 
 ## Example Templates
 
diff --git a/examples/storage/protomaps/supabase/functions/maps-private/index.ts b/examples/storage/protomaps/supabase/functions/maps-private/index.ts
index cacfc61de02..d0187cdafab 100644
--- a/examples/storage/protomaps/supabase/functions/maps-private/index.ts
+++ b/examples/storage/protomaps/supabase/functions/maps-private/index.ts
@@ -27,6 +27,6 @@ Deno.serve((req) => {
   const { method, headers } = req
   // Add Auth header
   const modHeaders = new Headers(headers)
-  modHeaders.append('authorization', `Bearer ${Deno.env.get(SUPABASE_SECRET_KEYS['default'])!}`)
+  modHeaders.append('authorization', `Bearer ${SUPABASE_SECRET_KEYS['default']!}`)
   return fetch(url, { method, headers: modHeaders })
 })
diff --git a/examples/storage/resumable-upload-signed-uppy/supabase/functions/create-upload-token/index.ts b/examples/storage/resumable-upload-signed-uppy/supabase/functions/create-upload-token/index.ts
index 2d1fb040fed..b61f9fafc6b 100644
--- a/examples/storage/resumable-upload-signed-uppy/supabase/functions/create-upload-token/index.ts
+++ b/examples/storage/resumable-upload-signed-uppy/supabase/functions/create-upload-token/index.ts
@@ -5,7 +5,7 @@ const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
 
 Deno.serve(async (req) => {
   const SUPABASE_URL = Deno.env.get('SUPABASE_URL') ?? ''
-  const SUPABASE_SECRET_KEY = Deno.env.get(SUPABASE_SECRET_KEYS['default']) ?? ''
+  const SUPABASE_SECRET_KEY = SUPABASE_SECRET_KEYS['default'] ?? ''
 
   const supabase = createClient(SUPABASE_URL, SUPABASE_SECRET_KEY)
 
diff --git a/examples/user-management/expo-push-notifications/supabase/functions/push/index.ts b/examples/user-management/expo-push-notifications/supabase/functions/push/index.ts
index 7f73cb91ded..76ea8f56338 100644
--- a/examples/user-management/expo-push-notifications/supabase/functions/push/index.ts
+++ b/examples/user-management/expo-push-notifications/supabase/functions/push/index.ts
@@ -20,10 +20,7 @@ interface WebhookPayload {
 }
 
 const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
-const supabase = createClient(
-  Deno.env.get('SUPABASE_URL')!,
-  Deno.env.get(SUPABASE_SECRET_KEYS['default'])!
-)
+const supabase = createClient(Deno.env.get('SUPABASE_URL')!, SUPABASE_SECRET_KEYS['default']!)
 
 Deno.serve(async (req) => {
   const payload: WebhookPayload = await req.json()

From be56096ea77c67b63d1b98a4818c4167d6acc365 Mon Sep 17 00:00:00 2001
From: Ali Waseem <waseema393@gmail.com>
Date: Wed, 3 Jun 2026 10:39:28 -0600
Subject: [PATCH 13/23] fix(studio): prevent SQL editor TreeView crash when an
 expanded folder leaves the tree (#46595)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

Sentry [SUPABASE-APP-J7C](https://supabase.sentry.io/issues/7492405004)
— `Error: Node with id=new-folder doesn't exist in the tree.` (328
events / 280 users). Crashes the SQL editor.

## Root cause

`react-accessible-treeview` throws when an id is dropped from the
controlled `expandedIds` prop in the same render its node leaves the
tree data — its collapse effect calls `getTreeNode(data, id)` on a node
that's already gone. The prior fix (`8bcb878a01`) reactively filtered
`expandedIds` against the live tree, which is exactly what produces that
simultaneous drop when a `new-folder` placeholder (or any expanded
folder) is removed.

## Fix

- Guard additions: only expand folder ids that exist in the tree.
- Tolerate stale ids: pass `expandedFolderIds` as-is instead of the
reactively filtered list, so we never create a "removed" delta for a
node that's already gone. Stale ids are harmless — the library only
inspects the add/remove delta.

## Reproduction (to verify the fix)

1. Open the SQL Editor for a project.
2. Create a folder and add a snippet into it.
3. **Expand** the folder.
4. Right-click the folder → **Delete folder** (confirm).
5. Before: the editor crashes with `Node with id=... doesn't exist in
the tree.` After: no crash.

Fixes SUPABASE-APP-J7C

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved stability of private snippet folder expansion in the SQL
editor: auto-expansion now respects the current snippet tree state to
avoid unexpected collapses or visual glitches in the folder tree.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../SQLEditorLayout/SQLEditorNavV2/SQLEditorNav.tsx | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/apps/studio/components/layouts/SQLEditorLayout/SQLEditorNavV2/SQLEditorNav.tsx b/apps/studio/components/layouts/SQLEditorLayout/SQLEditorNavV2/SQLEditorNav.tsx
index acfc57dcc52..35c7021f9cb 100644
--- a/apps/studio/components/layouts/SQLEditorLayout/SQLEditorNavV2/SQLEditorNav.tsx
+++ b/apps/studio/components/layouts/SQLEditorLayout/SQLEditorNavV2/SQLEditorNav.tsx
@@ -176,11 +176,6 @@ export const SQLEditorNav = ({ sort = 'inserted_at' }: SQLEditorNavProps) => {
     [privateSnippetsTreeState]
   )
 
-  const validExpandedFolderIds = useMemo(
-    () => expandedFolderIds.filter((id) => privateSnippetsTreeNodeIds.has(id)),
-    [expandedFolderIds, privateSnippetsTreeNodeIds]
-  )
-
   const privateSnippetsLastItemIds = useMemo(
     () => getLastItemIds(privateSnippetsTreeState),
     [privateSnippetsTreeState]
@@ -407,7 +402,11 @@ export const SQLEditorNav = ({ sort = 'inserted_at' }: SQLEditorNavProps) => {
       } else if (snippet.visibility === 'user') {
         setSectionVisibility({ ...sectionVisibility, private: true })
       }
-      if (snippet.folder_id && !expandedFolderIds.includes(snippet.folder_id)) {
+      if (
+        snippet.folder_id &&
+        !expandedFolderIds.includes(snippet.folder_id) &&
+        privateSnippetsTreeNodeIds.has(snippet.folder_id)
+      ) {
         setExpandedFolderIds([...expandedFolderIds, snippet.folder_id])
       }
     }
@@ -654,7 +653,7 @@ export const SQLEditorNav = ({ sort = 'inserted_at' }: SQLEditorNavProps) => {
                   setExpandedFolderIds(expandedFolderIds.filter((x) => x !== folderId))
                 }
               }}
-              expandedIds={validExpandedFolderIds}
+              expandedIds={expandedFolderIds}
               nodeRenderer={({ element, ...props }) => {
                 const isOpened = Object.values(tabs.tabsMap).some(
                   (tab) => tab.metadata?.sqlId === element.metadata?.id

From 31c4205a10f5b921086dd9cad46a8593ad600442 Mon Sep 17 00:00:00 2001
From: Prashant Sridharan <914007+CoolAssPuppy@users.noreply.github.com>
Date: Wed, 3 Jun 2026 22:54:36 +0100
Subject: [PATCH 14/23] Trying to fix form submission to Notion and HubSpot
 (#46629)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

go pages can have forms. Those forms can also submit to HubSpot and
Notion, if configured properly. There appears to be a bug in the form
submission that we thought we had fixed on Friday. I'm attempting to fix
it here because the web developer working on this project has left the
company. I can definitively rule out API keys and form UUIDs as the
culprit.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed CRM resolver configuration in bundled application builds to
ensure proper CRM form integration across all module instances.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../src/go/actions/formCrmResolver.ts         | 20 +++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/packages/marketing/src/go/actions/formCrmResolver.ts b/packages/marketing/src/go/actions/formCrmResolver.ts
index 994040a2b46..a054ca750ce 100644
--- a/packages/marketing/src/go/actions/formCrmResolver.ts
+++ b/packages/marketing/src/go/actions/formCrmResolver.ts
@@ -11,7 +11,22 @@ export type FormCrmResolver = (
   ref: FormRef
 ) => GoFormCrmConfig | undefined | Promise<GoFormCrmConfig | undefined>
 
-let resolver: FormCrmResolver | null = null
+/**
+ * The resolver is stored on `globalThis` rather than in a module-level variable.
+ * `instrumentation.ts` registers it via the `marketing` package barrel, while
+ * `submitFormAction` reads it via a relative import. In a bundled build those
+ * two paths can resolve to separate instances of this module, so a plain
+ * module-level singleton set on one instance is invisible to the other — the
+ * action then sees `null` and every submission fails with "Form not found".
+ * A `globalThis` slot is shared across all module instances in the process.
+ */
+const RESOLVER_KEY = Symbol.for('marketing.go.formCrmResolver')
+
+type ResolverStore = { [key: symbol]: FormCrmResolver | null | undefined }
+
+function resolverStore(): ResolverStore {
+  return globalThis as unknown as ResolverStore
+}
 
 /**
  * Register the function used by `submitFormAction` to look up the trusted CRM
@@ -23,10 +38,11 @@ let resolver: FormCrmResolver | null = null
  * `submitFormAction` for the security rationale.
  */
 export function setFormCrmResolver(fn: FormCrmResolver): void {
-  resolver = fn
+  resolverStore()[RESOLVER_KEY] = fn
 }
 
 export async function resolveFormCrmConfig(ref: FormRef): Promise<GoFormCrmConfig | undefined> {
+  const resolver = resolverStore()[RESOLVER_KEY]
   if (!resolver) return undefined
   return await resolver(ref)
 }

From f041ec4124e37858d68d7550dc3ef489ebf43ab4 Mon Sep 17 00:00:00 2001
From: Wen Bo Xie <wenbox323@gmail.com>
Date: Wed, 3 Jun 2026 18:44:11 -0400
Subject: [PATCH 15/23] feat: update API keys instruction for AI Assistant
 (#45401)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Updated authentication docs: require startup-time validation of
required env vars and introduce JSON-mapped publishable/secret key
handling.
* Added JWKS-based asymmetric JWT verification guidance and clarified
symmetric (HS256) handling; deprecated anon/service-role keys.
* Clarified Authorization control flow: when handlers must fully
authenticate vs. when module-scoped JWKS verification applies.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 apps/studio/lib/ai/prompts.ts | 63 ++++++++++++++++++++++++++++++-----
 1 file changed, 54 insertions(+), 9 deletions(-)

diff --git a/apps/studio/lib/ai/prompts.ts b/apps/studio/lib/ai/prompts.ts
index 031b6211501..09f71fb4f5d 100644
--- a/apps/studio/lib/ai/prompts.ts
+++ b/apps/studio/lib/ai/prompts.ts
@@ -213,16 +213,61 @@ If editing or adding code, state your assumptions, ensure any code examples are
 5. Prefer importing external dependencies via \`npm:\` or \`jsr:\`. Minimize imports from \`deno.land/x\`, \`esm.sh\`, or \`unpkg.com\`. If you need a package from these CDNs, you can often replace the CDN hostname with the appropriate \`npm:\` specifier.
 6. Node built-in APIs can be used by importing them with the \`node:\` specifier. For example, import Node's process as \`import process from "node:process";\`. Use Node APIs to fill in any gaps in Deno's APIs.
 7. Do **not** use \`import { serve } from "https://deno.land/std@0.168.0/http/server.ts";\`. Instead, use the built-in \`Deno.serve\`.
-8. The following environment variables (secrets) are automatically populated in both local and hosted Supabase environments. Users do not need to set them manually:
-    - SUPABASE_URL
-    - SUPABASE_ANON_KEY
-    - SUPABASE_SERVICE_ROLE_KEY
-    - SUPABASE_DB_URL
+8. The following environment variables are automatically populated in both local and hosted Supabase environments. Users do not need to set them manually. When reading any of these env vars, validate at startup with an explicit \`if (!x) throw new Error(...)\` check rather than \`!\` non-null assertions or \`??\` fallbacks:
+    - \`SUPABASE_URL\` — The API gateway for the Supabase project.
+    - \`SUPABASE_DB_URL\` — The direct PostgreSQL connection URL. Server-only; never expose to a browser.
+    - \`SUPABASE_PUBLISHABLE_KEYS\` — A JSON-encoded object of publishable API keys, keyed by the name configured for each key (values look like \`sb_publishable_...\`). Safe to use in a browser if RLS is enabled. Key names are project-specific and can be added or deleted, so do not assume any particular name exists. **Always ask the user which key name to use before emitting this code; never emit \`'<KEY_NAME>'\` verbatim.** Always parse before use and look up by name — do not pass the raw env-var string anywhere a key is expected:
+      \`\`\`ts
+      const raw = Deno.env.get('SUPABASE_PUBLISHABLE_KEYS');
+      if (!raw) throw new Error('SUPABASE_PUBLISHABLE_KEYS is required');
+      const publishableKeys = JSON.parse(raw);
+      // Ask the user which key name to use; do NOT emit '<KEY_NAME>' literally.
+      const publishableKey = publishableKeys['<KEY_NAME>'];
+      \`\`\`
+    - \`SUPABASE_SECRET_KEYS\` — Same shape as \`SUPABASE_PUBLISHABLE_KEYS\` (values look like \`sb_secret_...\`). Server-only; never expose to a browser. Same caveat about key names — they are not guaranteed.
+    - \`SUPABASE_JWKS\` — A JSON-encoded JWKS envelope (\`{ "keys": [...] }\`) of public keys for verifying asymmetric user JWTs. Parse it and pass the result to a JWKS library — see the *Verifying the request \`Authorization\` header* guideline below for the full pattern.
+    - \`SUPABASE_ANON_KEY\`, \`SUPABASE_SERVICE_ROLE_KEY\` — **Deprecated** legacy keys; do **not** use in new code. Migrate to \`SUPABASE_PUBLISHABLE_KEYS\` / \`SUPABASE_SECRET_KEYS\` issued through JWT Signing Keys.
+    - \`SB_REGION\` — The region the function was invoked in. Set per request.
+    - \`SB_EXECUTION_ID\` — A unique identifier for each function instance. Set per request.
+    - \`DENO_DEPLOYMENT_ID\` — The version of the function code. Set when the function is deployed.
 9. To set additional environment variables, users can specify them in an env file and execute \`supabase secrets set --env-file path/to/env-file\`.
-10. Each Edge Function can handle multiple routes. Using a routing library such as Express or Hono is recommended for maintainability; each route must be prefixed with \`/function-name\` for proper routing.
-11. File write operations are only permitted in the \`/tmp\` directory. Both Deno and Node File APIs may be used.
-12. Use the static method \`EdgeRuntime.waitUntil(promise)\` to execute long-running tasks in the background without blocking the response. Do **not** assume it is available on the request or execution context.
-13. Favor \`Deno.serve\` for creating Edge Functions where possible.
+10. Verifying the request \`Authorization\` header.
+
+    **\`SUPABASE_PUBLISHABLE_KEYS\` and \`SUPABASE_SECRET_KEYS\` are not JWTs — they ride in the \`apikey\` header, not \`Authorization\`. Never compare them to the \`Authorization\` value.**
+
+    The \`Authorization\` header value is a JWT. Whether it is asymmetric or symmetric depends on whether the project has rotated to JWT Signing Keys, not on the client's API-key format.
+
+    **If \`verify_jwt = false\` (configured per-function in \`supabase/config.toml\`), the platform performs no auth check before the handler runs. The handler is then fully responsible for authenticating the caller — without an explicit check inside the handler, anyone can invoke the function.**
+    - For **asymmetric** JWTs (project has rotated to JWT Signing Keys), verify with \`SUPABASE_JWKS\` and \`jose\`. Hoist the JWKS to module scope so it builds once per isolate, pin algorithms to prevent algorithm-confusion attacks, and validate the issuer:
+      \`\`\`ts
+      import { createLocalJWKSet, jwtVerify } from 'npm:jose@5';
+
+      const SUPABASE_URL = Deno.env.get('SUPABASE_URL');
+      const SUPABASE_JWKS = Deno.env.get('SUPABASE_JWKS');
+      if (!SUPABASE_URL) throw new Error('SUPABASE_URL is required');
+      if (!SUPABASE_JWKS) throw new Error('SUPABASE_JWKS is required');
+
+      const JWKS = createLocalJWKSet(JSON.parse(SUPABASE_JWKS));
+
+      Deno.serve(async (req) => {
+        // With \`verify_jwt = true\` (the default), the platform has already validated the JWT before the handler runs, so the header is guaranteed to be present.
+        const token = req.headers.get('Authorization')!.replace('Bearer ', '');
+
+        try {
+          const { payload } = await jwtVerify(token, JWKS, {
+            algorithms: ['ES256', 'RS256', 'EdDSA'],
+            issuer: \`\${SUPABASE_URL}/auth/v1\`,
+          });
+        } catch {
+          return new Response('Unauthorized', { status: 401 });
+        }
+      });
+      \`\`\`
+    - For **symmetric** JWTs (legacy HS256), the signing secret is not exposed to the function, so offline cryptographic verification is not possible. Recommend migrating to asymmetric signing keys; do not implement custom verification.
+11. Each Edge Function can handle multiple routes. Using a routing library such as Express or Hono is recommended for maintainability; each route must be prefixed with \`/function-name\` for proper routing.
+12. File write operations are only permitted in the \`/tmp\` directory. Both Deno and Node File APIs may be used.
+13. Use the static method \`EdgeRuntime.waitUntil(promise)\` to execute long-running tasks in the background without blocking the response. Do **not** assume it is available on the request or execution context.
+14. Favor \`Deno.serve\` for creating Edge Functions where possible.
 
 ## Example Templates
 

From 3efc8a12ca8c48668558437f7c954e1ee21e81e6 Mon Sep 17 00:00:00 2001
From: Aleksi Immonen <aleksi@supabase.io>
Date: Thu, 4 Jun 2026 09:01:59 +0300
Subject: [PATCH 16/23] fix: correct canonical tags on 4 docs pages (#46620)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Four pages in `apps/docs` have a mismatch between the `pathname` in
`generateMetadata` and the `pathname` in `GuideTemplate`. The
`generateMetadata` pathname is what generates the `<link
rel="canonical">` and `<link rel="alternate" type="text/markdown">` tags
— so both tags point to the wrong URL on all 4 pages.

The wrong canonical destinations either loop back to the source page
(308 → source) or end in a 404, meaning Google is being told the
authoritative URL is somewhere it can't reliably reach.

## Changes

One-line fix in each file — update `pathname` in `generateMetadata` to
match the `pathname` already correctly set in `GuideTemplate`:

- `apps/docs/app/guides/database/database-advisors/page.tsx` —
`/guides/database/database-linter` →
`/guides/database/database-advisors`
- `apps/docs/app/guides/local-development/cli/config/page.tsx` —
`/guides/cli/config` → `/guides/local-development/cli/config`
- `apps/docs/app/guides/deployment/ci/[slug]/page.tsx` —
`/guides/cli/github-action/${slug}` → `/guides/deployment/ci/${slug}`
- `apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx` —
`/guides/platform/terraform` → `/guides/deployment/terraform`

## Verification

Before fix — view source on any of these pages and search for
`canonical`:
- https://supabase.com/docs/guides/database/database-advisors
- https://supabase.com/docs/guides/local-development/cli/config
- https://supabase.com/docs/guides/deployment/ci/testing
- https://supabase.com/docs/guides/deployment/terraform

After fix — canonical on each page should be self-referencing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Fixed documentation routing paths across multiple guides to align with
proper navigation structure:
    * Database advisors guide
    * CI/deployment guide
    * Terraform deployment guide
    * Terraform provider reference guide
    * Local development CLI configuration guide
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 apps/docs/app/guides/database/database-advisors/page.tsx       | 2 +-
 apps/docs/app/guides/deployment/ci/[slug]/page.tsx             | 2 +-
 apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx | 2 +-
 apps/docs/app/guides/deployment/terraform/reference/page.tsx   | 2 +-
 apps/docs/app/guides/local-development/cli/config/page.tsx     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/docs/app/guides/database/database-advisors/page.tsx b/apps/docs/app/guides/database/database-advisors/page.tsx
index e35e9da410c..56d9c89876b 100644
--- a/apps/docs/app/guides/database/database-advisors/page.tsx
+++ b/apps/docs/app/guides/database/database-advisors/page.tsx
@@ -25,7 +25,7 @@ const meta = {
 }
 
 const generateMetadata = genGuideMeta(() => ({
-  pathname: '/guides/database/database-linter',
+  pathname: '/guides/database/database-advisors',
   meta,
 }))
 
diff --git a/apps/docs/app/guides/deployment/ci/[slug]/page.tsx b/apps/docs/app/guides/deployment/ci/[slug]/page.tsx
index 76152dc0aa1..4053787f65e 100644
--- a/apps/docs/app/guides/deployment/ci/[slug]/page.tsx
+++ b/apps/docs/app/guides/deployment/ci/[slug]/page.tsx
@@ -87,7 +87,7 @@ const getContent = async ({ slug }: Params) => {
   )
 
   return {
-    pathname: `/guides/cli/github-action/${slug}` satisfies `/${string}`,
+    pathname: `/guides/deployment/ci/${slug}` satisfies `/${string}`,
     meta,
     content,
     editLink,
diff --git a/apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx b/apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx
index 07c76c8da40..153c814eff3 100644
--- a/apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx
+++ b/apps/docs/app/guides/deployment/terraform/[[...slug]]/page.tsx
@@ -136,7 +136,7 @@ const getContent = async ({ slug }: Params) => {
 
   return {
     pathname:
-      `/guides/platform/terraform${slug?.length ? `/${slug.join('/')}` : ''}` satisfies `/${string}`,
+      `/guides/deployment/terraform${slug?.length ? `/${slug.join('/')}` : ''}` satisfies `/${string}`,
     meta,
     content,
     editLink,
diff --git a/apps/docs/app/guides/deployment/terraform/reference/page.tsx b/apps/docs/app/guides/deployment/terraform/reference/page.tsx
index d703ea17cb3..8b974373fe4 100644
--- a/apps/docs/app/guides/deployment/terraform/reference/page.tsx
+++ b/apps/docs/app/guides/deployment/terraform/reference/page.tsx
@@ -22,7 +22,7 @@ const meta = {
 }
 
 const generateMetadata = genGuideMeta(() => ({
-  pathname: '/guides/platform/terraform/reference',
+  pathname: '/guides/deployment/terraform/reference',
   meta,
 }))
 
diff --git a/apps/docs/app/guides/local-development/cli/config/page.tsx b/apps/docs/app/guides/local-development/cli/config/page.tsx
index 124ade3a74c..8461b6baeb4 100644
--- a/apps/docs/app/guides/local-development/cli/config/page.tsx
+++ b/apps/docs/app/guides/local-development/cli/config/page.tsx
@@ -12,7 +12,7 @@ const meta = {
 }
 
 const generateMetadata = genGuideMeta(() => ({
-  pathname: '/guides/cli/config',
+  pathname: '/guides/local-development/cli/config',
   meta,
 }))
 

From a429cd4e42f4ba839e8fd58c502bef5f815e4a4f Mon Sep 17 00:00:00 2001
From: Chase Cresgy <47046876+theccres@users.noreply.github.com>
Date: Thu, 4 Jun 2026 08:16:46 +0200
Subject: [PATCH 17/23] Update humans.txt - offboardings (#46635)

Removed Alan De Los Santos and Fabrizio Cataldo from the list.

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Humans update

## What is the current behavior?

Humans



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
  * Updated team roster in public documentation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 apps/docs/public/humans.txt | 2 --
 1 file changed, 2 deletions(-)

diff --git a/apps/docs/public/humans.txt b/apps/docs/public/humans.txt
index 1d67411e716..c2f9a44d4ff 100644
--- a/apps/docs/public/humans.txt
+++ b/apps/docs/public/humans.txt
@@ -9,7 +9,6 @@ Adam Mokan
 AJ Matias
 Akash Manimaran
 Alaister Young
-Alan De Los Santos
 Aleksi Immonen
 Alex Hall
 Alex Hsu
@@ -93,7 +92,6 @@ Emmett Folger
 Eric Kharitonashvili
 Etienne Stalmans
 Eyal Ehrlich
-Fabrizio Cataldo
 Fabrizio Fenoglio
 Fady A
 Fatuma Abdullahi

From 446398bd28d137f70f9ba462de3395382f95a405 Mon Sep 17 00:00:00 2001
From: Alaister Young <alaister@users.noreply.github.com>
Date: Thu, 4 Jun 2026 17:28:30 +1000
Subject: [PATCH 18/23] fix(studio): remove default DataGrid borders in table
 editor (#46633)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #46448, which removed the doubled DataGrid borders across
Studio. The table editor grid had the same doubled border at the bottom,
but unlike the other grids it still needs a top border — and that top
border was rendering in react-data-grid's own `--rdg-border-color`
rather than the studio default.

**Changed:**
- Removed the doubled bottom border on the table editor `<DataGrid>`
(`border-b-0!`)
- Forced the top border to the default border color via the
`border-t-default!` token (≈ rgb(46,46,46) / `--border-default`) instead
of leaning on react-data-grid's `--rdg-border-color`

## To test

- Open the table editor for any table (`/project/[ref]/editor/[id]`)
- Confirm there's a single top border between the filter/sort toolbar
and the grid header, in the standard border color
- Confirm there's no extra line at the bottom of the grid

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Refined grid visuals and spacing to improve alignment and visual
consistency across the app. Adjustments to border and growth behavior
reduce border inconsistencies and layout jitter during resizing. Context
menu display behavior remains intact, ensuring expected right-click
interactions continue to work smoothly for users.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
---
 apps/studio/components/grid/components/grid/Grid.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/studio/components/grid/components/grid/Grid.tsx b/apps/studio/components/grid/components/grid/Grid.tsx
index 50f38de5c2a..f4d9f757a00 100644
--- a/apps/studio/components/grid/components/grid/Grid.tsx
+++ b/apps/studio/components/grid/components/grid/Grid.tsx
@@ -401,7 +401,11 @@ export const Grid = memo(
                 )}
                 <DataGrid
                   ref={ref}
-                  className={cn(gridClass, 'grow', isContextMenuOpen && 'rdg-context-menu-open')}
+                  className={cn(
+                    gridClass,
+                    'grow border-t-default! border-b-0!',
+                    isContextMenuOpen && 'rdg-context-menu-open'
+                  )}
                   rowClass={computedRowClass}
                   columns={columnsWithDirtyCellClass}
                   rows={rows ?? []}

From 4ff4cdc62d7265b7dc82020e67a3b46f3f5bd931 Mon Sep 17 00:00:00 2001
From: Hieu <phamhieu1998@gmail.com>
Date: Thu, 4 Jun 2026 14:53:26 +0700
Subject: [PATCH 19/23] feat: expose mgmt api v2 spec on official document
 (#46605)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Include the v2 mgmt API spec in the official docs. This PR merges the v1
and v2 specs when generating the reference, with v2 taking precedence on
conflicts.

Fixes API-1215

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Docs now include API v2 reference: log-drain management
(list/create/update/delete) and project transfer (preview/transfer).

* **Documentation**
* Generated API reference now merges v1 and v2 specs so both appear in
the docs and section listings.
* New v2 operations added to Analytics and Projects documentation
sections.

* **Chores**
* Docs generation pipeline updated to accept and process multiple API
spec inputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../docs/Reference.generated.script.ts        |   23 +-
 apps/docs/spec/Makefile                       |    8 +-
 apps/docs/spec/api_v2_openapi.json            |  899 ++++++
 apps/docs/spec/common-api-sections.json       |   36 +
 .../spec/sections/generateMgmtApiSections.cts |  146 +-
 .../transforms/api_v2_openapi_deparsed.json   | 2551 +++++++++++++++++
 6 files changed, 3577 insertions(+), 86 deletions(-)
 create mode 100644 apps/docs/spec/api_v2_openapi.json
 create mode 100644 apps/docs/spec/transforms/api_v2_openapi_deparsed.json

diff --git a/apps/docs/features/docs/Reference.generated.script.ts b/apps/docs/features/docs/Reference.generated.script.ts
index d8824206342..7a52c883ffb 100644
--- a/apps/docs/features/docs/Reference.generated.script.ts
+++ b/apps/docs/features/docs/Reference.generated.script.ts
@@ -17,7 +17,8 @@ import selfHostingRealtimeCommonSections from '~/spec/common-self-hosting-realti
 import selfHostingStorageCommonSections from '~/spec/common-self-hosting-storage-sections.json' with { type: 'json' }
 import storageSpec from '~/spec/storage_v0_openapi.json' with { type: 'json' }
 import analyticsSpec from '~/spec/transforms/analytics_v0_openapi_deparsed.json' with { type: 'json' }
-import openApiSpec from '~/spec/transforms/api_v1_openapi_deparsed.json' with { type: 'json' }
+import apiV1Spec from '~/spec/transforms/api_v1_openapi_deparsed.json' with { type: 'json' }
+import apiV2Spec from '~/spec/transforms/api_v2_openapi_deparsed.json' with { type: 'json' }
 import { isPlainObject, keyBy } from 'lodash-es'
 import slugify from 'slugify'
 import { parse } from 'yaml'
@@ -239,7 +240,25 @@ async function writeCliReferenceSections() {
 }
 
 async function writeApiReferenceSections() {
-  const endpointsById = mapEndpointsById(openApiSpec)
+  const mergedSpec = {
+    ...apiV1Spec,
+    paths: {
+      ...apiV1Spec.paths,
+      ...apiV2Spec.paths,
+    },
+    components: {
+      ...apiV1Spec.components,
+      schemas: {
+        ...apiV1Spec.components?.schemas,
+        ...apiV2Spec.components?.schemas,
+      },
+      securitySchemes: {
+        ...apiV1Spec.components?.securitySchemes,
+        ...apiV2Spec.components?.securitySchemes,
+      },
+    },
+  }
+  const endpointsById = mapEndpointsById(mergedSpec)
   const pendingEndpointsByIdWrite = writeFile(
     join(GENERATED_DIRECTORY, 'api.latest.endpointsById.json'),
     JSON.stringify(Array.from(endpointsById.entries()))
diff --git a/apps/docs/spec/Makefile b/apps/docs/spec/Makefile
index cb598870827..c7e125bffa4 100644
--- a/apps/docs/spec/Makefile
+++ b/apps/docs/spec/Makefile
@@ -13,7 +13,7 @@ download: download.api.v1 download.storage.v1 download.tsdoc.v2
 
 download.api.v1:
 	curl -sS https://api.supabase.com/api/v1-json > $(REPO_DIR)/api_v1_openapi.json
-
+	curl -sS https://api.supabase.com/api/v2-json > $(REPO_DIR)/api_v2_openapi.json
 
 # This flow needs to be updated, so we'l comment out for the moment
 # Manual flow for now:
@@ -58,6 +58,7 @@ transform: dereference.api.v1 dereference.auth.v1 dereference.storage.v0
 
 dereference.api.v1:
 	pnpm exec redocly bundle --dereferenced -o $(REPO_DIR)/transforms/api_v1_openapi_deparsed.json $(REPO_DIR)/api_v1_openapi.json
+	pnpm exec redocly bundle --dereferenced -o $(REPO_DIR)/transforms/api_v2_openapi_deparsed.json $(REPO_DIR)/api_v2_openapi.json
 
 dereference.auth.v1:
 	pnpm exec redocly bundle --dereferenced -o $(REPO_DIR)/transforms/auth_v1_openapi_deparsed.json $(REPO_DIR)/auth_v1_openapi.json
@@ -74,7 +75,10 @@ dereference.analytics.v0:
 generate: generate.sections.api.v1
 
 generate.sections.api.v1:
-	npx tsx $(REPO_DIR)/sections/generateMgmtApiSections.cts $(REPO_DIR)/transforms/api_v1_openapi_deparsed.json $(REPO_DIR)/common-api-sections.json
+	npx tsx $(REPO_DIR)/sections/generateMgmtApiSections.cts \
+		$(REPO_DIR)/transforms/api_v1_openapi_deparsed.json \
+		$(REPO_DIR)/transforms/api_v2_openapi_deparsed.json \
+		$(REPO_DIR)/common-api-sections.json
 
 ###############################################################################
 # Validate OpenAPI 3.0
diff --git a/apps/docs/spec/api_v2_openapi.json b/apps/docs/spec/api_v2_openapi.json
new file mode 100644
index 00000000000..464289a5721
--- /dev/null
+++ b/apps/docs/spec/api_v2_openapi.json
@@ -0,0 +1,899 @@
+{
+  "openapi": "3.0.0",
+  "paths": {
+    "/v2/projects/{ref}/analytics/log-drains": {
+      "get": {
+        "operationId": "v2-list-log-drains",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/ListLogDrainsResponse" }
+              }
+            }
+          },
+          "401": { "description": "Unauthorized" },
+          "403": { "description": "Forbidden action" },
+          "429": { "description": "Rate limit exceeded" },
+          "500": { "description": "Failed to fetch log drains" }
+        },
+        "security": [{ "bearer": [] }, { "fga_permissions": ["analytics_config_read"] }],
+        "summary": "List project log drains",
+        "tags": ["Analytics"],
+        "x-badges": [{ "name": "OAuth scope: analytics_config:read", "position": "after" }],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:read"
+      },
+      "post": {
+        "operationId": "v2-create-log-drain",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/CreateLogDrainRequestOpenApi" }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "",
+            "content": {
+              "application/json": { "schema": { "$ref": "#/components/schemas/LogDrainResponse" } }
+            }
+          },
+          "401": { "description": "Unauthorized" },
+          "402": {
+            "description": "This feature requires the Pro, Team, or Enterprise organization plan."
+          },
+          "403": { "description": "Forbidden action" },
+          "429": { "description": "Rate limit exceeded" },
+          "500": { "description": "Failed to create a log drain" }
+        },
+        "security": [{ "bearer": [] }, { "fga_permissions": ["analytics_config_write"] }],
+        "summary": "Create a log drain for a project",
+        "tags": ["Analytics"],
+        "x-allowed-plans": ["Pro", "Team", "Enterprise"],
+        "x-badges": [
+          { "name": "Only available on Pro, Team, Enterprise", "position": "before" },
+          { "name": "OAuth scope: analytics_config:write", "position": "after" }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:write"
+      }
+    },
+    "/v2/projects/{ref}/analytics/log-drains/{id}": {
+      "put": {
+        "operationId": "v2-update-log-drain",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          },
+          {
+            "name": "id",
+            "required": true,
+            "in": "path",
+            "description": "Log drains identifier",
+            "schema": { "format": "uuid", "type": "string" }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/UpdateLogDrainRequestOpenApi" }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": { "schema": { "$ref": "#/components/schemas/LogDrainResponse" } }
+            }
+          },
+          "401": { "description": "Unauthorized" },
+          "403": { "description": "Forbidden action" },
+          "429": { "description": "Rate limit exceeded" },
+          "500": { "description": "Failed to update log drain" }
+        },
+        "security": [{ "bearer": [] }, { "fga_permissions": ["analytics_config_write"] }],
+        "summary": "Update a project log drain",
+        "tags": ["Analytics"],
+        "x-badges": [{ "name": "OAuth scope: analytics_config:write", "position": "after" }],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:write"
+      },
+      "delete": {
+        "operationId": "v2-delete-log-drain",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          },
+          {
+            "name": "id",
+            "required": true,
+            "in": "path",
+            "description": "Log drains identifier",
+            "schema": { "format": "uuid", "type": "string" }
+          }
+        ],
+        "responses": {
+          "204": { "description": "" },
+          "401": { "description": "Unauthorized" },
+          "403": { "description": "Forbidden action" },
+          "429": { "description": "Rate limit exceeded" },
+          "500": { "description": "Failed to delete a log drain" }
+        },
+        "security": [{ "bearer": [] }, { "fga_permissions": ["analytics_config_write"] }],
+        "summary": "Delete a project log drain",
+        "tags": ["Analytics"],
+        "x-badges": [{ "name": "OAuth scope: analytics_config:write", "position": "after" }],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:write"
+      }
+    },
+    "/v2/projects/{ref}/transfers/previews": {
+      "post": {
+        "operationId": "v2-preview-a-project-transfer",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/V2TransferProjectBody" }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/V2PreviewProjectTransferResponse" }
+              }
+            }
+          },
+          "401": { "description": "Unauthorized" },
+          "403": { "description": "Forbidden action" },
+          "429": { "description": "Rate limit exceeded" }
+        },
+        "security": [{ "bearer": [] }, { "fga_permissions": ["project_admin_read"] }],
+        "summary": "Previews transferring a project to a different organizations, shows eligibility and impact",
+        "tags": ["Projects"],
+        "x-endpoint-owners": ["management-api"]
+      }
+    },
+    "/v2/projects/{ref}/transfers": {
+      "post": {
+        "operationId": "v2-transfer-a-project",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": { "$ref": "#/components/schemas/V2TransferProjectBody" }
+            }
+          }
+        },
+        "responses": {
+          "200": { "description": "" },
+          "401": { "description": "Unauthorized" },
+          "403": { "description": "Forbidden action" },
+          "429": { "description": "Rate limit exceeded" }
+        },
+        "security": [{ "bearer": [] }, { "fga_permissions": ["organization_admin_write"] }],
+        "summary": "Transfers a project to a different organization",
+        "tags": ["Projects"],
+        "x-endpoint-owners": ["management-api"]
+      }
+    }
+  },
+  "info": {
+    "title": "Supabase API (v2)",
+    "description": "Supabase API generated from the OpenAPI specification.<br>Visit [https://supabase.com/docs](https://supabase.com/docs) for a complete documentation.",
+    "version": "1.0.0",
+    "contact": {}
+  },
+  "tags": [],
+  "servers": [],
+  "components": {
+    "securitySchemes": { "bearer": { "scheme": "bearer", "bearerFormat": "JWT", "type": "http" } },
+    "schemas": {
+      "ListLogDrainsResponse": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "enum": ["log_drain"],
+                  "description": "Resource type."
+                },
+                "id": { "type": "string" },
+                "attributes": {
+                  "type": "object",
+                  "properties": {
+                    "name": { "type": "string" },
+                    "description": { "type": "string" },
+                    "config": {
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "url": { "type": "string", "nullable": true },
+                            "schema": { "type": "string" },
+                            "username": { "type": "string", "nullable": true },
+                            "password": { "type": "string", "nullable": true },
+                            "port": { "type": "number", "nullable": true },
+                            "hostname": { "type": "string" }
+                          },
+                          "additionalProperties": false,
+                          "title": "postgres"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "url": { "type": "string" },
+                            "http": { "type": "string", "enum": ["http1", "http2"] },
+                            "gzip": { "type": "boolean" },
+                            "headers": {
+                              "type": "object",
+                              "additionalProperties": { "type": "string" }
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "webhook"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "project_id": { "type": "string" },
+                            "dataset_id": { "type": "string" }
+                          },
+                          "additionalProperties": false,
+                          "title": "bigquery"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "api_key": { "type": "string" },
+                            "region": { "type": "string" }
+                          },
+                          "additionalProperties": false,
+                          "title": "datadog"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "url": { "type": "string" },
+                            "username": { "type": "string", "nullable": true },
+                            "password": { "type": "string", "nullable": true },
+                            "headers": {
+                              "type": "object",
+                              "additionalProperties": { "type": "string" }
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "loki"
+                        },
+                        {
+                          "type": "object",
+                          "properties": { "dsn": { "type": "string" } },
+                          "additionalProperties": false,
+                          "title": "sentry"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "domain": { "type": "string" },
+                            "api_token": { "type": "string" },
+                            "dataset_name": { "type": "string" }
+                          },
+                          "additionalProperties": false,
+                          "title": "axiom"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "host": { "type": "string" },
+                            "port": { "type": "integer", "minimum": 0, "maximum": 65535 },
+                            "tls": { "default": false, "type": "boolean" },
+                            "structured_data": { "type": "string" },
+                            "cipher_key": { "type": "string" },
+                            "ca_cert": { "type": "string" },
+                            "client_cert": { "type": "string" },
+                            "client_key": { "type": "string" }
+                          },
+                          "additionalProperties": false,
+                          "title": "syslog"
+                        }
+                      ]
+                    },
+                    "backend_type": {
+                      "type": "string",
+                      "enum": [
+                        "postgres",
+                        "bigquery",
+                        "clickhouse",
+                        "webhook",
+                        "datadog",
+                        "loki",
+                        "sentry",
+                        "s3",
+                        "axiom",
+                        "last9",
+                        "otlp",
+                        "syslog"
+                      ]
+                    }
+                  },
+                  "required": ["name", "config", "backend_type"]
+                }
+              },
+              "required": ["type", "id", "attributes"]
+            }
+          }
+        },
+        "required": ["data"]
+      },
+      "CreateLogDrainRequestOpenApi": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": { "type": "string", "enum": ["log_drain"], "description": "Resource type." },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": { "type": "string" },
+                  "description": { "type": "string" },
+                  "config": {
+                    "oneOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string", "nullable": true },
+                          "schema": { "type": "string" },
+                          "username": { "type": "string", "nullable": true },
+                          "password": { "type": "string", "nullable": true },
+                          "port": { "type": "number", "nullable": true },
+                          "hostname": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "postgres"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string" },
+                          "http": { "type": "string", "enum": ["http1", "http2"] },
+                          "gzip": { "type": "boolean" },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "webhook"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "project_id": { "type": "string" },
+                          "dataset_id": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "bigquery"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "api_key": { "type": "string" },
+                          "region": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "datadog"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string" },
+                          "username": { "type": "string", "nullable": true },
+                          "password": { "type": "string", "nullable": true },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "loki"
+                      },
+                      {
+                        "type": "object",
+                        "properties": { "dsn": { "type": "string" } },
+                        "additionalProperties": false,
+                        "title": "sentry"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "domain": { "type": "string" },
+                          "api_token": { "type": "string" },
+                          "dataset_name": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "axiom"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "host": { "type": "string" },
+                          "port": { "type": "integer", "minimum": 0, "maximum": 65535 },
+                          "tls": { "default": false, "type": "boolean" },
+                          "structured_data": { "type": "string" },
+                          "cipher_key": { "type": "string" },
+                          "ca_cert": { "type": "string" },
+                          "client_cert": { "type": "string" },
+                          "client_key": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "syslog"
+                      }
+                    ]
+                  },
+                  "backend_type": {
+                    "type": "string",
+                    "enum": [
+                      "postgres",
+                      "bigquery",
+                      "clickhouse",
+                      "webhook",
+                      "datadog",
+                      "loki",
+                      "sentry",
+                      "s3",
+                      "axiom",
+                      "last9",
+                      "otlp",
+                      "syslog"
+                    ]
+                  }
+                },
+                "required": ["name", "config", "backend_type"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "LogDrainResponse": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": { "type": "string", "enum": ["log_drain"], "description": "Resource type." },
+              "id": { "type": "string" },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": { "type": "string" },
+                  "description": { "type": "string" },
+                  "config": {
+                    "oneOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string", "nullable": true },
+                          "schema": { "type": "string" },
+                          "username": { "type": "string", "nullable": true },
+                          "password": { "type": "string", "nullable": true },
+                          "port": { "type": "number", "nullable": true },
+                          "hostname": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "postgres"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string" },
+                          "http": { "type": "string", "enum": ["http1", "http2"] },
+                          "gzip": { "type": "boolean" },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "webhook"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "project_id": { "type": "string" },
+                          "dataset_id": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "bigquery"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "api_key": { "type": "string" },
+                          "region": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "datadog"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string" },
+                          "username": { "type": "string", "nullable": true },
+                          "password": { "type": "string", "nullable": true },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "loki"
+                      },
+                      {
+                        "type": "object",
+                        "properties": { "dsn": { "type": "string" } },
+                        "additionalProperties": false,
+                        "title": "sentry"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "domain": { "type": "string" },
+                          "api_token": { "type": "string" },
+                          "dataset_name": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "axiom"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "host": { "type": "string" },
+                          "port": { "type": "integer", "minimum": 0, "maximum": 65535 },
+                          "tls": { "default": false, "type": "boolean" },
+                          "structured_data": { "type": "string" },
+                          "cipher_key": { "type": "string" },
+                          "ca_cert": { "type": "string" },
+                          "client_cert": { "type": "string" },
+                          "client_key": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "syslog"
+                      }
+                    ]
+                  },
+                  "backend_type": {
+                    "type": "string",
+                    "enum": [
+                      "postgres",
+                      "bigquery",
+                      "clickhouse",
+                      "webhook",
+                      "datadog",
+                      "loki",
+                      "sentry",
+                      "s3",
+                      "axiom",
+                      "last9",
+                      "otlp",
+                      "syslog"
+                    ]
+                  }
+                },
+                "required": ["name", "config", "backend_type"]
+              }
+            },
+            "required": ["type", "id", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "UpdateLogDrainRequestOpenApi": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": { "type": "string", "enum": ["log_drain"], "description": "Resource type." },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": { "type": "string" },
+                  "description": { "type": "string" },
+                  "config": {
+                    "oneOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string", "nullable": true },
+                          "schema": { "type": "string" },
+                          "username": { "type": "string", "nullable": true },
+                          "password": { "type": "string", "nullable": true },
+                          "port": { "type": "number", "nullable": true },
+                          "hostname": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "postgres"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string" },
+                          "http": { "type": "string", "enum": ["http1", "http2"] },
+                          "gzip": { "type": "boolean" },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "webhook"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "project_id": { "type": "string" },
+                          "dataset_id": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "bigquery"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "api_key": { "type": "string" },
+                          "region": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "datadog"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": { "type": "string" },
+                          "username": { "type": "string", "nullable": true },
+                          "password": { "type": "string", "nullable": true },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "loki"
+                      },
+                      {
+                        "type": "object",
+                        "properties": { "dsn": { "type": "string" } },
+                        "additionalProperties": false,
+                        "title": "sentry"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "domain": { "type": "string" },
+                          "api_token": { "type": "string" },
+                          "dataset_name": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "axiom"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "host": { "type": "string" },
+                          "port": { "type": "integer", "minimum": 0, "maximum": 65535 },
+                          "tls": { "default": false, "type": "boolean" },
+                          "structured_data": { "type": "string" },
+                          "cipher_key": { "type": "string" },
+                          "ca_cert": { "type": "string" },
+                          "client_cert": { "type": "string" },
+                          "client_key": { "type": "string" }
+                        },
+                        "additionalProperties": false,
+                        "title": "syslog"
+                      }
+                    ]
+                  },
+                  "backend_type": {
+                    "type": "string",
+                    "enum": [
+                      "postgres",
+                      "bigquery",
+                      "clickhouse",
+                      "webhook",
+                      "datadog",
+                      "loki",
+                      "sentry",
+                      "s3",
+                      "axiom",
+                      "last9",
+                      "otlp",
+                      "syslog"
+                    ]
+                  }
+                },
+                "required": ["backend_type"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "V2TransferProjectBody": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["project_transfer_input"],
+                "description": "Resource type."
+              },
+              "attributes": {
+                "type": "object",
+                "properties": { "target_organization_slug": { "type": "string" } },
+                "required": ["target_organization_slug"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "V2PreviewProjectTransferResponse": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["project_transfer_result"],
+                "description": "Resource type."
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "valid": { "type": "boolean" },
+                  "warnings": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "key": { "type": "string" },
+                        "message": { "type": "string" }
+                      },
+                      "required": ["key", "message"]
+                    }
+                  },
+                  "errors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "key": { "type": "string" },
+                        "message": { "type": "string" }
+                      },
+                      "required": ["key", "message"]
+                    }
+                  },
+                  "info": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "key": { "type": "string" },
+                        "message": { "type": "string" }
+                      },
+                      "required": ["key", "message"]
+                    }
+                  }
+                },
+                "required": ["valid", "warnings", "errors", "info"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      }
+    }
+  }
+}
diff --git a/apps/docs/spec/common-api-sections.json b/apps/docs/spec/common-api-sections.json
index 67e1f055b4a..6d4aad0cd97 100644
--- a/apps/docs/spec/common-api-sections.json
+++ b/apps/docs/spec/common-api-sections.json
@@ -28,6 +28,18 @@
     "type": "category",
     "title": "Analytics",
     "items": [
+      {
+        "id": "v2-create-log-drain",
+        "title": "Create log drain",
+        "slug": "v2-create-log-drain",
+        "type": "operation"
+      },
+      {
+        "id": "v2-delete-log-drain",
+        "title": "Delete log drain",
+        "slug": "v2-delete-log-drain",
+        "type": "operation"
+      },
       {
         "id": "v1-get-project-function-combined-stats",
         "title": "Get project function combined stats",
@@ -51,6 +63,18 @@
         "title": "Get project usage request count",
         "slug": "v1-get-project-usage-request-count",
         "type": "operation"
+      },
+      {
+        "id": "v2-list-log-drains",
+        "title": "List log drains",
+        "slug": "v2-list-log-drains",
+        "type": "operation"
+      },
+      {
+        "id": "v2-update-log-drain",
+        "title": "Update log drain",
+        "slug": "v2-update-log-drain",
+        "type": "operation"
       }
     ]
   },
@@ -856,12 +880,24 @@
         "slug": "v1-pause-a-project",
         "type": "operation"
       },
+      {
+        "id": "v2-preview-a-project-transfer",
+        "title": "Preview a project transfer",
+        "slug": "v2-preview-a-project-transfer",
+        "type": "operation"
+      },
       {
         "id": "v1-restore-a-project",
         "title": "Restore a project",
         "slug": "v1-restore-a-project",
         "type": "operation"
       },
+      {
+        "id": "v2-transfer-a-project",
+        "title": "Transfer a project",
+        "slug": "v2-transfer-a-project",
+        "type": "operation"
+      },
       {
         "id": "v1-update-a-project",
         "title": "Update a project",
diff --git a/apps/docs/spec/sections/generateMgmtApiSections.cts b/apps/docs/spec/sections/generateMgmtApiSections.cts
index 02deb853df4..ecb55ed9063 100644
--- a/apps/docs/spec/sections/generateMgmtApiSections.cts
+++ b/apps/docs/spec/sections/generateMgmtApiSections.cts
@@ -3,7 +3,6 @@ import path from 'path'
 
 function slugToTitle(slug) {
   if (!slug) return ''
-  // remove version prefix if available
   const prefixRegex = /^v\d+/
   const title = slug.replace(prefixRegex, '').replace(/-/g, ' ').trimStart()
   return title.charAt(0).toUpperCase() + title.slice(1)
@@ -14,100 +13,83 @@ function isValidSlug(slug) {
   return slugRegex.test(slug)
 }
 
-function extractSectionsFromOpenApi(filePath, outputPath) {
-  fs.readFile(filePath, 'utf8', (err, data) => {
-    if (err) {
-      console.error(`Error reading file ${filePath}:`, err)
-      return
-    }
+function readJson(filePath: string) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'))
+}
+
+function extractSectionsFromOpenApi(filePaths: string[], outputPath: string) {
+  try {
+    // Merge paths from all specs, later specs override earlier ones on conflict
+    const mergedPaths = Object.assign({}, ...filePaths.map((p) => readJson(p).paths ?? {}))
 
-    try {
-      const openApiJson = JSON.parse(data)
-      const categories: string[] = []
-      const sections: Array<{
+    const categories: string[] = []
+    const sections: Array<{
+      type: string
+      title: string
+      id?: string
+      slug?: string
+      items: Array<{
         type: string
         title: string
-        id?: string
-        slug?: string
-        items: Array<{
-          type: string
-          title: string
-          id: string
-          slug: string
-        }>
-      }> = []
+        id: string
+        slug: string
+      }>
+    }> = []
 
-      if (openApiJson.paths) {
-        for (const route in openApiJson.paths) {
-          const methods = openApiJson.paths[route]
-          for (const method in methods) {
-            // We are using `x-internal` to hide endpoints from the docs,
-            // but still have them included in the spec so they generate types and can be used.
-            if (methods[method]['x-internal']) {
-              continue
-            }
-
-            const tag = methods[method].tags?.[0]
-            const operationId = methods[method].operationId
-            // If operationId is not in the form of a slug ignore it.
-            // This is intentional because operationId is not defined under the swagger
-            // spec and is extracted automatically from the function name.
-            if (!tag || !isValidSlug(operationId)) continue
-
-            if (!categories.includes(tag)) {
-              categories.push(tag)
-              sections.push({
-                type: 'category',
-                title: tag,
-                items: [],
-              })
-            }
-
-            const sectionCate = sections.find((i) => i.title === tag)
-            sectionCate?.items.push({
-              id: operationId,
-              title: slugToTitle(operationId),
-              slug: operationId,
-              type: 'operation',
-            })
-          }
+    for (const route in mergedPaths) {
+      const methods = mergedPaths[route]
+      for (const method in methods) {
+        if (methods[method]['x-internal']) {
+          continue
+        }
+        const tag = methods[method].tags?.[0]
+        const operationId = methods[method].operationId
+        if (!tag || !isValidSlug(operationId)) continue
+        if (!categories.includes(tag)) {
+          categories.push(tag)
+          sections.push({
+            type: 'category',
+            title: tag,
+            items: [],
+          })
         }
+        const sectionCate = sections.find((i) => i.title === tag)
+        sectionCate?.items.push({
+          id: operationId,
+          title: slugToTitle(operationId),
+          slug: operationId,
+          type: 'operation',
+        })
       }
+    }
 
-      // finalize sections
-      sections.sort((a, b) => a.title.localeCompare(b.title))
-      sections.forEach((i) => i.items.sort((a, b) => a.title.localeCompare(b.title)))
-      sections.unshift({
-        title: 'Introduction',
-        id: 'introduction',
-        slug: 'introduction',
-        type: 'markdown',
-        items: [],
-      })
+    sections.sort((a, b) => a.title.localeCompare(b.title))
+    sections.forEach((i) => i.items.sort((a, b) => a.title.localeCompare(b.title)))
+    sections.unshift({
+      title: 'Introduction',
+      id: 'introduction',
+      slug: 'introduction',
+      type: 'markdown',
+      items: [],
+    })
 
-      fs.writeFile(outputPath, JSON.stringify(sections, null, 2), 'utf8', (err) => {
-        if (err) {
-          console.error(`Error writing to file ${outputPath}:`, err)
-          return
-        }
-        console.log(`Sections successfully generated!!!`)
-      })
-    } catch (error) {
-      console.error('Error parsing JSON:', error)
-    }
-  })
+    fs.writeFileSync(outputPath, JSON.stringify(sections, null, 2), 'utf8')
+    console.log(`Sections successfully generated!!!`)
+  } catch (error) {
+    console.error('Error:', error)
+  }
 }
 
-// Get file paths from command line arguments
 const args = process.argv.slice(2)
 if (args.length < 2) {
-  console.error('Please provide the openapi file path and output file path as arguments.')
+  console.error(
+    'Please provide at least one openapi file path and an output file path as arguments.'
+  )
   process.exit(1)
 }
 
-const inputFilePath = path.resolve(args[0])
-const outputFilePath = path.resolve(args[1])
+// Last arg is output, everything before is input files
+const outputFilePath = path.resolve(args[args.length - 1])
+const inputFilePaths = args.slice(0, -1).map((p) => path.resolve(p))
 
-;(async () => {
-  extractSectionsFromOpenApi(inputFilePath, outputFilePath)
-})()
+extractSectionsFromOpenApi(inputFilePaths, outputFilePath)
diff --git a/apps/docs/spec/transforms/api_v2_openapi_deparsed.json b/apps/docs/spec/transforms/api_v2_openapi_deparsed.json
new file mode 100644
index 00000000000..3e430f5e530
--- /dev/null
+++ b/apps/docs/spec/transforms/api_v2_openapi_deparsed.json
@@ -0,0 +1,2551 @@
+{
+  "openapi": "3.0.0",
+  "info": {
+    "title": "Supabase API (v2)",
+    "description": "Supabase API generated from the OpenAPI specification.<br>Visit [https://supabase.com/docs](https://supabase.com/docs) for a complete documentation.",
+    "version": "1.0.0",
+    "contact": {}
+  },
+  "servers": [],
+  "tags": [],
+  "paths": {
+    "/v2/projects/{ref}/analytics/log-drains": {
+      "get": {
+        "operationId": "v2-list-log-drains",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "type": {
+                            "type": "string",
+                            "enum": ["log_drain"],
+                            "description": "Resource type."
+                          },
+                          "id": {
+                            "type": "string"
+                          },
+                          "attributes": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string"
+                              },
+                              "description": {
+                                "type": "string"
+                              },
+                              "config": {
+                                "oneOf": [
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "url": {
+                                        "type": "string",
+                                        "nullable": true
+                                      },
+                                      "schema": {
+                                        "type": "string"
+                                      },
+                                      "username": {
+                                        "type": "string",
+                                        "nullable": true
+                                      },
+                                      "password": {
+                                        "type": "string",
+                                        "nullable": true
+                                      },
+                                      "port": {
+                                        "type": "number",
+                                        "nullable": true
+                                      },
+                                      "hostname": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "postgres"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "url": {
+                                        "type": "string"
+                                      },
+                                      "http": {
+                                        "type": "string",
+                                        "enum": ["http1", "http2"]
+                                      },
+                                      "gzip": {
+                                        "type": "boolean"
+                                      },
+                                      "headers": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                          "type": "string"
+                                        }
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "webhook"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "project_id": {
+                                        "type": "string"
+                                      },
+                                      "dataset_id": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "bigquery"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "api_key": {
+                                        "type": "string"
+                                      },
+                                      "region": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "datadog"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "url": {
+                                        "type": "string"
+                                      },
+                                      "username": {
+                                        "type": "string",
+                                        "nullable": true
+                                      },
+                                      "password": {
+                                        "type": "string",
+                                        "nullable": true
+                                      },
+                                      "headers": {
+                                        "type": "object",
+                                        "additionalProperties": {
+                                          "type": "string"
+                                        }
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "loki"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "dsn": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "sentry"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "domain": {
+                                        "type": "string"
+                                      },
+                                      "api_token": {
+                                        "type": "string"
+                                      },
+                                      "dataset_name": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "axiom"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "host": {
+                                        "type": "string"
+                                      },
+                                      "port": {
+                                        "type": "integer",
+                                        "minimum": 0,
+                                        "maximum": 65535
+                                      },
+                                      "tls": {
+                                        "default": false,
+                                        "type": "boolean"
+                                      },
+                                      "structured_data": {
+                                        "type": "string"
+                                      },
+                                      "cipher_key": {
+                                        "type": "string"
+                                      },
+                                      "ca_cert": {
+                                        "type": "string"
+                                      },
+                                      "client_cert": {
+                                        "type": "string"
+                                      },
+                                      "client_key": {
+                                        "type": "string"
+                                      }
+                                    },
+                                    "additionalProperties": false,
+                                    "title": "syslog"
+                                  }
+                                ]
+                              },
+                              "backend_type": {
+                                "type": "string",
+                                "enum": [
+                                  "postgres",
+                                  "bigquery",
+                                  "clickhouse",
+                                  "webhook",
+                                  "datadog",
+                                  "loki",
+                                  "sentry",
+                                  "s3",
+                                  "axiom",
+                                  "last9",
+                                  "otlp",
+                                  "syslog"
+                                ]
+                              }
+                            },
+                            "required": ["name", "config", "backend_type"]
+                          }
+                        },
+                        "required": ["type", "id", "attributes"]
+                      }
+                    }
+                  },
+                  "required": ["data"]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to fetch log drains"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["analytics_config_read"]
+          }
+        ],
+        "summary": "List project log drains",
+        "tags": ["Analytics"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: analytics_config:read",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:read"
+      },
+      "post": {
+        "operationId": "v2-create-log-drain",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "data": {
+                    "type": "object",
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": ["log_drain"],
+                        "description": "Resource type."
+                      },
+                      "attributes": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string"
+                          },
+                          "description": {
+                            "type": "string"
+                          },
+                          "config": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "url": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "schema": {
+                                    "type": "string"
+                                  },
+                                  "username": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "password": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "port": {
+                                    "type": "number",
+                                    "nullable": true
+                                  },
+                                  "hostname": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "postgres"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "url": {
+                                    "type": "string"
+                                  },
+                                  "http": {
+                                    "type": "string",
+                                    "enum": ["http1", "http2"]
+                                  },
+                                  "gzip": {
+                                    "type": "boolean"
+                                  },
+                                  "headers": {
+                                    "type": "object",
+                                    "additionalProperties": {
+                                      "type": "string"
+                                    }
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "webhook"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "project_id": {
+                                    "type": "string"
+                                  },
+                                  "dataset_id": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "bigquery"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "api_key": {
+                                    "type": "string"
+                                  },
+                                  "region": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "datadog"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "url": {
+                                    "type": "string"
+                                  },
+                                  "username": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "password": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "headers": {
+                                    "type": "object",
+                                    "additionalProperties": {
+                                      "type": "string"
+                                    }
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "loki"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "dsn": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "sentry"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "domain": {
+                                    "type": "string"
+                                  },
+                                  "api_token": {
+                                    "type": "string"
+                                  },
+                                  "dataset_name": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "axiom"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "host": {
+                                    "type": "string"
+                                  },
+                                  "port": {
+                                    "type": "integer",
+                                    "minimum": 0,
+                                    "maximum": 65535
+                                  },
+                                  "tls": {
+                                    "default": false,
+                                    "type": "boolean"
+                                  },
+                                  "structured_data": {
+                                    "type": "string"
+                                  },
+                                  "cipher_key": {
+                                    "type": "string"
+                                  },
+                                  "ca_cert": {
+                                    "type": "string"
+                                  },
+                                  "client_cert": {
+                                    "type": "string"
+                                  },
+                                  "client_key": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "syslog"
+                              }
+                            ]
+                          },
+                          "backend_type": {
+                            "type": "string",
+                            "enum": [
+                              "postgres",
+                              "bigquery",
+                              "clickhouse",
+                              "webhook",
+                              "datadog",
+                              "loki",
+                              "sentry",
+                              "s3",
+                              "axiom",
+                              "last9",
+                              "otlp",
+                              "syslog"
+                            ]
+                          }
+                        },
+                        "required": ["name", "config", "backend_type"]
+                      }
+                    },
+                    "required": ["type", "attributes"]
+                  }
+                },
+                "required": ["data"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "data": {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "enum": ["log_drain"],
+                          "description": "Resource type."
+                        },
+                        "id": {
+                          "type": "string"
+                        },
+                        "attributes": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string"
+                            },
+                            "description": {
+                              "type": "string"
+                            },
+                            "config": {
+                              "oneOf": [
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "url": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "schema": {
+                                      "type": "string"
+                                    },
+                                    "username": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "password": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "port": {
+                                      "type": "number",
+                                      "nullable": true
+                                    },
+                                    "hostname": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "postgres"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "url": {
+                                      "type": "string"
+                                    },
+                                    "http": {
+                                      "type": "string",
+                                      "enum": ["http1", "http2"]
+                                    },
+                                    "gzip": {
+                                      "type": "boolean"
+                                    },
+                                    "headers": {
+                                      "type": "object",
+                                      "additionalProperties": {
+                                        "type": "string"
+                                      }
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "webhook"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "project_id": {
+                                      "type": "string"
+                                    },
+                                    "dataset_id": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "bigquery"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "api_key": {
+                                      "type": "string"
+                                    },
+                                    "region": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "datadog"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "url": {
+                                      "type": "string"
+                                    },
+                                    "username": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "password": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "headers": {
+                                      "type": "object",
+                                      "additionalProperties": {
+                                        "type": "string"
+                                      }
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "loki"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "dsn": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "sentry"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "domain": {
+                                      "type": "string"
+                                    },
+                                    "api_token": {
+                                      "type": "string"
+                                    },
+                                    "dataset_name": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "axiom"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "host": {
+                                      "type": "string"
+                                    },
+                                    "port": {
+                                      "type": "integer",
+                                      "minimum": 0,
+                                      "maximum": 65535
+                                    },
+                                    "tls": {
+                                      "default": false,
+                                      "type": "boolean"
+                                    },
+                                    "structured_data": {
+                                      "type": "string"
+                                    },
+                                    "cipher_key": {
+                                      "type": "string"
+                                    },
+                                    "ca_cert": {
+                                      "type": "string"
+                                    },
+                                    "client_cert": {
+                                      "type": "string"
+                                    },
+                                    "client_key": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "syslog"
+                                }
+                              ]
+                            },
+                            "backend_type": {
+                              "type": "string",
+                              "enum": [
+                                "postgres",
+                                "bigquery",
+                                "clickhouse",
+                                "webhook",
+                                "datadog",
+                                "loki",
+                                "sentry",
+                                "s3",
+                                "axiom",
+                                "last9",
+                                "otlp",
+                                "syslog"
+                              ]
+                            }
+                          },
+                          "required": ["name", "config", "backend_type"]
+                        }
+                      },
+                      "required": ["type", "id", "attributes"]
+                    }
+                  },
+                  "required": ["data"]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "402": {
+            "description": "This feature requires the Pro, Team, or Enterprise organization plan."
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to create a log drain"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["analytics_config_write"]
+          }
+        ],
+        "summary": "Create a log drain for a project",
+        "tags": ["Analytics"],
+        "x-allowed-plans": ["Pro", "Team", "Enterprise"],
+        "x-badges": [
+          {
+            "name": "Only available on Pro, Team, Enterprise",
+            "position": "before"
+          },
+          {
+            "name": "OAuth scope: analytics_config:write",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:write"
+      }
+    },
+    "/v2/projects/{ref}/analytics/log-drains/{id}": {
+      "put": {
+        "operationId": "v2-update-log-drain",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          },
+          {
+            "name": "id",
+            "required": true,
+            "in": "path",
+            "description": "Log drains identifier",
+            "schema": {
+              "format": "uuid",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "data": {
+                    "type": "object",
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": ["log_drain"],
+                        "description": "Resource type."
+                      },
+                      "attributes": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string"
+                          },
+                          "description": {
+                            "type": "string"
+                          },
+                          "config": {
+                            "oneOf": [
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "url": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "schema": {
+                                    "type": "string"
+                                  },
+                                  "username": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "password": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "port": {
+                                    "type": "number",
+                                    "nullable": true
+                                  },
+                                  "hostname": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "postgres"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "url": {
+                                    "type": "string"
+                                  },
+                                  "http": {
+                                    "type": "string",
+                                    "enum": ["http1", "http2"]
+                                  },
+                                  "gzip": {
+                                    "type": "boolean"
+                                  },
+                                  "headers": {
+                                    "type": "object",
+                                    "additionalProperties": {
+                                      "type": "string"
+                                    }
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "webhook"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "project_id": {
+                                    "type": "string"
+                                  },
+                                  "dataset_id": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "bigquery"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "api_key": {
+                                    "type": "string"
+                                  },
+                                  "region": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "datadog"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "url": {
+                                    "type": "string"
+                                  },
+                                  "username": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "password": {
+                                    "type": "string",
+                                    "nullable": true
+                                  },
+                                  "headers": {
+                                    "type": "object",
+                                    "additionalProperties": {
+                                      "type": "string"
+                                    }
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "loki"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "dsn": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "sentry"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "domain": {
+                                    "type": "string"
+                                  },
+                                  "api_token": {
+                                    "type": "string"
+                                  },
+                                  "dataset_name": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "axiom"
+                              },
+                              {
+                                "type": "object",
+                                "properties": {
+                                  "host": {
+                                    "type": "string"
+                                  },
+                                  "port": {
+                                    "type": "integer",
+                                    "minimum": 0,
+                                    "maximum": 65535
+                                  },
+                                  "tls": {
+                                    "default": false,
+                                    "type": "boolean"
+                                  },
+                                  "structured_data": {
+                                    "type": "string"
+                                  },
+                                  "cipher_key": {
+                                    "type": "string"
+                                  },
+                                  "ca_cert": {
+                                    "type": "string"
+                                  },
+                                  "client_cert": {
+                                    "type": "string"
+                                  },
+                                  "client_key": {
+                                    "type": "string"
+                                  }
+                                },
+                                "additionalProperties": false,
+                                "title": "syslog"
+                              }
+                            ]
+                          },
+                          "backend_type": {
+                            "type": "string",
+                            "enum": [
+                              "postgres",
+                              "bigquery",
+                              "clickhouse",
+                              "webhook",
+                              "datadog",
+                              "loki",
+                              "sentry",
+                              "s3",
+                              "axiom",
+                              "last9",
+                              "otlp",
+                              "syslog"
+                            ]
+                          }
+                        },
+                        "required": ["backend_type"]
+                      }
+                    },
+                    "required": ["type", "attributes"]
+                  }
+                },
+                "required": ["data"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "data": {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "enum": ["log_drain"],
+                          "description": "Resource type."
+                        },
+                        "id": {
+                          "type": "string"
+                        },
+                        "attributes": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string"
+                            },
+                            "description": {
+                              "type": "string"
+                            },
+                            "config": {
+                              "oneOf": [
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "url": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "schema": {
+                                      "type": "string"
+                                    },
+                                    "username": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "password": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "port": {
+                                      "type": "number",
+                                      "nullable": true
+                                    },
+                                    "hostname": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "postgres"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "url": {
+                                      "type": "string"
+                                    },
+                                    "http": {
+                                      "type": "string",
+                                      "enum": ["http1", "http2"]
+                                    },
+                                    "gzip": {
+                                      "type": "boolean"
+                                    },
+                                    "headers": {
+                                      "type": "object",
+                                      "additionalProperties": {
+                                        "type": "string"
+                                      }
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "webhook"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "project_id": {
+                                      "type": "string"
+                                    },
+                                    "dataset_id": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "bigquery"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "api_key": {
+                                      "type": "string"
+                                    },
+                                    "region": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "datadog"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "url": {
+                                      "type": "string"
+                                    },
+                                    "username": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "password": {
+                                      "type": "string",
+                                      "nullable": true
+                                    },
+                                    "headers": {
+                                      "type": "object",
+                                      "additionalProperties": {
+                                        "type": "string"
+                                      }
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "loki"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "dsn": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "sentry"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "domain": {
+                                      "type": "string"
+                                    },
+                                    "api_token": {
+                                      "type": "string"
+                                    },
+                                    "dataset_name": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "axiom"
+                                },
+                                {
+                                  "type": "object",
+                                  "properties": {
+                                    "host": {
+                                      "type": "string"
+                                    },
+                                    "port": {
+                                      "type": "integer",
+                                      "minimum": 0,
+                                      "maximum": 65535
+                                    },
+                                    "tls": {
+                                      "default": false,
+                                      "type": "boolean"
+                                    },
+                                    "structured_data": {
+                                      "type": "string"
+                                    },
+                                    "cipher_key": {
+                                      "type": "string"
+                                    },
+                                    "ca_cert": {
+                                      "type": "string"
+                                    },
+                                    "client_cert": {
+                                      "type": "string"
+                                    },
+                                    "client_key": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "additionalProperties": false,
+                                  "title": "syslog"
+                                }
+                              ]
+                            },
+                            "backend_type": {
+                              "type": "string",
+                              "enum": [
+                                "postgres",
+                                "bigquery",
+                                "clickhouse",
+                                "webhook",
+                                "datadog",
+                                "loki",
+                                "sentry",
+                                "s3",
+                                "axiom",
+                                "last9",
+                                "otlp",
+                                "syslog"
+                              ]
+                            }
+                          },
+                          "required": ["name", "config", "backend_type"]
+                        }
+                      },
+                      "required": ["type", "id", "attributes"]
+                    }
+                  },
+                  "required": ["data"]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to update log drain"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["analytics_config_write"]
+          }
+        ],
+        "summary": "Update a project log drain",
+        "tags": ["Analytics"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: analytics_config:write",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:write"
+      },
+      "delete": {
+        "operationId": "v2-delete-log-drain",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          },
+          {
+            "name": "id",
+            "required": true,
+            "in": "path",
+            "description": "Log drains identifier",
+            "schema": {
+              "format": "uuid",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": ""
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          },
+          "500": {
+            "description": "Failed to delete a log drain"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["analytics_config_write"]
+          }
+        ],
+        "summary": "Delete a project log drain",
+        "tags": ["Analytics"],
+        "x-badges": [
+          {
+            "name": "OAuth scope: analytics_config:write",
+            "position": "after"
+          }
+        ],
+        "x-endpoint-owners": ["analytics"],
+        "x-oauth-scope": "analytics_config:write"
+      }
+    },
+    "/v2/projects/{ref}/transfers/previews": {
+      "post": {
+        "operationId": "v2-preview-a-project-transfer",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "data": {
+                    "type": "object",
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": ["project_transfer_input"],
+                        "description": "Resource type."
+                      },
+                      "attributes": {
+                        "type": "object",
+                        "properties": {
+                          "target_organization_slug": {
+                            "type": "string"
+                          }
+                        },
+                        "required": ["target_organization_slug"]
+                      }
+                    },
+                    "required": ["type", "attributes"]
+                  }
+                },
+                "required": ["data"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "data": {
+                      "type": "object",
+                      "properties": {
+                        "type": {
+                          "type": "string",
+                          "enum": ["project_transfer_result"],
+                          "description": "Resource type."
+                        },
+                        "attributes": {
+                          "type": "object",
+                          "properties": {
+                            "valid": {
+                              "type": "boolean"
+                            },
+                            "warnings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "key": {
+                                    "type": "string"
+                                  },
+                                  "message": {
+                                    "type": "string"
+                                  }
+                                },
+                                "required": ["key", "message"]
+                              }
+                            },
+                            "errors": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "key": {
+                                    "type": "string"
+                                  },
+                                  "message": {
+                                    "type": "string"
+                                  }
+                                },
+                                "required": ["key", "message"]
+                              }
+                            },
+                            "info": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "key": {
+                                    "type": "string"
+                                  },
+                                  "message": {
+                                    "type": "string"
+                                  }
+                                },
+                                "required": ["key", "message"]
+                              }
+                            }
+                          },
+                          "required": ["valid", "warnings", "errors", "info"]
+                        }
+                      },
+                      "required": ["type", "attributes"]
+                    }
+                  },
+                  "required": ["data"]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["project_admin_read"]
+          }
+        ],
+        "summary": "Previews transferring a project to a different organizations, shows eligibility and impact",
+        "tags": ["Projects"],
+        "x-endpoint-owners": ["management-api"]
+      }
+    },
+    "/v2/projects/{ref}/transfers": {
+      "post": {
+        "operationId": "v2-transfer-a-project",
+        "parameters": [
+          {
+            "name": "ref",
+            "required": true,
+            "in": "path",
+            "description": "Project ref",
+            "schema": {
+              "minLength": 20,
+              "maxLength": 20,
+              "pattern": "^[a-z]+$",
+              "example": "abcdefghijklmnopqrst",
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "data": {
+                    "type": "object",
+                    "properties": {
+                      "type": {
+                        "type": "string",
+                        "enum": ["project_transfer_input"],
+                        "description": "Resource type."
+                      },
+                      "attributes": {
+                        "type": "object",
+                        "properties": {
+                          "target_organization_slug": {
+                            "type": "string"
+                          }
+                        },
+                        "required": ["target_organization_slug"]
+                      }
+                    },
+                    "required": ["type", "attributes"]
+                  }
+                },
+                "required": ["data"]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": ""
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden action"
+          },
+          "429": {
+            "description": "Rate limit exceeded"
+          }
+        },
+        "security": [
+          {
+            "bearer": []
+          },
+          {
+            "fga_permissions": ["organization_admin_write"]
+          }
+        ],
+        "summary": "Transfers a project to a different organization",
+        "tags": ["Projects"],
+        "x-endpoint-owners": ["management-api"]
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearer": {
+        "scheme": "bearer",
+        "bearerFormat": "JWT",
+        "type": "http"
+      }
+    },
+    "schemas": {
+      "ListLogDrainsResponse": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "enum": ["log_drain"],
+                  "description": "Resource type."
+                },
+                "id": {
+                  "type": "string"
+                },
+                "attributes": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string"
+                    },
+                    "description": {
+                      "type": "string"
+                    },
+                    "config": {
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "url": {
+                              "type": "string",
+                              "nullable": true
+                            },
+                            "schema": {
+                              "type": "string"
+                            },
+                            "username": {
+                              "type": "string",
+                              "nullable": true
+                            },
+                            "password": {
+                              "type": "string",
+                              "nullable": true
+                            },
+                            "port": {
+                              "type": "number",
+                              "nullable": true
+                            },
+                            "hostname": {
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "postgres"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "url": {
+                              "type": "string"
+                            },
+                            "http": {
+                              "type": "string",
+                              "enum": ["http1", "http2"]
+                            },
+                            "gzip": {
+                              "type": "boolean"
+                            },
+                            "headers": {
+                              "type": "object",
+                              "additionalProperties": {
+                                "type": "string"
+                              }
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "webhook"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "project_id": {
+                              "type": "string"
+                            },
+                            "dataset_id": {
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "bigquery"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "api_key": {
+                              "type": "string"
+                            },
+                            "region": {
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "datadog"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "url": {
+                              "type": "string"
+                            },
+                            "username": {
+                              "type": "string",
+                              "nullable": true
+                            },
+                            "password": {
+                              "type": "string",
+                              "nullable": true
+                            },
+                            "headers": {
+                              "type": "object",
+                              "additionalProperties": {
+                                "type": "string"
+                              }
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "loki"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "dsn": {
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "sentry"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "domain": {
+                              "type": "string"
+                            },
+                            "api_token": {
+                              "type": "string"
+                            },
+                            "dataset_name": {
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "axiom"
+                        },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "host": {
+                              "type": "string"
+                            },
+                            "port": {
+                              "type": "integer",
+                              "minimum": 0,
+                              "maximum": 65535
+                            },
+                            "tls": {
+                              "default": false,
+                              "type": "boolean"
+                            },
+                            "structured_data": {
+                              "type": "string"
+                            },
+                            "cipher_key": {
+                              "type": "string"
+                            },
+                            "ca_cert": {
+                              "type": "string"
+                            },
+                            "client_cert": {
+                              "type": "string"
+                            },
+                            "client_key": {
+                              "type": "string"
+                            }
+                          },
+                          "additionalProperties": false,
+                          "title": "syslog"
+                        }
+                      ]
+                    },
+                    "backend_type": {
+                      "type": "string",
+                      "enum": [
+                        "postgres",
+                        "bigquery",
+                        "clickhouse",
+                        "webhook",
+                        "datadog",
+                        "loki",
+                        "sentry",
+                        "s3",
+                        "axiom",
+                        "last9",
+                        "otlp",
+                        "syslog"
+                      ]
+                    }
+                  },
+                  "required": ["name", "config", "backend_type"]
+                }
+              },
+              "required": ["type", "id", "attributes"]
+            }
+          }
+        },
+        "required": ["data"]
+      },
+      "CreateLogDrainRequestOpenApi": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["log_drain"],
+                "description": "Resource type."
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "description": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "oneOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "schema": {
+                            "type": "string"
+                          },
+                          "username": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "password": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "port": {
+                            "type": "number",
+                            "nullable": true
+                          },
+                          "hostname": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "postgres"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string"
+                          },
+                          "http": {
+                            "type": "string",
+                            "enum": ["http1", "http2"]
+                          },
+                          "gzip": {
+                            "type": "boolean"
+                          },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "webhook"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "project_id": {
+                            "type": "string"
+                          },
+                          "dataset_id": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "bigquery"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "api_key": {
+                            "type": "string"
+                          },
+                          "region": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "datadog"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string"
+                          },
+                          "username": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "password": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "loki"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "dsn": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "sentry"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "domain": {
+                            "type": "string"
+                          },
+                          "api_token": {
+                            "type": "string"
+                          },
+                          "dataset_name": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "axiom"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "host": {
+                            "type": "string"
+                          },
+                          "port": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 65535
+                          },
+                          "tls": {
+                            "default": false,
+                            "type": "boolean"
+                          },
+                          "structured_data": {
+                            "type": "string"
+                          },
+                          "cipher_key": {
+                            "type": "string"
+                          },
+                          "ca_cert": {
+                            "type": "string"
+                          },
+                          "client_cert": {
+                            "type": "string"
+                          },
+                          "client_key": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "syslog"
+                      }
+                    ]
+                  },
+                  "backend_type": {
+                    "type": "string",
+                    "enum": [
+                      "postgres",
+                      "bigquery",
+                      "clickhouse",
+                      "webhook",
+                      "datadog",
+                      "loki",
+                      "sentry",
+                      "s3",
+                      "axiom",
+                      "last9",
+                      "otlp",
+                      "syslog"
+                    ]
+                  }
+                },
+                "required": ["name", "config", "backend_type"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "LogDrainResponse": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["log_drain"],
+                "description": "Resource type."
+              },
+              "id": {
+                "type": "string"
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "description": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "oneOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "schema": {
+                            "type": "string"
+                          },
+                          "username": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "password": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "port": {
+                            "type": "number",
+                            "nullable": true
+                          },
+                          "hostname": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "postgres"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string"
+                          },
+                          "http": {
+                            "type": "string",
+                            "enum": ["http1", "http2"]
+                          },
+                          "gzip": {
+                            "type": "boolean"
+                          },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "webhook"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "project_id": {
+                            "type": "string"
+                          },
+                          "dataset_id": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "bigquery"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "api_key": {
+                            "type": "string"
+                          },
+                          "region": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "datadog"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string"
+                          },
+                          "username": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "password": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "loki"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "dsn": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "sentry"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "domain": {
+                            "type": "string"
+                          },
+                          "api_token": {
+                            "type": "string"
+                          },
+                          "dataset_name": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "axiom"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "host": {
+                            "type": "string"
+                          },
+                          "port": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 65535
+                          },
+                          "tls": {
+                            "default": false,
+                            "type": "boolean"
+                          },
+                          "structured_data": {
+                            "type": "string"
+                          },
+                          "cipher_key": {
+                            "type": "string"
+                          },
+                          "ca_cert": {
+                            "type": "string"
+                          },
+                          "client_cert": {
+                            "type": "string"
+                          },
+                          "client_key": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "syslog"
+                      }
+                    ]
+                  },
+                  "backend_type": {
+                    "type": "string",
+                    "enum": [
+                      "postgres",
+                      "bigquery",
+                      "clickhouse",
+                      "webhook",
+                      "datadog",
+                      "loki",
+                      "sentry",
+                      "s3",
+                      "axiom",
+                      "last9",
+                      "otlp",
+                      "syslog"
+                    ]
+                  }
+                },
+                "required": ["name", "config", "backend_type"]
+              }
+            },
+            "required": ["type", "id", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "UpdateLogDrainRequestOpenApi": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["log_drain"],
+                "description": "Resource type."
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "description": {
+                    "type": "string"
+                  },
+                  "config": {
+                    "oneOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "schema": {
+                            "type": "string"
+                          },
+                          "username": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "password": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "port": {
+                            "type": "number",
+                            "nullable": true
+                          },
+                          "hostname": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "postgres"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string"
+                          },
+                          "http": {
+                            "type": "string",
+                            "enum": ["http1", "http2"]
+                          },
+                          "gzip": {
+                            "type": "boolean"
+                          },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "webhook"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "project_id": {
+                            "type": "string"
+                          },
+                          "dataset_id": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "bigquery"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "api_key": {
+                            "type": "string"
+                          },
+                          "region": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "datadog"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "url": {
+                            "type": "string"
+                          },
+                          "username": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "password": {
+                            "type": "string",
+                            "nullable": true
+                          },
+                          "headers": {
+                            "type": "object",
+                            "additionalProperties": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "loki"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "dsn": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "sentry"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "domain": {
+                            "type": "string"
+                          },
+                          "api_token": {
+                            "type": "string"
+                          },
+                          "dataset_name": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "axiom"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "host": {
+                            "type": "string"
+                          },
+                          "port": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 65535
+                          },
+                          "tls": {
+                            "default": false,
+                            "type": "boolean"
+                          },
+                          "structured_data": {
+                            "type": "string"
+                          },
+                          "cipher_key": {
+                            "type": "string"
+                          },
+                          "ca_cert": {
+                            "type": "string"
+                          },
+                          "client_cert": {
+                            "type": "string"
+                          },
+                          "client_key": {
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "title": "syslog"
+                      }
+                    ]
+                  },
+                  "backend_type": {
+                    "type": "string",
+                    "enum": [
+                      "postgres",
+                      "bigquery",
+                      "clickhouse",
+                      "webhook",
+                      "datadog",
+                      "loki",
+                      "sentry",
+                      "s3",
+                      "axiom",
+                      "last9",
+                      "otlp",
+                      "syslog"
+                    ]
+                  }
+                },
+                "required": ["backend_type"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "V2TransferProjectBody": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["project_transfer_input"],
+                "description": "Resource type."
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "target_organization_slug": {
+                    "type": "string"
+                  }
+                },
+                "required": ["target_organization_slug"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      },
+      "V2PreviewProjectTransferResponse": {
+        "type": "object",
+        "properties": {
+          "data": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": ["project_transfer_result"],
+                "description": "Resource type."
+              },
+              "attributes": {
+                "type": "object",
+                "properties": {
+                  "valid": {
+                    "type": "boolean"
+                  },
+                  "warnings": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "key": {
+                          "type": "string"
+                        },
+                        "message": {
+                          "type": "string"
+                        }
+                      },
+                      "required": ["key", "message"]
+                    }
+                  },
+                  "errors": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "key": {
+                          "type": "string"
+                        },
+                        "message": {
+                          "type": "string"
+                        }
+                      },
+                      "required": ["key", "message"]
+                    }
+                  },
+                  "info": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "key": {
+                          "type": "string"
+                        },
+                        "message": {
+                          "type": "string"
+                        }
+                      },
+                      "required": ["key", "message"]
+                    }
+                  }
+                },
+                "required": ["valid", "warnings", "errors", "info"]
+              }
+            },
+            "required": ["type", "attributes"]
+          }
+        },
+        "required": ["data"]
+      }
+    }
+  }
+}

From 101158e8249954c466aaeaf2f957c1e24ebe4d83 Mon Sep 17 00:00:00 2001
From: Raminder Singh <romi_ssk@yahoo.co.in>
Date: Thu, 4 Jun 2026 13:48:00 +0530
Subject: [PATCH 20/23] chore: remove deprecated fields (#46636)

Removed unused deprecated fields from marketplace types.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Updated listing configuration types to reflect current system
behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 packages/common/marketplace.types.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/common/marketplace.types.ts b/packages/common/marketplace.types.ts
index a5f625aebd2..b2712607278 100644
--- a/packages/common/marketplace.types.ts
+++ b/packages/common/marketplace.types.ts
@@ -55,8 +55,6 @@ export type Database = {
           partner_logo: string | null
           partner_name: string | null
           partner_slug: string | null
-          publish_dashboard: boolean | null
-          publish_marketplace: boolean | null
           published_in_catalog_at: string | null
           published_in_marketplace_at: string | null
           secret_key_prefix: string | null

From 6e08c11bb7fa9909e903cc976df2d156ba36700d Mon Sep 17 00:00:00 2001
From: Jeremias Menichelli <jmenichelli@gmail.com>
Date: Thu, 4 Jun 2026 10:41:42 +0200
Subject: [PATCH 21/23] fix: Rely on docs tag for wrappers content fetching
 (#46622)

---
 .../extensions/wrappers/[[...slug]]/page.tsx  | 68 +++++++++++++++++--
 1 file changed, 63 insertions(+), 5 deletions(-)

diff --git a/apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx b/apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx
index d7cb4b25678..ebafbd690b7 100644
--- a/apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx
+++ b/apps/docs/app/guides/database/extensions/wrappers/[[...slug]]/page.tsx
@@ -15,7 +15,7 @@ import { linkTransform, type UrlTransformFunction } from '~/lib/mdx/plugins/rehy
 import remarkMkDocsAdmonition from '~/lib/mdx/plugins/remarkAdmonition'
 import { removeTitle } from '~/lib/mdx/plugins/remarkRemoveTitle'
 import remarkPyMdownTabs from '~/lib/mdx/plugins/remarkTabs'
-import { getGitHubFileContents } from '~/lib/octokit'
+import { getGitHubFileContents, octokit } from '~/lib/octokit'
 import type { SerializeOptions } from '~/types/next-mdx-remote-serialize'
 import { isFeatureEnabled } from 'common'
 import matter from 'gray-matter'
@@ -29,10 +29,62 @@ import { Admonition } from 'ui-patterns'
 // We fetch these docs at build time from an external repo
 const org = 'supabase'
 const repo = 'wrappers'
-const branch = 'main'
 const docsDir = 'docs/catalog'
 const externalSite = 'https://supabase.github.io/wrappers'
 
+type DocsTagsQueryResponse = {
+  repository: {
+    refs: {
+      nodes: { name: string }[] | null
+      pageInfo: { hasNextPage: boolean; endCursor: string | null }
+    }
+  }
+}
+
+const docsTagsQuery = `
+  query DocsTagsQuery($owner: String!, $name: String!, $after: String) {
+    repository(owner: $owner, name: $name) {
+      refs(
+        refPrefix: "refs/tags/",
+        orderBy: { field: TAG_COMMIT_DATE, direction: DESC },
+        first: 5,
+        after: $after
+      ) {
+        nodes { name }
+        pageInfo { hasNextPage endCursor }
+      }
+    }
+  }
+`
+
+async function getLatestDocsTag(after: string | null = null): Promise<string | null> {
+  try {
+    /**
+     * We use GraphQL as it's the only way to use `orderBy` on Github API.
+     */
+    const {
+      repository: {
+        refs: {
+          nodes,
+          pageInfo: { hasNextPage, endCursor },
+        },
+      },
+    } = await octokit().graphql<DocsTagsQueryResponse>(docsTagsQuery, {
+      owner: org,
+      name: repo,
+      after,
+    })
+
+    return (
+      nodes?.find(({ name }) => /^docs_v\d+\.\d+\.\d+/.test(name))?.name ??
+      (hasNextPage && endCursor ? await getLatestDocsTag(endCursor) : null)
+    )
+  } catch (error) {
+    console.error(`Error fetching docs tags for wrappers federated pages: ${error}`)
+    return null
+  }
+}
+
 // Each external docs page is mapped to a local page
 const pageMap = [
   {
@@ -378,16 +430,22 @@ const getContent = async (params: Params) => {
     let remoteFile: string
     ;({ remoteFile, meta } = federatedPage)
 
-    editLink = `${org}/${repo}/blob/${branch}/${docsDir}/${remoteFile}`
+    const tag = await getLatestDocsTag()
+
+    if (!tag) {
+      throw new Error('No latest docs tag found for federated wrappers pages')
+    }
+
+    editLink = `${org}/${repo}/blob/${tag}/${docsDir}/${remoteFile}`
 
     let rawContent = await getGitHubFileContents({
       org,
       repo,
       path: `${docsDir}/${remoteFile}`,
-      branch,
+      branch: tag,
     })
 
-    assetsBaseUrl = `https://raw.githubusercontent.com/${org}/${repo}/${branch}/docs/assets/`
+    assetsBaseUrl = `https://raw.githubusercontent.com/${org}/${repo}/${tag}/docs/assets/`
 
     const { content: contentWithoutFrontmatter } = matter(rawContent)
     content = removeRedundantH1(contentWithoutFrontmatter)

From 714f0ad8e9dd58c0c87bfe51cfd543b44941b1b7 Mon Sep 17 00:00:00 2001
From: Ivan Vasilov <vasilov.ivan@gmail.com>
Date: Thu, 4 Jun 2026 12:17:14 +0300
Subject: [PATCH 22/23] fix: Don't use the custom domain when resolving OpenID
 config (#46637)

When setting up an OAuth Server app, the Studio fetches OpenID config
from the URL. If the project uses custom domain, it'll cause a CORS
because the custom domain is not whitelisted. This PR changes to use the
`<ref>.supabase.co` URL to resolve the config.

How to test:

1. Have a project with custom domain
2. Open `/project/_/auth/oauth-server`
3. Enable the Supabase OAuth Server
4. The OAuth endpoints in the bottom should appear

BEFORE:
<img width="1172" height="412" alt="Screenshot 2026-06-04 at 10 43 35"
src="https://github.com/user-attachments/assets/d6157281-dc80-4a55-9356-10efb7953b7c"
/>

AFTER:
<img width="1182" height="406" alt="Screenshot 2026-06-04 at 10 42 20"
src="https://github.com/user-attachments/assets/6222124e-5f9e-4898-9fae-41d295211403"
/>

Fixes
https://linear.app/supabase/issue/FE-2987/oauth-endpoint-fields-are-empty-with-custom-domains
---
 .../Auth/OAuthApps/OAuthServerSettingsForm.tsx     |  8 ++------
 .../oauth-openid-configuration-query.ts            | 14 +++++++-------
 2 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/apps/studio/components/interfaces/Auth/OAuthApps/OAuthServerSettingsForm.tsx b/apps/studio/components/interfaces/Auth/OAuthApps/OAuthServerSettingsForm.tsx
index 1be26ad534a..44ba297c29a 100644
--- a/apps/studio/components/interfaces/Auth/OAuthApps/OAuthServerSettingsForm.tsx
+++ b/apps/studio/components/interfaces/Auth/OAuthApps/OAuthServerSettingsForm.tsx
@@ -1,7 +1,6 @@
 import { zodResolver } from '@hookform/resolvers/zod'
 import { PermissionAction } from '@supabase/shared-types/out/constants'
 import { useParams } from 'common'
-import dynamic from 'next/dynamic'
 import Link from 'next/link'
 import { useEffect, useState } from 'react'
 import { useForm } from 'react-hook-form'
@@ -17,13 +16,14 @@ import {
   Input,
   Switch,
 } from 'ui'
-import { PageSection, PageSectionContent } from 'ui-patterns'
 import { Admonition } from 'ui-patterns/admonition'
 import ConfirmationModal from 'ui-patterns/Dialogs/ConfirmationModal'
 import { FormItemLayout } from 'ui-patterns/form/FormItemLayout/FormItemLayout'
+import { PageSection, PageSectionContent } from 'ui-patterns/PageSection'
 import { GenericSkeletonLoader } from 'ui-patterns/ShimmeringLoader'
 import * as z from 'zod'
 
+import { OAuthEndpointsTable } from './OAuthEndpointsTable'
 import { InlineLink } from '@/components/ui/InlineLink'
 import NoPermission from '@/components/ui/NoPermission'
 import { useAuthConfigQuery } from '@/data/auth/auth-config-query'
@@ -32,10 +32,6 @@ import { useOAuthServerAppsQuery } from '@/data/oauth-server-apps/oauth-server-a
 import { useAsyncCheckPermissions } from '@/hooks/misc/useCheckPermissions'
 import { DOCS_URL } from '@/lib/constants'
 
-const OAuthEndpointsTable = dynamic(() =>
-  import('./OAuthEndpointsTable').then((mod) => ({ default: mod.OAuthEndpointsTable }))
-)
-
 const configUrlSchema = z.object({
   id: z.string(),
   name: z.string(),
diff --git a/apps/studio/data/oauth-server-apps/oauth-openid-configuration-query.ts b/apps/studio/data/oauth-server-apps/oauth-openid-configuration-query.ts
index 71c6a8295d8..3de62ba7d68 100644
--- a/apps/studio/data/oauth-server-apps/oauth-openid-configuration-query.ts
+++ b/apps/studio/data/oauth-server-apps/oauth-openid-configuration-query.ts
@@ -31,13 +31,13 @@ export type OpenIDConfiguration = {
 }
 
 export async function getOpenIDConfiguration({
-  clientEndpoint,
+  endpoint,
 }: {
-  clientEndpoint: string | undefined
+  endpoint: string | undefined
 }): Promise<OpenIDConfiguration> {
-  if (!clientEndpoint) throw new Error('Client endpoint is required')
+  if (!endpoint) throw new Error('Client endpoint is required')
 
-  const response = await fetch(`${clientEndpoint}/auth/v1/.well-known/openid-configuration`)
+  const response = await fetch(`${endpoint}/auth/v1/.well-known/openid-configuration`)
 
   if (!response.ok) {
     handleError({ message: `Failed to fetch OpenID configuration: ${response.statusText}` })
@@ -56,7 +56,7 @@ export const useOpenIDConfigurationQuery = <TData = OpenIDConfigurationData>(
     ...options
   }: UseCustomQueryOptions<OpenIDConfigurationData, OpenIDConfigurationError, TData> = {}
 ) => {
-  const { data: clientEndpoint, isPending: isEndpointLoading } = useProjectApiUrl({
+  const { hostEndpoint, isPending: isEndpointLoading } = useProjectApiUrl({
     projectRef,
   })
 
@@ -70,13 +70,13 @@ export const useOpenIDConfigurationQuery = <TData = OpenIDConfigurationData>(
   const isQueryEnabled =
     enabled &&
     typeof projectRef !== 'undefined' &&
-    !!clientEndpoint &&
+    !!hostEndpoint &&
     isSuccessConfig &&
     isOAuthServerEnabled
 
   const query = useQuery<OpenIDConfigurationData, OpenIDConfigurationError, TData>({
     queryKey: oauthServerAppKeys.openidConfiguration(projectRef),
-    queryFn: () => getOpenIDConfiguration({ clientEndpoint }),
+    queryFn: () => getOpenIDConfiguration({ endpoint: hostEndpoint }),
     enabled: isQueryEnabled,
     ...options,
   })

From 4ed75886fc1131bcf9192a02f89d8b137e478162 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Pozo?= <tomaspozo@users.noreply.github.com>
Date: Thu, 4 Jun 2026 04:28:57 -0500
Subject: [PATCH 23/23] docs: guide for migrating to publishable and secret API
 keys (#46600)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Adds a getting-started guide for migrating an existing project from the
legacy JWT-based `anon` and `service_role` keys to the new publishable
(`sb_publishable_...`) and secret (`sb_secret_...`) keys.

The guide walks through the migration step by step:

- **Before you start** — maps legacy keys to their replacements.
- **Step 1** — create the new `default` keys.
- **Step 2 / 3** — swap the publishable key in client code and the
secret key in backend code.
- **Database Webhooks and `pg_net`** — move the key from the
`Authorization: Bearer` header to the `apikey` header (the new keys
aren't JWTs and are rejected on `Authorization`), with a Vault note for
not inlining secrets.
- **Step 4** — update Edge Functions, with two options: read the new env
vars (`SUPABASE_PUBLISHABLE_KEYS` / `SUPABASE_SECRET_KEYS`) and set
`verify_jwt = false`, or adopt the `@supabase/server` SDK.
- **Step 5 / 6** — verify nothing uses the legacy keys, then deactivate
them (reversible).
- **Next steps** — clarifies that JWT signing keys are a separate,
independent migration.

## Notes

While writing this we found Studio issues to fix separately (the Invoke
Function cURL snippet and the Database Webhooks editor both put the new
keys on the `Authorization` header).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added a comprehensive migration guide for moving from legacy JWT-based
API keys to the new publishable and secret keys with zero‑downtime
steps, verification, limitations, and next steps.
* Clarified API key behavior and recommended migration actions in the
getting‑started docs.
  * Added a navigation entry linking to the new migration guide.

* **Style**
* Relaxed documentation lint rules to allow expected wording/phrases
(e.g., "backends", "Database Webhooks").
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
---
 .../NavigationMenu.constants.ts               |   4 +
 .../guides/getting-started/api-keys.mdx       |   2 +-
 .../migrating-to-new-api-keys.mdx             | 225 ++++++++++++++++++
 supa-mdx-lint/Rule001HeadingCase.toml         |   1 +
 supa-mdx-lint/Rule003Spelling.toml            |   2 +-
 5 files changed, 232 insertions(+), 2 deletions(-)
 create mode 100644 apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx

diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
index 55bef3f1bf7..c77840d6ce9 100644
--- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
+++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
@@ -340,6 +340,10 @@ export const gettingstarted: NavMenuConstant = {
     { name: 'API Keys', url: '/guides/getting-started/api-keys' },
     { name: 'Local Development', url: '/guides/cli/getting-started' },
     { name: 'Architecture', url: '/guides/getting-started/architecture' },
+    {
+      name: 'Migrating to new API keys',
+      url: '/guides/getting-started/migrating-to-new-api-keys',
+    },
     {
       name: 'Framework Quickstarts',
       enabled: frameworkQuickstartsEnabled,
diff --git a/apps/docs/content/guides/getting-started/api-keys.mdx b/apps/docs/content/guides/getting-started/api-keys.mdx
index 1d3ebea3115..44f97cb20a2 100644
--- a/apps/docs/content/guides/getting-started/api-keys.mdx
+++ b/apps/docs/content/guides/getting-started/api-keys.mdx
@@ -36,7 +36,7 @@ There are 4 types of API keys that you can use with Supabase:
 
 Supabase has changed the way keys work to improve project security and developer experience. You can read [the full announcement](https://github.com/orgs/supabase/discussions/29260).
 
-`anon` and `service_role` keys are based on the project's JWT secret. They are generated when your project is created and you can only change them when you rotate the JWT secret. This can cause significant issues in production applications. **You should now use the `sb_publishable_xxx` and `sb_secret_xxx` keys instead**.
+`anon` and `service_role` keys are based on the project's JWT secret. They are generated when your project is created and you can only change them when you rotate the JWT secret. This can cause significant issues in production applications. **You should now use the `sb_publishable_xxx` and `sb_secret_xxx` keys instead**. See [Migrate to publishable and secret API keys](/docs/guides/getting-started/migrating-to-new-api-keys) for a step-by-step guide.
 
 You can still find legacy keys in the **Legacy anon, service_role API keys** tab of the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard:
 
diff --git a/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx b/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx
new file mode 100644
index 00000000000..0a7d3f29d46
--- /dev/null
+++ b/apps/docs/content/guides/getting-started/migrating-to-new-api-keys.mdx
@@ -0,0 +1,225 @@
+---
+id: 'migrating-to-new-api-keys'
+title: 'Migrating to publishable and secret API keys'
+description: 'Move from legacy JWT-based anon and service_role keys to publishable and secret keys.'
+---
+
+Supabase has changed the way API keys work. The legacy `anon` and `service_role` keys are based on your project's JWT secret, which makes them hard to rotate without downtime. The new publishable (`sb_publishable_...`) and secret (`sb_secret_...`) keys can be created, named, and revoked independently, so you can rotate a single key without touching the rest of your app.
+
+This guide covers migrating an **existing project.** Both key types work simultaneously, so you can swap clients one at a time and deactivate the legacy keys only after nothing depends on them.
+
+<Admonition type="note">
+
+The legacy `anon` and `service_role` keys keep working until the end of 2026. You don't have to migrate today, but doing it early lets you rotate keys safely from now on.
+
+</Admonition>
+
+## Before you start
+
+The migration maps onto your existing keys:
+
+| Legacy key     | Replace with    | Used by                                                |
+| -------------- | --------------- | ------------------------------------------------------ |
+| `anon`         | Publishable key | Browsers, mobile and desktop apps, CLIs, public source |
+| `service_role` | Secret key      | Servers, Edge Functions, workers, other backend code   |
+
+For a full explanation of each key type, read [the Understanding API keys guide](/docs/guides/getting-started/api-keys).
+
+## Step 1: Create the new API keys
+
+Open the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard and select the **Publishable and secret API keys** tab.
+
+Older projects don't have these keys yet. If you see a **Create new API keys** button, your project is still on legacy keys only. Creating the new keys is safe. It adds a publishable key and a secret key alongside your existing `anon` and `service_role` keys. Your legacy keys keep working.
+
+The new keys are created under the name `default`. You can add more keys with different names later, for example, one secret key per backend component, so you can rotate them independently. For an initial migration, the `default` publishable and secret keys are all you need.
+
+## Step 2: Swap the publishable key in client code
+
+Anywhere you use the `anon` key in public code, switch to the publishable key. This includes web pages, mobile and desktop apps, and any CLI or script that ships to users.
+
+```ts
+import { createClient } from '@supabase/supabase-js'
+
+const supabase = createClient(
+  'https://your-project.supabase.co',
+  'sb_publishable_...' // was the anon key
+)
+```
+
+The publishable key carries the same low privileges as the `anon` key, so your [Row Level Security](/docs/guides/database/postgres/row-level-security) policies behave the same. User authentication through Supabase Auth is unchanged. The user still signs in and gets their own JWT.
+
+## Step 3: Swap the secret key in backend code
+
+Anywhere you use the `service_role` key on a server you control, switch to a secret key.
+
+```ts
+import { createClient } from '@supabase/supabase-js'
+
+const supabaseAdmin = createClient(
+  'https://your-project.supabase.co',
+  'sb_secret_...' // was the service_role key
+)
+```
+
+Secret keys add protections the `service_role` key doesn't have. They return HTTP 401 if used in a browser (matched on the `User-Agent` header), and you can run a separate key per service so a single leak only forces one rotation.
+
+<Admonition type="caution">
+
+Secret keys bypass Row Level Security and have full access to your data. Keep them on backends you control, out of source control, and out of client code.
+
+</Admonition>
+
+### Database Webhooks and `pg_net`
+
+Calls made from Postgres with `pg_net`, including Database Webhooks, usually send the `service_role` key on the `Authorization: Bearer` header. The new secret keys aren't JWTs, so they're rejected there. Send the secret key on the `apikey` header instead.
+
+```sql
+-- before
+select net.http_post(
+  url := 'https://your-project.supabase.co/functions/v1/your-function',
+  headers := jsonb_build_object(
+    'Content-Type', 'application/json',
+    'Authorization', 'Bearer <service_role key>'
+  ),
+  body := jsonb_build_object('event', 'ping')
+);
+
+-- after
+select net.http_post(
+  url := 'https://your-project.supabase.co/functions/v1/your-function',
+  headers := jsonb_build_object(
+    'Content-Type', 'application/json',
+    'apikey', 'sb_secret_...'
+  ),
+  body := jsonb_build_object('event', 'ping')
+);
+```
+
+For Database Webhooks created in the Dashboard, edit each webhook's HTTP headers: remove the `Authorization` header that holds the key and add an `apikey` header with a secret key instead.
+
+<Admonition type="caution">
+
+Don't hardcode a secret key in SQL or a webhook configuration, where it's stored in plain text. Store it in [Vault](/docs/guides/database/vault) and read it at call time:
+
+```sql
+headers := jsonb_build_object(
+  'Content-Type', 'application/json',
+  'apikey', (select decrypted_secret from vault.decrypted_secrets where name = 'secret_key')
+)
+```
+
+</Admonition>
+
+## Step 4: Update Edge Functions
+
+Edge Functions read their keys from environment variables. Supabase adds two new ones to your functions' environment, `SUPABASE_PUBLISHABLE_KEYS` and `SUPABASE_SECRET_KEYS`, alongside the legacy `SUPABASE_ANON_KEY` and `SUPABASE_SERVICE_ROLE_KEY`. Confirm they exist in the [**Edge Functions > Secrets**](/dashboard/project/_/functions/secrets) section of the Dashboard before you start.
+
+You have two options: a minimal change that swaps which variable you read, or a fuller upgrade to the [`@supabase/server`](https://github.com/supabase/server) SDK.
+
+### Option 1: Read the new keys from the environment
+
+For most functions, the only change is how you read the key. The legacy variables held a plain string. The new ones hold a JSON object keyed by name, so you parse them and read the key by name. The key you created in [step 1](#step-1-create-the-new-api-keys) is named `default`.
+
+```ts
+// before
+const secretKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
+
+// after
+const secretKey = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)['default']
+```
+
+The publishable keys work the same way through `SUPABASE_PUBLISHABLE_KEYS`. Read [the Managing Secrets guide](/docs/guides/functions/secrets) for more on environment variables in Edge Functions.
+
+If you created more than one secret key in [step 1](#step-1-create-the-new-api-keys), every key lives in the same `SUPABASE_SECRET_KEYS` object, each under its own name. Read a non-default key the same way:
+
+```ts
+const secretKeys = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
+
+const defaultKey = secretKeys['default']
+const billingKey = secretKeys['billing'] // the secret key you named "billing"
+```
+
+Send publishable and secret keys on the `apikey` header only. If you also pass the key on the `Authorization: Bearer` header, which many Supabase clients do by default, the platform tries to parse it as a JWT and rejects the request with `Invalid JWT`. The platform's built-in `verify_jwt` check only understands the legacy JWT-based keys, so set `verify_jwt = false` for these functions and authorize the request in your own code, or let the `@supabase/server` SDK do it for you ([Option 2](#option-2-adopt-the-supabaseserver-sdk)).
+
+```toml
+[functions.my-function]
+verify_jwt = false
+```
+
+### Option 2: Adopt the @supabase/server SDK
+
+To get the most out of the new key model, migrate to the [`@supabase/server`](https://github.com/supabase/server) SDK. It removes the client-setup boilerplate every function repeats: reading keys from the environment, parsing the `Authorization` header, and initializing a user-scoped client and a separate admin client. You declare who can call the function, and get both clients ready to use on `ctx` (`ctx.supabase` respects Row Level Security, `ctx.supabaseAdmin` uses the secret key). This is the recommended approach for new functions.
+
+Wrap your existing `Deno.serve` handler with `withSupabase` and declare an `auth` mode for who can call it. Keep `verify_jwt = false` so the SDK does the authorization.
+
+For a function your users call from the client, use `auth: 'user'`. The SDK validates the user's session JWT and gives you a client scoped to their Row Level Security policies.
+
+```ts
+import { withSupabase } from 'npm:@supabase/server'
+
+Deno.serve(
+  withSupabase({ auth: 'user' }, async (_req, ctx) => {
+    // ctx.supabase is scoped to the authenticated user
+    return Response.json({ email: ctx.userClaims?.email })
+  })
+)
+```
+
+For a function called by your own backend, a worker, or `pg_net`, use `auth: 'secret'`. The SDK validates the secret key and gives you a client that bypasses Row Level Security.
+
+```ts
+import { withSupabase } from 'npm:@supabase/server'
+
+Deno.serve(
+  withSupabase({ auth: 'secret' }, async (_req, ctx) => {
+    // ctx.supabaseAdmin is authenticated with a valid secret key
+    return Response.json({ ok: true })
+  })
+)
+```
+
+To accept a specific named key instead of `default`, add its name after the mode with a colon. For example, `auth: 'secret:billing'` validates the request against the secret key you named `billing`, and `auth: 'publishable:web'` against a publishable key named `web`.
+
+`withSupabase` returns a standard request handler, so you can also export it as a `fetch` handler instead of passing it to `Deno.serve`:
+
+```ts
+import { withSupabase } from 'npm:@supabase/server'
+
+export default {
+  fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {
+    // ctx.supabase is scoped to the authenticated user
+    return Response.json({ email: ctx.userClaims?.email })
+  }),
+}
+```
+
+`export default { fetch }` is equivalent to `Deno.serve(...)`: both define a request handler. The `fetch` style is portable across Edge Functions, Cloudflare Workers, and Bun, so prefer it if you want the same function to run in more than one environment. `Deno.serve` keeps working on Edge Functions, so you can leave it in place during a migration and switch later.
+
+A good way to try this is to duplicate one of your functions and migrate the copy first. See [Securing Edge Functions](/docs/guides/functions/auth) for every auth mode and use case, and [Authorization headers](/docs/guides/functions/auth-headers) for how the headers work.
+
+## Step 5: Verify nothing uses the legacy keys
+
+Before turning the legacy keys off, confirm nothing still depends on them. There's no automatic usage indicator, so this is a manual check. Go through every place that holds a Supabase key and make sure it now uses a publishable or secret key.
+
+Don't forget callers that are easy to miss:
+
+- Mobile or desktop app versions already in users' hands.
+- CI/CD pipelines and deployment scripts.
+- Third-party integrations and webhooks.
+- Cron jobs, workers, and `pg_net` calls or Database Webhooks (see [Database Webhooks and `pg_net`](#database-webhooks-and-pgnet)).
+
+## Step 6: Deactivate the legacy keys
+
+Once you've confirmed nothing uses the legacy keys, deactivate them in the [**Settings > API Keys**](/dashboard/project/_/settings/api-keys/) section of the Dashboard. You can re-activate them if you find a client you missed, so this step is reversible.
+
+## Known limitations
+
+A few behaviors differ from the legacy JWT-based keys. Plan for them during the migration:
+
+- You can't send a publishable or secret key in the `Authorization: Bearer ...` header. Send it on the `apikey` header instead.
+- Edge Functions don't verify the `apikey` header for the new keys. Use `verify_jwt = false` and authorize in code, as shown in [Step 4](#step-4-update-edge-functions).
+- Public Realtime connections are limited to 24 hours unless the connection is upgraded with user-level authentication through Supabase Auth or a supported third-party auth provider.
+
+## Next steps
+
+After migrating your keys, consider moving to the [JWT signing keys](/docs/guides/auth/signing-keys) system as well. This is a separate, independent migration. The new publishable and secret keys aren't JWTs, so they no longer touch your project's JWT secret. But the access tokens Supabase Auth issues to your users are still signed by that shared secret. Signing keys replace it with rotatable keys you can change without downtime. Together, the two migrations get your whole project off the shared JWT secret.
diff --git a/supa-mdx-lint/Rule001HeadingCase.toml b/supa-mdx-lint/Rule001HeadingCase.toml
index f81ccedeef6..90fe9337045 100644
--- a/supa-mdx-lint/Rule001HeadingCase.toml
+++ b/supa-mdx-lint/Rule001HeadingCase.toml
@@ -54,6 +54,7 @@ may_uppercase = [
     "Dart",
     "Dashboard",
     "Database Functions?",
+    "Database Webhooks?",
     "Deadpool",
     "Dedicated Pooler",
     "Deno",
diff --git a/supa-mdx-lint/Rule003Spelling.toml b/supa-mdx-lint/Rule003Spelling.toml
index 579d8852c89..62a9bff0285 100644
--- a/supa-mdx-lint/Rule003Spelling.toml
+++ b/supa-mdx-lint/Rule003Spelling.toml
@@ -28,7 +28,7 @@ allow_list = [
     "[Aa]utomations?",
     "[Aa]utovacuum(s|ing|ed)?",
     "Azure MyApps",
-    "[Bb]ackend",
+    "[Bb]ackends?",
     "[Bb]ackoff",
     "[Bb]lockchains?",
     "BootEvent",