In this PR:
- The `llms.ts` script is removed from the pipeline. It was just
iterating over the sections of the SDK JSON files to generate _dummy_
text files for LLMS to consume. But with a lot of inconsistencies and
mistakes.
- There's a new script that builds markdown files from the SDK
definition files.
- The Management API now has a definition file too, it was missing
before.
- On the www project now there are redirects for the reference text
files to the new markdown files in the docs project.
- NPM scripts have received better names so that prebuild ones are
smaller and all are easier to differentiate.
## Problem
We added support for `*.md` guides in our docs, but our redirects don't
apply to them. This means that when we directly link to a guide using
the `.md` extension and that guide gets renamed or deleted, the links
begin to 404.
This happened already once in our agent-skills where we linked to
`https://supabase.com/docs/guides/database/data-api.md` which was
deleted and moved yesterday to
`https://supabase.com/docs/guides/api/securing-your-api.md`. Note that
there was a redirect on the regular path `/docs/guides/database/data-api
-> /docs/guides/api/securing-your-api`, but this didn't apply to the
`.md` version.
## Fix
This PR adds rules to redirect all the `/docs/guides/**/*.md` files to
their respective pages. Rather than manually duplicating all our
existing (and future) redirects by hand for `.md`, this dynamically
generates the `.md` redirect rules based on the path. Specifically it
assumes that all redirect rules under `/docs/guides` support the `.md`
extension, so it generates a redirect for all of these rules
automatically.
## How to test
Use curl to confirm that `.md` redirects are applied:
```shell
curl -I https://zone-www-dot-com-git-fix-doc-markdown-redirects-supabase.vercel.app/docs/guides/database/data-api.md
HTTP/2 308
cache-control: public, max-age=0, must-revalidate
content-type: text/plain
date: Wed, 29 Apr 2026 17:35:58 GMT
location: /docs/guides/api/securing-your-api.md
...
```
You can also verify that this didn't previously work:
```shell
curl -I https://supabase.com/docs/guides/database/data-api.md
HTTP/2 404
age: 0
cache-control: public, max-age=0, must-revalidate
content-type: text/plain;charset=UTF-8
date: Wed, 29 Apr 2026 17:38:00 GMT
...
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced documentation route redirects to support markdown file
extensions for guides, ensuring proper navigation for both standard and
markdown-variant paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- change changelog.md formatting
- make changelog entries slugs more descriptive (eg
/changelog/123-new-change)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Updated changelog entry URLs to use slug-based identifiers instead of
numeric IDs for improved readability and SEO-friendliness, with
automatic redirects for existing links.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds `/<page>.md` routes for 10 marketing/product pages (homepage, auth,
database, edge-functions, realtime, storage, vector, pricing,
modules/cron, modules/queues) so AI agents can fetch clean markdown
instead of parsing JS-rendered HTML. Also advertises the markdown
alternate via `<link rel="alternate" type="text/markdown">` on marketing
and docs pages so agents can discover it.
Pricing is generated dynamically via `generatePricingContent()` (single
source of truth with `/llms.txt` and `/llms-full.txt`); the other nine
slugs are bundled at build time from `content/md/*.md` into a
`MD_CONTENT` map.
Supersedes #44891 (rebased fresh off current master to avoid a 9-commit
replay over rename/rename conflicts created by #44897).
## Changes
- New `/api-v2/md/[...slug]` route handler returns the bundled markdown
(or dynamic pricing) with `Content-Type: text/markdown`,
`X-Content-Type-Options: nosniff`, and appropriate cache headers
- Middleware rewrites `/<slug>.md` and `Accept: text/markdown` to the
API route for the `MD_PAGES` allowlist; trailing-slash variants
(`/auth/`) are normalized so they resolve the same as `/auth`
- Build-time codegen `scripts/generateMdContent.mjs` scans `content/md/`
and emits `app/api-v2/md/content.generated.ts` exporting both
`MD_CONTENT` (Map) and `MD_PAGES` (Set, incl. dynamic `pricing`). Fails
the build on slug collision between `content/md/` and `DYNAMIC_SLUGS`.
Adding a new marketing `.md` is just dropping a file in `content/md/`
(also update `PRODUCT_OVERVIEW_LINKS` in `/llms.txt` since that list is
editorial).
- 8 permanent redirects `/llms/<product>.txt` → `/<product>.md` so
legacy URLs in caches and downstream `llms.txt` copies keep working
- `/llms.txt` product overview now references `.md` URLs (incl.
`modules/cron`, `modules/queues`); `/llms-full.txt` iterates
`MD_CONTENT.values()` (homepage first, then alphabetical) and appends
dynamic pricing
- `/llms/[slug]` route slimmed to proxy SDK reference files (`js.txt`,
`dart.txt`, etc.) since redirects handle product slugs and pricing;
pricing branch retained as fallback in case redirects are bypassed
- `apps/www/pages/_app.tsx` injects the alternate link conditionally
based on `MD_PAGES`; `/pricing` (app router) sets it via page metadata
- `apps/docs/app/page.tsx` (the `/docs` root) sets the text/markdown
alternate to `/llms-full.txt`; per-guide pages override with their
specific `.md` URL via `genGuideMeta` in `GuidesMdx.utils.tsx`. Other
docs pages (reference, troubleshooting) inherit nothing.
- `apps/www/.vercelignore`: replaces the prior `*.md`/`README.md` rules
with `*.md` + `!content/md/**/*.md` so Edge Function READMEs and future
scratch `.md` files aren't silently shipped to the build artifact
- Drops `apps/www/data/llms/*.txt` and the related
`outputFileTracingIncludes`
- Test coverage for the new middleware branches: `.md` suffix rewrite
(allowlisted vs. fall-through), `Accept: text/markdown` content
negotiation, trailing-slash normalization
## Testing (Vercel preview)
Local dev server smoke tests passing on `:3771` after each iteration.
Re-verified on the preview URL after the latest hardening commit:
- [x] `curl -I https://<preview>/llms/auth.txt` — expect `308 Permanent
Redirect` to `/auth.md`
- [x] `curl https://<preview>/auth.md | head -3` — expect `# Supabase
Auth`
- [x] `curl https://<preview>/pricing.md | head -3` — expect `# Supabase
Pricing` with current tier values
- [x] `curl https://<preview>/modules/cron.md | head -3` — expect `#
Supabase Cron`
- [x] `curl -H 'Accept: text/markdown' https://<preview>/ | head -3` —
expect `# Supabase` (homepage.md)
- [x] `curl https://<preview>/llms.txt` — Product Overview section lists
`.md` URLs and includes Cron + Queues
- [x] `curl https://<preview>/llms-full.txt | grep -E '^# Supabase
(Cron\|Queues\|Pricing)'` — Cron and Pricing each match once; Queues
matches twice (marketing module + existing docs guide)
- [x] View source on `/`, `/pricing`, `/database` — expect `<link
rel="alternate" type="text/markdown" href="/<slug>.md">`
- [x] View source on `/docs` — expect `<link rel="alternate"
type="text/markdown" href="/llms-full.txt">`
- [x] View source on a docs guide page (e.g., `/docs/guides/auth`) —
expect per-guide `.md` alternate; reference/troubleshooting pages should
NOT emit a markdown alternate
- [x] `curl -I https://<preview>/auth.md` — expect
`X-Content-Type-Options: nosniff`
- [x] `curl -I -L -H 'Accept: text/markdown' https://<preview>/auth/` —
should resolve to markdown content (trailing-slash normalization, with
Vercel's auto-redirect)
## Linear
- fixes GROWTH-760
## Follow-up (separate PR)
GROWTH-760 also asks about extending `.md` to blog/customers/events.
Different mechanism (path-prefix middleware, MDX read at request time
via `gray-matter`) so it deserves its own review. Will open a follow-up
PR after this lands.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Serve prebuilt and dynamic Markdown docs via new markdown endpoints
and routing; pages now advertise markdown alternates (including
pricing).
* Added Cron and Queues module documentation pages.
* **Documentation**
* Minor formatting tweaks to Realtime and Storage docs.
* **Chores**
* Added build-time Markdown content generation and adjusted
ignore/deploy rules for generated files.
* Added redirects from legacy text-based product URLs to new markdown
pages.
* **Tests**
* Expanded tests for markdown routing and content-negotiation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Updated terms on the the site
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new Enterprise SaaS Subscription Agreement page presenting
comprehensive legal terms. The agreement covers subscription
definitions, access and usage policies, customer responsibilities,
support obligations, confidentiality requirements, data security
standards, intellectual property rights, warranties, indemnification
clauses, liability limitations, termination conditions, and dispute
resolution provisions. The page includes the last modified date for
reference.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a `/.well-known/api-catalog` to advertise our management API.
Motivation is for agents, but this is generally part of [RFC
9727](https://www.rfc-editor.org/rfc/rfc9727).
## Testing
Make an HTTP request to `/.well-known/api-catalog` and confirm it
returns the JSON content with content type `application/linkset+json`:
```shell
curl -i https://zone-www-dot-com-git-feat-agent-catalog-supabase.vercel.app/.well-known/api-catalog
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a public API catalog (linkset) exposing API metadata, OpenAPI
endpoint, documentation and status links.
* Added HTTP headers to advertise the API catalog from the site root and
to serve the catalog with the correct content type.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The docs build had a fragile implicit dependency on www's filesystem
(`../../../apps/www/public/llms`), flagged by the docs team in #44670.
Rather than formalising that dependency with a shared package, this PR
eliminates it entirely by making www the sole owner of llms content
assembly.
**How it works now:**
`/llms/[slug]` handles all `/llms/*.txt` requests via a 3-step cascade:
1. Dynamic content — `pricing.txt` generated at request time from
`shared-data` imports
2. Local file — product overviews read from `data/llms/`
3. Docs proxy — reference docs (guides, js, dart, etc.) fetched from the
docs app
No hardcoded slug lists, so adding new content just works.
**What changed:**
- `apps/docs/scripts/llms.ts` trimmed to only generate per-source
reference files — www now owns `llms.txt`, `llms-full.txt`, and product
overviews
- Removed `generateLlmsPricing.mjs` build script — pricing generated
dynamically from `shared-data`
- Removed llms rewrites from `rewrites.js` — routes handle everything
with consistent `Cache-Control: public, s-maxage=3600,
stale-while-revalidate=86400`
- Product overview `.txt` files moved from `public/llms/` → `data/llms/`
so all requests go through routes for consistent caching
**Docs team concerns from GROWTH-773:**
| Concern | Resolution |
|---------|-----------|
| Docs build depends on www files at a fragile relative path | Path
removed — docs no longer reads from www |
| www restructuring breaks docs with no obvious connection | Eliminated
— no cross-app filesystem dependency |
| No build order enforcement between www and docs | Not needed — docs
doesn't depend on www's build output |
## To test
- `curl <preview>/llms.txt` — markdown index with doc + product overview
links
- `curl <preview>/llms-full.txt` — combined product overviews + docs
content
- `curl <preview>/llms/pricing.txt` — dynamically generated pricing
tables
- `curl <preview>/llms/auth.txt` — product overview from local file
- `curl <preview>/llms/guides.txt` — proxied from docs app
- `curl <preview>/llms/nonexistent.txt` — 404
- Verify `Cache-Control` header on all responses
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
## Context
Update next.config in `www` to
- set `x-robots-tag` to `all` for `/docs` and `/blog`
- set `x-robots-tag` to `noindex` for `/dashboard`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enabled search engine indexing for documentation and blog pages
(X‑Robots-Tag: all).
* Marked dashboard pages to be excluded from search engine indexing
(X‑Robots-Tag: noindex).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR removes the `payload` `cms` app that was added for the marketing
blog posts. We never started using it, it just adds additional work in
keeping the dependencies updated.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the CMS application and associated infrastructure, including
configuration files, build scripts, and environment management.
* Simplified project build configuration and removed CMS-related
dependencies from deployment workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR removes all CMS code from the `www` app. This includes fetching
of blog posts, API routes for proxying blog posts and types.
All functionality should remain the same (and the number of blog posts
should be the same).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed CMS integration, APIs, preview/draft/revalidate endpoints,
related env vars and dependency; switched to static markdown-only blog
pipeline.
* **Refactor**
* Simplified image and author resolution, tightened component props to
static post shapes, and migrated imports to path aliases.
* **Documentation**
* Deleted CMS integration docs and rich-text conversion helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
It's possible for individual PRs to pass typechecking, while the merge
result fails it. To prevent errors from getting into production, we can
fail the prod build if typecheck fails. Typecheck is still ignored on
preview builds for efficiency, since those are blocked on the GitHub
typecheck Action.
* show cms blog posts in www
* remove contentlayer from www
* outputFileTracingExcludes
* update remotePatterns
* fetch cms posts server-side with revalidation
* add cms env vars to turbo.json
* add www env vars to turbo.json
* include cms posts in www sitemap
* add migration to remove image from cms post
* update cms meta image mapping in www
* Set up Sentry for www
* Add Sentry captureEExceptions to API routes in www
* Prettier
* Fix TS
* Address feedback
* Clean
* Remove SENTRY_AUTH_TOKEN from turbo.json
* Bump nextjs in the ui-library.
* Bump the nextjs in design-system.
* Bump nextjs to v15 in www.
* Bump the next version in the pnpm catalog.
* Switch all apps to using the catalog version of next.
* Fix ui-lib and design-system to build with next 15.
* Fix some prettier errors.
* Bump the next-eslint package.
* Fix a lint issue about a component starting with underscore.
* Use the catalog version of next in cms app.
* Disable turbo for dev command in www. Remove obsolete experimental flags.
* Return some of the experimental flags.
* Consolidate different versions of postcss. Remove @mertasan/tailwindcss-variables from ui package.
* Bump vitest in pg-meta to remove a vulnerable version of vite.
* Bump dompurify.
* Bump all octokit deps to solve 2 vulns.
* Fix warnings about destructuring json imports.
* Remove a console.log in docs.
* Fix the changelog page to use an ESM import.
* Stabilize the generate-sitemap script output.
* Try another fix for the changelog.
* Added hsts header via vercel.json
* Migrate headers to next.config.js
* only apply hsts headers when running on vercel
* remove is platform check from docs
* Moved hsts header to root path
* Removed debugging header
* revert environment check on www header
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
* initial test.
* Add base path to the rewrites.
* Remove base path from the source rewrite.
* Another try.
* Another try.
* another try.
* Try another magic.
* Add try/catch to the flag processing code.
* Revert some of the unneeded changes.
* Fix the api route for flags.
* Remove vercel/toolbar for local dev.
* Try using a static file for toolbar config.
* Add a well known flags file in the www app.
* Add headers to interpret vercel/flags as json.
* Another try.
* Fix the json formatting.
* Add headers for the vercel/flags route in the www app.
* Change to force studio to deploy.
* add contentlayer2 to www
* remove authorURL from blog post meta
* latest blog posts in Developers dropdown menu
* parse blog slug in contentlayer
* change next config plugins order
* contentlayer build in www package.json
* contentlayer2
* contentlayer2 build on typecheck in www
* remove comment
* Update package-lock.json
* revert npm package version
* Update package-lock.json
---------
Co-authored-by: Jonathan Summers-Muir <MildTomato@users.noreply.github.com>
* move to shared types
* Rename the package to api-types.
* Fix a forgotten dependency.
* Add more forgotten deps.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* feat: add new Icons package
* Create README.md
* add more icons
* add "Home" icon and "Postgres" icon
* reduce helpers
* remove old files
* make dev deps
* Delete package-lock.json
* Update README.md
* add to packages for other apps
* remove from db.design
* Update README.md
* Move the build-icons package in the packages folder.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Change all imports in the ui package which import via the @ui shortcut.
* Add a new ui-patterns package. Add it to all apps.
* Migrate PrivacySettings from ui to ui-patterns.
* Migrate ConsentToast from ui to ui-patterns.
* Remove providers folder from ui package.
* Move GlassPanel.
* Migrate IconPanel.
* Migrate TweetCard.
* Migrate ThemeImage.
* Remove LWXCountdownBanner.
* Migrate CountdownWidget.
* Migrate SchemaTableNode.
* Migrate ExpandableVideo.
* Migrate ThemeToggle.
* Fix bunch of imports in the docs app.
* Revert some unnecessary changes.
* Expand the README.md.
* Fix the tailwind configs, they were using old folder structure.
* Fix leftover merge conflicts.
* Remove a deleted page in master.
---------
Co-authored-by: Terry Sutton <saltcod@gmail.com>
* update deps + image codemod (studio)
* update next links (studio)
* update deps
* update links (ui)
* remove next-transpile-modules
* move next-themes dependency
* chore: update ConfirmDialog
* chore: remove old ConfirmModal js file. migrated to TS
* dependency wrangling
* remove empty page
* update next links (www)
* First run bump react-data-grid-v7 beta 4
* fix package-lock.json
* more deps wrangling
* update recharts
* update sentry options
* fix some broken things in www
* studio fixes
* fix graphiql
* fix studio build
* fix menu hydration
* small build error
* update turbo
* fix www typescript errors
* docs image codemod
* links codemod docs
* fix docs typescript errors
* move useConsent to ui to prevent circular deps
* Fix links
* Fix homepage
* Fix links
* move studio/ to apps/
* Revert "move studio/ to apps/"
This reverts commit 1b0a985fcb.
* disable outputFileTracingRoot
* remove outputFileTracingRoot
* fix homepage product cards
* fix PrivacySettings links
* Fix links
* Fix the build for www.
* Minor fixes for JWTGenerator.
* Fix the docs and ui tests.
* Revert codehike back to 0.8.3
* remove ConfirmAlert()
* reenable babel because mobx hates me
* fix blog image and comparison page avatar
* Fix svg errors
* update image synthax
* Fix code hike
* Move the button in a div so that it doesn't inherit its parent height and make the button look weird.
* When components are defined in a component, they get recreated on each render. This makes them unstable in certain cases and causes infinite rerenders.
* Replace the next/head usage with next/script.
* Chore/upgrade next 13 fix table editor (#18431)
* fix table editor styling and fix row deletion logic
* Fix deleting selected rows from header, and fix checkboxes not clearing up
* Fix deleting all rows when filter applied, and fix deleting all rows
* Fix grid size styling issue
* Fix TS error
* Hydration errors
* studio org pages fixes
* fix more studio links
* audit logs fixes
* dropdown icon styling fixes
* fix some images in www
* upgrade to next 14
* try new sentry wrapper for api
* see if this is even invoked
* Revert "see if this is even invoked"
This reverts commit 86c3973ffa.
* Revert "try new sentry wrapper for api"
This reverts commit f67623ebad.
* Revert "upgrade to next 14"
This reverts commit a24dd6131e.
* chore: allow node version 19/20
* Try to fix the LogTable so that it renders with the newer "react-data-grid" version.
* Fix type errors in the log renderer code.
* Fix the replication screen.
* Add the CSS for the GraphiQL.
* Fix SQL editor results rendering
* Lint
* Fix SQL editor results height issue
* Fix auth RLS not invalidating RQ when toggling RLS
* Fix database tables new/edit column regressed
* Fix migrations page empty state if migrations schema not yet created
* Fix API side panel docs temp remove postgrest text for column description PK and FK
* Fix + improve timeout handling in SQL editor
---------
Co-authored-by: Jonathan Summers-Muir <MildTomato@users.noreply.github.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Francesco Sansalvadore <f.sansalvadore@gmail.com>
Co-authored-by: Terry Sutton <saltcod@gmail.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Co-authored-by: Kevin Grüneberg <k.grueneberg1994@gmail.com>
Jeremias Menichelli