## Problem
Since the upgrade to NextJS 16.1.6, many e2e tests run fails with
timeout, probably when building or starting the studio
## Solution
- [x] Add dedicated steps for supabase setup and NextJS build to ease
debugging
- [x] Fix flakyness
Feature
## What is the current behavior?
Incident banner logic depends on StatusPage and Supabase project for
metadata.
## What is the new behavior?
New incident banner logic that depends only on incident.io. Displays in
non-production environments for now because I haven't wired up the rest
of the workflow. This is just to allow a total end-to-end
testing/playground for test incidents <-> Slack <-> preview dashboard
for people to try out the UX.
## Additional context
You can test using my [test
incident](https://app.incident.io/supabase/incidents/405). This has
severity minor, so the preview site should have a banner. Toggle to
informative, hard refresh dashboard with cache off, and banner should
disappear. Toggle back to minor, hard refresh without cache again, and
banner should reappear. Same thing if you edit the "Banner shown" field
from 1 to -1 and back.
Lays groundwork for online evals on Assistant chat logs.
https://www.braintrust.dev/docs/observe/score-online
### Changes
- New workflows:
- `braintrust-scorers-deploy.yml` keeps prod scorers in sync on push to
`master`
- `braintrust-preview-scorers-deploy.yml` deploys preview scorers to the
staging project for PRs labeled `preview-scorers`, posting a comment
with scorer links
([example](https://github.com/supabase/supabase/pull/43194#issuecomment-4000097222))
- `braintrust-preview-scorers-cleanup.yml` deletes preview scorers when
the PR is closed
([example](https://github.com/supabase/supabase/pull/43194#issuecomment-4000749847))
- Adds `evals/scorer-online.ts` entry point invoked with `pnpm
scorers:deploy`, registering scorers for online evals in the Braintrust
"Assistant" project
- Refactors scorer code to separate online-compatible scorers
(`scorer-online.ts`) from WASM-dependent ones (`scorer-wasm.ts`)
- "URL Validity" scorer now only checks Supabase domains to prevent
requests to untrusted origins
- Span `input` is now shaped `{ prompt: string }` instead of plain
`string` for compatibility with offline eval scorers
- Env vars `BRAINTRUST_STAGING_PROJECT_ID` and `BRAINTRUST_PROJECT_ID`
configured in GitHub repo settings
- `generateAssistantResponse` now uses `startSpan` + `withCurrent`
instead of `traced()` to manually manage the root span lifecycle — this
ensures `onFinish` logs output to the span _before_ `span.end()` is
called, which is when Braintrust triggers scoring automations
### Online Scorers
We share scoring logic across offline and online evals, but some of our
scorers aren't transferrable to an "online" setting due to runtime
challenges or ground truth requirements.
**Supported**
- Goal Completion
- Conciseness
- Completeness
- Docs Faithfulness
- URL Validity
**Unsupported**
- Correctness (requires ground truth output)
- Tool Usage (requires ground truth requiredTools)
- SQL Syntax (uses libpg-query WASM)
- SQL Identifier Quoting (uses libpg-query WASM)
### How to use these scorers
Going forward if you want to add/edit online eval scorers, add the
`preview-scorers` label to a PR. This deploys scorers to the [Assistant
(Staging
Scorers)](https://www.braintrust.dev/app/supabase.io/p/Assistant%20(Staging%20Scorers)?v=Overview)
project in Braintrust with branch-specific slugs, and comments on the PR
([example](https://github.com/supabase/supabase/pull/43194#issuecomment-4000097222)).
From the Braintrust dashboard you can "Test" the scorer with traces from
any project.
<img width="1866" height="528" alt="CleanShot 2026-03-05 at 15 15 00@2x"
src="https://github.com/user-attachments/assets/4f15cebc-3f2d-4e8a-9ee2-fe8ef7bf4199"
/>
Once merged, scorers are deployed to the primary
[Assistant](https://www.braintrust.dev/app/supabase.io/p/Assistant)
project, and preview scorers are deleted from the staging project. Down
the road, scorers on the Assistant project will run automatically on a
sample of production traces.
Closes AI-437
Feature enhancement — smarter incident banner targeting logic
## What is the current behavior?
Displaying the incident banner requires toggling a flag or environment
variable. Banners are shown to all users regardless of whether their
projects are in affected regions or whether the incident affects project
creation.
## What is the new behavior?
Banner visibility is now driven by `show_banner` metadata from the
StatusPage API — no manual flag or env var toggle needed. Per-user
targeting is then applied:
- Users with projects only see the banner when they have a database in
an affected region
- Users without projects only see the banner when the incident affects
project creation
Incident responses are enriched with cache data (`affected_regions`,
`affects_project_creation`) fetched from a Supabase table. Visibility
logic is extracted into a dedicated hook and pure utility function,
backed by unit tests.
## Additional context
Resolves FE-2562
Enables Braintrust tracing for AI Assistant chats to support debugging
and future online evals.
**Code Changes**
- Wraps `generateAssistantResponse` in a Braintrust `traced()` span,
logging the user's latest message as input along with metadata
(`chatId`, `chatName`, `projectRef`, `userId`, `orgId`, `planId`, etc.)
- Threads JWT claims from `apiWrapper` → handler to log `userId` in
Braintrust without an extra API call (+ expanded `apiWrapper` tests)
- Threads `orgId` and `planId` from `getOrgAIDetails` to log in
Braintrust
**Infrastructure Changes**
- Created a "Vercel" service account in Braintrust
- Added `BRAINTRUST_API_KEY` and `BRAINTRUST_PROJECT_ID` env vars to the
studio-staging project in Vercel using a service token for the above
service account
- Added an "Overview" view to the Logs tab in the Braintrust Assistant
project to surface the new metadata
**Precautions**
- HIPAA sensitive projects are excluded from logging (see
https://github.com/supabase/supabase/pull/42787 for the detection logic)
- Production is temporarily excluded from logging until we're confident
in the setup
**Testing steps**
- Chat with the AI Assistant in the [studio-staging preview
build](https://github.com/supabase/supabase/pull/42963#issuecomment-3917178023)
below
- Visit the [Logs tab in the Braintrust Assistant
project](https://www.braintrust.dev/app/supabase.io/p/Assistant/logs)
and inspect the trace
<img width="4680" height="962" alt="CleanShot 2026-02-18 at 17 43 55@2x"
src="https://github.com/user-attachments/assets/c3a11b21-4e7f-4e90-bdab-a25ab8ee0d1f"
/>
<img width="2632" height="1288" alt="CleanShot 2026-02-18 at 17 45
04@2x"
src="https://github.com/user-attachments/assets/6c7b6ebc-5090-4ede-8f71-859ff7e386aa"
/>
**References**
- https://www.braintrust.dev/docs/integrations/sdk-integrations/vercel
- https://www.braintrust.dev/docs/instrument/custom-tracing
Closes AI-438
This PR removes the `payload` `cms` app that was added for the marketing
blog posts. We never started using it, it just adds additional work in
keeping the dependencies updated.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the CMS application and associated infrastructure, including
configuration files, build scripts, and environment management.
* Simplified project build configuration and removed CMS-related
dependencies from deployment workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What is the current behaviour?
Functions page on self-hosted differs from Platform
## What is the new behaviour?
Adds the possibility to see a list of edge-functions in Self-Host
version.
## Summary by CodeRabbit
* **New Features**
* Added self-hosted edge functions support with filesystem-based
artifact listing and a new API endpoint to list local functions.
* Improved functions UI: unified view, enhanced search and adjacent sort
controls, and clearer local-hosting guidance.
* **Chores**
* Added environment configuration and docker volume for edge functions
management.
* Updated build/task config to pass through edge functions env and
include contentlayer outputs.
Co-authored-by: Ali Waseem <waseema393@gmail.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
Co-authored-by: Terry Sutton <saltcod@gmail.com>
* Use the .sql suffix when generating ids.
* Fix a bug where a new snippet would not show up in the snippet list until refresh.
* Add API routes which serve file snippets.
* Refactor the renameSnippet and moveSnippet to work with file snippets.
* Change the link to the SQL Editor.
* Minor fixes from CodeRabbit.
* Check the file/folder name for invalid chars.
* More fixes from CodeRabbit review.
* Fix minor issues.
* Use zod to parse the snippet ids when deleting.
* Try to fix snyk issue.
* Add validation to the GET content index route.
* Minor fixes.
* Show create a new folder, it was hidden by mistake.
* Add SNIPPETS_MANAGEMENT_FOLDER env var.
* Add snippets folder in the docker-compose.
* Add error toasts if the env var is not set.
* Add snippets management folder to the generateLocalEnv script.
* Revert the docker-compose changes, will be done in a followup PR.
* Revert also the snippets volume folder.
* Remove unneeded line.
Incident status banners/alerts should be automatically determined from
the status page, rather than being manually configured.
Adds a new endpoint, /api/incident-status, to return information about
active incidents. This information is fetched from the StatusPage API.
The endpoint is cached to reduce number of third-party API requests.
Co-authored-by: Ali Waseem <waseema393@gmail.com>
* add ts any checks
* fix linting issues
* updated more file rules
* updated runtime files
* updated turbo to remove lints
* removed eslint and reference from next
* Revert the pnpm lock to the one from master.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Use the "eslint" command instead of built-in next lint since it's getting obsolete.
* Bump all deps to support eslint 9+.
* Convert the rules in eslint-config-supabase to be flat-config compatible.
* Migrate all apps to use the new eslint config rules.
* Fix all errors found in the new setup.
* Fix the no default exports ignores.
* Scan all files for linting in studio.
* Fix all lint errors.
* Make the reportUnusedDisableDirectives a warning.
* fix(support form): api route to create attachment urls
* clean: remove console log
* fix staging and prod
* Minor clean up
* Shift generation of urls to data folder
* refactor
* Final
* Fix tests
* Nit
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
* feat: add `crypto-js`, `encryptString` with sample key
* feat: include POSTGRES_PASSWORD in generated .env.test
* feat: include POSTGRES_PASSWORD in turbo.json for studio
* feat: read only query support
* feat: configurable `POSTGRES_HOST`, `POSTGRES_DB`, `POSTGRES_PORT`
* chore: rename POSTGRES_USER to clarify write permission
* feat: configurable `PG_META_CRYPTO_KEY`
* chore: add `PG_META_CRYPTO_KEY` to generateLocalEnv
* feat: add 'postgres-meta' to linter dictionary
* feat: restore read-only toggle in local MCP URL builder
* feat: MCP URL builder
- Creates an MCP URL builder component that allows a user to choose options via a UI, then automatically builds the URL and config needed for various MCP clients
- Adds this component to studio Config modal and docs MCP page
* fix(mcp url builder): mcp-remote options
mcp-remote handles OAuth, so no need to pass personal access token
* fix(docs): mcp
We are pushing the remote MCP server rather than the local one, so removing
references to the local server from documentation.
* fix(mcp url builder): ui messages
- Clarify read-only mode
- Storage is not enabled in the defautl configuration
* fix: mcp url builder
- Refactor unnecessary hook into a utility function
- Fix background color in dark mode
* feat: update remote MCP base URL
* docs: update MCP getting started
- Restores relevant content from prod
- Adds callout about authentication
- Adds next steps to remote MCP installation section
* Update apps/docs/content/guides/getting-started/mcp.mdx
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat: click selected project to unselect
This follows the unselect pattern from shadcn combobox example
https://ui.shadcn.com/docs/components/combobox
* Update apps/docs/content/guides/getting-started/mcp.mdx
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
* Update apps/docs/content/guides/getting-started/mcp.mdx
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
* Update apps/docs/content/guides/getting-started/mcp.mdx
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
* fix: light mode connection icons
* chore: format `mcp.mdx`
* fix: VS Code URL handler "name"
Based on docs the field is "name" instead of "id":
- https://code.visualstudio.com/docs/copilot/customization/mcp-servers#_commandline-configuration
- https://code.visualstudio.com/docs/copilot/customization/mcp-servers#_url-handler
* refactor: `NEXT_PUBLIC_MCP_URL` environment variable
* feat: move client selector below options
* feat: "Add to" buttons left aligned about config file
* feat: actionable login hint
* refactor: remote claude desktop client option
---------
Co-authored-by: Matt Rossman <22670878+mattrossman@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Danny White <3104761+dnywh@users.noreply.github.com>
* Update Supabase docs URLs to use env variable
Co-authored-by: a <a@alaisteryoung.com>
* Refactor: Use DOCS_URL constant for documentation links
This change centralizes documentation links using a new DOCS_URL constant, improving maintainability and consistency.
Co-authored-by: a <a@alaisteryoung.com>
* Refactor: Use DOCS_URL constant for all documentation links
This change replaces hardcoded documentation URLs with a centralized constant, improving maintainability and consistency.
Co-authored-by: a <a@alaisteryoung.com>
* replace more instances
* ci: Autofix updates from GitHub workflow
* remaining instances
* fix duplicate useRouter
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: alaister <10985857+alaister@users.noreply.github.com>
* show cms blog posts in www
* remove contentlayer from www
* outputFileTracingExcludes
* update remotePatterns
* fetch cms posts server-side with revalidation
* add cms env vars to turbo.json
* add www env vars to turbo.json
* include cms posts in www sitemap
* add migration to remove image from cms post
* update cms meta image mapping in www
* Set up Sentry for www
* Add Sentry captureEExceptions to API routes in www
* Prettier
* Fix TS
* Address feedback
* Clean
* Remove SENTRY_AUTH_TOKEN from turbo.json
* Initial work.
* Add missing import.
* Minor fixes.
* Minor fixes.
* Add a feature flag for the refresh toast.
* Add a commit for testing. Revert before merging.
* Remove header caching for testing.
* Tiny lint
* Fix
* One more
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
- Mandatory address input when adding a new payment method
- Removed the global HCaptcha store that wasn't used consistently and would sometimes block payment method changes
- Remove the custom billing address data & tax id form on org creation and plan upgrades in favour of Stripe's `AddressElement`
- Unify usage of the Stripe payment elements into a single component
- Customers can mark "Purchasing as a business" and will then be able to put down a tax id
- Adjusted billing address form to have better labels + tax id is filtered down to selected country
- Adjusted Stripe Elements styling to use floating labels (otherwise very hard to use with address element) + additional styling changes
- New flag to filter out payment methods that do not have an address for org upgrades and credit top ups, this will be enforced a few days after rolling this out
- Added Google Maps Places API integration for address auto-completion via Stripe AddressElement
- Upgraded Stripe dependencies
- Slight adjustments to styling of plan upgrade modal
* wip
* feat: distribute bedrock requests across regions
* fix: tests and type errors
* chore: remove AWS_BEDROCK_REGION from turbo.json
* fix: vercel oidc provider to fallback in credential chain
---------
Co-authored-by: delgado3d <27228526+delgado3d@users.noreply.github.com>
* Add third-parties dependency for GTM. Reexport the GTM from the common package.
* Add the TelemetryTagManager to four of the production apps.
* Add the GOOGLE_TAG_MANAGER_ID env var as a turbo dependency to the 4 apps.
* Skip rendering the tag manager if the env var is not set or not running on the platform.
* Fix the prop type to be extracted from the component.
* Add default values for consent to GTM.
* Another try to mimic gtag function.
* Fix a link in www.
* Try another approach.
* try.
* Remove the data-redaction flag.
* Remove extra code.
* Send a sign-up event if GTM is enabled.
* Send only the email to GTM.
* Minor fixes.
* Remove third-parties from pnpm lockfile.
* Lets try to make studio work again.
* Add CSP rules for img loading for GTM.
* Add event for testing.
* Add www.googletagmanager.com to the CSP rules.
* Add Stape to CSP rules.
* Fix stape CSP.
* Clean up the code.
* Remove extra console.log.
* Fix the stape urls for CORS.
* Fix the wrong category for Stape URL.
* Add google ads urls.
* Bump the timeout.
* Add google.com to the img-src for google ads.
* update csp
* remove comment
* update to use google analytics without signals
* add stape to default-src in csp
* move csp to middleware
* add google ads support and fix middleware base path
* remove google tag manager / google ads references from csp. load via stape proxy instead
* add double click url to image src
* add Google Tag Manager URL to CSP configuration
* add ga4 urls to csp
* remove google urls from CSP
---------
Co-authored-by: Alaister Young <a@alaisteryoung.com>
* step 1
* use mcp
* system prompt
* clean up
* space
* clean up
* add three state opt in toggle
* clean up
* todo
* hooks
* refactor opt in form and modal
* refinements
* add bedrock
* remove console
* update mcp util
* use bedrock
* remove openai sdk package
* re-add tools
* update complete endpoints
* fix: ai assistant markdown formatting (#35541)
* fix: mcp types and project ref (#35540)
* feat: more flexible aws credential provider (#35538)
* feat: more flexible aws credential provider
* fix: add AWS_REGION to turbo env vars
* change to allowed
* update complete endpoints
* add an additional permission
* refinements
* use claud 4
* legal copy changes
* update other ai functions to use bedrock
* update generate v3 copy
* remove generate sql modal
* fixes for query block
* re-add dragging to reports
* clean up
* add open ai edge function example
* use handle error from fetchers
* remove schema and lean on tools
* copy
* Assistant MCP tests (#36049)
* feat: refactor and test mcp and model logic
* fix: remove get_project tool
* fix: remove additional get_project tool references
* update copy
* Clean up, fixes, refactors
* oops
* Float errors from AI endpoionts as toasts
* Use a env var AWS_BEDROCK_PROFILE for bedrock.
* Rename the env var for AWS bedrock profile.
* feat: support custom aws bedrock env vars
* chore: add comments explaining aws credential chain
* MCP Self Hosted Check (#36185)
support self hosted
* feat: bedrock auth via vercel oidc
* Fix broken unit test
* Feeeex
* Refactor useOrgOptedIntoAi
* Remove useDisallowHipaa hook
* small system prompt change
* readd vercel packages
* fix self hosted
* increase max duration
* try more direct prompt
* max duration 90
* reduce max steps and add loading
* mono font
* backwards compat styling
* Chore/limit number of messages sent to assistant (#36388)
* Limit number of historical messages that get sent to assistant
* Update max chat history to 5
* alignment
* bump mcp server version
* Add feature flag for opt in tags (#36466)
* Add feature flag for opt in tags
* Add one more check
* security section system prompt
* rely on default link and replace image markdown
* Add custom link component to assistant message block (#36527)
* Add custom link component to assistant message block
* Update based on feedback
* Render plain text if URL is deemed unsafe
* fix mcp tools and parse data (#36593)
* Update Admonition for AI Assistant for when opt in is re-enabled (#36663)
* Update Admonition for AI Assistant for when opt in is re-enabled
* Update
* Smol fix
* Fix TS
* Tiny
---------
Co-authored-by: Greg Richardson <greg.nmr@gmail.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Add the ability to look up error code explanation in API Gateway logs.
Also a bunch of GraphQL-related utilities and generated types for
calling the Content API.
* add cms turbo app
* add cms scripts to package.json
* update README
* update README
* update files
* fix formatting
* fix populateAuthors
* sync dependencies
* update launch week field
* update lint config
* Coordinate the deps to be the same as the other apps.
* Remove extra files.
* Run prettier on the CMS files.
* Add commands for cleaning and typechecking.
* Fix weird version of @types/react in docs.
* run pnpm install
* fix pnpm-lock
* fix cms lint
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* chore: add usercentrics for consent management
* client component to make next.js happy
* address feedback
* move consent state to common
* fix import
* ensure page events are sent correctly
* add feature flag provider to ui library site
* fix ui lib 500 error
* skip in test env
---------
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
Co-authored-by: Jordi Enric <jordi.err@gmail.com>
Gildas Garcia