## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature — a new UI Library block. Stacked on #49573 (already in main)
Fixes AI-1064
## What is the new behavior?
Adds `headless-app-tanstack`: customers sign in, authorize an MCP
client, and use the product through agent tool calls. It composes the
existing Password-Based Auth, OAuth Consent, and MCP Server blocks.
- `/agents` provides a copyable connection prompt, lists OAuth
authorizations, and lets customers revoke access.
- The shared MCP runtime exposes `whoami` plus example task CRUD tools.
Tools use the caller's Supabase client, with database grants and RLS
enforcing ownership.
- A root-level `supabase/` directory supplies local Auth/OAuth
configuration, a declarative tasks schema, and Edge Function files,
including `.env.example`.
- Docs cover local setup, signing keys, migrations, environment
configuration, deployment, and extending the tools.
`/example/headless-app` previews the sign-in, consent, connect, and
connected states.
Shared block fixes make a fresh install work:
- Explicit public URL resolution fixes OAuth discovery in local Edge
Runtime when middleware runtime detection fails. Both external OAuth
access tokens and ordinary authenticated app session tokens remain
supported; embedded agents do not need an additional consent flow.
- Registry targets keep backend files outside `src/`, and generated
consumer routes omit source-only TypeScript suppressions.
- Signup respects `auth.email.enable_confirmations`; sign-in/signup
preserve the return destination. Missing consent IDs retain the existing
error state without serializing `null` into the URL.
## How to test
Use the UI Library on **staging** and follow the block pages'
instructions.
1. Open the **Headless App** block page for TanStack Start. Install it
into a fresh app and follow the setup instructions through connecting an
MCP client.
2. Sign up, open `/agents`, and use the connection prompt to authorize a
client. Call `whoami`, then create, list, update, and delete a task.
3. Confirm the client appears on `/agents`. Revoke access and verify it
disappears and token refresh fails. An existing access token can
continue working until it expires.
4. Follow the **MCP Server** block page's embedded-agent instructions
using an authenticated app session. Confirm tools work without another
OAuth consent flow and `whoami` returns `client_id: null`.
5. With a second user, confirm each user can only access their own
tasks. Check that signup behaves correctly for the configured
email-confirmation setting.
6. Check the Headless App preview states and run the installed app's
typecheck and production build.
## Validation performed
Fresh local installation and browser/SDK verification passed: 26 live
MCP/Data API checks, 10 Deno tests, and 7 connection-page component
tests. Also passed UI Library typecheck, targeted lint,
registry/Markdown builds, and fresh consumer typecheck/production build.
Both OAuth and ordinary app session authentication were exercised.
Hosted deployment and consuming the confirmation-email link were not
tested.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a TanStack Headless App example with sign-in, OAuth consent, MCP
connection, and connected-agent screens.
- Added task management tools for listing, creating, updating, and
deleting tasks through MCP.
- Added connected-agent management, including server URL and prompt
copying, refresh, and access revocation.
- Added a new Headless App registry block and documentation.
- **Bug Fixes**
- Preserved intended destinations through sign-up, email confirmation,
and protected-route login redirects.
- Improved OAuth discovery URL handling across forwarded-host
deployments.
- **Documentation**
- Updated setup, environment, deployment, and Supabase CLI guidance for
headless apps and MCP servers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: repro <repro@local>
Co-authored-by: Raúl Barroso <code@raulb.dev>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature: agent-readable markdown pages for the UI library docs.
## What is the current behavior?
Library docs are HTML-only. `llms.txt` lists page titles, but there is
no `.md` body an agent can fetch.
## What is the new behavior?
Each docs page is also served as markdown:
- Build-time MDX → markdown (`pnpm --filter library build:markdown`)
- `GET /library/docs/{slug}.md` (and `Accept: text/markdown`)
- HTML pages advertise `rel=alternate` `text/markdown`
- `llms.txt` links to the `.md` URLs
This is the base of a stack. The prompt-tab PR sits on top:
https://github.com/supabase/supabase/pull/49566
## Additional context
Interactive previews are omitted from the markdown. `BlockItem` emits
the production `npx shadcn add` command so agents still get an install
path.
## To test
1. `pnpm --filter library dev` (generates markdown in `predev`).
2. Open http://localhost:3004/library/docs/nextjs/password-based-auth.md
— markdown with the install command, file tree, and setup steps; no
interactive previews.
3. Open the same path without `.md` — HTML docs unchanged (no prompt tab
in this PR).
4. `curl -H 'Accept: text/markdown'
http://localhost:3004/library/docs/nextjs/password-based-auth` should
also return markdown.
5. http://localhost:3004/library/llms.txt — links should end in `.md`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Documentation pages are available as Markdown through `.md` URLs and a
dedicated endpoint.
* Markdown is generated automatically during development and production
builds.
* Generated content preserves front matter, links, callouts,
installation instructions, and supported documentation elements.
* Installation commands support npm, pnpm, yarn, and bun for React and
Vue projects.
* **Bug Fixes**
* Improved Markdown file handling, link rewriting, and content
negotiation.
* **Tests**
* Added coverage for Markdown conversion, content negotiation, and
installation commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Saxon Fletcher <SaxonF@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Our UI Library registry is expanding to include blocks that go beyond UI
and in some cases focus purely on back-end. This PR is a precursor to
adding more back-end related blocks. This PR includes the `ui-library ->
library` rename plus redirects and small UI copy updates. Since this is
a rename we'll need to update Vercel configuration.
## Vercel rollout
Keep the Library project Root Directory as `apps/ui-library`
1. In the **Library** Vercel project, set:
`NEXT_PUBLIC_BASE_PATH=/library`
Apply it to Preview and Production, then redeploy the Library project.
2. In the **www** Vercel project, add:
`NEXT_PUBLIC_LIBRARY_URL=<current value of NEXT_PUBLIC_UI_LIBRARY_URL>`
Apply it to Preview and Production. Keep `NEXT_PUBLIC_UI_LIBRARY_URL`
during the migration, then redeploy the www project.
3. Deploy in this order:
1. Library project
2. www project
4. Validate:
- `/library`
- `/library/docs/nextjs/password-based-auth`
- `/ui` redirects to `/library`
- `/ui/docs/nextjs/password-based-auth` redirects to
`/library/docs/nextjs/password-based-auth`
- `/ui/docs/ai-editors-rules/*` still uses its existing Docs redirects
No Vercel dashboard redirect rules are needed. Environment-variable
changes require a new deployment.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Supabase UI Library has been renamed to **Supabase Library** across
navigation, pages, documentation, and resource links.
* The Library is now available at `/library`, with updated descriptions
covering components, blocks, and developer tools.
* **Bug Fixes**
* Added permanent redirects from legacy `/ui` URLs to corresponding
`/library` paths.
* Updated links throughout the site and documentation to prevent broken
navigation and references.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature, docs update
## What is the new behavior?
This PR introduces a new `RealtimeFlow` component and hook to the UI
library for building collaborative React Flow with Supabase Realtime:
- keeps nodes and edges in sync across multiple connected clients in
real time
- uses Yjs with `@supabase-labs/y-supabase` to propagate flow updates
- supports optional persistence, so a flow can be restored from
previously saved shared state
## Additional context
https://github.com/user-attachments/assets/90d3a381-6f9c-427f-a493-5d91c2141462
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Collaborative "Realtime Flow" diagram editor with syncing overlays and
a dual-view demo component
* Interactive demo page and registry example for live editing
(add/remove/rename nodes)
* Framework-ready registry packages for Next.js, React, React Router,
and TanStack
* **Documentation**
* Comprehensive docs added for Next.js, React, React Router, and
TanStack (usage, persistence, hook API)
* **Chores**
* Added runtime dependency for the flow component package
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/44273)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Build the current registry.
* Export the blocks as JSON and import them into registry.json.
* Move the registry.json into public/r.
* Fix a prettier error.
* Clean up extra files in vue blocks.
* Bump shadcn.
* Readd shadcn to vue blocks.
* Fix the shadcn types.
* Remove extra package exclusions.
* Remove unneeded code.
* Remove more unused code.
* Update knip.jsonc for ui-library.
* Remove unneeded imports. Change the registry generation to only generate what's needed.
* Cleanup the rehype middleware (it wasn't used). Clean up the example blocks generation.
* Don't show the "show code" button in all dropzone examples.
* init
* Update component-preview.tsx
* please note: changed redirects in block, so need to update the logic to find and replace the redirects
* Fix the redirect urls to work when installing and in examples.
* Revert some of the changes.
* Add a step when building the registry to clean the registry of example code.
* Fix the clean registry script.
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
* Regenerate the registry files.
* Regenerate the llms.txt file.
* Set the supabase project for testing.
* Fix the registryBlock component.
* Various fixes.
* Add missing deps to satisfy TS build.
* Fix the tanstack client.
* Add a tanstack block for password-based auth.
* Fix the command URL.
* Fix the env vars in the React client.
* Add missing pages to the nextjs auth.
* Simplify the tanstack auth block.
* Add success state to the forgot-password form.
* Fix the v0 button. Add some more docs.
* Revert some changes.
* Copy the design-system app into a new one for ui-library.
* Remove unneeded content.
* Add supabase config.
* Cleanup the css.
* Add bunch of packages.
* Cleanup the registry.
* Regenerate the registry.
* Add needed components for documenting components.
* Add the pages for the components.
* Fix the RegistryBlock.
* Various fixes.
* Add a turbo definition for ui-library.
* Rename Remix to React Router.
* Reorder the pages for all frameworks.
* Remove the bottom pager.
* Fix the pages and command menu.
* Various fixes.
* Minor fixes.
* Add ai editor rules.
* Various fixes.
* Add local supabase env vars.
* Try to fix a package error.
* Bunch of various fixes.
* Fix lint errors.
