dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-06 18:05:11 +03:00
Code Issues Packages Projects Releases Wiki Activity
38,394 Commits 1,784 Branches 62 Tags
c33d255eba8ba9ff7c7a2a01a93dce80cb685708
Commit Graph
2938 Commits
Author SHA1 Message Date
Danny White 1131e3e2ce fix(ui): default Button variant to default instead of primary (#50160) 
## What kind of change does this PR introduce?

Bug fix / design-system alignment for the legacy `Button` from `ui`.

## What is the current behavior?

Omitting `variant` on the legacy `Button` falls back to brand-green
`primary`. That makes accidental greens easy, and it is hard to spot the
real main action on busy pages.

## What is the new behavior?

- Legacy `Button` now defaults to neutral `default`
- Intentional primary CTAs (create, save, submit, marketing CTAs, and
matching `ButtonTooltip` usages) now set `variant="primary"` so their
appearance is unchanged
- Neutral actions that previously relied on the old fallback (cancel,
close, back, dashboard nav, and similar) become grey/white
- Design-system docs updated; regression tests cover the new default

`Button_Shadcn_` is unchanged. It already uses its own CVA default.

This is PR 1 of 2 in a stack. PR 2 drops now-redundant
`variant="default"` props.

## To test

Studio (http://localhost:8082):

- `/sign-in`: Sign in stays green
- Open a project → Database → Tables: New table stays green
- Auth → Users → Invite: Invite user stays green; Cancel / dismiss
controls stay neutral
- Project Settings → General: edit a field so Cancel and Save appear.
Cancel is neutral, Save is green

Design system (http://localhost:3003):

- Components → Button: default demo is neutral; primary demo is green;
featured preview is the default variant

Marketing (optional):

- www header: Start your project stays green; logged-in Dashboard is
neutral

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Style**
- Buttons now default to a neutral style, while primary actions across
Studio, documentation, marketing pages, forms, dialogs, and error states
use prominent primary styling.
- Updated button examples and previews clarify the distinction between
default and primary variants.
  - Event registration now includes a directional arrow icon.

- **Tests**
- Added coverage confirming default button styling and explicit primary
styling behave as expected.
- Updated related test fixtures to use primary styling where
appropriate.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-10 11:23:17 +10:00
Pedro RodriguesCursorNik Richers
 		2b57416bc4 docs: add Cursor CLI instructions for Supabase MCP (#50053) 
## What this does

Adds Cursor CLI instructions to the existing Cursor entry in the
Supabase MCP docs.

- Explains that Cursor IDE and `agent` share `.cursor/mcp.json` or
`~/.cursor/mcp.json`.
- Documents enable, login, and status commands after one-click or file
setup.
- Updates the Cursor MCP documentation link.

Cursor CLI cannot add an MCP server, so no separate client entry is
added.

<img width="1128" height="706" alt="image"
src="https://github.com/user-attachments/assets/fc35226c-0284-4292-9023-79c4f735aad2"
/>


## Testing

- Verified with Cursor CLI `2026.09.02-c22c1a3` using isolated
configuration.
- Ran `pnpm --filter docs build:guides-markdown`.
- Ran `pnpm --filter ui-patterns test types.test.ts`: 17 passed.
- Verified the rendered Cursor instructions and copy buttons.

Closes
[AI-700](https://linear.app/supabase/issue/AI-700/add-cursor-cli-instructions-for-supabase-mcp-server)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added Cursor support to the MCP URL Builder, including setup
instructions for Cursor IDE and CLI.
  - Added guidance for configuring MCP servers across Cursor projects.
- Added OMP setup guidance for project-scoped and cross-project
configurations.
- Added commands to enable, authenticate, reload, and verify MCP
connectivity.
- **Documentation**
  - Updated the Cursor documentation link.
- **UI Improvements**
- Improved rendering of instruction headings with consistent sizing and
styling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Nik Richers <nrichers@gmail.com>
 2026-09-09 14:16:39 +01:00
Joshen Lim a1686025b6 Joshenlim/fe 4291 keep unsaved notebooks accessible after page refresh (#49673) 
## Context

Changes here adds a "Draft" state for notebooks with a new
`notebook-drafts` store - similar to how we handle query tabs in the
explorer.
This implies that if a user refreshes the tab while there's unsaved
changes to notebooks, the changes can be persisted locally and the user
will be able to continue from where they left off.

This also implies that If you create a new notebook (OR open an existing
notebook and make some changes) and refresh the browser, we no longer
show the native browser confirmation dialog about discarding changes.

We also reuse the existing confirmation dialog when saving a notebook if
its draft has diverged from the server side content - just updated the
language to be more generic rather than saying that the Assistant made
changes
<img width="429" height="238" alt="image"
src="https://github.com/user-attachments/assets/5c392aed-1633-4428-8060-28f495a01f04"
/>

Also fixes an unrelated issue - renaming a notebook should mark the
notebook as having unsaved changes (with the orange indicator)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Unsaved notebook edits are saved locally and restored when reopening
Studio.
* Drafts are scoped by project and protected from server changes through
conflict detection.
* Notebook tabs indicate unsaved changes, including drafts from unsaved
notebooks.
* **Bug Fixes**
* Closing a tab with local edits prompts for confirmation and removes
its saved draft.
  * Notebook save state reflects the server-confirmed update time.
  * Conflict messages clearly describe changes made on the server.
* **Style**
  * Improved keyboard focus behavior for tab controls.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-09 17:17:25 +08:00
Danny White bfe07a5937 fix(ui-patterns): stabilise multi-select trigger height (#50163) 
## What kind of change does this PR introduce?

Bug fix and design-system documentation update.

## What is the current behaviour?

Multi-select examples inconsistently hide the default trigger icon,
which makes the component default difficult to understand from the
design-system page.

The empty trigger label and selected badges also use different content
heights. Selecting or removing the first item causes the default 34px
trigger to grow or shrink slightly.

## What is the new behaviour?

- Shows the default trigger icon in every existing multi-select example
- Adds a dedicated **Without trigger icon** example for
`showIcon={false}`
- Normalises the label and badge content rows to 20px so the default
trigger remains 34px when the first item is selected or removed
- Adds regression coverage for the default trigger height classes

This follows the 34px trigger sizing introduced in
[#48696](https://github.com/supabase/supabase/pull/48696).

## To test

1. Open [Design System > Fragment Components > Multi
Select](https://design-system-git-dnywh-fixmulti-select-icon-ex-772e13-supabase.vercel.app/design-system/docs/fragments/multi-select).
2. Confirm every existing example shows the default trigger icon.
3. Confirm the new **Without trigger icon** example is the only example
without it.
4. In the first example, select and remove the first fruit. The trigger
should remain the same height throughout.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
  * Added a multi-select example that hides the trigger icon.
* Added documentation and a preview for using multi-select without a
trigger icon.

* **Bug Fixes**
  * Improved multi-select badge and label alignment.
  * Preserved consistent trigger height when selecting the first item.
  * Updated examples to display the trigger icon by default.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-09 04:14:46 +00:00
Danny White 6a4cbefbcf feat(ui): align combobox trigger with select styling (#49665) 
## What kind of change does this PR introduce?

Bug fix and shared UI primitive.

## What is the current behaviour?

In **Database > Replication > Add destination**, the searchable
**Publication** field uses a double chevron and button styling. It looks
inconsistent beside the **Initial sync** select, which uses a single
chevron and the standard select surface.

The shared multi-select trigger uses the same inconsistent double
chevron. These differences are easy to repeat because searchable
comboboxes do not have a dedicated trigger that shares the select
styling.

## What is the new behaviour?

- Adds `ComboboxTrigger` with the same shared styling as `SelectTrigger`
- Uses a fixed single down chevron so combobox and select triggers
cannot drift
- Migrates the Studio **Database > Replication > Add destination >
Publication** field to `ComboboxTrigger`
- Updates `MultiSelectorTrigger` to replace `ChevronsUpDown` with the
same fixed `ChevronDown`, including **Connect > MCP > Feature groups**
in Studio
- Updates the canonical design-system combobox examples
- Leaves `Button` unchanged, so adopting combobox styling is explicit

| Before | After |
| --- | --- |
| <img width="1256" height="448" alt="CleanShot 2026-09-09 at 10 21
32@2x"
src="https://github.com/user-attachments/assets/bb7a6056-0b4e-4cb4-8dce-e92fa4f5afe7"
/> | <img width="1256" height="448" alt="CleanShot 2026-09-09 at 10 21
11@2x"
src="https://github.com/user-attachments/assets/860a06b9-617d-4d94-ac98-944316e9fdc3"
/> |
| <img width="1210" height="520" alt="CleanShot 2026-09-09 at 10 58
28@2x"
src="https://github.com/user-attachments/assets/e916d3a2-6a75-40eb-965a-56e0694ba447"
/> | <img width="1210" height="520" alt="CleanShot 2026-09-09 at 10 57
57@2x"
src="https://github.com/user-attachments/assets/c5f1b8ff-8083-47b8-8242-59116d085c00"
/> |

## Left for incremental migration

These existing Studio comboboxes still use bespoke button triggers and
will move to `ComboboxTrigger` in focused follow-up changes:

- **Database > Backups > Point in time > Timezone**
- **Authentication > Third-party auth > AWS region**
- **Account > Preferences > Timezone**
- Shared schema and function selectors

See https://github.com/supabase/supabase/pull/50157.

The organisation and project switchers in the top navigation are
intentionally out of scope. They are context switchers rather than
form-field comboboxes.

## To test

### Studio callsites

On the [Studio
preview](https://studio-staging-git-dnywh-featcombobox-trigger-supabase.vercel.app):

1. Open **Database > Replication > Add destination**.
2. Compare **Publication** with **Initial sync**. Both should use a
single down chevron and the same closed-field surface, border, sizing,
and hover treatment.
3. Open **Publication**, search for an option, and select it. The
popover should close and the selected publication should be shown.
4. Open **Connect** from the project header, select **MCP**, and check
**Feature groups**. Its multi-select trigger should use a single down
chevron.

### Design system

1. Check the [combobox
examples](https://design-system-git-dnywh-featcombobox-trigger-supabase.vercel.app/design-system/docs/components/combobox).
2. Check the [multi-select
examples](https://design-system-git-dnywh-featcombobox-trigger-supabase.vercel.app/design-system/docs/fragments/multi-select).
3. Both trigger types should use a single down chevron.
 2026-09-09 13:44:11 +10:00
ŁUKASZ KORBASIEWICZ 8121df5b0a docs: correct Auth rate limit details (#49772) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Docs update

## What is the current behavior?

The Auth rate-limit table contains stale customization statuses and time
windows, omits SMS and Web3 limits, and describes the anonymous sign-in
burst incorrectly.

## What is the new behavior?

- Aligns documented limits with the current Auth, Studio, and Management
API behavior
- Documents SMS, Web3, and sign-up/sign-in request limits
- Corrects verification, token, MFA, email, and anonymous sign-in
details
- Updates shared rate-limit values and units used by the docs

## Additional context

Validation:

- Prettier check
- Focused MDX lint
- Shared-data TypeScript check
- All 16 SharedData references resolve

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
* Refined authentication rate limits with clearer per-minute and
per-five-minute windows.
* Added rate limits for SMS, password reset requests, and Web3 sign-ups
and sign-ins.
* Updated sign-in, sign-up, verification, token refresh, MFA, and
anonymous sign-in limits, including customizable settings where
supported.
  * Clarified email-sending limits and OTP behavior.

* **Documentation**
* Updated rate-limit reference tables and guidance on request bucket
capacity and sustained traffic.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-08 18:52:22 +02:00
Anthony Lio 45199443c8 fix(ui): admonition component parity (#49925) 
## what is the current behavior?

admonition icon <> text not optically aligned + rendered differently in
docs and the design system _ docs showed admonition text at 15px/28px
because the page's prose styles reached inside the component, while the
same callout was 13px in the design system _ lists

## what is the new behavior?

- the title offset is now conditional. a title and body copy have
different line heights, so they need different nudges to sit level with
the icon.
- fixes list markers and the ordered-list chip alignment inside
callouts.
- removes `.admonition-content` css that nothing referenced
- fixes 5 admonition titles that were not capitalized.

| state | preview |
| -------|------|
| before | <img width="902" height="279" alt="image"
src="https://github.com/user-attachments/assets/2fffb183-81e2-4eff-8f0d-8a07649390e8"
/> |
| after | <img width="902" height="279" alt="image"
src="https://github.com/user-attachments/assets/22abe3ed-fd6d-49ac-aa37-4292bca5850a"
/> |

## follow ups

- better composition: title, description and actions are still props _ a
compound api (`Admonition.Title`, `Admonition.Actions`) would remove the
`childProps` escape hatch


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Improved capitalization of note and warning titles in the Metabase and
Prisma guides for consistency.
* Updated the contributing guide’s table of contents to exclude feedback
headings.
  * Improved heading structure for the documentation feedback section.

* **UI Improvements**
* Refined admonition and alert typography, spacing, list formatting, and
ordered-list alignment.
* Improved content spacing when titles, descriptions, or icons are
present.
  * Updated action links and buttons for more consistent sizing.
  * Adjusted alert content styling for a clearer presentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-08 14:31:30 +03:00
Danny WhiteClaude Opus 5Joshen Lim
 		f5d0bf5d98 fix(ui): let command dropdowns scroll on touch inside overlays (#50103) 
## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

A command dropdown cannot be scrolled by touch when it sits inside a
dialog or sheet.

Radix wraps a modal dialog's overlay in a scroll lock that cancels wheel
and touch events whose target is not inside the sheet. A dropdown
portals to the body, so it falls outside that boundary and its scroll
events get cancelled.

Callers have been rediscovering this one at a time and fixing only half
of it. `MultiSelectorList` stops wheel events reaching the document, and
`SchemaSelector` and `FunctionSelector` expose a `stopScrollPropagation`
prop that does the same. None of them handle touch, so the desktop
symptom is fixed everywhere and the mobile one is fixed nowhere.

## What is the new behavior?

`CommandList` keeps wheel and touch events off the document itself. That
covers every command dropdown in the monorepo, in an overlay or not,
with no call-site changes. A caller's own `onWheel` or `onTouchMove`
still runs.

The workarounds this replaces are removed: the handler in
`MultiSelectorList`, and the `stopScrollPropagation` prop on
`SchemaSelector` and `FunctionSelector` along with its four call sites.

One behavior change worth naming: overscrolling past the end of a
dropdown no longer scrolls the page behind it. That is what a dropdown
should do, and it is what the four `stopScrollPropagation` call sites
were already opting into.

#50072 depends on this. It swaps two selects for comboboxes, and Radix
Select brings its own scroll lock, so without this the swap would
regress touch scrolling.

## To test

- On the deploy preview, [open a project's Connect
sheet](https://studio-staging-git-dnywh-fix-multi-select-scrol-63608b-supabase.vercel.app/dashboard/project/_)
and pick the MCP tab.
- Narrow the window to phone width and switch on touch emulation in
devtools.
- Open the features dropdown and drag the list. It should scroll, and
the sheet behind it should stay put.
- Repeat with a mouse wheel to confirm desktop scrolling still works.
- [Open Authentication >
Hooks](https://studio-staging-git-dnywh-fix-multi-select-scrol-63608b-supabase.vercel.app/dashboard/project/_/auth/hooks)
> Create hook, open the schema picker, and confirm it still scrolls by
wheel now that `stopScrollPropagation` is gone.
- [Open the SQL
editor](https://studio-staging-git-dnywh-fix-multi-select-scrol-63608b-supabase.vercel.app/dashboard/project/_/sql/new)'s
schema picker on a page with no overlay and confirm the list scrolls
normally.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved wheel and touch scrolling behavior in command lists,
selectors, and multi-select menus.
- Reduced unwanted scroll-lock interference when using selectors inside
overlays such as dialogs and sheets.
  - Preserved support for supplied scroll event callbacks.

- **Accessibility**
- Added clearer accessible labels to the Connect and mobile navigation
menu buttons.
- Updated the Connect button text behavior for icon-only and standard
presentations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-09-08 19:21:19 +08:00
Anthony Lio 84d3ce1bd2 fix(docs): keep code block line numbers sticky while scrolling (#49962) 
## What kind of change does this PR introduce?

bug fix + some ui polish on the docs code block

## What is the current behavior?

line numbers scroll away with the code _ so you lose your place in any
block wide enough to scroll _ the gutter is also see-through so scrolled
code renders interleaved with the numbers

## What is the new behavior?

- makes gutter sticky and stays pinned while the code scrolls (no
rubber)
- fixes gutter, row hover, and button backgrounds as opaque so nothing
bleeds through
- adds gutter right edge fades vs bg
- adds right padding so line endings clear the buttons
- adds press feedback on the shared in-house `Button` gated behind
`motion-safe`

| state | preview |
| -------|------|
| before | <img width="566" height="263" alt="image"
src="https://github.com/user-attachments/assets/81778815-1f15-4ea5-a647-ed48418210e8"
/> |
| after | <img width="566" height="259" alt="image"
src="https://github.com/user-attachments/assets/b7d770c5-4156-491f-93c8-b0d900b7dc85"
/> |

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **UI Improvements**
* Refined code block controls with consistent styling, active states,
animated icons, and automatic copy-status reset.
* Improved code block line-number presentation with hover effects,
sticky gutters, spacing, shadows, and smoother horizontal scrolling.
* Added smoother button transitions and a subtle pressed-state
animation.
* Respect reduced-motion preferences by disabling icon animations when
requested.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-08 14:07:17 +03:00
Joshen Lim db0e6b761b Joshenlim/fe 4304 bring database connections out of feature preview (#50107) 
## Context

As per PR title - we're bringing Database Connections out of feature
preview and it'll live on the dashboard by default 🙂
Also deprecating the existing Ongoing queries panel which Database
Connections now supercedes.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Database Connections is now available without feature-preview
activation.
* The SQL editor’s “View running queries” option now links directly to
Database Connections.

* **Bug Fixes**
* Query cancellation and session termination now refresh database
activity data.

* **Removed**
* Removed the in-editor ongoing queries panel and its termination
controls.
* Removed the Database Connections promotional banner, preview
messaging, settings, and related telemetry.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-08 17:26:24 +08:00
CharisandJoshen Lim 2ac052752a fix(pg-meta): fix invalid SQL when setting column default to NULL (#50097) 
## Summary

- Fixes invalid SQL generation when setting a column's default value to
NULL through Studio's Table Editor
- The bug occurred because raw `null` values bypassed literal
serialization in the SQL builder
- Added special case handling in both `create()` and `update()`
functions to use `literal(null)` regardless of format

## Details

Setting a column's default to NULL via the "Set as NULL" suggestion in
Studio generated invalid SQL: `ALTER TABLE ... ALTER COLUMN ... SET
DEFAULT ;` (missing the NULL keyword). This was caused by
`default_value` being JS `null` and bypassing the literal()
serialization function when `default_value_format === 'expression'`.

The fix ensures that when `default_value === null`, we always use
`literal(null)` to produce the correct `SET DEFAULT NULL` clause.

## Test plan

- New regression test in `packages/pg-meta/test/columns.test.ts`
("update column default value to NULL via expression format") verifies
the fix by:
  - Creating a text column with a literal default
- Updating it using `default_value_format: 'expression', default_value:
null` (exact payload from Studio)
  - Asserting the column's default value is null
- All 58 tests in `packages/pg-meta/test/columns.test.ts` pass
- TypeScript check (`tsc --noEmit`) passes

Fixes FE-4343

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Fixed column creation and updates so explicitly setting a default
value to `NULL` correctly preserves the `DEFAULT NULL` clause.
- Ensured setting a column default to `NULL` through expression-based
editing is reflected accurately when column details are retrieved.

- **Style**
- Improved the column editor’s suggestion menu layout and spacing for
clearer readability.

- **Tests**
  - Added coverage for updating a column default to `NULL`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-09-08 16:08:24 +08:00
Gildas Garcia bfb0737d14 Fix to ensure labels, descriptions and validation errors are correctly linked to their inputs (#50080) 
## Problem

`FormItemLayout` does not correctly binds inputs descriptions and
validation messages to their inputs. This is because the input ids are
generated and not correctly propagated to the `FormMessage` and
`FormDescription` components. Besides, we still pass `name` or `id`
directly to the inputs or `FormItemLayout` in some places.

## Solution

- Fix `FormItemLayout` to correctly binds inputs descriptions and
validation messages to their inputs
- Fix incorrect usages
- Fix Design System documentation

## How to test

The issue is visible in production:
- Open https://supabase.com/design-system/docs/ui-patterns/forms
- Open the devtool and check the labels `for`, the description `id` and
the input `id` or `aria-describedby` attributes. You'll see they often
don't match

Do the same on staging:
- Open
https://design-system-git-fix-a11y-form-input-descriptions-supabase.vercel.app/design-system/docs/ui-patterns/forms
- Open the devtool and check the labels `for`, the description `id` and
the input `id` or `aria-describedby` attributes. They now match

Dashboard fixes:
-
https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/tokens:
_Expires in_ select button is now correctly linked to its label
-
https://studio-staging-git-fix-a11y-form-input-descriptions-supabase.vercel.app/dashboard/account/me:
the switches are now correctly linked to their label
- In Database/Indexes: the select buttons when creating an index are now
correctly linked to their label
- All other changes are the same things
 2026-09-08 09:47:32 +02:00
Danny White 66a748cdd1 fix(ui): restore accordion trigger layout (#50114) 
## What kind of change does this PR introduce?

Bug fix. Follow-up to #49660.

## What is the current behavior?

`AccordionTrigger` adds horizontal padding at the shared primitive
level. This shifts content at call sites that already own their spacing.
In the Studio Advanced settings sections, padding around the whole
accordion also constrains the trigger and its hit area instead of
letting it fill the row.

## What is the new behavior?

The shared trigger no longer adds horizontal padding and its header
explicitly fills its container. Both Studio Advanced settings sections
now apply their padding inside the full-width trigger and content,
keeping the text aligned while extending the focus outline and hit area
across the row.

The inset focus treatment from #49660 is unchanged.

| Before | After |
| --- | --- |
| <img width="1334" height="286" alt="CleanShot 2026-09-08 at 16 18
57@2x"
src="https://github.com/user-attachments/assets/3a057b45-1eb4-4928-ae69-2d636b0c4678"
/> | <img width="1302" height="278" alt="CleanShot 2026-09-08 at 16 18
12@2x"
src="https://github.com/user-attachments/assets/0454493e-4fbc-4ad2-a9fd-1b9dc1d486dc"
/> |

## To test

### Studio replication destination

1. Open the [Studio staging
preview](https://studio-staging-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app)
and select a project with Pipelines enabled.
2. Go to **Database > Replication**. Under **Destinations**, click **Add
destination**.
3. Tab to **Advanced settings** and press Enter to expand it.
4. Confirm the text aligns with the form content, the focus outline
spans the full row between the sheet edges, and clicking near the far
right of the row toggles it.

### Studio access-token permissions

1. In the [Studio staging
preview](https://studio-staging-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app),
go to **Account > Access Tokens**.
2. Click **Generate new token** and scroll to **Permissions**.
3. Tab to any permission category, then click near the far right of its
row.
4. Confirm the focus outline fills the category row, the label keeps its
existing inset, and the full row toggles the category.

### Pricing FAQs

1. Open the [Pricing
preview](https://zone-www-dot-com-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app/pricing)
and scroll to **Frequently asked questions**.
2. Tab to any question, then click near the far right of its row.
3. Confirm the question has not gained extra horizontal inset and the
full row remains interactive.

### Design-system Accordion

1. Open the [design-system Accordion
preview](https://design-system-git-dnywh-fixaccordion-trigger-width-supabase.vercel.app/docs/components/accordion).
2. Tab through the three accordion triggers and toggle each one.
3. Confirm each focus outline fills its row, with no extra horizontal
padding around the label.
 2026-09-08 16:24:49 +10:00
Danny WhiteandJoshen Lim 8dd97d75aa refactor(studio): use v2 replication publication APIs (#49844) 
## What kind of change does this PR introduce?

Studio data-layer migration.

## What is the current behavior?

Studio loads complete publication details through the original bulk
endpoint and creates publications by executing SQL against the source
database. Publication and source-table data use names where stable table
IDs are available.

## What is the new behavior?

Uses the v2 publication-name, publication-detail, publication mutation,
and source-table endpoints. The existing creation sheet continues to
behave the same, including publishing partition changes through the
parent table by default. Initial-sync selection and Analytics Bucket
associations now consume the selected publication detail. Generated
platform API types and their required nullability updates are included.

The generated Platform contract accounts for roughly 10,000 changed
lines in this PR.

## Dependency

Depends on the v2 source table, table column, and publication endpoints
from
[supabase/platform#37505](https://github.com/supabase/platform/pull/37505),
which are deployed to production.

## To test

1. Open the pipeline creation sheet and select an existing publication.
2. Create a publication with mixed-case schema and table names, then
confirm the table names are shown while stable IDs are submitted.
3. Exercise all four initial-sync policies, including selecting
individual tables.
4. Reopen the publication and table selectors and confirm they refresh
without replacing populated options.
5. Edit and delete a publication.
6. Open an Analytics Bucket associated with a pipeline and confirm its
publication tables resolve correctly.
7. Confirm unlimited WAL retention renders as Unlimited on pipeline
status.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Improved replication publication setup with on-demand table loading,
refresh controls, clearer table labels, and streamlined publication
selection.
- Publication creation and updates now use the latest replication API
and table-based configurations.
- Added clearer handling for tables removed from publications, including
stale-selection warnings.

- **Bug Fixes**
- Prevented table selections from carrying over when switching
publications.
- Improved replication status displays when lag or WAL metrics are
unavailable.
- Updated replication deletion and table management for the latest API
behavior.

- **Tests**
- Expanded coverage for publication creation, table selection, stale
tables, loading states, and replication metrics.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
 2026-09-08 11:37:59 +10:00
Jordi Enric be030229bf feat(studio): add workers to unified logs FE-4281 (#49682) 
## Problem

Unified Logs does not expose Workers logs, so users cannot search
Workers ingress, runtime, or build events alongside other services.

## Fix

Add a Workers log type that classifies all three Workers OTEL streams.
Gate the option and any persisted Workers filters with the existing
Workers feature flag.

## How to test

- Enable the Workers feature flag and open Unified Logs.
- Select Workers from the Log Type filter.
- Expected result: Unified Logs shows ingress, runtime, and build events
with the Workers icon.
- Disable the Workers feature flag and load a URL containing
`log_type:eq:workers`.
- Expected result: the Workers option and filter are removed, and
Workers logs are not queried.
- Run `./node_modules/.bin/vitest --run
components/interfaces/UnifiedLogs/UnifiedLogs.queries.test.ts
components/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts
data/workers/worker-logs-query.test.ts` from `apps/studio`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added Workers as a selectable log type in Unified Logs.
* Unified Logs now combines worker ingress, guest, and API streams under
the Workers category.
  * Added a dedicated Workers icon and worker log filtering.

* **Improvements**
  * Worker filters and URL parameters respect feature availability.
* Worker details show relevant metadata while omitting unavailable HTTP
fields.
  * Improved handling of worker log levels, statuses, and raw data.
  * Added stronger validation for unified log data.

* **Tests**
* Added coverage for worker routing, filtering, feature visibility,
parsing, and metadata redaction.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-07 15:53:36 +02:00
Alaister YoungandAlaister Young ec1029dff0 chore: migrate from clsx + tailwind-merge to shadcn-ui/cn (#49938) 
Migrates the repo off `clsx` + `tailwind-merge` to
[shadcn-ui/cn](https://github.com/shadcn-ui/cn). Every app and package
already gets `cn` from `packages/ui`, so the swap happens in that one
helper and flows through to Studio, docs, www, and the rest.

**Changed:**
- `packages/ui` `cn` helper now uses `createCn` from `cn/config`,
keeping the custom `card`/`content` spacing scale so `p-card` still
overrides `p-4`. It has an explicit signature and re-exports
`ClassValue`.
- The four www Launch Week files that imported the `ClassValue` type
from `clsx` now import it from `ui`.
- `blocks/vue` local `lib/utils.ts` re-exports `cn` from the package.
- Comments/README that referenced tailwind-merge.

**Removed:**
- Direct `clsx` and `tailwind-merge` deps from `ui`, `ui-patterns`,
`www`, and `blocks/vue`. `ui-patterns` and `www` declared them without
importing.

**Added:**
- `packages/ui/src/lib/utils/cn.test.ts` covering clsx-style joining,
conflict resolution, the custom spacing scale, and variant handling.

Not migrated: the standalone apps under `examples/`. They're outside the
workspace and mostly on Tailwind v3, which `cn` doesn't support.

Lockfile note: after merging master, the lockfile diff is only the
intended swap (`clsx` and `tailwind-merge` out, `cn@0.2.5` in).
`tailwind-merge` stays in the lockfile as a transitive dep of a
third-party package.

Release-age note: this sat in draft with a temporary
`minimumReleaseAgeExclude` entry for `cn` while `cn` was inside the
workspace's 3-day `minimumReleaseAge` window. That window has closed, so
the exclusion is gone and nothing bypasses the release-age gate.

## To test

- `pnpm install --frozen-lockfile` succeeds with no
`minimumReleaseAgeExclude` entry for `cn`.
- `pnpm --filter ui test` – new `cn.test.ts` passes, including
`cn('p-4', 'p-card')` → `p-card`.
- Typecheck passes for studio, ui, ui-patterns, vue-blocks. www
typecheck panics under tsgo on master already (pre-existing, unrelated);
it passes with the JS `tsc` binary.
- Spot-check Studio locally: class overrides still win in the usual
places (e.g. `CodeEditor` height, `Button` variants with a custom
`className`).

https://claude.ai/code/session_01MkAt16tsPRDTm9oB5Jr8Ub


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Standardized Tailwind class merging across shared UI utilities while
preserving conditional classes, custom spacing classes, and variant
behavior.
* Updated related components and examples to use the standardized
class-merging utility.

* **Tests**
* Added coverage for conditional class handling, conflicting utility
resolution, custom spacing classes, and variant separation.

* **Documentation**
* Updated usage guidance to reflect the standardized Tailwind
class-merging approach.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-09-07 21:35:06 +08:00
Francesco SansalvadoreandClaude Sonnet 5 b0601f9ab7 feat(storage): add object versioning feature flag and feature preview (#49202) 
| # | Branch | Base |
| - | ------ | ---- |
| 1 | `feat/storage-versioning-private-alpha` ◀ | `master` |
| 2 | `feat/storage-versioning/002-bucket-form-fields` | 1 |
| 3 | `feat/storage-versioning/003-bucket-modals` | 2 |
| 4 | `feat/storage-versioning/004-object-versions-data` | 3 |
| 5 | `feat/storage-versioning/005-file-preview-versions` | 4 |
| 6 | `feat/storage-versioning/006-billing-storage-retention` | 5 |

### PR 01

Adding feature flag for versioning.

- `UI_PREVIEW_STORAGE_VERSIONING` local storage key, allowlisted
- Feature preview entry gated on
`useFlag('storageVersioningPrivateAlpha')`
- `useIsStorageVersioningEnabled()`, following the existing
`useIsSqlEditorManualSaveEnabled` shape

<img width="910" height="604" alt="Screenshot 2026-08-19 at 11 33 45"
src="https://github.com/user-attachments/assets/5c51c3fa-6100-48e5-914d-63a9948a5024"
/>

Note: will improve the feature preview with an image once we approach
release.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
  - Added a Storage Versioning feature preview in the dashboard.
- Preview access is controlled by feature flags and is disabled by
default.
- Added descriptive information about Storage Versioning and its Private
Alpha availability.
- Added support for remembering the Storage Versioning preview setting.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-07 12:53:01 +02:00
Pedro Rodrigues 16046a0139 docs: add omp (oh-my-pi) to supported clients in MCP and plugin guides (#50045) 
## What this does

Adds **omp** (oh-my-pi) across the Supabase AI-tools docs.

- **Plugin docs** (`AgentPluginsPanel`) — omp client + Anthropic
marketplace install: `omp plugin marketplace add
anthropics/claude-plugins-official`, then `omp plugin install
supabase@claude-plugins-official`.
- **MCP docs** (`McpUrlBuilder`) — omp under "AI Agent CLI":
`.omp/mcp.json` / `~/.omp/agent/mcp.json` (JSON), `/mcp add` guided
setup, project vs user scope.
- **"Pick your agent" grid** — add the omp logo and tagline ("A coding
agent with the IDE wired in.").

No CLI command mapping entry — omp has no `omp mcp …` subcommand, so the
page documents file-based setup (`/mcp add` wizard or direct JSON edit).
Matches other file-configured clients like kiro.

## Testing

Verified against omp 18.1.11: written `.omp/mcp.json` parsed by runtime,
`/mcp list` shows server connected; `omp plugin marketplace add/install
supabase@claude-plugins-official` works; `omp plugin list` confirms
installed.

## Preview

### Agent Plugin page

<img width="1128" height="706" alt="image"
src="https://github.com/user-attachments/assets/1f06895b-2d45-4b64-b9ab-c1670201c370"
/>


### MCP page

<img width="1128" height="706" alt="image"
src="https://github.com/user-attachments/assets/30a9a823-0e78-4c3b-aeeb-3a6a7aa40ed6"
/>


### AI Tools main page

<img width="1128" height="706" alt="image"
src="https://github.com/user-attachments/assets/064a3234-9f4d-4f0a-9598-fbb2a465266f"
/>


Closes AI-1184

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
- Added OMP as a supported AI coding agent across documentation and
integrations.
- Added OMP installation guidance, including marketplace setup, scope
options, session reloads, and authentication.
  - Added support for configuring the Supabase MCP server through OMP.
- Added OMP branding, icon, tagline, repository, and documentation
links.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-07 11:43:00 +01:00
Coenen BenjaminandCharis Lam 11289328e5 add support for warehouse connection string (#49914) 
Add support for connection string for warehouse. 
This PR gives the ability to enable warehouse on a project and also get
the connection string to connect to.

> This project is only available in staging for now and gated behind a
feature flag

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
  - Added a Warehouse connection option to the Connect dialog.
- Select schemas and tables to replicate, with setup progress, error
recovery, and retry support.
- View copyable Warehouse connection details, credentials guidance,
command-line instructions, and DuckLake setup scripts.
  - Warehouse availability is controlled by feature configuration.

- **Tests**
- Added coverage for Warehouse table selection, setup script generation,
URL parsing, and connection configuration utilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Benjamin <5719034+bnjjj@users.noreply.github.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
 2026-09-07 11:24:42 +02:00
claude[bot]ClaudePamela Chia
 		c086fe0d3f fix(studio): stop duplicating access_token_creation_sheet_dismissed on Done (#50077) 
<!-- ccr-slack-attribution -->
_Requested by **Pam Chia** · [Slack
thread](https://supabase.slack.com/archives/C076KTY11DF/p1788743741768969?thread_ts=1788743741.768969&cid=C076KTY11DF)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix (telemetry).

## What is the current behavior?

`access_token_creation_sheet_dismissed` (added in #49965) fires on every
close of the "Generate token" sheet in `/account/tokens`, including a
successful completion. The "Token created" step closes the sheet through
a "safe" path (clicking **Done**), but `handleOpenChange` tracked the
dismissed event on that path too: a 1:1 duplicate of the already-tracked
`access_token_done_button_clicked` event, with `step: 'success'`.

The event's `tokenType` property was also never meaningful: it is
derived from a variable that is only set after a token is actually
created and never reset, so on a first-attempt abandonment it is always
`'none'` by construction, and on a later abandonment in the same session
it carries the *previous* token's type.

The sheet also force-closes when the permissions map fails to load. That
close was indistinguishable from a user abandonment.

Linear:
[GROWTH-1196](https://linear.app/supabase/issue/GROWTH-1196/fix-access-token-creation-sheet-dismissed-duplicate-on-done)

## What is the new behavior?

- The event no longer fires on **Done**. The token-created step already
blocks Escape, outside click, and Cancel, so the event now only reflects
the sheet closing before a token exists.
- Dropped `tokenType` (never described the abandoned attempt, see above)
and `step` (a constant `'form'` once Done stops firing it; it was also
typed Numeric project-wide in PostHog, so its string values read as NULL
in HogQL).
- New properties, read from the live form at close time through a small
`useImperativeHandle` ref on `NewScopedTokenForm` (`useForm` ownership
stays inside the form component):
- `resourceAccess` (`project` | `organization` | `account`): the
in-flight scope selection. `account` is the classic-token path, so this
carries what `tokenType` was meant to. It is the default `project` when
the form is untouched, so filter on `isFormTouched` before reading it as
intent.
- `formStep` (`form` | `review`): which screen the user was on. The
sheet-level `step` never captured this.
  - `isFormTouched`: whether any field was changed from its default.
- `trigger` (`user` | `permissions_load_error`): the forced close on a
failed permissions load now fires with its own trigger, so an endpoint
regression shows up in the funnel instead of silently lowering
`access_token_created`.
- Fixed a double-fire on the load-error path: the form's error effect
depended on the `onCancel` callback identity and re-ran on the sheet's
close re-render (double toast, and a double event). It now reads the
callback through a ref and depends only on `isError`, matching the
existing `isReducedMotionPreferredRef` pattern in the same file.

## Additional context

`NewScopedTokenSheet.test.tsx` asserts: Done does not emit the dismissed
event; Cancel and Escape emit it with `trigger: 'user'` and the
in-progress `resourceAccess` and `isFormTouched`; dismissing from the
review screen reports `formStep: 'review'`; a 500 from the permissions
endpoint emits exactly one event with `trigger:
'permissions_load_error'` and closes the sheet.

`step` being typed Numeric in PostHog affects every event that sends a
string `step`. That is a PostHog data-management fix handled separately,
not in this PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01XW73umv73LrrKxFwwymSaH

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com>
 2026-09-07 16:53:56 +08:00
Danny White 9f5b5ea6a7 fix(ui): standardise disclosure focus rings (#49660) 
## What kind of change does this PR introduce?

Bug fix and design-system accessibility update.

## What is the current behavior?

Accordion and collapsible triggers do not consistently use the shared
focus treatment. Accordion focus can animate from the browser outline,
while call sites need to manage radius and focus geometry themselves.

## What is the new behavior?

Bare accordion and collapsible triggers use the rounded `focus-inset`
treatment by default, positioned 2px inside the control. Interactive
children composed with `asChild`, such as a standard `Button`, retain
their own focus treatment. Accordion triggers include a small default
horizontal hit-area padding (`px-2`) and retain an explicit outer-ring
option for standalone controls. The focus indicator is not animated.

Focused tests cover the default and opt-out accordion variants.

| Before | After |
| --- | --- |
| <img width="1792" height="384" alt="CleanShot 2026-09-07 at 15 40
23@2x"
src="https://github.com/user-attachments/assets/8c8fd99a-3669-465a-a7b2-d272ec92dec7"
/> | <img width="1784" height="498" alt="CleanShot 2026-09-07 at 15 39
52@2x"
src="https://github.com/user-attachments/assets/7a0b7de1-a4bc-48cf-b9fc-3421618806b9"
/> |
| <img width="1564" height="360" alt="CleanShot 2026-09-07 at 15 35
11@2x"
src="https://github.com/user-attachments/assets/34945180-e671-4dc2-981a-4c683d08f221"
/> | <img width="1552" height="378" alt="CleanShot 2026-09-07 at 15 36
19@2x"
src="https://github.com/user-attachments/assets/09f2c030-9ffb-4fa5-bf63-5e172326e8ef"
/> |

## Visual impact

Most call sites should look the same at rest. The exceptions are
accordion triggers that did not already set their own horizontal
padding: they pick up the new default `px-2`, `rounded-md`, and lose the
old blanket `transition-all` on the trigger (chevron rotation is
unchanged).

| Resting layout change | Why |
| --- | --- |
| Accordion triggers without an explicit `px-*` | Inherit new default
`px-2` and `rounded-md` |
| Accordion triggers with their own `px-*` | Unchanged (call-site
padding wins) |
| Collapsible triggers | Focus ring only; spacing comes from the child
element |
| Direct `focus-inset` users (table rows, etc.) | Focus ring only |

## To test

Use Tab to focus each disclosure trigger. Confirm the focus outline is
rounded, sits 2px inside the trigger, and appears immediately without a
dark flash.

Previews:
[design-system](https://design-system-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app)
·
[studio-staging](https://studio-staging-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app)
·
[docs](https://docs-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app)
·
[www](https://zone-www-dot-com-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app)

### Design system

-
[Accordion](https://design-system-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/design-system/docs/components/accordion)
-
[Collapsible](https://design-system-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/design-system/docs/components/collapsible)

### Studio (focus-only unless noted)

- [Account → Access tokens → **New
token**](https://studio-staging-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/dashboard/account/tokens):
permission category accordions (already `px-4`)
- [Database →
Roles](https://studio-staging-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/dashboard/project/_/database/roles):
role row collapsibles
- [Observability → Query
performance](https://studio-staging-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/dashboard/project/_/observability/query-performance):
index suggestion accordions (already `px-4`)
- [Settings → JWT
(legacy)](https://studio-staging-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/dashboard/project/_/settings/jwt/legacy):
migration help collapsible

### Docs

- Docs mobile nav (narrow viewport): accordion sections **(resting
layout: +px-2)**

### WWW

- [Pricing →
FAQs](https://zone-www-dot-com-git-dnywh-fixaccordion-focus-rings-supabase.vercel.app/pricing):
FAQ accordions **(resting layout: +px-2)**
- WWW mobile nav (narrow viewport): menu accordions **(resting layout:
+px-2)**

### Not worth opening manually

Sheets, modals, error fallbacks, and replication/cron/integration
advanced-settings accordions inherit the focus fix but need specific
flows or failure states to reach. Error-state troubleshooting accordions
(`TroubleshootingSections`) also gain **+px-2** when visible.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## New Features
- Accordion triggers now use an inset focus style by default, with an
option to use the standard ring style.
- Accordion and collapsible trigger styling can be customized more
flexibly.

## Accessibility
- Focus indicators appear consistently without flashing browser
defaults.
- Focus transitions are limited to visual properties that preserve
immediate keyboard focus visibility.

## Documentation
- Updated accessibility guidance explains inset focus behavior and
transition considerations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-07 16:59:40 +10:00
Saxon FletcherandCursor 04747937a2 fix(ui-patterns): align badges and input in the tiny multi-select trigger (#49986) 
## What's changed

**Before**
<img width="467" height="353" alt="image"
src="https://github.com/user-attachments/assets/4587d51a-8bbe-4da4-a3dd-dcaac6b17993"
/>

**After**
<img width="541" height="360" alt="image"
src="https://github.com/user-attachments/assets/de66b229-54b0-4443-9c49-6f2ff0dd93aa"
/>

Independent of the Explorer/assistant stack.

`MultiSelectorTrigger` with `size="tiny"` had badges and the inline
input overflowing the 26px control. The trigger now stretches its
children (`items-stretch`), badges are `h-full py-0 leading-none` with a
tighter `gap-0.5`, the input/label drop their extra padding and
line-height, and the chevron self-centers. Other sizes are unchanged
(`isTiny` guards every new class). Also drops a redundant `text-sm` from
`MultiSelectorInput`, which `MultiSelectorInputVariants` already sets
per size.

## How to test

1. Design system (`pnpm dev:design-system`) or anywhere Studio uses
`<MultiSelector size="tiny">` (e.g. Logs filters): with 1–3 values
selected the badges sit inside the 26px control with no clipping; the
placeholder and chevron are vertically centered.
2. `size="small"` / default still look the same as on `master`.
3. `pnpm --filter ui-patterns exec vitest --run src/multi-select`
passes.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Style**
- Improved the compact multi-select control layout, including spacing,
alignment, selected-value badges, input sizing, and dropdown indicator
positioning.
- Adjusted placeholder spacing when the tiny control has no selected
values.

- **Tests**
- Updated coverage to verify compact spacing and sizing when the tiny
multi-select control displays a selected value.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-07 09:48:01 +10:00
Ivan Vasilov c6cdf4bd53 Migrate off contentlayer2 to Velite (design-system, ui-library, learn) (#48546) 
## Summary
- `contentlayer2@0.4.6` is unmaintained and drags in a heavy, stale
dependency graph (esbuild pinned to 0.17–0.20, mdx-bundler, old
`@opentelemetry/core`) that was the recurring source of vuln bumps.
- Migrates all three apps that used it — `design-system`, `ui-library`,
`learn` — to [Velite](https://velite.js.org), preserving the generated
typed `allDocs`/`Doc` collection and the `body.code` + `useMDXComponent`
runtime via a small shared local hook.
- Same MDX pipeline (remark-gfm, remark-code-import, rehype-slug,
rehype-pretty-code w/ Shiki compat + local theme,
rehype-autolink-headings, custom
`__rawString__`/`__src__`/`__event__`/`__style__` visitors) ported 1:1
into each app's `velite.config.js`.
- `learn`'s extra frontmatter fields (`chapterNumber`, `explore`,
`courseHero`) are now backed by real Velite/Zod schema types, so the
`(doc as any)` casts in `get-next-page.ts` / `get-current-chapter.ts` /
the doc page could be dropped.
- `next.config.mjs` no longer wraps with `withContentlayer`; since
Velite has no Next.js webpack-plugin equivalent, each app's `dev` script
now runs `velite dev` and `next dev` in parallel via `npm-run-all`.

Ref:
[FE-3861](https://linear.app/supabase/issue/FE-3861/migrate-off-contentlayer2-learn-ui-library-design-system-to-shed)

## Test plan
- [x] `pnpm build:content` (Velite build) succeeds for all three apps
- [x] `pnpm typecheck` passes for all three apps
- [ ] Manual smoke test of `pnpm dev` for each app in a browser (docs
pages render, TOC, copy-button, code highlighting)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Improvements**
* Improved content generation across documentation, learning materials,
and the UI library for more consistent pages.
* Preserved MDX rendering, navigation, table of contents, course
metadata, source previews, and component examples.
* Improved consistency when displaying documentation and interactive
examples.
* Improved application loading by optimizing how interface components
are delivered.
* **Chores**
* Streamlined content compilation and development workflows across the
design system, learning area, and UI library.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-04 15:49:44 +02:00
kemal.earthandGildas Garcia 8654991847 feat(studio): additional events for scoped pat telemetry (#49965) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Adds PostHog tracking to the final step of the scoped PAT creation flow,
after `access_token_created` fires. The token value is only ever shown
once, so this measures whether users actually leave with a usable token.

Three new events on the "Token created" step:

| Event | Properties |
| --- | --- |
| `access_token_copied` | `tokenType` |
| `access_token_stored_checkbox_clicked` | `tokenType`, `isChecked` |
| `access_token_done_button_clicked` | `tokenType`, `hasCopiedToken` |

- `isChecked` is the resulting state, so unticking the acknowledgement
is captured too.
- `hasCopiedToken` records whether the Copy button was used before
finishing. Done is gated on the checkbox, not on copying, so this
separates "copied it" from "ticked the box and left."
- `tokenType` is threaded through from the sheet, which creates a
classic token when resource access is `account` and a scoped one
otherwise. It matches the existing `access_token_created` /
`access_token_removed` property.

## Changes

- `packages/common/telemetry-constants.ts` — three event interfaces,
added to the
`TelemetryEvent` union
- `NewScopedTokenSuccess.tsx` — `useTrack()` plus a new `tokenType`
prop;
copy/acknowledge/done routed
- `NewScopedTokenSheet.tsx` — `createdToken` state now holds `{ token,
tokenType }` so
the success step knows which
- `NewScopedTokenSheet.test.tsx` — extended the two tests that already
walk the full
success flow with assertions  and classic paths)

## Testing

`pnpm test:studio` on `NewSco16 passing. Typecheck clean.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Analytics**
* Added tracking for key access-token creation interactions, including
copying tokens, selecting storage options, and completing the flow.
* Tracking distinguishes between classic and scoped access tokens and
records whether a token was copied before completion.
* Added tracking when the access-token creation sheet is dismissed,
including the current step.

* **Behavior**
* Existing copy, storage-selection, notification, and completion actions
continue to work as expected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Gildas Garcia <1122076+djhi@users.noreply.github.com>
 2026-09-04 11:15:18 +02:00
Anthony Lio e25c0e83df fix(docs): table bottom border color missing (#49955) 
## What kind of change does this PR introduce?

bug fix on table ui in docs

## What is the current behavior?

currently a recent change in
[#47288](https://github.com/supabase/supabase/pull/47288/changes#diff-57e15cf799459c10344c86d8ec797a16f0d3e824386e85552cb653594f7e616aR118)
made table bottom border color dimmed down vs others.

## What is the new behavior?

- fixes bottom border by targeting only border within the table (if that
was the initial intent?)

| state | preview |
| -------|------|
| before | <img width="787" height="320" alt="image"
src="https://github.com/user-attachments/assets/70eac743-255d-4848-9488-752e91a8793e"
/> |
| after | <img width="787" height="320" alt="image"
src="https://github.com/user-attachments/assets/e307dc33-6247-4f36-89d0-75d1eb1aef4e"
/> |

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Style**
* Refined table styling so bottom borders appear only between body rows,
removing the border from the final row.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-04 07:57:32 +03:00
Saxon FletcherandCursor ad33b16f8c feat(studio): show health advisors on the project home (#49661) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature

## Summary

- Add a `useProjectHealthLintsQuery` that runs the live health checks
(database down, unreachable, connection limit, service error rate,
infrastructure alerts)
- Surface those results on the project home advisor row alongside
security and performance errors
- Register health lint metadata (titles, docs links, entity icon) so
homepage cards can render them

Bottom of the stack. The advisor sidebar still uses tabs; health items
show under All until #49662.

## To test

1. Open any project home in Studio.
2. Find the Advisor row (the cards under “Advisor found N issues”).
3. If the project has a real health problem, you should see a **HEALTH**
card (for example “Database process is down” or “Database connection
limit reached”), not only SECURITY / PERFORMANCE.
4. If the project is healthy, you should **not** see a HEALTH card.
Existing security and performance cards should still appear as before.
5. Click a HEALTH card (or any advisor card). Advisor Center should open
on that item.
6. In Advisor Center on this PR, health items only show under the
**All** tab — Health is not its own tab yet.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added a Health category to Advisor, with a dedicated tab and activity
icon.
- Added health checks for database availability, connection limits,
service errors, and infrastructure alerts.
- Health issues now appear alongside security and performance
recommendations with relevant troubleshooting links.

- **Bug Fixes**
- Health-related advisor findings are now correctly categorized and
displayed.

- **Tests**
- Added coverage for health checks, categorization, filtering, and
project health query behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-09-03 11:05:14 +02:00
Piyush Yadav b8d28b36d9 fix(ui-patterns): prevent duplicate horizontal scrollbar in MultipleCodeBlock (#49940) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

Fixes #49903

In `ConnectSheet` (e.g., Next.js -> Step 2 "Add files"), multi-file
instructions render using `MultipleCodeBlock`.
The `TabsContent` container in
`packages/ui-patterns/src/MultipleCodeBlock/index.tsx` was styled with
`className="... overflow-scroll ..."`.
The CSS property `overflow-scroll` forces both horizontal and vertical
scrollbar tracks to be rendered regardless of whether horizontal content
overflows.
Because the child `<CodeBlock>` already manages its own horizontal
overflow (`overflow-auto`) and fills the container width, `TabsContent`
displayed a frozen/disabled horizontal scrollbar at the top level. When
scrolling down vertically to the bottom of the code snippet,
`<CodeBlock>`'s real horizontal scrollbar came into view, resulting in
inconsistent and duplicate scrollbars.

## What is the new behavior?

- Replaced `overflow-scroll` with `overflow-y-auto` on `TabsContent` in
`MultipleCodeBlock`.
- `TabsContent` cleanly scrolls vertically when content height exceeds
`max-h-72`.
- Eliminates the duplicate/disabled top-level horizontal scrollbar.
- Horizontal code scrolling is cleanly delegated to `<CodeBlock>` only
when lines exceed the available width.
- Added a unit test in
`packages/ui-patterns/src/MultipleCodeBlock/index.test.tsx` verifying
`TabsContent` applies `overflow-y-auto` rather than `overflow-scroll`.

## Additional context

Verified locally:
- `vitest run src/MultipleCodeBlock/index.test.tsx` (all tests passing)
- `tsc --noEmit` in `packages/ui-patterns` (0 type errors)
- `prettier --check` against modified files (passed)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
  * Improved code block scrolling to use vertical scrolling only.
* Prevented unnecessary horizontal scrollbars in multi-file code
examples.
  * Added coverage to verify the updated scrolling behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-03 16:29:36 +10:00
Saxon Fletcher 4ee43f3585 chore(studio): refine Explorer query UI (#49895) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

UI refinements for Explorer query surfaces.

## What is the current behavior?

- The assistant chat textarea uses a tighter radius than the Run SQL /
Create a notebook cards on Explorer home.
- Chart results sit unevenly in the results pane because axis gutters
stack on card padding, and long Y labels can clip.
- Selecting SQL in the editor changes the primary Run button to Run
selected, which is easy to trigger by accident.
- The Prettify SQL icon in notebook query cells uses Lucide's default
size, so it doesn't match other toolbar actions.

## What is the new behavior?

- Assistant chat form uses `rounded-lg` so it matches the home action
cards everywhere the form is used.
- Query result charts collapse unused axis space, add a little padding
when labels are on, and size the Y axis from formatted ticks so longer
labels fit.
- Run is a default split button that always executes the full query. Run
selected is a secondary menu item, disabled until SQL is selected.
- Notebook cell Prettify SQL icons use `size={16}` and `strokeWidth={2}`
like the rest of the Explorer toolbar.

## Additional context

Cmd+Enter in the editor still runs the current selection when there is
one.

## Test plan

- [ ] Open Explorer home and confirm the assistant chat radius matches
the Run SQL and Create a notebook cards.
- [ ] Run a query, switch to chart view, and check spacing with labels
off and on, including large Y values.
- [ ] With no selection, click Run and confirm the full query runs. Open
the split menu and confirm Run selected is disabled.
- [ ] Select SQL, click Run, and confirm the full query still runs. Use
Run selected from the menu to run only the selection.
- [ ] In a notebook query cell, confirm Prettify SQL matches the size
and stroke of nearby toolbar icons.


Made with [Cursor](https://cursor.com)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
- Added a split Run control in the query editor, with separate actions
for running all content or only selected text.
  - Added support for customizing chart X-axis display settings.
- Improved chart Y-axis sizing, scaling, and tick formatting for clearer
results.

- **Bug Fixes**
  - The “Run selected” action is unavailable when no text is selected.

- **Style**
- Updated toolbar icon sizing and added rounded corners to the assistant
chat input.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-03 09:44:45 +10:00
Charis 9aaa753306 feat(studio): add telemetry for explorer/sql editor temporary switch buttons (#49898) 
## Summary

Add PostHog event tracking for the two new buttons introduced in PR
supabase/supabase#49698 that allow users to temporarily switch between
the Explorer and SQL Editor:

* **Explorer button**: "Back to SQL Editor" button in the Explorer
sidebar title bar now fires `explorer_temp_access_sql_editor_clicked`
event
* **SQL Editor button**: "Back to Explorer" button in the SQL Editor
title bar (shown during temporary visits) now fires
`sql_editor_back_explorer_clicked` event

Both event interfaces follow the repo's telemetry-standards conventions,
carrying only `groups: TelemetryGroups` property with no additional
custom properties.

## Test plan

- [X] Verify `explorer_temp_access_sql_editor_clicked` event fires in
PostHog when clicking "Back to SQL Editor" button in Explorer
- [X] Verify `sql_editor_back_explorer_clicked` event fires in PostHog
when clicking "Back to Explorer" button in SQL Editor
- [X] Run typecheck: `pnpm typecheck` passes without errors
- [X] Run lint: `pnpm lint --filter=studio` passes

## Issue

Resolves
[FE-4213](https://linear.app/supabase/issue/FE-4213/explorer-set-up-telemetry-for-metrics-where-appropriate)

## Summary by CodeRabbit

* **Analytics**
  * Added tracking for navigation from the Explorer to the SQL Editor.
  * Added tracking for returning from the SQL Editor to the Explorer.
 2026-09-02 09:07:06 -04:00
Pamela Chia 5db8a0e960 feat(studio): instrument sign-in attempts and failures (#49853) 
The /sign-in page emitted only a pageview on entry and the success-side
`sign_in` event on exit: failed or abandoned attempts were invisible, so
"never interacted" and "tried and failed silently" could not be told
apart in the sign-in funnel. I added an unsampled `sign_in_submitted`
event at every initiation point and classified failure capture via
`dashboard_error_created` with a new `signin` origin.

**Changed:**
- **Submit attempts observable**: `sign_in_submitted` (method: `email`,
provider id, `sso`, or partner) fires from the DOM submit handler on the
password and SSO forms (so submits that fail client-side validation
still count), and from the OAuth, custom-provider, and partner
initiation handlers.
- **Failures classified**: each sign-in error path feeds the existing
funnel-error pipe with origin `signin` and a controlled reason slug
(`invalid_credentials`, `email_not_confirmed`, `captcha_failed`,
`sso_provider_not_found`, ...). GoTrue auth errors now classify via
their numeric `status`, guarded so transport failures (`status: 0`) stay
`network_error`.
- **Attempt events survive the OAuth redirect**: the telemetry event
POST sends with `keepalive` (scoped to `sign_in_submitted`, since
keepalive requests share a per-page in-flight body quota), so a
dispatched request is no longer aborted by the provider navigation; send
rejections are caught centrally instead of surfacing as unhandled
rejections. The fetch still dispatches after an async token lookup, so
preview testing verifies the GitHub-path event actually lands on the
wire.
- **Captcha rejection is no longer silent**: a rejected hCaptcha
challenge resolves the stuck loading toast with an error message, emits
`captcha_challenge_failed` (distinct from `captcha_failed`, which stays
reserved for the auth server rejecting a submitted token), reports to
error monitoring, and resets the captcha widget (previously: unhandled
promise rejection and a spinner that never resolved).
- **Partner method validated**: the partner sign-in page resolves the
URL-hash value against the provider registry and forwards the canonical
provider id into `method` on both `sign_in_submitted` and `sign_in`;
anything unregistered records as `unregistered_partner`, so a crafted
link can't poison the breakdown on either event.

**Note:** failure events stay on the shared 10%
`dashboard_error_created` sampling rate (a per-origin carve-out would
break cross-source volume comparability); the unsampled attempt event
carries the tried-vs-never-interacted signal at full volume.

## To test

Tested on Vercel preview (studio-staging, wire-level network capture +
staging ingestion check):
- [x] On `/sign-in`, submit a bogus email + password: expect a `POST
*/platform/telemetry/event` request with `action: sign_in_submitted`,
`method: email` in the network tab, plus an error toast. Observed: 201,
auth returned 400 as expected.
- [x] Submit with an empty password: expect `sign_in_submitted` to still
fire (validation failures count as attempts). Observed: event fired with
201 and no auth call followed.
- [x] Click "Continue with GitHub": expect `sign_in_submitted` with
`method: github` on the wire before the provider redirect. Observed: the
POST completed (201) before the browser landed on github.com, so the
keepalive path holds.
- [x] Negative case: fresh page load with no interaction fires no
`sign_in_submitted`.
- [x] Ingestion: all fired events (methods `email`, `github`, plus
organic `sso` submits from a real login on the same preview) arrived in
the staging project with the expected properties.
- [x] Re-ran the email and GitHub paths on the scoped-keepalive build
(`129bf8d`): both `sign_in_submitted` POSTs returned 201 (the GitHub one
completed despite the provider redirect), and both events ingested into
the staging project with the expected `method`/`category` properties.

## Linear
- GROWTH-1165 (no `fixes` keyword on purpose: the evidence checks run on
prod data post-deploy, and the issue closes manually after they pass)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Improved sign-in protection with more reliable invisible CAPTCHA
handling.
* Added sign-in submission tracking across password, SSO, partner,
custom OAuth, and external-provider flows.
* Added detailed classification for authentication, validation, CAPTCHA,
provider, and network errors.

* **Bug Fixes**
  * Sign-in now stops safely and resets CAPTCHA when verification fails.
* Improved error reporting for failed sign-in attempts, including
redirects and OAuth flows.
* Ensured sign-in telemetry is delivered reliably during OAuth
redirects.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-02 19:02:37 +08:00
Danny White 924b3f5793 feat(ui-patterns): add async selection feedback (#49843) 
## What kind of change does this PR introduce?

Shared UI pattern and Studio UX improvement.

## What is the current behavior?

Async selectors use bespoke loading and error layouts. Some replace the
entire field while fetching, and opening a selector does not
consistently refresh its options.

## What is the new behavior?

Adds shared loading, error, and empty states for Select, command, and
MultiSelector lists, including a persistent polite live region and
reduced-motion support. Analytics Bucket and DuckLake selectors keep
their controls in place, retain populated options during background
refreshes, and refresh when reopened.

## To test

Open the [Replication
preview](https://studio-staging-git-dnywh-featasync-selection-feedback-supabase.vercel.app/dashboard/project/_/database/replication?destinationType=Analytics%20Bucket).
The destination sheet should already be open on **Analytics Bucket**.

You do not need to create a bucket, configure a destination, or start a
pipeline. Open **Select a bucket**, then review these outcomes:

1. **The trigger stays put.** Opening the picker must not replace the
form field with a full-width loading placeholder.
2. **Loading belongs inside the menu.** While options are fetched, the
open menu shows a compact skeleton list.
3. **No resources has a clear explanation.** If the project has no
Analytics Buckets, the menu says **No buckets available**. It still
offers **Create a new bucket** beneath that message.
4. **Existing options do not disappear on refresh.** If the project does
have buckets, close and reopen the picker. Its current options remain
visible while the refresh happens in the background, rather than
flashing back to skeletons.
5. **The pattern is consistent.** If convenient, select a bucket and
open the namespace or access-key picker. The same in-menu loading,
empty, and error treatment applies there too.

The deterministic request-error and reduced-motion cases are covered by
focused unit tests because the deploy preview cannot reliably force
those states.
 2026-09-02 14:25:03 +10:00
Pamela Chia 3338be76f0 fix(studio): emit sign_in on totp challenge (#49755) 
The dashboard's `sign_in` event never fires when a user completes a TOTP
challenge: `SignInForm` only tracks when no MFA challenge is needed, and
the /sign-in-mfa page only tracks on mount when the assurance level is
already satisfied (OAuth/SSO returns). Sign-ins that go through the
actual MFA form were invisible to analytics, and the login audit event
was missing on the same path.

**Changed:**
- **MFA-challenged sign-ins now tracked**: `SignInMfaForm` fires
`sign_in` (reading the same `method` query param the page mount site
reads) plus the login audit event on successful TOTP verification, in
the sign-in context only. The forgot-password flow stays untracked: it
is a reset, not a sign-in.
- **Password+MFA sign-ins report `method: email`**: `SignInForm` now
passes `?method=email` when routing to /sign-in-mfa instead of falling
through to `unknown`.
- **Partner TOTP sign-ins carry their provider**: `SignInPartner` now
passes `?method=<partner>` when routing to /sign-in-mfa, matching the
raw-provider-name convention the other entry points use.
- **Join caveat documented**: the `SignInEvent` doc comment now notes
the event is captured server-side and races the identify call, so it is
not a valid funnel join key across the auth boundary.

## Linear
- fixes GROWTH-1156


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added sign-in method details to MFA redirects for email and partner
authentication, improving sign-in flow tracking.
* Added telemetry and login auditing for successful MFA sign-ins while
keeping forgot-password flows untracked.
* **Documentation**
* Clarified sign-in event tracking coverage, including OAuth providers,
server-side capture, anonymous identifiers, and the sign-in page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-01 13:26:08 +00:00
Charis 4b1f93bb99 feat(explorer): add path back to SQL Editor for snippet access (#49698) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature

## What is the current behavior?

Users who have opted into the Explorer feature preview have no way back
to the SQL Editor from within Explorer, so they can't easily check their
old snippets.

## What is the new behavior?

- The Explorer sidebar title bar now has a button (using the same icon
as the SQL Editor/Explorer nav entry) that links to the SQL Editor, with
a tooltip explaining it's a temporary switch to access snippets.
- Clicking it marks the visit as temporary in localStorage, which
surfaces a matching "Back to Explorer" button in the SQL Editor title
bar. Clicking that button clears the temporary flag and returns to
Explorer.
- Fixed the product menu title bar badge slot to sit flush right instead
of directly next to the title text.

## Additional context

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added a quick switch from the Explorer to the project’s SQL Editor.
* Added a “Back to Explorer” option in the SQL Editor when opened from
Explorer.
  * Added tooltips to clarify these navigation actions.
* Navigation state is preserved per project for a smoother return
experience.

* **UI Improvements**
* Improved product menu spacing and title truncation for better layout
handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-01 09:07:54 -04:00
Utkarash Kumar Singh 0c8dc73bf4 feat(upgrade): surface btree_gist NaN reindex warning (#49684) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature — studio counterpart of supabase/platform#37696 (PG 15.19/17.11
release, PSQL-1247).

## What is the current behavior?

The pre-upgrade warnings panel handles `ltree_reindex_required` and
`operator_estimator_gate` only.

## What is the new behavior?

Adds the `btree_gist_nan_reindex` warning (title, description, docs
link) emitted by the eligibility endpoint when a project has btree_gist
indexes on float columns and the upgrade crosses the 15.19/17.11
NaN-handling fix. Non-blocking, same pattern as #47003. `api-v1.d.ts`
union extended to match the platform spec.

## Additional context

Docs anchor targets the section added in #49621 — merge that first (or
together). Refs PSQL-1247.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added an upgrade warning for the `btree_gist_nan_reindex` requirement.
* Included a description and link to relevant documentation for
guidance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-01 14:42:06 +02:00
Wen Bo Xie 2681a21f5c docs: add Personal Access Tokens guide with generated permission tables (#49732) 
Add a guide that compares classic and scoped personal access tokens,
explains how account roles constrain token permissions, and walks
through creating and testing a project-scoped token. Include generated
tables mapping permissions to Management API endpoints and MCP tools,
and link the guide from docs navigation and Studio token sheets.

Move the scoped-token permission catalog from Studio into shared-data.
Studio and docs generation now share permission names, categories,
descriptions, risk metadata, modes, scopes, and display order.

Generate the tables from the shared catalog, OpenAPI
x-fga-permissions, and the downloaded MCP permission map. Exclude
Workers permissions until the feature is live.

Run regeneration through the docs Makefile, verify checked-in output in
CI, and refresh it in the weekly Management API workflow. Add Dashboard
and Docs ownership plus contributor guidance so permission changes stay
synchronized.
 2026-09-01 12:30:56 +00:00
Ivan Vasilov 02cf09212e chore: Remove tsconfig paths (#49770) 
This PR removes all `paths` in `tsconfig.json` for all apps and
packages. They were added previosly because some of the components had a
`_Shadcn` suffix because of an ongoing migration. How that the migration
is done, the paths can be removed.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Refactor**
* Standardized shared UI component, utility, and icon imports across
design-system examples and application screens.
  * Simplified shared component access and project configuration.
  * Added shared access to anchor-link helpers and animation styles.

* **Compatibility**
* Updated component exports and imports without changing existing
behavior.
  * No changes to user-facing workflows, screens, or functionality.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-01 13:13:30 +02:00
Gildas Garcia 6cb08304d9 Fix: RadioGroupCard accessibility issues (#48527) 
## Problem

The `<RadioGroupCard>` component has an accessibility issue: duplicate
ids on the items.
Besides, its usage in the Design System app has additional issue: no
label on the group itself when used outside a react-hook-form.
Finally, the form example wrap each item in a `FormField` and
`FormControl` which is unnecessary and causes another accessibility
issue as all items are then injected the same `id` prop.

## Solution

- Fix the duplicate ids issue
- Fix all design system example
- Fix the only wrong usage we have in studio

No visual changes

## Notes

When used outside a form, I added aria-label attributes on the group and
they are announced by Mac Voice Over.
However, when used in a form, our components adds a label with the
correct for attribute but it seems that Mac Voice Over does not announce
it.

Not sure about how this should be handled.

## How to test

On
https://design-system-git-fix-radio-group-card-a11y-supabase.vercel.app/design-system/docs/components/radio-group-card,
with Voice Over enabled:
- tab to the first radio group, it should announce the value and the
label of group itself, _Size_
- tab to the second, same but label is _Theme_

On
https://design-system-git-fix-radio-group-card-a11y-supabase.vercel.app/design-system/docs/components/radio-group-card#form
(Form example):
- select any option and submit
- check the correct option is submitted

On
https://studio-staging-git-fix-radio-group-card-a11y-supabase.vercel.app:
- Go to your organization settings, Audit Log Drains, open your devtool
network tab
- Create a new custom endpoint and select the HTTP version
- Check in the network tab that the correct http version is passed

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Accessibility**
* Improved labeling for radio card groups, including size, spacing,
theme, and webhook version selections.
* Radio options now use stable or automatically generated identifiers
with reliable label associations.

* **Bug Fixes**
* Simplified radio option structure in forms for more consistent
behavior.
* Improved ID handling across radio card, stacked, and large radio
options.
* Updated the themed radio card example to use the dark theme by
default.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-31 16:14:09 +02:00
Mert YEREKAPANandkemal d11705ded0 feat(studio): add plan-change panel presentation experiment (#49534) 
## What

A/B test for the plan-change side panel
(`/org/_/billing?panel=subscriptionPlan`) — gated behind PostHog flag
`pricingPanelPlanPresentation` (multivariate, 3 arms).

The current panel drops `description`, `preface`, and `footer` from
`shared-data/plans.ts` and uses a much smaller type scale than the www
pricing page, so the two surfaces look unrelated and plan differences
are hard to reason about. This experiment tests whether matching the www
style and surfacing plan gaps improves upgrade conversion.

| Variant | Surface |
| --- | --- |
| `control` | Current panel — no change (baseline cohort, still tracked)
|
| `parity` | www pricing page style: mono uppercase heading,
description, CTA above price, large mono price, preface ("Everything in
the Free Plan, plus:"), 13px features |
| `gaps` | `parity` + gap rows at the bottom showing what the plan is
missing (✗ Daily backups, ✗ Email support, dimmed ✓ 1-day log retention)
|

## Variants

Control
<img width="3520" height="2394" alt="Arc 2026-08-26 16 14 09"
src="https://github.com/user-attachments/assets/95464e83-b377-4754-85ee-c65dce0206c7"
/>

Parity
<img width="3520" height="2394" alt="Arc 2026-08-26 16 14 01"
src="https://github.com/user-attachments/assets/f50e66e2-7cbe-4e65-b1fb-083efd79ff00"
/>

Gaps
<img width="3520" height="2394" alt="Arc 2026-08-26 16 29 48"
src="https://github.com/user-attachments/assets/fbb08a12-1b76-4ce5-9247-20a6e8399be3"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a refreshed subscription plan selector with pricing,
descriptions, features, exclusions, and plan-specific messaging.
* Added upgrade and downgrade actions with loading states and
eligibility-based controls.
* Added plan comparison views highlighting missing and lower-tier
features.
* Added tailored handling for enterprise plans and supported billing
arrangements.
* Improved accessibility by respecting reduced-motion preferences during
plan highlights.

* **Tests**
* Expanded coverage for plan eligibility, feature comparisons, and
presentation variants.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: kemal <hello@kemal.earth>
 2026-08-31 11:53:16 +02:00
Gildas Garcia 4f92790587 fix: FormItemLayout does not apply item id correctly (#49637) 
## Problem

`<FormItemLayout>` does not apply item id correctly. This can be seen on
https://supabase.com/design-system/docs/ui-patterns/forms: open the
devtool and check the form items labels. They have no `for` attribute.
This makes it harder to correctly test and is an accessibility issue.

Axe devtool actually report it

## Solution

When inside React Hook Form, `<FormItemLayout>` actually generate an
`id` (via `<FormItem>`). However, this `id` is overridden in
`<FormLayout>` and read from context by `<FormLabel>`. Ensure we use the
generated id unless one was provided.

Also updated the paths filters for the CI check so that any changes in
either `ui` or `ui-patterns` triggers the studio unit and e2e tests.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved form accessibility by ensuring labels consistently connect to
their corresponding input fields.
- React-based forms now correctly preserve field-specific identifiers
when associating labels with inputs.
- Added support for explicitly specifying a label’s input target,
improving compatibility with customized form layouts.
- Updated Studio forms to use consistent control identifiers and
labeling behavior.

- **Quality Improvements**
- Automated validation now also runs when shared UI components and
patterns are updated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-31 10:32:45 +02:00
claude[bot]ClaudePamela Chia
 		5b01b5a9c7 fix(studio): report advisorCategory consistently across advisor telemetry surfaces (#49746) 
<!-- ccr-slack-attribution -->
_Requested by **Pam Chia** · [Slack
thread](https://supabase.slack.com/archives/C076KTY11DF/p1788139328573799?thread_ts=1788139328.573799&cid=C076KTY11DF)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix (telemetry correctness). No user-visible change.

## What is the current behavior?

Linear:
[GROWTH-1153](https://linear.app/supabase/issue/GROWTH-1153/telemetry-advisorcategory-omitted-for-health-lints-on-two-of-five)

**Before:** five surfaces emit the optional `advisorCategory` property
on `advisor_detail_opened` and `advisor_assistant_button_clicked`, and
they disagree about how to derive it. Three pass the lint's category
straight through as `categories[0]`. Two compute it with a hardcoded
ladder — `categories.includes('SECURITY') ? 'SECURITY' :
categories.includes('PERFORMANCE') ? 'PERFORMANCE' : undefined` — which
predates the `HEALTH` category and falls through to `undefined` for
anything it does not name. Because the property is optional, those two
surfaces ship the event with `advisorCategory` silently absent: no type
error, no runtime error, just a hole in the data. A reader querying a
category breakdown of either event gets numbers that depend on which
surface the user happened to click, and `HEALTH` is under-counted. The
split is clearest in `AdvisorSection.tsx`, where a single advisor card
emits both events — the card click through the ladder (L83) and the
Assistant button through the pass-through (L206) — so one card can
report two different categories for the same lint.

The cause is that `AdvisorCategory` in
`packages/common/telemetry-constants.ts` is schema-derived:

```ts
type AdvisorCategory =
  components['schemas']['GetProjectLintsResponse'][number]['categories'][number]
```

The API-types regeneration in supabase/supabase #49646 (merged
2026-08-27, `26e89b36c349893540f8efbd45613921be0a4d18`) widened
`categories` from `('PERFORMANCE' | 'SECURITY')[]` to `('PERFORMANCE' |
'SECURITY' | 'HEALTH')[]`. `AdvisorCategory` picked up the third value
incidentally and the two ladders were never updated — a union widening
is invisible to a hardcoded ladder, so nothing broke loudly.

| Event | Surface | HEALTH behavior before |
| --- | --- | --- |
| `advisor_detail_opened` |
`apps/studio/components/ui/AdvisorPanel/AdvisorPanel.tsx` (L203) |
ladder → property absent |
| `advisor_detail_opened` |
`apps/studio/components/interfaces/ProjectHome/AdvisorSection.tsx` (L83)
| ladder → property absent |
| `advisor_detail_opened` |
`apps/studio/components/interfaces/Linter/LinterDataGrid.tsx` (L163) |
pass-through → `'HEALTH'` |
| `advisor_assistant_button_clicked` |
`apps/studio/components/interfaces/Linter/LintDetail.tsx` (L38) |
pass-through → `'HEALTH'` |
| `advisor_assistant_button_clicked` |
`apps/studio/components/interfaces/ProjectHome/AdvisorSection.tsx`
(L206) | pass-through → `'HEALTH'` |

The two `advisorCategory` property doc comments in
`telemetry-constants.ts` (L2949, L2980) also still read "Category of the
advisor (SECURITY or PERFORMANCE)", which the widening made false.

## What is the new behavior?

**After:** all five surfaces derive `advisorCategory` the same way, so a
category breakdown of these two events is consistent regardless of which
surface produced the event, and `HEALTH` is reported wherever it can
occur. The two ladder sites now read `item.original.categories[0]`,
matching the three sites that already did. The `signal` branch (which
reports `'SECURITY'`) and the `notification` branch (`undefined`) of
those two expressions are unchanged, so nothing about non-lint advisor
items moves. The stale parenthetical is cut from both doc comments.

Net diff is 3 files, -12/+4 lines. No behavior change outside the value
of one optional telemetry property.

## Additional context

**How.** The fix is the pass-through, not an extended ladder. Per the
two options considered:

1. **No lint carries more than one category in practice.** Every lint
fixture in `apps/studio` uses a single-element array (`['SECURITY']`,
`['PERFORMANCE']`). The API type permits a multi-element array, but
nothing in the repo produces one, so the ladder's
SECURITY-over-PERFORMANCE priority is not load-bearing.
2. **The advisors UI already treats the first element as canonical** —
`LinterDataGrid.tsx` L196 renders `<LintCategoryBadge
category={selectedLint.categories[0]} />`.
3. **Extending the ladder would not actually produce agreement.** In the
one reachable multi-category case, a ladder with a `HEALTH` branch
appended still reports the higher-priority category while the three
pass-through sites report `categories[0]`. Only `categories[0]` makes
all five agree, which is the point of the change.

**Reviewers should look at this first — how much data is actually
affected.** Narrower than the headline suggests, and worth stating
precisely. Every surface feeding these events filters lints upstream by
category, and all three filters still admit only `SECURITY` or
`PERFORMANCE`:

- `AdvisorPanel.utils.ts` `createAdvisorLintItems` drops any lint that
resolves to no tab (`if (!tab) return null`), and it is the item source
for **both** ladder surfaces
- `pages/project/[ref]/advisors/security.tsx` filters
`categories.includes('SECURITY')`
- `pages/project/[ref]/advisors/performance.tsx` filters
`categories.includes('PERFORMANCE')`

So a HEALTH-**only** lint is not surfaced anywhere in Studio today and
cannot currently reach any of the five emit sites. The divergence
reachable today is a lint carrying `HEALTH` alongside another category:
it passes the filters, and then the ladder sites and the pass-through
sites disagree. The HEALTH-only omission is latent, and becomes live
data loss the moment HEALTH lints are surfaced — presumably the point of
the API adding the category. Practical consequence: **no backfill or
historical-data caveat is needed**, because no HEALTH-only event was
ever emitted. This is a correctness fix that gets the emit surfaces
right ahead of the category being shown, not a response to an active
data incident.

**How it was tested.** Honest caveat up front: `pnpm install` cannot
complete in this sandbox, so the Studio-scoped checks could not be run
here. `apps/studio` depends on `@std/path` → `npm:@jsr/std__path`, and
the JSR registry is network-blocked in this environment (`GET
https://npm.jsr.io/~/11/@jsr/std__path/1.0.8.tgz` → `403`, both direct
and proxied; `registry.npmjs.org` returns `200`, so it is JSR
specifically). CI on this PR is the real signal for Studio lint,
typecheck, and tests. What did run clean:

- `prettier --config prettier.config.mjs --check` on all three changed
files — clean
- `tsc --noEmit` in `packages/common` (installed via `pnpm install
--filter=common...`) — clean, and `--listFiles` confirms it genuinely
covers both `telemetry-constants.ts` and the widened
`packages/api-types/types/platform.d.ts`
- the changed expression typechecked in a standalone harness against the
real generated `components['schemas']['GetProjectLintsResponse']`,
confirming `categories[0]` is assignable to `AdvisorCategory |
undefined` — with a negative control that correctly errored (`Type
'"HEALTH"' is not assignable to type '"PERFORMANCE" | "SECURITY" |
undefined'`) to prove the harness had teeth

No tests are added. There is no existing test coverage of
`handleItemClick` / `handleCardClick` in either ladder component, and
the change is a narrowing of one expression to match three existing call
sites rather than new logic. Asserting an emitted property value would
require standing up component tests for two components that have none,
which is a larger piece of work than this fix and better done as its own
change.

**Suggested follow-up, deliberately not in this PR.**
`createAdvisorLintItems` and the two advisors pages filter HEALTH lints
out entirely, so the category the API now returns is invisible in
Studio. Whether to surface it is a product decision about a new advisor
category, not a telemetry fix. Also out of scope by request:
`Linter.utils.tsx` badge styling (HEALTH falling back to PERFORMANCE's
badge is harmless).

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Xwj2SotnaHByjbTfqF4Kdm)_

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com>
 2026-08-31 15:48:01 +08:00
claude[bot]ClaudePamela Chia
 		5e8a83e11a feat(studio): add explorer_banner_exposed impression event (#49747) 
<!-- ccr-slack-attribution -->
_Requested by **Pam Chia** · [Slack
thread](https://supabase.slack.com/archives/C076KTY11DF/p1788139328573799?thread_ts=1788139328.573799&cid=C076KTY11DF)_

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Feature (telemetry). Adds one PostHog event.

Linear issue:
[GROWTH-1154](https://linear.app/supabase/issue/GROWTH-1154/telemetry-explorer-feature-preview-banner-has-no-exposure-event-so)

## What is the current behavior?

The Explorer feature preview banner emits
`explorer_banner_dismiss_button_clicked` and
`explorer_banner_cta_button_clicked` (both from
`apps/studio/components/ui/BannerStack/Banners/BannerExplorer.tsx`,
shipped in #49606), and nothing else. With no impression event there is
no denominator, so no click-through or dismiss rate can be reported.

## What is the new behavior?

`explorer_banner_exposed` fires when the banner content is rendered, at
most once per page load.

The event is declared in `packages/common/telemetry-constants.ts` next
to the two existing Explorer banner events and added to the
`TelemetryEvent` union, following the existing `*_exposed` family. It
carries no custom properties; `project` and `organization` groups are
attached by `apps/studio/lib/telemetry/track.ts`.

**Verification:**

- `prettier --check` on both changed files: passing
- `tsc --noEmit` in `packages/common`, which covers the new event
interface and the `TelemetryEvent` union: passing
- Studio-scoped lint, typecheck, and tests: green on CI
- Browser-tested on the studio-staging preview (Playwright): the
exposure event fires exactly once per page load (201 on the wire), does
not re-fire on client-side navigation or banner hover within the same
page load, fires again after a full reload, and does not fire after
dismissal; the CTA and dismiss click events are unchanged and carry the
`project`/`organization` groups

**Out of scope:**

- Pre-consent drops: every telemetry event waits for consent, so this
event degrades the same way the rest of the `*_exposed` family does
(transient, recovers on the next page load). A family-wide fix is a
separate issue.
- Mirroring the `explorer` flag state into event properties: redundant
once exposure exists.
- The CTA handler not dismissing the banner: raised separately, both
click handlers untouched.
-
[GROWTH-1153](https://linear.app/supabase/issue/GROWTH-1153/telemetry-advisorcategory-omitted-for-health-lints-on-two-of-five)
and its draft PR #49746: separate issue, no overlap.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Xwj2SotnaHByjbTfqF4Kdm); reworked
per Pam's review._

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Pamela Chia <pamelachiamayyee@gmail.com>
 2026-08-31 15:47:43 +08:00
Alaister YoungandAlaister Young 29493e02d0 [FE-4010] feat(studio): add read-only replica connection option for HA projects (#49485) 
For Multigres (HA) projects you can't connect to read replicas directly
— reads go through a read-only load balancer on the primary's host at
port 5433. Since #44695 stripped the pooler UI, HA projects showed no
source option at all in the Connect dialog and still prompted for the
IPv4 add-on. This surfaces it as a first-class, clearly-labeled
read-only source. In the UI it's labeled `Replica (read-only)` rather
than "load balancer" — the primary goes through the same gateway, so
"load balancer" would be confusing from a product perspective
(internally the `load-balancer` source identifier and
`HIGH_AVAILABILITY_LOAD_BALANCER_PORT` constant keep their names).

<img width="883" height="342" alt="Screenshot 2026-08-24 at 11 32 26 PM"
src="https://github.com/user-attachments/assets/3716f6dd-0325-4b9d-adbc-9ece9244de62"
/>

**Added:**
- Source select for HA projects in the Direct tab: `Primary database` +
`Replica (read-only)` (individual replica rows are filtered out —
they're only reachable via the load balancer)
- Replica (load balancer) connection strings on all 9 connection types:
primary host, port `5433`, with the Multigres-required
`sslmode=require&sslnegotiation=direct` params (JDBC gets the
`sslNegotiation` spelling, .NET gets `SSL Negotiation=Direct`)
- `Read-only` badge on the connection code block + note pointing writes
at the primary
- Programmatic labels for the ConnectSheet select/switch/multi-select
fields (the Source combobox previously had no accessible name)

**Changed:**
- The generated-file step (Node.js/Golang/.NET/Python/SQLAlchemy) is now
source-aware — it previously ignored the Source selection entirely (also
affected read replicas on normal projects) and silently rendered the
primary's connection info
- .NET template now emits `Port=` (Npgsql defaults to 5432 when omitted)
and the install step actually installs Npgsql (pinned 9.0.5 — `SSL
Negotiation` requires 9+)
- SQLAlchemy `DATABASE_URL` merges `sslmode=require` into the string's
existing query params instead of a hardcoded suffix that could drop TLS
- Source option labels normalized to sentence case (`Primary database`,
`Read replica (…)`)
- `MultipleCodeBlock` (ui-patterns) accepts an optional `className`
- HA coercion in `useConnectState` extended: a stale replica
`connectionSource` restored from URL/localStorage falls back to the
primary

**Removed:**
- IPv4 add-on admonition for HA projects (the forced-direct method was
tripping it; the add-on doesn't apply to Multigres)

Out of scope (needs platform work): SQL editor / Data API / other
`DatabaseSelector` surfaces — executing against the load balancer
requires a platform-issued connection string, and the load-balancers API
only returns a REST endpoint today. The `5433` port is a client-side
constant (`HIGH_AVAILABILITY_LOAD_BALANCER_PORT`) until the API exposes
it.

## To test

On an HA (Multigres) project:
- Open Connect → Direct: Source shows exactly `Primary database` and
`Replica (read-only)`; selecting the replica shows
`…@<primary-host>:5433/postgres?sslmode=require&sslnegotiation=direct`,
a `Read-only` badge, and the read-only note
- Cycle all 9 connection types with the replica selected — every snippet
carries port 5433 (`.NET` includes `Port=5433;…;SSL
Negotiation=Direct`), badge/note persist
- No "Enable IPv4 add-on" admonition anywhere in the Direct tab
- Switch tabs / hard-reload: source resets to primary with no stale
badge/string combos

On a normal project:
- Direct tab unchanged: no `Replica (read-only)` option, pooler badges
and IPv4 admonitions behave as before, `.NET` now shows `Port=5432` and
no `SSL Negotiation`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added read-only load-balancer connection options for high-availability
projects.
- Added .NET and SQLAlchemy connection examples with required SSL
settings.
- Added clear read-only labels and notices explaining write
restrictions.
- **Bug Fixes**
  - Suppressed IPv4 add-on notices for high-availability connections.
  - Improved connection-source selection and restored-setting handling.
  - Improved connection form identification and accessibility.
- **Style**
  - Added customizable styling support for multi-code-block displays.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
 2026-08-28 10:43:55 +01:00
Wendie CheungWendie CheungClaude Sonnet 5
 		c984771ed8 Update pricing page: BYO Cloud → AWS PrivateLink (#49624) 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Content update to /pricing.

## What is the current behavior?

- The Enterprise plan card lists "BYO Cloud supported" as a feature.
- The Platform Security and Compliance comparison table has a separate
"BYO cloud" row (Enterprise-only), alongside an existing "AWS
PrivateLink" row.

## What is the new behavior?

- Enterprise plan card bullet changed to "Supports AWS PrivateLink".
- Removed the "BYO cloud" row entirely from the Platform Security and
Compliance comparison table (the AWS PrivateLink row already covers
this).

## Additional context

Data-only change in `packages/shared-data/plans.ts` and
`packages/shared-data/pricing.ts`. No component logic changed.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Enterprise plan details now highlight AWS PrivateLink support.
  * Removed the BYO Cloud feature from the security feature listings.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Wendie Cheung <wendie.cheung@supabase.io>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-28 07:53:48 +10:00
Francesco Sansalvadore 45d8f30ba8 chore(icons): add workers icon (#49645) 
- added workers to icons package
- used workers as product icon in studio sidebar

<img width="200" height="79" alt="Screenshot 2026-08-27 at 16 36 19"
src="https://github.com/user-attachments/assets/0e2e7ce6-dde2-439a-93e8-e795aa5efded"
/>
 2026-08-27 17:12:37 +02:00
Ivan Vasilov 26e89b36c3 chore: Regenerate API types and fix all issues (#49646) 
A bunch of small issues have showed up where the API types are breaking
the FE repo:
- Regenerate the API types.
- For the removed Response types, use the return types from the
operations instead.
- Fix some types which now have a suffix `_Output`.
- Add `requires_indirect_tax_declaration` property to Organization
instances in mocks.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Refactor**
* Updated Studio and shared type references to use generated API
definitions consistently.
  * Improved typing for SSO configuration creation and updates.
  * Aligned telemetry lint categories with API-provided values.
  * Marked the legacy API type re-export as deprecated.

* **Tests**
* Updated test fixtures and response types to reflect current API
contracts.
  * Added indirect tax declaration data to organization test scenarios.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-27 17:07:58 +02:00
Ivan Vasilov df002b4018 fix: Fix a type error in List JIT access API (#49612) 
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved database access rule handling by excluding records without an
associated user.
* Preserved valid user-rule mappings while preventing incomplete entries
from being included.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-27 14:14:50 +00:00
Gildas Garcia 57a6f74407 Revert "fix: FormItemLayout does not apply item id correctly" (#49635) 
Reverts supabase/supabase#49593 because we currently provide `id`
manually in some places and that breaks many tests. We didn't see the
failures because the PR only modified `ui-patterns` which isn't in the
paths checked to actually run the tests (this must be fixed too).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved form accessibility by correctly associating labels with their
corresponding fields in React form layouts.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-27 09:34:10 +01:00
Gildas Garcia df48528443 fix: FormItemLayout does not apply item id correctly (#49593) 
## Problem

`<FormItemLayout>` does not apply item id correctly. This can be seen on
https://supabase.com/design-system/docs/ui-patterns/forms: open the
devtool and check the form items labels. They have no `for` attribute.
This makes it harder to correctly test and is an accessibility issue.

Axe devtool actually report it

## Solution

When inside React Hook Form, `<FormItemLayout>` actually generate an
`id` (via `<FormItem>`). However, this `id` is overridden in
`<FormLayout>` and read from context by `<FormLabel>`. Simply removing
this line fixes it and correctly binds the label to its input
 2026-08-27 09:00:11 +02:00
Joshen Lim 961fc749d4 Add feature preview banner toast for explorerd (#49606) 
## Context

Adds a feature preview banner toast for the explorer - flagged behind
the configcat flag
<img width="315" height="342" alt="image"
src="https://github.com/user-attachments/assets/9dbd7ffd-02c6-4083-9ca0-266b862e1b5d"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
- Added an Explorer preview banner to project layouts when the feature
is enabled.
- Added an “Enable Explorer” call-to-action that opens the feature
preview.
  - Banner dismissal is remembered and persists across sessions.
  - Added telemetry tracking for banner dismissal and CTA interactions.

- **Bug Fixes**
- Improved banner behavior and stability when displaying database
connection notifications.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-27 14:12:04 +08:00
Joshen Lim 2d1a2ff9a2 Set up feature preview for explorer (#49602) 
## Context

Sets up the Explorer behind the feature preview modal + removes the
temporary entry point from the SQL Editor
Changes are still not live on production, so will only affect local +
staging.

Enabling the feature preview will replace the sidebar nav for SQL Editor
to new Explorer (Icon remains unchanged, just the label)

<img width="918" height="647" alt="image"
src="https://github.com/user-attachments/assets/b088eb47-1176-4618-b345-d1ec0521b092"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added an “Explorer & Notebooks” feature preview with an overview image
and direct access to Explorer or SQL Editor.
  - Added Explorer navigation when the preview is enabled.

- **Improvements**
- Updated desktop and mobile navigation to consistently display the
available editor destination.
- Improved the Explorer shortcut tooltip to clearly say “Go to
Explorer.”
  - Organized SQL Editor previews under the Editors category.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-26 22:45:11 +08:00