From 24ce0ba5f87698ad72c173c7a26fa6c5c105e8ca Mon Sep 17 00:00:00 2001
From: Ivan Vasilov <vasilov.ivan@gmail.com>
Date: Mon, 20 Jul 2026 12:57:42 +0200
Subject: [PATCH 1/8] chore: migrate repo to pnpm v11 (#48033)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore / dependency tooling update.

## What is the current behavior?

The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.

## What is the new behavior?

The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.

## Additional context

Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.

* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .npmrc                                       |  2 --
 apps/design-system/package.json              |  2 +-
 apps/docs/package.json                       |  2 +-
 apps/learn/package.json                      |  2 +-
 apps/lite-studio/package.json                |  2 +-
 apps/studio/Dockerfile                       |  2 +-
 apps/studio/package.json                     |  2 +-
 apps/ui-library/package.json                 |  2 +-
 apps/www/package.json                        |  2 +-
 blocks/vue/package.json                      |  2 +-
 package.json                                 |  8 ++---
 packages/ai-commands/package.json            |  2 +-
 packages/api-types/package.json              |  2 +-
 packages/build-icons/package.json            |  2 +-
 packages/common/package.json                 |  2 +-
 packages/config/package.json                 |  2 +-
 packages/dev-tools/package.json              |  2 +-
 packages/eslint-config-supabase/package.json |  2 +-
 packages/generator/package.json              |  2 +-
 packages/icons/package.json                  |  2 +-
 packages/marketing/package.json              |  2 +-
 packages/pg-meta/package.json                |  2 +-
 packages/shared-data/package.json            |  2 +-
 packages/ui-patterns/package.json            |  2 +-
 packages/ui/package.json                     |  2 +-
 pnpm-lock.yaml                               |  4 +--
 pnpm-workspace.yaml                          | 32 +++++++++++---------
 turbo.jsonc                                  |  1 +
 28 files changed, 46 insertions(+), 47 deletions(-)

diff --git a/.npmrc b/.npmrc
index 19c081e2d4f63..41583e36ca8d2 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,3 +1 @@
-engine-strict=true
-update-notifier=false
 @jsr:registry=https://npm.jsr.io
diff --git a/apps/design-system/package.json b/apps/design-system/package.json
index 9636c6b1dd676..d1ffddf65031c 100644
--- a/apps/design-system/package.json
+++ b/apps/design-system/package.json
@@ -13,7 +13,7 @@
     "start": "next start",
     "lint": "eslint .",
     "content:build": "contentlayer2 build",
-    "clean": "rimraf node_modules .next .turbo",
+    "clean": "rimraf .next .turbo tsconfig.tsbuildinfo",
     "typecheck": "contentlayer2 build && tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
diff --git a/apps/docs/package.json b/apps/docs/package.json
index 704b3a23cccff..87f158579da73 100644
--- a/apps/docs/package.json
+++ b/apps/docs/package.json
@@ -13,7 +13,7 @@
     "build:markdown": "pnpm build:guides-markdown && pnpm build:reference-markdown",
     "build:gz-archive": "tsx ./internals/generate-gz-archive.ts",
     "build:sitemap": "tsx ./internals/generate-sitemap.ts",
-    "clean": "rimraf .next .turbo node_modules features/docs/generated examples __generated__",
+    "clean": "rimraf .next .turbo features/docs/generated examples __generated__ tsconfig.tsbuildinfo",
     "codegen:examples": "shx cp -r ../../examples ./examples",
     "codegen:graphql": "tsx --conditions=react-server ./scripts/graphqlSchema.ts && graphql-codegen --config codegen.ts",
     "codegen:references:new:ensure": "(test -f spec/reference/javascript/v2/supabase.json || (cd spec && make download.tsdoc.v2)) && (test -f spec/reference/server/v1/server.json || (cd spec && make download.server.v1))",
diff --git a/apps/learn/package.json b/apps/learn/package.json
index f2159e418c1e3..c857297c49134 100644
--- a/apps/learn/package.json
+++ b/apps/learn/package.json
@@ -12,7 +12,7 @@
     "lint": "eslint .",
     "lint:mdx": "supa-mdx-lint content --config ../../supa-mdx-lint.config.toml",
     "content:build": "contentlayer2 build",
-    "clean": "rimraf node_modules .next .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .next .turbo tsconfig.tsbuildinfo",
     "typecheck": "contentlayer2 build && tsc --noEmit"
   },
   "dependencies": {
diff --git a/apps/lite-studio/package.json b/apps/lite-studio/package.json
index b6ebf0e791d0e..a149499c2591f 100644
--- a/apps/lite-studio/package.json
+++ b/apps/lite-studio/package.json
@@ -7,7 +7,7 @@
     "dev": "react-router dev",
     "start": "react-router-serve ./build/server/index.js",
     "typecheck": "react-router typegen && tsc",
-    "clean": "rimraf node_modules tsconfig.tsbuildinfo build .react-router .turbo"
+    "clean": "rimraf build .react-router .turbo tsconfig.tsbuildinfo"
   },
   "dependencies": {
     "@react-router/fs-routes": "^7.17.0",
diff --git a/apps/studio/Dockerfile b/apps/studio/Dockerfile
index a657a43213732..237b543b41c74 100644
--- a/apps/studio/Dockerfile
+++ b/apps/studio/Dockerfile
@@ -23,7 +23,7 @@ RUN apt-get update -qq && \
   rm -rf /var/lib/apt/lists/* && \
   update-ca-certificates
 
-RUN npm install -g pnpm@10.24.0
+RUN npm install -g pnpm@11.13.1
 
 WORKDIR /app
 
diff --git a/apps/studio/package.json b/apps/studio/package.json
index 72da599debab9..837e9b4280d78 100644
--- a/apps/studio/package.json
+++ b/apps/studio/package.json
@@ -19,7 +19,7 @@
     "start:tanstack": "node scripts/serve.js",
     "lint": "eslint .",
     "lint:ratchet": "tsx scripts/ratchet-eslint-rules.ts --rules-file scripts/ratchet-rules.json",
-    "clean": "rimraf node_modules tsconfig.tsbuildinfo .next .turbo",
+    "clean": "rimraf .next .turbo tsconfig.tsbuildinfo",
     "test": "vitest --run --coverage",
     "test:watch": "vitest watch",
     "test:ui": "vitest --ui",
diff --git a/apps/ui-library/package.json b/apps/ui-library/package.json
index 844cd637bb43c..dfbcb6c3de802 100644
--- a/apps/ui-library/package.json
+++ b/apps/ui-library/package.json
@@ -14,7 +14,7 @@
     "lint": "eslint .",
     "lint:mdx": "supa-mdx-lint content --config ../../supa-mdx-lint.config.toml",
     "content:build": "contentlayer2 build",
-    "clean": "rimraf node_modules .next .turbo",
+    "clean": "rimraf .next .turbo tsconfig.tsbuildinfo",
     "typecheck": "contentlayer2 build && tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
diff --git a/apps/www/package.json b/apps/www/package.json
index aa16494342414..b1e2deea0f6e0 100644
--- a/apps/www/package.json
+++ b/apps/www/package.json
@@ -11,7 +11,7 @@
     "export": "next export",
     "start": "next start",
     "lint": "eslint .",
-    "clean": "rimraf node_modules",
+    "clean": "rimraf .next .turbo tsconfig.tsbuildinfo",
     "pretypecheck": "next typegen",
     "typecheck": "pnpm run content:build:core && tsc --noEmit",
     "content:build:core": "node scripts/generateStaticContent.mjs && node scripts/generateMdContent.mjs",
diff --git a/blocks/vue/package.json b/blocks/vue/package.json
index 8ff4abe17ccea..39fd1c19c31d5 100644
--- a/blocks/vue/package.json
+++ b/blocks/vue/package.json
@@ -6,7 +6,7 @@
   "exports": "./index.ts",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules .next .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .next .turbo tsconfig.tsbuildinfo",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
diff --git a/package.json b/package.json
index 6993678bcd04c..e76e4c7dd3cc6 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
     "build:studio:docker": "docker build . -f apps/studio/Dockerfile --target production -t supabase-studio:local --build-arg NEXT_PUBLIC_STUDIO_AUTH_MODE=supabase --no-cache",
     "build:design-system": "turbo run build --filter=design-system",
     "build:docs": "turbo run build --filter=docs",
-    "clean": "turbo run clean --parallel && rimraf -G node_modules/{*,.bin,.modules.yaml} .turbo/cache",
+    "clean": "turbo run clean --parallel && rimraf -G .turbo/cache && pnpm purge",
     "dev": "turbo run dev --parallel",
     "dev:studio": "turbo run dev --filter=studio --parallel",
     "dev:studio-local": "pnpm setup:cli && NODE_ENV=test MODE=test pnpm --prefix ./apps/studio dev",
@@ -65,8 +65,8 @@
     "url": "git+https://github.com/supabase/supabase.git"
   },
   "engines": {
-    "pnpm": "10.24",
-    "node": ">=22"
+    "pnpm": "11.13",
+    "node": ">=22.13"
   },
   "keywords": [
     "postgres",
@@ -76,5 +76,5 @@
     "database",
     "auth"
   ],
-  "packageManager": "pnpm@10.24.0"
+  "packageManager": "pnpm@11.13.1"
 }
diff --git a/packages/ai-commands/package.json b/packages/ai-commands/package.json
index 68b2181eaccae..c1de0dd0ef37d 100644
--- a/packages/ai-commands/package.json
+++ b/packages/ai-commands/package.json
@@ -7,7 +7,7 @@
   "sideEffects": false,
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "typecheck": "tsc --noEmit",
     "test": "vitest"
   },
diff --git a/packages/api-types/package.json b/packages/api-types/package.json
index 666602c98a743..d975cab4de8c0 100644
--- a/packages/api-types/package.json
+++ b/packages/api-types/package.json
@@ -6,7 +6,7 @@
   "types": "./index.ts",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "codegen": "openapi-typescript --redocly ./redocly.yaml --alphabetize --default-non-nullable=false && prettier --cache --write types/*.d.ts"
   },
   "author": "",
diff --git a/packages/build-icons/package.json b/packages/build-icons/package.json
index 7a789e0a0c1a3..099a3a9cf678d 100644
--- a/packages/build-icons/package.json
+++ b/packages/build-icons/package.json
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules"
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo"
   },
   "engines": {
     "node": ">= 16"
diff --git a/packages/common/package.json b/packages/common/package.json
index 1fd27ba5f8db1..bc9c7ebd64db5 100644
--- a/packages/common/package.json
+++ b/packages/common/package.json
@@ -7,7 +7,7 @@
   "license": "MIT",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "gen:types": "supabase gen types typescript --local >| ./database-types.ts",
     "typecheck": "tsc --noEmit"
   },
diff --git a/packages/config/package.json b/packages/config/package.json
index 324105ef29b48..df687c8ea9be0 100644
--- a/packages/config/package.json
+++ b/packages/config/package.json
@@ -5,7 +5,7 @@
   "license": "MIT",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules"
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo"
   },
   "dependencies": {
     "@tailwindcss/forms": "^0.5.11",
diff --git a/packages/dev-tools/package.json b/packages/dev-tools/package.json
index 7d32a3ee69473..1879dfe449f6f 100644
--- a/packages/dev-tools/package.json
+++ b/packages/dev-tools/package.json
@@ -11,7 +11,7 @@
   },
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules .turbo tsconfig.tsbuildinfo dist",
+    "clean": "rimraf .turbo dist tsconfig.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit"
diff --git a/packages/eslint-config-supabase/package.json b/packages/eslint-config-supabase/package.json
index 878e68ca8e173..54b36915b7be6 100644
--- a/packages/eslint-config-supabase/package.json
+++ b/packages/eslint-config-supabase/package.json
@@ -5,7 +5,7 @@
   "license": "MIT",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules"
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.0.0",
diff --git a/packages/generator/package.json b/packages/generator/package.json
index bf33b2438e0b6..cb3e56a7e713f 100644
--- a/packages/generator/package.json
+++ b/packages/generator/package.json
@@ -6,7 +6,7 @@
   "license": "MIT",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "tsdoc:dereference:functions:v1": "tsx ./tsdoc.ts --input ../../apps/docs/spec/enrichments/tsdoc_v1/functions.json --output ../../apps/docs/spec/enrichments/tsdoc_v1/functions_dereferenced.json",
     "tsdoc:dereference:gotrue:v1": "tsx ./tsdoc.ts --input ../../apps/docs/spec/enrichments/tsdoc_v1/gotrue.json --output ../../apps/docs/spec/enrichments/tsdoc_v1/gotrue_dereferenced.json",
     "tsdoc:dereference:postgrest:v1": "tsx ./tsdoc.ts --input ../../apps/docs/spec/enrichments/tsdoc_v1/postgrest.json --output ../../apps/docs/spec/enrichments/tsdoc_v1/postgrest_dereferenced.json",
diff --git a/packages/icons/package.json b/packages/icons/package.json
index dc5bc56c5cf8f..2161e0f4df502 100644
--- a/packages/icons/package.json
+++ b/packages/icons/package.json
@@ -4,7 +4,7 @@
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "build:icons": "build-icons --templateSrc=./scripts/exportTemplate.mjs --renderUniqueKey --iconFileExtension=.ts --exportFileName=index.ts",
-    "clean": "rimraf node_modules .turbo"
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo"
   },
   "dependencies": {
     "@typescript/native": "catalog:",
diff --git a/packages/marketing/package.json b/packages/marketing/package.json
index f9274b2f2e370..f87045fe20ca5 100644
--- a/packages/marketing/package.json
+++ b/packages/marketing/package.json
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules"
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo"
   },
   "dependencies": {
     "@types/react": "catalog:",
diff --git a/packages/pg-meta/package.json b/packages/pg-meta/package.json
index 94f2cc959478a..bc9f010499e91 100644
--- a/packages/pg-meta/package.json
+++ b/packages/pg-meta/package.json
@@ -7,7 +7,7 @@
   "repository": "supabase/supabase",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "test": "test/run-tests.sh vitest run --coverage",
     "test:update": "test/run-tests.sh vitest run --update",
     "lint": "tsc --noEmit",
diff --git a/packages/shared-data/package.json b/packages/shared-data/package.json
index 9625ffecd62bb..bc39f07660007 100644
--- a/packages/shared-data/package.json
+++ b/packages/shared-data/package.json
@@ -6,7 +6,7 @@
   "types": "./index.ts",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
-    "clean": "rimraf node_modules .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
diff --git a/packages/ui-patterns/package.json b/packages/ui-patterns/package.json
index c9dd3e0956a28..a0df1ca5102a0 100644
--- a/packages/ui-patterns/package.json
+++ b/packages/ui-patterns/package.json
@@ -8,7 +8,7 @@
     "preinstall": "npx only-allow pnpm",
     "test": "vitest",
     "test:coverage": "vitest --run --coverage",
-    "clean": "rimraf node_modules .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "typecheck": "tsc --noEmit",
     "gen:exports": "tsx ./scripts/update-exports.ts"
   },
diff --git a/packages/ui/package.json b/packages/ui/package.json
index a724528e4fc11..b9fb78d53c2ca 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -9,7 +9,7 @@
     "preinstall": "npx only-allow pnpm",
     "typecheck": "tsc --noEmit",
     "generate-tailwind-classes": "tsx ./scripts/generate-tailwind-classes.ts",
-    "clean": "rimraf node_modules .turbo tsconfig.tsbuildinfo",
+    "clean": "rimraf .turbo tsconfig.tsbuildinfo",
     "test": "vitest",
     "test:ci": "vitest --run --coverage",
     "test:report": "open coverage/lcov-report/index.html"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 28c11dee30876..1fc7165af4e99 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -129,9 +129,7 @@ overrides:
   webpack: ^5.104.1
 
 patchedDependencies:
-  react-data-grid:
-    hash: 803f02d6cede565990ab9675326b93195b98bcc6477a4811715405892c257488
-    path: patches/react-data-grid.patch
+  react-data-grid: 803f02d6cede565990ab9675326b93195b98bcc6477a4811715405892c257488
 
 importers:
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 17cbf3f5abb4d..ea5c77a993edc 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -5,6 +5,10 @@ packages:
   - e2e/*
 
 blockExoticSubdeps: true
+engineStrict: true
+updateNotifier: false
+# Doesn't work because of Typescript issues with peer dependencies, see https://github.com/pnpm/pnpm/issues/9739
+enableGlobalVirtualStore: false 
 
 catalog:
   '@monaco-editor/react': ^4.7.0
@@ -49,17 +53,19 @@ catalog:
   vitest: ^4.1.4
   zod: 3.25.76
 
-ignoredBuiltDependencies:
-  - '@parcel/watcher'
-  - '@sentry/cli'
-  - contentlayer2
-  - core-js
-  - es5-ext
-  - esbuild
-  - libpg-query
-  - msw
-  - protobufjs
-  - sharp
+allowBuilds:
+  '@parcel/watcher': false
+  '@sentry/cli': false
+  contentlayer2: false
+  core-js: false
+  es5-ext: false
+  esbuild: false
+  libpg-query: false
+  msw: false
+  node-pty: true
+  protobufjs: false
+  sharp: false
+  supabase: true
 
 minimumReleaseAge: 4320
 
@@ -74,10 +80,6 @@ minimumReleaseAgeExclude:
   # The following are excluded to fix vulnerablities.
   - react-use
 
-onlyBuiltDependencies:
-  - node-pty
-  - supabase
-
 overrides:
   '@ardatan/relay-compiler>immutable': ^3.8.3
   'monaco-editor': 'catalog:'
diff --git a/turbo.jsonc b/turbo.jsonc
index cbc370c99da88..838e626b86965 100644
--- a/turbo.jsonc
+++ b/turbo.jsonc
@@ -13,6 +13,7 @@
     "clean": {
       "outputs": [],
       "cache": false,
+      "outputLogs": "errors-only",
     },
     "dev": {
       "cache": false,

From 05d5da03402132f577ca193f6b262edfd5e6b862 Mon Sep 17 00:00:00 2001
From: Etienne Stalmans <staaldraad@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:46:44 +0200
Subject: [PATCH 2/8] chore: add ssl_enforcement_required for jit (#48032)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

chore / bug fix

## What is the current behavior?

The new `ssl_enforcement_required` state is not handled

## What is the new behavior?

Displays the correct message




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved temporary database access messaging when SSL enforcement is
required.
* Added a direct action to open database settings and enable SSL
enforcement before activating temporary access.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../JitDatabaseAccess/JitDbAccessConfiguration.tsx | 14 ++++++++++++--
 packages/api-types/types/api.d.ts                  |  1 +
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/apps/studio/components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx b/apps/studio/components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx
index 2e247c35eee6f..6c4cb135cf3c9 100644
--- a/apps/studio/components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx
+++ b/apps/studio/components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx
@@ -302,13 +302,17 @@ export const JitDbAccessConfiguration = () => {
       ? 'Postgres upgrade required'
       : unavailableReason === 'manual_migration_required'
         ? 'Migration required'
-        : 'Temporary access unavailable'
+        : unavailableReason === 'ssl_enforcement_required'
+          ? 'SSL enforcement required'
+          : 'Temporary access unavailable'
   const unavailableDescription =
     unavailableReason === 'postgres_upgrade_required'
       ? 'must be upgraded to Postgres 17 or later before temporary access can be enabled.'
       : unavailableReason === 'manual_migration_required'
         ? 'must be migrated before temporary access can be enabled. Contact support to migrate this project.'
-        : 'This feature is currently unavailable for this project. Contact support if you need help enabling it.'
+        : unavailableReason === 'ssl_enforcement_required'
+          ? 'must have SSL enforcement enabled before temporary access can be enabled.'
+          : 'This feature is currently unavailable for this project. Contact support if you need help enabling it.'
 
   useEffect(() => {
     if (!isLoadingConfiguration && jitDbAccessConfiguration) {
@@ -377,6 +381,12 @@ export const JitDbAccessConfiguration = () => {
                   <Button variant="default" asChild>
                     <Link href={`/project/${ref}/settings/infrastructure`}>Upgrade Postgres</Link>
                   </Button>
+                ) : unavailableReason === 'ssl_enforcement_required' && ref ? (
+                  <Button variant="default" asChild>
+                    <Link href={`/project/${ref}/settings/database#ssl-configuration`}>
+                      Enable SSL enforcement
+                    </Link>
+                  </Button>
                 ) : (
                   <Button variant="default" asChild>
                     <SupportLink
diff --git a/packages/api-types/types/api.d.ts b/packages/api-types/types/api.d.ts
index 6283a1679fe9c..eef705e690efe 100644
--- a/packages/api-types/types/api.d.ts
+++ b/packages/api-types/types/api.d.ts
@@ -3223,6 +3223,7 @@ export interface components {
           unavailableReason:
             | 'manual_migration_required'
             | 'postgres_upgrade_required'
+            | 'ssl_enforcement_required'
             | 'temporarily_unavailable'
         }
     LegacyApiKeysResponse: {

From 8c511032b694459d4aad23bb59f0dd31d1d38dc7 Mon Sep 17 00:00:00 2001
From: Lukas Klingsbo <lukas.klingsbo@gmail.com>
Date: Mon, 20 Jul 2026 14:22:58 +0200
Subject: [PATCH 3/8] docs(dart): derive reference sections from spec YAML
 section headers (#47994)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Addresses @jeremenichelli's feedback that the Dart v2 reference required
maintaining section metadata separately from the spec. The reference now
derives every method's section from the spec YAML itself, with **no
per-method metadata**.

## How

Each **section-header** entry in `supabase_dart_v2.yml` carries the
`category` and optional `subcategory` that every method after it
inherits, up to the next header:

- Existing subcategory headers gain a `category`/`subcategory`:
`auth-mfa-api`, `passkey-api`, `admin-api`, `admin-passkey-api`,
`file-buckets`, `using-modifiers`, `using-filters`.
- New top-level category headers mark the sections that previously had
no header: `auth-api`, `functions-api`, `database-api`, `realtime-api`.

`generate-dart-reference.ts` walks the spec in order, tracking the
current section from the most recent header, and tags each method's
declaration with it. A method may still set `category`/`subcategory`
explicitly to override, and the converter errors if a method appears
before any header.

## Why this is less work

- **Authoring a new method:** place it in the right section. No
`category`/`subcategory` fields, no nav file edit.
- **Adding a section:** one header entry (with `category`/`subcategory`)
plus its overview partial.
- `common-client-libs-sections.json` is not touched (it still drives the
legacy-pipeline SDKs).

## Verification

The generated navigation (`content/reference/dart/v2/sections.json`,
`bySlug.json`) is **byte-for-byte identical** to the previous output.
`pnpm codegen:references:new` writes 105 method declarations across 5
categories with no orphaned methods and no slug collisions.

Supersedes the earlier per-method-`category` approach on this branch.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Improved Dart/Flutter API reference organization by leveraging
spec-provided `category` and `subcategory` taxonomy for clearer grouping
(Auth, Passkey, Edge Functions, Database, Realtime, Storage, and
database modifiers/filters).
* Updated reference generation to use structured in-spec section
headers, resulting in more consistent published categorization and
navigation.

* **Bug Fixes**
* Enhanced validation and error messaging for entries that can’t be
assigned to a section/category, including clearer guidance on how to fix
incomplete spec items.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 apps/docs/scripts/generate-dart-reference.ts | 121 ++++++++++---------
 apps/docs/spec/supabase_dart_v2.yml          |  26 ++++
 2 files changed, 87 insertions(+), 60 deletions(-)

diff --git a/apps/docs/scripts/generate-dart-reference.ts b/apps/docs/scripts/generate-dart-reference.ts
index d8119284727fc..df8c063e9c3f6 100644
--- a/apps/docs/scripts/generate-dart-reference.ts
+++ b/apps/docs/scripts/generate-dart-reference.ts
@@ -4,10 +4,14 @@
  *
  * Dart has no upstream TypeDoc output, so this script is the "pre-step" the
  * reference README describes: it adapts the hand-authored legacy spec
- * (`spec/supabase_dart_v2.yml`) plus the shared section tree
- * (`spec/common-client-libs-sections.json`) into a TypeDoc-shaped JSON dump at
+ * (`spec/supabase_dart_v2.yml`) into a TypeDoc-shaped JSON dump at
  * `spec/reference/dart/v2/supabase_flutter.json`.
  *
+ * Each method's section comes from `category` / `subcategory` fields on its own
+ * YAML entry, so adding or moving a method only ever touches this one file. The
+ * `build-reference-content.ts` "barebone" step then generates the navigation
+ * tree from those tags — no separate section list to maintain.
+ *
  * Each Dart method becomes a `variant: 'declaration'` node tagged with
  * `@category` / `@subcategory` (so the build groups it into the right section)
  * and carries the legacy function shape (description, notes, params, examples)
@@ -36,85 +40,54 @@ import { parse } from 'yaml'
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const DOCS_DIR = join(__dirname, '..')
 const YAML_PATH = join(DOCS_DIR, 'spec/supabase_dart_v2.yml')
-const SECTIONS_PATH = join(DOCS_DIR, 'spec/common-client-libs-sections.json')
 const VERSION_DIR = join(DOCS_DIR, 'spec/reference/dart/v2')
 const CONFIG_PATH = join(VERSION_DIR, 'config.json')
 const OUT_PATH = join(VERSION_DIR, 'supabase_flutter.json')
 
-const LIB_ID = 'reference_dart_v2'
-
 /**
- * Ids whose YAML entry is a category/subcategory overview rather than a method.
- * They are rendered through committed JSON partials (keyed by the subcategory
- * title slug), so they are skipped when building method declarations.
+ * Ids whose YAML entry is a section header rather than a method. Each header
+ * carries the `category` (and optional `subcategory`) that every method after
+ * it inherits, up to the next header. This is what lets individual methods omit
+ * section metadata entirely: authoring a new method just means placing it in the
+ * right section. Headers are skipped when building method declarations; their
+ * overview text is rendered from the committed JSON partials (keyed by the
+ * category/subcategory title slug).
+ *
+ * Listed in file order for readability.
  */
 const HEADER_IDS = new Set([
-  'using-filters',
-  'using-modifiers',
+  'auth-api',
   'auth-mfa-api',
   'passkey-api',
   'admin-api',
   'admin-passkey-api',
+  'functions-api',
+  'database-api',
+  'realtime-api',
   'file-buckets',
+  'using-modifiers',
+  'using-filters',
 ])
 
 /** Top-level entries handled by markdown / top-level JSON partials, not methods. */
 const SKIP_IDS = new Set(['introduction', 'installing', 'upgrade-guide', 'initializing'])
 
-/**
- * Dart-specific ids that are absent from the shared (JS-centric) section tree.
- * Map them to the category/subcategory they belong to.
- */
-const SECTION_OVERRIDE: Record<string, { category: string; subcategory: string | null }> = {
-  'max-affected': { category: 'Database', subcategory: 'Using modifiers' },
-  'link-identity-with-id-token': { category: 'Auth', subcategory: null },
-  'auth-reset-password-for-email': { category: 'Auth', subcategory: null },
-}
-
 /** Method-name overrides for titles that don't yield a clean identifier. */
 const NAME_OVERRIDE: Record<string, string> = {
   explain: 'explain',
 }
 
-interface SectionNode {
-  id?: string
-  title?: string
-  type?: string
-  excludes?: string[]
-  items?: SectionNode[]
-}
-
 interface DartFunction {
   id: string
   title: string
+  category?: string
+  subcategory?: string | null
   description?: string
   notes?: string
   params?: unknown[]
   examples?: unknown[]
 }
 
-/** Walk the shared section tree, recording each id's category/subcategory for dart v2. */
-function buildSectionMap(
-  sections: SectionNode[]
-): Map<string, { category: string; subcategory: string | null }> {
-  const map = new Map<string, { category: string; subcategory: string | null }>()
-  const included = (n: SectionNode) => !(n.excludes ?? []).includes(LIB_ID)
-  const walk = (nodes: SectionNode[], category: string | null, subcategory: string | null) => {
-    for (const node of nodes) {
-      if (!included(node)) continue
-      if (node.type === 'category') {
-        walk(node.items ?? [], node.title ?? '', null)
-      } else if (node.items && node.items.length) {
-        walk(node.items, category, node.title ?? null)
-      } else if (node.id) {
-        map.set(node.id, { category: category ?? '', subcategory })
-      }
-    }
-  }
-  walk(sections, null, null)
-  return map
-}
-
 /**
  * Derive a Dart method identifier from a legacy title:
  *   'signUp()'              -> 'signUp'
@@ -164,26 +137,53 @@ function slugify(value: string): string {
 
 export async function generateDartReferenceDump(): Promise<{ methodCount: number }> {
   const doc = parse(await readFile(YAML_PATH, 'utf-8')) as { functions: DartFunction[] }
-  const sections = JSON.parse(await readFile(SECTIONS_PATH, 'utf-8')) as SectionNode[]
   const config = JSON.parse(await readFile(CONFIG_PATH, 'utf-8')) as {
     navigationPrefixes?: NavigationPrefixes
   }
   const navigationPrefixes = config.navigationPrefixes ?? {}
-  const sectionMap = buildSectionMap(sections)
 
   let nextId = 1
   const children: unknown[] = []
   const slugOwners = new Map<string, string>()
-  const skipped: string[] = []
+  const orphaned: string[] = []
+
+  // The section a method belongs to is the one opened by the nearest preceding
+  // header entry. We walk the spec in order, updating the current section each
+  // time we hit a header, so methods themselves carry no section metadata.
+  let currentCategory: string | null = null
+  let currentSubcategory: string | null = null
 
   for (const fn of doc.functions) {
-    if (SKIP_IDS.has(fn.id) || HEADER_IDS.has(fn.id)) continue
+    if (SKIP_IDS.has(fn.id)) continue
+
+    if (HEADER_IDS.has(fn.id)) {
+      if (!fn.category) {
+        throw new Error(
+          `Dart converter: header "${fn.id}" needs a "category" field; it defines the ` +
+            `section that the methods after it inherit.`
+        )
+      }
+      currentCategory = fn.category
+      currentSubcategory = fn.subcategory ?? null
+      continue
+    }
 
-    const section = SECTION_OVERRIDE[fn.id] ?? sectionMap.get(fn.id)
-    if (!section) {
-      skipped.push(fn.id)
+    // A method inherits the current section. It may still override either field
+    // independently: an explicit `subcategory` always wins, an explicit
+    // `category` (with no subcategory) starts a fresh, subcategory-less section,
+    // and anything left unset is inherited from the current header.
+    const category = fn.category ?? currentCategory
+    const subcategory =
+      fn.subcategory !== undefined
+        ? fn.subcategory
+        : fn.category !== undefined
+          ? null
+          : currentSubcategory
+    if (!category) {
+      orphaned.push(fn.id)
       continue
     }
+    const section = { category, subcategory }
 
     const name = NAME_OVERRIDE[fn.id] ?? deriveName(fn.title)
     if (!/^[A-Za-z][A-Za-z0-9]*$/.test(name)) {
@@ -229,10 +229,11 @@ export async function generateDartReferenceDump(): Promise<{ methodCount: number
   await mkdir(dirname(OUT_PATH), { recursive: true })
   await writeFile(OUT_PATH, JSON.stringify(dump, null, 2))
 
-  if (skipped.length) {
+  if (orphaned.length) {
     throw new Error(
-      `Dart converter: ${skipped.length} ids have no section mapping (add them to ` +
-        `common-client-libs-sections.json or SECTION_OVERRIDE): ${skipped.join(', ')}`
+      `Dart converter: ${orphaned.length} ids have no section (they appear before any ` +
+        `section header in supabase_dart_v2.yml). Move them under a header, add a header ` +
+        `before them, or list them in SKIP_IDS if they are not methods: ${orphaned.join(', ')}`
     )
   }
 
diff --git a/apps/docs/spec/supabase_dart_v2.yml b/apps/docs/spec/supabase_dart_v2.yml
index 66393e48d8f32..67e2df89ca6c6 100644
--- a/apps/docs/spec/supabase_dart_v2.yml
+++ b/apps/docs/spec/supabase_dart_v2.yml
@@ -113,6 +113,9 @@ functions:
           );
           ```
 
+  - id: auth-api
+    title: 'Auth'
+    category: Auth
   - id: sign-up
     title: 'signUp()'
     description: |
@@ -1847,6 +1850,8 @@ functions:
           ```
   - id: auth-mfa-api
     title: 'Overview'
+    category: Auth
+    subcategory: Auth MFA
     notes: |
       This section contains methods commonly used for Multi-Factor Authentication (MFA) and are invoked behind the `supabase.auth.mfa` namespace.
 
@@ -2174,6 +2179,8 @@ functions:
           ```
   - id: passkey-api
     title: 'Auth Passkey'
+    category: Auth
+    subcategory: Auth Passkey
     notes: |
       This section contains methods for WebAuthn passkey registration, authentication, and management. Methods are invoked behind the `supabase.auth.passkey` namespace.
 
@@ -2330,6 +2337,8 @@ functions:
           ```
   - id: admin-api
     title: 'Overview'
+    category: Auth
+    subcategory: Auth Admin
     notes: |
       - Any method under the `supabase.auth.admin` namespace requires a `secret` key.
       - These methods are considered admin methods and should be called on a trusted server. Never expose your `secret` key in the Flutter app.
@@ -2828,6 +2837,8 @@ functions:
           ```
   - id: admin-passkey-api
     title: 'Passkey Admin API'
+    category: Auth
+    subcategory: Passkey Admin
     notes: |
       Contains passkey administration methods, accessed under the `supabase.auth.admin.passkey` namespace. Requires a `secret` key.
 
@@ -2875,6 +2886,9 @@ functions:
             passkeyId: '34e770dd-9ff9-416c-87fa-43b31d7ef225',
           );
           ```
+  - id: functions-api
+    title: 'Edge Functions'
+    category: Edge Functions
   - id: invoke
     title: 'invoke()'
     description: |
@@ -2923,6 +2937,9 @@ functions:
             },
           );
           ```
+  - id: database-api
+    title: 'Database'
+    category: Database
   - id: select
     description: |
       Perform a SELECT query on the table or view.
@@ -3929,6 +3946,9 @@ functions:
           Postgres functions that return tables can also be combined with [Filters](/docs/reference/dart/using-filters) and [Modifiers](/docs/reference/dart/using-modifiers).
         hideCodeBlock: true
 
+  - id: realtime-api
+    title: 'Realtime'
+    category: Realtime
   - id: subscribe
     description: |
       Subscribe to realtime changes in your database.
@@ -4211,6 +4231,8 @@ functions:
           ```
   - id: file-buckets
     title: 'Overview'
+    category: Storage
+    subcategory: File Buckets
     notes: |
       This section contains methods for working with File Buckets.
   # - id: analytics-buckets
@@ -5053,6 +5075,8 @@ functions:
           ```
   - id: using-modifiers
     title: Using Modifiers
+    category: Database
+    subcategory: Using modifiers
     description: |
       Filters work on the row level. That is, they allow you to return rows that
       only match certain conditions without changing the shape of the rows.
@@ -5671,6 +5695,8 @@ functions:
         isSpotlight: false
   - id: using-filters
     title: Using Filters
+    category: Database
+    subcategory: Using filters
     description: |
       Filters allow you to only return rows that match certain conditions.
 

From 9f5b36fb3b35b474f8225acaf507d1c57a319a28 Mon Sep 17 00:00:00 2001
From: Lukas Klingsbo <lukas.klingsbo@gmail.com>
Date: Mon, 20 Jul 2026 14:35:19 +0200
Subject: [PATCH 4/8] docs(dart): OAuth server, custom providers, realtime
 heartbeat & explain reference updates (#47728)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> **Stacked on #47994** (`docs/dart-reference-categories-in-yaml`).
Review/merge that first; GitHub will retarget this to `master` once it
lands.

## What

Adds Dart client library reference entries
(`apps/docs/spec/supabase_dart_v2.yml`) for features shipped in
[`supabase/supabase-flutter`](https://github.com/supabase/supabase-flutter)
(parity with `supabase-js`).

Rebuilt on the **new reference pipeline** (#47224 / #47994): each
method's section comes from `category` / `subcategory` fields on its own
YAML entry, with subcategory overviews as committed partials under
`spec/reference/dart/v2/partials/`. As a result this PR no longer
touches `common-client-libs-sections.json` or `supabase_js_v2.yml` (the
earlier shared-nav id rename is unnecessary now that Dart no longer
reads that file).

## Changes

**Auth (OAuth 2.1 server)** — new **OAuth Server** section
- `oauth.getAuthorizationDetails()`, `oauth.approveAuthorization()`,
`oauth.denyAuthorization()`

**Auth admin** — new **Custom Provider Admin** section
-
`admin.customProviders.listProviders/createProvider/getProvider/updateProvider/deleteProvider`,
including `customClaimsAllowlist`

**Realtime**
- `onHeartbeat`
- `onPostgresChanges` examples for the new pattern/negated filter
operators, multiple filters, and column selection

**Postgrest**
- `explain()` `format` option (`ExplainFormat.text` / `.json`)

## Pipeline plumbing

- New partials: `oauth-server.json`, `custom-provider-admin.json`
- `generate-dart-reference.ts`: registers `oauth-server-api` and
`admin-custom-providers-api` group-header ids in `HEADER_IDS`

## Source PRs

supabase-flutter: #1499, #1516, #1517, #1519, #1526

## Verification

`pnpm codegen:references:new` builds cleanly and the nav renders the new
**OAuth Server**, **Custom Provider Admin**, and Realtime
**onHeartbeat** entries.

## Notes

- `RealtimeChannelConfig.replicationReady` (#1526) is omitted since
there is no reference slot for channel-config options.
- The **OAuth Server** section also appears in #47971 (which adds
`listGrants` / `revokeGrant`). Whichever lands second should drop the
duplicate section header/partial and keep both sets of methods.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added OAuth 2.1 server consent-flow methods for retrieving, approving,
and denying authorization requests.
  * Added admin APIs for managing custom OIDC/OAuth providers.
* Added Realtime heartbeat monitoring and advanced Postgres change
filters.
  * Added text and JSON output options for query explanations.

* **Documentation**
* Expanded Dart API reference coverage across Auth, MFA, Passkeys,
Database, Realtime, and Storage.
* Added dedicated reference sections for OAuth Server and Custom
Provider administration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 apps/docs/scripts/generate-dart-reference.ts  |   2 +
 .../v2/partials/custom-provider-admin.json    |   5 +
 .../dart/v2/partials/oauth-server.json        |   5 +
 apps/docs/spec/supabase_dart_v2.yml           | 265 ++++++++++++++++++
 4 files changed, 277 insertions(+)
 create mode 100644 apps/docs/spec/reference/dart/v2/partials/custom-provider-admin.json
 create mode 100644 apps/docs/spec/reference/dart/v2/partials/oauth-server.json

diff --git a/apps/docs/scripts/generate-dart-reference.ts b/apps/docs/scripts/generate-dart-reference.ts
index df8c063e9c3f6..ae0d51361fdc2 100644
--- a/apps/docs/scripts/generate-dart-reference.ts
+++ b/apps/docs/scripts/generate-dart-reference.ts
@@ -61,6 +61,8 @@ const HEADER_IDS = new Set([
   'passkey-api',
   'admin-api',
   'admin-passkey-api',
+  'oauth-server-api',
+  'admin-custom-providers-api',
   'functions-api',
   'database-api',
   'realtime-api',
diff --git a/apps/docs/spec/reference/dart/v2/partials/custom-provider-admin.json b/apps/docs/spec/reference/dart/v2/partials/custom-provider-admin.json
new file mode 100644
index 0000000000000..4a2337aa94c93
--- /dev/null
+++ b/apps/docs/spec/reference/dart/v2/partials/custom-provider-admin.json
@@ -0,0 +1,5 @@
+{
+  "id": "custom-provider-admin",
+  "title": "Custom Provider Admin",
+  "notes": "- Methods under the `supabase.auth.admin.customProviders` namespace manage custom OIDC/OAuth providers programmatically. Requires a `secret` key.\n- These are admin methods and should be called on a trusted server. Never expose your `secret` key in the Flutter app.\n- Custom providers are referenced with a `custom:` prefix when signing in (for example `custom:mycompany`), and are distinct from the OAuth 2.1 server clients managed through `supabase.auth.admin.oauth`.\n"
+}
diff --git a/apps/docs/spec/reference/dart/v2/partials/oauth-server.json b/apps/docs/spec/reference/dart/v2/partials/oauth-server.json
new file mode 100644
index 0000000000000..4d8ea90b2b2f8
--- /dev/null
+++ b/apps/docs/spec/reference/dart/v2/partials/oauth-server.json
@@ -0,0 +1,5 @@
+{
+  "id": "oauth-server",
+  "title": "OAuth Server",
+  "notes": "Methods under the `supabase.auth.oauth` namespace are used when your Supabase project acts as an OAuth 2.1 server. They drive the user-facing consent flow and require a signed-in user. The OAuth 2.1 server feature must be enabled in your Supabase Auth configuration.\n"
+}
diff --git a/apps/docs/spec/supabase_dart_v2.yml b/apps/docs/spec/supabase_dart_v2.yml
index 67e2df89ca6c6..33db2972de40b 100644
--- a/apps/docs/spec/supabase_dart_v2.yml
+++ b/apps/docs/spec/supabase_dart_v2.yml
@@ -2335,6 +2335,81 @@ functions:
           final Session? session = res.session;
           final User? user = res.user;
           ```
+  - id: oauth-server-api
+    title: 'OAuth Server'
+    category: Auth
+    subcategory: OAuth Server
+    notes: |
+      Methods under the `supabase.auth.oauth` namespace are used when your Supabase project acts as an OAuth 2.1 server. They drive the user-facing consent flow and require a signed-in user. The OAuth 2.1 server feature must be enabled in your Supabase Auth configuration.
+  - id: oauth-get-authorization-details
+    title: 'oauth.getAuthorizationDetails()'
+    notes: |
+      Retrieves details about a pending OAuth authorization request so you can render a consent screen. The `authorizationId` is provided as a query parameter on the redirect URL that starts the flow.
+      - Returns a sealed `OAuthAuthorizationResponse`. Handle both variants: `OAuthAuthorizationDetailsResponse` carries the requesting `client` and requested `scope` for the consent screen, while `OAuthAuthorizationRedirectResponse` is returned when the user has already granted consent and only carries a `redirectUrl` to forward to.
+    params:
+      - name: authorizationId
+        isOptional: false
+        type: String
+        description: The unique identifier of the pending authorization request.
+    examples:
+      - id: get-authorization-details
+        name: Get authorization details
+        isSpotlight: true
+        code: |
+          ```dart
+          final authorizationId =
+              Uri.parse(currentUrl).queryParameters['authorization_id']!;
+
+          final response =
+              await supabase.auth.oauth.getAuthorizationDetails(authorizationId);
+
+          switch (response) {
+            case OAuthAuthorizationRedirectResponse(:final redirectUrl):
+              // The user already consented; forward them without a consent screen.
+              break;
+            case OAuthAuthorizationDetailsResponse(:final client, :final scope):
+              // Render a consent screen for `client` requesting `scope`.
+              break;
+          }
+          ```
+  - id: oauth-approve-authorization
+    title: 'oauth.approveAuthorization()'
+    notes: |
+      Approves a pending OAuth authorization request on behalf of the signed-in user. The response contains the redirect URL the user should be sent to.
+    params:
+      - name: authorizationId
+        isOptional: false
+        type: String
+        description: The unique identifier of the pending authorization request.
+    examples:
+      - id: approve-authorization
+        name: Approve authorization
+        isSpotlight: true
+        code: |
+          ```dart
+          final consent =
+              await supabase.auth.oauth.approveAuthorization(authorizationId);
+          // Redirect the user to consent.redirectUrl
+          ```
+  - id: oauth-deny-authorization
+    title: 'oauth.denyAuthorization()'
+    notes: |
+      Denies a pending OAuth authorization request on behalf of the signed-in user. The response contains the redirect URL the user should be sent to.
+    params:
+      - name: authorizationId
+        isOptional: false
+        type: String
+        description: The unique identifier of the pending authorization request.
+    examples:
+      - id: deny-authorization
+        name: Deny authorization
+        isSpotlight: true
+        code: |
+          ```dart
+          final consent =
+              await supabase.auth.oauth.denyAuthorization(authorizationId);
+          // Redirect the user to consent.redirectUrl
+          ```
   - id: admin-api
     title: 'Overview'
     category: Auth
@@ -2886,6 +2961,122 @@ functions:
             passkeyId: '34e770dd-9ff9-416c-87fa-43b31d7ef225',
           );
           ```
+  - id: admin-custom-providers-api
+    title: 'Custom OIDC/OAuth Provider Admin API'
+    category: Auth
+    subcategory: Custom Provider Admin
+    notes: |
+      - Methods under the `supabase.auth.admin.customProviders` namespace manage custom OIDC/OAuth providers programmatically. Requires a `secret` key.
+      - These are admin methods and should be called on a trusted server. Never expose your `secret` key in the Flutter app.
+      - Custom providers are referenced with a `custom:` prefix when signing in (for example `custom:mycompany`), and are distinct from the OAuth 2.1 server clients managed through `supabase.auth.admin.oauth`.
+  - id: admin-custom-providers-list
+    title: 'admin.customProviders.listProviders()'
+    notes: |
+      Lists all custom providers, optionally filtered by provider type.
+    params:
+      - name: type
+        isOptional: true
+        type: CustomProviderType
+        description: When set, only providers of this type are returned. Either `CustomProviderType.oauth2` or `CustomProviderType.oidc`.
+    examples:
+      - id: list-custom-providers
+        name: List custom providers
+        isSpotlight: true
+        code: |
+          ```dart
+          final List<CustomOAuthProvider> providers =
+              await supabase.auth.admin.customProviders.listProviders();
+          ```
+  - id: admin-custom-providers-create
+    title: 'admin.customProviders.createProvider()'
+    notes: |
+      Creates a new custom OIDC/OAuth provider. For OIDC providers, the server fetches and validates the discovery document at creation time and throws an `AuthException` with code `validation_failed` if it is unreachable or invalid.
+    params:
+      - name: params
+        isOptional: false
+        type: CreateCustomProviderParams
+        description: The provider configuration, including `providerType`, `identifier`, `name`, `clientId`, `clientSecret`, and optional fields such as `customClaimsAllowlist`.
+    examples:
+      - id: create-custom-provider
+        name: Create a custom provider
+        isSpotlight: true
+        code: |
+          ```dart
+          final CustomOAuthProvider provider =
+              await supabase.auth.admin.customProviders.createProvider(
+            CreateCustomProviderParams(
+              providerType: CustomProviderType.oidc,
+              identifier: 'custom:mycompany',
+              name: 'My Company',
+              clientId: 'client-id',
+              clientSecret: 'client-secret',
+              issuer: 'https://auth.mycompany.com',
+              customClaimsAllowlist: ['groups', 'org_id'],
+            ),
+          );
+          ```
+  - id: admin-custom-providers-get
+    title: 'admin.customProviders.getProvider()'
+    notes: |
+      Gets details of a specific custom provider by its identifier.
+    params:
+      - name: identifier
+        isOptional: false
+        type: String
+        description: The provider identifier, for example `custom:mycompany`.
+    examples:
+      - id: get-custom-provider
+        name: Get a custom provider
+        isSpotlight: true
+        code: |
+          ```dart
+          final CustomOAuthProvider provider =
+              await supabase.auth.admin.customProviders.getProvider('custom:mycompany');
+          ```
+  - id: admin-custom-providers-update
+    title: 'admin.customProviders.updateProvider()'
+    notes: |
+      Updates an existing custom provider. When `issuer` or `discoveryUrl` changes on an OIDC provider, the server re-fetches and validates the discovery document before persisting.
+    params:
+      - name: identifier
+        isOptional: false
+        type: String
+        description: The provider identifier, for example `custom:mycompany`.
+      - name: params
+        isOptional: false
+        type: UpdateCustomProviderParams
+        description: The fields to update on the provider.
+    examples:
+      - id: update-custom-provider
+        name: Update a custom provider
+        isSpotlight: true
+        code: |
+          ```dart
+          final CustomOAuthProvider provider =
+              await supabase.auth.admin.customProviders.updateProvider(
+            'custom:mycompany',
+            UpdateCustomProviderParams(
+              customClaimsAllowlist: ['groups', 'org_id', 'mail'],
+            ),
+          );
+          ```
+  - id: admin-custom-providers-delete
+    title: 'admin.customProviders.deleteProvider()'
+    notes: |
+      Deletes a custom provider by its identifier.
+    params:
+      - name: identifier
+        isOptional: false
+        type: String
+        description: The provider identifier, for example `custom:mycompany`.
+    examples:
+      - id: delete-custom-provider
+        name: Delete a custom provider
+        isSpotlight: true
+        code: |
+          ```dart
+          await supabase.auth.admin.customProviders.deleteProvider('custom:mycompany');
+          ```
   - id: functions-api
     title: 'Edge Functions'
     category: Edge Functions
@@ -4076,6 +4267,58 @@ functions:
                   })
               .subscribe();
           ```
+      - id: listen-with-pattern-and-negated-filters
+        name: Listen with pattern and negated filters
+        description: |
+          Besides equality, `PostgresChangeFilterType` supports `neq`, `lt`, `lte`, `gt`, `gte`, `inFilter`, `like`, `ilike`, `isFilter`, `match`, `imatch`, and `isDistinct`. Set `negate: true` to prefix the operator with `not.`.
+        code: |
+          ```dart
+          supabase
+              .channel('public:countries')
+              .onPostgresChanges(
+                  event: PostgresChangeEvent.all,
+                  schema: 'public',
+                  table: 'countries',
+                  filter: PostgresChangeFilter(
+                    type: PostgresChangeFilterType.ilike,
+                    column: 'name',
+                    value: '%land%',
+                    negate: true,
+                  ),
+                  callback: (payload) {
+                    print('Change received: ${payload.toString()}');
+                  })
+              .subscribe();
+          ```
+      - id: listen-with-multiple-filters
+        name: Listen with multiple filters
+        description: Pass a list of filters to `filters` to combine several conditions with `AND`. Use `select` to limit the change payload to a subset of columns.
+        code: |
+          ```dart
+          supabase
+              .channel('public:countries')
+              .onPostgresChanges(
+                  event: PostgresChangeEvent.update,
+                  schema: 'public',
+                  table: 'countries',
+                  filters: [
+                    PostgresChangeFilter(
+                      type: PostgresChangeFilterType.gte,
+                      column: 'population',
+                      value: 1000000,
+                    ),
+                    PostgresChangeFilter(
+                      type: PostgresChangeFilterType.eq,
+                      column: 'continent',
+                      value: 'Europe',
+                    ),
+                  ],
+                  select: ['id', 'name', 'population'],
+                  callback: (payload) {
+                    print('Change received: ${payload.toString()}');
+                  })
+              .subscribe();
+          ```
       - id: listen-to-broadcast
         name: Listen to broadcast messages
         code: |
@@ -4150,6 +4393,24 @@ functions:
           final channels = supabase.getChannels();
           ```
 
+  - id: on-heartbeat
+    description: |
+      A `Stream` that emits a status every time the Realtime client sends a heartbeat, receives an acknowledgement, or when a heartbeat goes unanswered.
+    title: 'onHeartbeat()'
+    notes: |
+      - Each event is a `RealtimeHeartbeatStatus`: `sent` when a heartbeat is pushed, `ok` or `error` when the server acknowledges it, and `timeout` when a prior heartbeat is not answered in time.
+      - Useful for observing connection health, for example to surface a reconnecting indicator in your UI.
+    examples:
+      - id: listen-to-heartbeat
+        name: Listen to heartbeat status
+        isSpotlight: true
+        code: |
+          ```dart
+          final subscription = supabase.realtime.onHeartbeat.listen((status) {
+            print('Heartbeat status: $status');
+          });
+          ```
+
   - id: stream
     description: |
       Returns real-time data from your table as a `Stream`.
@@ -5621,6 +5882,10 @@ functions:
         isOptional: true
         type: bool
         description: If `true`, include information on WAL record generation.
+      - name: format
+        isOptional: true
+        type: ExplainFormat
+        description: The output format of the execution plan. Either `ExplainFormat.text` (default) or `ExplainFormat.json`, in which case the plan is returned as a JSON string.
     examples:
       - id: get-execution-plan
         name: Get the execution plan

From 620c9329cf663ee494be8aebe24e1755b02e0c07 Mon Sep 17 00:00:00 2001
From: Ali Waseem <waseema393@gmail.com>
Date: Mon, 20 Jul 2026 06:45:20 -0600
Subject: [PATCH 5/8] fix(studio): prevent duplicate success toast on disk
 upgrade (#48097)

## Summary
Fixes FE-3948: two success toasts were firing after a disk upgrade. Now
the immediate toast is skipped when a disk resize is requested, since
the polling effect already shows a completion toast once the resize is
applied.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved disk settings update notifications to prevent premature
success messages while configuration changes are still being applied.
* Success confirmation now appears after disk resizing is fully
completed.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 .../interfaces/DiskManagement/DiskManagementForm.tsx       | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/apps/studio/components/interfaces/DiskManagement/DiskManagementForm.tsx b/apps/studio/components/interfaces/DiskManagement/DiskManagementForm.tsx
index 742568c4b5c47..778a790c3253c 100644
--- a/apps/studio/components/interfaces/DiskManagement/DiskManagementForm.tsx
+++ b/apps/studio/components/interfaces/DiskManagement/DiskManagementForm.tsx
@@ -301,9 +301,10 @@ export function DiskManagementForm() {
 
       setIsDialogOpen(false)
       form.reset(data as DiskStorageSchemaType)
-      toast.success(
-        `Successfully updated disk settings!${willUpdateDiskConfiguration ? ' The requested changes will be applied to your disk shortly.' : ''}`
-      )
+      // Disk resizes get their own completion toast once polling confirms it's applied
+      if (!willUpdateDiskConfiguration) {
+        toast.success('Successfully updated disk settings!')
+      }
     } catch (error: unknown) {
       setMessageState({
         message: error instanceof Error ? error.message : 'An unknown error occurred',

From b82dec4ef1e908dbb30fbd2907149b2831e7b7b9 Mon Sep 17 00:00:00 2001
From: Danny White <3104761+dnywh@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:17:00 -0400
Subject: [PATCH 6/8] fix(studio): polish advisor attention indicator quirks
 (#47714)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix / UI polish.

## What is the current behavior?

- The Advisors sidebar attention dot drifts 1–2px sideways on
hover-expand, because its `left` offset was tied to the expanded state
while the nav icon only shifts when the sidebar is persistently open.
- When the Advisor Center header button is selected while in a critical
state, it keeps a destructive outline instead of matching the other
header circles (`bg-foreground`).

## What is the new behavior?

- Sidebar attention dot offset follows the same condition as nav icon
padding (persistently open), so it no longer drifts on hover-expand.
- Selected Advisor Center button matches the other header circles
(foreground fill, no destructive outline). Critical idle styling is
unchanged aside from a destructive hover border. The critical dot is
slightly lighter when selected in light mode so it still contrasts on
the inverted fill.

## Additional context

Earlier commits on this branch experimented with a shared
`useAdvisorAttention` hook to sync the sidebar and header indicators.
That was dropped: the sidebar Advisors route goes to project
security/performance pages, while the header opens Advisor Center
(including org notifications). Those surfaces should not share one
attention definition — thanks Joshen for catching that.

---------

Co-authored-by: Joshen Lim <joshenlimek@gmail.com>
---
 apps/studio/components/interfaces/Sidebar.tsx      | 13 ++++++++++++-
 .../components/layouts/AppLayout/AdvisorButton.tsx | 14 ++++++++++++--
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/apps/studio/components/interfaces/Sidebar.tsx b/apps/studio/components/interfaces/Sidebar.tsx
index 994bc0e0e8acc..6f1d3af6a698d 100644
--- a/apps/studio/components/interfaces/Sidebar.tsx
+++ b/apps/studio/components/interfaces/Sidebar.tsx
@@ -226,10 +226,21 @@ export function SideBarNavLink({
 }
 
 const ActiveDot = ({ hasErrors, hasWarnings }: { hasErrors: boolean; hasWarnings: boolean }) => {
+  const [sidebarBehaviour] = useLocalStorageQuery(
+    LOCAL_STORAGE_KEYS.SIDEBAR_BEHAVIOR,
+    DEFAULT_SIDEBAR_BEHAVIOR
+  )
+
+  // The nav icon only shifts right (pl-1.5 -> pl-2) when the sidebar is
+  // persistently open — not on hover-expand. Tie the dot to the same
+  // condition so it stays put while skimming the nav.
+  const isPersistentlyOpen = sidebarBehaviour === 'open'
+
   return (
     <div
       className={cn(
-        'absolute pointer-events-none flex h-2 w-2 left-[18px] group-data-[state=expanded]:left-[20px] top-2 z-10 rounded-full',
+        'absolute pointer-events-none flex h-2 w-2 top-2 z-10 rounded-full',
+        isPersistentlyOpen ? 'left-[20px]' : 'left-[18px]',
         hasErrors ? 'bg-destructive-600' : hasWarnings ? 'bg-warning-600' : 'bg-transparent'
       )}
     />
diff --git a/apps/studio/components/layouts/AppLayout/AdvisorButton.tsx b/apps/studio/components/layouts/AppLayout/AdvisorButton.tsx
index efc5c3ae2a789..5006cd4034928 100644
--- a/apps/studio/components/layouts/AppLayout/AdvisorButton.tsx
+++ b/apps/studio/components/layouts/AppLayout/AdvisorButton.tsx
@@ -51,7 +51,11 @@ export const AdvisorButton = ({ projectRef }: { projectRef?: string }) => {
         id="advisor-center-trigger"
         className={cn(
           'rounded-full w-[32px] h-[32px] flex items-center justify-center p-0 group',
-          hasCriticalIssues && 'bg-destructive-200 border-destructive-500',
+          // Critical fill/border only when idle — selected matches the other
+          // header circles (foreground fill, no destructive outline).
+          hasCriticalIssues &&
+            !isOpen &&
+            'bg-destructive-200 border-destructive-500 hover:border-destructive',
           isOpen && 'bg-foreground text-background'
         )}
         onClick={handleClick}
@@ -72,7 +76,13 @@ export const AdvisorButton = ({ projectRef }: { projectRef?: string }) => {
         <span className="sr-only">Advisor Center</span>
       </ButtonTooltip>
       {hasCriticalIssues ? (
-        <span className="absolute top-1.5 right-1.5 w-1.5 h-1.5 rounded-full bg-destructive" />
+        <span
+          className={cn(
+            'absolute top-1.5 right-1.5 w-1.5 h-1.5 rounded-full',
+            // Slightly lighter on the inverted selected fill in light mode only.
+            isOpen ? 'bg-destructive-500 dark:bg-destructive' : 'bg-destructive'
+          )}
+        />
       ) : hasWarningIssues ? (
         <span className="absolute top-1.5 right-1.5 w-1.5 h-1.5 rounded-full bg-warning" />
       ) : hasUnreadNotifications ? (

From 64879ba4f2f36e4e48c73dca32cd6fe250e240b5 Mon Sep 17 00:00:00 2001
From: "supabase-supabase-autofixer[bot]"
 <248690971+supabase-supabase-autofixer[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 08:47:33 -0600
Subject: [PATCH 7/8] [bot] Decrease ESLint ratchet baselines (#48062)

Automated weekly decrease of ESLint ratchet baselines.

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 .../studio/.github/eslint-rule-baselines.json | 30 +++++++------------
 1 file changed, 11 insertions(+), 19 deletions(-)

diff --git a/apps/studio/.github/eslint-rule-baselines.json b/apps/studio/.github/eslint-rule-baselines.json
index f958116f06175..c9717ecb62b29 100644
--- a/apps/studio/.github/eslint-rule-baselines.json
+++ b/apps/studio/.github/eslint-rule-baselines.json
@@ -1,9 +1,9 @@
 {
   "rules": {
-    "react-hooks/exhaustive-deps": 161,
+    "react-hooks/exhaustive-deps": 160,
     "import/no-anonymous-default-export": 57,
     "@tanstack/query/exhaustive-deps": 9,
-    "@typescript-eslint/no-explicit-any": 887,
+    "@typescript-eslint/no-explicit-any": 875,
     "no-restricted-imports": 0,
     "no-restricted-exports": 193,
     "react/no-unstable-nested-components": 36,
@@ -11,7 +11,7 @@
     "jsx-a11y/aria-proptypes": 0,
     "jsx-a11y/role-supports-aria-props": 0,
     "jsx-a11y/anchor-has-content": 0,
-    "jsx-a11y/control-has-associated-label": 260,
+    "jsx-a11y/control-has-associated-label": 249,
     "jsx-a11y/label-has-associated-control": 36,
     "jsx-a11y/aria-role": 0,
     "jsx-a11y/no-redundant-roles": 4,
@@ -47,6 +47,7 @@
       "components/interfaces/Billing/Payment/PaymentConfirmation.tsx": 1,
       "components/interfaces/Billing/Payment/PaymentMethods/NewPaymentMethodElement.tsx": 1,
       "components/interfaces/ConnectSheet/content/steps/mcp/cursor/content.tsx": 1,
+      "components/interfaces/ConnectSheet/useConnectServerEnv.ts": 1,
       "components/interfaces/Database/Backups/PITR/TimeInput.tsx": 4,
       "components/interfaces/Database/Indexes/Indexes.tsx": 2,
       "components/interfaces/Database/Policies/PolicyEditorPanel/PolicyDetailsV2.tsx": 1,
@@ -74,7 +75,8 @@
       "components/interfaces/SQLEditor/InlineWidget.tsx": 2,
       "components/interfaces/SQLEditor/MoveQueryModal.tsx": 1,
       "components/interfaces/SQLEditor/OngoingQueriesPanel.tsx": 1,
-      "components/interfaces/SQLEditor/SQLEditor.tsx": 2,
+      "components/interfaces/SQLEditor/useSnippetIdentity.ts": 1,
+      "components/interfaces/SQLEditor/useSnippetTitleGenerator.ts": 1,
       "components/interfaces/Settings/Addons/CustomDomainSidePanel.tsx": 1,
       "components/interfaces/Settings/Addons/IPv4SidePanel.tsx": 1,
       "components/interfaces/Settings/Addons/PITRSidePanel.tsx": 1,
@@ -102,7 +104,7 @@
       "components/layouts/SQLEditorLayout/SQLEditorNavV2/SQLEditorTreeViewItem.tsx": 2,
       "components/layouts/SignInLayout/SignInLayout.tsx": 1,
       "components/layouts/Tabs/Tabs.utils.ts": 2,
-      "components/ui/Charts/ChartHighlightActions.tsx": 2,
+      "components/ui/Charts/ChartHighlightActions.tsx": 1,
       "components/ui/Charts/Charts.utils.tsx": 7,
       "components/ui/Charts/ComposedChartHandler.tsx": 1,
       "components/ui/CodeEditor/CodeEditor.tsx": 1,
@@ -111,7 +113,7 @@
       "components/ui/DataTable/DataTableSideBarLayout.tsx": 4,
       "components/ui/DataTable/DataTableViewOptions.tsx": 1,
       "components/ui/DataTable/LiveButton.tsx": 1,
-      "components/ui/DataTable/TimelineChart.tsx": 1,
+      "components/ui/DataTable/TimelineChart.tsx": 2,
       "components/ui/DatePicker/TimeSplitInput.tsx": 1,
       "components/ui/DateRangePicker.tsx": 1,
       "components/ui/FilterPopover.tsx": 1,
@@ -130,8 +132,6 @@
       "hooks/misc/useUpgradePrompt.tsx": 1,
       "lib/telemetry/track.ts": 1,
       "pages/forgot-password-mfa.tsx": 1,
-      "pages/integrations/vercel/[slug]/deploy-button/new-project.tsx": 1,
-      "pages/integrations/vercel/install.tsx": 1,
       "pages/logout.tsx": 1,
       "pages/new/index.tsx": 1,
       "pages/organizations.tsx": 1,
@@ -234,7 +234,7 @@
       "components/interfaces/Auth/AuthProvidersForm/AuthProvidersForm.types.ts": 1,
       "components/interfaces/Auth/AuthProvidersForm/FormField.tsx": 1,
       "components/interfaces/Auth/AuthProvidersForm/ProviderForm.tsx": 4,
-      "components/interfaces/Auth/AuthProvidersForm/index.tsx": 7,
+      "components/interfaces/Auth/AuthProvidersForm/index.tsx": 2,
       "components/interfaces/Auth/AuthProvidersFormValidation.tsx": 2,
       "components/interfaces/Auth/BasicAuthSettingsForm.tsx": 1,
       "components/interfaces/Auth/Overview/OverviewTable.tsx": 1,
@@ -247,7 +247,6 @@
       "components/interfaces/Auth/SmtpForm/SmtpForm.tsx": 2,
       "components/interfaces/Auth/Users/UserLogs.tsx": 1,
       "components/interfaces/Auth/Users/UserPanel.tsx": 1,
-      "components/interfaces/Auth/Users/Users.utils.tsx": 5,
       "components/interfaces/Auth/Users/UsersGridComponents.tsx": 2,
       "components/interfaces/Auth/Users/UsersV2.tsx": 6,
       "components/interfaces/Billing/Payment/AddNewPaymentMethodModal.tsx": 3,
@@ -344,7 +343,6 @@
       "components/interfaces/RoleImpersonationSelector/UserImpersonationSelector.tsx": 1,
       "components/interfaces/SQLEditor/MoveQueryModal.tsx": 2,
       "components/interfaces/SQLEditor/RenameQueryModal.tsx": 2,
-      "components/interfaces/SQLEditor/SQLEditor.tsx": 4,
       "components/interfaces/SQLEditor/SQLEditor.utils.ts": 1,
       "components/interfaces/SQLEditor/SQLTemplates/SQLExamples.tsx": 1,
       "components/interfaces/SQLEditor/SQLTemplates/SQLTemplates.tsx": 1,
@@ -354,6 +352,8 @@
       "components/interfaces/SQLEditor/UtilityPanel/UtilityPanel.tsx": 1,
       "components/interfaces/SQLEditor/hooks.ts": 1,
       "components/interfaces/SQLEditor/useAddDefinitions.ts": 1,
+      "components/interfaces/SQLEditor/useSqlEditorAi.ts": 3,
+      "components/interfaces/SQLEditor/useSqlEditorExecution.ts": 1,
       "components/interfaces/Settings/Database/NetworkRestrictions/AddRestrictionModal.tsx": 1,
       "components/interfaces/Settings/Database/NetworkRestrictions/NetworkRestrictions.utils.ts": 2,
       "components/interfaces/Settings/Infrastructure/InfrastructureActivity.tsx": 1,
@@ -434,7 +434,6 @@
       "components/layouts/SQLEditorLayout/SQLEditorNavV2/SQLEditorTreeViewItem.tsx": 2,
       "components/layouts/SQLEditorLayout/SQLEditorNavV2/SearchList.tsx": 1,
       "components/layouts/TableEditorLayout/EntityListItem.tsx": 1,
-      "components/layouts/TableEditorLayout/TableEditorMenu.tsx": 1,
       "components/ui/AIAssistantPanel/AIAssistant.utils.ts": 1,
       "components/ui/AIAssistantPanel/DisplayBlockRenderer.tsx": 1,
       "components/ui/AIAssistantPanel/MessageMarkdown.tsx": 1,
@@ -579,7 +578,6 @@
       "pages/api/platform/projects/[ref]/content/count.ts": 1,
       "pages/api/platform/projects/[ref]/content/index.ts": 1,
       "pages/api/platform/projects/[ref]/databases.ts": 1,
-      "pages/integrations/vercel/[slug]/deploy-button/new-project.tsx": 1,
       "pages/project/[ref]/functions/[functionSlug]/index.tsx": 3,
       "pages/project/[ref]/settings/log-drains.tsx": 1,
       "state/ai-assistant-state.tsx": 4,
@@ -832,7 +830,6 @@
       "components/interfaces/Account/AccessTokens/AccessTokenList.tsx": 1,
       "components/interfaces/Account/AccessTokens/AccessTokenNewBanner/AccessTokenNewBanner.tsx": 1,
       "components/interfaces/Account/AccessTokens/Classic/NewTokenButton.tsx": 1,
-      "components/interfaces/Account/AccessTokens/Scoped/Form/Permissions/Permissions.tsx": 1,
       "components/interfaces/Account/AccessTokens/Scoped/Form/ResourceAccess/ResourceOption.tsx": 1,
       "components/interfaces/Account/AccessTokens/Scoped/ScopedTokenList.tsx": 1,
       "components/interfaces/Account/Preferences/AnalyticsSettings.tsx": 1,
@@ -876,7 +873,6 @@
       "components/interfaces/Database/Replication/DestinationPanel/DestinationForm/AnalyticsBucket/Fields.tsx": 2,
       "components/interfaces/Database/Replication/DestinationPanel/DestinationForm/DuckLake/Fields.tsx": 2,
       "components/interfaces/Database/Replication/DestinationPanel/DestinationForm/Snowflake/Fields.tsx": 1,
-      "components/interfaces/Database/Replication/Destinations.tsx": 2,
       "components/interfaces/Database/Replication/ReadReplicas/ReadReplicaRow.tsx": 1,
       "components/interfaces/Database/Replication/ReplicationPipelineStatus/ReplicationPipelineStatus.tsx": 1,
       "components/interfaces/Database/Replication/RowMenu.tsx": 1,
@@ -933,7 +929,6 @@
       "components/interfaces/QueryInsights/QueryInsightsTable/QueryInsightsTable.tsx": 1,
       "components/interfaces/QueryInsights/hooks/useQueryInsightsTableColumns.tsx": 2,
       "components/interfaces/QueryPerformance/QueryPerformanceGrid.tsx": 1,
-      "components/interfaces/QueryPerformance/WithStatements/WithStatements.tsx": 2,
       "components/interfaces/QueryPerformance/components/FilterInput.tsx": 1,
       "components/interfaces/Realtime/Inspector/ChooseChannelPopover.tsx": 1,
       "components/interfaces/Realtime/Inspector/RealtimeFilterPopover/index.tsx": 3,
@@ -952,7 +947,6 @@
       "components/interfaces/Settings/Database/JitDatabaseAccess/JitDbAccessConfiguration.tsx": 1,
       "components/interfaces/Settings/Database/SSLConfiguration.tsx": 1,
       "components/interfaces/Settings/General/ComplianceConfig/ProjectComplianceMode.tsx": 1,
-      "components/interfaces/Settings/General/DeleteProjectPanel/DeleteProjectModal.tsx": 1,
       "components/interfaces/Settings/Infrastructure/InfrastructureConfiguration/InstanceConfiguration.tsx": 3,
       "components/interfaces/Settings/Infrastructure/InfrastructureConfiguration/InstanceNode.tsx": 2,
       "components/interfaces/Settings/Infrastructure/InfrastructureConfiguration/MapView.tsx": 1,
@@ -999,7 +993,6 @@
       "components/layouts/ProjectLayout/PauseFailedState.tsx": 1,
       "components/layouts/ProjectLayout/RestoreFailedState.tsx": 1,
       "components/layouts/TableEditorLayout/EntityListItem.tsx": 1,
-      "components/ui/AIAssistantPanel/AIAssistantChatSelector.tsx": 4,
       "components/ui/AIAssistantPanel/CollapsibleCodeBlock.tsx": 1,
       "components/ui/AdvisorPanel/AdvisorPanelBody.tsx": 1,
       "components/ui/AdvisorPanel/AdvisorSignalDetail.tsx": 1,
@@ -1011,7 +1004,6 @@
       "components/ui/Resource/ResourceItem.tsx": 1,
       "pages/project/[ref]/auth/templates/[templateId].tsx": 1,
       "pages/project/[ref]/branches/merge-requests.tsx": 1,
-      "pages/project/[ref]/database/policies.tsx": 1,
       "pages/project/[ref]/functions/index.tsx": 1,
       "pages/project/[ref]/observability/auth.tsx": 1,
       "pages/project/[ref]/observability/database.tsx": 1,

From 3d07613c2bc96c21aa9f74de23bc7a3ca2ca8dd0 Mon Sep 17 00:00:00 2001
From: Danny White <3104761+dnywh@users.noreply.github.com>
Date: Mon, 20 Jul 2026 10:59:34 -0400
Subject: [PATCH 8/8] fix(ui): restore text-contrast token (#48017)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

`text-contrast` / `text-foreground-contrast` resolve to
`--primary-foreground`, which is always the darker of surface /
foreground lightness (text for the green primary fill).

In light mode that is near-black, so contrast text on inverted fills is
wrong: on true black (`bg-black`) it disappears; on dark fills like
`bg-red-900` it shows as a black icon instead of white. Visible
regression on the design-system colour usage page: the `text-contrast`
swatch only shows "Postgres" on hover.

Regression from the colour system rewrite (#47288), which aliased
`--foreground-contrast` → `--primary-foreground`.

## What is the new behavior?

`--foreground-contrast` is defined again as a surface-based inverse of
`--foreground` (light in light mode, dark in dark mode). Tailwind
utilities `text-contrast` and `text-foreground-contrast` map to it.

`--primary-foreground` is unchanged and still used for text on the
primary fill.

## Additional context

### Callsites to test (light mode especially)

| Where to look | What to check |
|---|---|
| [Design system → Colour
usage](https://design-system-git-fix-text-contrast-token-supabase.vercel.app/design-system/docs/color-usage)
| Under **Text**, the `text-contrast` swatch shows "Postgres" without
hovering |
| [Studio staging → Auth
Users](https://studio-staging-git-fix-text-contrast-token-supabase.vercel.app/project/_/auth/users)
→ open any user | Boolean fields (e.g. confirmed): check/X on the black
circle should be **white** (not missing) |
| [Studio staging → Support
new](https://studio-staging-git-fix-text-contrast-token-supabase.vercel.app/support/new)
→ upload a file | Red remove (`X`) badge should be a **white** X (prod
currently shows black) |
| [www →
Contribute](https://zone-www-dot-com-git-fix-text-contrast-token-supabase.vercel.app/contribute)
→ apply at least one filter | Filter count badge: **white** number on
black |
| [Studio staging → Support
link](https://studio-staging-git-fix-text-contrast-token-supabase.vercel.app/support/link)
success state (after linking a ticket) | Check on the brand badge should
use contrast text (light on brand in light mode) |

`Announcement` (`text-foreground-contrast` dismiss icon) is not
currently mounted in any app — covered by the design-system / token
check above.
---
 packages/config/css/theme.css             | 4 ++--
 packages/ui/build/css/source/compat.css   | 2 +-
 packages/ui/build/css/source/semantic.css | 4 ++++
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/packages/config/css/theme.css b/packages/config/css/theme.css
index 081452ba09fa5..71b0255cd58c0 100644
--- a/packages/config/css/theme.css
+++ b/packages/config/css/theme.css
@@ -37,7 +37,7 @@
   --color-foreground-light: var(--muted-foreground);
   --color-foreground-lighter: var(--tertiary-foreground);
   --color-foreground-muted: var(--foreground-muted);
-  --color-foreground-contrast: var(--primary-foreground);
+  --color-foreground-contrast: var(--foreground-contrast);
   --color-background-200: var(--background-200);
   --color-background-alternative-200: var(--background-alternative-200);
   --color-background-alternative: var(--background-alternative-default);
@@ -346,7 +346,7 @@
   --text-color-light: var(--muted-foreground);
   --text-color-lighter: var(--tertiary-foreground);
   --text-color-muted: var(--foreground-muted);
-  --text-color-contrast: var(--primary-foreground);
+  --text-color-contrast: var(--foreground-contrast);
 
   /* misc theme tokens — typography, breakpoints, sizing, transform-origin */
   --font-sans: var(
diff --git a/packages/ui/build/css/source/compat.css b/packages/ui/build/css/source/compat.css
index f2806ed468b65..23ea0b3b44d37 100644
--- a/packages/ui/build/css/source/compat.css
+++ b/packages/ui/build/css/source/compat.css
@@ -16,7 +16,7 @@
   --foreground-light: var(--muted-foreground);
   --foreground-lighter: var(--tertiary-foreground);
   --foreground-muted: var(--tertiary-foreground);
-  --foreground-contrast: var(--primary-foreground);
+  /* --foreground-contrast lives in semantic.css — do not remap to --primary-foreground */
 
   /* Legacy background aliases */
   --background-default: var(--background);
diff --git a/packages/ui/build/css/source/semantic.css b/packages/ui/build/css/source/semantic.css
index 4734b7144f691..2e205a4c7ccd7 100644
--- a/packages/ui/build/css/source/semantic.css
+++ b/packages/ui/build/css/source/semantic.css
@@ -143,6 +143,10 @@
     calc(var(--surface) + var(--tone-span) * var(--contrast-text)) calc(var(--chroma) * 0.55)
       var(--surface-hue)
   );
+  /* Inverse of --foreground: canvas-coloured text for use on inverted fills
+     (bg-foreground, bg-black / dark:bg-white, etc). Not the same as
+     --primary-foreground, which stays dark for the vivid primary fill. */
+  --foreground-contrast: oklch(var(--surface) calc(var(--chroma) * 0.55) var(--surface-hue));
 
   --card: oklch(from var(--background) calc(l + var(--elevation-step) * var(--elevation-1)) c h);
   --card-foreground: var(--foreground);