[pull] master from supabase:master - #1159

## What kind of change does this PR introduce?

Chore — adds Matt Robinson to `apps/docs/public/humans.txt`, inserted in
alphabetical order (between Matt Johnston and Matt Rossman).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

## Problem

The database debugging and monitoring guide had the generic title
"Debugging and monitoring", which lacked product context and made it
unclear in search results or breadcrumbs which area it covered.

## Fix

Changed the page title to "Database debugging and monitoring". The
sidebar entry keeps its shorter "Debugging and monitoring" label since
it already has database section context.

## How to test

- Navigate to the database debugging and monitoring guide in the docs
- Confirm the page H1 reads "Database debugging and monitoring"
- Confirm the sidebar entry still reads "Debugging and monitoring"

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated the guide title to “Database debugging and monitoring” for
clearer navigation and context.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## Summary

Updates docs based on recent SDK changes across three of the six tracked
SDKs. `supabase-py`, `supabase-kt`, and `supabase-csharp` were also
analyzed this cycle but had no doc-worthy changes (internal bug fixes /
dependency bumps only, or no new commits).

## Changes analyzed

| SDK | Repo | Commits | Latest tag |
|---|---|---|---|
| js | https://github.com/supabase/supabase-js | `485695ff7...21e410f56`
| v3.0.0-next.29 |
| dart | https://github.com/supabase/supabase-flutter |
`6979093...5447063` | yet_another_json_isolate-v2.1.1 |
| py | https://github.com/supabase/supabase-py | `3c98900...0490201` |
v3.0.0a1 |
| swift | https://github.com/supabase/supabase-swift |
`c24795d...51a083a` | v2.54.1 |
| kt | https://github.com/supabase-community/supabase-kt | (no new
commits) | 3.7.0 |
| csharp | https://github.com/supabase-community/supabase-csharp |
`572624e...ac057a2` | v1.5.0 |

## Documentation updates

- **`apps/docs/content/guides/auth/sessions/pkce-flow.mdx`** — new
"Overlapping flows" section documenting the experimental
`appendPkceFlowIdToRedirects` option and `flowId`-aware
`exchangeCodeForSession()`, added in supabase-js #2569, which fixes
concurrent PKCE flows (e.g. multiple tabs) clobbering each other's
stored code verifier.
- **`apps/docs/spec/supabase_dart_v2.yml`** — `stream()` entry:
documented the new filter methods (`like`, `ilike`, `match`, `imatch`,
`isFilter`, `isDistinct`) and multi-filter chaining added in
supabase-flutter #1610, plus two behavioral caveats (filter
re-evaluation on UPDATE, primary-key-only DELETE payloads) and a new
example.
- **`apps/docs/spec/supabase_swift_v2.yml`**:
- `invoke()` entry: documented the new `timeoutInterval` override on
`FunctionInvokeOptions` (supabase-swift #1144), with a new example.
- Added missing `generate-link` and `signOut()` (admin) spec entries —
supabase-swift #1152 added these methods but Swift had no reference
entries for them, even though the shared nav ids already existed in
`common-client-libs-sections.json` for other SDKs.

## Test plan

- [x] `python3 -c "import yaml; yaml.safe_load(...)"` on both edited
YAML spec files — parses cleanly
- [x] `npx prettier --check` on all three changed files — passes
- [ ] Visual check of rendered reference pages for the new Swift
`generate-link` / `signOut` / timeout examples and the Dart `stream()`
multi-filter example (docs dev server)

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Documentation**
- Added guidance for experimental overlapping PKCE authentication flows,
including separating concurrent flows and exchanging their flow IDs.
- Expanded Dart streaming documentation with filter operators,
multiple-filter behavior, update semantics, delete payloads, and
chained-filter examples.
- Added Swift documentation for admin link generation, user sign-out,
and configurable Edge Function timeouts.
- Documented the default 150-second Edge Function idle timeout and
per-invocation timeout overrides.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

…eystroke (#48956)

## What kind of change does this PR introduce?

Bug fix.

## What is the current behavior?

With a snippet already open in the SQL Editor, clicking the `+` button
and typing in the new tab made it look like the previously open tab was
being taken over: the tab bar showed the *old* snippet's name while the
editor showed the newly typed content. With several tabs open, the
rightmost one appeared to be the one taken over.

`useSqlEditorTabsCleanup` prunes any `sql-*` tab whose snippet is absent
from the server-fetched snippet list, so tabs for snippets deleted in
another session don't linger. But a snippet created by typing in a new
tab exists only in the local store until its first save lands, so it is
legitimately absent from that list — and the same keystroke that creates
it calls `setSql({ shouldInvalidate: true })`, invalidating the snippet
lists and triggering a refetch that pruned the tab that had just been
opened.

`removeTab` then reassigns `activeTab` to a neighbor, so the tab bar
fell back to whichever tab was open before, while the URL, sidebar, and
editor content all stayed correctly on the new snippet — none of them
read from the tabs store.

Confirmed from a user's persisted tab state, which showed a single tab
in `openTabs` pointing at the previous snippet while the URL pointed at
the new one.

No snippet content was ever lost — this was tab state only.

## What is the new behavior?

Tabs (and recent items) whose snippet is present in the local store with
a never-persisted status (`new`, `new_saving`, `new_save_failed`) are
preserved by the cleanup pass. Genuine stale-tab pruning for snippets
removed outside the session is unaffected.

## Additional context

The regression test in `Tabs.utils.test.tsx` fails without the fix
(`expected undefined to be defined`) and passes with it. The
pre-existing pruning tests still pass, confirming legitimate cleanup
still works.

Also adds two tests covering adjacent invariants that were verified
while narrowing this down: snippet content isolation between tabs, and
unique snippet id generation across `/sql/new` navigations.

Verified: 343 tests pass across `components/layouts/Tabs` and
`components/interfaces/SQLEditor`; typecheck clean; ESLint warning count
unchanged (ratchet safe); Prettier clean.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Bug Fixes**
- Preserved newly created SQL editor tabs and recent items before their
first save.
  - Prevented unsaved snippets from being removed during tab cleanup.
- Ensured editing a new tab does not overwrite content in existing tabs.
  - Ensured successive new SQL tabs receive distinct identities.

- **Tests**
- Added regression coverage for snippet editing, route changes, and tab
cleanup behavior.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## Summary
- Adds `update_notebook`, an AI tool (`needsApproval: true`) that
re-fetches a notebook, applies an ordered list of cell operations
(insert/replace/delete/move, from `notebook-operations.ts`) via
`applyNotebookOperations`, and PUTs the resolved content. Concurrent
edits are last-write-wins, since re-fetching at execute time is the only
mitigation per the RFC.
- Registers `update_notebook` in `toolSetValidationSchema` /
`TOOL_CATEGORY_MAP`, and documents it in the notebooks system prompt.
- The untrusted→safe SQL promotion
(`acceptUntrustedSql`/`acceptUntrustedLogsSql`) is inlined directly
inside each `needsApproval: true` tool's own `execute` (both
`create_notebook` and `update_notebook`), rather than behind a shared
helper — kept auditable right next to the approval gate that authorizes
it, and not reusable by an unrelated caller unaware it needs
re-promotion.

Resolves FE-4083

## Test plan
- [x] `notebook-tools.test.ts`: re-fetch → apply operations → PUT with
promoted SQL; descriptive error (no PUT) when an operation targets an
unknown cell id; `needsApproval` asserted for both create and update
- [x] `pnpm vitest run` on `notebook-tools.test.ts`,
`tools/index.test.ts`, `tool-filter.test.ts` — all pass
- [x] `tsc --noEmit`, `eslint`, `prettier --check` — clean on all
touched files

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* AI-assisted notebook editing now supports updating existing notebooks.
* Notebook changes are refreshed before being applied to help preserve
the latest content.
* Updates report operation errors and return a summary of the modified
notebook.
  * Notebook edits require user approval before being saved.

* **Bug Fixes**
* Invalid or unknown cell references are reported without applying a
partial update.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## Summary
- Adds deterministic `list_notebooks`/`get_notebook` fixtures (two
seeded notebooks, each with markdown/database/log cells) and stateful
in-memory `create_notebook`/`update_notebook` mocks to
`apps/studio/lib/ai/tools/mock-tools.ts`, so Braintrust evals can
exercise notebook tool calls without a real project.
- Both write-tool mocks force `needsApproval: false`, matching the
existing `execute_sql`/`deploy_edge_function` mock pattern — the eval
harness filters out tool-parts in `'approval-requested'` state and can
never answer an approval gate.
- All four notebook tools are wrapped from the real `getNotebookTools()`
definitions (only `execute`/`needsApproval` overridden), so evals
validate the model's arguments against the exact production schemas.
- Dedupes `describeOperationError` (previously duplicated between this
new mock and `notebook-tools.ts`) into a single exported
`describeNotebookOperationError` in `notebook-operations.ts`.

**Stacked on #48949** (`feature/notebooks-update-tool`) — this PR's base
branch is that PR, not `master`, because it reuses `update_notebook` and
the shared error helper that only exist there. Merge #48949 first, then
retarget/merge this one.

## Test plan
- [x] \`pnpm --filter studio typecheck\` passes
- [x] \`pnpm --filter studio test\` — all notebook-related suites pass
(\`mock-tools.test.ts\`, \`notebook-tools.test.ts\`,
\`data/content/notebooks/*\`)
- [x] \`eslint\` / \`prettier --check\` clean on all touched files

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Update to customer stories section on www

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

<img width="1021" height="691" alt="Screenshot 2026-08-11 at 3 23 03 PM"
src="https://github.com/user-attachments/assets/ee44f874-1cdf-47d6-bb63-6cdd8f85563a"
/>
<img width="1016" height="661" alt="Screenshot 2026-08-11 at 3 23 09 PM"
src="https://github.com/user-attachments/assets/97e84189-4351-489f-831f-f938a461e1dd"
/>
<img width="1011" height="661" alt="Screenshot 2026-08-11 at 3 23 13 PM"
src="https://github.com/user-attachments/assets/48ebdb06-6d6d-4711-ae5e-31cd513b144b"
/>
<img width="1036" height="677" alt="Screenshot 2026-08-11 at 3 23 17 PM"
src="https://github.com/user-attachments/assets/576aae48-33a3-4fe0-bc71-e6a0e3342608"
/>
<img width="1025" height="690" alt="Screenshot 2026-08-11 at 3 23 20 PM"
src="https://github.com/user-attachments/assets/5b7616f7-e968-4cbf-bd18-67de73904f14"
/>

## Additional context

Add any other context or screenshots.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Content Updates**
* Refreshed the customer stories section with new featured companies,
testimonials, icons, colors, and visual gradients.

* **Responsive Design**
* Updated the layout breakpoint to improve the transition between mobile
and desktop presentations.
* Improved icon rendering with optional scaling for better visual
balance.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## What kind of change does this PR introduce?

Chore — adds Pierre Frances to `apps/docs/public/humans.txt`, inserted
in alphabetical order (after Pierre Ducroquet).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

The agent skills docs page covered installing skills but not upgrading
them, and skill fixes/features (like the debugging skill, only available
from v0.1.8) can go unnoticed if users never re-run the CLI. Adds an
**Upgrading skills** section with the `npx skills update` command and a
link to the [`skills update`
docs](https://github.com/vercel-labs/skills#skills-update).

### Preview

<img width="813" height="611" alt="image"
src="https://github.com/user-attachments/assets/c4b96316-f2d1-4b8a-b7bd-a868156447d5"
/>




[source](https://docs-git-docs-add-update-agent-skills-step-to-docs-supabase.vercel.app/docs/guides/ai-tools/ai-skills)

Closes
[AI-1066](https://linear.app/supabase/issue/AI-1066/add-agent-skills-upgrade-step-to-docs-page).

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Added an “Upgrading skills” guide explaining how to update all or
selected installed skills.
  * Included links to additional documentation for more details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## What kind of change does this PR introduce?

Chore — adds Yara Lacerda to `apps/docs/public/humans.txt`, inserted in
alphabetical order (between Wendie Cheung and Yorvi Arias).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…ubleshooting guide (#48998)

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

docs update

## What is the current behavior?


## What is the new behavior?


## Additional context

Add any other context or screenshots.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Expanded troubleshooting guidance for re-enabling the Data API after
applying the schema exposure workaround.
  * Clarified the steps and context for reversing the workaround.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

The database testing docs currently show test files using the
`.test.sql` suffix, but `supabase test new` generates `_test.sql` files.

Both formats work, but the generator behavior matches the previous Go
CLI implementation and existing test fixtures. Update the docs for
consistency with the actual generated file naming.

Relevant context: [database testing
docs](<https://supabase.com/docs/guides/database/testing>) and
[CLI-1318](<https://linear.app/supabase/issue/CLI-1318/port-supabase-test-db-supabase-test-new>).

We might want to add `supabase test new` to the docs, but that's a
separate change.

## What is the current behavior?

It reports `.test.sql`

## What is the new behavior?

it reports `_test.sql` inline with the generator

## Additional context

[slack
thread](https://supabase.slack.com/archives/C07E5GFAHTM/p1786373594478619)
- we can also add the test generator to the docs but I think that's a
separate issue.