## What kind of change does this PR introduce?
Surface the new scoped personal access token permissions published in
`@supabase/shared-types` 0.1.95 (added by
https://github.com/supabase/platform/pull/38060, now deployed).
**Stacked on #50234**, which regenerates the Management API types so
Studio's scope type includes the new ids. This PR targets that branch
and will retarget to `master` when it merges.
## What's in here
- Bump `@supabase/shared-types` to 0.1.95 (Studio and shared-data).
- Catalog entries in
`packages/shared-data/scoped-access-token-permissions.ts`:
- **API Key Secrets** (`api_gateway_keys_secret_read`): gates
`?reveal=true` on the API keys endpoints. Renamed from "JWT secret",
which described the wrong thing.
- **Data API JWT Secret** (`data_api_config_secret_read`): gates the
`jwt_secret` field on the PostgREST config endpoint.
- **Compute** (`workers_read` / `workers_write`): shared-types 0.1.95
also publishes the workers scopes, so they surface in the catalog now.
Named to match Studio's product naming (#50208).
- Minimum roles for the four new ids in `FGA_SCOPE_MINIMUM_ROLE`,
transcribed from the OpenFGA model (secret reads: developer; workers
read: readonly; workers write: developer).
- Docs generator (`generateAccessControlPartials.mts`):
- Drop the workers exclusion now that the scopes are live.
- When an endpoint lists alternative permission sets (for example API
keys read alone, or read plus secret read for reveal), a row's footnote
now only considers the alternatives that include that row's own scope.
Previously the API Key Secrets row would have said "Requires API Keys
(Read), or API Keys (Read) and API Key Secrets (Read)".
- Regenerated PAT guide tables. The committed Management API specs
predate the secret scopes, so this also includes the same spec refresh
the weekly docs bot performs (`chore(docs): refresh the Management API
specs`, kept as its own commit). Besides the new rows it picks up two
new upstream endpoints under Advisors and the branch rows.
## Verified
- `pnpm --filter studio typecheck` clean on top of #50234.
- Access token test suite passes, including the guard that the role
table covers exactly the ids shared-types publishes.
- Partial regeneration is idempotent, so the Docs Tests stale-table gate
passes.
## Follow-ups (not in this PR)
- `apps/docs/content/guides/getting-started/api-keys.mdx` says a
fine-grained token needs `api_gateway_keys_read` for the `?reveal=true`
example. It now also needs `api_gateway_keys_secret_read`.
- `project:api_gateway_keys` still says "Read exposes API keys" in its
risk reason, which overstates it now that secret values sit behind a
separate scope. Rewording may mean revisiting its risk level.
- The comment in `ComputeLayout.tsx` about shared-types not exposing
`workers_read` is stale.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added permission support for API key secrets, Data API JWT secrets,
and compute workers.
* Added API endpoints to run project advisors and create branches.
* Added support for additional log-drain destinations, including S3,
Last9, and OTLP.
* Added storage object versioning information to project configuration
responses.
* **Documentation**
* Updated access-control documentation for new permissions, worker
operations, advisor runs, and branch creation.
* Clarified Data API configuration and secret descriptions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com>
Add a guide that compares classic and scoped personal access tokens,
explains how account roles constrain token permissions, and walks
through creating and testing a project-scoped token. Include generated
tables mapping permissions to Management API endpoints and MCP tools,
and link the guide from docs navigation and Studio token sheets.
Move the scoped-token permission catalog from Studio into shared-data.
Studio and docs generation now share permission names, categories,
descriptions, risk metadata, modes, scopes, and display order.
Generate the tables from the shared catalog, OpenAPI
x-fga-permissions, and the downloaded MCP permission map. Exclude
Workers permissions until the feature is live.
Run regeneration through the docs Makefile, verify checked-in output in
CI, and refresh it in the weekly Management API workflow. Add Dashboard
and Docs ownership plus contributor guidance so permission changes stay
synchronized.
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / dependency tooling update.
## What is the current behavior?
The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.
## What is the new behavior?
The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.
## Additional context
Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.
* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
https://linear.app/supabase/issue/FE-2226/fix-incorrect-baseline-and-max-iopsthroughput-values
- Centralized compute/disk limits in
packages/shared-data/compute-disk-limits.ts (MB/s, baseline+max
IOPS/throughput) and re-exported from shared-data.
- Hooked Docs compute/disk table into shared data, converted docs
text/table to MB/s baseline/max.
- Removed duplicated compute IOPS/throughput constants from Studio,
Studio now imports shared data.
- Updated Studio disk schema: compute-aware MAX IOPS/throughput
validation (MB/s), defaults computeSize to ci_micro, and gp3/io2 checks
use compute caps.
- Clarified disk update mutation to send throughput as MB/s despite
backend throughput_mbps field name.
- Added tests for compute-size mappings and IOPS helper logic.
- Added Infra ownership for shared compute/disk data in CODEOWNERS.
- Locked zod version via catalog and added zod dep to shared-data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a reusable Compute Disk Limits table and centralized compute
disk limits dataset for dynamic display.
* **Documentation**
* Replaced static per-size tables with a component-driven MB/s view;
clarified baseline vs. burst behavior and updated guides and
troubleshooting.
* **Bug Fixes**
* Validation and UI guidance now honor compute-size limits for IOPS and
throughput.
* **Tests**
* Expanded unit tests for sizing, mappings, and edge cases.
* **Chores**
* Published shared-data exports, added a validation schema, pinned a
dependency, and added ownership entries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Fix some missing and duplicate dependencies.
* Fix the types for jest in ai-commands package.
* Replace all npm commands with pnpm. Add pnpm files and workspace links.
* Fix rimraf to work with pnpm.
* Refactor the github actions to work with pnpm.
* Delete package-lock.json.
* Fix the tailwind configs to not include node_modules.
* Fix random files.
* Add preinstall scripts to all packages.
* Fix the Dockerfile to work with pnpm.
* Update the DEVELOPERS documentation.
Gildas Garcia