[pull] master from supabase:master

.agents/skills/ask-the-docs/SKILL.md

@@ -87,7 +87,7 @@ at hand — they cite each other where context matters.
 | [`reference/llm-agent-parity.md`](./reference/llm-agent-parity.md)                 | HTML↔markdown fidelity (e.g. AI prompts), search caveat, agent onboarding guides, in-flux wiring.                                                     |
 | [`reference/federated-docs.md`](./reference/federated-docs.md)                     | How docs pulls markdown from external repos at build time. Routes, `pageMap`, remark/rehype plugins, link transforms, known failure modes.            |
 | [`reference/ci-and-lint.md`](./reference/ci-and-lint.md)                           | GitHub Actions on every PR — `docs_lint`, `Docs Tests`, typecheck, prettier, Vercel preview gate. Where to add a check before creating a new one.     |
-| [`reference/management-api-reference.md`](./reference/management-api-reference.md) | Management API OpenAPI download → Redocly bundle → codegen → `ApiEndpointSection`; why not to swap in Scalar/Redoc.                                   |
+| [`reference/management-api-reference.md`](./reference/management-api-reference.md) | Management API OpenAPI → reference generation, including scoped PAT permission tables; why not to swap in Scalar/Redoc.                               |
 | [`reference/gotchas.md`](./reference/gotchas.md)                                   | Specific traps to watch for. One-liner per item.                                                                                                      |
 
 ## How to use during a chat

.agents/skills/ask-the-docs/reference/ci-and-lint.md

@@ -14,7 +14,7 @@ PR opened / updated
     │
     ├── docs_lint                  (MDX/content linting; required)
     ├── docs_lint_comment_external (posts results as PR comments for external PRs)
-    ├── Docs Tests                 (pnpm test:docs on .ts* file changes)
+    ├── Docs Tests                 (pnpm test:docs on relevant docs code/spec changes)
     ├── TypeScript & Lint          (tsc + eslint)
     ├── Prettier                   (format check)
     ├── reviewdog                  (inline annotations)
@@ -36,15 +36,16 @@ check before merging.** Backed by `supa-mdx-lint`.
 
 ### 2. Docs Tests (`docs-tests.yml`)
 
-Triggered on PRs to master when files matching `apps/docs/**/*.ts*` or
-`apps/docs/spec/**/*.json` change. Runs on a Blacksmith 4-vCPU Ubuntu runner
-with concurrency controls to cancel stale builds.
+Triggered on relevant docs code/spec changes, including the generated scoped
+PAT partials and their shared permission catalog. Runs on a Blacksmith 4-vCPU
+Ubuntu runner with concurrency controls to cancel stale builds.
 
 - Sparse checkout of `apps/docs`, `examples`, `packages`, `supabase`, and
   `patches`.
 - Install pnpm (pinned hash).
 - Set up Node.js from `.nvmrc`.
 - `pnpm install --frozen-lockfile`.
+- Regenerate the scoped PAT partials and fail if the committed output drifts.
 - Run `pnpm run test:docs` (with dummy GitHub OAuth env vars to prevent local
   Supabase startup errors).
 

.agents/skills/ask-the-docs/reference/llm-agent-parity.md

@@ -80,10 +80,6 @@ runtime (`AiSkills.utils.ts`). See [`federated-docs.md`](./federated-docs.md).
 
 ## In-flux / stale wiring
 
-- `apps/docs/.gitignore` lists `public/llms/` as generated by
-  `build:llms`, but **`build:llms` is not in `package.json`** today.
-  Per-source `llms/*.txt` links in `/llms.txt` may point at assets whose
-  generation path is unclear — verify before depending on them.
 - `llms-full.txt` fetches reference markdown from
   `${NEXT_PUBLIC_DOCS_URL}/markdown/reference/<slug>.md` at runtime.
 

.agents/skills/ask-the-docs/reference/management-api-reference.md

@@ -92,6 +92,15 @@ the custom cycle-safe resolve remains required.
 | `apps/docs/features/docs/Reference.sections.tsx`        | `ApiEndpointSection` UI                      |
 | `apps/docs/internals/generate-reference-markdown.ts`    | agent markdown export                        |
 
+## Scoped personal access token permission tables
+
+The "Personal Access Tokens" guide's permission and MCP tables are generated
+from the Management API specs, MCP permission map, and the same shared catalog
+Studio uses. Regenerate `content/_partials/access-control/scoped_pat_*.mdx` with
+`make -C apps/docs/spec generate.partials.access-control`. Docs Tests runs this
+on relevant pull requests and fails if the partials drift; the weekly Management
+API update also runs it after refreshing the live inputs.
+
 ## Related
 
 - [`build-pipeline.md`](./build-pipeline.md) — where `codegen:references`

.claude/CLAUDE.md

@@ -41,7 +41,7 @@ pnpm api:codegen             # platform Management API types → packages/api-ty
 
 Every PR must pass typecheck + lint (one workflow), Prettier, and a typos check. Other checks are path-filtered: Studio unit tests/build and the lint ratchet (ESLint warning count must not increase) run on `apps/studio/**` changes; app-specific test suites run on their own paths.
 
-Never hand-edit generated files: `packages/api-types/types/**`, `**/routeTree.gen.ts`, `**/__generated__/**`, `apps/docs/features/docs/generated/**`, `apps/www/.generated/**`, `supabase/functions/common/database-types.ts`.
+Never hand-edit generated files: `packages/api-types/types/**`, `**/routeTree.gen.ts`, `**/__generated__/**`, `apps/docs/features/docs/generated/**`, `apps/www/.generated/**`, `supabase/functions/common/database-types.ts`, `apps/docs/content/_partials/access-control/scoped_pat_*.mdx` (run `make -C apps/docs/spec generate.partials.access-control`).
 
 ## Conventions
 

.github/CODEOWNERS

@@ -1,6 +1,7 @@
 /packages/ui/  @supabase/design
 /packages/shared-data/pricing.ts @supabase/billing
 /packages/shared-data/plans.ts @supabase/billing
+/packages/shared-data/scoped-access-token-permissions.ts @supabase/Dashboard @supabase/docs
 /packages/common/telemetry-constants.ts @supabase/growth-eng
 /packages/dev-tools/ @supabase/growth-eng
 # /packages/pg-meta @supabase/postgres @avallete

.github/workflows/docs-mgmt-api-update.yml

@@ -3,7 +3,7 @@ name: Update Mgmt Api Docs
 on:
   schedule:
     # Run at 00:00 UTC every Monday
-    - cron: "0 0 * * 1"
+    - cron: '0 0 * * 1'
   workflow_dispatch:
 
 permissions:
@@ -19,10 +19,13 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ github.ref }}
+          # The PAT tables generator imports the shared catalog and its base tsconfig.
           sparse-checkout: |
             apps/docs
             patches
             packages/generator
+            packages/shared-data
+            packages/tsconfig
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         name: Install pnpm
@@ -32,15 +35,15 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version-file: ".nvmrc"
-          cache: "pnpm"
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
 
       - name: Install deps
         run: pnpm install --frozen-lockfile
 
-      - name: Change to apps/docs/spec directory and run make command
+      - name: Refresh Management API docs
         working-directory: apps/docs/spec
-        run: make download.api.v1 dereference.api.v1 generate.sections.api.v1 format
+        run: make download.api.v1 download.mcp-tools-permissions dereference.api.v1 generate.sections.api.v1 generate.partials.access-control format
 
       - name: Generate token
         id: app-token
@@ -55,8 +58,18 @@ jobs:
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: "feat: update mgmt api docs"
-          title: "feat: update mgmt api docs"
-          body: "This PR updates mgmt api docs automatically."
-          branch: "gha/auto-update-mgmt-api-docs"
-          base: "master"
+          commit-message: 'feat: update mgmt api docs'
+          title: 'feat: update mgmt api docs'
+          body: |
+            This PR updates Management API docs automatically.
+
+            This regenerates:
+
+            - Management API specs and sections
+            - Personal Access Tokens permission-to-endpoint table
+            - Personal Access Tokens MCP tool permissions table
+
+            Sources include the live Management API specs, MCP permission map,
+            and Studio's shared permission catalog.
+          branch: 'gha/auto-update-mgmt-api-docs'
+          base: 'master'

.github/workflows/docs-tests.yml

@@ -6,8 +6,13 @@ on:
     paths:
       - 'apps/docs/**/*.ts*'
       - 'apps/docs/spec/**/*.json'
+      - 'apps/docs/spec/Makefile'
+      - 'apps/docs/spec/sections/generateAccessControlPartials.mts'
+      - 'apps/docs/content/_partials/access-control/**'
       - 'apps/docs/.env.development'
       - 'apps/docs/package.json'
+      - 'packages/shared-data/package.json'
+      - 'packages/shared-data/scoped-access-token-permissions.ts'
       - 'e2e/docs/local-smoke/**'
       - 'e2e/docs/playwright.local-smoke.config.ts'
       - 'e2e/docs/package.json'
@@ -52,6 +57,13 @@ jobs:
       - name: Install deps
         run: pnpm install --frozen-lockfile
 
+      - name: Check access-control partials
+        run: |
+          make -C apps/docs/spec generate.partials.access-control
+          git diff --exit-code -- \
+            apps/docs/content/_partials/access-control/scoped_pat_permissions.mdx \
+            apps/docs/content/_partials/access-control/scoped_pat_mcp_tools.mdx
+
       - name: Download JS reference TypeDoc dumps
         # The source dumps under apps/docs/spec/reference/<lib>/<ver>/*.json are
         # gitignored — `make download.tsdoc.v2` re-fetches them from

.github/workflows/www-tests.yml

@@ -10,6 +10,7 @@ on:
       - 'apps/www/lib/**/*.js'
       - 'apps/www/content/md/**'
       - 'apps/www/scripts/**/*.mjs'
+      - 'apps/www/public/.well-known/**'
 
 # Cancel old builds on new commit for same workflow + branch/PR
 concurrency:

apps/design-system/app/(app)/page.tsx

@@ -1,4 +1,4 @@
-import { Auth, Database, Realtime } from 'icons/src/icons'
+import { Auth, Database, Realtime } from 'icons'
 import { Paintbrush } from 'lucide-react'
 import Link from 'next/link'
 

apps/design-system/components/colors.tsx

@@ -1,9 +1,10 @@
 import { useState } from 'react'
-import { cn } from 'ui'
-import color from 'ui/src/lib/tailwind-demo-classes'
+import { cn, colors } from 'ui'
 
 import { Grid, GridItem } from './grid'
 
+const color = colors['default']
+
 const Colors = ({
   definition,
 }: {

apps/design-system/content/docs/components/alert.mdx

@@ -18,7 +18,7 @@ Use [Collapsible Alert](../fragments/collapsible-alert) when a callout also need
 ## Usage
 
 ```tsx
-import { Alert, AlertDescription, AlertTitle } from 'ui/src/components/shadcn/ui/alert'
+import { Alert, AlertDescription, AlertTitle } from 'ui'
 ```
 
 ```tsx
@@ -36,5 +36,5 @@ import { Alert, AlertDescription, AlertTitle } from 'ui/src/components/shadcn/ui
 Use `alertVariants` when building shared wrappers around the primitive.
 
 ```tsx
-import { alertVariants } from 'ui/src/components/shadcn/ui/alert'
+import { alertVariants } from 'ui'
 ```

apps/design-system/content/docs/components/collapsible.mdx

@@ -13,11 +13,7 @@ Use Collapsible for generic disclosure behaviour: rows, sections, menus, tool de
 ## Usage
 
 ```tsx
-import {
-  Collapsible,
-  CollapsibleContent,
-  CollapsibleTrigger,
-} from 'ui/src/components/shadcn/ui/collapsible'
+import { Collapsible, CollapsibleContent, CollapsibleTrigger } from 'ui'
 ```
 
 ```tsx

apps/design-system/registry/default/example/commandmenu-badge.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@ui/components/shadcn/ui/button'
+import { Button } from 'ui'
 import {
   BadgeExperimental,
   CommandMenu,

apps/design-system/registry/default/example/commandmenu-conditional.tsx

@@ -1,5 +1,5 @@
-import { Button } from '@ui/components/shadcn/ui/button'
 import { useMemo, useState } from 'react'
+import { Button } from 'ui'
 import {
   CommandMenu,
   CommandMenuInput,

apps/design-system/registry/default/example/commandmenu-demo.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@ui/components/shadcn/ui/button'
+import { Button } from 'ui'
 import {
   CommandMenu,
   CommandMenuInput,

apps/design-system/registry/default/example/commandmenu-force.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@ui/components/shadcn/ui/button'
+import { Button } from 'ui'
 import {
   CommandMenu,
   CommandMenuInput,

apps/design-system/registry/default/example/commandmenu-hidden.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@ui/components/shadcn/ui/button'
+import { Button } from 'ui'
 import {
   CommandMenu,
   CommandMenuInput,

apps/design-system/registry/default/example/commandmenu-icon.tsx

@@ -1,5 +1,5 @@
-import { Button } from '@ui/components/shadcn/ui/button'
 import { Github } from 'lucide-react'
+import { Button } from 'ui'
 import {
   CommandMenu,
   CommandMenuInput,

apps/design-system/registry/default/example/commandmenu-subpage-custom.tsx

@@ -1,4 +1,4 @@
-import { Button } from '@ui/components/shadcn/ui/button'
+import { Button } from 'ui'
 import {
   Breadcrumb,
   CommandMenu,

apps/design-system/registry/default/example/commandmenu-subpage.tsx

@@ -1,5 +1,5 @@
-import { Button } from '@ui/components/shadcn/ui/button'
 import { useMemo } from 'react'
+import { Button } from 'ui'
 import {
   CommandMenu,
   CommandMenuInput,

apps/design-system/registry/default/example/field-checkbox.tsx

@@ -1,5 +1,5 @@
-import { Checkbox } from 'ui'
 import {
+  Checkbox,
   Field,
   FieldContent,
   FieldDescription,
@@ -8,7 +8,7 @@ import {
   FieldLegend,
   FieldSeparator,
   FieldSet,
-} from 'ui/src/components/shadcn/ui/field'
+} from 'ui'
 
 export default function FieldCheckbox() {
   return (

apps/design-system/registry/default/example/field-choice-card.tsx

@@ -6,8 +6,9 @@ import {
   FieldLabel,
   FieldSet,
   FieldTitle,
-} from 'ui/src/components/shadcn/ui/field'
-import { RadioGroup, RadioGroupItem } from 'ui/src/components/shadcn/ui/radio-group'
+  RadioGroup,
+  RadioGroupItem,
+} from 'ui'
 
 export default function FieldChoiceCard() {
   return (

apps/design-system/registry/default/example/field-demo.tsx

@@ -1,20 +1,21 @@
-import { Button, Checkbox, Input, Textarea } from 'ui'
 import {
+  Button,
+  Checkbox,
   Field,
   FieldDescription,
   FieldGroup,
   FieldLabel,
   FieldLegend,
   FieldSeparator,
   FieldSet,
-} from 'ui/src/components/shadcn/ui/field'
-import {
+  Input,
   Select,
   SelectContent,
   SelectItem,
   SelectTrigger,
   SelectValue,
-} from 'ui/src/components/shadcn/ui/select'
+  Textarea,
+} from 'ui'
 
 export default function FieldDemo() {
   return (

apps/design-system/registry/default/example/field-fieldset.tsx

@@ -1,12 +1,4 @@
-import { Input } from 'ui'
-import {
-  Field,
-  FieldDescription,
-  FieldGroup,
-  FieldLabel,
-  FieldLegend,
-  FieldSet,
-} from 'ui/src/components/shadcn/ui/field'
+import { Field, FieldDescription, FieldGroup, FieldLabel, FieldLegend, FieldSet, Input } from 'ui'
 
 export default function FieldFieldset() {
   return (

apps/design-system/registry/default/example/field-group.tsx

@@ -1,12 +1,12 @@
-import { Checkbox } from 'ui'
 import {
+  Checkbox,
   Field,
   FieldDescription,
   FieldGroup,
   FieldLabel,
   FieldSeparator,
   FieldSet,
-} from 'ui/src/components/shadcn/ui/field'
+} from 'ui'
 
 export default function FieldGroupExample() {
   return (

apps/design-system/registry/default/example/field-hear.tsx

@@ -1,13 +1,15 @@
-import { Card, CardContent, Checkbox } from 'ui'
 import {
+  Card,
+  CardContent,
+  Checkbox,
   Field,
   FieldDescription,
   FieldGroup,
   FieldLabel,
   FieldLegend,
   FieldSet,
   FieldTitle,
-} from 'ui/src/components/shadcn/ui/field'
+} from 'ui'
 
 const options = [
   {

apps/design-system/registry/default/example/field-input.tsx

@@ -1,11 +1,4 @@
-import { Input } from 'ui'
-import {
-  Field,
-  FieldDescription,
-  FieldGroup,
-  FieldLabel,
-  FieldSet,
-} from 'ui/src/components/shadcn/ui/field'
+import { Field, FieldDescription, FieldGroup, FieldLabel, FieldSet, Input } from 'ui'
 
 export default function FieldInput() {
   return (