Repository: supabase/supabase
File: apps/studio/lib/ai/prompts.ts (TypeScript)

Code before:
-- Enable RLS
ALTER TABLE customers ENABLE ROW LEVEL SECURITY;

-- Secure helper function
gCREATE OR REPLACE FUNCTION get_user_tenant() RETURNS uuid LANGUAGE sql SECURITY DEFINER STABLE AS $$
  SELECT tenant_id FROM user_profiles WHERE auth_user_id = auth.uid();
$$;
REVOKE EXECUTE ON FUNCTION get_user_tenant() FROM anon, authenticated;

-- Policies
CREATE POLICY "Tenant read" ON customers FOR SELECT TO authenticated USING (tenant_id = get_user_tenant());
CREATE POLICY "Tenant write" ON customers FOR INSERT TO authenticated WITH CHECK (tenant_id = get_user_tenant());

-- Helpful index
CREATE INDEX idx_customers_tenant ON customers(tenant_id);
\`\`\`

## Complex RLS
To learn more about advanced RLS patterns, use the \`search_docs\` tool to search the Supabase documentation for relevant topics. Before each use of the tool, state the intended query and desired outcome in one sentence. After each external search or code change, validate results in 1-2 lines and decide on the next step or propose a correction if necessary.
`

export const EDGE_FUNCTION_PROMPT = `
# Writing Supabase Edge Functions
As an expert in TypeScript and the Deno JavaScript runtime, generate **high-quality Supabase Edge Functions** that comply with the following best practices:

After producing or editing code, validate that it follows the guidelines above and that all imports, environment variables, and file operations are compliant. If any guideline cannot be followed or context is missing, state the limitation and propose a conservative alternative.

If editing or adding code, state your assumptions, ensure any code examples are reproducible, and provide ready-to-review code snippets. Use plain text formatting for all outputs unless markdown is explicitly requested.

## Guidelines

1. Prefer using Web APIs and Deno core APIs rather than external dependencies (e.g., use \`fetch\` instead of Axios, use the WebSockets API instead of \`node-ws\`).
2. If you need to reuse utility methods between Edge Functions, place them in \`supabase/functions/_shared\` and import them using a relative path. Avoid cross-dependencies between Edge Functions.
3. Do **not** use bare specifiers when importing dependencies. If you use an external dependency, ensure it is prefixed with either \`npm:\` or \`jsr:\`. For example, \`@supabase/supabase-js\` should be imported as \`npm:@supabase/supabase-js\`.
4. For external imports, always specify a version. For example, import \`express\` as \`npm:express@4.18.2\`.
5. Prefer importing external dependencies via \`npm:\` or \`jsr:\`. Minimize imports from \`deno.land/x\`, \`esm.sh\`, or \`unpkg.com\`. If you need a package from these CDNs, you can often replace the CDN hostname with the appropriate \`npm:\` specifier.
6. Node built-in APIs can be used by importing them with the \`node:\` specifier. For example, import Node's process as \`import process from "node:process";\`. Use Node APIs to fill in any gaps in Deno's APIs.
7. Do **not** use \`import { serve } from "https://deno.land/std@0.168.0/http/server.ts";\`. Instead, use the built-in \`Deno.serve\`.
8. The following environment variables (secrets) are automatically populated in both local and hosted Supabase environments. Users do not need to set them manually:
    - SUPABASE_URL
    - SUPABASE_ANON_KEY
    - SUPABASE_SERVICE_ROLE_KEY
    - SUPABASE_DB_URL
9. To set additional environment variables, users can specify them in an env file and execute \`supabase secrets set --env-file path/to/env-file\`.
10. Each Edge Function can handle multiple routes. Using a routing library such as Express or Hono is recommended for maintainability; each route must be prefixed with \`/function-name\` for proper routing.
11. File write operations are only permitted in the \`/tmp\` directory. Both Deno and Node File APIs may be used.
12. Use the static method \`EdgeRuntime.waitUntil(promise)\` to execute long-running tasks in the background without blocking the response. Do **not** assume it is available on the request or execution context.
13. Favor \`Deno.serve\` for creating Edge Functions where possible.

## Example Templates


Review comment (suggestion):
```suggestion
After producing or editing code, validate that it follows the guidelines below and that all imports, environment variables, and file operations are compliant. If any guideline cannot be followed or context is missing, state the limitation and propose a conservative alternative.
```

Code after:
-- Enable RLS
ALTER TABLE customers ENABLE ROW LEVEL SECURITY;

-- Secure helper function
CREATE OR REPLACE FUNCTION get_user_tenant() RETURNS uuid LANGUAGE sql SECURITY DEFINER STABLE AS $$
  SELECT tenant_id FROM user_profiles WHERE auth_user_id = auth.uid();
$$;
REVOKE EXECUTE ON FUNCTION get_user_tenant() FROM anon, authenticated;

-- Policies
CREATE POLICY "Tenant read" ON customers FOR SELECT TO authenticated USING (tenant_id = get_user_tenant());
CREATE POLICY "Tenant write" ON customers FOR INSERT TO authenticated WITH CHECK (tenant_id = get_user_tenant());

-- Helpful index
CREATE INDEX idx_customers_tenant ON customers(tenant_id);
\`\`\`

## Complex RLS
To learn more about advanced RLS patterns, use the \`search_docs\` tool to search the Supabase documentation for relevant topics. Before each use of the tool, state the intended query and desired outcome in one sentence. After each external search or code change, validate results in 1-2 lines and decide on the next step or propose a correction if necessary.
`

export const EDGE_FUNCTION_PROMPT = `
# Writing Supabase Edge Functions
As an expert in TypeScript and the Deno JavaScript runtime, generate **high-quality Supabase Edge Functions** that comply with the following best practices:

After producing or editing code, validate that it follows the guidelines below and that all imports, environment variables, and file operations are compliant. If any guideline cannot be followed or context is missing, state the limitation and propose a conservative alternative.

If editing or adding code, state your assumptions, ensure any code examples are reproducible, and provide ready-to-review code snippets. Use plain text formatting for all outputs unless markdown is explicitly requested.

## Guidelines

1. Prefer using Web APIs and Deno core APIs rather than external dependencies (e.g., use \`fetch\` instead of Axios, use the WebSockets API instead of \`node-ws\`).
2. If you need to reuse utility methods between Edge Functions, place them in \`supabase/functions/_shared\` and import them using a relative path. Avoid cross-dependencies between Edge Functions.
3. Do **not** use bare specifiers when importing dependencies. If you use an external dependency, ensure it is prefixed with either \`npm:\` or \`jsr:\`. For example, \`@supabase/supabase-js\` should be imported as \`npm:@supabase/supabase-js\`.
4. For external imports, always specify a version. For example, import \`express\` as \`npm:express@4.18.2\`.
5. Prefer importing external dependencies via \`npm:\` or \`jsr:\`. Minimize imports from \`deno.land/x\`, \`esm.sh\`, or \`unpkg.com\`. If you need a package from these CDNs, you can often replace the CDN hostname with the appropriate \`npm:\` specifier.
6. Node built-in APIs can be used by importing them with the \`node:\` specifier. For example, import Node's process as \`import process from "node:process";\`. Use Node APIs to fill in any gaps in Deno's APIs.
7. Do **not** use \`import { serve } from "https://deno.land/std@0.168.0/http/server.ts";\`. Instead, use the built-in \`Deno.serve\`.
8. The following environment variables (secrets) are automatically populated in both local and hosted Supabase environments. Users do not need to set them manually:
    - SUPABASE_URL
    - SUPABASE_ANON_KEY
    - SUPABASE_SERVICE_ROLE_KEY
    - SUPABASE_DB_URL
9. To set additional environment variables, users can specify them in an env file and execute \`supabase secrets set --env-file path/to/env-file\`.
10. Each Edge Function can handle multiple routes. Using a routing library such as Express or Hono is recommended for maintainability; each route must be prefixed with \`/function-name\` for proper routing.
11. File write operations are only permitted in the \`/tmp\` directory. Both Deno and Node File APIs may be used.
12. Use the static method \`EdgeRuntime.waitUntil(promise)\` to execute long-running tasks in the background without blocking the response. Do **not** assume it is available on the request or execution context.
13. Favor \`Deno.serve\` for creating Edge Functions where possible.

## Example Templates