supabase-drizzle-bootstrap

A set of project rules for connecting Drizzle ORM to Supabase PostgreSQL. Drizzle ORM is a tool for working with database tables from application code; Supabase provides hosted PostgreSQL databases.

In plain words
What is it for?
It guides dependency installation, configuration, schema-file organization, PostgreSQL connections, and definitions for tables such as todos.
Why use it?
It gives the project a consistent setup for database schemas, migrations, credentials, and Supabase authentication references.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/squirrelogic/cursor-rules/supabase-drizzle-bootstrap
Clone the repo
git clone --depth 1 https://github.com/squirrelogic/cursor-rules
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 1,704 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01704
Opus 5 $0.00000 $0.00852
Sonnet 5 $0.00000 $0.00341
Haiku 4.5 $0.00000 $0.00170

Measured 2d ago against content hash b52603eb25be, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

supabase-drizzle-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

supabase/supabase-drizzle-bootstrap.mdc · 243 lines

How it starts

The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bootstrap Drizzle with Supabase

Overview

Guidelines for setting up and using Drizzle ORM with Supabase PostgreSQL.

actions:

  • type: suggest message: | When setting up Drizzle with Supabase:

    1. Install required dependencies:
    npm install drizzle-orm pg @types/pg postgres jwt-decode
    npm install -D drizzle-kit
    
    1. Create a drizzle config file (drizzle.config.ts):
      import { config } from 'dotenv';
      import { defineConfig } from 'drizzle-kit';
    
      config({ path: '.env' });
    
      export default defineConfig({
      schema: './db/schema/index.ts',
      out: './supabase/migrations',
      dialect: 'postgresql',
      dbCredentials: {
          url: process.env.DATABASE_URL!,
      },
      });
    
    1. Schema files should be organized as:
    src/
    └── db/
        ├── schema/
        │   ├── index.ts // exports all schema definitions.          
        │   ├── auth.ts
        │   ├── todos.ts
        │   └── ...
        ├── drizzle.ts
        ├── index.ts
        └── jwt.ts
    
    1. Example schema structure:
    import { eq } from 'drizzle-orm'
    import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'
    import { authUid, authUsers, authenticatedRole } from 'drizzle-orm/supabase'
    
    export const todos = pgTable('todos', {
      id: uuid('id').defaultRandom().primaryKey(),
      title: text('title').notNull(),
      completed: boolean('completed').notNull().default(false),
      created_at: timestamp('created_at').defaultNow().notNull(),
      user_id: uuid('user_id').notNull().references(() => authUsers.id, { onDelete: "cascade" })
    }, (table) => [
    
      // Row Level Security is defined here
      pgPolicy("users can insert their own todos", {
          for: "insert",
          to: authenticatedRole,
          withCheck: eq(table.id, authUid)
      }),
      pgPolicy("users can update their own todos", {
          for: "update",
          to: authenticatedRole,
          using: eq(table.id, authUid),
          withCheck: eq(table.id, authUid),
      }),
    ])
    

Read the full file on GitHub · 243 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 243 lines · 1,704 tokens per session scan A b52603eb25be

Subscribe to this mod's changes

supabase-drizzle-bootstrap is a cursor rule published in the GitHub repository squirrelogic/cursor-rules (20 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,704 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.