Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/yudefine/nuxt-supabase-starter/db-preview-envgit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/db-preview-env)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/db-preview-env"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/db-preview-env.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.05660 |
| Opus 5 | $0.00000 | $0.02830 |
| Sonnet 5 | $0.00000 | $0.01132 |
| Haiku 4.5 | $0.00000 | $0.00566 |
Grade A, and why
db-preview-env scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DB Preview Environment（capability + safety contract）
核心命題：兩條 PR 同時改 schema 不能在 shared staging 互踩。本檔規約「應該具備什麼能力、應該守住什麼風險邊界」，不規定 topology — 用 docker-compose / LXC / cloud preview / 任何方案都可以，只要滿足下列契約。
Self-host Supabase 的實作細節（compose-per-PR / schema-migration-gate / role password alignment / image quirk）見
rules/modules/db-runtime/supabase-self-hosted/preview-env.md。Cookbook 範本：
~/offline/clade/vendor/snippets/db-preview-env/。Audit signal：
vendor/scripts/db-preview-env-audit.ts。
為什麼不規定 topology
Self-host Supabase 在 platform-only Branching 之外的選項地景已收斂：
- ❌ Schema-per-branch（同 PG 多 schema）：Auth/Storage/Realtime/RLS 共用狀態，假隔離
- ❌ PG TEMPLATE clone：Postgres
CREATE DATABASE ... TEMPLATE不是 CoW、template 期間禁 active conn、且 Auth/Storage 仍共用 → 一旦補 per-branch service stack 就是 compose-per-PR，B 是 dead-end - ✅ schema-migration-gate（CI throwaway-DB replay + diff）：最便宜、立即解 reviewer 漏看，MUST 第一階段必備
- ✅ compose-per-PR（docker-compose per PR，unique JWT/port/volume）：完整 preview，可選升級路徑
- ⏸️ LXC-per-PR：LXC 同構在錯的層（OS/Tailscale/DNS/secret 不該每 PR 重建）；rare high-fidelity lane、不自動化
- ⚠️ clone + PostgREST sidecar：PG TEMPLATE 死路的窄例外，且只適用 worktree-level dev 隔離、不是 PR preview；六個前提全滿足才開，見下節
clade 規約管 capability，consumer 在 registry/consumers.json 宣告自家當前能力。
窄例外：clone + PostgREST sidecar（worktree-level dev 隔離）
上面「PG TEMPLATE clone 是 dead-end」的判定針對 PR preview —— 那個場景要的是完整 per-branch service stack（Auth / Storage / Realtime），補齊就等於 compose-per-PR，所以 clone 沒有中間態價值。
但同一台 dev 主機上多個 git worktree 各自要一份可 reset 的 DB 是不同問題：不需要 per-branch Auth／Realtime（開發者共用一組 dev 身分即可），只需要「資料互不覆蓋 + 各自可 db:reset」。此時 clone + 每 clone 一個 PostgREST sidecar 是成立的，但六個前提 MUST 全部滿足：
- Dedicated zero-connection template —— 專用 template DB（
datistemplate=true、datallowconn=false、0 active connection），NEVER 拿正在服務的 DB 當 template - 小 DB ——
CREATE DATABASE ... TEMPLATE是實體 copy 不是 CoW；DB 大到 clone 時間／磁碟不可接受就不適用 - 無 GoTrue / Realtime per-clone 需求 —— 只要 REST；需要 per-clone Auth／Realtime 就退回 compose-per-PR
- Storage 明確 gate —— 預設
storageEnabled=false；要 Storage 而無 verified strategy 時 MUST fail closed，NEVER 讓 clone 去動 shared storage bucket - 完整 lifecycle 與 destructive target guard —— deterministic 命名、ownership marker、
reconcile預設 report-only、drop 前驗 ownership；NEVER 讓 target 解析到postgres/ template 本身 / 非本工具建立的 DB - Connection pool 預算控管 —— 每 sidecar 固定 pool size，start 前依
max_connections與現有用量估算，超過 headroom 即拒絕
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 260 lines · 0 tokens per session scan A 79e9234d3f0a
db-preview-env is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 5,660 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
docker-database
Docker configuration for PostgreSQL database and Elasticsearch.
postgres-docker-shared-memory
PostgreSQL in Docker — /dev/shm "No space left on device" and shmsize tuning.
sveltekit-spa
You are an expert SvelteKit engineer. Follow these rules ALWAYS when generating or editing code.
supabase
Supabase development guidelines, commands, and database patterns.
cursorrules
You are assisting the Orbital engineering team — 5 backend engineers building a multi-tenant SaaS for logistics operations. TypeScript monorepo using NestJS, PostgreSQL (drizzle-orm), and BullMQ. All engineers use shared conventions.
30-database-postgres
PostgreSQL and persistence rules.