Problem
Every audit() call becomes a no-op when Supabase env is missing, so denied writes leave zero trace despite the append-only audit-log guarantee.
Where
src/audit.ts (early return when env is unconfigured).
Acceptance
Add a failing test first with unconfigured Supabase, expecting a denied write to still surface (queued log/warning) rather than vanishing. Then fix.
Problem
Every
audit()call becomes a no-op when Supabase env is missing, so denied writes leave zero trace despite the append-only audit-log guarantee.Where
src/audit.ts(early return when env is unconfigured).Acceptance
Add a failing test first with unconfigured Supabase, expecting a denied write to still surface (queued log/warning) rather than vanishing. Then fix.