v1.2.1 — three shipped service-role defects, four more, five review findings, and two regressions the fixes themselves introduced

.github/workflows/review.yml

@@ -38,13 +38,39 @@ permissions:
   id-token: write
 
 concurrency:
-  group: review-${{ github.event.pull_request.number }}
+  # The fallback is not decoration. `github.event.pull_request.number` is EMPTY on any event
+  # that is not a pull request, and the caller template triggers on `[pull_request, push]`, so
+  # every push run collapsed into one shared group key of `review-` and cancelled the previous
+  # one. Harmless only for as long as this job stays skipped on push — which is a property of
+  # the `if` below, not of the group, and the two are not written down together anywhere else.
+  # A concurrency key that silently means "all of them" is the same shape as a check that
+  # silently means "nothing".
+  group: review-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   review:
     name: Draft review
-    if: github.event.pull_request.draft == true
+    # DRAFT, AND NOT FROM A FORK. The second half is about what a secret is worth on each
+    # trigger, and it was raised as an exfiltration risk — "a PR can rewrite the caller job and
+    # read CLAUDE_CODE_OAUTH_TOKEN". The load-bearing distinction is the trigger word: the
+    # caller runs on `pull_request`, NOT `pull_request_target`. On `pull_request` a fork's PR
+    # gets no repository secrets at all, so there is nothing there to read; and a same-repo
+    # branch is pushed by someone who already has write access, which is not a boundary this
+    # trigger was ever holding. So the risk as stated does not hold here.
+    #
+    # What DOES hold is duller and still worth the line: on a fork PR the secret expression
+    # resolves to empty while `review.yml` declares it `required: true`, so the reviewer is red
+    # on every fork PR for a reason having nothing to do with the code — the same shape as the
+    # 403 the `permissions:` note in caller-template.yml exists to prevent. Skipping is the
+    # honest outcome: as with a ready PR, `skipped` is an ABSENCE and is not claimed as a pass.
+    #
+    # This is reasoned from GitHub's documented trigger semantics, not measured: a fork PR
+    # against this repository is not something this branch can stage. Stated so the next reader
+    # knows which kind of claim it is.
+    if: >-
+      github.event.pull_request.draft == true
+      && github.event.pull_request.head.repo.fork == false
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -132,7 +158,12 @@ jobs:
       # finishing. If the count file is missing or unparseable the run says UNKNOWN and goes RED:
       # there is no third colour, and a reviewer that died is not a clean bill of health.
       - name: Post the tally
-        if: always()
+        # success() || failure(), NOT always(). With cancel-in-progress on, a superseded run is
+        # CANCELLED, and always() runs this step there too — so every push to a draft PR left a
+        # spurious "UNKNOWN — the reviewer did not report a count" comment from the run that was
+        # deliberately killed. The tally must be unmissable when the reviewer ran; it must not
+        # narrate a run that was cancelled on purpose.
+        if: success() || failure()
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR: ${{ github.event.pull_request.number }}

CITATION.cff

@@ -10,7 +10,7 @@ authors:
 repository-code: "https://github.com/chiibitsu/gates"
 url: "https://chiibitsu.com"
 license: MIT
-version: "1.2.0"
+version: "1.2.1"
 date-released: "2026-09-08"
 keywords:
   - ci

caller-template.yml

@@ -3,6 +3,14 @@
 # purpose: a reusable workflow cannot discover its own commit, so the ref you pin has to be
 # handed to it. Change both together.
 #
+# READ THIS BEFORE COPYING: the SHA shipped below is v1.2.0, and the Releases table in the
+# README marks v1.2.0 **do not use** — its service-role gate has a false green on a multi-line
+# dynamic import and does not terminate on a circular one. The template pins the PREVIOUS
+# release by construction, and the previous release is the bad one, so this is the first time
+# the convention has shipped a pin the table contradicts. TAKE v1.2.1 FROM THE TABLE. The
+# convention is left visible rather than quietly patched because it is the convention that
+# needs a decision, not this line.
+#
 # It does NOT name the release you are reading, and cannot: a commit cannot contain its own
 # SHA. What it does name is not derivable — from v1.0.2 onward it is the previous release, but
 # v1.0.0 and v1.0.1 pinned untagged ancestors, and v1.0.1 labelled its untagged pin with its
@@ -13,27 +21,43 @@
 on: [pull_request, push]
 jobs:
   gates:
-    uses: chiibitsu/gates/.github/workflows/gates.yml@7832ea67355f22a3e9077d061f1dd937cead905a # v1.1.0
+    uses: chiibitsu/gates/.github/workflows/gates.yml@44f6125815853021fcc4c8c96f5e2305cd4c4313 # v1.2.0
     with:
-      gates_ref: 7832ea67355f22a3e9077d061f1dd937cead905a # v1.1.0
+      gates_ref: 44f6125815853021fcc4c8c96f5e2305cd4c4313 # v1.2.0
 
   # ── The draft-stage reviewer (Tier 2, not a gate) ────────────────────────────────────────
   #
-  # Commented, and NOT because it is a placeholder. review.yml does not exist before v1.2.0, so
-  # pinning it at the SHA above — the previous release, which is what this template ships —
-  # would fail with a file-not-found on every run. A caller line that is broken by construction
-  # is worse than one that says why it is off.
+  # ACTIVE from v1.2.1 onward. It shipped commented in v1.2.0 for a reason that has since
+  # stopped being true: review.yml did not exist at the release this template pins, so an
+  # active line would have failed file-not-found on every run. review.yml exists at v1.2.0,
+  # which is what the pin below now names, so the block is live. A comment kept past the
+  # expiry of its own reason is how a file starts lying quietly.
   #
-  # To turn it on: take the v1.2.0 SHA (or later) from the Releases table in the README, put it
-  # on the `uses:` line below and on both `gates` lines above, and uncomment. There is ONE SHA
-  # in this block — the other line is the secret mapping, and an earlier wording said "BOTH
-  # lines below", which would have had a careful reader overwrite the token with a commit hash.
-  # It needs a repository secret CLAUDE_CODE_OAUTH_TOKEN, from `claude setup-token`.
+  # It needs a repository secret CLAUDE_CODE_OAUTH_TOKEN, from `claude setup-token`. Without
+  # it the job fails loudly rather than reviewing nothing.
   #
   # It runs ONLY while the pull request is a draft. On a ready PR the job reports `skipped`,
-  # which is an absence, not a pass — see AGENTS.md on accounting for a check that is not there.
+  # which is an absence, not a pass — account for it before flipping, as AGENTS.md says.
+  #
+  # From v1.2.1 it also skips on pull requests FROM FORKS, and the pin below predates that.
+  # A fork PR gets no repository secrets, so the token expression is empty against a
+  # `required: true` declaration and the job is red for a reason having nothing to do with the
+  # code. Pinning the SHA on this line to v1.2.1 or later is what gets the skip; that is the
+  # same pin question the header above hands to the reader, named here so it is not discovered
+  # by a red run on someone's first outside contribution.
   #
-  # review:
-  #   uses: chiibitsu/gates/.github/workflows/review.yml@<v1.2.0-sha-from-the-releases-table>
-  #   secrets:
-  #     CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+  # ONE SHA in this block, on the `uses:` line. The line under `secrets:` is a token mapping.
+  review:
+    # PERMISSIONS ARE THE CALLER'S TO GRANT. A called workflow can only narrow the token it is
+    # handed, never widen it, so review.yml's own `permissions:` block is a ceiling and not a
+    # grant. On a repository whose default workflow token is read-only, the tally step's
+    # `gh pr comment` gets a 403 and the job is red on every draft PR — a reviewer that fails
+    # for a reason having nothing to do with the code.
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: read
+      id-token: write
+    uses: chiibitsu/gates/.github/workflows/review.yml@44f6125815853021fcc4c8c96f5e2305cd4c4313 # v1.2.0
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

fixtures/migrations-lint/bad/cases/alter-table-named-if/supabase/migrations/20260110000000_orders.down.sql

@@ -0,0 +1,2 @@
+drop table if exists public.orders;
+drop table if exists public."if";

fixtures/migrations-lint/bad/cases/alter-table-named-if/supabase/migrations/20260110000000_orders.sql

@@ -0,0 +1,9 @@
+-- `if` and `exists` are non-reserved in PostgreSQL and are legal table names — the create
+-- side already knew that. The ALTER side swallowed them wherever they appeared, so it bound
+-- `enable` as the table name here, emitted no RLS record, and reported a violation on a file
+-- that enables RLS correctly. The planted violation is `orders`, which genuinely has none;
+-- the point of the file is that `if` must NOT also be reported.
+create table if (id int);
+alter table if enable row level security;
+
+create table public.orders (id int);

fixtures/migrations-lint/bad/cases/comment-marker-in-a-string/supabase/migrations/20260106000000_orders.down.sql

@@ -0,0 +1,2 @@
+drop table if exists public.orders;
+drop table if exists public.notes;

fixtures/migrations-lint/bad/cases/comment-marker-in-a-string/supabase/migrations/20260106000000_orders.sql

@@ -0,0 +1,13 @@
+-- A `/*` INSIDE a string literal. Comment stripping used to run as a separate stage with no
+-- string state, so this opened a block comment that deleted every line until the `*/` in the
+-- string below it — taking the create table with it. Verified against PostgreSQL 16: the file
+-- applies cleanly and leaves public.orders with RLS off, while the gate reported ok, exit 0.
+-- The two surviving quotes pair up, so the unterminated-string guard never fired either.
+create table public.notes (body text);
+alter table public.notes enable row level security;
+
+insert into public.notes (body) values ('x /* y');
+
+create table public.orders (id int);
+
+insert into public.notes (body) values ('*/ z');

fixtures/migrations-lint/bad/cases/cross-schema-rls/supabase/migrations/20260102000000_orders.down.sql

@@ -0,0 +1,2 @@
+drop table if exists archive.orders;
+drop table if exists public.orders;

fixtures/migrations-lint/bad/cases/cross-schema-rls/supabase/migrations/20260102000000_orders.sql

@@ -0,0 +1,9 @@
+-- RLS ON A DIFFERENT SCHEMA'S SAME-NAMED TABLE. The create side discarded the schema
+-- qualifier after reading it, so the check asked only "does SOME table called orders, in SOME
+-- schema, have RLS?" while the message named one specific table. Both statements below are
+-- accepted by PostgreSQL and the resulting state really does leave public.orders unprotected.
+-- Two schemas holding a same-named table is an ordinary layout, not a contrivance.
+create table public.orders (id uuid primary key, owner uuid);
+
+create table archive.orders (id uuid primary key, owner uuid);
+alter table archive.orders enable row level security;

fixtures/migrations-lint/bad/cases/multiline-create-table/supabase/migrations/20260104000000_orders.down.sql

@@ -0,0 +1 @@
+drop table if exists public.orders;

fixtures/migrations-lint/bad/cases/multiline-create-table/supabase/migrations/20260104000000_orders.sql

@@ -0,0 +1,8 @@
+-- The table name is on the line after `create table`. grep is line-scoped, so the statement
+-- was not seen at all and the file passed with no RLS anywhere in it: a silent green, which
+-- is the one outcome this toolkit refuses. The tokeniser reads statements, not lines.
+create table
+  public.orders (
+    id uuid primary key,
+    owner uuid
+  );

fixtures/migrations-lint/bad/cases/non-utf8-identifier/supabase/migrations/20260107000000_orders.down.sql

@@ -0,0 +1 @@
+drop table if exists public.clean;

fixtures/migrations-lint/bad/cases/non-utf8-identifier/supabase/migrations/20260107000000_orders.sql

@@ -0,0 +1,7 @@
+-- A LATIN1 byte in a quoted identifier. `grep` without `-a` calls the records file
+-- binary under an ordinary UTF-8 locale, SUPPRESSES the matching line and still exits 0,
+-- so this table never reached the comparison and was never checked. The clean table
+-- beside it was, which is what made the loss invisible: one violation reported where
+-- two are planted. PostgreSQL 16 confirms both tables are real and both have RLS off.
+create table public.clean (id int);
+create table public."a�o" (id int);

fixtures/migrations-lint/bad/cases/quote-inside-a-string/supabase/migrations/20260105000000_orders.down.sql

@@ -0,0 +1 @@
+drop table if exists public.orders;

fixtures/migrations-lint/bad/cases/quote-inside-a-string/supabase/migrations/20260105000000_orders.sql

@@ -0,0 +1,10 @@
+-- ONE double quote inside an ordinary string literal. The scanner had no single-quoted-string
+-- state, so this `"` opened a quoted identifier that ran to the end of the file and every
+-- statement after it was invisible: the create below had no RLS anywhere and the file
+-- reported ok, exit 0. An inch mark in seed data is enough to do it.
+insert into public.products (name) values ('24" monitor');
+
+create table public.orders (
+  id uuid primary key,
+  owner_id uuid not null
+);

fixtures/migrations-lint/bad/cases/quoted-identifier-case/supabase/migrations/20260103000000_orders.down.sql

@@ -0,0 +1,2 @@
+drop table if exists public."Orders";
+drop table if exists public.orders;

fixtures/migrations-lint/bad/cases/quoted-identifier-case/supabase/migrations/20260103000000_orders.sql

@@ -0,0 +1,8 @@
+-- PostgreSQL folds an unquoted identifier to lower case and keeps a quoted one exactly, so
+-- "Orders" and orders are two different tables. The extractor lowercased both and the RLS
+-- search was case-insensitive, so RLS on one satisfied a create of the other — a false green.
+-- The quoted PascalCase form is what Prisma and Drizzle emit, so this is not a contrivance.
+create table public."Orders" (id uuid primary key, owner uuid);
+
+create table public.orders (id uuid primary key, owner uuid);
+alter table public.orders enable row level security;

fixtures/migrations-lint/bad/cases/quoted-schema-qualifier/supabase/migrations/20260101000000_orders.down.sql

@@ -0,0 +1,2 @@
+drop table if exists "public"."orders";
+drop table if exists public.public;

fixtures/migrations-lint/bad/cases/quoted-schema-qualifier/supabase/migrations/20260101000000_orders.sql

@@ -0,0 +1,12 @@
+-- The schema qualifier is quoted SEPARATELY from the table: "public"."orders". The extractor
+-- read the first identifier it could and took `public` for the table name, so the RLS check
+-- below was run against a table called public rather than against orders.
+--
+-- This fixture is shaped to discriminate. A table actually named `public` exists here and
+-- does enable RLS, so the broken reading finds what it is looking for and the file passes,
+-- with orders — the real table, with no RLS — never checked at all. A gate that reads the
+-- name correctly checks orders, finds no RLS, and goes red. Before the fix: green. After: red.
+create table public.public (id uuid primary key);
+alter table public.public enable row level security;
+
+create table "public"."orders" (id uuid primary key);

fixtures/migrations-lint/bad/unknown/ddl-in-a-dollar-quoted-body/supabase/migrations/20260109000000_orders.down.sql

@@ -0,0 +1 @@
+drop function if exists public.f();

fixtures/migrations-lint/bad/unknown/ddl-in-a-dollar-quoted-body/supabase/migrations/20260109000000_orders.sql

@@ -0,0 +1,13 @@
+-- A dollar-quoted body is data, like any other string. Scanning it as SQL made the create
+-- below a FAIL naming public.tmp — a table that does not exist at definition time and is
+-- created only when the function runs. A red on a compliant file, naming a table nobody
+-- created, which is the shape this gate refuses.
+--
+-- `do $$ … $$` does execute immediately, so a create inside one is real; but the gate cannot
+-- see whether RLS follows it inside the body either. UNKNOWN is the honest answer for both:
+-- still red, still blocking, and claiming nothing it has not established.
+create function public.f() returns void language plpgsql as $$
+begin
+  create table public.tmp (id int);
+end
+$$;

fixtures/migrations-lint/bad/unknown/modifier-table-in-a-string/supabase/migrations/20260108000000_orders.down.sql

@@ -0,0 +1 @@
+drop table if exists public.o;

fixtures/migrations-lint/bad/unknown/modifier-table-in-a-string/supabase/migrations/20260108000000_orders.sql

@@ -0,0 +1,9 @@
+-- `execute` running DDL this gate cannot follow must be UNKNOWN, and it was — until the
+-- modifier allowance in that test was written as {0,2}, which mawk miscompiles to zero
+-- repetitions when the group starts with a +-quantified bracket. The allowance was inert and
+-- the test became exactly `create table`, so this line passed over silently. PostgreSQL 16
+-- confirms it creates a persistent unlogged table with RLS off.
+create table public.o (id int);
+alter table public.o enable row level security;
+
+do $x$ begin execute 'CREATE UNLOGGED TABLE public.x (id int)'; end $x$;

fixtures/service-role/bad/cases/aliased-duplicate-path/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture",
+  "dependencies": { "next": "15.0.0" }
+}

fixtures/service-role/bad/cases/aliased-duplicate-path/src/app/page.tsx

@@ -0,0 +1,2 @@
+import { key } from "@/lib/secret";
+export default function Page() { return <main>{key ? "y" : "n"}</main>; }

fixtures/service-role/bad/cases/aliased-duplicate-path/src/app/x/page.tsx

@@ -0,0 +1,2 @@
+import { key } from "../../lib/secret";
+export default function X() { return <main>{key ? "y" : "n"}</main>; }

fixtures/service-role/bad/cases/aliased-duplicate-path/src/lib/secret.ts

@@ -0,0 +1 @@
+export const key = process.env.SUPABASE_SECRET_KEY;

fixtures/service-role/bad/cases/aliased-duplicate-path/tsconfig.json

@@ -0,0 +1,6 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "paths": { "@/*": ["./src/*"] }
+  }
+}

fixtures/service-role/bad/cases/baseurl-absolute-import/package.json

@@ -0,0 +1 @@
+{ "name": "fixture-baseurl-absolute-import", "dependencies": { "next": "15.0.0" } }

fixtures/service-role/bad/cases/baseurl-absolute-import/src/app/page.tsx

@@ -0,0 +1,9 @@
+// Next.js "Absolute Imports": baseUrl alone, no paths alias anywhere. `lib/supabase-admin`
+// means `src/lib/supabase-admin.ts`. The gate parsed this baseUrl — it is the base for every
+// alias target — and still skipped this bare specifier as a published package. Written
+// `../lib/supabase-admin`, the same file and the same secret were caught.
+import { admin } from "lib/supabase-admin";
+
+export default function Page() {
+  return admin;
+}

fixtures/service-role/bad/cases/baseurl-absolute-import/src/lib/supabase-admin.ts

@@ -0,0 +1 @@
+export const admin = process.env.SUPABASE_SERVICE_ROLE_KEY;

fixtures/service-role/bad/cases/baseurl-absolute-import/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "baseUrl": "src" } }

fixtures/service-role/bad/cases/baseurl-dot-absolute-import/app/page.tsx

@@ -0,0 +1,10 @@
+// `"baseUrl": "."` is the spelling in Next.js's own Absolute Imports documentation and the
+// one create-next-app ships. The first version of the baseUrl fallback armed on the VALUE
+// rather than on the key being present, and "." is exactly the value it excluded — so the
+// false green it was written to close stayed open on the commonest spelling, while the
+// fixture beside this one used "src" and kept the selftest green over the half that worked.
+import { admin } from "lib/supabase-admin";
+
+export default function Page() {
+  return admin;
+}

fixtures/service-role/bad/cases/baseurl-dot-absolute-import/lib/supabase-admin.ts

@@ -0,0 +1 @@
+export const admin = process.env.SUPABASE_SERVICE_ROLE_KEY;

fixtures/service-role/bad/cases/baseurl-dot-absolute-import/package.json

@@ -0,0 +1 @@
+{ "name": "fixture-baseurl-dot-absolute-import", "dependencies": { "next": "15.0.0" } }

fixtures/service-role/bad/cases/baseurl-dot-absolute-import/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "baseUrl": "." } }

fixtures/service-role/bad/cases/baseurl-nonpackage-name/package.json

@@ -0,0 +1 @@
+{ "name": "fixture-baseurl-nonpackage-name", "dependencies": { "next": "15.0.0" } }

fixtures/service-role/bad/cases/baseurl-nonpackage-name/src/_components/Button.ts

@@ -0,0 +1 @@
+export const admin = process.env.SUPABASE_SERVICE_ROLE_KEY;

fixtures/service-role/bad/cases/baseurl-nonpackage-name/src/app/page.tsx

@@ -0,0 +1,10 @@
+// An underscore-prefixed private folder is an ordinary Next.js convention, and a leading
+// underscore is not a valid npm package name. The baseUrl probe was gated on the specifier
+// LOOKING like a package, so it skipped exactly the names most likely to be baseUrl-relative:
+// this file resolves under baseUrl and was reported UNKNOWN anyway — a red on a tree the gate
+// could read perfectly well, and one that hides the violation underneath it.
+import { admin } from "_components/Button";
+
+export default function Page() {
+  return admin;
+}

fixtures/service-role/bad/cases/baseurl-nonpackage-name/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "baseUrl": "src" } }

fixtures/service-role/bad/cases/circular-import/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture",
+  "dependencies": { "next": "15.0.0" }
+}

fixtures/service-role/bad/cases/circular-import/src/app/page.tsx

@@ -0,0 +1,2 @@
+import { b } from "../lib/b";
+export default function Page() { return <main>{b ? "y" : "n"}</main>; }

fixtures/service-role/bad/cases/circular-import/src/lib/a.ts

@@ -0,0 +1,2 @@
+import { b } from "./b";
+export const a = b;

fixtures/service-role/bad/cases/circular-import/src/lib/b.ts

@@ -0,0 +1,4 @@
+// b imports a, a imports b. Before the paths were canonicalised this pair grew a longer
+// spelling every hop, the visited set never matched, and the walk did not terminate.
+import { a } from "./a";
+export const b = a ?? process.env.SUPABASE_SECRET_KEY;

fixtures/service-role/bad/cases/declaration-sidecar/app/page.jsx

@@ -0,0 +1,9 @@
+// A hand-written declaration sits beside the implementation. Probing the declaration first
+// resolved to a file that BY CONSTRUCTION cannot hold a secret, and lib/admin.js — the module
+// Node actually loads — was never read. Deleting the .d.ts turned the same tree red, which is
+// the sidecar doing the hiding.
+import { admin } from "../lib/admin.js";
+
+export default function Page() {
+  return admin;
+}

fixtures/service-role/bad/cases/declaration-sidecar/lib/admin.d.ts

@@ -0,0 +1 @@
+export declare const admin: string | undefined;

fixtures/service-role/bad/cases/declaration-sidecar/lib/admin.js

@@ -0,0 +1 @@
+export const admin = process.env.SUPABASE_SERVICE_ROLE_KEY;

fixtures/service-role/bad/cases/declaration-sidecar/package.json

@@ -0,0 +1 @@
+{ "name": "fixture-declaration-sidecar", "type": "module", "dependencies": { "next": "15.0.0" } }

fixtures/service-role/bad/cases/division-after-brace/lib/admin.js

@@ -0,0 +1 @@
+export const admin = process.env.SUPABASE_SERVICE_ROLE_KEY;

fixtures/service-role/bad/cases/division-after-brace/package.json

@@ -0,0 +1 @@
+{ "name": "fixture-division-after-brace", "dependencies": { "next": "15.0.0" } }

fixtures/service-role/bad/cases/division-after-brace/pages/index.js

@@ -0,0 +1,10 @@
+// A slash after `}` is division here, not a regex. Treating `}` as a regex position made the
+// scanner consume the rest of the line looking for a closing slash — swallowing the real
+// import beside it. ok, exit 0, on a module reaching the key, where the pre-tokeniser
+// extractor caught it. A block close can precede a regex, so this trades a rare false red
+// for a false green, which is the trade this toolkit takes every time.
+const x = {} / foo; import { admin } from "../lib/admin";
+
+export default function Page() {
+  return admin;
+}

fixtures/service-role/bad/cases/emitted-extension-import/app/admin.mts

@@ -0,0 +1 @@
+export const admin = process.env.SUPABASE_SERVICE_ROLE_KEY;

fixtures/service-role/bad/cases/emitted-extension-import/app/page.tsx

@@ -0,0 +1,7 @@
+// nodenext makes the import name the EMITTED file (.mjs) while the source is .mts.
+// The gate must follow that mapping; appending extensions to "./admin.mjs" finds nothing.
+import { admin } from "./admin.mjs";
+
+export default function Page() {
+  return admin;
+}