@viberaven/cli 1.4.4 → 1.5.1

package/schemas/permissions-matrix.schema.json

@@ -0,0 +1,90 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://viberaven.dev/schemas/permissions-matrix.v1.json",
+  "title": "VibeRaven permissions matrix (viberaven.permissions.json)",
+  "description": "Who may read, add, change and delete rows in each table, written by a person. `viberaven rls-test` checks the migrations against it. Never generate it from the app's own policies. Every cell is about rows owned by `owner`: owner acts on their own row, other_user is a different signed-in user acting on the owner's row, anon is a request with only the public anon key. For insert, the new row names the owner as its owner.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "tables"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "version": { "const": 1 },
+    "description": { "type": "string" },
+    "defaultGrants": {
+      "description": "Table grants the test database gives new public tables. supabase-legacy: anon and authenticated get all privileges on new public tables, as on existing Supabase projects (the more exposed assumption). none: no default grants, only what the migrations grant.",
+      "enum": ["supabase-legacy", "none"],
+      "default": "supabase-legacy"
+    },
+    "tables": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*(\\.[A-Za-z_][A-Za-z0-9_$]*)?$" },
+      "additionalProperties": { "$ref": "#/$defs/table" }
+    }
+  },
+  "$defs": {
+    "table": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "expect"],
+      "properties": {
+        "description": { "type": "string" },
+        "owner": {
+          "description": "How a row's owner is defined. Only `column = auth.uid()` is supported.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["column", "is"],
+          "properties": {
+            "column": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+            "is": { "const": "auth.uid()" }
+          }
+        },
+        "expect": { "$ref": "#/$defs/expectation" },
+        "seed": {
+          "description": "Values for columns the test cannot fill by itself (for example a NOT NULL foreign key). Used for every seeded and inserted row. Leave the owner column out.",
+          "type": "object",
+          "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+          "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
+        },
+        "updateColumn": {
+          "description": "Column the update probe changes. Default: the first plain column that is not the owner column or part of the primary key.",
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$"
+        }
+      }
+    },
+    "expectation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "other_user", "anon"],
+      "properties": {
+        "owner": { "$ref": "#/$defs/actorCells" },
+        "other_user": { "$ref": "#/$defs/actorCells" },
+        "anon": { "$ref": "#/$defs/actorCells" },
+        "service_role": {
+          "description": "The service role bypasses RLS, so it is never tested.",
+          "const": "excluded"
+        }
+      }
+    },
+    "actorCells": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["select", "insert", "update", "delete"],
+      "properties": {
+        "select": { "$ref": "#/$defs/cell" },
+        "insert": { "$ref": "#/$defs/cell" },
+        "update": { "$ref": "#/$defs/cell" },
+        "delete": { "$ref": "#/$defs/cell" },
+        "reassign": {
+          "description": "Optional. Setting the owner column of the owner's row to another user: the owner giving the row away, or another user taking it. Not tested when absent.",
+          "$ref": "#/$defs/cell"
+        }
+      }
+    },
+    "cell": {
+      "description": "allow: the action must work on the owner's row. deny: it must return nothing, change nothing, or be refused with a permission error. skip: not tested (N/A).",
+      "enum": ["allow", "deny", "skip"]
+    }
+  }
+}

package/templates/AGENTS.snippet.md

@@ -1,52 +1,52 @@
-## VibeRaven Launch Readiness
-
-VibeRaven is the Agent Context + Production Gate.
-
-Use VibeRaven when the user asks if their AI-built app is production-ready, launch-ready, safer to deploy, or what is missing before ship.
-
-### Humans
-
-```bash
-npx -y viberaven
-```
-
-In a real terminal, this opens the interactive VibeRaven menu.
-
-### Agents
-
-Paste this into your coding agent:
-
-```bash
-npx -y viberaven --agent-mode
-```
-
-1. Run `npx -y viberaven --agent-mode` from the project root.
-2. If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal alive while the user approves.
-   If the scan flow cannot start login, run `npx -y viberaven login`.
-3. Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context. If the tasklist says `CRITICAL GAPS DETECTED` or `PRODUCTION GATE NOT CLEAR`, fix one listed repo-code gap before deploy.
-4. Read `.viberaven/agent-summary.md` second for scan context.
-5. Read `.viberaven/launch-playbook.md` third for the full checklist.
-6. Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix. Local installs can use `viberaven prompt`.
-7. For Vercel + Supabase, run `npx -y viberaven audit --vercel-supabase` and check RLS, service role exposure, and Supabase pooler port 6543 instead of runtime port 5432.
-8. Do not claim provider dashboard checks are fixed by repo-code edits.
-9. Verify with tests/build, then run `npx -y viberaven --verify`.
-
-Before deploy or CI pass:
-
-```bash
-npx -y viberaven --strict
-```
-
-Also available:
-
-- `.viberaven/last-scan.json` - full mission map and gaps
-- `.viberaven/report.html` - visual map for the user
-- `npx -y viberaven init --dry-run` - preview local agent rules
-- `npx -y viberaven clean --plan` - write a non-destructive cleanup plan
-
-Free plan: 2 lifetime scans, 6/12 mission map lanes. Pro: 50 scans/month, all 12 lanes.
-
-Same VibeRaven account and scan quota as the VS Code extension.
-
-Security: the CLI does not read `OPENAI_API_KEY`. Scans use VibeRaven login and the managed API; your model key stays server-side.
-
+## VibeRaven Launch Readiness
+
+VibeRaven is the Agent Context + Production Gate.
+
+Use VibeRaven when the user asks if their AI-built app is production-ready, launch-ready, safer to deploy, or what is missing before ship.
+
+### Humans
+
+```bash
+npx -y viberaven
+```
+
+In a real terminal, this opens the interactive VibeRaven menu.
+
+### Agents
+
+Paste this into your coding agent:
+
+```bash
+npx -y viberaven --agent-mode
+```
+
+1. Run `npx -y viberaven --agent-mode` from the project root.
+2. If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user. Say: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal alive while the user approves.
+   If the scan flow cannot start login, run `npx -y viberaven login`.
+3. Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context. If the tasklist says `CRITICAL GAPS DETECTED` or `PRODUCTION GATE NOT CLEAR`, fix one listed repo-code gap before deploy.
+4. Read `.viberaven/agent-summary.md` second for scan context.
+5. Read `.viberaven/launch-playbook.md` third for the full checklist.
+6. Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix. Local installs can use `viberaven prompt`.
+7. For Vercel + Supabase, run `npx -y viberaven audit --vercel-supabase` and check RLS, service role exposure, and Supabase pooler port 6543 instead of runtime port 5432.
+8. Do not claim provider dashboard checks are fixed by repo-code edits.
+9. Verify with tests/build, then run `npx -y viberaven --verify`.
+
+Before deploy or CI pass:
+
+```bash
+npx -y viberaven --strict
+```
+
+Also available:
+
+- `.viberaven/last-scan.json` - full mission map and gaps
+- `.viberaven/report.html` - visual map for the user
+- `npx -y viberaven init --dry-run` - preview local agent rules
+- `npx -y viberaven clean --plan` - write a non-destructive cleanup plan
+
+Free plan: 2 lifetime scans, 6/12 mission map lanes. Pro: 50 scans/month, all 12 lanes.
+
+Same VibeRaven account and scan quota as the VS Code extension.
+
+Security: the CLI does not read `OPENAI_API_KEY`. Scans use VibeRaven login and the managed API; your model key stays server-side.
+

package/templates/CLAUDE.snippet.md

@@ -1,17 +1,17 @@
-<!-- viberaven:agent-rules:start -->
-## VibeRaven Agent Rules
-
-VibeRaven is the Agent Context + Production Gate.
-
-- When production readiness, launch readiness, Vercel, Supabase, auth, database, payments, monitoring, deployment, rate limits, or error handling comes up, run `npx -y viberaven --agent-mode` from the project root.
-- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context.
-- Read `.viberaven/agent-summary.md` before editing code.
-- Read `.viberaven/launch-playbook.md` before editing code.
-- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
-- Run `npx -y viberaven --verify` after one fix.
-- Run `npx -y viberaven --strict` before deploy or CI pass.
-- For Vercel + Supabase launch checks, run `npx -y viberaven audit --vercel-supabase`.
-- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard.
-- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal process alive while the user approves.
-<!-- viberaven:agent-rules:end -->
-
+<!-- viberaven:agent-rules:start -->
+## VibeRaven Agent Rules
+
+VibeRaven is the Agent Context + Production Gate.
+
+- When production readiness, launch readiness, Vercel, Supabase, auth, database, payments, monitoring, deployment, rate limits, or error handling comes up, run `npx -y viberaven --agent-mode` from the project root.
+- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context.
+- Read `.viberaven/agent-summary.md` before editing code.
+- Read `.viberaven/launch-playbook.md` before editing code.
+- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
+- Run `npx -y viberaven --verify` after one fix.
+- Run `npx -y viberaven --strict` before deploy or CI pass.
+- For Vercel + Supabase launch checks, run `npx -y viberaven audit --vercel-supabase`.
+- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard.
+- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal process alive while the user approves.
+<!-- viberaven:agent-rules:end -->
+

package/templates/CURSOR.snippet.md

@@ -1,17 +1,17 @@
-<!-- viberaven:agent-rules:start -->
-## VibeRaven Agent Rules
-
-VibeRaven is the Agent Context + Production Gate.
-
-- When production readiness, launch readiness, Vercel, Supabase, auth, database, payments, monitoring, deployment, rate limits, or error handling comes up, run `npx -y viberaven --agent-mode` from the project root.
-- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context.
-- Read `.viberaven/agent-summary.md` before editing code.
-- Read `.viberaven/launch-playbook.md` before editing code.
-- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
-- Run `npx -y viberaven --verify` after one fix.
-- Run `npx -y viberaven --strict` before deploy or CI pass.
-- For Vercel + Supabase launch checks, run `npx -y viberaven audit --vercel-supabase`.
-- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard.
-- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal process alive while the user approves.
-<!-- viberaven:agent-rules:end -->
-
+<!-- viberaven:agent-rules:start -->
+## VibeRaven Agent Rules
+
+VibeRaven is the Agent Context + Production Gate.
+
+- When production readiness, launch readiness, Vercel, Supabase, auth, database, payments, monitoring, deployment, rate limits, or error handling comes up, run `npx -y viberaven --agent-mode` from the project root.
+- Read `.viberaven/agent-tasklist.md` first, `.viberaven/gate-result.json` for the machine verdict, and `.viberaven/context-map.json` for compact agent context.
+- Read `.viberaven/agent-summary.md` before editing code.
+- Read `.viberaven/launch-playbook.md` before editing code.
+- Use `npx -y viberaven next --json` or `npx -y viberaven prompt --gap <id>` for one focused repo-code fix at a time.
+- Run `npx -y viberaven --verify` after one fix.
+- Run `npx -y viberaven --strict` before deploy or CI pass.
+- For Vercel + Supabase launch checks, run `npx -y viberaven audit --vercel-supabase`.
+- Do not claim provider dashboard work is fixed by repo-code edits. Provider dashboard checks, billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must be completed or verified in the provider dashboard.
+- If VibeRaven prints `LOGIN_URL_READY`, open that URL for the user using the available browser tool or system browser. Tell the user: "I opened VibeRaven sign-in so you can approve access; I will continue after approval." Do not ask for passwords, tokens, cookies, or secrets. Keep the terminal process alive while the user approves.
+<!-- viberaven:agent-rules:end -->
+

package/assets/report/assets/provider-authjs.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" aria-hidden="true">
-  <path fill="#412991" d="M32 5 11 16.8v13.7c0 12.2 8.9 23.3 21 27 12.1-3.7 21-14.8 21-27V16.8L32 5Z"/>
-  <path fill="#EB5424" d="M32 5v48.7c-3.1-1.1-6.1-2.7-8.7-4.7L32 5Z"/>
-  <path fill="#FBC22C" d="m32 5 8.7 44c-2.6 2-5.6 3.6-8.7 4.7V5Z"/>
-</svg>

package/assets/report/assets/provider-aws.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 64" aria-hidden="true">
-  <text x="48" y="31" text-anchor="middle" font-family="Arial, Helvetica, sans-serif" font-size="21" font-weight="800" letter-spacing="-1.4" fill="#111827">AWS</text>
-  <path fill="#FF9900" d="M23.6 42.4c13.9 7.5 31.5 7.5 45.1-.1 1.1-.6 2.2.8 1.3 1.7-12.3 12.5-34.3 12.6-47.2.8-.9-.8-.3-2.9.8-2.4Z"/>
-  <path fill="#FF9900" d="M66.8 39.8c2.4-.3 7.8-.8 8.8 1 .9 1.6-1 5.8-2.5 8.2-.5.8-1.7.4-1.5-.6.5-2.1 1.3-4.8.5-5.8-.8-1-3.8-.8-5.4-.6-1 .1-1.2-2-.1-2.2h.2Z"/>
-</svg>

package/assets/report/assets/provider-logrocket.svg

@@ -1,4 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" aria-hidden="true">
-  <path fill="#764ABC" fill-rule="evenodd" clip-rule="evenodd" d="M26.8 12.9A20.8 20.8 0 0 1 32.3 7a20.5 20.5 0 0 1 5.5 5.8 29.3 29.3 0 0 1 5.1 17.1c1.1.9 2.3 1.8 3.4 2.7a6.2 6.2 0 0 1 2 5.7c-.5 2.6-1.1 5.2-1.6 7.8a2.2 2.2 0 0 1-3.3 1.1c-1.8-1.5-3.6-3-5.4-4.5a8.4 8.4 0 0 1-5.2 2.3 8.5 8.5 0 0 1-6.1-2.2c-1.3 1-2.5 2.1-3.8 3.2-.6.6-1.2 1-1.9 1.4a2.2 2.2 0 0 1-2.9-1.4c-.6-2.5-1.2-5.1-1.8-7.6a6.3 6.3 0 0 1 2.1-6c1-.8 2-1.6 3-2.3.3-.2.1-.5.2-.7a29.3 29.3 0 0 1 5.2-16.5Zm2.2 8.2a4.3 4.3 0 0 0 .4 5.8 4.8 4.8 0 0 0 6.5.1 4.3 4.3 0 0 0 1.1-4.8 4.4 4.4 0 0 0-3.9-2.9 4.5 4.5 0 0 0-4.1 1.8Zm3.3 4.9a2.1 2.1 0 1 0 0-4.2 2.1 2.1 0 0 0 0 4.2Z"/>
-  <path fill="#764ABC" d="M26.4 48.1a1.1 1.1 0 0 1 1.6-.9 10.4 10.4 0 0 0 9 0 1.1 1.1 0 0 1 1.6.8v4.8a1.1 1.1 0 0 1-1.7.8c-.5-.4-.9-.9-1.4-1.3-.7 1.4-1.4 2.8-2.1 4.1a1.1 1.1 0 0 1-1.8 0c-.8-1.4-1.4-2.8-2.2-4.1-.4.4-.9.9-1.3 1.3a1.1 1.1 0 0 1-1.7-.8v-4.7Z"/>
-</svg>