vibecarbon 0.1.0

package/carbon/k8s/test-local.sh

@@ -0,0 +1,318 @@
+#!/bin/bash
+# Local Kubernetes Testing with k3d
+# Tests the k8s manifests locally before deploying to production
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+CLUSTER_NAME="vibecarbon-local"
+NAMESPACE="vibecarbon"
+
+# Get script directory
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+print_step() { echo -e "\n${GREEN}▶ $1${NC}"; }
+print_info() { echo -e "${BLUE}ℹ $1${NC}"; }
+print_warning() { echo -e "${YELLOW}⚠ $1${NC}"; }
+print_error() { echo -e "${RED}✗ $1${NC}"; }
+print_success() { echo -e "${GREEN}✓ $1${NC}"; }
+
+check_dependencies() {
+    print_step "Checking dependencies..."
+
+    local missing=()
+
+    command -v docker &> /dev/null || missing+=("docker")
+    command -v kubectl &> /dev/null || missing+=("kubectl")
+    command -v k3d &> /dev/null || missing+=("k3d")
+
+    if [ ${#missing[@]} -ne 0 ]; then
+        print_error "Missing dependencies: ${missing[*]}"
+        echo ""
+        echo "Install instructions:"
+        echo ""
+        if [[ " ${missing[*]} " =~ " kubectl " ]]; then
+            echo "  kubectl:"
+            echo "    curl -LO \"https://dl.k8s.io/release/\$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl\""
+            echo "    sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl"
+            echo ""
+        fi
+        if [[ " ${missing[*]} " =~ " k3d " ]]; then
+            echo "  k3d:"
+            echo "    curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash"
+            echo ""
+        fi
+        exit 1
+    fi
+
+    print_success "All dependencies satisfied"
+}
+
+create_cluster() {
+    print_step "Creating k3d cluster: ${CLUSTER_NAME}"
+
+    # Check if cluster exists
+    if k3d cluster list | grep -q "${CLUSTER_NAME}"; then
+        print_warning "Cluster ${CLUSTER_NAME} already exists"
+        read -p "Delete and recreate? (y/N) " -n 1 -r
+        echo
+        if [[ $REPLY =~ ^[Yy]$ ]]; then
+            k3d cluster delete ${CLUSTER_NAME}
+        else
+            print_info "Using existing cluster"
+            return
+        fi
+    fi
+
+    # Create cluster with port mappings
+    # - 8080:80 for HTTP traffic via Traefik
+    # - 8443:443 for HTTPS traffic
+    # Note: k3d comes with built-in Traefik, but we deploy our own
+    k3d cluster create ${CLUSTER_NAME} \
+        --port "8080:80@loadbalancer" \
+        --port "8443:443@loadbalancer" \
+        --agents 1 \
+        --k3s-arg "--disable=traefik@server:0" \
+        --wait
+
+    print_success "Cluster created"
+}
+
+install_traefik_crds() {
+    print_step "Installing Traefik CRDs..."
+
+    # Install Traefik CRDs from the official Traefik helm chart
+    # These are needed for IngressRoute and Middleware resources
+    kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.2/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml 2>/dev/null || {
+        print_warning "Could not fetch Traefik v3 CRDs, trying v2..."
+        kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+    }
+
+    print_success "Traefik CRDs installed"
+}
+
+deploy_manifests() {
+    print_step "Deploying Kubernetes manifests..."
+
+    # Install Traefik CRDs first (since we disabled k3d's built-in Traefik)
+    install_traefik_crds
+
+    # Use the local overlay which:
+    # - Sets correct namespace (vibecarbon)
+    # - Uses local-path storage class instead of hcloud-volumes
+    # - Uses nginx placeholder for app image
+    # - Includes secrets and configmap
+    # - Reduces replicas for local testing
+
+    print_info "Applying local overlay..."
+
+    # Apply the local overlay with kustomize
+    # Use kustomize build with load restrictor to allow referencing base manifests
+    kubectl kustomize "${SCRIPT_DIR}/overlays/local" --load-restrictor=LoadRestrictionsNone | kubectl apply -f -
+
+    print_success "Manifests deployed"
+}
+
+wait_for_pods() {
+    print_step "Waiting for pods to be ready..."
+
+    local timeout=300
+    local start_time=$(date +%s)
+
+    # First, wait for any pods to appear
+    print_info "Waiting for pods to be created..."
+    local pod_count=0
+    while [ $pod_count -eq 0 ]; do
+        local current_time=$(date +%s)
+        local elapsed=$((current_time - start_time))
+
+        if [ $elapsed -gt 60 ]; then
+            print_warning "No pods created after 60s, checking all namespaces..."
+            kubectl get pods -A
+            break
+        fi
+
+        pod_count=$(kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | wc -l)
+        if [ $pod_count -eq 0 ]; then
+            sleep 2
+        fi
+    done
+
+    # Now wait for pods to be ready
+    while true; do
+        local current_time=$(date +%s)
+        local elapsed=$((current_time - start_time))
+
+        if [ $elapsed -gt $timeout ]; then
+            print_error "Timeout waiting for pods"
+            echo ""
+            echo "Pod Status:"
+            kubectl get pods -n ${NAMESPACE} -o wide
+            echo ""
+            echo "Events:"
+            kubectl get events -n ${NAMESPACE} --sort-by='.lastTimestamp' | tail -20
+            exit 1
+        fi
+
+        local total=$(kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | wc -l)
+        local running=$(kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | grep "Running" | wc -l)
+        local pending=$(kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | grep -E "Pending|ContainerCreating|Init" | wc -l)
+        local failed=$(kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | grep -E "Error|CrashLoopBackOff|ImagePullBackOff|CreateContainerConfigError" | wc -l)
+
+        if [ "$total" -gt 0 ] && [ "$running" -eq "$total" ]; then
+            print_success "All ${total} pods ready"
+            break
+        fi
+
+        if [ "$failed" -gt 0 ]; then
+            print_warning "${failed} pods have errors (will continue waiting...)"
+        fi
+
+        print_info "Pods: ${running}/${total} running, ${pending} pending (${elapsed}s)"
+        sleep 5
+    done
+}
+
+show_status() {
+    print_step "Deployment Status"
+
+    echo ""
+    echo "Pods:"
+    kubectl get pods -n ${NAMESPACE} -o wide 2>/dev/null || echo "No pods found"
+
+    echo ""
+    echo "Services:"
+    kubectl get svc -n ${NAMESPACE} 2>/dev/null || echo "No services found"
+
+    echo ""
+    echo "PVCs:"
+    kubectl get pvc -n ${NAMESPACE} 2>/dev/null || echo "No PVCs found"
+}
+
+show_access_info() {
+    print_step "Access Information"
+
+    echo ""
+    echo -e "${BLUE}Local URLs (no auth required):${NC}"
+    echo "  App:       http://localhost:8080"
+    echo "  Studio:    http://studio.localhost:8080"
+    echo "  n8n:       http://n8n.localhost:8080  (admin / local-n8n-password)"
+    echo "  Traefik:   http://traefik.localhost:8080"
+    echo ""
+    echo -e "${BLUE}Admin URLs (requires admin role - production-like):${NC}"
+    echo "  Studio:    http://localhost:8080/admin/studio"
+    echo "  n8n:       http://localhost:8080/admin/n8n"
+    echo ""
+    echo -e "${BLUE}Supabase API (via Kong):${NC}"
+    echo "  Auth:      http://localhost:8080/auth/v1/"
+    echo "  REST:      http://localhost:8080/rest/v1/"
+    echo "  Realtime:  http://localhost:8080/realtime/v1/"
+    echo "  Storage:   http://localhost:8080/storage/v1/"
+    echo ""
+    echo -e "${BLUE}App API:${NC}"
+    echo "  Health:    http://localhost:8080/api/health"
+    echo "  Docs:      http://localhost:8080/api/docs"
+    echo "  v1 API:    http://localhost:8080/api/v1/..."
+    echo ""
+    echo -e "${BLUE}Port Forwarding (direct service access):${NC}"
+    echo "  kubectl port-forward svc/postgres 5432:5432 -n ${NAMESPACE}"
+    echo "  kubectl port-forward svc/kong 8000:8000 -n ${NAMESPACE}"
+    echo "  kubectl port-forward svc/studio 3001:3000 -n ${NAMESPACE}"
+    echo ""
+    echo -e "${BLUE}View logs:${NC}"
+    echo "  kubectl logs -f statefulset/postgres -n ${NAMESPACE}"
+    echo "  kubectl logs -f deployment/kong -n ${NAMESPACE}"
+    echo "  kubectl logs -f deployment/auth -n ${NAMESPACE}"
+    echo "  kubectl logs -f deployment/app -n ${NAMESPACE}"
+    echo ""
+    echo -e "${BLUE}Delete cluster when done:${NC}"
+    echo "  k3d cluster delete ${CLUSTER_NAME}"
+    echo "  # or: pnpm k8s:local:down"
+    echo ""
+}
+
+debug_pods() {
+    print_step "Debugging pod issues..."
+
+    echo ""
+    echo "Failed/Pending pods:"
+    kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | grep -v "Running" || echo "All pods running"
+
+    echo ""
+    echo "Recent events:"
+    kubectl get events -n ${NAMESPACE} --sort-by='.lastTimestamp' 2>/dev/null | tail -15
+
+    local problem_pod=$(kubectl get pods -n ${NAMESPACE} --no-headers 2>/dev/null | grep -v "Running" | head -1 | awk '{print $1}')
+    if [ -n "$problem_pod" ]; then
+        echo ""
+        echo "Details for problematic pod: $problem_pod"
+        kubectl describe pod "$problem_pod" -n ${NAMESPACE} 2>/dev/null | tail -30
+    fi
+}
+
+cleanup() {
+    print_step "Cleaning up local cluster..."
+    k3d cluster delete ${CLUSTER_NAME}
+
+    # Also delete k3d docker volumes to ensure fresh state
+    docker volume rm k3d-${CLUSTER_NAME}-images 2>/dev/null || true
+
+    print_success "Cluster deleted"
+}
+
+# Parse arguments
+case "${1:-}" in
+    "delete"|"cleanup"|"down")
+        cleanup
+        exit 0
+        ;;
+    "status")
+        kubectl config use-context k3d-${CLUSTER_NAME} 2>/dev/null || true
+        show_status
+        exit 0
+        ;;
+    "logs")
+        kubectl config use-context k3d-${CLUSTER_NAME} 2>/dev/null || true
+        kubectl logs -f "${2:-deployment/app}" -n ${NAMESPACE}
+        exit 0
+        ;;
+    "debug")
+        kubectl config use-context k3d-${CLUSTER_NAME} 2>/dev/null || true
+        debug_pods
+        exit 0
+        ;;
+    "help"|"-h"|"--help")
+        echo "Usage: $0 [command]"
+        echo ""
+        echo "Commands:"
+        echo "  (none)     Create cluster and deploy"
+        echo "  status     Show pod/service status"
+        echo "  logs       Follow logs (default: deployment/app)"
+        echo "  debug      Debug failing pods"
+        echo "  delete     Delete the local cluster"
+        echo "  help       Show this help"
+        exit 0
+        ;;
+esac
+
+# Main flow
+echo -e "${BLUE}"
+echo "╔════════════════════════════════════════════════════════════╗"
+echo "║         Vibecarbon Local Kubernetes Testing                ║"
+echo "╚════════════════════════════════════════════════════════════╝"
+echo -e "${NC}"
+
+check_dependencies
+create_cluster
+deploy_manifests
+wait_for_pods
+show_status
+show_access_info
+
+print_success "Local k8s environment ready!"

package/carbon/k8s/values/supabase.values.yaml

@@ -0,0 +1,133 @@
+# Supabase Helm chart values (supabase-community/supabase-kubernetes).
+#
+# Chart schema reference:
+#   helm show values supabase-community/supabase
+#
+# Top-level keys recognised by this chart: secret, deployment, image,
+# environment, persistence, service, autoscaling, ingress, migration,
+# bigQuery. Component toggles live under `deployment.<comp>.enabled` —
+# top-level keys like `functions:` or `analytics:` are silently ignored.
+#
+# Placeholders like {{DOMAIN}} are substituted at deploy time in
+# installSupabase — do not hand-edit after deploy.
+#
+# We intentionally do NOT set fullnameOverride/nameOverride: the chart's
+# generated resources ignore the top-level override, so attempting to
+# rename creates a mismatch (ConfigMap URLs stop resolving). Deploy code
+# and the production overlay reference the chart-generated names directly
+# (`supabase-supabase-<component>`).
+
+# Shared secret wiring — every component reads from the vibecarbon-secrets
+# Secret created by applyVibecarbonSecrets before helm install runs. The
+# chart's `secretRef` + `secretRefKey` map the chart's internal field
+# names to keys in our secret; plain `secretName: vibecarbon-secrets`
+# does NOT work — the chart silently falls back to generating its own
+# supabase-jwt/supabase-dashboard secrets with random values (hit on
+# 2026-04-19 run #3 — Kong rejected our app's SERVICE_ROLE_KEY because
+# it was signed with our JWT_SECRET while the chart-generated
+# supabase-jwt.secret was a different string).
+secret:
+  jwt:
+    secretRef: vibecarbon-secrets
+    secretRefKey:
+      anonKey: ANON_KEY
+      serviceKey: SERVICE_ROLE_KEY
+      secret: JWT_SECRET
+  dashboard:
+    # Inline values — dashboard.openAiApiKey is chart-required and we don't
+    # ship one in vibecarbon-secrets. Using secretRef here would force the
+    # chart to read EVERY dashboard field from the secret (including
+    # openAiApiKey), and kubelet would fail the studio StatefulSet with
+    # "couldn't find key openAiApiKey in Secret vibecarbon/vibecarbon-secrets".
+    # Inline values are rendered into the chart's own supabase-dashboard
+    # secret at install time — still secure, just not deduped into ours.
+    username: "{{ADMIN_EMAIL}}"
+    password: "{{ADMIN_PASSWORD}}"
+    openAiApiKey: ""
+  db:
+    secretRef: vibecarbon-secrets
+    # When secretRef is set, the chart uses secret keys for every db.* value
+    # (inline values are ignored). Maps the chart's lowercase field names to
+    # the uppercase keys vibecarbon-secrets ships (DB_NAME defaulted to
+    # "postgres" by applyVibecarbonSecrets).
+    secretRefKey:
+      password: DB_PASSWORD
+      database: DB_NAME
+
+# Component enable toggles — chart's path is deployment.<comp>.enabled.
+# Top-level `functions:`/`analytics:`/`vector:` are silently ignored
+# (was the bug behind the 2026-04-26 e2e helm-wait timeout).
+deployment:
+  functions:
+    # Chart's edge-runtime expects a function source at /home/deno/functions.
+    # The template doesn't ship a default `main/index.ts`, so the chart's
+    # default deployment fetches `https://deno.land/x/jose@v4.14.4/index.ts`
+    # at boot — and the network policy + missing function source produce
+    # a CrashLoopBackOff that holds up `helm --wait`. Re-enable once a
+    # project actually defines a function.
+    enabled: false
+  analytics:
+    # Logflare — disable until we need it. Adds ClickHouse + BigQuery deps.
+    enabled: false
+  vector:
+    # Log-shipper — disable; conflicts with the optional observability stack.
+    enabled: false
+  db:
+    # Pin postgres to the dedicated supabase node (taint applied by Pulumi).
+    nodeSelector:
+      dedicated: supabase
+    tolerations:
+      - key: dedicated
+        operator: Equal
+        value: supabase
+        effect: NoSchedule
+
+# Per-component environment — chart's path is environment.<comp>.
+environment:
+  auth:
+    API_EXTERNAL_URL: https://{{DOMAIN}}
+    GOTRUE_SITE_URL: https://{{DOMAIN}}
+    GOTRUE_EXTERNAL_EMAIL_ENABLED: "true"
+    # Auto-confirm signups: the chart doesn't ship an SMTP provider, so
+    # leaving AUTOCONFIRM=false makes every signup return 500 "Error
+    # sending confirmation email" (observed 2026-04-26 batch run #3 —
+    # k8s verify-deploy failed at the auth_signup check). Real
+    # production deployments override this to false once they wire up
+    # SMTP (configure SMTP_* env in the auth section). Default-true is
+    # the right call for an out-of-the-box deploy that doesn't have a
+    # mail provider.
+    GOTRUE_MAILER_AUTOCONFIRM: "true"
+  realtime:
+    DB_NAME: postgres
+  storage:
+    STORAGE_BACKEND: s3
+  imgproxy:
+    IMGPROXY_USE_S3: "true"
+  studio:
+    SUPABASE_PUBLIC_URL: https://{{DOMAIN}}
+    STUDIO_DEFAULT_ORGANIZATION: "{{PROJECT_NAME}}"
+  # Kong reads its declarative config from /usr/local/kong/kong.yml — written
+  # by the chart's kong-entrypoint.sh after env substitution. The chart's
+  # default `KONG_DECLARATIVE_CONFIG` already points at this path, so leave
+  # it un-overridden. (Setting it to `/usr/local/kong/declarative/kong.yml`
+  # — which doesn't exist — was the cause of the 2026-04-26 e2e kong
+  # CrashLoopBackOff.)
+
+# We front Kong with our own Traefik IngressRoute (k8s/base/traefik) — the
+# chart's ingress object is off so we don't end up with two ingresses
+# pointing at the same Service.
+ingress:
+  enabled: false
+
+# Persistence:
+# - db: bump default 5Gi → 10Gi.
+# - functions: disable PVC creation. The chart's persistence.functions PVC
+#   is independent of deployment.functions.enabled — without this, studio
+#   stays Pending forever waiting for a `supabase-functions` PVC that
+#   persistence.yaml gates on `deployment.functions.enabled` (off here).
+persistence:
+  db:
+    enabled: true
+    size: 10Gi
+  functions:
+    enabled: false

package/carbon/package.json

@@ -0,0 +1,154 @@
+{
+  "name": "vibecarbon-template",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "packageManager": "pnpm@10.32.1",
+  "scripts": {
+    "dev:init": "node scripts/dev-init.js",
+    "dev:start": "node scripts/docker-up.js && pnpm db:migrate && exec node scripts/dev.js",
+    "dev:start:all": "node scripts/docker-up.js --all && pnpm db:migrate && exec node scripts/dev.js",
+    "dev:stop": "node scripts/docker-down.js",
+    "dev:stop:all": "node scripts/docker-down.js --all",
+    "dev:reset": "node scripts/docker-down.js -v --rmi",
+    "dev:reset:all": "node scripts/docker-down.js -v --rmi --all",
+    "dev": "exec node scripts/dev.js",
+    "dev:server": "tsx watch --env-file=.env.local src/server/index.ts",
+    "dev:client": "vite",
+    "build": "pnpm build:client && pnpm build:server",
+    "build:client": "vite build && tsx scripts/generate-sitemap.ts && tsx scripts/generate-rss.ts",
+    "build:server": "esbuild src/server/index.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/server/index.js --external:pino --external:pino-pretty --banner:js=\"import{createRequire as __cr}from'module';const require=__cr(import.meta.url);\"",
+    "start": "node dist/server/index.js",
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "format": "biome format --write .",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.server.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:unit": "vitest run --project unit",
+    "test:component": "vitest run --project component",
+    "test:integration": "vitest run --project integration",
+    "test:coverage": "vitest run --coverage",
+    "test:prepush": "pnpm lint && pnpm test:unit && pnpm test:component && pnpm test:integration",
+    "docker:up": "node scripts/docker-up.js",
+    "docker:up:all": "node scripts/docker-up.js --all",
+    "docker:down": "node scripts/docker-down.js",
+    "docker:down:all": "node scripts/docker-down.js --all",
+    "docker:logs": "node scripts/docker-logs.js",
+    "docker:reset": "node scripts/docker-down.js -v --rmi",
+    "docker:reset:all": "node scripts/docker-down.js -v --rmi --all",
+    "docker:prod:up": "node scripts/docker-up.js --prod",
+    "docker:prod:down": "node scripts/docker-down.js --prod",
+    "db:migrate": "docker compose exec db bash -c 'for f in /migrations/*.sql; do psql -U postgres -d postgres -f \"$f\" || exit 1; done' && docker compose exec db psql -U postgres -d postgres -f /tmp/super-admin.sql",
+    "db:reset": "node scripts/docker-down.js -v && node scripts/docker-up.js",
+    "k8s:apply": "node scripts/k8s-apply.js",
+    "k8s:delete": "node scripts/k8s-delete.js",
+    "k8s:local:up": "./k8s/test-local.sh",
+    "k8s:local:status": "./k8s/test-local.sh status",
+    "k8s:local:debug": "./k8s/test-local.sh debug",
+    "k8s:local:down": "./k8s/test-local.sh delete",
+    "stripe:listen": "stripe listen --forward-to localhost:3000/api/webhooks/stripe"
+  },
+  "dependencies": {
+    "@base-ui/react": "^1.3.0",
+    "@fontsource-variable/noto-sans": "^5.2.10",
+    "@fontsource/jetbrains-mono": "^5.2.8",
+    "@hono/node-server": "^1.19.13",
+    "@hono/zod-openapi": "^1.2.3",
+    "@hookform/resolvers": "^5.2.2",
+    "@mdx-js/react": "^3.1.1",
+    "@mdx-js/rollup": "^3.1.1",
+    "@scalar/api-reference-react": "^0.9.15",
+    "@supabase/ssr": "^0.9.0",
+    "@supabase/supabase-js": "^2.100.0",
+    "@tanstack/react-query": "^5.95.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "date-fns": "^4.1.0",
+    "embla-carousel-react": "^8.6.0",
+    "framer-motion": "^12.38.0",
+    "hono": "^4.12.16",
+    "i18next": "^25.10.9",
+    "i18next-browser-languagedetector": "^8.2.1",
+    "input-otp": "^1.4.2",
+    "ioredis": "^5.10.1",
+    "lenis": "^1.3.20",
+    "lucide-react": "^1.7.0",
+    "next-themes": "^0.4.6",
+    "nodemailer": "^8.0.5",
+    "pino": "^10.3.1",
+    "react": "^19.2.4",
+    "react-day-picker": "^9.14.0",
+    "react-dom": "^19.2.4",
+    "react-hook-form": "^7.72.0",
+    "react-i18next": "^16.6.6",
+    "react-resizable-panels": "^4.7.6",
+    "react-router-dom": "^7.13.2",
+    "recharts": "^3.8.1",
+    "rehype-autolink-headings": "^7.1.0",
+    "rehype-slug": "^6.0.0",
+    "remark-frontmatter": "^5.0.0",
+    "remark-mdx-frontmatter": "^5.2.0",
+    "sonner": "^2.0.7",
+    "stripe": "^20.4.1",
+    "tailwind-merge": "^3.5.0",
+    "vaul": "^1.1.2",
+    "zod": "^4.3.6"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild",
+      "msw"
+    ],
+    "allowedDeprecatedVersions": {
+      "node-domexception": "1.0.0"
+    },
+    "overrides": {
+      "dompurify": "^3.4.0",
+      "unhead": ">=2.1.13",
+      "defu": ">=6.1.5",
+      "path-to-regexp@>=8.0.0": ">=8.4.0",
+      "postcss@<8.5.10": ">=8.5.10",
+      "ip-address@<10.1.1": ">=10.1.1",
+      "fast-uri@<3.1.2": ">=3.1.2",
+      "protobufjs@<7.5.6": "^7.5.6",
+      "@protobufjs/utf8@<1.1.1": "^1.1.1"
+    },
+    "peerDependencyRules": {
+      "allowedVersions": {
+        "typescript": "*"
+      }
+    }
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.9",
+    "@hono/swagger-ui": "^0.6.1",
+    "@scalar/hono-api-reference": "^0.10.5",
+    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/vite": "^4.2.2",
+    "@testing-library/jest-dom": "^6.6.3",
+    "@testing-library/react": "^16.3.0",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/node": "^25.5.0",
+    "@types/nodemailer": "^7.0.11",
+    "@types/pg": "^8.20.0",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react": "^6.0.1",
+    "@vitest/coverage-v8": "^4.1.1",
+    "concurrently": "^9.2.1",
+    "esbuild": "^0.27.4",
+    "jsdom": "^26.1.0",
+    "pg": "^8.20.0",
+    "pino-pretty": "^13.1.3",
+    "remark-gfm": "^4.0.1",
+    "shadcn": "^4.1.0",
+    "tailwindcss": "^4.2.2",
+    "tsx": "^4.21.0",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "^6.0.2",
+    "vite": "^8.0.5",
+    "vitest": "^4.1.1"
+  }
+}

package/carbon/runtime.Dockerfile

@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1
+# Vibecarbon Runtime Base Image
+# This image contains the pre-installed node_modules for the Vibecarbon template.
+# Using this as a base for your app image reduces build times from minutes to seconds.
+
+FROM node:22-alpine3.23 AS base
+
+RUN npm install -g pnpm@9
+WORKDIR /app
+
+# Pre-install dependencies
+COPY package.json pnpm-lock.yaml ./
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
+
+# This image is meant to be a base, so we stop here.
+# The app build will continue FROM this image.

package/carbon/scripts/_dev-jwt.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+// Sign HS256 JWTs from a shared dev secret. Used by dev-init.js and
+// generate-dev-configs.sh to produce ANON / SERVICE_ROLE keys at runtime
+// so the carbon template doesn't ship literal JWT strings — those would
+// trip every secret-scanner that looked at the repo (GitHub's, ours,
+// gitleaks, ...). The values are still deterministic for a given
+// JWT_SECRET, so dev workflows that depend on stable keys keep working
+// across runs.
+//
+// Usage:
+//   node scripts/_dev-jwt.mjs <role>
+//
+// Where <role> is `anon` or `service_role`. JWT_SECRET must be set in
+// the environment. Prints the JWT to stdout (no newline) on success;
+// non-zero exit on bad input.
+
+import { createHmac } from 'node:crypto';
+
+const role = process.argv[2];
+if (role !== 'anon' && role !== 'service_role') {
+  process.stderr.write('usage: _dev-jwt.mjs (anon|service_role)\n');
+  process.exit(2);
+}
+const secret = process.env.JWT_SECRET;
+if (!secret) {
+  process.stderr.write('JWT_SECRET must be set in the environment\n');
+  process.exit(2);
+}
+
+const b64url = (buf) =>
+  Buffer.from(buf).toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+
+const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+const payload = b64url(
+  JSON.stringify({
+    iss: 'supabase-demo',
+    role,
+    // 100-year expiry: dev tokens shouldn't churn during a single
+    // engineer's career. Production tokens are signed elsewhere with
+    // shorter lifetimes; this is local-dev only.
+    exp: Math.floor(Date.now() / 1000) + 100 * 365 * 24 * 60 * 60,
+  }),
+);
+const sig = b64url(createHmac('sha256', secret).update(`${header}.${payload}`).digest());
+process.stdout.write(`${header}.${payload}.${sig}`);