vibecarbon 0.1.0

package/carbon/scripts/check-rls.ts

@@ -0,0 +1,53 @@
+import { Client } from 'pg';
+import { env } from '../src/server/lib/env';
+
+/**
+ * CI/CD Security Check
+ * Verifies that Row Level Security (RLS) is enabled on ALL tables in the 'public' schema.
+ * 
+ * This ensures that no table is accidentally left open to public access 
+ * (especially now that we rely on RLS as the primary defense mechanism).
+ */
+
+async function main() {
+    console.log('🔒 Verifying Row Level Security (RLS) policies...');
+
+    // Use connection string from env or default to local dev
+    const connectionString =
+        process.env.DATABASE_URL ||
+        `postgres://postgres:${process.env.POSTGRES_PASSWORD || 'postgres'}@localhost:5432/postgres`;
+
+    const client = new Client({ connectionString });
+
+    try {
+        await client.connect();
+
+        // Query finding tables in public schema that have RLS disabled
+        const result = await client.query(`
+      SELECT tablename 
+      FROM pg_tables 
+      WHERE schemaname = 'public' 
+      AND rowsecurity = false;
+    `);
+
+        if (result.rows.length > 0) {
+            console.error('\n❌ CRITICAL SECURITY FAILURE: The following tables do not have RLS enabled:');
+            result.rows.forEach(row => {
+                console.error(`   - ${row.tablename}`);
+            });
+            console.error('\nResult: Security check FAILED. All public tables must have RLS enabled.');
+            process.exit(1);
+        }
+
+        console.log('✅ Success: All tables in public schema have RLS enabled.');
+        process.exit(0);
+
+    } catch (err) {
+        console.error('Error running security check:', err);
+        process.exit(1);
+    } finally {
+        await client.end();
+    }
+}
+
+main();

package/carbon/scripts/dev-init.js

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+/**
+ * Generate .env and .env.local for developing directly in the carbon/ template.
+ *
+ * Uses the same hardcoded dev values as generate-dev-configs.sh
+ * so everything works out of the box without running `vibecarbon create`.
+ *
+ * Usage:
+ *   node scripts/dev-init.js           # Generate if missing
+ *   node scripts/dev-init.js --force   # Overwrite existing files
+ */
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+
+const force = process.argv.includes('--force');
+
+// Dev values matching generate-dev-configs.sh.
+// Note: ANON_KEY / SERVICE_ROLE_KEY are NOT hardcoded here — they're
+// signed at runtime against JWT_SECRET below. Committing literal JWT
+// strings tripped GitHub's secret-scanner on every push; signing on
+// the fly keeps the dev workflow deterministic without leaking
+// service-role-shaped values into git history.
+const DEV = {
+  PROJECT_NAME: 'vibecarbon',
+  JWT_SECRET: 'local-dev-jwt-secret-must-be-at-least-32-chars-padded-padded',
+  DB_ENC_KEY: 'devdbencryptkey1',
+  VAULT_ENC_KEY: 'local-vault-encryption-key-1234567890',
+  REALTIME_SECRET: 'local-realtime-secret-pad',
+  DB_PASSWORD: 'local-postgres-password-for-dev-only',
+  ANON_KEY: signDevJwt('anon', 'local-dev-jwt-secret-must-be-at-least-32-chars-padded-padded'),
+  SERVICE_ROLE_KEY: signDevJwt(
+    'service_role',
+    'local-dev-jwt-secret-must-be-at-least-32-chars-padded-padded',
+  ),
+  ADMIN_EMAIL: 'admin@example.com',
+  ADMIN_PASSWORD: 'local-admin-password',
+};
+
+function signDevJwt(role, secret) {
+  const { createHmac } = require('node:crypto');
+  const b64url = (buf) =>
+    Buffer.from(buf)
+      .toString('base64')
+      .replace(/=+$/, '')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_');
+  const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const payload = b64url(
+    JSON.stringify({
+      iss: 'supabase-demo',
+      role,
+      exp: Math.floor(Date.now() / 1000) + 100 * 365 * 24 * 60 * 60,
+    }),
+  );
+  const sig = b64url(createHmac('sha256', secret).update(`${header}.${payload}`).digest());
+  return `${header}.${payload}.${sig}`;
+}
+
+const envContent = `# =============================================================================
+# DEV ENVIRONMENT - Generated by \`pnpm dev:init\`
+# Matches hardcoded values in generate-dev-configs.sh
+# DO NOT COMMIT THIS FILE
+# =============================================================================
+
+# Project
+PROJECT_NAME="${DEV.PROJECT_NAME}"
+VITE_PROJECT_NAME="${DEV.PROJECT_NAME}"
+
+# Supabase URLs (base ports — DEV_PORT_OFFSET is applied dynamically at runtime
+# by src/server/lib/env.ts and vite.config.ts, so these stay at default 8000)
+SUPABASE_URL="http://localhost:8000"
+VITE_SUPABASE_URL="http://localhost:8000"
+
+# Supabase Keys (standard Supabase demo keys)
+SUPABASE_ANON_KEY="${DEV.ANON_KEY}"
+VITE_SUPABASE_ANON_KEY="${DEV.ANON_KEY}"
+SUPABASE_SERVICE_ROLE_KEY="${DEV.SERVICE_ROLE_KEY}"
+
+# JWT Secret
+JWT_SECRET="${DEV.JWT_SECRET}"
+
+# Database
+DB_PASSWORD="${DEV.DB_PASSWORD}"
+POSTGRES_PASSWORD="${DEV.DB_PASSWORD}"
+
+# Encryption keys (DB_ENC_KEY must be exactly 16 bytes for Realtime AES-128-ECB)
+DB_ENC_KEY="${DEV.DB_ENC_KEY}"
+VAULT_ENC_KEY="${DEV.VAULT_ENC_KEY}"
+REALTIME_SECRET="${DEV.REALTIME_SECRET}"
+
+# Admin credentials (matches super-admin.dev.sql)
+ADMIN_EMAIL="${DEV.ADMIN_EMAIL}"
+ADMIN_PASSWORD="${DEV.ADMIN_PASSWORD}"
+
+# Site URL (base port — offset applied dynamically, see above)
+SITE_URL="http://localhost:5173"
+
+# OAuth (disabled for dev)
+GOOGLE_ENABLED="false"
+GOOGLE_CLIENT_ID=""
+GOOGLE_CLIENT_SECRET=""
+
+MICROSOFT_ENABLED="false"
+MICROSOFT_CLIENT_ID=""
+MICROSOFT_CLIENT_SECRET=""
+MICROSOFT_TENANT_ID=""
+
+# External services (disabled for dev)
+STRIPE_SECRET_KEY=""
+STRIPE_WEBHOOK_SECRET=""
+SMTP_HOST=""
+SMTP_PORT="587"
+SMTP_USER=""
+SMTP_PASS=""
+# SMTP_ADMIN_EMAIL=""
+SMTP_SENDER_NAME="${DEV.PROJECT_NAME}"
+
+# Optional services
+VITE_N8N_ENABLED="false"
+VITE_OBSERVABILITY_ENABLED="false"
+
+# Analytics (Plausible - leave empty to disable)
+VITE_PLAUSIBLE_DOMAIN=""
+VITE_PLAUSIBLE_SCRIPT_URL=""
+
+# Observability
+GRAFANA_ADMIN_USER="admin"
+GRAFANA_ADMIN_PASSWORD="admin"
+
+# Ports
+DEV_PORT_OFFSET="0"
+
+# Environment
+NODE_ENV="development"
+PORT="3000"
+VITE_ENVIRONMENT="development"
+VITE_APP_VERSION="0.1.0"
+`;
+
+function writeEnv(filename) {
+  if (existsSync(filename) && !force) {
+    console.log(`  SKIP: ${filename} (exists, use --force to overwrite)`);
+    return false;
+  }
+  writeFileSync(filename, envContent, { mode: 0o600 });
+  console.log(`  ${force && existsSync(filename) ? 'OVERWRITTEN' : 'CREATED'}: ${filename}`);
+  return true;
+}
+
+console.log('');
+console.log('  Generating dev environment files...');
+console.log('');
+
+const wrote1 = writeEnv('.env');
+const wrote2 = writeEnv('.env.local');
+
+// Generate super-admin SQL with real credentials from the dev template.
+// The template has ADMIN_EMAIL and ADMIN_PASSWORD_HASH placeholders that
+// `vibecarbon create` replaces for real projects. For local CLI development we
+// generate a separate file so the template stays clean (tracked by git), plus a
+// docker-compose override that mounts the generated file into the db container.
+// The hash is pre-computed for the fixed dev password — no bcrypt dependency needed.
+const ADMIN_PASSWORD_HASH = '$2b$10$OWzZo/eSlFAb2S9oX4Ps5.prj7LzVfAWo7N1cFrL3N8Z3HLUZtvOm';
+const sqlTemplatePath = 'volumes/db/super-admin.dev.sql';
+const sqlGeneratedPath = 'volumes/db/super-admin.generated.sql';
+if (existsSync(sqlTemplatePath)) {
+  const sql = readFileSync(sqlTemplatePath, 'utf-8')
+    .replace(/\{\{ADMIN_EMAIL\}\}/g, DEV.ADMIN_EMAIL)
+    .replace(/\{\{ADMIN_PASSWORD_HASH\}\}/g, ADMIN_PASSWORD_HASH);
+  writeFileSync(sqlGeneratedPath, sql);
+  console.log(`  CREATED: ${sqlGeneratedPath} (dev admin credentials)`);
+
+  // Write a compose override that mounts the generated SQL instead of the template
+  const composeOverride = `# Generated by dev-init.js — DO NOT COMMIT
+services:
+  db:
+    volumes:
+      - ./volumes/db/super-admin.generated.sql:/docker-entrypoint-initdb.d/post-init/super-admin.sql:Z
+`;
+  writeFileSync('docker-compose.dev-init.yml', composeOverride);
+  console.log('  CREATED: docker-compose.dev-init.yml (mounts generated admin SQL)');
+}
+
+console.log('');
+if (wrote1 || wrote2) {
+  console.log(`  Admin login: ${DEV.ADMIN_EMAIL} / ${DEV.ADMIN_PASSWORD}`);
+  console.log('  Run `pnpm dev:start` to start all services.');
+} else {
+  console.log('  No files written. Use --force to overwrite existing files.');
+}
+console.log('');

package/carbon/scripts/dev.js

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+/**
+ * Development server script with proper signal handling.
+ * Spawns both the API server (tsx watch) and Vite dev server,
+ * and ensures clean shutdown on Ctrl+C.
+ */
+
+import { execFileSync, spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { createServer } from 'node:net';
+
+const isWindows = process.platform === 'win32';
+
+// Read project name from package.json
+let projectName = 'your app';
+try {
+  const pkg = JSON.parse(readFileSync('package.json', 'utf-8'));
+  projectName = pkg.name || projectName;
+} catch {
+  // Ignore errors, use default
+}
+
+// Read port configuration from .env.local
+function getPortConfig() {
+  const defaults = { vite: 5173, api: 3000 };
+  try {
+    const envFiles = ['.env.local', '.env'];
+    for (const file of envFiles) {
+      if (existsSync(file)) {
+        const content = readFileSync(file, 'utf-8');
+        const getEnvValue = (key) => {
+          const match = content.match(new RegExp(`^${key}=["']?([^"'\\n]+)["']?`, 'm'));
+          return match ? match[1] : null;
+        };
+
+        const portOffset = Number.parseInt(getEnvValue('DEV_PORT_OFFSET') || '0', 10);
+        const vitePort = getEnvValue('DEV_VITE_PORT') || String(5173 + portOffset);
+        const apiPort = getEnvValue('DEV_API_PORT') || String(3000 + portOffset);
+
+        return { vite: Number.parseInt(vitePort, 10), api: Number.parseInt(apiPort, 10) };
+      }
+    }
+  } catch {
+    // Fall through to defaults
+  }
+  return defaults;
+}
+
+/** Resolves to true if no listener can grab the port on 0.0.0.0. */
+function isPortFree(port) {
+  return new Promise((resolve) => {
+    const probe = createServer();
+    probe.once('error', () => resolve(false));
+    probe.once('listening', () => probe.close(() => resolve(true)));
+    probe.listen(port, '0.0.0.0');
+  });
+}
+
+/** Best-effort `command/pid` lookup for whatever owns a busy port. */
+function describePortHolder(port) {
+  if (isWindows) return null;
+  // execFileSync (no shell) — port is already numeric, but using execFile
+  // keeps us aligned with the codebase's no-shell convention.
+  if (!Number.isInteger(port)) return null;
+  try {
+    const out = execFileSync('lsof', [`-iTCP:${port}`, '-sTCP:LISTEN', '-P', '-n'], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const dataLines = out.trim().split('\n').slice(1);
+    if (dataLines.length === 0) return null;
+    const [command, pid] = dataLines[0].split(/\s+/);
+    return { command, pid };
+  } catch {
+    return null;
+  }
+}
+
+const ports = getPortConfig();
+
+// ANSI colors
+const cyan = (s) => `\x1b[36m${s}\x1b[0m`;
+const bold = (s) => `\x1b[1m${s}\x1b[0m`;
+const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
+
+// Pre-flight: fail fast if either port is already in use. Without this,
+// `tsx watch` swallows the EADDRINUSE from the API server, Vite keeps
+// serving on its port, and `/api/*` requests return 502 with empty bodies —
+// surfacing in the UI as "Unexpected end of JSON input".
+const portChecks = await Promise.all(
+  [
+    { name: 'API', port: ports.api },
+    { name: 'Vite', port: ports.vite },
+  ].map(async (p) => ({ ...p, free: await isPortFree(p.port) })),
+);
+const conflicts = portChecks.filter((c) => !c.free);
+if (conflicts.length > 0) {
+  console.error(`\n  ${yellow('✗')}  Cannot start dev servers — port conflict:\n`);
+  for (const { name, port } of conflicts) {
+    const holder = describePortHolder(port);
+    const who = holder ? `  (held by ${holder.command} PID ${holder.pid})` : '';
+    console.error(`     ${name} port ${bold(String(port))} is in use${who}`);
+  }
+  console.error(
+    `\n  An orphaned dev session is likely still running. To recover:\n` +
+      `    ${cyan('pkill -f "scripts/dev.js"')}   ${cyan('# kill the previous dev-server tree')}\n` +
+      `    ${cyan('pnpm dev:start')}              ${cyan('# restart')}\n`,
+  );
+  process.exit(1);
+}
+
+console.log(`
+  ${cyan('✦')}  Starting ${projectName} services...
+
+  ${cyan('→')}  ${bold('Frontend:')}  ${cyan(`http://localhost:${ports.vite}`)}
+  ${cyan('→')}  ${bold('API:')}       ${cyan(`http://localhost:${ports.api}`)}
+  ${cyan('→')}  ${bold('Studio:')}    ${cyan('http://studio.localhost')} (requires login)
+  ${cyan('→')}  ${bold('Traefik:')}   ${cyan('http://traefik.localhost')} (requires login)
+`);
+
+const children = [];
+
+// Spawn server process with its own process group for clean shutdown
+const server = spawn('npx', ['tsx', 'watch', '--env-file=.env.local', 'src/server/index.ts'], {
+  stdio: 'inherit',
+  shell: isWindows,
+  detached: !isWindows, // Create process group on Unix for clean group kill
+});
+children.push(server);
+
+// Spawn client process
+const client = spawn('npx', ['vite'], {
+  stdio: 'inherit',
+  shell: isWindows,
+  detached: !isWindows,
+});
+children.push(client);
+
+// Track if we're shutting down
+let shuttingDown = false;
+
+function shutdown(exitCode = 0) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+
+  console.log('\n  Shutting down...');
+
+  // Kill all child process groups
+  for (const child of children) {
+    if (child.exitCode === null) {
+      if (isWindows) {
+        spawn('taskkill', ['/pid', child.pid, '/f', '/t']);
+      } else {
+        // Kill the entire process group (negative PID)
+        try {
+          process.kill(-child.pid, 'SIGTERM');
+        } catch {
+          // Fallback: kill just the process
+          try {
+            child.kill('SIGTERM');
+          } catch {
+            // Process already dead
+          }
+        }
+      }
+    }
+  }
+
+  // Exit immediately - don't wait
+  process.exit(exitCode);
+}
+
+// Handle signals
+process.on('SIGINT', () => shutdown(0));
+process.on('SIGTERM', () => shutdown(0));
+
+// If either child exits while the session is meant to be running, take the
+// rest down with it. Otherwise an API crash leaves Vite happily serving a
+// half-dead app where /api/* returns 502s.
+for (const child of children) {
+  child.on('exit', (code, signal) => {
+    if (shuttingDown) return;
+    const failed = code !== 0 && signal !== 'SIGTERM' && signal !== 'SIGINT';
+    if (failed) {
+      console.error(
+        `\n  ${yellow('✗')}  Dev process exited unexpectedly (code=${code}, signal=${signal}). Stopping remaining processes.`,
+      );
+    }
+    shutdown(failed ? (code ?? 1) : 0);
+  });
+}

package/carbon/scripts/docker-down.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * Stop Docker Compose services based on enabled features
+ *
+ * Usage:
+ *   node scripts/docker-down.js           # Stop services
+ *   node scripts/docker-down.js -v        # Stop and remove volumes
+ *   node scripts/docker-down.js --dry-run # Show command without running
+ */
+
+import { execSync } from 'node:child_process';
+import { buildComposeCommand, loadManifest, parseArgs } from './lib/manifest.js';
+
+const rawArgs = process.argv.slice(2);
+const args = parseArgs(rawArgs);
+
+// Check for -v flag (volumes) - different from --verbose
+const removeVolumes = rawArgs.includes('-v') && !rawArgs.includes('--verbose');
+const removeImages = rawArgs.includes('--rmi');
+
+if (args.help) {
+  console.log(`
+Usage: node scripts/docker-down.js [options]
+
+Options:
+  --all       Include all optional services (ignores .vibecarbon.json)
+  -v          Remove volumes (docker compose down -v)
+  --prod      Include production overlay
+  --rmi       Remove locally-built images (docker compose down --rmi local)
+  --dry-run   Print the command without executing it
+  --verbose   Verbose output
+  -h, --help  Show this help message
+
+Examples:
+  node scripts/docker-down.js        # Stop services from .vibecarbon.json
+  node scripts/docker-down.js --all  # Stop ALL services
+  node scripts/docker-down.js -v     # Stop and remove volumes
+  node scripts/docker-down.js -v --rmi  # Stop, remove volumes and built images
+  pnpm docker:down                   # Via package.json script
+`);
+  process.exit(0);
+}
+
+const manifest = loadManifest();
+let action = 'down';
+if (removeVolumes) action += ' -v';
+if (removeImages) action += ' --rmi local';
+const cmd = buildComposeCommand(action, manifest, { prod: args.prod, all: args.all });
+
+if (args.dryRun) {
+  console.log('Would run:', cmd);
+  process.exit(0);
+}
+
+if (args.verbose) {
+  console.log('Running:', cmd);
+}
+
+try {
+  execSync(cmd, { stdio: 'inherit' });
+} catch (error) {
+  process.exit(error.status || 1);
+}

package/carbon/scripts/docker-logs.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+/**
+ * View Docker Compose logs for enabled services
+ *
+ * Usage:
+ *   node scripts/docker-logs.js           # Follow all logs
+ *   node scripts/docker-logs.js app       # Follow logs for specific service
+ *   node scripts/docker-logs.js --dry-run # Show command without running
+ */
+
+import { execSync } from 'node:child_process';
+import { buildComposeCommand, loadManifest, parseArgs } from './lib/manifest.js';
+
+const args = parseArgs(process.argv.slice(2));
+
+if (args.help) {
+  console.log(`
+Usage: node scripts/docker-logs.js [service] [options]
+
+Arguments:
+  service     Optional service name to filter logs
+
+Options:
+  --prod      Include production overlay
+  --dry-run   Print the command without executing it
+  --verbose   Verbose output
+  -h, --help  Show this help message
+
+Examples:
+  node scripts/docker-logs.js          # Follow all logs
+  node scripts/docker-logs.js app      # Follow app service logs
+  node scripts/docker-logs.js db       # Follow database logs
+  pnpm docker:logs                     # Via package.json script
+`);
+  process.exit(0);
+}
+
+const manifest = loadManifest();
+const service = args.positional[0] || '';
+const action = `logs -f ${service}`.trim();
+const cmd = buildComposeCommand(action, manifest, { prod: args.prod });
+
+if (args.dryRun) {
+  console.log('Would run:', cmd);
+  process.exit(0);
+}
+
+if (args.verbose) {
+  console.log('Running:', cmd);
+}
+
+try {
+  execSync(cmd, { stdio: 'inherit' });
+} catch (error) {
+  // Logs can be interrupted with Ctrl+C, which is expected
+  if (error.status !== 130) {
+    process.exit(error.status || 1);
+  }
+}