vibecarbon 0.1.0

package/carbon/scripts/k8s-delete.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Delete Kubernetes manifests using Kustomize
+ *
+ * Usage:
+ *   node scripts/k8s-delete.js                    # Delete local overlay
+ *   node scripts/k8s-delete.js production-nbg1    # Delete specific overlay
+ *   node scripts/k8s-delete.js --dry-run          # Show what would be deleted
+ */
+
+import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadManifest, getEnabledFeatures, parseArgs } from './lib/manifest.js';
+
+const args = parseArgs(process.argv.slice(2));
+
+if (args.help) {
+  console.log(`
+Usage: node scripts/k8s-delete.js [overlay] [options]
+
+Arguments:
+  overlay     Kustomize overlay to delete (default: local)
+              Available: local, production-nbg1, production-hel1
+
+Options:
+  --dry-run   Show what would be deleted without executing
+  --verbose   Verbose output
+  -h, --help  Show this help message
+
+Examples:
+  node scripts/k8s-delete.js              # Delete local overlay
+  node scripts/k8s-delete.js production-nbg1  # Delete production overlay
+  pnpm k8s:delete                         # Via package.json script
+`);
+  process.exit(0);
+}
+
+const manifest = loadManifest();
+const overlay = args.positional[0] || 'local';
+const overlayPath = join(process.cwd(), 'k8s', 'overlays', overlay);
+
+if (!existsSync(overlayPath)) {
+  console.error(`Error: Overlay '${overlay}' not found at ${overlayPath}`);
+  console.error('Available overlays: local, production-nbg1, production-hel1');
+  process.exit(1);
+}
+
+const features = getEnabledFeatures(manifest);
+if (args.verbose && features.length > 0) {
+  console.log('Enabled features:', features.join(', '));
+}
+
+// Build the kubectl delete command
+const dryRunFlag = args.dryRun ? ' --dry-run=client' : '';
+const cmd = `kubectl delete -k ${overlayPath}${dryRunFlag}`;
+
+if (args.dryRun) {
+  console.log('Would run:', cmd);
+  console.log('\nDry run output:');
+}
+
+if (args.verbose) {
+  console.log('Running:', cmd);
+}
+
+try {
+  execSync(cmd, { stdio: 'inherit' });
+} catch (error) {
+  // Exit code 1 from kubectl delete is common (resources not found), don't fail hard
+  if (args.verbose) {
+    console.log('kubectl delete exited with code:', error.status);
+  }
+  process.exit(error.status || 1);
+}

package/carbon/scripts/lib/manifest.js

@@ -0,0 +1,176 @@
+/**
+ * Shared manifest utilities for Vibecarbon scripts
+ * Reads .vibecarbon.json to determine which services are enabled
+ */
+
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * Load the vibecarbon manifest from the current directory
+ * @returns {Object} The manifest object with version and services
+ */
+export function loadManifest() {
+  const path = join(process.cwd(), '.vibecarbon.json');
+  if (!existsSync(path)) {
+    return { version: '1', services: {} };
+  }
+  return JSON.parse(readFileSync(path, 'utf-8'));
+}
+
+/**
+ * Get list of enabled service names from manifest
+ * Supports both "services" (new) and "features" (legacy) keys
+ * @param {Object} manifest - The vibecarbon manifest
+ * @returns {string[]} Array of service names
+ */
+export function getEnabledServices(manifest) {
+  // Support both "services" (new) and "features" (legacy)
+  const services = manifest.services || manifest.features || {};
+  return Object.keys(services);
+}
+
+/**
+ * Discover all optional service compose files in the project directory
+ * Excludes core files (prod, override, ha-*) and service-specific overrides
+ * @returns {string[]} Array of optional service compose file names
+ */
+export function discoverOptionalServices() {
+  const cwd = process.cwd();
+  const corePatterns = [
+    'docker-compose.yml',
+    'docker-compose.prod.yml',
+    'docker-compose.override.yml',
+    /^docker-compose\.ha-.*\.yml$/,
+    /^docker-compose\..*\.override\.yml$/, // Service-specific overrides (handled separately)
+    /^docker-compose\..*\.prod\.yml$/, // Service-specific prod configs (use --prod flag)
+  ];
+
+  const files = readdirSync(cwd).filter((file) => {
+    if (!file.startsWith('docker-compose.') || !file.endsWith('.yml')) {
+      return false;
+    }
+    // Exclude core patterns
+    for (const pattern of corePatterns) {
+      if (typeof pattern === 'string' && file === pattern) return false;
+      if (pattern instanceof RegExp && pattern.test(file)) return false;
+    }
+    return true;
+  });
+
+  return files;
+}
+
+/**
+ * Get list of Docker Compose files to use based on enabled services
+ * @param {Object} manifest - The vibecarbon manifest
+ * @param {Object} options - Options for file selection
+ * @param {boolean} options.prod - Include production overlay
+ * @param {boolean} options.all - Include all optional services (ignores manifest)
+ * @returns {string[]} Array of compose file paths
+ */
+export function getComposeFiles(manifest, options = {}) {
+  const files = ['docker-compose.yml'];
+  const cwd = process.cwd();
+
+  if (options.prod) {
+    files.push('docker-compose.prod.yml');
+  }
+
+  // Collect service files (either from --all discovery or manifest)
+  let serviceFiles = [];
+  if (options.all) {
+    serviceFiles = discoverOptionalServices();
+  } else {
+    for (const service of getEnabledServices(manifest)) {
+      const serviceFile = `docker-compose.${service}.yml`;
+      if (existsSync(join(cwd, serviceFile))) {
+        serviceFiles.push(serviceFile);
+      }
+    }
+  }
+
+  // Add each service file, followed by its environment-specific override
+  for (const serviceFile of serviceFiles) {
+    files.push(serviceFile);
+
+    if (options.prod) {
+      // In prod mode, check for service-specific prod file
+      // e.g., docker-compose.observability.yml -> docker-compose.observability.prod.yml
+      const prodFile = serviceFile.replace('.yml', '.prod.yml');
+      if (existsSync(join(cwd, prodFile))) {
+        files.push(prodFile);
+      }
+    } else {
+      // In dev mode, check for service-specific override file
+      // e.g., docker-compose.observability.yml -> docker-compose.observability.override.yml
+      const overrideFile = serviceFile.replace('.yml', '.override.yml');
+      if (existsSync(join(cwd, overrideFile))) {
+        files.push(overrideFile);
+      }
+    }
+  }
+
+  // In dev mode, include the main override file LAST so it can override
+  // service-specific compose files with dev passwords/config
+  if (!options.prod && existsSync(join(cwd, 'docker-compose.override.yml'))) {
+    files.push('docker-compose.override.yml');
+  }
+
+  // dev-init.js generates this file to mount the admin SQL with real credentials
+  // (only exists when developing the CLI itself, not in derived projects)
+  if (!options.prod && existsSync(join(cwd, 'docker-compose.dev-init.yml'))) {
+    files.push('docker-compose.dev-init.yml');
+  }
+
+  return files;
+}
+
+/**
+ * Check if a specific service is enabled
+ * @param {Object} manifest - The vibecarbon manifest
+ * @param {string} serviceName - Name of the service to check
+ * @returns {boolean} True if service is enabled
+ */
+export function isServiceEnabled(manifest, serviceName) {
+  const services = manifest.services || manifest.features || {};
+  return Boolean(services[serviceName]);
+}
+
+/**
+ * Build docker compose command with appropriate files
+ * @param {string} action - The compose action (up, down, logs, etc.)
+ * @param {Object} manifest - The vibecarbon manifest
+ * @param {Object} options - Options for command building
+ * @param {boolean} options.prod - Use production config
+ * @param {boolean} options.all - Include all optional services
+ * @param {string[]} options.extraArgs - Additional arguments
+ * @returns {string} The full docker compose command
+ */
+export function buildComposeCommand(action, manifest, options = {}) {
+  const files = getComposeFiles(manifest, { prod: options.prod, all: options.all });
+  const fileArgs = files.map((f) => `-f ${f}`).join(' ');
+  const extraArgs = options.extraArgs ? options.extraArgs.join(' ') : '';
+
+  return `docker compose ${fileArgs} ${action} ${extraArgs}`.trim();
+}
+
+/**
+ * Parse CLI arguments for common flags
+ * @param {string[]} args - CLI arguments
+ * @returns {Object} Parsed arguments
+ */
+export function parseArgs(args) {
+  return {
+    prod: args.includes('--prod'),
+    all: args.includes('--all'),
+    dryRun: args.includes('--dry-run'),
+    verbose: args.includes('--verbose') || args.includes('-v'),
+    help: args.includes('--help') || args.includes('-h'),
+    positional: args.filter((arg) => !arg.startsWith('-')),
+  };
+}
+
+// Legacy aliases for backwards compatibility
+export const getEnabledFeatures = getEnabledServices;
+export const isFeatureEnabled = isServiceEnabled;

package/carbon/scripts/secret-scan.mjs

@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+// Self-contained secret scanner for the vibecarbon-managed pre-commit
+// hook. Mirrors the rules in src/lib/secret-scan.js (vibecarbon CLI)
+// so the same allowlist + behaviour applies offline / without the CLI
+// installed. Keep the rule set in sync — the test suite over there is
+// the source of truth.
+//
+// Usage:
+//   node scripts/secret-scan.mjs <file> [<file>...]
+//   node scripts/secret-scan.mjs --stdin   # reads file paths from stdin, one per line
+
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SECRET_RULES = [
+  { id: 'aws-access-key', description: 'AWS access key ID', pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+  {
+    id: 'aws-secret-key',
+    description: 'AWS secret access key',
+    pattern:
+      /(?:aws[_-]?secret[_-]?access[_-]?key|secretAccessKey)\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
+  },
+  {
+    id: 'github-pat',
+    description: 'GitHub personal access token',
+    pattern: /\bgh[posru]_[A-Za-z0-9]{36,}\b/g,
+  },
+  {
+    id: 'stripe-live-key',
+    description: 'Stripe live secret key',
+    pattern: /\bsk_live_[A-Za-z0-9]{24,}\b/g,
+  },
+  {
+    id: 'stripe-test-key',
+    description: 'Stripe test secret key',
+    pattern: /\bsk_test_[A-Za-z0-9]{24,}\b/g,
+  },
+  { id: 'slack-token', description: 'Slack token', pattern: /\bxox[abprs]-[0-9A-Za-z-]{10,}\b/g },
+  { id: 'openai-key', description: 'OpenAI API key', pattern: /\bsk-[A-Za-z0-9]{20,}\b/g },
+  {
+    id: 'anthropic-key',
+    description: 'Anthropic API key',
+    pattern: /\bsk-ant-[A-Za-z0-9_-]{40,}\b/g,
+  },
+  {
+    id: 'google-service-account-json',
+    description: 'Google Cloud service account JSON',
+    pattern: /"type"\s*:\s*"service_account"/g,
+    context: /"private_key"\s*:\s*"-----BEGIN[ A-Z]+PRIVATE KEY-----/,
+  },
+  { id: 'google-api-key', description: 'Google API key', pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  {
+    id: 'private-key-block',
+    description: 'PEM-encoded private key',
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+  },
+  {
+    id: 'hetzner-token',
+    description: 'Hetzner Cloud API token',
+    pattern: /['"]([A-Za-z0-9]{64})['"]/g,
+    context: /(?:hetzner|hcloud|HCLOUD_TOKEN|HETZNER_API_TOKEN)/i,
+  },
+  {
+    id: 'cloudflare-api-token',
+    description: 'Cloudflare scoped API token',
+    pattern: /\b[A-Za-z0-9_-]{40}\b/g,
+    context: /(?:cloudflare|cf[_-]?api[_-]?token|CLOUDFLARE_API_TOKEN)/i,
+    predicate: (m) => !/^[a-f0-9]+$/i.test(m),
+  },
+  {
+    id: 'supabase-service-role-jwt',
+    description: 'Supabase service-role JWT',
+    pattern: /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+    predicate: (m) => {
+      const parts = m.split('.');
+      if (parts.length !== 3) return false;
+      const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+      const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+      try {
+        const payload = JSON.parse(Buffer.from(padded, 'base64').toString('utf-8'));
+        return payload?.role === 'service_role' || payload?.role === 'admin';
+      } catch {
+        return false;
+      }
+    },
+  },
+  {
+    id: 'generic-secret-assignment',
+    description: 'High-entropy value assigned to a secret-named variable',
+    pattern:
+      /(?:password|passwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|credentials?)\s*[:=]\s*['"]([^'"\s]{20,})['"]/gi,
+    predicate: (_m, captured) => {
+      const value = captured?.[1];
+      if (!value) return false;
+      if (/^(?:REPLACE|TODO|CHANGE|YOUR|EXAMPLE|PLACEHOLDER|FIXME)/i.test(value)) return false;
+      if (/^(?:local|dev|test|sample|fake|demo)[-_]/i.test(value)) return false;
+      const freq = new Map();
+      for (const c of value) freq.set(c, (freq.get(c) ?? 0) + 1);
+      let h = 0;
+      for (const n of freq.values()) {
+        const p = n / value.length;
+        h -= p * Math.log2(p);
+      }
+      return h >= 3.5;
+    },
+  },
+];
+
+const SKIP_EXTS = new Set([
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.ico',
+  '.pdf',
+  '.zip',
+  '.gz',
+  '.tar',
+  '.tgz',
+  '.7z',
+  '.rar',
+  '.mp3',
+  '.mp4',
+  '.mov',
+  '.avi',
+  '.webm',
+  '.woff',
+  '.woff2',
+  '.ttf',
+  '.otf',
+  '.eot',
+  '.so',
+  '.dll',
+  '.dylib',
+  '.bin',
+  '.wasm',
+]);
+const MAX_FILE_BYTES = 1_048_576;
+
+function loadAllowlist() {
+  try {
+    return readFileSync(join(process.cwd(), '.vibecarbonignore'), 'utf-8')
+      .split('\n')
+      .map((l) => l.trim())
+      .filter((l) => l && !l.startsWith('#'));
+  } catch {
+    return [];
+  }
+}
+
+function matchesAllowlist(value, allowlist) {
+  for (const entry of allowlist) {
+    if (entry.startsWith('regex:')) {
+      try {
+        if (new RegExp(entry.slice(6)).test(value)) return true;
+      } catch {}
+    } else if (value.includes(entry)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function locate(content, offset) {
+  let line = 1;
+  let lineStart = 0;
+  for (let i = 0; i < offset; i++) {
+    if (content.charCodeAt(i) === 10) {
+      line++;
+      lineStart = i + 1;
+    }
+  }
+  return { line, column: offset - lineStart + 1 };
+}
+
+function scanContent(content, allowlist) {
+  if (!content) return [];
+  const findings = [];
+  for (const rule of SECRET_RULES) {
+    rule.pattern.lastIndex = 0;
+    let m = rule.pattern.exec(content);
+    while (m !== null) {
+      const [whole] = m;
+      if (rule.context) {
+        const start = Math.max(0, m.index - 128);
+        const end = Math.min(content.length, m.index + whole.length + 128);
+        if (!rule.context.test(content.slice(start, end))) {
+          m = rule.pattern.exec(content);
+          continue;
+        }
+      }
+      if (rule.predicate && !rule.predicate(whole, m)) {
+        m = rule.pattern.exec(content);
+        continue;
+      }
+      if (matchesAllowlist(whole, allowlist)) {
+        m = rule.pattern.exec(content);
+        continue;
+      }
+      const { line, column } = locate(content, m.index);
+      findings.push({
+        ruleId: rule.id,
+        description: rule.description,
+        match: whole.length > 64 ? `${whole.slice(0, 32)}…${whole.slice(-16)}` : whole,
+        line,
+        column,
+      });
+      m = rule.pattern.exec(content);
+    }
+  }
+  return findings;
+}
+
+async function readStdinList() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks)
+    .toString('utf-8')
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean);
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  let files = [];
+  if (argv.includes('--stdin')) {
+    files = await readStdinList();
+  } else {
+    files = argv;
+  }
+  if (files.length === 0) process.exit(0);
+
+  const allowlist = loadAllowlist();
+  const failures = [];
+  for (const file of files) {
+    if (!existsSync(file)) continue;
+    const ext = file.includes('.') ? file.slice(file.lastIndexOf('.')).toLowerCase() : '';
+    if (SKIP_EXTS.has(ext)) continue;
+    let stat;
+    try {
+      stat = statSync(file);
+    } catch {
+      continue;
+    }
+    if (!stat.isFile() || stat.size > MAX_FILE_BYTES) continue;
+    let content;
+    try {
+      content = readFileSync(file, 'utf-8');
+    } catch {
+      continue;
+    }
+    const findings = scanContent(content, allowlist);
+    for (const f of findings) failures.push({ file, ...f });
+  }
+
+  if (failures.length === 0) process.exit(0);
+  process.stderr.write(
+    `\n[X] Refusing commit: ${failures.length} potential secret${failures.length === 1 ? '' : 's'} detected:\n\n`,
+  );
+  for (const f of failures) {
+    process.stderr.write(`  ${f.file}:${f.line}:${f.column}  [${f.ruleId}] ${f.description}\n`);
+    process.stderr.write(`    -> ${f.match}\n`);
+  }
+  process.stderr.write(
+    '\nIf a finding is a false positive, add it to .vibecarbonignore at the repo root:\n',
+  );
+  process.stderr.write('  - one entry per line\n');
+  process.stderr.write('  - literal substring match, OR `regex:<pattern>` for a regex\n');
+  process.stderr.write('  - `#` comments are ignored\n\n');
+  process.exit(1);
+}
+
+main().catch((err) => {
+  process.stderr.write(`secret-scan: ${err.message}\n`);
+  process.exit(2);
+});

package/carbon/scripts/validate-dev-configs.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+#
+# Validate that all template files have corresponding dev files
+# Run in CI to catch missing dev configs
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CARBON_DIR="$(dirname "$SCRIPT_DIR")"
+
+cd "$CARBON_DIR"
+
+errors=0
+
+# Known template/dev file pairs that must exist
+declare -a REQUIRED_PAIRS=(
+  # Grafana dashboards
+  "volumes/grafana/provisioning/dashboards/dashboards.yml:volumes/grafana/provisioning/dashboards/dashboards.dev.yml"
+  # Database initialization (only super-admin needs dev variant — roles/services use runtime env vars)
+  "volumes/db/super-admin.sql:volumes/db/super-admin.dev.sql"
+)
+
+# Directories where each template file needs a dev counterpart
+declare -a REQUIRED_DIR_PAIRS=(
+  "volumes/grafana/dashboards:volumes/grafana/dashboards.dev"
+)
+
+echo "Validating dev config files..."
+echo ""
+
+# Check individual file pairs
+echo "Required file pairs:"
+for pair in "${REQUIRED_PAIRS[@]}"; do
+  template="${pair%%:*}"
+  dev_file="${pair##*:}"
+
+  if [[ ! -f "$template" ]]; then
+    echo "  SKIP: $template (template not found)"
+    continue
+  fi
+
+  if [[ -f "$dev_file" ]]; then
+    echo "  OK: $dev_file"
+  else
+    echo "  MISSING: $dev_file"
+    ((errors++))
+  fi
+done
+
+echo ""
+
+# Check directory pairs
+echo "Required directory pairs:"
+for dir_pair in "${REQUIRED_DIR_PAIRS[@]}"; do
+  template_dir="${dir_pair%%:*}"
+  dev_dir="${dir_pair##*:}"
+
+  if [[ ! -d "$template_dir" ]]; then
+    echo "  SKIP: $template_dir (template dir not found)"
+    continue
+  fi
+
+  for template_file in "$template_dir"/*; do
+    if [[ -f "$template_file" ]]; then
+      filename=$(basename "$template_file")
+      dev_file="$dev_dir/$filename"
+
+      if [[ -f "$dev_file" ]]; then
+        echo "  OK: $dev_file"
+      else
+        echo "  MISSING: $dev_file"
+        ((errors++))
+      fi
+    fi
+  done
+done
+
+echo ""
+
+# Check for template placeholders in mounted files
+echo "Checking for unsubstituted placeholders in dev files..."
+dev_files_with_placeholders=$(find volumes -name "*.dev.*" -o -name "*.dev" -type f 2>/dev/null | xargs grep -l '{{[A-Z_]*}}' 2>/dev/null || true)
+
+if [[ -n "$dev_files_with_placeholders" ]]; then
+  echo "  WARNING: Dev files still contain template placeholders:"
+  echo "$dev_files_with_placeholders" | while read -r f; do
+    echo "    $f"
+  done
+  ((errors++))
+fi
+
+echo ""
+
+if [[ $errors -gt 0 ]]; then
+  echo "FAILED: $errors issue(s) found"
+  echo "Run ./scripts/generate-dev-configs.sh to fix"
+  exit 1
+else
+  echo "PASSED: All dev configs present"
+  exit 0
+fi