vibecarbon 0.1.0

package/carbon/TESTING.md

@@ -0,0 +1,138 @@
+# Testing
+
+Three tiers, picked to mirror what each tier actually proves:
+
+| Tier | Env | Wall-clock | What it tests |
+|---|---|---|---|
+| `unit` | node | <1s | Pure functions, validators, pricing/format helpers, cross-cutting invariants |
+| `component` | jsdom | a few s | React components + custom hooks via React Testing Library |
+| `integration` | node | <30s | Hono route handlers end-to-end with externals (Supabase, Stripe, SMTP) mocked |
+
+Run them:
+
+```bash
+pnpm test              # every tier
+pnpm test:unit
+pnpm test:component
+pnpm test:integration
+pnpm test:watch        # vitest watch mode (all tiers)
+pnpm test:coverage     # writes coverage/ HTML (v8)
+pnpm test:prepush      # what the pre-push git hook runs (lint + all three tiers)
+```
+
+The pre-push hook is installed automatically by `vibecarbon create` — bypass with `git push --no-verify` only if you understand why the tests are red.
+
+## Where to put a new test
+
+Mirror `src/` under the tier directory:
+
+```
+tests/
+├── _helpers/                          shared harness
+├── unit/
+│   ├── shared/pricing.test.ts         src/shared/pricing.ts
+│   └── client/utils.test.ts           src/client/lib/utils.ts
+├── structural/
+│   └── i18n-parity.test.ts            cross-file invariant
+├── component/
+│   ├── ErrorBoundary.test.tsx         src/client/components/ErrorBoundary.tsx
+│   └── use-auth-settings.test.tsx     src/client/hooks/api/useAuthSettings.ts
+└── integration/
+    └── server/routes/
+        ├── health.test.ts             src/server/routes/health.ts
+        └── contact.test.ts            src/server/routes/v1/contact.ts
+```
+
+**Heuristic** — if the test imports `react` or `@testing-library/react`, it's `component`. If it imports anything from `src/server/`, it's `integration`. Otherwise it's `unit`.
+
+## Tier picking guide
+
+- **Could this be a pure function?** Refactor it into one and write a `unit` test. Cheap, fast, never flaky.
+- **Behavior depends on the DOM, focus, keyboard, or React state transitions?** `component` tier.
+- **You want to assert what the Hono route returns for a real request?** `integration` tier.
+- **You want to prove two files agree on a key set, schema, or constants?** `structural` test under `tests/structural/` — runs under `unit`.
+
+## Helpers
+
+All under `tests/_helpers/`:
+
+| Helper | Use it when |
+|---|---|
+| `app.ts` → `mountRoute(prefix, routes)` | Building a one-route Hono app for an integration test. No global middleware so assertions stay focused. |
+| `app.ts` → `jsonPost(body)` | POSTing JSON to `app.request()` without re-typing headers. |
+| `factories.ts` → `makeUser`, `makeOrg`, `makeContactSubmission` | Plausible domain objects to hand to mocked Supabase resolved values. |
+| `jwt.ts` → `mockJwt(payload, secret?)` | HS256-signed bearer token for auth-protected routes. |
+| `env.ts` → `mockEnv({...})` | Temporarily swap process.env vars for one test; returns a restore closure. |
+| `setup-rtl.ts` | Wired into the `component` project — loads jest-dom matchers and runs RTL's cleanup between tests. |
+| `setup-integration.ts` | Wired into the `integration` project — seeds plausible Supabase env values so server modules pass zod validation when imported. |
+
+## Mocking the external boundary
+
+Server-side modules are imported with their relative paths inside `src/server/`. Pass the path alias `@server/...` to `vi.mock` — vitest matches by resolved file path, so it'll intercept whichever path the production code happens to use.
+
+```ts
+// Supabase
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: { from: () => ({ insert: vi.fn().mockResolvedValue({ error: null }) }) },
+}));
+
+// Stripe
+vi.mock('@server/lib/stripe', () => ({
+  stripe: { checkout: { sessions: { create: vi.fn() } } },
+}));
+
+// SMTP — fire-and-forget
+vi.mock('@server/lib/email', () => ({
+  sendEmail: vi.fn().mockResolvedValue(undefined),
+}));
+
+// Rate limiter — the real one starts a 60s setInterval at module load;
+// replace with a pass-through middleware so tests exit cleanly.
+vi.mock('@server/lib/rate-limiter', () => ({
+  createRateLimiter: () => async (_c: unknown, next: () => Promise<void>) => {
+    await next();
+  },
+}));
+
+// Logger — quiet the expected error-path log
+vi.mock('@server/lib/logger', () => ({
+  logger: { error: vi.fn(), info: vi.fn(), warn: vi.fn(), debug: vi.fn() },
+}));
+```
+
+Client-side fetch — stub the global and unstub in afterEach:
+
+```ts
+beforeEach(() => {
+  vi.stubGlobal('fetch', vi.fn(async () => new Response('{}', { status: 200 })));
+});
+afterEach(() => vi.unstubAllGlobals());
+```
+
+TanStack Query in component tests — wrap with a fresh QueryClient each render, `retry: false` so rejected fetches surface immediately:
+
+```tsx
+function makeWrapper() {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  return ({ children }) => <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+const { result } = renderHook(() => useMyHook(), { wrapper: makeWrapper() });
+```
+
+## Don't mock these
+
+- `zod` schemas — they're the contract; test the route's behavior through them.
+- The route file under test (obviously).
+- `clsx`, `class-variance-authority`, or other pure UI utilities — let them run.
+
+## What we deliberately don't do (yet)
+
+- **No real Postgres in `integration`.** The Supabase dev container doesn't expose Postgres on the host. Mocking at the Supabase client boundary gives fast, deterministic tests and covers the route logic. If you need SQL-level coverage (RLS, triggers, complex joins), add testcontainers or expose a dev port and write a `tests/database/` tier — the boundary stays the same.
+- **No E2E / Playwright.** Add when you actually have flows worth black-box testing through the browser.
+- **No snapshot tests.** Brittle and noisy in a fast-moving template; assert behavior instead.
+- **No MSW.** `vi.stubGlobal('fetch', ...)` covers the seed cases; adopt MSW if your fetch surface grows.
+
+## When you use the test-maintainer agent
+
+It reads `tests/_helpers/` and the existing test files to learn this project's conventions, then matches the style when writing new tests. The smaller and more consistent the seed it sees, the more consistent its output. If you find yourself adjusting its output the same way twice, encode the convention here.

package/carbon/backup/Dockerfile

@@ -0,0 +1,75 @@
+# syntax=docker/dockerfile:1
+FROM ubuntu:22.04
+
+# Base image is ubuntu, not alpine, because wal-g v3.x stopped publishing
+# alpine-musl prebuilt binaries — only ubuntu glibc builds remain. We need
+# wal-g v3+ for the current S3 + Postgres 16 wire protocol support.
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install PostgreSQL 16 client + utilities. PG 16 isn't in the default
+# ubuntu 22.04 repos; pull it from the postgresql apt repo. AWS CLI is
+# installed as the standalone v2 binary further down (the apt-shipped
+# `awscli` is v1 and pulls ~500MB of Python deps; v2 is ~80MB self-
+# contained and the only version AWS itself supports for new code).
+#
+# apt cache mount: keeps /var/cache/apt populated across rebuilds so
+# `apt-get install` reuses .deb files. The cache lives outside the layer,
+# so we don't need the historical `rm -rf /var/lib/apt/lists/*` to keep
+# the final image small — that's still done below as a belt-and-braces
+# measure for cases where the cache mount isn't honored (e.g. legacy
+# `docker build` without BuildKit).
+# `sharing=locked` serializes parallel builds against the same cache
+# (apt's lock semantics expect exclusive access).
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl gnupg lsb-release \
+        bash tar gzip unzip && \
+    install -d /usr/share/postgresql-common/pgdg && \
+    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+        -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc && \
+    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt jammy-pgdg main" \
+        > /etc/apt/sources.list.d/pgdg.list && \
+    apt-get update && apt-get install -y --no-install-recommends \
+        postgresql-client-16
+
+# Install AWS CLI v2 standalone binary (~80MB) instead of `apt-get install
+# awscli` (v1 with ~500MB of Python/boto3 deps). Saves ~400MB on the
+# final image, which matters because the backup image is sideloaded to
+# every k3s node (~6 nodes in HA = ~2.4GB less network per deploy).
+# --fail makes curl exit non-zero on HTTP 4xx/5xx instead of piping a
+# 404 HTML body into unzip.
+RUN curl -fL https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip \
+        -o /tmp/awscli.zip && \
+    unzip -q /tmp/awscli.zip -d /tmp && \
+    /tmp/aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli && \
+    rm -rf /tmp/aws /tmp/awscli.zip
+
+# Install WAL-G v3.0.5 (ubuntu 22.04 amd64 build).
+# --fail makes curl exit non-zero on HTTP 4xx/5xx instead of piping a 404
+# HTML body into tar (the previous v3.0.3-alpine URL 404'd, tar saw "<html>"
+# and errored "not in gzip format" — observed 2026-04-26 matrix run #2).
+RUN curl -fL https://github.com/wal-g/wal-g/releases/download/v3.0.5/wal-g-pg-ubuntu-22.04-amd64.tar.gz \
+        | tar -xz && \
+    mv wal-g-pg-ubuntu-22.04-amd64 /usr/local/bin/wal-g && \
+    chmod +x /usr/local/bin/wal-g
+
+# Security: non-root system user. We can't reuse the name `backup` —
+# ubuntu pre-populates a `backup` system group (GID 34, used for system
+# backup operations) and `groupadd backup` errors with exit 9 ("group
+# 'backup' already exists"). The previous alpine version sidestepped
+# this because alpine doesn't ship the same default. Use a unique name
+# (`vbbackup`) and let --system pick a free system GID/UID.
+# The k8s manifest doesn't pin runAsUser so any UID works.
+RUN groupadd --system vbbackup && \
+    useradd --system -g vbbackup -s /usr/sbin/nologin -M vbbackup
+
+# Copy backup script
+COPY backup.sh /usr/local/bin/backup.sh
+RUN chmod +x /usr/local/bin/backup.sh
+
+USER vbbackup
+
+# CronJob handles scheduling — script runs once and exits
+ENTRYPOINT ["/usr/local/bin/backup.sh"]

package/carbon/backup/backup.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+set -e
+# pipefail is critical: the pg_dump | gzip pipeline below silently uploaded
+# 170-byte gzip-header-only tarballs when pg_dump failed (wrong PGHOST),
+# making restore think backups existed when they were empty. Observed
+# 2026-04-27 k8s-ha matrix #6 — restore failed "No backups found in S3"
+# because the broken tarball had no SQL inside.
+set -o pipefail
+
+# ============================================================================
+# Vibecarbon Blazing Fast Backup Script (WAL-G)
+#
+# Optimized for performance and robustness using continuous archiving.
+# Fallback to pg_dump for legacy compatibility.
+#
+# Environment Variables:
+#   PGHOST, PGPORT, PGUSER, PGDATABASE, PGPASSWORD  - PostgreSQL connection
+#   S3_BUCKET, S3_ENDPOINT, S3_ACCESS_KEY, S3_SECRET_KEY, S3_REGION - S3 config
+#   S3_BACKUP_BUCKET       - Dedicated backup bucket (falls back to S3_BUCKET)
+#   BACKUP_RETENTION_DAYS  - Days to keep backups (default: 7)
+#   PROJECT_NAME           - Project name for backup naming
+#   BACKUP_MODE            - "walg" (default) or "pg_dump"
+# ============================================================================
+
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+PROJECT="${PROJECT_NAME:-vibecarbon}"
+MODE="${BACKUP_MODE:-walg}"
+RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-7}"
+
+echo "=== Vibecarbon Backup (${MODE}) ==="
+echo "Started at $(date)"
+
+# --- S3 CONFIGURATION ---
+UPLOAD_BUCKET="${S3_BACKUP_BUCKET:-${S3_BUCKET}}"
+export AWS_ACCESS_KEY_ID="${S3_ACCESS_KEY}"
+export AWS_SECRET_ACCESS_KEY="${S3_SECRET_KEY}"
+export AWS_DEFAULT_REGION="${S3_REGION:-us-east-1}"
+export AWS_ENDPOINT="${S3_ENDPOINT}"
+
+if [ -z "${UPLOAD_BUCKET}" ] || [ -z "${AWS_ACCESS_KEY_ID}" ] || [ -z "${AWS_SECRET_ACCESS_KEY}" ] || [ -z "${AWS_ENDPOINT}" ]; then
+  echo "Error: S3 configuration missing. Backup cannot proceed."
+  exit 1
+fi
+
+# --- WAL-G CONFIGURATION ---
+export WALG_S3_PREFIX="s3://${UPLOAD_BUCKET}/backups/${PROJECT}/walg"
+# Use the same credentials for WAL-G (it uses AWS_* by default, but we can be explicit)
+export WALE_S3_PREFIX="${WALG_S3_PREFIX}"
+# Parallelism for faster compression/upload
+export WALG_COMPRESSION_METHOD="lz4"
+export WALG_UPLOAD_CONCURRENCY=4
+
+if [ "${MODE}" = "walg" ]; then
+  echo "Creating full base backup with WAL-G..."
+  # WAL-G requires PGHOST to be reachable.
+  # If running in a sidecar, it might need to connect via socket or network.
+  # We assume PGHOST is set correctly (e.g. "db").
+  export PGDATA="/var/lib/postgresql/data"
+  
+  # Check if we can run backup-push. 
+  # Note: backup-push usually needs to run on the database server or have access to PGDATA
+  # if it's doing a direct filesystem scan. 
+  # If this script runs in a separate container, it uses the network protocol.
+  
+  wal-g backup-push "${PGDATA}"
+  
+  echo "Full base backup completed."
+  
+  echo "Cleaning up old backups (retention: ${RETENTION_DAYS} days)..."
+  wal-g delete before "$(date -d "-${RETENTION_DAYS} days" +%Y-%m-%dT%H:%M:%SZ)" --confirm
+  
+else
+  # --- LEGACY PG_DUMP FALLBACK ---
+  echo "Falling back to pg_dump..."
+  WORK_DIR="/tmp/backup_${TIMESTAMP}"
+  mkdir -p "${WORK_DIR}"
+  ARCHIVE_NAME="${PROJECT}_${TIMESTAMP}_full.tar.gz"
+
+  PGPASSWORD="${PGPASSWORD}" pg_dump \
+    -h "${PGHOST:-postgres}" \
+    -p "${PGPORT:-5432}" \
+    -U "${PGUSER:-supabase_admin}" \
+    "${PGDATABASE:-postgres}" | gzip > "${WORK_DIR}/postgres.sql.gz"
+
+  tar czf "/tmp/${ARCHIVE_NAME}" -C "${WORK_DIR}" .
+  
+  aws s3 cp "/tmp/${ARCHIVE_NAME}" \
+    "s3://${UPLOAD_BUCKET}/backups/${ARCHIVE_NAME}" \
+    --endpoint-url "${S3_ENDPOINT}"
+
+  rm -rf "${WORK_DIR}"
+  rm "/tmp/${ARCHIVE_NAME}"
+fi
+
+echo "=== Backup completed at $(date) ==="

package/carbon/backup/compose-backup.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+set -e
+
+# ============================================================================
+# Vibecarbon Compose Backup Script
+#
+# Runs via cron on the VPS. Creates a full backup archive containing all
+# PostgreSQL databases and storage files, uploads to S3, and cleans up
+# old backups based on retention policy.
+#
+# Environment Variables (loaded from .backup-env):
+#   PROJECT_NAME           - Project name for backup naming
+#   BACKUP_RETENTION_DAYS  - Days to keep backups (default: 30)
+#   S3_BACKUP_BUCKET       - S3 bucket for backup storage
+#   S3_ACCESS_KEY          - S3 access key
+#   S3_SECRET_KEY          - S3 secret key
+#   S3_ENDPOINT            - S3 endpoint URL
+#   S3_REGION              - S3 region
+# ============================================================================
+
+# Prevent concurrent backups
+LOCKFILE="/tmp/vibecarbon-backup.lock"
+exec 200>"${LOCKFILE}"
+flock -n 200 || { echo "Backup already running — skipping"; exit 0; }
+
+PROJECT="${PROJECT_NAME:?PROJECT_NAME is required}"
+REMOTE_DIR="/opt/${PROJECT}"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+WORK_DIR="/tmp/backup_${TIMESTAMP}"
+ARCHIVE_NAME="${PROJECT}_${TIMESTAMP}_full.tar.gz"
+RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-30}"
+
+echo "=== Vibecarbon Compose Backup ==="
+echo "Started at $(date)"
+echo "Retention: ${RETENTION_DAYS} days"
+
+mkdir -p "${WORK_DIR}"
+
+# ============================================================================
+# Step 1: Dump postgres database
+# ============================================================================
+
+echo "Backing up postgres database..."
+cd "${REMOTE_DIR}" && docker compose exec -T db pg_dump -U postgres postgres \
+  | gzip > "${WORK_DIR}/postgres.sql.gz"
+DB_SIZE=$(du -h "${WORK_DIR}/postgres.sql.gz" | cut -f1)
+echo "postgres: ${DB_SIZE}"
+
+# ============================================================================
+# Step 2: Dump optional service databases (n8n, metabase)
+# ============================================================================
+
+for EXTRA_DB in n8n metabase; do
+  DB_EXISTS=$(cd "${REMOTE_DIR}" && docker compose exec -T db \
+    psql -U postgres -tAc "SELECT 1 FROM pg_database WHERE datname='${EXTRA_DB}'" 2>/dev/null || echo "")
+  if [ "${DB_EXISTS}" = "1" ]; then
+    echo "Backing up ${EXTRA_DB} database..."
+    cd "${REMOTE_DIR}" && docker compose exec -T db pg_dump -U postgres "${EXTRA_DB}" \
+      | gzip > "${WORK_DIR}/${EXTRA_DB}.sql.gz"
+    EXTRA_SIZE=$(du -h "${WORK_DIR}/${EXTRA_DB}.sql.gz" | cut -f1)
+    echo "${EXTRA_DB}: ${EXTRA_SIZE}"
+  fi
+done
+
+# ============================================================================
+# Step 3: Storage files (file backend only)
+# ============================================================================
+
+STORAGE_COUNT=$(cd "${REMOTE_DIR}" && docker compose exec -T storage \
+  sh -c 'find /var/lib/storage -type f 2>/dev/null | wc -l' 2>/dev/null || echo "0")
+if [ "${STORAGE_COUNT}" -gt 0 ] 2>/dev/null; then
+  echo "Backing up ${STORAGE_COUNT} storage files..."
+  cd "${REMOTE_DIR}" && docker compose exec -T storage \
+    tar czf - -C / var/lib/storage > "${WORK_DIR}/storage.tar.gz"
+  STORAGE_SIZE=$(du -h "${WORK_DIR}/storage.tar.gz" | cut -f1)
+  echo "Storage: ${STORAGE_SIZE}"
+fi
+
+# ============================================================================
+# Step 4: Create combined archive
+# ============================================================================
+
+echo "Creating archive: ${ARCHIVE_NAME}"
+tar czf "${REMOTE_DIR}/backups/${ARCHIVE_NAME}" -C "${WORK_DIR}" .
+TOTAL_SIZE=$(du -h "${REMOTE_DIR}/backups/${ARCHIVE_NAME}" | cut -f1)
+echo "Total archive size: ${TOTAL_SIZE}"
+
+# ============================================================================
+# Step 5: Upload to S3 (if configured)
+# ============================================================================
+
+if [ -n "${S3_BACKUP_BUCKET}" ] && [ -n "${S3_ACCESS_KEY}" ] && [ -n "${S3_SECRET_KEY}" ] && [ -n "${S3_ENDPOINT}" ]; then
+  echo "Uploading to S3: s3://${S3_BACKUP_BUCKET}/backups/${ARCHIVE_NAME}"
+
+  export AWS_ACCESS_KEY_ID="${S3_ACCESS_KEY}"
+  export AWS_SECRET_ACCESS_KEY="${S3_SECRET_KEY}"
+  export AWS_DEFAULT_REGION="${S3_REGION:-us-east-1}"
+
+  aws s3 cp "${REMOTE_DIR}/backups/${ARCHIVE_NAME}" \
+    "s3://${S3_BACKUP_BUCKET}/backups/${ARCHIVE_NAME}" \
+    --endpoint-url "${S3_ENDPOINT}"
+
+  echo "Upload complete"
+
+  # S3 retention cleanup
+  echo "Cleaning up S3 backups older than ${RETENTION_DAYS} days..."
+  CUTOFF_DATE=$(date -d "-${RETENTION_DAYS} days" +%Y%m%d 2>/dev/null || echo "")
+  if [ -n "${CUTOFF_DATE}" ]; then
+    aws s3api list-objects-v2 \
+      --bucket "${S3_BACKUP_BUCKET}" \
+      --prefix "backups/${PROJECT}_" \
+      --endpoint-url "${S3_ENDPOINT}" \
+      --query "Contents[].Key" \
+      --output text 2>/dev/null | tr '\t' '\n' | while read -r key; do
+        [ -z "${key}" ] || [ "${key}" = "None" ] && continue
+        FILE_DATE=$(echo "${key}" | sed -n 's/.*_\([0-9]\{8\}\)_[0-9]\{6\}_full\.tar\.gz$/\1/p')
+        if [ -n "${FILE_DATE}" ] && [ "${FILE_DATE}" -lt "${CUTOFF_DATE}" ] 2>/dev/null; then
+          echo "Deleting expired backup: ${key}"
+          aws s3 rm "s3://${S3_BACKUP_BUCKET}/${key}" --endpoint-url "${S3_ENDPOINT}"
+        fi
+      done
+  fi
+else
+  echo "No S3 configured — backup stored locally only"
+fi
+
+# ============================================================================
+# Step 6: Local retention cleanup
+# ============================================================================
+
+find "${REMOTE_DIR}/backups" -name "${PROJECT}_*_full.tar.gz" -mtime "+${RETENTION_DAYS}" -delete 2>/dev/null || true
+
+# ============================================================================
+# Cleanup
+# ============================================================================
+
+rm -rf "${WORK_DIR}"
+
+echo "=== Backup completed at $(date) ==="
+echo "Archive: ${ARCHIVE_NAME} (${TOTAL_SIZE})"

package/carbon/biome.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.4.9/schema.json",
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "complexity": {
+        "noUselessFragments": "warn"
+      },
+      "correctness": {
+        "noUnusedImports": "error",
+        "noUnusedVariables": "warn",
+        "useExhaustiveDependencies": "warn"
+      },
+      "style": {
+        "noNonNullAssertion": "warn"
+      },
+      "suspicious": {
+        "noExplicitAny": "warn",
+        "noArrayIndexKey": "warn",
+        "noDoubleEquals": "warn",
+        "noDocumentCookie": "off"
+      },
+      "a11y": {
+        "useSemanticElements": "off",
+        "useFocusableInteractive": "warn",
+        "noRedundantRoles": "warn",
+        "noLabelWithoutControl": "warn",
+        "noPositiveTabindex": "warn",
+        "useKeyWithClickEvents": "off",
+        "useAriaPropsForRole": "warn",
+        "useValidAriaProps": "warn",
+        "useAriaPropsSupportedByRole": "off"
+      },
+      "security": {
+        "noDangerouslySetInnerHtml": "warn"
+      }
+    }
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "semicolons": "always",
+      "trailingCommas": "es5"
+    }
+  },
+  "css": {
+    "parser": {
+      "cssModules": true
+    },
+    "formatter": {
+      "enabled": false
+    },
+    "linter": {
+      "enabled": false
+    }
+  },
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "files": {
+    "includes": [
+      "src/**/*.ts",
+      "src/**/*.tsx",
+      "src/**/*.js",
+      "src/**/*.jsx",
+      "*.ts",
+      "*.tsx",
+      "*.js",
+      "*.jsx"
+    ]
+  }
+}

package/carbon/cloud-init/docker-ce-setup.yaml

@@ -0,0 +1,55 @@
+#cloud-config
+# Vibecarbon compose-deploy bootstrap.
+#
+# This user-data runs at VPS boot time in parallel with Hetzner's default
+# docker-ce app (Ubuntu 24.04 with Docker + compose-plugin pre-installed).
+# By finishing UFW + unattended-upgrades before SSH is even reachable, the
+# CLI's post-SSH setupServer becomes a ~2-second marker-file probe instead
+# of a ~90-second serial apt-get chain.
+#
+# Writing the marker file `/var/lib/vibecarbon/ready` is the contract that
+# tells the CLI it's safe to proceed. If user-data fails, the marker never
+# appears; the CLI reports and dumps /var/log/cloud-init-output.log.
+
+package_update: true
+packages:
+  - ufw
+  - unattended-upgrades
+
+write_files:
+  - path: /etc/apt/apt.conf.d/20auto-upgrades
+    permissions: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+
+runcmd:
+  # UFW defaults + the three ports Traefik needs. Ordering matters: we enable
+  # last so the allow rules are in place before the first policy flip.
+  - [ufw, default, deny, incoming]
+  - [ufw, default, allow, outgoing]
+  - [ufw, allow, '22/tcp']
+  - [ufw, allow, '80/tcp']
+  - [ufw, allow, '443/tcp']
+  - [sh, -c, 'echo y | ufw enable']
+
+  # Ensure Docker is running (docker-ce app usually starts it, but be defensive).
+  - [systemctl, enable, --now, docker]
+
+  # Note: an earlier iteration (iter-perfwave4b 2026-05-06) added parallel
+  # `docker pull` of supabase service images here to overlap pulls with
+  # iac.upStack. Net result was -25s: the unauthenticated pulls from
+  # Hetzner DC IPs hit Docker Hub's per-IP rate limit, serializing/
+  # throttling them, which extended cloudInitReady by ~61s while only
+  # saving ~35s on compose.up. The marker file can't land until cloud-init
+  # finishes runcmd, so a slow pre-pull blocks the operator longer than
+  # paying the same cost during compose.up (which uses authenticated
+  # pulls — quota-exempt). Reverted; reconcile.sh's `docker compose pull`
+  # is the right place for this work, post-dockerLoginOnServer.
+
+  # Marker file — the CLI's setupServer polls for this. The parent dir may
+  # not exist yet on a first boot; mkdir -p is safe either way.
+  - [mkdir, -p, /var/lib/vibecarbon]
+  - [sh, -c, 'printf "%s\n" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > /var/lib/vibecarbon/ready']
+
+final_message: "vibecarbon cloud-init complete after $UPTIME seconds"