vibecarbon 0.1.0

package/carbon/tests/integration/server/routes/contact.test.ts

@@ -0,0 +1,162 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { jsonPost, mountRoute } from '../../../_helpers/app';
+import { makeContactSubmission } from '../../../_helpers/factories';
+
+// `vi.hoisted` runs before the vi.mock factories below, so the same object
+// reference is shared with the mocked env module. Per-test mutations to
+// `fakeEnv` are visible inside the route under test.
+const { insertMock, sendEmailMock, fakeEnv } = vi.hoisted(() => ({
+  insertMock: vi.fn(),
+  sendEmailMock: vi.fn().mockResolvedValue(undefined),
+  fakeEnv: {
+    SMTP_ADMIN_EMAIL: undefined as string | undefined,
+  } as Record<string, unknown>,
+}));
+
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: {
+    from: () => ({ insert: insertMock }),
+  },
+}));
+
+// Email is fired-and-forgotten on success — stub it so tests don't try
+// to open an SMTP connection.
+vi.mock('@server/lib/email', () => ({
+  sendEmail: sendEmailMock,
+}));
+
+// The route reads `env.SMTP_ADMIN_EMAIL` at request time. The real env
+// module evaluates zod schemas at import time, so vi.stubEnv can't shift
+// values after the fact — mock the module instead with a mutable object.
+vi.mock('@server/lib/env', () => ({
+  env: fakeEnv,
+}));
+
+// The route file's `createRateLimiter` returns a Hono middleware. The
+// real implementation builds an in-memory rate-limit store on a 60s
+// setInterval — replace with a pass-through so the timer never starts.
+vi.mock('@server/lib/rate-limiter', () => ({
+  createRateLimiter: () => async (_c: unknown, next: () => Promise<void>) => {
+    await next();
+  },
+}));
+
+vi.mock('@server/lib/logger', () => ({
+  logger: { error: vi.fn(), info: vi.fn(), warn: vi.fn(), debug: vi.fn() },
+}));
+
+const { contactRoutes } = await import('@server/routes/v1/contact');
+const app = mountRoute('/api/v1/contact', contactRoutes);
+
+beforeEach(() => {
+  insertMock.mockReset();
+  sendEmailMock.mockClear();
+  fakeEnv.SMTP_ADMIN_EMAIL = undefined;
+});
+
+describe('POST /api/v1/contact/submit', () => {
+  it('inserts the submission and returns 200 on the happy path', async () => {
+    insertMock.mockResolvedValueOnce({ error: null });
+
+    const payload = makeContactSubmission();
+    const res = await app.request('/api/v1/contact/submit', jsonPost(payload));
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true });
+    expect(insertMock).toHaveBeenCalledTimes(1);
+    expect(insertMock).toHaveBeenCalledWith({
+      name: payload.name,
+      email: payload.email,
+      subject: payload.subject,
+      message: payload.message,
+    });
+  });
+
+  it('returns 400 with field errors when validation fails', async () => {
+    const res = await app.request(
+      '/api/v1/contact/submit',
+      jsonPost({ name: '', email: 'not-an-email', subject: '', message: 'short' }),
+    );
+
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toContain('Name is required');
+    expect(insertMock).not.toHaveBeenCalled();
+  });
+
+  it('returns 400 on invalid JSON', async () => {
+    const res = await app.request('/api/v1/contact/submit', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: '{not valid',
+    });
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe('Invalid JSON body');
+  });
+
+  it('rejects bot submissions that fill the honeypot field (zod max(0))', async () => {
+    // The schema's `website: z.string().max(0).optional()` is the actual
+    // bot trap — anything non-empty fails validation with 400. The
+    // route's defensive `if (body.website)` is dead code as the schema
+    // stands; we test the live protection here.
+    const res = await app.request(
+      '/api/v1/contact/submit',
+      jsonPost(makeContactSubmission({ website: 'http://spam.example' })),
+    );
+
+    expect(res.status).toBe(400);
+    expect(insertMock).not.toHaveBeenCalled();
+  });
+
+  it('returns 500 when the insert fails', async () => {
+    insertMock.mockResolvedValueOnce({ error: { message: 'db down' } });
+
+    const res = await app.request('/api/v1/contact/submit', jsonPost(makeContactSubmission()));
+
+    expect(res.status).toBe(500);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBeTypeOf('string');
+  });
+
+  it('fires the admin notification email when SMTP_ADMIN_EMAIL is set', async () => {
+    fakeEnv.SMTP_ADMIN_EMAIL = 'admin@example.test';
+    insertMock.mockResolvedValueOnce({ error: null });
+
+    const payload = makeContactSubmission({ subject: 'Bug report' });
+    const res = await app.request('/api/v1/contact/submit', jsonPost(payload));
+
+    expect(res.status).toBe(200);
+    // Email is sent async — wait a tick for the .catch chain to run.
+    await new Promise((r) => setTimeout(r, 0));
+    expect(sendEmailMock).toHaveBeenCalledTimes(1);
+    expect(sendEmailMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'admin@example.test',
+        subject: expect.stringContaining('Bug report'),
+        replyTo: payload.email,
+      }),
+    );
+  });
+
+  it('escapes HTML in the notification email body', async () => {
+    fakeEnv.SMTP_ADMIN_EMAIL = 'admin@example.test';
+    insertMock.mockResolvedValueOnce({ error: null });
+
+    await app.request(
+      '/api/v1/contact/submit',
+      jsonPost(
+        makeContactSubmission({
+          name: '<script>alert(1)</script>',
+          message: 'hi & bye <b>bold</b>'.padEnd(20, ' '),
+        }),
+      ),
+    );
+    await new Promise((r) => setTimeout(r, 0));
+
+    const html = sendEmailMock.mock.calls[0][0].html as string;
+    expect(html).not.toContain('<script>');
+    expect(html).toContain('&lt;script&gt;');
+    expect(html).toContain('hi &amp; bye &lt;b&gt;bold&lt;/b&gt;');
+  });
+});

package/carbon/tests/integration/server/routes/health.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, it, vi } from 'vitest';
+import { mountRoute } from '../../../_helpers/app';
+
+// supabaseAdmin is invoked only by the readiness check. We give it a
+// chainable shape so .from(...).select(...).limit(...) resolves to a
+// controllable result; the test overrides the resolved value per case.
+const limitMock = vi.fn();
+vi.mock('@server/lib/supabase', () => ({
+  supabaseAdmin: {
+    from: () => ({ select: () => ({ limit: limitMock }) }),
+  },
+}));
+
+// Quiet the route's error log on the failure path — it's expected.
+vi.mock('@server/lib/logger', () => ({
+  logger: { error: vi.fn(), info: vi.fn(), warn: vi.fn(), debug: vi.fn() },
+}));
+
+const { healthRoutes } = await import('@server/routes/health');
+const app = mountRoute('/api/health', healthRoutes);
+
+describe('GET /api/health', () => {
+  it('returns 200 with a timestamp (liveness probe is independent of deps)', async () => {
+    // Hono mounts: app.route('/api/health', healthRoutes) + healthRoutes.get('/').
+    // Match the path without a trailing slash — Hono's router is strict.
+    const res = await app.request('/api/health');
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { status: string; timestamp: string };
+    expect(body.status).toBe('ok');
+    expect(new Date(body.timestamp).toString()).not.toBe('Invalid Date');
+  });
+});
+
+describe('GET /api/health/ready', () => {
+  it('returns 200 when Supabase responds without error', async () => {
+    limitMock.mockResolvedValueOnce({ data: [], error: null });
+    const res = await app.request('/api/health/ready');
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      status: string;
+      services: { database: string; supabase: string };
+    };
+    expect(body.status).toBe('ready');
+    expect(body.services.database).toBe('connected');
+    expect(body.services.supabase).toBe('connected');
+  });
+
+  it('returns 503 when Supabase responds with an error', async () => {
+    limitMock.mockResolvedValueOnce({ data: null, error: new Error('db down') });
+    const res = await app.request('/api/health/ready');
+    expect(res.status).toBe(503);
+    const body = (await res.json()) as { status: string };
+    expect(body.status).toBe('not_ready');
+  });
+
+  it('returns 503 when the Supabase client throws', async () => {
+    limitMock.mockRejectedValueOnce(new Error('connection refused'));
+    const res = await app.request('/api/health/ready');
+    expect(res.status).toBe(503);
+  });
+});

package/carbon/tests/structural/i18n-parity.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+import de from '../../src/client/locales/de.json';
+import en from '../../src/client/locales/en.json';
+import es from '../../src/client/locales/es.json';
+import fr from '../../src/client/locales/fr.json';
+import pt from '../../src/client/locales/pt.json';
+
+// Structural invariant: every locale file must have the same key set as
+// en.json. A missing key falls back to the key path at runtime (ugly); an
+// extra key in a translation file means the source string was renamed or
+// dropped but the translation wasn't updated. Either way it's a bug.
+//
+// This is the pattern for "cross-cutting invariant" tests — they don't
+// exercise behavior, they assert that the shape of related artifacts
+// agrees. Lives in tests/structural/ and runs under the `unit` project.
+
+/** Recursively collect every leaf key path, e.g. "auth.signIn", "landing.hero.badge". */
+function collectKeys(obj: unknown, prefix = ''): string[] {
+  if (typeof obj !== 'object' || obj === null) return [prefix];
+  return Object.entries(obj as Record<string, unknown>).flatMap(([key, val]) =>
+    collectKeys(val, prefix ? `${prefix}.${key}` : key),
+  );
+}
+
+const enKeys = new Set(collectKeys(en));
+const locales: Record<string, unknown> = { es, fr, de, pt };
+
+describe('i18n locale parity', () => {
+  for (const [lang, locale] of Object.entries(locales)) {
+    const keys = new Set(collectKeys(locale));
+
+    it(`${lang}.json contains every key from en.json`, () => {
+      const missing = [...enKeys].filter((k) => !keys.has(k));
+      expect(missing, `${lang} missing: ${missing.slice(0, 10).join(', ')}`).toHaveLength(0);
+    });
+
+    it(`${lang}.json has no extra keys absent from en.json`, () => {
+      const extra = [...keys].filter((k) => !enKeys.has(k));
+      expect(extra, `${lang} extra: ${extra.slice(0, 10).join(', ')}`).toHaveLength(0);
+    });
+  }
+});

package/carbon/tests/unit/client/utils.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest';
+import { cn, getUserInitials } from '@/lib/utils';
+
+describe('cn (className merger)', () => {
+  it('joins truthy class names', () => {
+    expect(cn('a', 'b', 'c')).toBe('a b c');
+  });
+
+  it('drops falsy values', () => {
+    expect(cn('a', false, null, undefined, '', 'b')).toBe('a b');
+  });
+
+  it('lets later Tailwind utilities override earlier ones (tw-merge)', () => {
+    // The whole reason we use tw-merge instead of plain clsx: conflicting
+    // utility classes resolve to the last one in.
+    expect(cn('px-2', 'px-4')).toBe('px-4');
+    expect(cn('text-sm text-red-500', 'text-blue-500')).toBe('text-sm text-blue-500');
+  });
+});
+
+describe('getUserInitials', () => {
+  it('returns "?" when user is null', () => {
+    expect(getUserInitials(null)).toBe('?');
+  });
+
+  it('uses the first two name parts when full_name is present', () => {
+    expect(
+      getUserInitials({ email: 'a@b.c', user_metadata: { full_name: 'Ada Lovelace' } }),
+    ).toBe('AL');
+  });
+
+  it('caps initials at two characters even for long names', () => {
+    expect(
+      getUserInitials({
+        email: 'm@a.c',
+        user_metadata: { full_name: 'Mary Anne Evans George Eliot' },
+      }),
+    ).toBe('MA');
+  });
+
+  it('falls back to the email first character when no full_name', () => {
+    expect(getUserInitials({ email: 'ada@example.com' })).toBe('A');
+  });
+
+  it('returns "?" when neither name nor email is usable', () => {
+    expect(getUserInitials({ email: '' })).toBe('?');
+    expect(getUserInitials({})).toBe('?');
+  });
+});

package/carbon/tests/unit/shared/pricing.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest';
+import {
+  formatPrice,
+  getPlan,
+  planIdFromPriceId,
+  plans,
+} from '@shared/pricing';
+
+describe('plans catalog', () => {
+  it('exposes free, starter, and pro tiers', () => {
+    expect(plans.map((p) => p.id)).toEqual(['free', 'starter', 'pro']);
+  });
+
+  it('only `starter` is flagged as popular', () => {
+    const popular = plans.filter((p) => p.popular);
+    expect(popular.map((p) => p.id)).toEqual(['starter']);
+  });
+
+  it('prices are non-negative integer cents', () => {
+    for (const plan of plans) {
+      expect(Number.isInteger(plan.price.monthly)).toBe(true);
+      expect(plan.price.monthly).toBeGreaterThanOrEqual(0);
+    }
+  });
+
+  it('higher tiers strictly include all features of lower tiers', () => {
+    // Encodes the product invariant: upgrading never removes a feature.
+    const tierOrder = ['free', 'starter', 'pro'] as const;
+    for (let i = 1; i < tierOrder.length; i++) {
+      const lower = getPlan(tierOrder[i - 1])!;
+      const higher = getPlan(tierOrder[i])!;
+      const lowerIncluded = lower.features.filter((f) => f.included).map((f) => f.text);
+      const higherIncluded = new Set(
+        higher.features.filter((f) => f.included).map((f) => f.text),
+      );
+      for (const feature of lowerIncluded) {
+        expect(higherIncluded.has(feature)).toBe(true);
+      }
+    }
+  });
+});
+
+describe('getPlan', () => {
+  it('returns the plan when the id matches', () => {
+    expect(getPlan('pro')?.name).toBe('Pro');
+  });
+
+  it('returns undefined for an unknown id', () => {
+    // @ts-expect-error — intentional: exercise runtime behavior for unknown id
+    expect(getPlan('enterprise')).toBeUndefined();
+  });
+});
+
+describe('formatPrice', () => {
+  it('returns "Free" for zero cents', () => {
+    expect(formatPrice(0)).toBe('Free');
+  });
+
+  it('formats whole-dollar amounts with /mo suffix', () => {
+    expect(formatPrice(1900)).toBe('$19/mo');
+    expect(formatPrice(7900)).toBe('$79/mo');
+  });
+
+  it('truncates fractional dollars (current behavior)', () => {
+    // Documenting current rounding: toFixed(0) on $19.50 -> "$20/mo" due
+    // to banker rounding via toFixed. If you change pricing math, update
+    // this assertion to whatever the new contract is.
+    expect(formatPrice(1950)).toBe('$20/mo');
+  });
+});
+
+describe('planIdFromPriceId', () => {
+  const priceIds = {
+    starter: 'price_starter_test',
+    pro: 'price_pro_test',
+  };
+
+  it('maps the starter price id to "starter"', () => {
+    expect(planIdFromPriceId('price_starter_test', priceIds)).toBe('starter');
+  });
+
+  it('maps the pro price id to "pro"', () => {
+    expect(planIdFromPriceId('price_pro_test', priceIds)).toBe('pro');
+  });
+
+  it('falls back to "free" for unknown price ids', () => {
+    expect(planIdFromPriceId('price_unknown', priceIds)).toBe('free');
+  });
+
+  it('falls back to "free" when the id mapping is empty', () => {
+    expect(planIdFromPriceId('anything', {})).toBe('free');
+  });
+});

package/carbon/tsconfig.json

@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "types": ["vite/client"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "ignoreDeprecations": "6.0",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/client/*"],
+      "@shared/*": ["./src/shared/*"],
+      "@content/*": ["./content/*"]
+    }
+  },
+  "include": ["src/client", "src/shared", "content"]
+}

package/carbon/tsconfig.server.json

@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2023"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "outDir": "./dist/server",
+    "rootDir": "./src",
+    "strict": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "ignoreDeprecations": "6.0",
+    "baseUrl": ".",
+    "paths": {
+      "@shared/*": ["./src/shared/*"]
+    }
+  },
+  "include": ["src/server", "src/shared"],
+  "exclude": ["src/client"]
+}

package/carbon/tsconfig.test.json

@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "types": ["vitest/globals", "@testing-library/jest-dom", "node"],
+    "noUnusedLocals": false,
+    "noUnusedParameters": false
+  },
+  "include": ["src", "tests", "vitest.config.ts"]
+}

package/carbon/vite.config.ts

@@ -0,0 +1,110 @@
+import path from 'node:path';
+import mdx from '@mdx-js/rollup';
+import tailwindcss from '@tailwindcss/vite';
+import react from '@vitejs/plugin-react';
+import rehypeAutolinkHeadings from 'rehype-autolink-headings';
+import rehypeSlug from 'rehype-slug';
+import remarkFrontmatter from 'remark-frontmatter';
+import remarkGfm from 'remark-gfm';
+import remarkMdxFrontmatter from 'remark-mdx-frontmatter';
+import { defineConfig, loadEnv } from 'vite';
+
+// Calculate ports based on offset and overrides
+function getPort(envVarName: string, defaultPort: number, offset: number): number {
+  const override = process.env[envVarName];
+  if (override) return Number.parseInt(override, 10);
+  return defaultPort + offset;
+}
+
+export default defineConfig(({ mode }) => {
+  // Load env from project root (where .env.local lives)
+  const env = loadEnv(mode, path.resolve(__dirname), '');
+
+  const portOffset = Number.parseInt(env.DEV_PORT_OFFSET || '0', 10);
+  const vitePort = getPort('DEV_VITE_PORT', 5173, portOffset);
+  const apiPort = getPort('DEV_API_PORT', 3000, portOffset);
+  const kongPort = getPort('DEV_KONG_PORT', 8000, portOffset);
+
+  // Override client-side env vars with offset-adjusted ports in development.
+  // VITE_SUPABASE_URL and SITE_URL are hardcoded to default ports in .env,
+  // but DEV_PORT_OFFSET shifts Docker ports (Kong on 8000+offset).
+  const devDefines: Record<string, string> =
+    mode === 'development' && portOffset !== 0
+      ? {
+          'import.meta.env.VITE_SUPABASE_URL': JSON.stringify(`http://localhost:${kongPort}`),
+          'import.meta.env.SITE_URL': JSON.stringify(`http://localhost:${vitePort}`),
+        }
+      : {};
+
+  return {
+    plugins: [
+      mdx({
+        remarkPlugins: [remarkFrontmatter, remarkGfm, remarkMdxFrontmatter],
+        rehypePlugins: [rehypeSlug, [rehypeAutolinkHeadings, { behavior: 'wrap' }]],
+      }),
+      react(),
+      tailwindcss(),
+    ],
+
+    define: devDefines,
+
+    root: 'src/client',
+    envDir: '../..',
+
+    build: {
+      outDir: '../../dist/client',
+      emptyOutDir: true,
+      // Security: Explicitly disable source maps in production builds
+      // Using mode check since NODE_ENV may not be set during Vite build
+      sourcemap: mode === 'development',
+      rollupOptions: {
+        output: {
+          manualChunks(id) {
+            if (
+              id.includes('node_modules/react-dom/') ||
+              id.includes('node_modules/react/') ||
+              id.includes('node_modules/react-router')
+            )
+              return 'vendor-react';
+            if (id.includes('node_modules/@supabase/')) return 'vendor-supabase';
+            if (id.includes('node_modules/@tanstack/react-query')) return 'vendor-query';
+            if (id.includes('node_modules/recharts')) return 'vendor-charts';
+            if (id.includes('node_modules/framer-motion')) return 'vendor-motion';
+            if (
+              id.includes('node_modules/cmdk') ||
+              id.includes('node_modules/vaul') ||
+              id.includes('node_modules/sonner') ||
+              id.includes('node_modules/embla-carousel-react')
+            )
+              return 'vendor-ui';
+          },
+        },
+      },
+    },
+
+    resolve: {
+      alias: {
+        '@': path.resolve(__dirname, './src/client'),
+        '@shared': path.resolve(__dirname, './src/shared'),
+        '@content': path.resolve(__dirname, './content'),
+      },
+    },
+
+    server: {
+      port: vitePort,
+      // Listen on all interfaces so Docker containers can reach Vite via host.docker.internal
+      // This enables accessing the app at http://app.localhost through Traefik
+      host: true,
+      proxy: {
+        '/api': {
+          target: `http://localhost:${apiPort}`,
+          changeOrigin: true,
+          // Let React Router handle /api/docs — don't proxy it to the backend
+          bypass(req) {
+            if (req.url === '/api/docs') return req.url;
+          },
+        },
+      },
+    },
+  };
+});

package/carbon/vitest.config.ts

@@ -0,0 +1,74 @@
+import { resolve } from 'node:path';
+import { defineConfig } from 'vitest/config';
+
+// Three-tier vitest setup mirroring vibecarbon's own layout (slimmed for an
+// app — no real-infra e2e tier).
+//
+//   unit         pure functions, validators, shared lib       — node env, fast
+//   component    React components + hooks via RTL             — jsdom env
+//   integration  Hono route handlers w/ mocked externals      — node env
+//
+// `pnpm test` runs the full set; `pnpm test:unit` etc. pick one tier.
+//
+// The `test-maintainer` subagent reads tests/ to learn this project's
+// conventions — keep new tests in the matching tier directory so the agent
+// can extend the pattern.
+export default defineConfig({
+  resolve: {
+    alias: {
+      '@': resolve(__dirname, 'src/client'),
+      '@shared': resolve(__dirname, 'src/shared'),
+      '@server': resolve(__dirname, 'src/server'),
+    },
+  },
+  test: {
+    globals: true,
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'html'],
+      include: ['src/**/*.{ts,tsx}'],
+      exclude: ['src/**/*.test.{ts,tsx}', 'src/**/*.d.ts', 'tests/**', 'node_modules'],
+    },
+    projects: [
+      {
+        extends: true,
+        test: {
+          name: 'unit',
+          // Pure, in-process. No DOM, no React. Validators, formatters,
+          // pricing math, shared types.
+          environment: 'node',
+          include: ['tests/unit/**/*.test.ts', 'tests/structural/**/*.test.ts'],
+          testTimeout: 5_000,
+        },
+      },
+      {
+        extends: true,
+        test: {
+          name: 'component',
+          // React components + custom hooks via React Testing Library.
+          // jsdom for DOM APIs; setup file wires @testing-library/jest-dom
+          // matchers + auto-cleanup between tests.
+          environment: 'jsdom',
+          include: ['tests/component/**/*.test.{ts,tsx}'],
+          setupFiles: ['tests/_helpers/setup-rtl.ts'],
+          testTimeout: 10_000,
+        },
+      },
+      {
+        extends: true,
+        test: {
+          name: 'integration',
+          // Hono route handlers exercised end-to-end via app.request(),
+          // with external services (Supabase, Stripe, SMTP) mocked at the
+          // module boundary. Tests the full request/response cycle —
+          // schema validation, status codes, error mapping, rate-limit
+          // wiring — without standing up real infra.
+          environment: 'node',
+          include: ['tests/integration/**/*.test.ts'],
+          setupFiles: ['tests/_helpers/setup-integration.ts'],
+          testTimeout: 15_000,
+        },
+      },
+    ],
+  },
+});