vibecarbon 0.1.3 → 0.1.5

package/carbon/package.json

@@ -50,41 +50,41 @@
     "stripe:listen": "stripe listen --forward-to localhost:3000/api/webhooks/stripe"
   },
   "dependencies": {
-    "@base-ui/react": "^1.3.0",
+    "@base-ui/react": "^1.5.0",
     "@fontsource-variable/noto-sans": "^5.2.10",
     "@fontsource/jetbrains-mono": "^5.2.8",
-    "@hono/node-server": "^1.19.13",
-    "@hono/zod-openapi": "^1.2.3",
-    "@hookform/resolvers": "^5.2.2",
+    "@hono/node-server": "^2.0.4",
+    "@hono/zod-openapi": "^1.4.0",
+    "@hookform/resolvers": "^5.4.0",
     "@mdx-js/react": "^3.1.1",
     "@mdx-js/rollup": "^3.1.1",
-    "@scalar/api-reference-react": "^0.9.15",
+    "@scalar/api-reference-react": "^0.9.41",
     "@supabase/ssr": "^0.9.0",
-    "@supabase/supabase-js": "^2.100.0",
+    "@supabase/supabase-js": "^2.106.2",
     "@tanstack/react-query": "^5.95.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
-    "framer-motion": "^12.38.0",
-    "hono": "^4.12.16",
+    "framer-motion": "^12.40.0",
+    "hono": "^4.12.23",
     "i18next": "^25.10.9",
     "i18next-browser-languagedetector": "^8.2.1",
     "input-otp": "^1.4.2",
     "ioredis": "^5.10.1",
-    "lenis": "^1.3.20",
+    "lenis": "^1.3.23",
     "lucide-react": "^1.7.0",
     "next-themes": "^0.4.6",
-    "nodemailer": "^8.0.5",
+    "nodemailer": "^8.0.8",
     "pino": "^10.3.1",
-    "react": "^19.2.4",
+    "react": "^19.2.6",
     "react-day-picker": "^9.14.0",
-    "react-dom": "^19.2.4",
+    "react-dom": "^19.2.6",
     "react-hook-form": "^7.72.0",
     "react-i18next": "^16.6.6",
-    "react-resizable-panels": "^4.7.6",
-    "react-router-dom": "^7.13.2",
+    "react-resizable-panels": "^4.11.2",
+    "react-router-dom": "^7.15.1",
     "recharts": "^3.8.1",
     "rehype-autolink-headings": "^7.1.0",
     "rehype-slug": "^6.0.0",
@@ -113,7 +113,8 @@
       "ip-address@<10.1.1": ">=10.1.1",
       "fast-uri@<3.1.2": ">=3.1.2",
       "protobufjs@<7.5.6": "^7.5.6",
-      "@protobufjs/utf8@<1.1.1": "^1.1.1"
+      "@protobufjs/utf8@<1.1.1": "^1.1.1",
+      "ws@>=8.0.0 <8.20.1": ">=8.20.1"
     },
     "peerDependencyRules": {
       "allowedVersions": {
@@ -122,33 +123,33 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.9",
+    "@biomejs/biome": "^2.4.15",
     "@hono/swagger-ui": "^0.6.1",
-    "@scalar/hono-api-reference": "^0.10.5",
+    "@scalar/hono-api-reference": "^0.10.19",
     "@tailwindcss/typography": "^0.5.19",
-    "@tailwindcss/vite": "^4.2.2",
+    "@tailwindcss/vite": "^4.3.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^25.5.0",
-    "@types/nodemailer": "^7.0.11",
+    "@types/node": "^25.9.1",
+    "@types/nodemailer": "^8.0.0",
     "@types/pg": "^8.20.0",
-    "@types/react": "^19.2.14",
+    "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.1",
+    "@vitejs/plugin-react": "^6.0.2",
+    "@vitest/coverage-v8": "^4.1.7",
     "concurrently": "^9.2.1",
-    "esbuild": "^0.27.4",
+    "esbuild": "^0.28.0",
     "jsdom": "^26.1.0",
-    "pg": "^8.20.0",
+    "pg": "^8.21.0",
     "pino-pretty": "^13.1.3",
     "remark-gfm": "^4.0.1",
-    "shadcn": "^4.1.0",
-    "tailwindcss": "^4.2.2",
-    "tsx": "^4.21.0",
+    "shadcn": "^4.8.1",
+    "tailwindcss": "^4.3.0",
+    "tsx": "^4.22.3",
     "tw-animate-css": "^1.4.0",
-    "typescript": "^6.0.2",
-    "vite": "^8.0.5",
-    "vitest": "^4.1.1"
+    "typescript": "^6.0.3",
+    "vite": "^8.0.14",
+    "vitest": "^4.1.7"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -61,7 +61,7 @@
     "@pulumi/pulumi": "^3.231.0",
     "bcryptjs": "^3.0.3",
     "undici": "^8.1.0",
-    "which": "^6.0.1"
+    "which": "^7.0.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
@@ -87,9 +87,9 @@
     "better-sqlite3": "^12.8.0",
     "conventional-changelog-conventionalcommits": "^9.3.1",
     "msw": "^2.12.14",
-    "semantic-release": "^23.0.8",
+    "semantic-release": "^25.0.3",
     "tsx": "^4.21.0",
-    "vite": "^7.3.2",
+    "vite": "^8.0.14",
     "vitest": "^4.1.1",
     "zod": "^4.3.6"
   }

package/src/lib/deploy/bundle.js

@@ -207,6 +207,12 @@ export function renderBundle(projectName, options = {}) {
   copyDirIfExist('volumes/db', 'volumes/db');
   copyDirIfExist('supabase/migrations', 'supabase/migrations');
   copyDirIfExist('volumes/kong', 'volumes/kong');
+  // Edge functions: docker-compose.prod.yml bind-mounts ./functions and starts
+  // the edge-runtime with `--main-service /home/deno/functions/main`. If this
+  // isn't bundled, the mount auto-creates an empty dir on the server and the
+  // runtime crash-loops with "could not find an appropriate entrypoint". The
+  // template ships a stub at functions/main/index.ts. RCA: prod-1 2026-05-26.
+  copyDirIfExist('functions', 'functions');
 
   // volumes/traefik/middlewares.yml
   const traefikMiddlewares = join(cwd, 'volumes', 'traefik', 'middlewares.yml');

package/src/lib/deploy/compose/index.js

@@ -734,17 +734,40 @@ export async function pullComposeImages(ip, sshKeyPath, projectName, options = {
 export async function runMigrations(ip, sshKeyPath, projectName) {
   const remoteDir = `/opt/${projectName}`;
 
-  // Wait for PostgreSQL to be ready, then run every migration — all in one
-  // SSH round-trip. A `for f in *.sql; do ...; done` on the remote shell
-  // executes the migrations sequentially without N+1 SSH handshakes (one
-  // ls, one psql per file = N+1 trips before). `|| true` per-file keeps a
-  // bad migration from halting the rest (matches prior behaviour).
+  // On a fresh volume, supabase/postgres runs its own first-boot initdb scripts
+  // (creating the supabase_admin role + auth/storage/realtime schemas) before
+  // our app migrations can apply. `pg_isready` flips true as soon as PG accepts
+  // connections — which can be *during* that init, before supabase_admin
+  // exists. Running migrations then errors (missing role/extension). Previously
+  // those errors were piped to /dev/null with `|| true`, so a fully-failed
+  // migration was indistinguishable from success and an empty schema shipped to
+  // prod (RCA prod-1 2026-05-26: 0 public tables, every DB feature 500'd).
+  //
+  // Gate on supabase_admin actually being able to run a query (not just
+  // pg_isready), polling up to ~3 min.
   await sshRunAsync(
     ip,
     sshKeyPath,
-    `cd ${remoteDir} && docker compose exec -T db pg_isready -U postgres && ` +
+    `cd ${remoteDir} && ` +
+      `for i in $(seq 1 60); do ` +
+      `docker compose exec -T db psql -U supabase_admin -d postgres -c 'SELECT 1' >/dev/null 2>&1 && exit 0; ` +
+      `echo "[migrate] waiting for supabase_admin to accept queries (attempt $i/60)"; sleep 3; ` +
+      `done; echo "[migrate] supabase_admin never became ready" >&2; exit 1`,
+    { timeout: 240_000 },
+  );
+
+  // Apply each migration with ON_ERROR_STOP=1 and abort on the first failure.
+  // A failed migration MUST fail the deploy — silently shipping an empty schema
+  // is far worse than a deploy the operator can see failed and retry. Errors
+  // propagate (no 2>/dev/null, no `|| true`); sshRunAsync throws on non-zero.
+  await sshRunAsync(
+    ip,
+    sshKeyPath,
+    `cd ${remoteDir} && ` +
       `for f in $(ls supabase/migrations/ 2>/dev/null | sort); do ` +
-      `cat "supabase/migrations/$f" | docker compose exec -T db psql -U supabase_admin -d postgres 2>/dev/null || true; ` +
+      `echo "[migrate] applying $f"; ` +
+      `cat "supabase/migrations/$f" | docker compose exec -T db psql -U supabase_admin -d postgres -v ON_ERROR_STOP=1 || ` +
+      `{ echo "[migrate] FAILED applying $f" >&2; exit 1; }; ` +
       `done`,
     { timeout: 300_000 },
   );
@@ -809,20 +832,28 @@ export async function deployCompose(options) {
   onProgress('Starting services...');
   await startComposeStack(ip, sshKeyPath, projectName, serviceOpts);
 
-  // Step 5: Run migrations
+  // Step 5: Run migrations. A failure here means an empty/partial schema, which
+  // makes every DB-backed feature 500 — so let it abort the deploy rather than
+  // swallowing it (RCA prod-1 2026-05-26: the previous blanket try/catch hid a
+  // fully-failed migration and shipped a schema-less prod that reported success).
   onProgress('Running database migrations...');
   const remoteDir = `/opt/${projectName}`;
-  try {
-    await runMigrations(ip, sshKeyPath, projectName);
-    // Reload PostgREST schema cache so it sees newly created tables
-    await sshRunAsync(
-      ip,
-      sshKeyPath,
-      `cd ${remoteDir} && docker compose exec -T rest kill -s SIGUSR1 1 2>/dev/null || true`,
-    );
-  } catch {
-    // Migrations may partially fail on first run, non-fatal
-  }
+  await runMigrations(ip, sshKeyPath, projectName);
+  // Reload PostgREST schema cache so it sees newly created tables. The old
+  // `docker compose exec rest kill -s SIGUSR1 1` never worked — the
+  // postgrest/postgrest image has no `kill` binary ("exec: kill: executable
+  // file not found in $PATH"), so the reload silently no-op'd and fresh tables
+  // stayed invisible (PGRST205) until rest happened to restart. RCA prod-1
+  // 2026-05-26. Use the canonical SQL NOTIFY on the pgrst channel instead
+  // (db-channel-enabled defaults on); fall back to restarting rest if NOTIFY
+  // doesn't land. Best-effort: a missed reload self-heals on the next deploy.
+  await sshRunAsync(
+    ip,
+    sshKeyPath,
+    `cd ${remoteDir} && ` +
+      `docker compose exec -T db psql -U postgres -d postgres -c "NOTIFY pgrst, 'reload schema'" 2>/dev/null || ` +
+      `docker compose restart rest 2>/dev/null || true`,
+  );
 
   return {
     success: true,

package/src/lib/providers/hetzner-s3.js

@@ -355,16 +355,28 @@ export class HetznerS3Provider {
    * @param {string} bucketName - Bucket name
    */
   async deleteBucket(bucketName) {
-    for (let attempt = 0; attempt < 5; attempt++) {
+    // Hetzner's S3 returns BucketNotEmpty for some time after the last object
+    // deletion finishes propagating, even when GET/LIST already report the
+    // bucket as empty. Observed in prod-1 destroy 2026-05-26: cleanup ran,
+    // all subsequent listings returned 0 items, but DeleteBucket still raised
+    // BucketNotEmpty for >30s. Manual `aws s3api delete-bucket` minutes later
+    // succeeded immediately. Backoff schedule below totals ~90s wall time
+    // across 7 attempts — covers the consistency lag we've seen without
+    // dragging out the destroy stage on the happy path.
+    const delays = [2000, 5000, 10000, 15000, 20000, 25000, 30000];
+    let lastErr;
+    for (let attempt = 0; attempt <= delays.length; attempt++) {
       try {
         await this._send(new DeleteBucketCommand({ Bucket: bucketName }));
         return;
       } catch (err) {
+        lastErr = err;
         const isNotEmpty = err.Code === 'BucketNotEmpty' || err.message?.includes('not empty');
-        if (!isNotEmpty || attempt === 4) throw err;
-        await new Promise((r) => setTimeout(r, 3000 * (attempt + 1)));
+        if (!isNotEmpty || attempt === delays.length) throw err;
+        await new Promise((r) => setTimeout(r, delays[attempt]));
       }
     }
+    throw lastErr;
   }
 
   /**
@@ -546,7 +558,15 @@ export class HetznerS3Provider {
       // multipart API absent — covered above
     }
 
-    return parts.length > 0 ? parts.join(', ') : 'unable to list remaining contents';
+    // If all three listings succeeded and returned zero items, the bucket
+    // *appears* empty but DeleteBucket still raised BucketNotEmpty. Almost
+    // always Hetzner consistency lag — the upstream caller has already
+    // exhausted its retry budget by this point, so tell the operator how to
+    // recover instead of the generic "unable to list" message which sounds
+    // like the diagnostic itself broke.
+    return parts.length > 0
+      ? parts.join(', ')
+      : 'bucket appears empty in all listings — likely Hetzner S3 eventual-consistency lag. Wait ~60s, then retry the destroy or delete the bucket manually with `aws s3api delete-bucket --bucket <name> --endpoint-url <endpoint>`.';
   }
 
   /**