vibecarbon 0.1.4 → 0.1.5

package/carbon/package.json

@@ -53,7 +53,7 @@
     "@base-ui/react": "^1.5.0",
     "@fontsource-variable/noto-sans": "^5.2.10",
     "@fontsource/jetbrains-mono": "^5.2.8",
-    "@hono/node-server": "^1.19.13",
+    "@hono/node-server": "^2.0.4",
     "@hono/zod-openapi": "^1.4.0",
     "@hookform/resolvers": "^5.4.0",
     "@mdx-js/react": "^3.1.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",
@@ -61,7 +61,7 @@
     "@pulumi/pulumi": "^3.231.0",
     "bcryptjs": "^3.0.3",
     "undici": "^8.1.0",
-    "which": "^6.0.1"
+    "which": "^7.0.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
@@ -87,9 +87,9 @@
     "better-sqlite3": "^12.8.0",
     "conventional-changelog-conventionalcommits": "^9.3.1",
     "msw": "^2.12.14",
-    "semantic-release": "^23.0.8",
+    "semantic-release": "^25.0.3",
     "tsx": "^4.21.0",
-    "vite": "^7.3.2",
+    "vite": "^8.0.14",
     "vitest": "^4.1.1",
     "zod": "^4.3.6"
   }

package/src/lib/deploy/bundle.js

@@ -207,6 +207,12 @@ export function renderBundle(projectName, options = {}) {
   copyDirIfExist('volumes/db', 'volumes/db');
   copyDirIfExist('supabase/migrations', 'supabase/migrations');
   copyDirIfExist('volumes/kong', 'volumes/kong');
+  // Edge functions: docker-compose.prod.yml bind-mounts ./functions and starts
+  // the edge-runtime with `--main-service /home/deno/functions/main`. If this
+  // isn't bundled, the mount auto-creates an empty dir on the server and the
+  // runtime crash-loops with "could not find an appropriate entrypoint". The
+  // template ships a stub at functions/main/index.ts. RCA: prod-1 2026-05-26.
+  copyDirIfExist('functions', 'functions');
 
   // volumes/traefik/middlewares.yml
   const traefikMiddlewares = join(cwd, 'volumes', 'traefik', 'middlewares.yml');

package/src/lib/deploy/compose/index.js

@@ -734,17 +734,40 @@ export async function pullComposeImages(ip, sshKeyPath, projectName, options = {
 export async function runMigrations(ip, sshKeyPath, projectName) {
   const remoteDir = `/opt/${projectName}`;
 
-  // Wait for PostgreSQL to be ready, then run every migration — all in one
-  // SSH round-trip. A `for f in *.sql; do ...; done` on the remote shell
-  // executes the migrations sequentially without N+1 SSH handshakes (one
-  // ls, one psql per file = N+1 trips before). `|| true` per-file keeps a
-  // bad migration from halting the rest (matches prior behaviour).
+  // On a fresh volume, supabase/postgres runs its own first-boot initdb scripts
+  // (creating the supabase_admin role + auth/storage/realtime schemas) before
+  // our app migrations can apply. `pg_isready` flips true as soon as PG accepts
+  // connections — which can be *during* that init, before supabase_admin
+  // exists. Running migrations then errors (missing role/extension). Previously
+  // those errors were piped to /dev/null with `|| true`, so a fully-failed
+  // migration was indistinguishable from success and an empty schema shipped to
+  // prod (RCA prod-1 2026-05-26: 0 public tables, every DB feature 500'd).
+  //
+  // Gate on supabase_admin actually being able to run a query (not just
+  // pg_isready), polling up to ~3 min.
   await sshRunAsync(
     ip,
     sshKeyPath,
-    `cd ${remoteDir} && docker compose exec -T db pg_isready -U postgres && ` +
+    `cd ${remoteDir} && ` +
+      `for i in $(seq 1 60); do ` +
+      `docker compose exec -T db psql -U supabase_admin -d postgres -c 'SELECT 1' >/dev/null 2>&1 && exit 0; ` +
+      `echo "[migrate] waiting for supabase_admin to accept queries (attempt $i/60)"; sleep 3; ` +
+      `done; echo "[migrate] supabase_admin never became ready" >&2; exit 1`,
+    { timeout: 240_000 },
+  );
+
+  // Apply each migration with ON_ERROR_STOP=1 and abort on the first failure.
+  // A failed migration MUST fail the deploy — silently shipping an empty schema
+  // is far worse than a deploy the operator can see failed and retry. Errors
+  // propagate (no 2>/dev/null, no `|| true`); sshRunAsync throws on non-zero.
+  await sshRunAsync(
+    ip,
+    sshKeyPath,
+    `cd ${remoteDir} && ` +
       `for f in $(ls supabase/migrations/ 2>/dev/null | sort); do ` +
-      `cat "supabase/migrations/$f" | docker compose exec -T db psql -U supabase_admin -d postgres 2>/dev/null || true; ` +
+      `echo "[migrate] applying $f"; ` +
+      `cat "supabase/migrations/$f" | docker compose exec -T db psql -U supabase_admin -d postgres -v ON_ERROR_STOP=1 || ` +
+      `{ echo "[migrate] FAILED applying $f" >&2; exit 1; }; ` +
       `done`,
     { timeout: 300_000 },
   );
@@ -809,20 +832,28 @@ export async function deployCompose(options) {
   onProgress('Starting services...');
   await startComposeStack(ip, sshKeyPath, projectName, serviceOpts);
 
-  // Step 5: Run migrations
+  // Step 5: Run migrations. A failure here means an empty/partial schema, which
+  // makes every DB-backed feature 500 — so let it abort the deploy rather than
+  // swallowing it (RCA prod-1 2026-05-26: the previous blanket try/catch hid a
+  // fully-failed migration and shipped a schema-less prod that reported success).
   onProgress('Running database migrations...');
   const remoteDir = `/opt/${projectName}`;
-  try {
-    await runMigrations(ip, sshKeyPath, projectName);
-    // Reload PostgREST schema cache so it sees newly created tables
-    await sshRunAsync(
-      ip,
-      sshKeyPath,
-      `cd ${remoteDir} && docker compose exec -T rest kill -s SIGUSR1 1 2>/dev/null || true`,
-    );
-  } catch {
-    // Migrations may partially fail on first run, non-fatal
-  }
+  await runMigrations(ip, sshKeyPath, projectName);
+  // Reload PostgREST schema cache so it sees newly created tables. The old
+  // `docker compose exec rest kill -s SIGUSR1 1` never worked — the
+  // postgrest/postgrest image has no `kill` binary ("exec: kill: executable
+  // file not found in $PATH"), so the reload silently no-op'd and fresh tables
+  // stayed invisible (PGRST205) until rest happened to restart. RCA prod-1
+  // 2026-05-26. Use the canonical SQL NOTIFY on the pgrst channel instead
+  // (db-channel-enabled defaults on); fall back to restarting rest if NOTIFY
+  // doesn't land. Best-effort: a missed reload self-heals on the next deploy.
+  await sshRunAsync(
+    ip,
+    sshKeyPath,
+    `cd ${remoteDir} && ` +
+      `docker compose exec -T db psql -U postgres -d postgres -c "NOTIFY pgrst, 'reload schema'" 2>/dev/null || ` +
+      `docker compose restart rest 2>/dev/null || true`,
+  );
 
   return {
     success: true,