vibecarbon 0.1.7 → 0.2.1

package/src/add.js

@@ -1,10 +1,13 @@
 /**
  * Vibecarbon Add Command
  *
- * Adds optional services to an existing Vibecarbon project. Services
- * are fetched from GitHub at runtime so users always get the latest
- * templates regardless of their CLI version. -offline falls back to
- * bundled templates for air-gapped environments.
+ * Adds optional services to an existing Vibecarbon project. Service
+ * bundles ship with the CLI and are installed from the packaged
+ * `services/` directory by default — the same way `create` scaffolds
+ * from the packaged `carbon/` template, so an `add` is version-pinned
+ * and works offline. `-online` opts into fetching the latest bundles
+ * from GitHub (single-file assets only; directory assets such as `k8s/`
+ * still come from the packaged copy).
  *
  * Interactive-by-default: bare `vibecarbon add` prompts for a feature
  * to add. Positional features (`vibecarbon add observability redis`)
@@ -53,7 +56,9 @@ const GITHUB_BRANCH = 'main';
 const GITHUB_RAW_BASE = `https://raw.githubusercontent.com/${GITHUB_REPO}/${GITHUB_BRANCH}`;
 const SERVICES_PATH = 'services';
 
-// Local services directory (for --offline mode and development)
+// Packaged services directory — the default install source (shipped in the
+// npm package `files`, alongside `carbon/`). `-online` overrides this to fetch
+// from GitHub.
 const LOCAL_SERVICES_DIR = join(__dirname, '..', SERVICES_PATH);
 
 // Template variable placeholders
@@ -92,7 +97,7 @@ function buildSpec() {
     summary: 'Add a feature to a Vibecarbon project',
     description: [
       'Available features:',
-      ...LOCAL_FEATURES.map((f) => `  ${f.name.padEnd(16)} ${f.description}`),
+      ...AVAILABLE_FEATURES.map((f) => `  ${f.name.padEnd(16)} ${f.description}`),
       '',
       'External services (CI/CD, Stripe, OAuth, etc.) live in `vibecarbon configure`.',
     ].join('\n'),
@@ -109,9 +114,9 @@ function buildSpec() {
       { name: 'v', boolean: true, description: 'Show version' },
       { name: 'y', boolean: true, description: 'Skip confirmation prompts' },
       {
-        name: 'offline',
+        name: 'online',
         boolean: true,
-        description: 'Use bundled templates (for air-gapped environments)',
+        description: 'Fetch the latest bundles from GitHub instead of the packaged copy',
       },
     ],
     examples: [
@@ -227,9 +232,13 @@ async function installServiceDirectory(serviceName, srcDir, destDir, variables,
       }
     }
   } else {
-    // For online mode, the manifest should list all files
-    // We'll handle this in the main install function
-    throw new Error('Directory installation requires file listing in manifest');
+    // Online mode can't enumerate a remote directory (GitHub raw has no
+    // listing and we don't hit the contents API). Directory assets such as
+    // `k8s/` therefore only install from the packaged copy.
+    throw new Error(
+      `Cannot fetch directory "${srcDir}" over -online (remote directory listing is not supported). ` +
+        'Drop -online to install this feature from the packaged template.',
+    );
   }
 }
 
@@ -290,88 +299,27 @@ function removeFromBaseKustomization(kustomizationEntry) {
   writeFileSync(kustomizationPath, content);
 }
 
-// ============================================================================
-// SPECIALIZED FEATURE HANDLERS
-// ============================================================================
-
-// Features with specialized handlers (not manifest-based). CI/CD used to be
-// here too; it moved to `vibecarbon configure` (CI/CD is an external service,
-// not a local container, so it lives with the other configure features).
-const SPECIALIZED_FEATURES = ['observability'];
-
-async function handleSpecializedFeature(featureName, options) {
-  const { project } = options;
-
-  switch (featureName) {
-    case 'observability': {
-      return handleObservabilityFeature(project);
-    }
-
-    default:
-      throw new Error(`Unknown specialized feature: ${featureName}`);
-  }
-}
-
-/**
- * Enable observability stack (Prometheus, Grafana, Loki)
- * Files are already included in the project - this just enables them
- */
-async function handleObservabilityFeature(_project) {
-  const manifest = loadManifest();
-
-  // Check if already enabled
-  if (manifest.services?.observability) {
-    p.log.info('Observability is already enabled.');
-    return true;
-  }
-
-  // Check that the observability compose file exists
-  const observabilityCompose = join(process.cwd(), 'docker-compose.observability.yml');
-  if (!existsSync(observabilityCompose)) {
-    p.log.error('Observability files not found. Please ensure your project is up to date.');
-    return false;
-  }
-
-  const s = p.spinner();
-  s.start('Enabling observability stack');
-
-  // Set env flags for dashboard visibility (client + server)
-  setEnvVar('VITE_OBSERVABILITY_ENABLED', 'true');
-  setEnvVar('OBSERVABILITY_ENABLED', 'true');
-
-  // Update manifest
-  if (!manifest.services) manifest.services = {};
-  manifest.services.observability = { addedAt: new Date().toISOString() };
-  saveManifest(manifest);
-
-  s.stop('Observability enabled');
-
-  p.note(
-    [
-      'Observability stack enabled:',
-      `  ${c.info('Prometheus')}  http://prometheus.localhost`,
-      `  ${c.info('Grafana')}     http://grafana.localhost`,
-      `  ${c.info('Loki')}        http://loki.localhost`,
-    ].join('\n'),
-    'Observability',
-  );
-
-  return true;
-}
-
 // ============================================================================
 // ADD SERVICE
 // ============================================================================
 
 async function addService(serviceName, options) {
   const { project } = options;
-  let { offline } = options;
 
-  // Check if this is a specialized feature with a custom handler
-  if (SPECIALIZED_FEATURES.includes(serviceName)) {
-    return handleSpecializedFeature(serviceName, options);
+  // Parked features ship in `services/` but are turned off for this release.
+  // Refuse here — before any manifest fetch — so `add <parked>` can't install
+  // something we've hidden from the offering. `remove` is intentionally not
+  // guarded, so an existing install can still be cleaned up.
+  if (isParked(serviceName)) {
+    p.log.warn(`"${serviceName}" is not available in this release.`);
+    return false;
   }
 
+  // Default install source is the packaged `services/` dir (mirrors how
+  // `create` uses the packaged `carbon/` template). `-online` opts into the
+  // GitHub fetch; on network failure we fall back to the packaged copy below.
+  let offline = !options.online;
+
   let manifest;
   try {
     manifest = await fetchServiceManifest(serviceName, offline);
@@ -528,11 +476,18 @@ async function addService(serviceName, options) {
 // LIST SERVICES
 // ============================================================================
 
-// Features that work locally without external dependencies
+// Features that work locally without external dependencies.
+//
+// `status: 'parked'` turns a feature off for this release: it's hidden from the
+// offering (help body + interactive prompt) and `add` refuses to install it,
+// but its packaged bundle under `services/` stays in place so un-parking is a
+// one-line flip. Existing installs can still be `vibecarbon remove`d. Broad
+// add-on discovery will move to a marketplace later — this list is not the
+// permanent catalog.
 const LOCAL_FEATURES = [
   { name: 'observability', description: 'Prometheus, Grafana, Loki monitoring stack' },
-  { name: 'n8n', description: 'Workflow automation platform' },
-  { name: 'metabase', description: 'Business intelligence and analytics' },
+  { name: 'n8n', description: 'Workflow automation platform', status: 'parked' },
+  { name: 'metabase', description: 'Business intelligence and analytics', status: 'parked' },
   { name: 'redis', description: 'In-memory cache and session store' },
 ];
 
@@ -542,6 +497,19 @@ const LOCAL_FEATURES = [
 
 const ALL_FEATURES = [...LOCAL_FEATURES];
 
+// Features actually offered to users. Parked features are excluded from the
+// help body and the interactive prompt, but remain in ALL_FEATURES so typo
+// suggestions and the parked guard can still resolve their names.
+const AVAILABLE_FEATURES = LOCAL_FEATURES.filter((f) => f.status !== 'parked');
+
+/**
+ * Whether a feature ships but is turned off for this release.
+ * @param {string} name
+ */
+function isParked(name) {
+  return LOCAL_FEATURES.some((f) => f.name === name && f.status === 'parked');
+}
+
 /**
  * Calculate Levenshtein distance between two strings
  */
@@ -652,7 +620,7 @@ async function main(cliArgs) {
   if (services.length === 0) {
     const choice = await p.select({
       message: 'Which feature do you want to add?',
-      options: LOCAL_FEATURES.map((f) => ({
+      options: AVAILABLE_FEATURES.map((f) => ({
         value: f.name,
         label: f.name,
         hint: f.description,
@@ -668,7 +636,7 @@ async function main(cliArgs) {
   let success = true;
   for (const serviceName of services) {
     const result = await addService(serviceName, {
-      offline: !!values.offline,
+      online: !!values.online,
       project,
       cliArgs: cliArgs, // Pass raw CLI args for infrastructure services
     });

package/src/cli.js

@@ -95,7 +95,7 @@ ${c.bold('DEV COMMANDS')}
   ${c.info('down')}                     Stop local development environment
   ${c.info('status')}                   Show project and deployment status
   ${c.info('reset')}                    Reset local environment (removes all data)
-  ${c.info('add')} [feature]            Add features (cicd, observability, n8n, metabase, redis)
+  ${c.info('add')} [feature]            Add features (observability, redis)
   ${c.info('remove')} [feature]         Remove features from a project
   ${c.info('configure')}                Configure external services (billing, OAuth, SMTP, etc.)
   ${c.info('upgrade')}                  Upgrade infrastructure files to latest template

package/src/create.js

@@ -188,8 +188,8 @@ const SPEC = {
       description: 'non-interactive (CI/CD)',
     },
     {
-      command: 'vibecarbon create my-saas -git -install',
-      description: 'create + initialize git + run pm install',
+      command: 'vibecarbon create my-saas -install',
+      description: 'create + run pm install (git is initialized automatically)',
     },
   ],
 };
@@ -697,13 +697,6 @@ async function bootstrap(cliArgs) {
     'volumes/kong',
     'volumes/db',
     'volumes/traefik',
-    'volumes/prometheus',
-    'volumes/loki',
-    'volumes/promtail',
-    'volumes/grafana/provisioning/dashboards',
-    'volumes/grafana/provisioning/datasources',
-    'volumes/grafana/dashboards',
-    'volumes/grafana/dashboards.dev',
     '.github/workflows',
     'k8s/base/app',
     'k8s/base/backup',
@@ -758,21 +751,11 @@ async function bootstrap(cliArgs) {
   copyTemplate('.dockerignore', join(projectDir, '.dockerignore'), variables);
   copyTemplate('docker-compose.yml', join(projectDir, 'docker-compose.yml'), variables);
   copyTemplate('docker-compose.prod.yml', join(projectDir, 'docker-compose.prod.yml'), variables);
-  copyTemplate(
-    'docker-compose.observability.yml',
-    join(projectDir, 'docker-compose.observability.yml'),
-    variables,
-  );
   copyTemplate(
     'docker-compose.override.yml',
     join(projectDir, 'docker-compose.override.yml'),
     variables,
   );
-  copyTemplate(
-    'docker-compose.observability.override.yml',
-    join(projectDir, 'docker-compose.observability.override.yml'),
-    variables,
-  );
   copyTemplate('PRODUCTION.md', join(projectDir, 'PRODUCTION.md'), variables);
   copyTemplate('DEVELOPMENT.md', join(projectDir, 'DEVELOPMENT.md'), variables);
   copyTemplate(
@@ -780,11 +763,6 @@ async function bootstrap(cliArgs) {
     join(projectDir, 'docker-compose.dev-init.yml'),
     variables,
   );
-  copyTemplate(
-    'docker-compose.observability.prod.yml',
-    join(projectDir, 'docker-compose.observability.prod.yml'),
-    variables,
-  );
   chmodSync(join(projectDir, 'docker-entrypoint.sh'), 0o755);
 
   await tick();
@@ -802,6 +780,16 @@ async function bootstrap(cliArgs) {
     join(projectDir, 'volumes/db/set-passwords.sh'),
     variables,
   );
+  // wal-archive.sh is postgres's archive_command. It was missing from this copy
+  // list, so scaffolds shipped no source file — Docker then bind-mounted an
+  // empty DIRECTORY at /etc/postgresql/wal-archive.sh and postgres failed
+  // archiving with exit 126 ("is a directory"), re-pinning WAL. Copy it (the
+  // chmod block below makes it +x; the script has only shell $vars, no {{}}).
+  copyTemplate(
+    'volumes/db/wal-archive.sh',
+    join(projectDir, 'volumes/db/wal-archive.sh'),
+    variables,
+  );
   copyTemplate('volumes/db/jwt.sql', join(projectDir, 'volumes/db/jwt.sql'), variables);
   copyTemplate('volumes/db/realtime.sql', join(projectDir, 'volumes/db/realtime.sql'), variables);
   copyTemplate(
@@ -830,68 +818,6 @@ async function bootstrap(cliArgs) {
     variables,
   );
 
-  // Observability config files (used by deploy --observability)
-  copyTemplate(
-    'volumes/prometheus/prometheus.yml',
-    join(projectDir, 'volumes/prometheus/prometheus.yml'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/loki/loki-config.yml',
-    join(projectDir, 'volumes/loki/loki-config.yml'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/promtail/promtail-config.yml',
-    join(projectDir, 'volumes/promtail/promtail-config.yml'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/provisioning/dashboards/dashboards.yml',
-    join(projectDir, 'volumes/grafana/provisioning/dashboards/dashboards.yml'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/provisioning/dashboards/dashboards.dev.yml',
-    join(projectDir, 'volumes/grafana/provisioning/dashboards/dashboards.dev.yml'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/provisioning/datasources/datasources.yml',
-    join(projectDir, 'volumes/grafana/provisioning/datasources/datasources.yml'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/dashboards/logs.json',
-    join(projectDir, 'volumes/grafana/dashboards/logs.json'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/dashboards/overview.json',
-    join(projectDir, 'volumes/grafana/dashboards/overview.json'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/dashboards/postgresql.json',
-    join(projectDir, 'volumes/grafana/dashboards/postgresql.json'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/dashboards.dev/logs.json',
-    join(projectDir, 'volumes/grafana/dashboards.dev/logs.json'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/dashboards.dev/overview.json',
-    join(projectDir, 'volumes/grafana/dashboards.dev/overview.json'),
-    variables,
-  );
-  copyTemplate(
-    'volumes/grafana/dashboards.dev/postgresql.json',
-    join(projectDir, 'volumes/grafana/dashboards.dev/postgresql.json'),
-    variables,
-  );
-
   copyTemplate('backup/backup.sh', join(projectDir, 'backup/backup.sh'), variables);
   copyTemplate('backup/compose-backup.sh', join(projectDir, 'backup/compose-backup.sh'), variables);
   copyTemplate('backup/Dockerfile', join(projectDir, 'backup/Dockerfile'), variables);
@@ -938,6 +864,11 @@ async function bootstrap(cliArgs) {
     'docker-entrypoint.sh',
     'volumes/kong/docker-entrypoint.sh',
     'volumes/db/set-passwords.sh',
+    // Postgres execs this directly as its archive_command, so it MUST be +x.
+    // copyTemplate (copyFileSync) drops the source's exec bit, and omitting it
+    // here shipped a 0644 script → archive_command failed with exit 126 ("not
+    // executable") → WAL pinned → disk-fill risk the wrapper exists to prevent.
+    'volumes/db/wal-archive.sh',
   ];
   for (const script of shellScripts) {
     const scriptPath = join(projectDir, script);
@@ -1180,7 +1111,7 @@ fi
 # Runs lint + unit + component + integration tests.
 #
 # No-ops gracefully if node_modules isn't present yet — a fresh
-# \`vibecarbon create -git\` lands you on a commit that's pushable
+# \`vibecarbon create\` lands you on a commit that's pushable
 # before you've run \`pnpm install\`. Once deps land the hook gates
 # every subsequent push. Bypass at will with \`git push --no-verify\`.
 

package/src/destroy.js

@@ -693,7 +693,29 @@ async function handleBackupBucket(envConfig, projectConfig, args, spinner) {
     }
     const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, region);
     try {
-      const result = await s3Provider.emptyAndDeleteBucket(bucketName);
+      // Bound the purge so a slow/contended S3 endpoint can't consume the whole
+      // destroy budget. The Hetzner resources are already freed (Pulumi destroy
+      // ran before this), but a single S3 op can hang up to ~9 min under the
+      // SDK (maxAttempts 3 × 60s requestTimeout) × _send (maxAttempts 3) retry
+      // layers — observed on k8s teardown, where the storage bucket doubles as
+      // the Pulumi state backend (slow/contended), blowing the 600s
+      // final-destroy timeout and getting the whole step SIGKILLed. On timeout
+      // we leave the bucket for the orphan sweep / next destroy rather than hang.
+      const PURGE_TIMEOUT_MS = 180_000;
+      const result = await Promise.race([
+        s3Provider.emptyAndDeleteBucket(bucketName),
+        new Promise((_, reject) =>
+          setTimeout(
+            () =>
+              reject(
+                new Error(
+                  `backup bucket purge exceeded ${PURGE_TIMEOUT_MS / 1000}s — left for the orphan sweep / a retried destroy`,
+                ),
+              ),
+            PURGE_TIMEOUT_MS,
+          ),
+        ),
+      ]);
       spinner.stop(
         result.deleted
           ? result.objectsRemoved > 0

package/src/lib/deploy/bundle.js

@@ -96,7 +96,9 @@ function composeFileFlags(options = {}) {
   if (options.metabase) {
     files.push('-f', 'docker-compose.metabase.yml', '-f', 'docker-compose.metabase.prod.yml');
   }
-  if (options.redis) files.push('-f', 'docker-compose.redis.yml');
+  if (options.redis) {
+    files.push('-f', 'docker-compose.redis.yml', '-f', 'docker-compose.redis.prod.yml');
+  }
   return files.join(' ');
 }
 
@@ -126,7 +128,7 @@ export function renderBundle(projectName, options = {}) {
   if (options.metabase) {
     rootFiles.push('docker-compose.metabase.yml', 'docker-compose.metabase.prod.yml');
   }
-  if (options.redis) rootFiles.push('docker-compose.redis.yml');
+  if (options.redis) rootFiles.push('docker-compose.redis.yml', 'docker-compose.redis.prod.yml');
 
   for (const file of rootFiles) {
     const src = join(cwd, file);

package/src/lib/deploy/compose/ha.js

@@ -1043,15 +1043,18 @@ export async function deployComposeHA(options) {
     ]),
   );
 
-  // Run migrations on primary only
+  // Run migrations on primary only. Let failures propagate — silently shipping
+  // an empty/partial schema is far worse than a visibly-failed deploy the
+  // operator can retry. The old swallowing try/catch ("non-fatal") masked
+  // exactly that: HA could deploy a schema-less DB that 500s on every DB-backed
+  // route with no error surfaced. runMigrations now waits for supabase_admin AND
+  // the storage schema (storage.buckets.public) before applying with
+  // ON_ERROR_STOP=1, so the first-run races that motivated the swallow are gone
+  // and a failure here is a real one that must abort the deploy.
   onProgress('Running database migrations on primary...');
-  try {
-    await perfAsync('deploy.ha.compose.migrations', () =>
-      runMigrations(primaryIp, sshKeyPath, projectName),
-    );
-  } catch {
-    // Migrations may partially fail on first run, non-fatal
-  }
+  await perfAsync('deploy.ha.compose.migrations', () =>
+    runMigrations(primaryIp, sshKeyPath, projectName),
+  );
 
   // Create admin user in production Supabase (same as single-server deploy)
   onProgress('Creating admin user...');

package/src/lib/deploy/compose/index.js

@@ -493,7 +493,9 @@ function composeFileFlags(options = {}) {
   if (options.metabase) {
     files.push('-f', 'docker-compose.metabase.yml', '-f', 'docker-compose.metabase.prod.yml');
   }
-  if (options.redis) files.push('-f', 'docker-compose.redis.yml');
+  if (options.redis) {
+    files.push('-f', 'docker-compose.redis.yml', '-f', 'docker-compose.redis.prod.yml');
+  }
   return files.join(' ');
 }
 
@@ -756,6 +758,27 @@ export async function runMigrations(ip, sshKeyPath, projectName) {
     { timeout: 240_000 },
   );
 
+  // Also wait for the storage service to finish ITS first-boot migrations
+  // before applying app migrations. supabase-storage adds columns to the
+  // `storage` schema on startup (notably storage.buckets.public); our
+  // 00001_init.sql seeds buckets referencing them. Racing ahead fails with
+  // `column "public" of relation "buckets" does not exist`, which aborts the
+  // whole migration — the core public.* tables get created first, but the
+  // deploy still fails (deployComposeHA only ever masked this by swallowing the
+  // error in a try/catch). The supabase_admin gate above is insufficient: that
+  // role exists before storage has migrated. Gate on storage.buckets.public
+  // being queryable as the proxy for "storage migrations done", polling ~3 min.
+  await sshRunAsync(
+    ip,
+    sshKeyPath,
+    `cd ${remoteDir} && ` +
+      `for i in $(seq 1 60); do ` +
+      `docker compose exec -T db psql -U supabase_admin -d postgres -c 'SELECT public FROM storage.buckets LIMIT 0' >/dev/null 2>&1 && exit 0; ` +
+      `echo "[migrate] waiting for storage schema (buckets.public) to be ready (attempt $i/60)"; sleep 3; ` +
+      `done; echo "[migrate] storage schema never became ready" >&2; exit 1`,
+    { timeout: 240_000 },
+  );
+
   // Apply each migration with ON_ERROR_STOP=1 and abort on the first failure.
   // A failed migration MUST fail the deploy — silently shipping an empty schema
   // is far worse than a deploy the operator can see failed and retry. Errors
@@ -771,6 +794,25 @@ export async function runMigrations(ip, sshKeyPath, projectName) {
       `done`,
     { timeout: 300_000 },
   );
+
+  // Reload PostgREST schema cache so it sees newly created tables. The old
+  // `docker compose exec rest kill -s SIGUSR1 1` never worked — the
+  // postgrest/postgrest image has no `kill` binary ("exec: kill: executable
+  // file not found in $PATH"), so the reload silently no-op'd and fresh tables
+  // stayed invisible (PGRST205) until rest happened to restart. RCA prod-1
+  // 2026-05-26. Use the canonical SQL NOTIFY on the pgrst channel instead
+  // (db-channel-enabled defaults on); fall back to restarting rest if NOTIFY
+  // doesn't land. Best-effort: a missed reload self-heals on the next deploy.
+  // Lives here (not just in deployCompose) so every caller — deployCompose,
+  // deployComposeHA, and the orchestrator's inline single-compose path — gets
+  // a queryable schema instead of PGRST205.
+  await sshRunAsync(
+    ip,
+    sshKeyPath,
+    `cd ${remoteDir} && ` +
+      `docker compose exec -T db psql -U postgres -d postgres -c "NOTIFY pgrst, 'reload schema'" 2>/dev/null || ` +
+      `docker compose restart rest 2>/dev/null || true`,
+  );
 }
 
 /**
@@ -837,23 +879,9 @@ export async function deployCompose(options) {
   // swallowing it (RCA prod-1 2026-05-26: the previous blanket try/catch hid a
   // fully-failed migration and shipped a schema-less prod that reported success).
   onProgress('Running database migrations...');
-  const remoteDir = `/opt/${projectName}`;
+  // runMigrations applies supabase/migrations/* AND reloads PostgREST's schema
+  // cache, so the new tables are immediately queryable (no PGRST205).
   await runMigrations(ip, sshKeyPath, projectName);
-  // Reload PostgREST schema cache so it sees newly created tables. The old
-  // `docker compose exec rest kill -s SIGUSR1 1` never worked — the
-  // postgrest/postgrest image has no `kill` binary ("exec: kill: executable
-  // file not found in $PATH"), so the reload silently no-op'd and fresh tables
-  // stayed invisible (PGRST205) until rest happened to restart. RCA prod-1
-  // 2026-05-26. Use the canonical SQL NOTIFY on the pgrst channel instead
-  // (db-channel-enabled defaults on); fall back to restarting rest if NOTIFY
-  // doesn't land. Best-effort: a missed reload self-heals on the next deploy.
-  await sshRunAsync(
-    ip,
-    sshKeyPath,
-    `cd ${remoteDir} && ` +
-      `docker compose exec -T db psql -U postgres -d postgres -c "NOTIFY pgrst, 'reload schema'" 2>/dev/null || ` +
-      `docker compose restart rest 2>/dev/null || true`,
-  );
 
   return {
     success: true,

package/src/lib/deploy/image.js

@@ -92,11 +92,11 @@ export function inspectGitState(cwd) {
  * pod (Phase 1 wired the registries.yaml; Phase 6 wires the push).
  *
  * @param {string} projectDir - Project root with the Dockerfile.
- * @param {{projectName: string, timestamp?: string, rebuild?: boolean, tagPrefix?: string}} options
+ * @param {{projectName: string, timestamp?: string, rebuild?: boolean, tagPrefix?: string, buildArgs?: Record<string,string>}} options
  * @returns {{tag: string, gitSha: string, isDirty: boolean}}
  */
 export function buildLocalImage(projectDir, options) {
-  const { projectName, rebuild = false, tagPrefix } = options;
+  const { projectName, rebuild = false, tagPrefix, buildArgs = {} } = options;
   if (!projectName) {
     throw new Error('buildLocalImage: projectName is required');
   }
@@ -112,6 +112,14 @@ export function buildLocalImage(projectDir, options) {
 
   const args = ['build'];
   if (rebuild) args.push('--no-cache');
+  // Vite inlines import.meta.env.VITE_* at build time, so the browser bundle
+  // bakes whatever these ARGs resolve to. Without passing them the bundle ships
+  // empty VITE_SUPABASE_* and crashes at page load with "Missing Supabase
+  // environment variables" — k8s shipped exactly this because buildAppImage
+  // passed no build args (compose plumbs them via collectComposeBuildArgs).
+  for (const [k, v] of Object.entries(buildArgs)) {
+    if (v !== undefined && v !== null && v !== '') args.push('--build-arg', `${k}=${v}`);
+  }
   args.push('-t', tag, projectDir);
 
   execFileSync('docker', args, { stdio: 'inherit' });

package/src/lib/deploy/k8s/k3s.js

@@ -556,9 +556,25 @@ export function loadEnvLocal(envPath) {
  * @param {boolean} [rebuild]
  * @returns {Promise<{tag: string, gitSha: string, isDirty: boolean}>}
  */
-export async function buildAppImage(projectDir, projectName, rebuild = false) {
+export async function buildAppImage(projectDir, projectName, rebuild = false, domain = undefined) {
   const { buildLocalImage } = await import('../image.js');
-  return buildLocalImage(projectDir, { projectName, rebuild, tagPrefix: '10.0.1.1:5000' });
+  // App image: collect VITE_* build args (incl. VITE_SUPABASE_URL rewritten to
+  // https://api.<domain>) so the browser bundle ships with real config instead
+  // of empty strings. buildLocalImage previously passed NO build args, so the
+  // k8s SPA crashed on load with "Missing Supabase environment variables" —
+  // compose plumbs these via collectComposeBuildArgs, k8s did not. The backup
+  // image build (no frontend) calls this without a domain → no VITE args.
+  let buildArgs = {};
+  if (domain) {
+    const { collectComposeBuildArgs } = await import('../compose/build-args.js');
+    buildArgs = collectComposeBuildArgs(projectDir, { projectName, domain });
+  }
+  return buildLocalImage(projectDir, {
+    projectName,
+    rebuild,
+    tagPrefix: '10.0.1.1:5000',
+    buildArgs,
+  });
 }
 
 /**
@@ -2436,11 +2452,14 @@ export async function deployK3s(options) {
   }
 
   // 6. Build the app image locally
-  const buildInputs = { projectName: options.projectName };
+  // domain is part of the cache key + passed to the build: it's baked into the
+  // browser bundle (VITE_SUPABASE_URL=https://api.<domain>), so a domain change
+  // must force a rebuild rather than serving a stale-domain bundle.
+  const buildInputs = { projectName: options.projectName, domain: options.domain };
   if (!state.shouldSkip('k3s-build', buildInputs)) {
     state.startStep('k3s-build', buildInputs);
     s.start('Building app image (10.0.1.1:5000/...)');
-    const built = await buildAppImage(projectDir, options.projectName);
+    const built = await buildAppImage(projectDir, options.projectName, false, options.domain);
     state.completeStep('k3s-build', {
       tag: built.tag,
       gitSha: built.gitSha,