vibecarbon 0.6.0 → 0.7.0

package/carbon/package.json

@@ -39,7 +39,7 @@
     "docker:reset:all": "node scripts/docker-down.js -v --rmi --all",
     "docker:prod:up": "node scripts/docker-up.js --prod",
     "docker:prod:down": "node scripts/docker-down.js --prod",
-    "db:migrate": "docker compose exec db bash -c 'for f in /migrations/*.sql; do psql -U postgres -d postgres -f \"$f\" || exit 1; done' && docker compose exec db psql -U postgres -d postgres -f /tmp/super-admin.sql",
+    "db:migrate": "node scripts/db-migrate.js",
     "db:reset": "node scripts/docker-down.js -v && node scripts/docker-up.js",
     "k8s:apply": "node scripts/k8s-apply.js",
     "k8s:delete": "node scripts/k8s-delete.js",
@@ -59,7 +59,7 @@
     "@mdx-js/react": "^3.1.1",
     "@mdx-js/rollup": "^3.1.1",
     "@scalar/api-reference-react": "^0.9.49",
-    "@supabase/supabase-js": "^2.106.2",
+    "@supabase/supabase-js": "^2.108.2",
     "@tanstack/react-query": "^5.100.14",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -75,7 +75,7 @@
     "lenis": "^1.3.25",
     "lucide-react": "^1.17.0",
     "next-themes": "^0.4.6",
-    "nodemailer": "^8.0.10",
+    "nodemailer": "^9.0.1",
     "pino": "^10.3.1",
     "react": "^19.2.7",
     "react-day-picker": "^10.0.1",

package/carbon/scripts/db-migrate.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * Quiet database migration runner for local dev (`pnpm db:migrate`).
+ *
+ * Applies every /migrations/*.sql (lexical order) then /tmp/super-admin.sql
+ * inside the running `db` compose service. psql runs with notices suppressed
+ * (client_min_messages=warning), command tags silenced (-q), and stdout
+ * discarded (>/dev/null), so a normal idempotent re-run prints ~one line per
+ * file instead of ~200. Real WARNING/ERROR text is preserved on stderr and the
+ * first error aborts the run (ON_ERROR_STOP + set -e).
+ */
+import { spawnSync } from 'node:child_process';
+
+/** The bash program run inside the db container. Exported for unit testing. */
+export function buildMigrateScript() {
+  // Single quiet psql invocation, parameterised by the shell var "$f" / a path.
+  const psql = (file) =>
+    `PGOPTIONS="-c client_min_messages=warning" ` +
+    `psql -U postgres -d postgres -v ON_ERROR_STOP=1 -q -f ${file} >/dev/null`;
+
+  return [
+    'set -e',
+    'for f in /migrations/*.sql; do',
+    `  ${psql('"$f"')}`,
+    '  echo "  ✓ $(basename "$f")"',
+    'done',
+    psql('/tmp/super-admin.sql'),
+    'echo "  ✓ super-admin"',
+  ].join('\n');
+}
+
+function main() {
+  console.log('Running database migrations…');
+  const res = spawnSync(
+    'docker',
+    ['compose', 'exec', '-T', 'db', 'bash', '-c', buildMigrateScript()],
+    { stdio: 'inherit' },
+  );
+  if (res.error) {
+    console.error(res.error.message);
+    process.exit(1);
+  }
+  process.exit(res.status ?? 0);
+}
+
+// Run only when invoked directly, not when imported by the test.
+if (process.argv[1] && process.argv[1].endsWith('db-migrate.js')) {
+  main();
+}

package/carbon/scripts/dev-init.js

@@ -95,6 +95,10 @@ ADMIN_PASSWORD="${DEV.ADMIN_PASSWORD}"
 # Site URL (base port — offset applied dynamically, see above)
 SITE_URL="http://localhost:5173"
 
+# Public URL — substituted into index.html's og:/twitter: meta tags by Vite's
+# %VITE_PUBLIC_URL% replacement. Must be defined or Vite warns on every reload.
+VITE_PUBLIC_URL="http://localhost:5173"
+
 # OAuth (disabled for dev)
 GOOGLE_ENABLED="false"
 GOOGLE_CLIENT_ID=""

package/carbon/scripts/dev.js

@@ -109,22 +109,53 @@ if (conflicts.length > 0) {
   process.exit(1);
 }
 
-console.log(`
-  ${cyan('✦')}  Starting ${projectName} services...
+// The service-URL banner is printed *after* both dev servers are listening (see
+// announceWhenReady below) rather than up-front. Otherwise Vite's "ready in Xms"
+// and the API's startup logs print afterward and scroll the URLs off-screen.
+function printBanner() {
+  console.log(`
+  ${cyan('✦')}  ${bold(projectName)} is ready
 
   ${cyan('→')}  ${bold('Frontend:')}  ${cyan(`http://localhost:${ports.vite}`)}
   ${cyan('→')}  ${bold('API:')}       ${cyan(`http://localhost:${ports.api}`)}
-  ${cyan('→')}  ${bold('Studio:')}    ${cyan('http://studio.localhost')} (requires login)
-  ${cyan('→')}  ${bold('Traefik:')}   ${cyan('http://traefik.localhost')} (requires login)
+  ${cyan('→')}  ${bold('Studio:')}    ${cyan('http://studio.localhost')} (no auth in dev)
+  ${cyan('→')}  ${bold('Traefik:')}   ${cyan('http://traefik.localhost')} (no auth in dev)
 `);
+}
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// Poll until both dev servers hold their ports (i.e. are listening), then print
+// the URL banner so it lands as the last thing on screen. We watch the ports
+// instead of piping child stdout because `stdio: 'inherit'` keeps Vite's TTY
+// (colours + interactive `h+enter` shortcuts); piping would forfeit both.
+async function announceWhenReady() {
+  const deadline = Date.now() + 30_000; // print anyway after 30s, don't hang
+  while (Date.now() < deadline) {
+    if (shuttingDown) return;
+    const free = await Promise.all([isPortFree(ports.vite), isPortFree(ports.api)]);
+    if (free.every((isFree) => !isFree)) break; // both ports in use → listening
+    await delay(200);
+  }
+  if (shuttingDown) return;
+  // Let the servers' own "ready"/"Starting server" lines flush first.
+  await delay(400);
+  if (!shuttingDown) printBanner();
+}
 
 const children = [];
 
+// pnpm exports its own config as npm_config_* env vars; the nested `npx`
+// (real npm) then warns "Unknown env config …". Silence npm's own warnings
+// for these dev tool processes — tsx/vite write their own logs, not via npm.
+const childEnv = { ...process.env, npm_config_loglevel: 'error' };
+
 // Spawn server process with its own process group for clean shutdown
 const server = spawn('npx', ['tsx', 'watch', '--env-file=.env.local', 'src/server/index.ts'], {
   stdio: 'inherit',
   shell: isWindows,
   detached: !isWindows, // Create process group on Unix for clean group kill
+  env: childEnv,
 });
 children.push(server);
 
@@ -133,12 +164,16 @@ const client = spawn('npx', ['vite'], {
   stdio: 'inherit',
   shell: isWindows,
   detached: !isWindows,
+  env: childEnv,
 });
 children.push(client);
 
 // Track if we're shutting down
 let shuttingDown = false;
 
+// Print the URL banner once both servers are up (fire-and-forget).
+announceWhenReady();
+
 function shutdown(exitCode = 0) {
   if (shuttingDown) return;
   shuttingDown = true;

package/carbon/scripts/lib/vite-log-filter.js

@@ -0,0 +1,29 @@
+// Matches ANSI SGR escape sequences (colour/style codes). In a TTY, Vite wraps
+// the banner labels in colour codes — and crucially places the reset *between*
+// the word and its colon (e.g. `bold("Local") + ":"` → "Local\x1b[22m:"), so the
+// raw line never contains the literal substring "Local:". We strip the escapes
+// before matching. Built from String.fromCharCode(27) rather than a control-char
+// regex literal, which Biome forbids.
+const ANSI_RE = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g');
+
+/**
+ * True when a Vite log line is the dev-server URL banner that our own dev.js
+ * banner already prints (so vite.config.ts's customLogger can drop it). Keeps
+ * the "ready in Xms" header, HMR/reload info, warnings, and errors.
+ *
+ * @param {unknown} msg
+ * @returns {boolean}
+ */
+export function isViteUrlBannerLine(msg) {
+  if (typeof msg !== 'string') return false;
+  // Strip colour codes so matches work the same in a TTY (coloured) and when
+  // piped/CI (plain). Vite splits labels and their colons into separate escape
+  // wrappers, so substring checks must run against the de-coloured text.
+  const plain = msg.replace(ANSI_RE, '');
+  const hasUrl = plain.includes('http://') || plain.includes('https://');
+  // Vite's startup banner: "➜  Local:  <url>" / "➜  Network: <url>".
+  if (hasUrl && (plain.includes('Local:') || plain.includes('Network:'))) return true;
+  // The interactive shortcuts hint printed right after the URLs.
+  if (plain.includes('press h + enter')) return true;
+  return false;
+}

package/carbon/src/client/locales/en.json

@@ -274,7 +274,7 @@
     "hero": {
       "badge": "Fully Automated · Self-Hosted",
       "headline1": "Professional Grade",
-      "subheading": "Full-stack SaaS architecture with auth, billing, infrastructure, and deployment — built for AI-driven development.",
+      "subheading": "Full-stack SaaS starter kit with automated everything — built for AI-driven development.",
       "getUpdates": "Get Updates"
     },
     "logoStrip": {

package/carbon/src/server/lib/env.ts

@@ -94,8 +94,19 @@ if (process.env.NODE_ENV !== 'production' && portOffset !== 0) {
   }
 }
 
+// Treat empty-string env vars as unset before validating. Docker Compose
+// `env_file` (and other env sources) surface an unset optional var as "" rather
+// than omitting it; zod's `.optional()` permits `undefined` but NOT "", so an
+// empty SMTP_ADMIN_EMAIL / REDIS_URL / SMTP_PORT would fail .email()/.url()/
+// .number() and crash boot with "Server configuration error". Stripping blanks
+// makes "" mean "not set", matching operator intent (and how the k8s Secret
+// path already skips empty values).
+const cleanedEnv = Object.fromEntries(
+  Object.entries(process.env).filter(([, value]) => value !== ''),
+);
+
 // Validate environment variables
-const parsed = envSchema.safeParse(process.env);
+const parsed = envSchema.safeParse(cleanedEnv);
 
 if (!parsed.success) {
   // In production, don't expose which specific environment variables failed validation

package/carbon/supabase/migrations/00001_init.sql

@@ -82,7 +82,8 @@ CREATE TABLE IF NOT EXISTS customers (
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_user_id ON customers(user_id) WHERE user_id IS NOT NULL;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_customers_organization_id ON customers(organization_id) WHERE organization_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS idx_customers_stripe_customer_id ON customers(stripe_customer_id);
+-- stripe_customer_id is UNIQUE (see column def), which already creates an index;
+-- a separate idx_ would be a duplicate.
 
 CREATE TABLE IF NOT EXISTS subscriptions (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -99,7 +100,8 @@ CREATE TABLE IF NOT EXISTS subscriptions (
 );
 
 CREATE INDEX IF NOT EXISTS idx_subscriptions_customer_id ON subscriptions(customer_id);
-CREATE INDEX IF NOT EXISTS idx_subscriptions_stripe_subscription_id ON subscriptions(stripe_subscription_id);
+-- stripe_subscription_id is UNIQUE (see column def), which already creates an
+-- index; a separate idx_ would be a duplicate.
 CREATE INDEX IF NOT EXISTS idx_subscriptions_status ON subscriptions(status);
 
 -- ============================================================================
@@ -132,6 +134,11 @@ CREATE INDEX IF NOT EXISTS idx_notifications_org
   ON notifications(organization_id)
   WHERE organization_id IS NOT NULL;
 
+-- Covering index for the created_by FK (avoids seq scans on auth.users deletes).
+CREATE INDEX IF NOT EXISTS idx_notifications_created_by
+  ON notifications(created_by)
+  WHERE created_by IS NOT NULL;
+
 CREATE TABLE IF NOT EXISTS notification_dismissals (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   notification_id UUID NOT NULL REFERENCES notifications(id) ON DELETE CASCADE,
@@ -167,6 +174,11 @@ CREATE TABLE IF NOT EXISTS app_settings (
   updated_at TIMESTAMPTZ DEFAULT NOW() NOT NULL
 );
 
+-- Covering index for the updated_by FK (avoids seq scans on auth.users deletes).
+CREATE INDEX IF NOT EXISTS idx_app_settings_updated_by
+  ON app_settings(updated_by)
+  WHERE updated_by IS NOT NULL;
+
 -- WARNING: This table is publicly readable by the anonymous role to support
 -- pre-authentication flows (e.g. checking if MFA is enforced).
 -- DO NOT STORE SECRETS, TOKENS, OR SENSITIVE ENVIRONMENT VARIABLES HERE.

package/carbon/supabase/migrations/00003_pg_cron.sql

@@ -48,6 +48,10 @@ CREATE OR REPLACE FUNCTION public.log_cron_job(
 RETURNS void
 LANGUAGE plpgsql
 SECURITY DEFINER
+-- Pin search_path so this SECURITY DEFINER function can't be hijacked by a
+-- malicious object in an attacker-controlled schema. All refs below are already
+-- schema-qualified (public.cron_job_history), so an empty path is safe.
+SET search_path = ''
 AS $$
 BEGIN
   INSERT INTO public.cron_job_history (job_name, status, finished_at, result, error)

package/carbon/supabase/migrations/00004_contact_newsletter.sql

@@ -52,7 +52,8 @@ CREATE TABLE IF NOT EXISTS public.newsletter_subscribers (
 );
 
 CREATE INDEX IF NOT EXISTS idx_newsletter_subscribers_status ON public.newsletter_subscribers (status);
-CREATE INDEX IF NOT EXISTS idx_newsletter_subscribers_email ON public.newsletter_subscribers (email);
+-- email is UNIQUE (see column def), which already creates an index; a separate
+-- idx_ would be a duplicate.
 
 ALTER TABLE public.newsletter_subscribers ENABLE ROW LEVEL SECURITY;
 

package/carbon/vite.config.ts

@@ -7,7 +7,8 @@ import rehypeSlug from 'rehype-slug';
 import remarkFrontmatter from 'remark-frontmatter';
 import remarkGfm from 'remark-gfm';
 import remarkMdxFrontmatter from 'remark-mdx-frontmatter';
-import { defineConfig, loadEnv } from 'vite';
+import { createLogger, defineConfig, loadEnv } from 'vite';
+import { isViteUrlBannerLine } from './scripts/lib/vite-log-filter.js';
 
 // Calculate ports based on offset and overrides
 function getPort(envVarName: string, defaultPort: number, offset: number): number {
@@ -36,7 +37,19 @@ export default defineConfig(({ mode }) => {
         }
       : {};
 
+  const logger = createLogger();
+  const baseInfo = logger.info.bind(logger);
+  // Our dev.js banner is the single source of truth for service URLs; drop
+  // Vite's redundant Local/Network/"press h" lines but keep readiness, HMR,
+  // warnings, and errors.
+  logger.info = (msg, options) => {
+    if (isViteUrlBannerLine(msg)) return;
+    baseInfo(msg, options);
+  };
+
   return {
+    customLogger: logger,
+
     plugins: [
       mdx({
         remarkPlugins: [remarkFrontmatter, remarkGfm, remarkMdxFrontmatter],

package/carbon/volumes/db/super-admin.dev.sql

@@ -8,7 +8,11 @@ DECLARE
   new_user_id UUID;
 BEGIN
   -- Only create if admin email is provided and not empty
-  IF admin_email IS NOT NULL AND admin_email != '' THEN
+  -- Skip when the email is still an unreplaced "{{ADMIN_EMAIL}}" template token
+  -- (e.g. the raw dev template mounted at /tmp/super-admin.sql): the existence
+  -- check could never match, so it would always attempt a duplicate INSERT and
+  -- collide on UNIQUE(phone) with the admin created at container init.
+  IF admin_email IS NOT NULL AND admin_email != '' AND admin_email NOT LIKE '{{%' THEN
 
     -- Check if user already exists
     IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN

package/carbon/volumes/db/super-admin.sql

@@ -9,7 +9,10 @@ DECLARE
   new_user_id UUID;
 BEGIN
   -- Only create if admin email is provided and not empty
-  IF admin_email IS NOT NULL AND admin_email != '' THEN
+  -- Skip when the email is still an unreplaced "{{ADMIN_EMAIL}}" template token:
+  -- the existence check could never match, so it would always attempt a
+  -- duplicate INSERT and collide on UNIQUE(phone) with an existing admin.
+  IF admin_email IS NOT NULL AND admin_email != '' AND admin_email NOT LIKE '{{%' THEN
 
     -- Check if user already exists
     IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibecarbon",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Create and manage production-ready Vibecarbon applications",
   "type": "module",
   "bin": "./src/cli.js",

package/src/create.js

@@ -1165,6 +1165,64 @@ ${runCmd} test:prepush
   );
   await tick();
 
+  // Create the initial commit so the user starts from a clean, tracked
+  // template baseline (not a pile of untracked files). Guarded by the same
+  // `gitAvailable` flag as `git init` above — if git isn't on PATH we already
+  // logged the skip note and there's no repo to commit into.
+  if (gitAvailable) {
+    s.message('Creating initial commit');
+
+    // The pre-commit hook we just installed runs `${pm} lint` under `set -e`,
+    // and node_modules is absent by default (install is opt-in via -install),
+    // so a verified commit would fail. The template is vibecarbon-authored and
+    // already clean; the hooks exist to gate the user's *future* commits.
+    const commitArgs = ['git', 'commit', '--no-verify', '-m', 'Initial commit from vibecarbon'];
+
+    // `git commit` aborts when no author identity is configured. If neither
+    // user.name nor user.email is set, prepend fallback identity via `-c`
+    // (command-line `-c` only overrides config files, and is itself overridden
+    // by any GIT_AUTHOR_* env — so a real identity, by config or env, always
+    // wins; the fallback only fills a total void).
+    const name = runCommand(['git', 'config', 'user.name'], {
+      cwd: projectDir,
+      cleanEnv: true,
+      silent: true,
+      ignoreError: true,
+    });
+    const email = runCommand(['git', 'config', 'user.email'], {
+      cwd: projectDir,
+      cleanEnv: true,
+      silent: true,
+      ignoreError: true,
+    });
+    if (!name || !email || !String(name).trim() || !String(email).trim()) {
+      commitArgs.splice(
+        1,
+        0,
+        '-c',
+        'user.name=vibecarbon',
+        '-c',
+        'user.email=vibecarbon@users.noreply.github.com',
+      );
+    }
+
+    const staged = runCommand(['git', 'add', '-A'], {
+      cwd: projectDir,
+      cleanEnv: true,
+      ignoreError: true,
+    });
+    const committed =
+      staged !== null &&
+      runCommand(commitArgs, { cwd: projectDir, cleanEnv: true, ignoreError: true }) !== null;
+
+    if (!committed) {
+      p.log.warn(
+        "Couldn't create the initial commit — run `git add -A && git commit` in the project to capture the baseline.",
+      );
+    }
+    await tick();
+  }
+
   s.stop('Project created successfully');
   registerProject(projectName, projectDir);
   tracker.finish();