vibecarbon 0.1.0

package/src/scale.js

@@ -0,0 +1,1734 @@
+/**
+ * Vibecarbon Scale Command
+ *
+ * Adjust instance types post-deploy without re-running the full deploy
+ * flow. Interactive-by-default; bare `vibecarbon scale` walks the
+ * operator through env → role → server-type prompts. Power users can
+ * seed env via `-env <name>` (or positional) and server type via
+ * `-type <id>` for fully-scripted scaling.
+ *
+ * Form rule: vibecarbon uses single-dash flags only — see
+ * memory:feedback_cli_single_dash_flags. Worker-bound flags
+ * (--min-workers / --max-workers) are gone; the interactive bounds
+ * prompt covers that need without tying up two top-level letters.
+ */
+
+import { existsSync, readFileSync, unlinkSync } from 'node:fs';
+import os from 'node:os';
+import { join } from 'node:path';
+import * as p from '@clack/prompts';
+import { getGHCRCredentials } from './lib/build.js';
+import { renderHelp } from './lib/cli/help.js';
+import { parseFlags } from './lib/cli/parse-flags.js';
+import { requireTTYOrFlags } from './lib/cli/tty-guard.js';
+import { c, printBanner } from './lib/colors.js';
+import { runCommand } from './lib/command.js';
+import { loadCredentials, saveProjectConfig } from './lib/config.js';
+import { buildCostBreakdown, formatCostLines } from './lib/cost.js';
+import {
+  backupCompose,
+  dockerLoginOnServer,
+  isLocalOnlyImageTag,
+  pullComposeImages,
+  restoreCompose,
+  setupComposeBackupCron,
+  setupServer,
+  setupServerFiles,
+  startComposeStack,
+  waitForSSH,
+} from './lib/deploy/compose/index.js';
+import { buildRemote } from './lib/deploy/remote-build.js';
+import { DEFAULT_WORKER_MAX, DEFAULT_WORKER_MIN } from './lib/deploy/utils.js';
+import { waitForDNSPropagation } from './lib/dns-propagation.js';
+import { getApiToken, getS3Credentials } from './lib/hetzner-guided-setup.js';
+import { requireLicense } from './lib/licensing/index.js';
+import { ensureOperatorIpAccess } from './lib/operator-ip.js';
+import { perfAsync } from './lib/perf.js';
+import { assertInProjectDir } from './lib/project-guard.js';
+import { HetznerProvider } from './lib/providers/hetzner.js';
+import { buildComposeTypeOptions, buildSimpleTypeOptions } from './lib/server-types.js';
+import { parseDotenv } from './lib/shell.js';
+import { scpDownload, scpUpload, sshRun, sshRunScript } from './lib/ssh.js';
+import { VERSION } from './lib/version.js';
+
+// ============================================================================
+// COMMAND SPEC — single source of truth for argv parsing AND help output.
+// ============================================================================
+
+/** @type {import('./lib/cli/parse-flags.js').CommandSpec & { summary?: string, description?: string, examples?: Array<{ command: string, description?: string }> }} */
+const SPEC = {
+  name: 'scale',
+  summary: 'Adjust instance types post-deploy',
+  description: [
+    'What you can change:',
+    '  Compose / Compose HA   VPS server type (blue-green; zero downtime)',
+    '  Kubernetes             Worker / master / supabase server types (in-place)',
+    '  Kubernetes             Worker bounds (autoscaler floor + ceiling)',
+  ].join('\n'),
+  positional: [
+    {
+      name: 'env',
+      optional: true,
+      description: 'Environment to scale (skips the env prompt)',
+    },
+  ],
+  flags: [
+    { name: 'h', boolean: true, description: 'Show this help' },
+    { name: 'v', boolean: true, description: 'Show version' },
+    { name: 'y', boolean: true, description: 'Skip confirmations (required with -type)' },
+    { name: 'env', value: '<name>', description: 'Environment seed (alternative to positional)' },
+    {
+      name: 'type',
+      value: '<id>',
+      description:
+        'Server type to scale to (e.g. cx33). Compose: resizes the VPS. K8s: resizes all roles.',
+    },
+  ],
+  examples: [
+    { command: 'vibecarbon scale', description: 'prompts for env and changes' },
+    { command: 'vibecarbon scale prod', description: 'env seeded; prompts for changes' },
+    {
+      command: 'vibecarbon scale -env prod -type cx33 -y',
+      description: 'scripted: resize all roles to cx33',
+    },
+  ],
+};
+
+// ============================================================================
+// COMPOSE SCALING
+// ============================================================================
+
+async function scaleCompose(environment, envConfig, projectConfig, options = {}) {
+  const servers = envConfig.servers || [];
+  const projectName = projectConfig.projectName;
+
+  // `s.id` is the Hetzner-assigned numeric server id, persisted by the
+  // orchestrator on every API-provisioned compose deploy. Servers deployed
+  // via --ssh against a pre-existing VPS legitimately have no id and can't
+  // be resized through the Hetzner API — the user has to resize via the
+  // provider console.
+  //
+  // Pre-release scope: there is intentionally no fallback to `hetznerName`
+  // lookup or to .vibecarbon.json shapes that predate the id-persistence
+  // fix. If you see this message after a fresh `vibecarbon deploy` against
+  // an automated provider, your .vibecarbon.json is from before the fix
+  // landed — re-deploy to refresh the shape (it's pre-release; re-deploys
+  // are cheap).
+  const resizableServers = servers.filter((s) => s.id);
+  if (resizableServers.length === 0) {
+    p.log.info('No servers with a Hetzner id found in .vibecarbon.json.');
+    p.log.info('If you deployed via --ssh: resize the VPS through your provider console.');
+    p.log.info('If you used automated provisioning: re-run `vibecarbon deploy` to refresh.');
+    p.outro('');
+    return;
+  }
+
+  // Get API token
+  const apiToken = await getApiToken(projectName);
+  if (!apiToken) {
+    p.log.error('API token required for server scaling');
+    process.exit(1);
+  }
+
+  // Ensure operator IP is in the firewall allowlist before any SSH work.
+  try {
+    const isHA = envConfig.deployMode === 'compose-ha';
+    const result = await ensureOperatorIpAccess({
+      projectConfig,
+      environment,
+      isHA,
+      apiToken,
+      yes: !!options.yes,
+      onMessage: (msg) => p.log.info(msg),
+    });
+    if (result.added) {
+      p.log.success(`Firewall updated: SSH now allows ${result.cidr}`);
+    }
+  } catch (err) {
+    p.log.error(`Operator-IP check failed: ${err.message}`);
+    process.exit(1);
+  }
+
+  // Fetch live server types for accurate pricing
+  await HetznerProvider.fetchServerTypes(apiToken);
+
+  const region = envConfig.region || 'fsn1';
+  const currentType = envConfig.serverType || 'cpx21';
+
+  // Display current configuration
+  const pad = 18;
+  const configLines = [
+    `${'Environment'.padEnd(pad)} ${c.bold(environment)}`,
+    `${'Deploy mode'.padEnd(pad)} ${c.bold(envConfig.deployMode)}`,
+    `${'Region'.padEnd(pad)} ${c.bold(region)}`,
+    `${'Server type'.padEnd(pad)} ${c.bold(currentType)}`,
+  ];
+  for (const server of servers) {
+    const role = server.role ? ` (${server.role})` : '';
+    const id = server.id ? ` [id: ${server.id}]` : ' [--ssh, not scalable]';
+    configLines.push(`${'Server'.padEnd(pad)} ${server.ip}${role}${id}`);
+  }
+  p.note(configLines.join('\n'), 'Current Configuration');
+
+  // For compose-ha: select which server(s) to scale
+  let targetServers = resizableServers;
+  if (envConfig.deployMode === 'compose-ha' && resizableServers.length > 1) {
+    const primaryServer = resizableServers.find((s) => s.role === 'primary');
+    const standbyServer = resizableServers.find((s) => s.role === 'standby');
+
+    // Non-interactive: default to both servers when --yes is set
+    let target;
+    if (options.yes) {
+      target = 'both';
+      p.log.info('Scaling both primary and standby servers');
+    } else {
+      target = await p.select({
+        message: 'Which server(s) to scale?',
+        options: [
+          { value: 'both', label: 'Both primary and standby', hint: 'recommended' },
+          ...(primaryServer
+            ? [{ value: 'primary', label: `Primary only (${primaryServer.ip})` }]
+            : []),
+          ...(standbyServer
+            ? [{ value: 'standby', label: `Standby only (${standbyServer.ip})` }]
+            : []),
+        ],
+      });
+      if (p.isCancel(target)) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+    }
+
+    if (target === 'primary') targetServers = primaryServer ? [primaryServer] : [];
+    else if (target === 'standby') targetServers = standbyServer ? [standbyServer] : [];
+  }
+
+  // Select new server type
+  const regionTypes = HetznerProvider.getServerTypesForRegion(region);
+  const typeOptions = buildComposeTypeOptions(regionTypes, currentType);
+
+  let newType;
+  if (options.type) {
+    newType = options.type;
+    p.log.info(`Using target server type: ${c.bold(newType)}`);
+  } else {
+    newType = await p.select({
+      message: 'New server type:',
+      options: typeOptions,
+      initialValue: currentType,
+    });
+    if (p.isCancel(newType)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
+  }
+
+  if (newType === currentType) {
+    p.log.info(`Already using ${c.bold(currentType)} — nothing to change.`);
+    p.outro('');
+    return;
+  }
+
+  // Cost comparison
+  const ha = envConfig.deployMode === 'compose-ha';
+  const services = projectConfig.services || {};
+  const costBreakdown = buildCostBreakdown({
+    isComposeDeploy: true,
+    ha,
+    serverType: newType,
+    region,
+    services,
+  });
+  p.note(formatCostLines(costBreakdown), 'New Estimated Cost');
+
+  // Confirmation
+  const serverLabel =
+    targetServers.length > 1 ? `${targetServers.length} servers (one at a time)` : '1 server';
+  p.log.info(
+    `This will create a new ${c.bold(newType)} server, migrate data, and destroy the old one.`,
+  );
+  p.log.info('Your application stays online during the migration (zero downtime).');
+
+  const confirmed =
+    options.yes ||
+    (await p.confirm({
+      message: `Scale ${serverLabel} from ${currentType} to ${newType}?`,
+    }));
+  if (p.isCancel(confirmed) || !confirmed) {
+    p.cancel('Operation cancelled.');
+    process.exit(0);
+  }
+
+  // Prepare shared resources
+  const provider = new HetznerProvider(apiToken);
+  const sshKeyPath = join(process.cwd(), '.vibecarbon', `deploy_key_${environment}`);
+  const sshPubKeyPath = `${sshKeyPath}.pub`;
+  const domain = envConfig.domain || null;
+
+  // Read SSH public key and register/reuse in Hetzner
+  const sshPubKey = readFileSync(sshPubKeyPath, 'utf-8').trim();
+  // Project + environment is already a unique key in Hetzner; no need for
+  // an extra `vibecarbon-` prefix. The SSH key here is created by the
+  // initial deploy under a Pulumi-named key (`${projectName}-${env}-${region}-key`)
+  // and createSSHKey dedups by public-key bytes regardless of the requested
+  // name, so the `name` we pass is mostly cosmetic — keep it aligned with
+  // the rest of the codebase.
+  const sshKeyName = `${projectName}-${environment}-key`;
+  const sshKeyId = await provider.createSSHKey(sshKeyName, sshPubKey);
+
+  // Blue-green replacement for each target server. For compose-ha we run
+  // primary + standby in parallel — every per-server step (backup, create,
+  // build, restore, recreate) is independent except the apex DNS update,
+  // which races to whichever server finishes step 9a last (same final-state
+  // behavior the prior sequential code had — the second iteration's
+  // updateDNS overwrote the first). perf data showed compose-ha scale was
+  // exactly 2× single-server scale (711s vs ~365s); parallelizing makes it
+  // ~max(primary, standby) ≈ 6m off the critical path.
+  const scaleSingleServer = async (server) => {
+    const label =
+      envConfig.deployMode === 'compose-ha' ? `${server.role} (${server.ip})` : server.ip;
+    const s = p.spinner();
+
+    // 1. Backup database on old server (--clean so restore can run without DROP DATABASE)
+    s.start(`Backing up database on ${label}...`);
+    const archiveName = await perfAsync('scale.backupOldServer', async () =>
+      backupCompose(server.ip, sshKeyPath, projectName, { clean: true }),
+    );
+    s.stop(`Database backed up: ${archiveName}`);
+
+    // 2. Create new server. user_data front-loads ufw + unattended-upgrades
+    // during boot so setupServer is a ~2s marker-file probe below.
+    const { loadCloudInitScript } = await import('./lib/deploy/compose/index.js');
+    const newServerName = `${projectName}-${environment}${server.role ? `-${server.role}` : ''}-new`;
+    s.start(`Creating new ${c.bold(newType)} server...`);
+    const { id: newServerId, server: newServer } = await perfAsync(
+      'scale.createNewServer',
+      async () =>
+        provider.createServer({
+          name: newServerName,
+          serverType: newType,
+          region: server.region || region,
+          image: 'docker-ce',
+          sshKeys: [sshKeyId],
+          firewalls: envConfig.firewallId ? [envConfig.firewallId] : [],
+          userData: loadCloudInitScript(),
+          labels: {
+            'managed-by': 'vibecarbon',
+            project: projectName,
+            environment,
+          },
+        }),
+    );
+    const newIp = HetznerProvider.getPublicIP(newServer);
+    s.stop(`New server created: ${newIp} (id: ${newServerId})`);
+
+    // Wrap remaining steps in try/catch — if anything fails after creating the
+    // new server, delete it so we don't leave orphaned infrastructure behind.
+    try {
+      // 3. Wait for SSH
+      s.start('Waiting for server to come online...');
+      await perfAsync('scale.waitForServer', () => provider.waitForServer(newServerId));
+      const sshReady = await perfAsync('scale.waitForSSH', () => waitForSSH(newIp, sshKeyPath, 40));
+      if (!sshReady) {
+        throw new Error(`SSH did not become available on new server ${newIp}`);
+      }
+      s.stop('Server online');
+
+      // 4. Provision new server
+      s.start('Configuring server...');
+      await perfAsync('scale.cloudInitReady', () => setupServer(newIp, sshKeyPath));
+      s.stop('Docker installed');
+
+      // Pull the OLD server's full /opt/<project>/.env so every variable the
+      // original deploy seeded (Supabase keys, S3 creds, SMTP, billing,
+      // Grafana, n8n encryption key, etc.) propagates to the new server.
+      //
+      // Why pull the whole file vs. re-deriving from project state:
+      //   - The original deploy merges values from many sources — project
+      //     `.env` + `~/.vibecarbon/credentials.json` (S3 secret key) +
+      //     orchestrator-derived overrides (DOMAIN, ACME_EMAIL, SITE_URL,
+      //     SUPABASE_URL, S3_*, S3_BACKUP_BUCKET, PROJECT_NAME, APP_IMAGE).
+      //     Reconstructing all of those at scale time would mean re-prompting
+      //     for credentials and re-running the same envOverrides logic.
+      //   - The old server's `.env` already contains the resolved superset.
+      //     Replaying it onto the new server is the smallest patch that
+      //     preserves every value, including ones the project's local
+      //     `.env`/`.env.local` doesn't even know about.
+      //
+      // The on-disk form is `KEY='POSIX-single-quoted-value'` (per
+      // escapeDotenv); parseDotenv decodes the wrapping quotes so the values
+      // we pass to renderBundle as envOverrides are raw strings ready to be
+      // re-escaped on write. We then pin APP_IMAGE explicitly because that's
+      // the one value scale needs to keep stable across the migration; all
+      // other keys flow through transparently.
+      let oldEnv = {};
+      try {
+        const envText = sshRun(server.ip, sshKeyPath, ['cat', `/opt/${projectName}/.env`]);
+        oldEnv = parseDotenv(envText);
+      } catch {
+        // Old server may be unreachable; renderBundle will fall back to the
+        // project's local `.env`. That path is degraded (missing S3 secrets)
+        // but at least surfaces a meaningful error during reconcile rather
+        // than crashing scale silently.
+      }
+      const oldAppImage = oldEnv.APP_IMAGE || '';
+
+      s.start('Copying project files...');
+      await perfAsync('scale.setupFiles', () =>
+        setupServerFiles(newIp, sshKeyPath, projectName, {
+          domain,
+          image: oldAppImage || `${projectName}:latest`,
+          observability: services.observability,
+          n8n: services.n8n,
+          metabase: services.metabase,
+          redis: services.redis,
+          // Replay every env var the old server had. renderBundle's existing
+          // envOverrides path overlays these onto the project-local `.env`
+          // baseline, then re-applies the deploy-time overrides (DOMAIN,
+          // SITE_URL, APP_IMAGE, etc.) on top — so the new bundle is a
+          // superset of both sources.
+          envOverrides: oldEnv,
+        }),
+      );
+      s.stop('Project files copied');
+
+      // 4b. Registry auth (optional — avoids rate limits on shared Hetzner IPs).
+      // Scale pulls the same ghcr.io/<owner>/<repo>:<tag> the original
+      // deploy pushed, so ghcr credentials are required alongside Docker Hub.
+      const creds = loadCredentials();
+      const dockerHubCreds = creds.dockerHub || null;
+      if (dockerHubCreds) {
+        s.start('Authenticating with Docker Hub...');
+        await perfAsync('scale.dockerLogin', () =>
+          dockerLoginOnServer(newIp, sshKeyPath, dockerHubCreds),
+        );
+        s.stop('Docker Hub authenticated');
+      }
+      try {
+        const ghcrCreds = await getGHCRCredentials();
+        if (ghcrCreds?.username && ghcrCreds?.token) {
+          s.start('Authenticating with ghcr.io...');
+          await perfAsync('scale.ghcrLogin', () =>
+            dockerLoginOnServer(newIp, sshKeyPath, {
+              username: ghcrCreds.username,
+              token: ghcrCreds.token,
+              registry: 'ghcr.io',
+            }),
+          );
+          s.stop('ghcr.io authenticated');
+        }
+      } catch {
+        /* non-fatal: image may be public */
+      }
+
+      // 4c. Direct-mode image: build on the new server instead of sideloading.
+      //
+      // Original implementation piped `ssh old docker save | ssh new docker load`
+      // from the local shell — every image byte transited the local machine
+      // twice across the WAN, causing 16+ min hangs / timeouts on a ~500MB
+      // image during matrix runs. compose's `prod.yml` resets
+      // `build: !reset null`, so `docker compose up --build` can NOT rebuild
+      // it during the reconcile step — the image must already exist in the
+      // new server's daemon by the time compose pulls.
+      //
+      // buildRemote uses DOCKER_HOST=ssh://new and runs the build directly on
+      // the new server. BuildKit only ships the build context (~tens of MB
+      // of source), not the 500MB built image, so the data path is local →
+      // new (one short hop) instead of old → local → new (two long hops).
+      // Reuses the same code that does direct-mode deploy builds.
+      if (oldAppImage && isLocalOnlyImageTag(oldAppImage)) {
+        s.start(`Building image ${oldAppImage} on new server...`);
+        await perfAsync('scale.sideloadImage', () =>
+          buildRemote(newIp, sshKeyPath, oldAppImage, process.cwd()),
+        );
+        s.stop('Image built on new server');
+      }
+
+      // 5. Pull app + base images from ghcr.io / Docker Hub
+      // No local build — image was built by CI (see Lever 1).
+      s.start('Pulling images on server...');
+      await perfAsync('scale.pullImages', () =>
+        pullComposeImages(newIp, sshKeyPath, projectName, services),
+      );
+      s.stop('Docker images ready');
+
+      // 6. Start compose stack on new server
+      s.start('Starting services on new server...');
+      await perfAsync('scale.composeUp', () =>
+        startComposeStack(newIp, sshKeyPath, projectName, services),
+      );
+      s.stop('Services started');
+
+      // 7. Wait for DB to be ready (backup uses --clean so no DROP DATABASE needed)
+      s.start('Waiting for database to be ready...');
+      const remoteDir = `/opt/${projectName}`;
+      // Shell loop + `$(...)` needs a real shell; projectName is basename-validated.
+      sshRunScript(
+        newIp,
+        sshKeyPath,
+        `cd ${remoteDir} && for i in $(seq 1 30); do docker compose exec -T db pg_isready -U postgres >/dev/null 2>&1 && break || sleep 2; done`,
+        { timeout: 120_000 },
+      );
+      s.stop('Database ready for restore');
+
+      // 8. Transfer backup from old server to new server
+      s.start('Transferring backup to new server...');
+      const localTmpBackup = join(os.tmpdir(), archiveName);
+      try {
+        scpDownload(server.ip, sshKeyPath, `${remoteDir}/backups/${archiveName}`, localTmpBackup);
+        sshRun(newIp, sshKeyPath, ['mkdir', '-p', `${remoteDir}/backups`]);
+        scpUpload(newIp, sshKeyPath, localTmpBackup, `${remoteDir}/backups/${archiveName}`);
+      } finally {
+        try {
+          unlinkSync(localTmpBackup);
+        } catch {
+          // ignore cleanup errors
+        }
+      }
+      s.stop('Backup transferred');
+
+      // 9. Restore database on new server
+      s.start('Restoring database...');
+      await perfAsync('scale.restoreDb', async () =>
+        restoreCompose(newIp, sshKeyPath, projectName, archiveName),
+      );
+      s.stop('Database restored');
+
+      // 9a. Update DNS BEFORE recreating services so Traefik can get ACME certs.
+      // Traefik attempts HTTP-01 challenges immediately on startup; if DNS still
+      // points to the old server, all challenges fail and the next retry is 30+ min.
+      if (domain) {
+        s.start('Updating DNS to new server...');
+        await perfAsync('scale.updateDNS', () => updateDNS(envConfig, apiToken, domain, newIp));
+        s.stop('DNS updated');
+
+        // Poll until Cloudflare/Google DNS returns the new IP (max 120s).
+        // Fixed waits are unreliable — propagation speed varies per resolver.
+        s.start('Waiting for DNS propagation...');
+        const dnsOk = await perfAsync('scale.waitForDNS', () =>
+          waitForDNSPropagation(domain, newIp, 120_000),
+        );
+        s.stop(dnsOk ? 'DNS propagated' : 'DNS propagation timed out (proceeding anyway)');
+      }
+
+      // 9b. Reset ACME state so Traefik retries cert challenges with the correct DNS.
+      // startComposeStack (step 6) ran before DNS was updated — all challenges failed
+      // and are cached as errors in the letsencrypt_data volume.
+      // Use docker compose exec (Traefik is already running) instead of pulling alpine.
+      // Uses an SCP'd script so quoting/redirection stay intact without local shell.
+      sshRunScript(
+        newIp,
+        sshKeyPath,
+        `cd ${remoteDir} && docker compose exec -T traefik sh -c 'echo "{}" > /letsencrypt/acme.json && chmod 600 /letsencrypt/acme.json'`,
+        { timeout: 30_000 },
+      );
+
+      // 9c. Recreate all services after restore so they reconnect to the restored DB.
+      // Include all feature compose file flags so feature containers (redis, n8n,
+      // observability) are recreated too. Using --force-recreate (not down+up) avoids
+      // a Docker network removal error when feature containers on separate compose files
+      // are still holding the network open. depends_on ordering is still respected.
+      const composeFlags = [
+        '-f docker-compose.yml',
+        '-f docker-compose.prod.yml',
+        ...(services.observability
+          ? ['-f docker-compose.observability.yml', '-f docker-compose.observability.prod.yml']
+          : []),
+        ...(services.n8n ? ['-f docker-compose.n8n.yml', '-f docker-compose.n8n.prod.yml'] : []),
+        ...(services.metabase
+          ? ['-f docker-compose.metabase.yml', '-f docker-compose.metabase.prod.yml']
+          : []),
+        ...(services.redis ? ['-f docker-compose.redis.yml'] : []),
+      ].join(' ');
+      s.start('Recreating all services after restore...');
+      sshRunScript(
+        newIp,
+        sshKeyPath,
+        `cd ${remoteDir} && docker compose ${composeFlags} up -d --force-recreate 2>&1`,
+        { timeout: 600_000 },
+      );
+      s.stop('All services running');
+
+      // 11. Re-setup backup cron if configured. envConfig only persists
+      //     bucket/region/endpoint under `s3` — accessKey/secretKey live in
+      //     ~/.vibecarbon/credentials.json (loaded into `creds` at step 4b).
+      //     Without merging them in, setupComposeBackupCron would write a
+      //     /etc/vibecarbon/backup.env with empty AWS_ACCESS_KEY_ID /
+      //     AWS_SECRET_ACCESS_KEY and every cron-triggered backup would 403
+      //     against S3.
+      if (envConfig.backup) {
+        const backupS3Config =
+          envConfig.s3 && creds.s3
+            ? {
+                bucket: envConfig.s3.bucket,
+                accessKey: creds.s3.accessKey,
+                secretKey: creds.s3.secretKey,
+                endpoint: envConfig.s3.endpoint,
+                region: envConfig.s3.region,
+              }
+            : null;
+        setupComposeBackupCron(newIp, sshKeyPath, projectName, backupS3Config, envConfig.backup);
+        p.log.info('Backup cron restored on new server');
+      }
+
+      // 12. Destroy old server
+      s.start(`Destroying old server ${server.ip}...`);
+      await perfAsync('scale.destroyOldServer', () => provider.deleteServer(server.id));
+      s.stop(`Old server destroyed: ${server.ip}`);
+
+      // Rename new server to permanent name
+      const permanentName = `${projectName}-${environment}${server.role ? `-${server.role}` : ''}`;
+      try {
+        await provider.apiRequest(`/servers/${newServerId}`, {
+          method: 'PUT',
+          body: JSON.stringify({ name: permanentName }),
+        });
+      } catch {
+        // Non-critical — server works fine with the temporary name
+      }
+
+      // Update server entry in the config. We spread the original `server`
+      // entry first so any field we don't explicitly touch (e.g.
+      // `supabaseIp` on shapes that have it) carries over verbatim — then
+      // override the fields that actually changed during the migration.
+      // We deliberately keep `server.name` (the role label —
+      // 'master' / 'primary' / 'standby') because failover.js, diagnose.js,
+      // and destroy.js all filter on it (e.g. `s.name === 'master'`). The
+      // Hetzner-API name goes into `hetznerName` so destroy's name-fallback
+      // can locate the VPS.
+      server._replacement = {
+        ...server,
+        id: newServerId,
+        hetznerName: permanentName,
+        ip: newIp,
+        region: server.region || region,
+        serverType: newType,
+      };
+    } catch (scaleErr) {
+      // Clean up the new server so it doesn't become orphaned infrastructure.
+      p.log.error(`Scale failed: ${scaleErr.message}`);
+      p.log.info(`Cleaning up new server ${newIp} (id: ${newServerId})...`);
+      try {
+        await provider.deleteServer(newServerId);
+        p.log.info('New server deleted. Old server is still running.');
+      } catch (cleanupErr) {
+        p.log.error(
+          `Failed to delete new server ${newServerId}: ${cleanupErr.message}. Delete it manually.`,
+        );
+      }
+      throw scaleErr;
+    }
+  };
+
+  if (ha && targetServers.length > 1) {
+    // Wrap parallel scale in a perfTimer so the wall-clock win is visible
+    // in perf_substep alongside the per-server scale.* timings.
+    await perfAsync('scale.ha.fan', () => Promise.all(targetServers.map(scaleSingleServer)));
+  } else {
+    for (const server of targetServers) {
+      await scaleSingleServer(server);
+    }
+  }
+
+  // Update .vibecarbon.json with new server details
+  const updatedServers = servers.map((server) => {
+    if (server._replacement) {
+      const replacement = { ...server._replacement };
+      delete server._replacement;
+      return replacement;
+    }
+    return server;
+  });
+
+  const allScaled = servers.every((s) => !s.id || targetServers.some((t) => t.id === s.id));
+  const updatedConfig = {
+    ...projectConfig,
+    environments: {
+      ...projectConfig.environments,
+      [environment]: {
+        ...envConfig,
+        ...(allScaled && { serverType: newType }),
+        servers: updatedServers,
+      },
+    },
+  };
+  saveProjectConfig(updatedConfig);
+
+  p.outro(
+    `${c.success('Scale complete!')} ${c.bold(currentType)} → ${c.bold(newType)} (zero downtime)`,
+  );
+}
+
+/**
+ * Update DNS A records to point to the new server IP.
+ */
+async function updateDNS(envConfig, apiToken, domain, newIp) {
+  const dnsProvider = envConfig.dnsProvider || envConfig.dns?.provider;
+
+  if (dnsProvider === 'cloudflare') {
+    const cfToken = process.env.CLOUDFLARE_API_TOKEN;
+    const zoneId = envConfig.dns?.cloudflareZoneId;
+    if (cfToken && zoneId) {
+      const { createDNSRecord } = await import('./lib/cloudflare.js');
+      // proxied:false matches deploy-time setup (Cloudflare LBs removed
+      // 2026-03-26 — orange cloud no longer needed).
+      await createDNSRecord(cfToken, zoneId, {
+        type: 'A',
+        name: domain,
+        content: newIp,
+        proxied: false,
+      });
+      await createDNSRecord(cfToken, zoneId, {
+        type: 'A',
+        name: `*.${domain}`,
+        content: newIp,
+        proxied: false,
+      });
+      p.log.info(`DNS updated via Cloudflare: ${domain} → ${newIp}`);
+    } else {
+      p.log.warn(`Update DNS manually: ${domain} → ${newIp}`);
+    }
+  } else if (dnsProvider === 'hetzner') {
+    const zoneId = envConfig.dns?.hetznerZoneId;
+    if (zoneId) {
+      const { createDNSRecord, getZone } = await import('./lib/hetzner-dns.js');
+      const zone = await getZone(apiToken, zoneId);
+      await createDNSRecord(apiToken, zoneId, zone.name, {
+        type: 'A',
+        name: domain,
+        value: newIp,
+        ttl: 60,
+      });
+      await createDNSRecord(apiToken, zoneId, zone.name, {
+        type: 'A',
+        name: `*.${domain}`,
+        value: newIp,
+        ttl: 60,
+      });
+      p.log.info(`DNS updated via Hetzner DNS: ${domain} → ${newIp}`);
+    } else {
+      p.log.warn(`Update DNS manually: ${domain} → ${newIp}`);
+    }
+  } else if (domain) {
+    p.log.warn(`Update your DNS A record: ${domain} → ${newIp}`);
+  }
+}
+
+// waitForDNSPropagation now lives in src/lib/dns-propagation.js (imported
+// at the top of this file). The compose deploy path needs the same
+// utility for the cold-deploy ACME race fix; extracting it lets both
+// paths share the implementation.
+
+// ============================================================================
+// MAIN
+// ============================================================================
+
+export async function run(args) {
+  const { values, positional, errors } = parseFlags(args, SPEC);
+
+  if (errors.length > 0) {
+    for (const e of errors) {
+      process.stderr.write(`${c.error('✗')} ${e}\n`);
+    }
+    process.stderr.write(`Run ${c.info('vibecarbon scale -h')} for usage.\n`);
+    process.exit(1);
+  }
+
+  if (values.h) {
+    process.stdout.write(renderHelp(SPEC));
+    return;
+  }
+  if (values.v) {
+    console.log(`vibecarbon v${VERSION}`);
+    return;
+  }
+
+  // Project guard runs before banner so an accidental `vibecarbon
+  // scale` from a parent directory emits the canonical message.
+  const projectConfig = assertInProjectDir();
+
+  requireLicense('scale');
+  printBanner();
+  p.intro(`${c.bold('vibecarbon scale')} ${c.dim(`v${VERSION}`)}`);
+
+  const envs = projectConfig.environments || {};
+  const deployedEnvs = Object.entries(envs)
+    .filter(([, cfg]) => cfg.status === 'deployed')
+    .map(([name]) => name);
+
+  if (deployedEnvs.length === 0) {
+    p.log.error('No deployed environments found. Run vibecarbon deploy first.');
+    process.exit(1);
+  }
+
+  // Build a legacy-shaped `parsed` struct for the orchestration code below.
+  // Worker-bound flags are gone in the new flag set — the prompt covers
+  // them — so they're nulls here.
+  const envSeed =
+    /** @type {string|undefined} */ (positional.env) ||
+    /** @type {string|null} */ (values.env) ||
+    null;
+  const parsed = {
+    env: envSeed,
+    type: /** @type {string|null} */ (values.type),
+    yes: !!values.y,
+    minWorkers: null,
+    maxWorkers: null,
+  };
+
+  // TTY guard: env prompt fires if multi-deployed and no seed.
+  requireTTYOrFlags({
+    requirements: [
+      {
+        flag: 'env',
+        description: 'name an environment to scale',
+        satisfied: !!envSeed || deployedEnvs.length <= 1,
+      },
+    ],
+  });
+
+  // Select environment (preserves the old behavior of filtering to
+  // deployed envs only — different from selectEnvironment which lists
+  // all envs in projectConfig regardless of status).
+  let environment = parsed.env;
+  if (!environment) {
+    if (deployedEnvs.length === 1) {
+      environment = deployedEnvs[0];
+      p.log.info(`Using environment: ${c.bold(environment)}`);
+    } else {
+      environment = await p.select({
+        message: 'Which environment to scale?',
+        options: deployedEnvs.map((e) => ({ value: e, label: e })),
+      });
+      if (p.isCancel(environment)) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+    }
+  }
+  parsed.env = environment;
+
+  const envConfig = envs[environment];
+  if (!envConfig) {
+    p.log.error(`Environment "${environment}" not found in .vibecarbon.json`);
+    process.exit(1);
+  }
+
+  // Compose deployments: vertical scaling via Hetzner API
+  if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
+    await scaleCompose(environment, envConfig, projectConfig, {
+      type: parsed.type,
+      yes: parsed.yes,
+    });
+    return;
+  }
+
+  const region = envConfig.region || 'fsn1';
+
+  // Pre-fetch live server types (non-blocking, uses saved credentials if available)
+  {
+    const token = process.env.HETZNER_API_TOKEN || loadCredentials()?.hetzner?.apiToken;
+    if (token) await HetznerProvider.fetchServerTypes(token);
+  }
+
+  // Per-role types are optional in the deploy. The orchestrator saves only
+  // `serverType` (the unified default) to .vibecarbon.json — the master/
+  // supabase/worker types only appear here after a previous `scale` set
+  // them. Fall back to envConfig.serverType so we don't send the em-dash
+  // placeholder to Pulumi: doing so triggered ~serverType against the
+  // already-provisioned `cx23` master/supabase servers and Hetzner replied
+  // 'server type — not found'.
+  const fallbackType = envConfig.serverType || 'cx23';
+  const currentMasterType = envConfig.masterServerType || fallbackType;
+  const currentSupabaseType = envConfig.supabaseServerType || fallbackType;
+  const currentWorkerType = envConfig.workerServerType || fallbackType;
+
+  // 3. Display current config
+  const pad = 18;
+  const configLines = [`${'Environment'.padEnd(pad)} ${c.bold(environment)}`];
+  if (envConfig.ha?.enabled && envConfig.secondaryRegion) {
+    configLines.push(`${'Primary region'.padEnd(pad)} ${c.bold(region)}`);
+    configLines.push(
+      `${'Standby region'.padEnd(pad)} ${c.bold(envConfig.secondaryRegion)}  ${c.dim('(will be scaled identically)')}`,
+    );
+  } else {
+    configLines.push(`${'Region'.padEnd(pad)} ${c.bold(region)}`);
+  }
+  configLines.push(
+    `${'Master type'.padEnd(pad)} ${c.bold(currentMasterType)}`,
+    `${'Supabase type'.padEnd(pad)} ${c.bold(currentSupabaseType)}`,
+    `${'Worker type'.padEnd(pad)} ${c.bold(currentWorkerType)}`,
+  );
+  p.note(configLines.join('\n'), 'Current Configuration');
+
+  // 4. Select what to change
+  // 5. Collect new values
+  const newValues = {};
+  const regionTypes = HetznerProvider.getServerTypesForRegion(region);
+  const serverTypeOptions = buildSimpleTypeOptions(regionTypes, { filterSharedCpu: false });
+
+  let changes;
+  if (parsed.yes && parsed.type) {
+    // Non-interactive: `--type X` means "scale every node role to X" for
+    // parity with compose's `--type X` (which resizes the one VPS).
+    // Without this, a k8s `--type cx33` only changed worker pools and
+    // left master + supabase on the previous type — a UX inconsistency
+    // the e2e verify-scale assertion caught (matrix run #10 k8s
+    // scale: only the worker IP showed cx33 post-scale, supabase stayed
+    // cx23).
+    //
+    // Hetzner server_type changes are in-place resizes (~2 min reboot
+    // per node), so the master-replace guard below does NOT trip on
+    // legitimate type bumps — that guard fires only on userData drift
+    // (k3sToken, labels, cloud-init template), which the probe-and-replay
+    // earlier in this function already prevents. Master upgrades cause
+    // ~2 min of control-plane downtime; running under -y means the
+    // operator accepted the cost.
+    //
+    // Per-role overrides remain available through the interactive
+    // multiselect when finer control is needed.
+    changes = ['masterType', 'supabaseType', 'workerType'];
+    newValues.masterType = parsed.type;
+    newValues.supabaseType = parsed.type;
+    newValues.workerType = parsed.type;
+    // Allow --type and bounds to be combined in one invocation. CA
+    // re-patch happens regardless once changes include 'workerBounds'.
+    if (parsed.minWorkers != null || parsed.maxWorkers != null) {
+      changes.push('workerBounds');
+      if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
+      if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+    }
+    p.log.info(
+      `Scaling all node roles (master, supabase, worker) to ${c.bold(parsed.type)} ${c.dim('(in-place resize, ~2 min downtime per node)')}`,
+    );
+  } else if (parsed.yes && (parsed.minWorkers != null || parsed.maxWorkers != null)) {
+    // Non-interactive bounds-only path: --min-workers and/or --max-workers
+    // without --type. We do not run Pulumi here unless minWorkers rose above
+    // the previously persisted floor (which would require new static workers
+    // to be provisioned).
+    //
+    // TODO(phase 8 follow-up): bounds-driven Pulumi changes — when
+    // minWorkers rises above the persisted floor, run Pulumi to add static
+    // workers; when minWorkers drops, leave Pulumi alone (don't reap static
+    // workers on bounds relax). For now we patch CA only; bumping min above
+    // the persisted floor will not provision new static workers until the
+    // next deploy.
+    changes = ['workerBounds'];
+    if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
+    if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+    p.log.info(
+      `Updating cluster-autoscaler bounds: ${c.bold(
+        `min=${newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN}`,
+      )} ${c.bold(`max=${newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX}`)}`,
+    );
+  } else {
+    changes = await p.multiselect({
+      message: 'What would you like to change?',
+      options: [
+        { value: 'workerType', label: 'Worker server type (replace)' },
+        {
+          value: 'masterType',
+          label: 'Master server type (~2 min control-plane downtime)',
+        },
+        {
+          value: 'supabaseType',
+          label: 'Supabase server type (database restart — back up first)',
+        },
+      ],
+      required: true,
+    });
+    if (p.isCancel(changes)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
+
+    for (const change of changes) {
+      if (change === 'workerType') {
+        const val = await p.select({
+          message: 'New worker server type:',
+          options: serverTypeOptions,
+          initialValue: serverTypeOptions.find((t) => t.value === currentWorkerType)?.value,
+        });
+        if (p.isCancel(val)) {
+          p.cancel('Operation cancelled.');
+          process.exit(0);
+        }
+        newValues.workerType = val;
+      } else if (change === 'masterType') {
+        p.log.warn('Changing master type will cause ~2 minutes of control-plane downtime.');
+        const val = await p.select({
+          message: 'New master server type:',
+          options: serverTypeOptions,
+          initialValue: serverTypeOptions.find((t) => t.value === currentMasterType)?.value,
+        });
+        if (p.isCancel(val)) {
+          p.cancel('Operation cancelled.');
+          process.exit(0);
+        }
+        newValues.masterType = val;
+      } else if (change === 'supabaseType') {
+        p.log.warn('Changing Supabase type will restart the database. Back up first!');
+        const val = await p.select({
+          message: 'New Supabase server type:',
+          options: serverTypeOptions,
+          initialValue: serverTypeOptions.find((t) => t.value === currentSupabaseType)?.value,
+        });
+        if (p.isCancel(val)) {
+          p.cancel('Operation cancelled.');
+          process.exit(0);
+        }
+        newValues.supabaseType = val;
+      }
+    }
+  }
+
+  // Server type changes apply via Pulumi up → Hetzner in-place resize per
+  // node (~2 min reboot each).
+  const infraChanges = changes.filter(
+    (c) => c === 'workerType' || c === 'masterType' || c === 'supabaseType',
+  );
+
+  // Cost breakdown with new values applied
+  const services = projectConfig.services || {};
+  const isHA = envConfig.ha?.enabled && envConfig.secondaryRegion;
+  const costBreakdown = buildCostBreakdown({
+    isComposeDeploy: false,
+    ha: !!isHA,
+    masterServerType: newValues.masterType || currentMasterType,
+    supabaseServerType: newValues.supabaseType || currentSupabaseType,
+    workerServerType: newValues.workerType || currentWorkerType,
+    region,
+    services,
+  });
+  p.note(formatCostLines(costBreakdown), 'New Estimated Cost');
+
+  // 6. Require API token if infra changes (server type swap) needed
+  let apiToken = null;
+  if (infraChanges.length > 0) {
+    apiToken = await getApiToken(projectConfig.projectName);
+    if (!apiToken) {
+      p.log.error('API token required for server type changes');
+      process.exit(1);
+    }
+  }
+
+  // Ensure operator IP is in the firewall allowlist before any SSH or k8s
+  // API work. Skip when there's no apiToken (no infra changes and no SSH —
+  // a no-op scale that just returns) since both paths below require token.
+  if (apiToken) {
+    try {
+      const isHA = !!envConfig.ha?.enabled;
+      const result = await ensureOperatorIpAccess({
+        projectConfig,
+        environment,
+        isHA,
+        apiToken,
+        yes: !!parsed.yes,
+        onMessage: (msg) => p.log.info(msg),
+      });
+      if (result.added) {
+        p.log.success(`Firewall updated: SSH/k8s API now allow ${result.cidr}`);
+      }
+    } catch (err) {
+      p.log.error(`Operator-IP check failed: ${err.message}`);
+      process.exit(1);
+    }
+  }
+
+  // 7+8. Apply changes — for HA environments, apply to both clusters
+  const secondaryRegion = envConfig.secondaryRegion;
+
+  async function applyScaleChanges({ clusterEnv, clusterRegion, label }) {
+    // Apply server type changes via Pulumi. Hetzner server_type is an
+    // in-place resize via the provider's update path (~2 min reboot), so a
+    // legitimate type-bump shows up as `update`, not `replace`. Any planned
+    // `replace` of master is the destructive userData-drift bug — see the
+    // master-replace defense block below.
+    if (infraChanges.length > 0) {
+      const { upStack, getStackOutputs, getOrCreateStack, classifyK3sTokenProbe } = await import(
+        './lib/iac/index.js'
+      );
+      const { buildHetznerK8sProgram } = await import('./lib/iac/programs/hetzner-k8s.js');
+      const { K3S_VERSION } = await import('./lib/deploy/k8s/k3s.js');
+      const REGION_TO_NETWORK_ZONE = {
+        nbg1: 'eu-central',
+        hel1: 'eu-central',
+        fsn1: 'eu-central',
+        hil: 'us-west',
+        ash: 'us-east',
+        sin: 'ap-southeast',
+      };
+      // SSH key location depends on deploy topology:
+      // - Single-cluster k8s: deployK3s' ensureSshKey writes
+      //   `.vibecarbon/ssh-<env>` and lets Pulumi manage the SshKey resource.
+      // - HA k8s: deployK8sHA generates a SHARED key at
+      //   `.vibecarbon/deploy_key_<environment>` (one file, used by both
+      //   primary and standby), uploads it to Hetzner ONCE via
+      //   uploadSshKeyToHetzner, and passes the resulting `existingSshKeyId`
+      //   into buildHetznerK8sProgram so neither stack manages the SshKey
+      //   resource directly.
+      //
+      // If we read the wrong path, sshPublicKey resolves to `''` and Pulumi
+      // would either replace the managed SshKey (single-cluster) or — for
+      // HA — try to *create* a brand-new SshKey resource that the original
+      // deploy never managed. The new resource has a different id,
+      // master/supabase/worker `sshKeys: [sshKeyId]` diffs against state,
+      // and Pulumi plans a destructive replace of every node (etcd loss).
+      // The k3sToken probe (further down) is necessary but insufficient
+      // for HA — we ALSO need to mirror the deploy's `existingSshKeyId`
+      // decision, which means reading the shared key file and re-resolving
+      // the Hetzner SshKey id by name.
+      let sshPublicKey = '';
+      let existingSshKeyId;
+      if (isHA) {
+        const sharedKeyPath = join(process.cwd(), '.vibecarbon', `deploy_key_${environment}.pub`);
+        if (existsSync(sharedKeyPath)) {
+          sshPublicKey = readFileSync(sharedKeyPath, 'utf-8').trim();
+        } else {
+          p.log.error(
+            `HA shared SSH key not found at ${sharedKeyPath}. ` +
+              `Was this environment deployed with the current CLI? Refusing to ` +
+              `proceed — a missing key would force Pulumi to recreate every node.`,
+          );
+          process.exit(1);
+        }
+        // Resolve the existing Hetzner SshKey id by the deploy-time name.
+        // HetznerProvider.createSSHKey is idempotent: matches first by
+        // <name>, then by public-key bytes, and only POSTs when neither
+        // exists. Same call deploy made via uploadSshKeyToHetzner — must
+        // match so Pulumi sees the same `existingSshKeyId` input.
+        const provider = new HetznerProvider(apiToken);
+        const haSshKeyName = `${projectConfig.projectName}-${environment}-ha-key`;
+        try {
+          const id = await provider.createSSHKey(haSshKeyName, sshPublicKey);
+          existingSshKeyId = String(id);
+        } catch (err) {
+          p.log.error(
+            `Could not resolve HA SSH key '${haSshKeyName}' in Hetzner: ${err.message?.split('\n')[0] || err}`,
+          );
+          process.exit(1);
+        }
+      } else {
+        const sshKeyPath = join(process.cwd(), '.vibecarbon', `ssh-${clusterEnv}`);
+        sshPublicKey = existsSync(`${sshKeyPath}.pub`)
+          ? readFileSync(`${sshKeyPath}.pub`, 'utf-8').trim()
+          : '';
+      }
+
+      // Reconstruct the s3Config that the original deploy used so pulumi
+      // hits the same backend bucket. envConfig persists bucket + region +
+      // endpoint under `s3` (not `s3Config` — the typo on this line was
+      // silently undefined-ing the config, falling pulumi back to file://
+      // backend with empty state, then trying to CREATE every Hetzner
+      // resource fresh and 409-ing on "name is already used"). Keys aren't
+      // persisted (they live in ~/.vibecarbon/credentials.json) so we
+      // re-fetch them via getS3Credentials.
+      let s3Config;
+      if (envConfig.s3?.bucket) {
+        const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+        if (!s3Creds) {
+          p.log.error('S3 credentials required to access pulumi backend');
+          process.exit(1);
+        }
+        s3Config = {
+          bucket: envConfig.s3.bucket,
+          region: envConfig.s3.region,
+          endpoint: envConfig.s3.endpoint,
+          accessKey: s3Creds.accessKey,
+          secretKey: s3Creds.secretKey,
+        };
+      }
+
+      // Common program inputs shared by both the probe (read-only outputs())
+      // and the real `up` call. They MUST be byte-identical to what deployK3s
+      // passed at deploy time — every input that flows into a Server's
+      // `sshKeys`, `firewallIds`, `labels`, or `userData` is a tripwire for
+      // destructive replace. The k3sToken probe-and-replay (further below)
+      // keeps userData stable; HA needed `existingSshKeyId` to also be
+      // mirrored or master.sshKeys would still drift and replace etcd.
+      const allowedCidrs = (projectConfig.operatorCidrs ?? []).map((e) => e.cidr);
+      const programConfig = {
+        projectName: projectConfig.projectName,
+        environment: clusterEnv,
+        sshPublicKey,
+        allowedSshIps: allowedCidrs,
+        allowedK8sApiIps: allowedCidrs,
+        // HA deploys share one Hetzner SshKey across primary + standby and
+        // pass `existingSshKeyId` so neither stack manages the resource.
+        // Single-cluster lets Pulumi own the SshKey (existingSshKeyId =
+        // undefined). Mirror whichever the deploy did or master.sshKeys
+        // changes and Pulumi replaces every node.
+        existingSshKeyId,
+        location: clusterRegion,
+        networkZone: REGION_TO_NETWORK_ZONE[clusterRegion] || 'eu-central',
+        masterServerType: newValues.masterType ?? currentMasterType,
+        supabaseServerType: newValues.supabaseType ?? currentSupabaseType,
+        workerServerType: newValues.workerType ?? currentWorkerType,
+        // Phase 8: minWorkers/maxWorkers replace workerCount. minWorkers is
+        // what Pulumi consumes (static floor of worker servers it owns).
+        // maxWorkers is not consumed by Pulumi; it flows to the CA Deployment
+        // patch below. If the operator passed --min-workers/--max-workers
+        // we honor them; otherwise replay the previously persisted values
+        // (which are needed verbatim to keep Pulumi's plan a no-op for the
+        // worker pool when the operator is just resizing types).
+        minWorkers: newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN,
+        maxWorkers: newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX,
+        // MUST match the K3S_VERSION used by deployK3s — k3sVersion is
+        // interpolated into each server's userData (cloud-init script), so a
+        // mismatch makes Pulumi see ~userData on master/supabase/workers and
+        // tries to replace them. Replacing master = etcd wipe.
+        k3sVersion: K3S_VERSION,
+        // MUST match the labels passed by deployK3s (src/lib/deploy/k8s/k3s.js).
+        // Mismatched labels make Pulumi mark every resource as ~labels and
+        // attempt a replace — for hcloud.SshKey, replace = delete+create with
+        // the same public-key bytes, which Hetzner rejects with HTTP 409.
+        labels: { 'managed-by': 'vibecarbon', 'os-flavor': 'k3s' },
+        apiToken,
+      };
+
+      // Probe prior stack outputs for the k3sToken so we can replay it into
+      // the real program. classifyK3sTokenProbe normalizes recovered/empty/
+      // errored into a tagged result so the visible logging path matches the
+      // unit tests for this seam (see tests/unit/iac/probe-classify.test.ts).
+      let probeOutputs = null;
+      let probeError = null;
+      try {
+        const probeProgram = buildHetznerK8sProgram(programConfig);
+        probeOutputs = await perfAsync(`scale.k8s.${clusterEnv}.probeOutputs`, () =>
+          getStackOutputs(clusterEnv, probeProgram, {
+            hcloudToken: apiToken,
+            s3Config,
+          }),
+        );
+      } catch (err) {
+        probeError = err instanceof Error ? err : new Error(String(err));
+      }
+      const probe = classifyK3sTokenProbe({ outputs: probeOutputs, error: probeError });
+      const priorK3sToken = probe.priorK3sToken;
+      switch (probe.status) {
+        case 'recovered':
+          break;
+        case 'empty':
+          // Legit on a fresh stack; suspicious on an established one. Either
+          // way, the master-replace defense below is what protects etcd —
+          // we just log loudly so a misbehaving probe is visible in run logs.
+          p.log.warn(
+            `${label}: ${probe.reason}. Proceeding with newly-minted k3sToken — master-replace defense will block any destructive plan.`,
+          );
+          break;
+        case 'errored':
+          // Genuine backend failure (S3 outage, expired creds, corrupt
+          // state). Surface as an error so it doesn't blend into routine
+          // info noise. The real `up` below will resurface the same problem
+          // with a cleaner message.
+          p.log.error(
+            `${label}: ${probe.reason}. Master-replace defense remains armed; if it doesn't fire, fix the backend before scaling.`,
+          );
+          break;
+        default:
+          // Future-proof: classifyK3sTokenProbe is the single source of
+          // truth for status values; surface any unhandled status so a
+          // silent regression can't flow through.
+          p.log.error(`${label}: unexpected probe status '${probe.status}': ${probe.reason}`);
+      }
+
+      const program = buildHetznerK8sProgram({
+        ...programConfig,
+        // Replay the prior token (when available) so userData hashes match
+        // and Pulumi plans an in-place server-type change rather than a
+        // destructive replace of every node.
+        k3sToken: priorK3sToken,
+      });
+
+      // Defense in depth: run a Pulumi preview and refuse to proceed if any
+      // resource with role=master is scheduled for replacement. The k3sToken
+      // probe-and-replay above should make this unreachable, but if any
+      // future input drift (cloud-init template change, label rename, etc.)
+      // re-introduces userData hash drift, this fails fast instead of
+      // silently wiping etcd. Replacements show up under three op codes:
+      // "replace", "create-replacement", and "delete-replaced" — Pulumi
+      // emits all three for a single replaced resource. Catching any one
+      // is sufficient.
+      const s = p.spinner();
+      s.start(`Previewing infra changes (${label})...`);
+      // perf coverage: scale on k8s/k8s-ha was a black box — cli.scale.total
+      // landed at ~470s with only ~9s instrumented (waitForCsiNode +
+      // waitForPodsReady at the tail). The dominant cost is the Pulumi
+      // preview + up cycle below; wrap each so perf_substep can finally
+      // attribute the gap. Tag with clusterEnv (e.g. e4-primary vs
+      // e4-standby) so HA primary/standby are distinguishable.
+      try {
+        const previewStack = await perfAsync(`scale.k8s.${clusterEnv}.previewStack`, () =>
+          getOrCreateStack(clusterEnv, program, {
+            hcloudToken: apiToken,
+            s3Config,
+          }),
+        );
+        const masterReplacements = [];
+        await perfAsync(`scale.k8s.${clusterEnv}.preview`, () =>
+          previewStack.preview({
+            color: 'never',
+            onEvent: (event) => {
+              const meta = event?.resourcePreEvent?.metadata;
+              if (!meta) return;
+              const isReplaceOp =
+                meta.op === 'replace' ||
+                meta.op === 'create-replacement' ||
+                meta.op === 'delete-replaced';
+              if (!isReplaceOp) return;
+              // Resource was created with `new hcloud.Server('master', ...)`
+              // and labelled `role: 'master'`. Either signal flags it.
+              const role = meta.new?.inputs?.labels?.role || meta.old?.inputs?.labels?.role || null;
+              const urn = meta.urn || '';
+              if (role === 'master' || /::master$/.test(urn)) {
+                masterReplacements.push({ op: meta.op, urn });
+              }
+            },
+          }),
+        );
+        s.stop(`Preview complete (${label})`);
+        if (masterReplacements.length > 0) {
+          p.log.error(
+            `Refusing to scale: would replace master node (etcd loss). ` +
+              `Inspect with: pulumi preview --stack ${clusterEnv}`,
+          );
+          for (const r of masterReplacements) {
+            p.log.error(`  ${r.op}: ${r.urn}`);
+          }
+          process.exit(1);
+        }
+      } catch (err) {
+        s.stop(`Pulumi preview failed (${label})`);
+        p.log.error(err.message);
+        process.exit(1);
+      }
+
+      s.start(`Applying infra changes via Pulumi (${label})...`);
+      try {
+        await perfAsync(`scale.k8s.${clusterEnv}.upStack`, () =>
+          upStack(clusterEnv, program, {
+            hcloudToken: apiToken,
+            s3Config,
+          }),
+        );
+        s.stop(`Infra updated (${label})`);
+      } catch (err) {
+        s.stop(`Pulumi up failed (${label})`);
+        p.log.error(err.message);
+        process.exit(1);
+      }
+    }
+
+    // Phase 8: re-patch the cluster-autoscaler Deployment's `--nodes` argv
+    // slot whenever bounds or worker type changed. The CA pool spec is
+    // `<min>:<max>:<workerServerType>:<region>:<poolName>` per
+    // formatCaNodesSpec — bumping the type without re-patching CA leaves
+    // the autoscaler spawning the OLD type for any new nodes. Bumping
+    // bounds without a type change still requires a re-patch.
+    //
+    // When --type is passed alongside bounds (or vs Pulumi already
+    // resized workers), CA-spawned workers should also be drained so CA
+    // re-spawns them at the new type. That drain step is deferred to a
+    // follow-up — for now we surface a 1-line warning.
+    const needsCaRepatch = changes.includes('workerType') || changes.includes('workerBounds');
+    if (needsCaRepatch) {
+      const kubeconfigPath = join(process.cwd(), '.vibecarbon', `kubeconfig-${clusterEnv}`);
+      if (!existsSync(kubeconfigPath)) {
+        p.log.warn(`kubeconfig missing at ${kubeconfigPath} (${label}); skipping CA re-patch`);
+      } else {
+        const { formatCaNodesSpec } = await import('./lib/deploy/k8s/k3s.js');
+        const newMin = newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN;
+        const newMax = newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX;
+        const newType = newValues.workerType ?? currentWorkerType;
+        const caNodesSpec = formatCaNodesSpec({
+          minWorkers: newMin,
+          maxWorkers: newMax,
+          workerServerType: newType,
+          region: clusterRegion,
+        });
+        // Patch the CA Deployment's container args via JSON-pointer so
+        // a kubectl rollout restart picks up the new --nodes flag. The
+        // `--nodes=` arg lives at .spec.template.spec.containers[0].args
+        // and is the only arg we need to update.
+        const caSpinner = p.spinner();
+        caSpinner.start(`Re-patching cluster-autoscaler --nodes (${label})`);
+        try {
+          // Read current args so we can replace just the --nodes one.
+          // runCommand returns the captured stdout string when `silent: true`.
+          const argsJsonRaw = runCommand(
+            [
+              'kubectl',
+              '--kubeconfig',
+              kubeconfigPath,
+              '-n',
+              'kube-system',
+              'get',
+              'deploy',
+              'cluster-autoscaler',
+              '-o',
+              'jsonpath={.spec.template.spec.containers[0].args}',
+            ],
+            { silent: true },
+          );
+          const argsJson = typeof argsJsonRaw === 'string' ? argsJsonRaw.trim() : '';
+          let argList = [];
+          try {
+            argList = JSON.parse(argsJson);
+          } catch {
+            argList = [];
+          }
+          const updated = argList.map((a) =>
+            typeof a === 'string' && a.startsWith('--nodes=') ? `--nodes=${caNodesSpec}` : a,
+          );
+          // If for some reason --nodes wasn't there, append it.
+          if (!updated.some((a) => typeof a === 'string' && a.startsWith('--nodes='))) {
+            updated.push(`--nodes=${caNodesSpec}`);
+          }
+          const patch = JSON.stringify({
+            spec: {
+              template: { spec: { containers: [{ name: 'cluster-autoscaler', args: updated }] } },
+            },
+          });
+          runCommand(
+            [
+              'kubectl',
+              '--kubeconfig',
+              kubeconfigPath,
+              '-n',
+              'kube-system',
+              'patch',
+              'deploy',
+              'cluster-autoscaler',
+              '--type=strategic',
+              '-p',
+              patch,
+            ],
+            { silent: true },
+          );
+          runCommand(
+            [
+              'kubectl',
+              '--kubeconfig',
+              kubeconfigPath,
+              '-n',
+              'kube-system',
+              'rollout',
+              'restart',
+              'deploy/cluster-autoscaler',
+            ],
+            { silent: true },
+          );
+          caSpinner.stop(`cluster-autoscaler re-patched (${label}): ${caNodesSpec}`);
+          if (changes.includes('workerType')) {
+            p.log.warn(
+              `CA-spawned workers (if any) are still on the old type. ` +
+                `Drain them with kubectl drain so CA respawns at the new type.`,
+            );
+          }
+        } catch (err) {
+          caSpinner.stop(`CA re-patch failed (${label})`);
+          p.log.warn(
+            `Could not re-patch cluster-autoscaler: ${err.message?.split('\n')[0] || err}`,
+          );
+        }
+      }
+    }
+  }
+
+  // Apply to primary (or single) cluster
+  await applyScaleChanges({
+    clusterEnv: isHA ? `${environment}-primary` : environment,
+    clusterRegion: region,
+    label: isHA ? `primary — ${region}` : region,
+  });
+
+  // Apply to standby cluster if HA
+  if (isHA) {
+    p.log.step(`Applying same changes to standby cluster (${secondaryRegion})...`);
+    await applyScaleChanges({
+      clusterEnv: `${environment}-standby`,
+      clusterRegion: secondaryRegion,
+      label: `standby — ${secondaryRegion}`,
+    });
+  }
+
+  // Hetzner in-place server_type changes are ~2 min reboots per node.
+  // Pulumi's upStack returns when the VM is back up + k3s reports
+  // ready, but stateful workloads inside the cluster (notably
+  // supabase-supabase-db Postgres) need additional time to finish
+  // their own init / WAL replay before they accept connections. If
+  // the next caller (e.g. e2e backup step) runs against a
+  // still-recovering cluster, pg_dump gets "connection refused" and
+  // the work fails for what looks like a backup bug but is actually
+  // a "scale didn't wait for the cluster to settle" problem. Observed
+  // 2026-04-28 e2e — every backup-step failure across three
+  // reruns had this same root cause.
+  //
+  // Wait for all pods in the vibecarbon namespace to reach
+  // Ready=True. The supabase chart's readiness probe on
+  // supabase-supabase-db is TCP-based on 5432, so once that pod is
+  // Ready the connection-refused window has closed.
+  const clustersToVerify = isHA
+    ? [
+        { env: `${environment}-primary`, label: `primary — ${region}` },
+        { env: `${environment}-standby`, label: `standby — ${secondaryRegion}` },
+      ]
+    : [{ env: environment, label: region }];
+  // 10 min is the floor that holds for HA (k8s-ha rerun 2026-04-28: standby
+  // timed out 12/12 pods at 5 min — supabase-db-0 alone needs ~60-90s to
+  // start postgres after a node reboot, then auth/kong/realtime/etc.
+  // dependency-chain off it, then app pulls images that may not be cached
+  // on the freshly-rebooted node). Single-cluster k8s only used ~70s of
+  // its old 300s budget, so the bump costs nothing on the happy path.
+  const WAIT_TIMEOUT_SEC = 600;
+  for (const { env: clusterEnv, label } of clustersToVerify) {
+    const kubeconfigPath = join(process.cwd(), '.vibecarbon', `kubeconfig-${clusterEnv}`);
+    if (!existsSync(kubeconfigPath)) {
+      p.log.warn(
+        `kubeconfig missing at ${kubeconfigPath} (${label}); skipping post-resize Ready wait`,
+      );
+      continue;
+    }
+    // Wait for the API server to be reachable BEFORE running any kubectl
+    // commands. RCA from k8s scale failure 2026-05-07 (e2e run
+    // bt5zvlw7n): Pulumi's upStack returns when the Hetzner VM is back up
+    // and k3s reports ready inside the master, but the floating IP that
+    // kubeconfig points at re-attaches asynchronously — there's a 30-90s
+    // window where `kubectl --kubeconfig ...` returns
+    // `ServiceUnavailable: the server is currently unable to handle the
+    // request`. The next call (`kubectl rollout status` for hcloud-csi-node)
+    // exits in <1s with that error, then `kubectl wait --for=Ready pods`
+    // does the same, and scale fails for what looks like "pods didn't
+    // settle" but is actually "API server wasn't reachable yet". Poll
+    // `--raw=/healthz` until we see ok before continuing — k3s's healthz
+    // returns "ok" only when the apiserver + scheduler + controller-manager
+    // are all alive, so a single success here means the cluster control
+    // plane has truly stabilized post-resize.
+    const apiSpinner = p.spinner();
+    apiSpinner.start(`Waiting for API server to be reachable (${label})`);
+    const apiStart = Date.now();
+    const API_READY_BUDGET_MS = 300_000;
+    let apiReady = false;
+    let lastApiErr = '';
+    while (Date.now() - apiStart < API_READY_BUDGET_MS) {
+      try {
+        runCommand(['kubectl', '--kubeconfig', kubeconfigPath, 'get', '--raw=/healthz'], {
+          silent: true,
+          timeout: 10_000,
+        });
+        apiReady = true;
+        break;
+      } catch (err) {
+        lastApiErr = err.message?.split('\n')[0]?.slice(0, 120) || String(err).slice(0, 120);
+        await new Promise((r) => setTimeout(r, 5_000));
+      }
+    }
+    if (!apiReady) {
+      apiSpinner.stop(`API server (${label}) not reachable within 5 min`);
+      throw new Error(
+        `Kube API server for ${label} never returned /healthz=ok within 5 min after Pulumi resize. ` +
+          `Last error: ${lastApiErr}`,
+      );
+    }
+    apiSpinner.stop(`API server reachable (${label})`);
+    // Wait for the Hetzner CSI driver DaemonSet to register on every
+    // node BEFORE checking pod-Ready. RCA from k8s-ha standby failure
+    // 2026-04-28 (live cluster repro under triple-node-reboot):
+    // kubelet can flip the supabase node Ready before hcloud-csi-node
+    // pod registers; supabase-db-0 then tries to mount its PVC and
+    // hits "MountVolume.MountDevice failed... driver name
+    // csi.hetzner.cloud not found in the list of registered CSI
+    // drivers". The pod sandbox gets killed + recreated in a tight
+    // loop, eventually enters CrashLoopBackOff with a 5-min backoff
+    // timer that the pod-Ready wait then can't outrun. Waiting for
+    // the DS rollout first eliminates the race entirely.
+    const csiSpinner = p.spinner();
+    csiSpinner.start(`Waiting for hcloud-csi-node DaemonSet rollout (${label})`);
+    try {
+      await perfAsync('scale.waitForCsiNode', async () =>
+        runCommand(
+          [
+            'kubectl',
+            '--kubeconfig',
+            kubeconfigPath,
+            '-n',
+            'kube-system',
+            'rollout',
+            'status',
+            'daemonset/hcloud-csi-node',
+            '--timeout=300s',
+          ],
+          { silent: true },
+        ),
+      );
+      csiSpinner.stop(`hcloud-csi-node Ready on all nodes (${label})`);
+    } catch {
+      csiSpinner.stop(`hcloud-csi-node rollout did not complete in 5 min (${label})`);
+      // Continue anyway — the pod-Ready wait below will surface any
+      // real persistent issue via the diag dump.
+    }
+    // (Live debug 2026-04-28 found that bouncing pods to break a
+    // CrashLoopBackOff cycle leaves the underlying CSI VolumeAttachment
+    // stuck in "deletionTimestamp set, finalizer external-attacher/
+    // csi-hetzner-cloud held" state — supabase-db-0 then sits in
+    // Init:0/1 for 10+ min waiting for the new VolumeAttachment to
+    // bind. Solution: do not bounce. Rely on the csi-node rollout
+    // wait above eliminating the race in the first place; a pod that
+    // entered BackOff before CSI registered will exit BackOff cleanly
+    // once kubelet's next retry tick fires (5-min cap).)
+    //
+    // HA standby exception: skip the pod-Ready wait entirely when this
+    // is the standby cluster. The standby's DB is supposed to be a
+    // streaming replica (read-only), and the supabase chart's
+    // app-tier pods (app/kong/rest/auth/realtime/storage) currently
+    // can't satisfy their readiness probes against a read-only DB —
+    // their probes call /api/health/ready (or similar) which times out
+    // upstream and returns 503. `kubectl wait --all` then blocks until
+    // its 10-min budget runs out and the scale step fails for what
+    // looks like "scale didn't settle" but is actually "standby's app
+    // tier is not designed to Ready before failover". Surfaced
+    // 2026-04-29 in k8s-ha e2e run 674f03c3-8b7a after the
+    // earlier deploy-step issues were fixed — scale was the first
+    // step doing `wait --all` against the standby kubeconfig.
+    //
+    // The CSI rollout above already verifies node-level health
+    // post-resize; pod-level readiness on standby is validated end-
+    // to-end by the failover step (which promotes the DB and re-
+    // probes the app pods). Until HA replication is properly wired
+    // up — see memory: project_replication_broken.md ("K8s HA
+    // replication never worked") — pod-Ready against standby is a
+    // known false-failure mode.
+    const isStandbyCluster = clusterEnv.endsWith('-standby');
+    if (isStandbyCluster) {
+      p.log.info(
+        `Skipping pod-Ready wait on standby (${label}) — replica-mode app tier ` +
+          `is not expected to Ready until failover; CSI rollout above already ` +
+          `verified node-level health.`,
+      );
+      continue;
+    }
+    const spinner = p.spinner();
+    spinner.start(`Waiting for vibecarbon pods to be Ready (${label})`);
+    try {
+      await perfAsync('scale.waitForPodsReady', async () =>
+        runCommand(
+          [
+            'kubectl',
+            '--kubeconfig',
+            kubeconfigPath,
+            '-n',
+            'vibecarbon',
+            'wait',
+            '--for=condition=Ready',
+            'pods',
+            '--all',
+            `--timeout=${WAIT_TIMEOUT_SEC}s`,
+          ],
+          { silent: true },
+        ),
+      );
+      spinner.stop(`Pods Ready (${label})`);
+    } catch (err) {
+      spinner.stop(`Pods did not all become Ready within ${WAIT_TIMEOUT_SEC / 60} min (${label})`);
+      // On timeout, dump pod state + describe + logs of any non-Ready
+      // pods so the next debug session knows *which* pods didn't
+      // recover and *why* (CrashLoopBackOff/ImagePullBackOff/post-reboot
+      // postgres init failure). Without this the failure attribution is
+      // just "kubectl wait timed out" with no signal as to which
+      // controller is wedged.
+      try {
+        runCommand(
+          [
+            'kubectl',
+            '--kubeconfig',
+            kubeconfigPath,
+            '-n',
+            'vibecarbon',
+            'get',
+            'pods',
+            '-o',
+            'wide',
+          ],
+          { silent: false, ignoreError: true },
+        );
+        runCommand(
+          [
+            'kubectl',
+            '--kubeconfig',
+            kubeconfigPath,
+            '-n',
+            'vibecarbon',
+            'get',
+            'events',
+            '--sort-by=.lastTimestamp',
+          ],
+          { silent: false, ignoreError: true },
+        );
+        // Per-non-Ready-pod describe + previous-container logs. We
+        // shell-pipe through bash because kubectl doesn't have a native
+        // way to "describe + logs everything that isn't Ready". Pre-Ready
+        // pods have no `--previous` so we attempt both with-and-without.
+        // Container name is left out so kubectl picks the main container
+        // (works for single-container pods; multi-container pods get a
+        // generic dump which still tells us *something*).
+        runCommand(
+          [
+            'bash',
+            '-c',
+            `KCFG="${kubeconfigPath}"; for pod in $(kubectl --kubeconfig "$KCFG" -n vibecarbon get pods --no-headers 2>/dev/null | awk '$2 !~ /^([0-9]+)\\/\\1$/ {print $1}'); do
+  echo "=== describe $pod ===";
+  kubectl --kubeconfig "$KCFG" -n vibecarbon describe pod "$pod" 2>&1 | head -n 80;
+  echo "=== logs $pod (current) ===";
+  kubectl --kubeconfig "$KCFG" -n vibecarbon logs "$pod" --tail=80 --all-containers 2>&1 | head -n 200;
+  echo "=== logs $pod (previous) ===";
+  kubectl --kubeconfig "$KCFG" -n vibecarbon logs "$pod" --tail=80 --all-containers --previous 2>&1 | head -n 200;
+done`,
+          ],
+          { silent: false, ignoreError: true },
+        );
+      } catch {
+        /* best-effort diag */
+      }
+      throw err;
+    }
+  }
+
+  // 9. Update .vibecarbon.json with new sizing inputs.
+  //
+  // Hetzner server_type changes are in-place resizes (not replaces) per
+  // the master-replace guard's design comment above — the public IP
+  // survives the type bump, so the persisted `servers[]` block still
+  // points at the right hosts after scale. We only need to update the
+  // sizing inputs (worker/master/supabase serverType). The serverType
+  // field on each `servers[]` entry is left alone since failover/destroy
+  // don't read it (status reads from the top-level `*ServerType` fields
+  // below).
+  const updatedEnvFields = {
+    ...(newValues.workerType && {
+      workerServerType: newValues.workerType,
+      serverType: newValues.workerType,
+    }),
+    ...(newValues.masterType && { masterServerType: newValues.masterType }),
+    ...(newValues.supabaseType && { supabaseServerType: newValues.supabaseType }),
+    // Phase 8: persist CA bounds so subsequent `vibecarbon deploy` and
+    // `vibecarbon scale` runs replay the operator's most recent choice
+    // rather than falling back to defaults.
+    ...(newValues.minWorkers != null && { minWorkers: newValues.minWorkers }),
+    ...(newValues.maxWorkers != null && { maxWorkers: newValues.maxWorkers }),
+  };
+
+  const updatedConfig = {
+    ...projectConfig,
+    environments: {
+      ...projectConfig.environments,
+      [environment]: { ...envConfig, ...updatedEnvFields },
+    },
+  };
+  saveProjectConfig(updatedConfig);
+
+  p.outro(`${c.success('Scale complete!')} Configuration updated in .vibecarbon.json`);
+}
+
+// Exported for tests.
+export { SPEC };