vibecarbon 0.3.1 → 0.5.0

package/src/lib/deploy/orchestrator.js

@@ -19,6 +19,7 @@ import { waitForDNSPropagation } from '../dns-propagation.js';
 import { ensureOperatorIpAccess } from '../operator-ip.js';
 import { perfAsync, perfTimer } from '../perf.js';
 import { createTracker } from '../tracker.js';
+import { useDnsChallenge } from './acme.js';
 import { renderBundle } from './bundle.js';
 import { sideloadCompose } from './image.js';
 import { buildRemote } from './remote-build.js';
@@ -458,6 +459,13 @@ export async function executeDeployment(args, gatheredConfig) {
   // gutter and print flush-left, breaking the visual flow. Bundle content
   // is reproducible from the project tree; debug it by re-running with
   // VIBECARBON_PERF=1 + VIBECARBON_BUNDLE_VERBOSE=1 if needed.
+  // Managed-DNS compose deploys (cloudflare/hetzner) solve ACME via DNS-01 —
+  // Traefik writes a TXT record through the provider API, so there is no
+  // HTTP-01 race against A-record propagation and no need for the
+  // DNS-propagation poll or the Traefik cert self-heal below. `manual` keeps
+  // HTTP-01. Scoped to compose: k8s issues certs via cert-manager and ignores
+  // this Traefik override entirely.
+  const dnsChallenge = isComposeDeploy && useDnsChallenge(dnsProvider);
   const bundlePath = renderBundle(projectConfig.projectName, {
     domain,
     image: imageRef,
@@ -467,6 +475,10 @@ export async function executeDeployment(args, gatheredConfig) {
     redis: services.redis,
     s3: s3Config,
     backupS3: backupS3Config,
+    dnsChallenge,
+    dnsProvider,
+    cloudflareApiToken,
+    hetznerApiToken: apiToken,
     verbose: process.env.VIBECARBON_BUNDLE_VERBOSE === '1',
   });
   bundleRenderTimer.end();
@@ -542,9 +554,14 @@ export async function executeDeployment(args, gatheredConfig) {
       );
       s.stop('Compose HA deployment complete');
     } else {
-      const { setupServer, dockerLoginOnServer, startComposeStack, runMigrations } = await import(
-        './compose/index.js'
-      );
+      const {
+        setupServer,
+        dockerLoginOnServer,
+        startComposeStack,
+        runMigrations,
+        createAdminUser,
+        setupComposeBackupCron,
+      } = await import('./compose/index.js');
       const { setupServerFiles, waitForSSH: waitForComposeSSH } = await import(
         './compose/index.js'
       );
@@ -750,27 +767,35 @@ export async function executeDeployment(args, gatheredConfig) {
           await perfAsync('deploy.dns.create', () => updateDnsIp(token, zoneId, domain, serverIp));
           state.completeStep('compose-dns-update', { serverIp });
         }
-        // Block compose-up until public resolvers see the real IP. 120s
-        // budget covers Cloudflare's typical edge propagation (under 60s)
-        // with margin. Returns false on timeout; we proceed anyway —
-        // Traefik can still acquire certs on its own retries, the
-        // customer just sees a brief self-signed-cert window. Hard-
-        // failing here would mask deploys that succeed eventually.
+        // HTTP-01 only: block compose-up until public resolvers see the real
+        // IP. 120s budget covers Cloudflare's typical edge propagation (under
+        // 60s) with margin. Returns false on timeout; we proceed anyway —
+        // Traefik can still acquire certs on its own retries, the customer
+        // just sees a brief self-signed-cert window. Hard-failing here would
+        // mask deploys that succeed eventually.
+        //
+        // DNS-01 (managed providers) skips this entirely: lego validates via a
+        // TXT record it writes through the provider API, so cert issuance does
+        // not wait on the A record propagating. The A record we just wrote
+        // propagates in the background; the post-deploy health probe uses
+        // localhost + Host header and never depends on it.
         //
         // Visible spinner so the operator isn't staring at a frozen
         // "Yes" screen for up to 120s on a cold deploy where the DNS
         // edge is slow. `timer` indicator forces the rendered string to
         // change every second so progress remains visibly alive.
-        const dnsSpinner = p.spinner({ indicator: 'timer' });
-        dnsSpinner.start(`Waiting for ${domain} to resolve to ${serverIp}`);
-        const dnsPropagated = await perfAsync('deploy.dns.waitForPropagation', () =>
-          waitForDNSPropagation(domain, serverIp, 120_000),
-        );
-        dnsSpinner.stop(
-          dnsPropagated
-            ? `DNS resolves: ${domain} → ${serverIp}`
-            : `DNS propagation timed out — proceeding anyway`,
-        );
+        if (!dnsChallenge) {
+          const dnsSpinner = p.spinner({ indicator: 'timer' });
+          dnsSpinner.start(`Waiting for ${domain} to resolve to ${serverIp}`);
+          const dnsPropagated = await perfAsync('deploy.dns.waitForPropagation', () =>
+            waitForDNSPropagation(domain, serverIp, 120_000),
+          );
+          dnsSpinner.stop(
+            dnsPropagated
+              ? `DNS resolves: ${domain} → ${serverIp}`
+              : `DNS propagation timed out — proceeding anyway`,
+          );
+        }
       }
 
       // `docker compose up -d` is idempotent and cheap — always run so a
@@ -794,6 +819,24 @@ export async function executeDeployment(args, gatheredConfig) {
         runMigrations(serverIp, sshKeyPath, projectConfig.projectName),
       );
 
+      // Create the production app super-admin in auth.users via GoTrue's admin
+      // API. Same class of trap as runMigrations above: this inline single-
+      // compose path previously skipped it (only deployComposeHA called
+      // createAdminUser), so a single-server deploy shipped a prod app the
+      // operator couldn't actually log into — the only admin user lived in
+      // their local Docker. Idempotent (422 = already exists); a failure here
+      // is a warning, not a hard abort, so a transient GoTrue blip doesn't
+      // fail an otherwise-healthy deploy — re-running `vibecarbon deploy`
+      // retries it.
+      const adminResult = await perfAsync('deploy.compose.createAdminUser', () =>
+        createAdminUser(serverIp, sshKeyPath, projectConfig.projectName),
+      );
+      if (adminResult.success) {
+        p.log.success(adminResult.message);
+      } else {
+        p.log.warn(`${adminResult.message}. Run \`vibecarbon deploy\` again to retry.`);
+      }
+
       // --- Verifiable success gate ---
       // Probe the app's own /api/health endpoint on the server itself (via
       // localhost + Host header), bypassing DNS/TLS. A successful deploy
@@ -831,23 +874,33 @@ export async function executeDeployment(args, gatheredConfig) {
       }
       healthSpinner.stop(`App is serving requests (HTTP ${health.status})`);
 
-      // --- ACME / TLS self-heal (compose only) ---
-      // The internal health probe above bypasses DNS/TLS and confirms the
-      // app container is up. It does NOT confirm Traefik has issued a real
-      // Let's Encrypt cert. Verify by reading acme.json; if Traefik is
-      // stuck on a stale failed-challenge state (typically because a
-      // previous deploy on v3.6.1 raced ahead of DNS propagation), restart
-      // Traefik in-line to retry ACME. RCA: vibecarbon.com customer hit
-      // this on 2026-05-19 — cold deploy "succeeded" with HTTP 200 from
-      // internal probe, but browsers saw NET::ERR_CERT_AUTHORITY_INVALID
-      // because Traefik served its self-signed default cert.
-      if (domain && dnsProvider && dnsProvider !== 'manual') {
-        const { ensureTraefikCert } = await import('./compose/acme-verify.js');
-        await perfAsync('deploy.acme.verify', () =>
-          ensureTraefikCert(serverIp, sshKeyPath, projectConfig.projectName, domain, p.log),
+      // Install the scheduled wal-g backup cron on the server. Without this,
+      // a fresh compose deploy collects + persists backupConfig (envConfig.backup)
+      // but never schedules a backup — backups only ran after a `vibecarbon scale`
+      // event (scale.js was the lone caller). setupComposeBackupCron defaults the
+      // schedule + retain when backupConfig is absent, so it always installs a
+      // sensible cron. wal-g reads its S3 config from the db container env
+      // (rendered into .env at deploy) — the cron just runs compose-backup.sh,
+      // which self-skips (exit 0) when no S3 backup target is configured, so an
+      // always-installed cron never hard-fails on a no-S3 deploy.
+      //
+      // A cron-install failure must NOT fail an already-healthy deploy: the app
+      // is serving by this point. Downgrade to a warning so a transient ssh/cron
+      // hiccup doesn't roll back a successful deploy.
+      try {
+        await perfAsync('deploy.compose.backupCron', async () =>
+          setupComposeBackupCron(serverIp, sshKeyPath, projectConfig.projectName, backupConfig),
         );
+      } catch (err) {
+        p.log.warn(`Scheduled backup cron install failed (deploy still succeeded): ${err.message}`);
       }
 
+      // No ACME self-heal needed here. Managed-DNS deploys (cloudflare/hetzner)
+      // issue certs via DNS-01, which has no HTTP-01-vs-DNS-propagation race to
+      // recover from; `manual` DNS was never self-healed (we don't manage its
+      // records). The old acme.json poll + Traefik restart (acme-verify.js)
+      // existed only for the HTTP-01 race the DNS-01 switch eliminates.
+
       deployResult = {
         masterIp: serverIp,
         serverId: serverHetznerId || 'manual',
@@ -883,6 +936,10 @@ export async function executeDeployment(args, gatheredConfig) {
       s3Config,
       backupConfig,
       backupBucketName: backupS3Config?.bucket || null,
+      // DR: when set (`deploy -restore latest|<ts>`), the db pod's init
+      // container seeds PGDATA from S3 via wal-g and applyMigrations is
+      // skipped (the restored DB is authoritative).
+      restore: args.restore || null,
       operatorCidrs: projectConfig.operatorCidrs ?? [],
       imageReadyPromise,
       tracker,

package/src/lib/deploy/utils.js

@@ -139,6 +139,26 @@ export function generateSSHKeyPair(keyPath) {
   return readFileSync(`${keyPath}.pub`, 'utf-8').trim();
 }
 
+/**
+ * Read REPL_PASSWORD — process.env first (CI may export it), then .env.local
+ * (where `vibecarbon create` writes it at project-init time). Shared by the
+ * compose-HA and k8s-HA replication paths so the parsing lives in one place.
+ * Accepts both double-quoted (machine secrets) and single-quoted
+ * (escapeDotenv'd user secrets) forms, matching create.js output.
+ *
+ * @param {string} [cwd] - directory to look for .env.local in
+ * @returns {string|null} the password, or null if absent everywhere
+ */
+export function readReplPassword(cwd = process.cwd()) {
+  if (process.env.REPL_PASSWORD) return process.env.REPL_PASSWORD;
+  const envLocalPath = join(cwd, '.env.local');
+  if (!existsSync(envLocalPath)) return null;
+  const content = readFileSync(envLocalPath, 'utf-8');
+  const m =
+    content.match(/^REPL_PASSWORD="([^"]+)"/m) || content.match(/^REPL_PASSWORD='([^']+)'/m);
+  return m ? m[1] : null;
+}
+
 /**
  * Wait for SSH to become available on a host
  * @param {string} host

package/src/lib/hetzner-guided-setup.js

@@ -113,13 +113,6 @@ export async function saveIfWanted(credentials) {
   }
 }
 
-/**
- * Reset the session-level save preference (for testing)
- */
-export function resetSavePreference() {
-  _savePreference = null;
-}
-
 /**
  * Get API token with improved visual guidance
  * Lookup order: env var → credentials file → interactive prompt

package/src/lib/iac/index.js

@@ -135,6 +135,35 @@ export async function initBackend(options = {}) {
   }
 }
 
+// S3 (Hetzner Object Storage) throttles the Pulumi state backend with
+// `503 SlowDown` / `ServiceUnavailable` when many stack operations read/write
+// state concurrently — the documented blocker for running the e2e matrix in
+// parallel (multiple scenarios' `up`/`refresh`/`destroy` hit one S3 account at
+// once). It is also a transient any single deploy can hit. These ops are all
+// idempotent (Pulumi reconciles to desired state), so retrying on a throttle is
+// safe. Non-throttle errors propagate immediately.
+export const STATE_BACKEND_THROTTLE_PATTERN =
+  /SlowDown|ServiceUnavailable|RequestLimitExceeded|throttl|too many requests|\b503\b/i;
+
+export async function withStateBackendRetry(fn, desc, options = {}) {
+  const attempts = options.attempts ?? 5;
+  const baseMs = options.baseMs ?? 2000;
+  const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      const msg = err?.message || String(err);
+      if (attempt >= attempts || !STATE_BACKEND_THROTTLE_PATTERN.test(msg)) throw err;
+      const backoff = Math.min(baseMs * 2 ** (attempt - 1), 30_000);
+      console.error(
+        `[pulumi] ${desc}: S3 state backend throttled (attempt ${attempt}/${attempts}), retrying in ${backoff}ms`,
+      );
+      await sleep(backoff);
+    }
+  }
+}
+
 /**
  * Run `pulumi up` and return the raw outputs. Streams Pulumi logs to an
  * optional `onOutput` sink so callers can forward progress to a spinner.
@@ -181,7 +210,10 @@ export async function upStack(stackName, program, options = {}) {
   }
   if (needsRefresh) {
     try {
-      await stack.refresh({ onOutput: options.onOutput, color: 'never' });
+      await withStateBackendRetry(
+        () => stack.refresh({ onOutput: options.onOutput, color: 'never' }),
+        'pre-up refresh',
+      );
     } catch (err) {
       // refresh can fail if the state file is completely corrupt or a
       // resource is unreachable. Log and proceed — `up` may still succeed
@@ -190,10 +222,10 @@ export async function upStack(stackName, program, options = {}) {
     }
   }
 
-  const result = await stack.up({
-    onOutput: options.onOutput,
-    color: 'never',
-  });
+  const result = await withStateBackendRetry(
+    () => stack.up({ onOutput: options.onOutput, color: 'never' }),
+    'up',
+  );
   // Flatten outputs: { foo: { value: 'bar', secret: false } } → { foo: 'bar' }
   const outputs = {};
   for (const [key, { value }] of Object.entries(result.outputs || {})) {
@@ -221,11 +253,17 @@ export async function destroyStack(stackName, program, options = {}) {
   // treats it as a hard error — surfaced in orphan-stack cleanup as
   // "server not found (not_found, ...)".
   try {
-    await stack.refresh({ onOutput: options.onOutput, color: 'never' });
+    await withStateBackendRetry(
+      () => stack.refresh({ onOutput: options.onOutput, color: 'never' }),
+      'pre-destroy refresh',
+    );
   } catch (err) {
     console.error(`[pulumi] pre-destroy refresh warning: ${err.message?.split('\n')[0] || err}`);
   }
-  await stack.destroy({ onOutput: options.onOutput, color: 'never' });
+  await withStateBackendRetry(
+    () => stack.destroy({ onOutput: options.onOutput, color: 'never' }),
+    'destroy',
+  );
   await stack.workspace.removeStack(stackName);
   return { destroyed: true };
 }
@@ -290,15 +328,6 @@ export function classifyK3sTokenProbe({ outputs, error } = {}) {
   };
 }
 
-/**
- * Refresh the stack's view of reality without applying program changes.
- * Useful before a partial scale operation.
- */
-export async function refreshStack(stackName, program, options = {}) {
-  const stack = await getOrCreateStack(stackName, program, options);
-  await stack.refresh({ onOutput: options.onOutput, color: 'never' });
-}
-
 /**
  * List stack names that exist in the configured backend for this project.
  * Used by `destroy` to surface orphans (stacks without a matching envConfig).

package/src/lib/images.js

@@ -0,0 +1,17 @@
+/**
+ * Single source of truth for the pre-published, multi-arch db image
+ * (supabase/postgres + wal-g). Built once per version by
+ * .github/workflows/publish-db-image.yml; pulled (never built) by deploys.
+ * Bumping the tag here + Dockerfile is the whole version-bump surface.
+ */
+// Publish to ghcr (GitHub Container Registry) under the hyperformant org
+// (this repo is hyperformant/vibecarbon). The package must be set to PUBLIC
+// so k3s/compose nodes pull without a secret. Single source of truth for the
+// tag — bump here + the Dockerfile to cut a new version.
+export const DB_IMAGE = 'ghcr.io/hyperformant/postgres';
+export const DB_IMAGE_TAG = '15.8.1.085-walg3.0.5';
+
+/** @returns {string} e.g. "ghcr.io/hyperformant/postgres:15.8.1.085-walg3.0.5" */
+export function dbImageRef() {
+  return `${DB_IMAGE}:${DB_IMAGE_TAG}`;
+}

package/src/lib/licensing/index.js

@@ -9,7 +9,7 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from '
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { c } from '../colors.js';
-import { allowsFlag as _allowsFlag, getTier, TIERS } from './tiers.js';
+import { getTier, TIERS } from './tiers.js';
 import { validateLicenseKey } from './validator.js';
 
 // License storage location
@@ -165,32 +165,6 @@ export function deactivateLicense() {
   }
 }
 
-/**
- * Check if the current license allows a specific deployment mode
- * @param {string} deploymentFlag - The deployment flag (e.g., '--k8s', '--ha')
- * @returns {object} Access check result
- */
-export function checkDeploymentAccess(deploymentFlag) {
-  const license = getLicense();
-
-  // If licensing is disabled in the validator, allow everything
-  if (license.licensingDisabled) {
-    return {
-      allowed: true,
-      tier: license.tier,
-      licensingDisabled: true,
-    };
-  }
-
-  const allowed = _allowsFlag(license.tier, deploymentFlag);
-
-  return {
-    allowed,
-    tier: license.tier,
-    requiredTier: allowed ? license.tier : 'diamond',
-  };
-}
-
 /**
  * Guard function: require any paid license or exit with upgrade message
  * @param {string} commandName - The command that requires a license
@@ -222,38 +196,6 @@ export function requireLicense(commandName) {
   process.exit(0);
 }
 
-/**
- * Get a formatted status message for the current license
- * @returns {string} Status message
- */
-export function getLicenseStatus() {
-  const license = getLicense();
-
-  if (!license.active) {
-    return `License: Graphite tier (free, no license activated)
-Features: ${TIERS.graphite.features.join(', ')}
-
-Upgrade to deploy:
-  Diamond ($149 lifetime)   — deploy to production, indie & startup use
-  Fullerene ($499 lifetime) — deploy for clients & agencies, commercial use rights
-
-Purchase at https://vibecarbon.dev/pricing`;
-  }
-
-  let status = `License: ${license.displayName}
-Customer ID: ${license.customerId}
-Activated: ${license.activatedAt}
-Features: ${license.features.join(', ')}
-Max servers: ${license.maxServers === Infinity ? 'Unlimited' : license.maxServers}
-Expires: Never (lifetime license)`;
-
-  if (license.devMode) {
-    status += '\n\n[Development Mode - Signature not verified]';
-  }
-
-  return status;
-}
-
 // Re-export tier utilities
 export { allowsFlag, compareTiers, getRequiredTier, getTier, TIERS } from './tiers.js';
 export { generateDevLicenseKey, validateLicenseKey } from './validator.js';

package/src/lib/licensing/tiers.js

@@ -157,14 +157,6 @@ export function getRequiredTier(flag) {
   return 'diamond';
 }
 
-/**
- * Get all tier names
- * @returns {string[]} Array of tier names
- */
-export function getTierNames() {
-  return Object.keys(TIERS);
-}
-
 /**
  * Compare two tiers and return which one is higher
  * @param {string} tierA - First tier name

package/src/lib/pod-backups.js

@@ -0,0 +1,53 @@
+/**
+ * List Supabase database backups stored inside the Postgres pod's /backups dir
+ * (k8s mode, used when an env has no S3 configured). Shared by `backup` and
+ * `restore` so the parsing of `ls` output lives in exactly one place.
+ */
+
+import { getPostgresPod, sshKubectl } from './ssh.js';
+
+/**
+ * @param {string} ip - master node IP
+ * @param {string} sshKeyPath - path to the deploy SSH key
+ * @param {{ sort?: 'recent' | 'largest' }} [options]
+ *   - 'recent' (default) → newest first (`ls -lt`); restore lists by recency.
+ *   - 'largest'          → biggest first with human-readable sizes (`ls -lhS`);
+ *     backup lists by size.
+ * @returns {Array<{ size: string, date: string, name: string }>} parsed entries
+ *   (empty array if the pod is unreachable or holds no backups)
+ */
+export function listPodBackups(ip, sshKeyPath, { sort = 'recent' } = {}) {
+  const pod = getPostgresPod(ip, sshKeyPath);
+  const lsFlags = sort === 'largest' ? '-lhS' : '-lt';
+
+  try {
+    const output = sshKubectl(ip, sshKeyPath, [
+      'exec',
+      '-n',
+      'vibecarbon',
+      pod,
+      '--',
+      'sh',
+      '-c',
+      `ls ${lsFlags} /backups/*_full.tar.gz /backups/*.sql.gz 2>/dev/null || echo NO_BACKUPS`,
+    ]);
+
+    if (output === 'NO_BACKUPS' || !output) {
+      return [];
+    }
+
+    return output
+      .split('\n')
+      .filter((line) => line.includes('.tar.gz') || line.includes('.sql.gz'))
+      .map((line) => {
+        const parts = line.split(/\s+/);
+        return {
+          size: parts[4],
+          date: `${parts[5]} ${parts[6]} ${parts[7]}`,
+          name: parts[parts.length - 1].replace('/backups/', ''),
+        };
+      });
+  } catch {
+    return [];
+  }
+}

package/src/lib/providers/index.js

@@ -74,14 +74,6 @@ export function listProviders() {
   }));
 }
 
-/**
- * Get list of provider IDs
- * @returns {string[]}
- */
-export function getProviderIds() {
-  return Object.keys(PROVIDERS);
-}
-
 /**
  * Check if a provider exists
  * @param {string} providerName - Provider name to check
@@ -91,14 +83,6 @@ export function hasProvider(providerName) {
   return providerName.toLowerCase() in PROVIDERS;
 }
 
-/**
- * Get the default provider ID
- * @returns {string}
- */
-export function getDefaultProvider() {
-  return 'hetzner';
-}
-
 /**
  * Validate provider configuration
  * @param {string} providerName - Provider name
@@ -128,37 +112,6 @@ export function validateProviderConfig(providerName, config) {
   return { valid: errors.length === 0, errors };
 }
 
-/**
- * Format provider regions for display (e.g., in CLI prompts)
- * @param {string} providerName - Provider name
- * @returns {Array<{value: string, label: string}>}
- */
-export function formatRegionsForSelect(providerName) {
-  const Provider = PROVIDERS[providerName.toLowerCase()];
-  if (!Provider) return [];
-
-  return Object.entries(Provider.REGIONS).map(([id, name]) => ({
-    value: id,
-    label: `${id} - ${name}`,
-  }));
-}
-
-/**
- * Format provider server types for display
- * @param {string} providerName - Provider name
- * @returns {Array<{value: string, label: string, hint: string}>}
- */
-export function formatServerTypesForSelect(providerName) {
-  const Provider = PROVIDERS[providerName.toLowerCase()];
-  if (!Provider) return [];
-
-  return Object.entries(Provider.SERVER_TYPES).map(([id, spec]) => ({
-    value: id,
-    label: id,
-    hint: `${spec.vcpu} vCPU, ${spec.ram}GB RAM, ${spec.disk}GB SSD - ${spec.price}`,
-  }));
-}
-
 // Re-export base class and providers for direct access
 export { BaseProvider } from './base.js';
 export { HetznerProvider } from './hetzner.js';

package/src/lib/ssh.js

@@ -94,6 +94,18 @@ function sshHostKeyOpts(env, { firstConnect = false } = {}) {
   return opts;
 }
 
+/**
+ * The no-host-key-pinning SSH option set as a single space-joined string,
+ * for the compose deploy path's string-command runners (sshRun/sshRunAsync
+ * in compose/index.js) and raw `ssh ${SSH_OPTS}` interpolations.
+ *
+ * Derived from sshHostKeyOpts() so the string form can never drift from the
+ * argv form — the historical footgun was compose/ha.js hand-copying this
+ * string and silently dropping the ServerAlive keepalives, letting a
+ * banner-exchange hang stall an HA deploy for ~600s.
+ */
+export const NO_PIN_SSH_OPTS = sshHostKeyOpts().join(' ');
+
 /**
  * Execute a command on a remote server via SSH using argv form.
  *