vibecarbon 0.5.0 → 0.6.0

package/src/lib/billing/stripe-catalog.js

@@ -0,0 +1,152 @@
+/**
+ * Stripe catalog fetch — pulls the customer's live products + prices so
+ * `vibecarbon configure` (Billing → Stripe) can let them pick which products to
+ * activate and snapshot the display fields into the project.
+ *
+ * Contains NO secrets in its output — product names, amounts, and price IDs are
+ * all public. The secret key only ever travels in the Authorization header of
+ * the live API call; it is never persisted by this module.
+ */
+
+import { fetchWithRetry } from '../fetch-retry.js';
+
+/**
+ * @typedef {Object} NormalizedPrice
+ * @property {string} priceId             Stripe price id (`price_...`).
+ * @property {string} name                Expanded product name (falls back to nickname/id).
+ * @property {string | null} description  Expanded product description.
+ * @property {string[]} features          Product marketing features (names).
+ * @property {number} amount              Smallest currency unit (cents).
+ * @property {string} currency            Lowercase ISO 4217 (e.g. `usd`).
+ * @property {'month' | 'year' | 'one_time'} interval
+ * @property {'recurring' | 'one_time'} type
+ */
+
+/**
+ * Format a smallest-unit amount + currency for human-readable select labels,
+ * e.g. (1900, 'usd') -> "$19.00". Falls back to a generic "<major> <CODE>"
+ * form for currencies Intl doesn't render with a symbol.
+ *
+ * @param {number} amount   Smallest currency unit (cents).
+ * @param {string} currency Lowercase ISO 4217 code.
+ * @returns {string}
+ */
+export function formatAmount(amount, currency) {
+  const code = (currency || 'usd').toUpperCase();
+  try {
+    return new Intl.NumberFormat('en-US', {
+      style: 'currency',
+      currency: code,
+    }).format(amount / 100);
+  } catch {
+    // Unknown / unsupported currency code — render the major-unit number plainly.
+    return `${(amount / 100).toFixed(2)} ${code}`;
+  }
+}
+
+/**
+ * Normalize a raw Stripe price object (with `product` expanded) into the shape
+ * our billing catalog stores. Returns null for prices we can't represent
+ * (metered / null `unit_amount`) so the caller can skip them.
+ *
+ * @param {any} price
+ * @returns {NormalizedPrice | null}
+ */
+function normalizePrice(price) {
+  if (!price || typeof price !== 'object') return null;
+  // Metered prices have a null unit_amount — we can't display a fixed amount,
+  // so skip them rather than emit a bogus 0.
+  if (price.unit_amount === null || price.unit_amount === undefined) return null;
+
+  const product = price.product && typeof price.product === 'object' ? price.product : null;
+  const name = product?.name || price.nickname || price.id;
+  const description = product?.description ?? null;
+  // Stripe product marketing_features is an array of { name }; flatten to the
+  // feature strings, dropping any with an empty/missing name.
+  const features = Array.isArray(product?.marketing_features)
+    ? product.marketing_features.map((f) => f?.name).filter(Boolean)
+    : [];
+
+  const recurring = price.recurring && typeof price.recurring === 'object' ? price.recurring : null;
+  // Our catalog type only allows month/year/one_time. Use the Stripe interval
+  // when it's month or year; for any other recurring interval (week/day) fall
+  // back to a safe 'month' default; non-recurring prices are one_time.
+  let interval;
+  if (recurring) {
+    interval =
+      recurring.interval === 'month' || recurring.interval === 'year'
+        ? recurring.interval
+        : 'month';
+  } else {
+    interval = 'one_time';
+  }
+
+  return {
+    priceId: price.id,
+    name,
+    description,
+    features,
+    amount: price.unit_amount,
+    currency: price.currency,
+    interval,
+    type: recurring ? 'recurring' : 'one_time',
+  };
+}
+
+/**
+ * Fetch the customer's active Stripe prices (with products expanded),
+ * normalize them, and return them sorted by amount ascending.
+ *
+ * Single page (limit=100) — fine for MVP. If Stripe reports `has_more`, we log
+ * a note but don't paginate; a customer with >100 active prices is well past
+ * the activate-products use case this serves.
+ *
+ * @param {string} secretKey Stripe secret key (`sk_test_...` / `sk_live_...`).
+ * @returns {Promise<NormalizedPrice[]>} Sorted by amount ascending.
+ * @throws {Error} on non-OK response (e.g. 401 invalid key) so the caller can
+ *   warn and skip catalog writing.
+ */
+export async function listStripePrices(secretKey) {
+  // Stripe wants form-encoded query params; `expand[]=data.product` must be
+  // sent literally (URLSearchParams would percent-encode the brackets, which
+  // Stripe rejects), so build the query string by hand.
+  const url = 'https://api.stripe.com/v1/prices?active=true&limit=100&expand[]=data.product';
+
+  const response = await fetchWithRetry(url, {
+    headers: { Authorization: `Bearer ${secretKey}` },
+    label: 'stripe prices',
+  });
+
+  if (!response.ok) {
+    // Surface Stripe's own error message when present — its body is
+    // { error: { message, type, ... } } for auth/validation failures.
+    let detail = `HTTP ${response.status}`;
+    try {
+      const body = await response.json();
+      if (body?.error?.message) detail = body.error.message;
+    } catch {
+      // Non-JSON body (rare) — keep the status-code detail.
+    }
+    throw new Error(`Stripe price fetch failed: ${detail}`);
+  }
+
+  const body = await response.json();
+  const rows = Array.isArray(body?.data) ? body.data : [];
+  const prices = [];
+  for (const price of rows) {
+    const normalized = normalizePrice(price);
+    if (normalized) prices.push(normalized);
+  }
+
+  if (body?.has_more) {
+    console.error(
+      '[stripe] more than 100 active prices exist; only the first page was loaded. Activation uses this page.',
+    );
+  }
+
+  // Sort by amount ascending so the activate multiselect and the snapshot both
+  // present cheapest-first (free tiers, then paid).
+  prices.sort((a, b) => a.amount - b.amount);
+
+  return prices;
+}

package/src/lib/billing/write-catalog.js

@@ -0,0 +1,123 @@
+/**
+ * write-catalog — serializes a billing catalog snapshot into the project's
+ * `src/shared/billing-catalog.ts` data module.
+ *
+ * The companion `billing-catalog.types.ts` ships in the template and is never
+ * regenerated; this writer only replaces the data file so `vibecarbon
+ * configure` (Billing → Stripe) can refresh pricing without touching types.
+ */
+
+import { existsSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * Escaped TS string literal matching the repo's biome style: prefer single
+ * quotes, but switch to double quotes when the string contains more single than
+ * double quotes (biome's "fewer escapes" rule, e.g. `"Developer's Plan"`).
+ */
+function tsString(s) {
+  const str = String(s);
+  const singles = (str.match(/'/g) || []).length;
+  const doubles = (str.match(/"/g) || []).length;
+  const quote = singles > doubles ? '"' : "'";
+  const escaped = str
+    .replace(/\\/g, '\\\\')
+    .replaceAll(quote, `\\${quote}`)
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/\t/g, '\\t');
+  return `${quote}${escaped}${quote}`;
+}
+
+const IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const LINE_WIDTH = 80; // biome's default; keep generated output collapse/break-equivalent
+
+function isPrimitive(v) {
+  return v === null || typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean';
+}
+
+/**
+ * Serialize plain JSON-ish data (objects / strings / numbers / booleans / null)
+ * into a biome-conformant TS object literal: unquoted identifier keys, single
+ * quotes, trailing commas, two-space indent. Avoids the double-quoted, quoted-key
+ * output of JSON.stringify, which fails the project's lint gate.
+ *
+ * `column` is the column at which this value begins, used to mirror biome's
+ * "inline an array if it fits within the line width, else break one-per-line"
+ * rule for primitive arrays (e.g. short `features` lists stay on one line).
+ */
+function serializeTs(value, indentLevel = 0, column = 0) {
+  if (value === null) return 'null';
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+  if (typeof value === 'string') return tsString(value);
+
+  const pad = '  '.repeat(indentLevel);
+  const padInner = '  '.repeat(indentLevel + 1);
+
+  if (Array.isArray(value)) {
+    if (value.length === 0) return '[]';
+    if (value.every(isPrimitive)) {
+      const inline = `[${value.map((v) => serializeTs(v)).join(', ')}]`;
+      // +1 for the trailing comma that follows on the same line.
+      if (column + inline.length + 1 <= LINE_WIDTH) return inline;
+    }
+    const items = value
+      .map((v) => `${padInner}${serializeTs(v, indentLevel + 1, padInner.length)},`)
+      .join('\n');
+    return `[\n${items}\n${pad}]`;
+  }
+
+  const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+  if (entries.length === 0) return '{}';
+  const lines = entries
+    .map(([k, v]) => {
+      const key = IDENT_RE.test(k) ? k : tsString(k);
+      const prefix = `${padInner}${key}: `;
+      return `${prefix}${serializeTs(v, indentLevel + 1, prefix.length)},`;
+    })
+    .join('\n');
+  return `{\n${lines}\n${pad}}`;
+}
+
+/**
+ * Serialize + write the billing catalog into `<cwd>/src/shared/billing-catalog.ts`.
+ *
+ * The emitted module mirrors the shipped default's shape exactly: the
+ * `import type { BillingCatalog }` line, a generated-file header, and
+ * `export const billingCatalog: BillingCatalog = <json>;`.
+ *
+ * If `<cwd>/src/shared` does not exist this isn't an app project root — return
+ * false and skip rather than throwing, so the configure flow never blocks on a
+ * missing snapshot target.
+ *
+ * @param {string} cwd Project root.
+ * @param {{ provider: string | null, generatedAt: string | null, tiers: Array<Record<string, unknown>> }} catalog
+ *   `tiers` is a price-sorted list of activated products (CatalogTier[]).
+ * @returns {boolean} true if written, false if skipped (no src/shared).
+ */
+export function writeBillingCatalog(cwd, catalog) {
+  const sharedDir = join(cwd, 'src', 'shared');
+  if (!existsSync(sharedDir)) return false;
+
+  const targetPath = join(sharedDir, 'billing-catalog.ts');
+  // Emit a biome-conformant TS literal (single quotes, unquoted keys, trailing
+  // commas) so the generated file passes the project's lint gate as-is.
+  const body = serializeTs(catalog, 0);
+
+  const content = `/**
+ * Billing catalog snapshot — GENERATED by \`vibecarbon configure\` (Billing →
+ * Stripe). Do not hand-edit: re-run \`vibecarbon configure\` to refresh after
+ * changing a price or product name in the provider dashboard, then redeploy.
+ *
+ * Contains NO secrets — product names, amounts, and price IDs are all public.
+ * Types live in \`billing-catalog.types.ts\` (not regenerated).
+ */
+
+import type { BillingCatalog } from './billing-catalog.types';
+
+export const billingCatalog: BillingCatalog = ${body};
+`;
+
+  writeFileSync(targetPath, content);
+  return true;
+}

package/src/lib/ci-setup.js

@@ -449,7 +449,7 @@ export async function commitAndPushWorkflow(cwd = process.cwd()) {
 let _ghAuthChecked = false;
 
 export async function ensureCIImageReady(options = {}) {
-  const { yes = false, tracker, cwd = process.cwd() } = options;
+  const { yes = false, tracker, cwd = process.cwd(), buildArgs = null } = options;
 
   if (!checkDependency('gh', 'GitHub CLI')) {
     throw new Error(
@@ -473,6 +473,16 @@ export async function ensureCIImageReady(options = {}) {
     );
   }
 
+  // Seed the VITE_* build args as repo variables BEFORE the workflow runs, so
+  // the CI-built image bakes real values instead of empty strings. Must
+  // precede commitAndPushWorkflow / workflow dispatch below (both trigger the
+  // build). Skipped when the caller passes no buildArgs (e.g. older callers).
+  if (buildArgs && Object.keys(buildArgs).length > 0) {
+    const { seedBuildVars } = await import('./github-environments.js');
+    const applied = await seedBuildVars(buildArgs);
+    if (applied.length) p.log.info(`Seeded ${applied.length} VITE build var(s) for CI`);
+  }
+
   // Install workflow if missing — first-deploy case
   const installed = installWorkflowFile(cwd);
   if (installed) {

package/src/lib/config-registry.js

@@ -0,0 +1,116 @@
+/**
+ * Single source of truth for the env keys that `vibecarbon configure` manages.
+ *
+ * `configure` writes feature config/secrets to `.env.local`/`.env`. Several
+ * deploy paths each need to know *which* keys to propagate and *how* to treat
+ * each one (build-time vs runtime, secret vs non-secret). Historically each
+ * path carried its own hand-maintained list, so a key added to one feature
+ * silently failed to reach the cloud on another path. This registry is the one
+ * list they all derive from; coverage tests assert registry ⊆ each path.
+ *
+ * Scope: feature keys only (billing, OAuth, SMTP, analytics). Infra secrets
+ * (DB_PASSWORD/JWT_SECRET/ANON_KEY/…) are *generated*, not configured, and
+ * carry k8s-specific Supabase-chart translation logic — they stay local to the
+ * k8s deploy modules.
+ *
+ * Classification:
+ *   - 'client-build'   → baked into the client bundle at image build time
+ *                        (VITE_*). A change must force an image rebuild.
+ *   - 'runtime-config' → non-secret server/auth runtime env.
+ *   - 'runtime-secret' → secret server/auth runtime env.
+ *
+ * Keep this aligned with what `configure` writes (src/configure.js) and what
+ * the app/auth services read (carbon/src/server/lib/env.ts + the GoTrue
+ * `auth` service wiring in carbon/docker-compose.yml). Dependency-free on
+ * purpose so deploy code can import it without pulling in @clack/prompts.
+ */
+
+/**
+ * @typedef {'client-build' | 'runtime-config' | 'runtime-secret'} ConfigClass
+ * @typedef {{ key: string, class: ConfigClass, feature: string }} ConfigKey
+ */
+
+/** @type {ConfigKey[]} */
+export const CONFIG_KEYS = [
+  // ---- Billing: provider selection ----
+  { key: 'BILLING_PROVIDER', class: 'runtime-config', feature: 'billing' },
+
+  // ---- Billing: Stripe ----
+  { key: 'STRIPE_SECRET_KEY', class: 'runtime-secret', feature: 'billing' },
+  { key: 'STRIPE_WEBHOOK_SECRET', class: 'runtime-secret', feature: 'billing' },
+  { key: 'STRIPE_PRICE_STARTER', class: 'runtime-config', feature: 'billing' },
+  { key: 'STRIPE_PRICE_PRO', class: 'runtime-config', feature: 'billing' },
+
+  // ---- Billing: Paddle ----
+  { key: 'PADDLE_API_KEY', class: 'runtime-secret', feature: 'billing' },
+  { key: 'PADDLE_WEBHOOK_SECRET', class: 'runtime-secret', feature: 'billing' },
+  { key: 'PADDLE_ENVIRONMENT', class: 'runtime-config', feature: 'billing' },
+  { key: 'PADDLE_PRICE_STARTER', class: 'runtime-config', feature: 'billing' },
+  { key: 'PADDLE_PRICE_PRO', class: 'runtime-config', feature: 'billing' },
+
+  // ---- Billing: Polar ----
+  { key: 'POLAR_ACCESS_TOKEN', class: 'runtime-secret', feature: 'billing' },
+  { key: 'POLAR_WEBHOOK_SECRET', class: 'runtime-secret', feature: 'billing' },
+  { key: 'POLAR_ORGANIZATION_ID', class: 'runtime-config', feature: 'billing' },
+  { key: 'POLAR_PRICE_STARTER', class: 'runtime-config', feature: 'billing' },
+  { key: 'POLAR_PRICE_PRO', class: 'runtime-config', feature: 'billing' },
+
+  // ---- OAuth: Google (consumed by the GoTrue auth service) ----
+  { key: 'GOOGLE_ENABLED', class: 'runtime-config', feature: 'oauth' },
+  { key: 'GOOGLE_CLIENT_ID', class: 'runtime-config', feature: 'oauth' },
+  { key: 'GOOGLE_CLIENT_SECRET', class: 'runtime-secret', feature: 'oauth' },
+
+  // ---- OAuth: Microsoft ----
+  { key: 'MICROSOFT_ENABLED', class: 'runtime-config', feature: 'oauth' },
+  { key: 'MICROSOFT_CLIENT_ID', class: 'runtime-config', feature: 'oauth' },
+  { key: 'MICROSOFT_CLIENT_SECRET', class: 'runtime-secret', feature: 'oauth' },
+  { key: 'MICROSOFT_TENANT_ID', class: 'runtime-config', feature: 'oauth' },
+
+  // ---- SMTP / Email (shared by the app and the auth service) ----
+  // Canonical name is SMTP_PASS everywhere (app env.ts, compose, manifests).
+  { key: 'SMTP_HOST', class: 'runtime-config', feature: 'smtp' },
+  { key: 'SMTP_PORT', class: 'runtime-config', feature: 'smtp' },
+  { key: 'SMTP_USER', class: 'runtime-config', feature: 'smtp' },
+  { key: 'SMTP_PASS', class: 'runtime-secret', feature: 'smtp' },
+  { key: 'SMTP_ADMIN_EMAIL', class: 'runtime-config', feature: 'smtp' },
+  { key: 'SMTP_SENDER_NAME', class: 'runtime-config', feature: 'smtp' },
+
+  // ---- Analytics (client-side, baked at build time) ----
+  { key: 'VITE_PLAUSIBLE_DOMAIN', class: 'client-build', feature: 'analytics' },
+  { key: 'VITE_PLAUSIBLE_SCRIPT_URL', class: 'client-build', feature: 'analytics' },
+];
+
+/** Keys of a given classification. @param {ConfigClass} cls */
+function keysOfClass(cls) {
+  return CONFIG_KEYS.filter((k) => k.class === cls).map((k) => k.key);
+}
+
+/** Secret runtime keys (Stripe/Paddle/Polar secrets, OAuth secrets, SMTP_PASS). */
+export function featureSecretKeys() {
+  return keysOfClass('runtime-secret');
+}
+
+/** Non-secret runtime keys (BILLING_PROVIDER, SMTP_HOST, GOOGLE_CLIENT_ID, …). */
+export function featureConfigKeys() {
+  return keysOfClass('runtime-config');
+}
+
+/** All runtime keys (secret + non-secret) — everything that must reach a pod/container at runtime. */
+export function featureRuntimeKeys() {
+  return [...featureConfigKeys(), ...featureSecretKeys()];
+}
+
+/** Client build-time keys (VITE_*) — a change must force an image rebuild. */
+export function clientBuildKeys() {
+  return keysOfClass('client-build');
+}
+
+/** Whether `key` is a configure-managed secret. @param {string} key */
+export function isSecretKey(key) {
+  return CONFIG_KEYS.some((k) => k.key === key && k.class === 'runtime-secret');
+}
+
+/** All keys belonging to a feature, in registry order. @param {string} feature */
+export function featureKeys(feature) {
+  return CONFIG_KEYS.filter((k) => k.feature === feature).map((k) => k.key);
+}

package/src/lib/deploy/compose/build-args.js

@@ -58,6 +58,12 @@ export function collectComposeBuildArgs(cwd, opts = {}) {
   // server's runtime .env so the client + server agree on the URL.
   if (projectName) args.VITE_PROJECT_NAME = projectName;
   if (domain) args.VITE_SUPABASE_URL = `https://api.${domain}`;
+  // Public canonical URL (apex domain) baked into the client at build time —
+  // drives og:url / og:image / twitter:image and the generated sitemap. Distinct
+  // from VITE_SUPABASE_URL's `api.` host. Without this the client falls back to
+  // the create-time SITE_URL (localhost), so social previews + sitemap point at
+  // localhost on every deployed site.
+  if (domain) args.VITE_PUBLIC_URL = `https://${domain}`;
   return args;
 }
 

package/src/lib/deploy/compose/ha.js

@@ -215,7 +215,7 @@ async function deleteFirewallByName(name, hetznerHeaders, deadlineMs = 30_000) {
  * 3. Set wal_level=replica and max_wal_senders
  * 4. Restart PostgreSQL to apply changes
  */
-function configurePrimaryReplication(primaryIp, standbyIp, sshKeyPath, projectName) {
+async function configurePrimaryReplication(primaryIp, standbyIp, sshKeyPath, projectName) {
   const remoteDir = `/opt/${projectName}`;
   // replPassword is generated at create time from crypto.randomBytes and is
   // restricted to base64url characters — no shell escaping needed.
@@ -264,7 +264,7 @@ BEGIN
 END $$;
 `;
   const createRoleB64 = Buffer.from(createRoleSql).toString('base64');
-  sshRun(
+  await sshRun(
     primaryIp,
     sshKeyPath,
     `cd ${remoteDir} && echo ${createRoleB64} | base64 -d | docker compose exec -T db psql -U supabase_admin -d postgres`,
@@ -279,7 +279,7 @@ END $$;
   // pg_hba_file_rules reflected the actual /etc loaded contents (no replicator
   // entry). Resolve the path at runtime via SHOW hba_file so we don't break
   // again if the image moves the file.
-  sshRun(
+  await sshRun(
     primaryIp,
     sshKeyPath,
     `cd ${remoteDir} && HBA_FILE=$(docker compose exec -T db psql -U supabase_admin -d postgres -tAc 'SHOW hba_file;' | tr -d '[:space:]') && ` +
@@ -289,7 +289,7 @@ END $$;
   );
 
   // Set WAL settings for replication
-  sshRun(
+  await sshRun(
     primaryIp,
     sshKeyPath,
     `cd ${remoteDir} && docker compose exec -T db psql -U supabase_admin -d postgres -c "ALTER SYSTEM SET wal_level = 'replica';" && docker compose exec -T db psql -U supabase_admin -d postgres -c "ALTER SYSTEM SET max_wal_senders = 5;" && docker compose exec -T db psql -U supabase_admin -d postgres -c "ALTER SYSTEM SET wal_keep_size = '512MB';"`,
@@ -297,14 +297,14 @@ END $$;
   );
 
   // Restart PostgreSQL to apply WAL changes
-  sshRun(primaryIp, sshKeyPath, `cd ${remoteDir} && docker compose restart db`, {
+  await sshRun(primaryIp, sshKeyPath, `cd ${remoteDir} && docker compose restart db`, {
     timeout: 60_000,
   });
 
   // Wait for PostgreSQL to be ready again
   for (let i = 0; i < 15; i++) {
     try {
-      sshRun(
+      await sshRun(
         primaryIp,
         sshKeyPath,
         `cd ${remoteDir} && docker compose exec -T db pg_isready -U postgres`,
@@ -359,7 +359,7 @@ BEGIN
   END IF;
 END $$;`;
   const ensureSlotB64 = Buffer.from(ensureSlotSql).toString('base64');
-  sshRun(
+  await sshRun(
     primaryIp,
     sshKeyPath,
     `cd ${remoteDir} && echo ${ensureSlotB64} | base64 -d | docker compose exec -T db psql -U supabase_admin -d postgres`,
@@ -367,7 +367,7 @@ END $$;`;
   );
 
   // Stop the standby database
-  sshRun(standbyIp, sshKeyPath, `cd ${remoteDir} && docker compose stop db`, {
+  await sshRun(standbyIp, sshKeyPath, `cd ${remoteDir} && docker compose stop db`, {
     timeout: 60_000,
   });
 
@@ -430,7 +430,7 @@ grep -q '^primary_slot_name' /var/lib/postgresql/data/postgresql.auto.conf
 `;
   const basebackupB64 = Buffer.from(basebackupScript).toString('base64');
   try {
-    sshRun(
+    await sshRun(
       standbyIp,
       sshKeyPath,
       // Use bash, not sh: the supabase/postgres image symlinks /bin/sh →
@@ -465,7 +465,7 @@ grep -q '^primary_slot_name' /var/lib/postgresql/data/postgresql.auto.conf
   }
 
   // Start the standby database
-  sshRun(standbyIp, sshKeyPath, `cd ${remoteDir} && docker compose start db`, {
+  await sshRun(standbyIp, sshKeyPath, `cd ${remoteDir} && docker compose start db`, {
     timeout: 60_000,
   });
 
@@ -496,7 +496,7 @@ grep -q '^primary_slot_name' /var/lib/postgresql/data/postgresql.auto.conf
   let lastPrimarySignal = '';
   for (let i = 0; i < PROBE_BUDGET_S / PROBE_INTERVAL_S; i++) {
     try {
-      const result = sshRun(
+      const result = await sshRun(
         standbyIp,
         sshKeyPath,
         `cd ${remoteDir} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc 'SELECT pg_is_in_recovery()'`,
@@ -508,7 +508,7 @@ grep -q '^primary_slot_name' /var/lib/postgresql/data/postgresql.auto.conf
       // Retry — database may still be applying initial WAL, hot_standby off
     }
     try {
-      const primaryResult = sshRun(
+      const primaryResult = await sshRun(
         primaryIp,
         sshKeyPath,
         `cd ${remoteDir} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc "SELECT state FROM pg_stat_replication WHERE client_addr = '${standbyIp}'::inet"`,
@@ -629,7 +629,7 @@ async function openReplicationPortHetznerFirewall(serverName, peerIp, hetznerTok
  */
 async function isPrimaryReachable(primaryIp, sshKeyPath, remoteDir) {
   try {
-    const result = sshRun(
+    const result = await sshRun(
       primaryIp,
       sshKeyPath,
       `cd ${remoteDir} && docker compose exec -T db pg_isready -U postgres -t 3`,
@@ -1122,7 +1122,7 @@ export async function deployComposeHA(options) {
   const healthConfirmed = await perfAsync('deploy.ha.compose.primaryHealthProbe', async () => {
     for (let i = 0; i < 30; i++) {
       try {
-        const health = sshRun(
+        const health = await sshRun(
           primaryIp,
           sshKeyPath,
           `cd /opt/${projectName} && docker compose exec -T db pg_isready -h localhost -p 5432 2>/dev/null`,
@@ -1185,7 +1185,7 @@ export async function deployComposeHA(options) {
   // dominated by pg_basebackup for the standby seed.
   await perfAsync('deploy.ha.replication.setup', async () => {
     onProgress('Configuring PostgreSQL replication on primary...');
-    configurePrimaryReplication(primaryIp, standbyIp, sshKeyPath, projectName);
+    await configurePrimaryReplication(primaryIp, standbyIp, sshKeyPath, projectName);
 
     onProgress('Configuring standby as hot replica...');
     let replicationOk = false;
@@ -1221,7 +1221,7 @@ export async function deployComposeHA(options) {
   let replActive = false;
   for (let i = 0; i < REPL_DELAYS_MS.length; i++) {
     try {
-      const count = sshRun(
+      const count = await sshRun(
         primaryIp,
         sshKeyPath,
         `cd /opt/${projectName} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc "SELECT count(*) FROM pg_stat_replication WHERE state = 'streaming'"`,
@@ -1597,7 +1597,7 @@ export async function waitForNewPrimaryApi(ip, sshKeyPath, domain, opts = {}) {
   let lastCode = '';
   for (let i = 0; i < attempts; i++) {
     try {
-      const code = runner(ip, sshKeyPath, cmd, { silent: true, timeout: 12_000 });
+      const code = await runner(ip, sshKeyPath, cmd, { silent: true, timeout: 12_000 });
       lastCode = typeof code === 'string' ? code.trim() : '';
       if (lastCode === '200') return true;
     } catch {
@@ -1746,9 +1746,9 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   // converted to "did not exit recovery mode after 5 attempts" because
   // attempts 2-5 hit the same not-in-recovery error and never re-checked.
   // RCA: compose-ha 2026-05-01 fanout4b failover.
-  const probeRecovery = () => {
+  const probeRecovery = async () => {
     try {
-      const r = sshRun(
+      const r = await sshRun(
         standbyServer.ip,
         sshKeyPath,
         `cd ${remoteDir} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc 'SELECT pg_is_in_recovery()'`,
@@ -1772,7 +1772,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   const MAX_PROMOTE_ATTEMPTS = 5;
   for (let attempt = 1; attempt <= MAX_PROMOTE_ATTEMPTS && !promoted; attempt++) {
     try {
-      const result = sshRun(
+      const result = await sshRun(
         standbyServer.ip,
         sshKeyPath,
         `cd ${remoteDir} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc "SELECT pg_promote(wait => true, wait_seconds => 120)"`,
@@ -1783,7 +1783,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
         promoted = true;
         break;
       }
-      const probeTrimmed = probeRecovery();
+      const probeTrimmed = await probeRecovery();
       if (probeTrimmed === 'f') {
         promoted = true;
         break;
@@ -1792,7 +1792,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
         `pg_promote returned ${JSON.stringify(trimmed)}; pg_is_in_recovery=${JSON.stringify(probeTrimmed)}`,
       );
     } catch (err) {
-      const probeTrimmed = probeRecovery();
+      const probeTrimmed = await probeRecovery();
       if (probeTrimmed === 'f') {
         promoted = true;
         break;
@@ -1809,7 +1809,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
     // instead of guessing. Best-effort — failover-step abort is what matters.
     let dbLogs = '';
     try {
-      dbLogs = sshRun(
+      dbLogs = await sshRun(
         standbyServer.ip,
         sshKeyPath,
         `cd ${remoteDir} && docker compose logs db --tail=60`,
@@ -1837,7 +1837,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   // promotion. Restart is cheap (~10s) and forces a clean reconnect.
   s.start('Restarting new-primary app-tier');
   try {
-    sshRun(
+    await sshRun(
       standbyServer.ip,
       sshKeyPath,
       `cd ${remoteDir} && docker compose restart supavisor auth rest realtime storage app`,
@@ -1868,7 +1868,7 @@ export async function failoverComposeHA(envName, envConfig, projectConfig, parse
   // Step 2: Stop old primary services to prevent split-brain
   s.start('Stopping old primary services');
   try {
-    sshRun(
+    await sshRun(
       primaryServer.ip,
       sshKeyPath,
       `cd ${remoteDir} && docker compose stop app auth rest realtime storage supavisor`,