vibecarbon 0.5.0 → 0.6.0

package/src/lib/providers/hetzner.js

@@ -10,6 +10,10 @@
 import { fetchWithRetry } from '../fetch-retry.js';
 import { BaseProvider } from './base.js';
 
+// Canonical link to Hetzner's live pricing. We don't hard-code prices anywhere
+// (they change), so surface this wherever a user would want current costs.
+export const HETZNER_PRICING_URL = 'https://www.hetzner.com/cloud/';
+
 export class HetznerProvider extends BaseProvider {
   static NAME = 'Hetzner Cloud';
   static API_BASE = 'https://api.hetzner.cloud/v1';
@@ -22,33 +26,68 @@ export class HetznerProvider extends BaseProvider {
     hil: 'Hillsboro, Oregon, USA',
   };
 
+  // Continent grouping for HA standby selection. The goal is to keep a primary
+  // and its failover standby on the same continent so cross-region replication
+  // (wal-g/S3 + Postgres streaming) doesn't pay a transatlantic RTT.
+  static REGION_CONTINENT = {
+    fsn1: 'eu',
+    nbg1: 'eu',
+    hel1: 'eu',
+    ash: 'na',
+    hil: 'na',
+  };
+
+  /**
+   * Default HA standby region for a given primary: a DIFFERENT region on the
+   * same continent, so failover stays intra-continent (a US primary fails over
+   * to the other US region, not across the Atlantic). Used as the pre-selected
+   * value in the interactive standby prompt and as the headless default.
+   * @param {string} primaryRegion
+   * @returns {string}
+   */
+  static getDefaultStandbyRegion(primaryRegion) {
+    const continent = HetznerProvider.REGION_CONTINENT[primaryRegion];
+    const sameContinent = Object.keys(HetznerProvider.REGION_CONTINENT).filter(
+      (r) => r !== primaryRegion && HetznerProvider.REGION_CONTINENT[r] === continent,
+    );
+    if (sameContinent.length > 0) {
+      // Keep the conventional nbg1<->fsn1 EU pairing where it applies.
+      if (primaryRegion === 'nbg1') return 'fsn1';
+      return sameContinent[0];
+    }
+    // No same-continent partner (e.g. a future single-region continent) —
+    // fall back to the robust EU default, but never to the primary itself.
+    return primaryRegion === 'nbg1' ? 'fsn1' : 'nbg1';
+  }
+
   // Offline fallback catalog — used when the API is unreachable or no token is available.
-  // Prices and availability are approximate; live data from fetchServerTypes() takes precedence.
+  // Specs only; availability is approximate and live data from fetchServerTypes() takes
+  // precedence. Prices are intentionally not hard-coded here — see HETZNER_PRICING_URL.
   static FALLBACK_SERVER_TYPES = {
-    cx23: { vcpu: 2, ram: 4, disk: 40, price: '€4.19/mo' },
-    cx33: { vcpu: 4, ram: 8, disk: 80, price: '€7.09/mo' },
-    cx43: { vcpu: 8, ram: 16, disk: 160, price: '€13.49/mo' },
-    cx53: { vcpu: 16, ram: 32, disk: 320, price: '€27.49/mo' },
-    cx22: { vcpu: 2, ram: 4, disk: 40, price: '€3.99/mo' },
-    cx32: { vcpu: 4, ram: 8, disk: 80, price: '€6.49/mo' },
-    cx42: { vcpu: 8, ram: 16, disk: 160, price: '€11.99/mo' },
-    cx52: { vcpu: 16, ram: 32, disk: 320, price: '€22.49/mo' },
-    cpx11: { vcpu: 2, ram: 2, disk: 40, price: '€7.99/mo' },
-    cpx21: { vcpu: 3, ram: 4, disk: 80, price: '€13.99/mo' },
-    cpx22: { vcpu: 3, ram: 4, disk: 80, price: '€13.99/mo' },
-    cpx31: { vcpu: 4, ram: 8, disk: 160, price: '€25.49/mo' },
-    cpx41: { vcpu: 8, ram: 16, disk: 240, price: '€36.49/mo' },
-    cpx51: { vcpu: 16, ram: 32, disk: 360, price: '€50.49/mo' },
-    cax11: { vcpu: 2, ram: 4, disk: 40, price: '€4.49/mo' },
-    cax21: { vcpu: 4, ram: 8, disk: 80, price: '€7.99/mo' },
-    cax31: { vcpu: 8, ram: 16, disk: 160, price: '€15.99/mo' },
-    cax41: { vcpu: 16, ram: 32, disk: 320, price: '€31.49/mo' },
-    ccx13: { vcpu: 2, ram: 8, disk: 80, price: '€15.99/mo' },
-    ccx23: { vcpu: 4, ram: 16, disk: 160, price: '€31.49/mo' },
-    ccx33: { vcpu: 8, ram: 32, disk: 240, price: '€62.49/mo' },
-    ccx43: { vcpu: 16, ram: 64, disk: 360, price: '€124.99/mo' },
-    ccx53: { vcpu: 32, ram: 128, disk: 600, price: '€249.99/mo' },
-    ccx63: { vcpu: 48, ram: 192, disk: 960, price: '€374.49/mo' },
+    cx23: { vcpu: 2, ram: 4, disk: 40 },
+    cx33: { vcpu: 4, ram: 8, disk: 80 },
+    cx43: { vcpu: 8, ram: 16, disk: 160 },
+    cx53: { vcpu: 16, ram: 32, disk: 320 },
+    cx22: { vcpu: 2, ram: 4, disk: 40 },
+    cx32: { vcpu: 4, ram: 8, disk: 80 },
+    cx42: { vcpu: 8, ram: 16, disk: 160 },
+    cx52: { vcpu: 16, ram: 32, disk: 320 },
+    cpx11: { vcpu: 2, ram: 2, disk: 40 },
+    cpx21: { vcpu: 3, ram: 4, disk: 80 },
+    cpx22: { vcpu: 3, ram: 4, disk: 80 },
+    cpx31: { vcpu: 4, ram: 8, disk: 160 },
+    cpx41: { vcpu: 8, ram: 16, disk: 240 },
+    cpx51: { vcpu: 16, ram: 32, disk: 360 },
+    cax11: { vcpu: 2, ram: 4, disk: 40 },
+    cax21: { vcpu: 4, ram: 8, disk: 80 },
+    cax31: { vcpu: 8, ram: 16, disk: 160 },
+    cax41: { vcpu: 16, ram: 32, disk: 320 },
+    ccx13: { vcpu: 2, ram: 8, disk: 80 },
+    ccx23: { vcpu: 4, ram: 16, disk: 160 },
+    ccx33: { vcpu: 8, ram: 32, disk: 240 },
+    ccx43: { vcpu: 16, ram: 64, disk: 360 },
+    ccx53: { vcpu: 32, ram: 128, disk: 600 },
+    ccx63: { vcpu: 48, ram: 192, disk: 960 },
   };
 
   // Live catalog populated by fetchServerTypes(). Falls back to FALLBACK_SERVER_TYPES.
@@ -61,24 +100,6 @@ export class HetznerProvider extends BaseProvider {
   static DEFAULT_TYPE = 'cpx11';
   static HA_REGIONS = ['fsn1', 'hel1'];
 
-  // Infrastructure costs (EUR/mo, as of Apr 2026)
-  static INFRA_COSTS = {
-    floatingIp: 3.57,
-    volumePerGb: 0.052, // Hetzner CSI volumes
-    s3MinBucket: 4.49, // 250 GB Object Storage minimum
-    firewall: 0, // Free
-    network: 0, // Free (first 1 TB)
-  };
-
-  // Known PVC sizes (Gi) per service
-  static VOLUME_SIZES = {
-    base: 30, // postgres 20Gi + storage 10Gi
-    observability: 25, // prometheus 10Gi + loki 10Gi + grafana 5Gi
-    n8n: 5,
-    metabase: 1,
-    redis: 1,
-  };
-
   static EU_REGIONS = ['fsn1', 'nbg1', 'hel1'];
   static US_REGIONS = ['ash', 'hil'];
 
@@ -123,27 +144,10 @@ export class HetznerProvider extends BaseProvider {
           locationTypes[locName].add(t.name);
         }
 
-        // Build per-location price map
-        const locationPrices = {};
-        for (const p of t.prices || []) {
-          const loc = p.location;
-          if (loc) {
-            locationPrices[loc] = `€${parseFloat(p.price_monthly.gross).toFixed(2)}/mo`;
-          }
-        }
-
-        // Use first available location price as the default display price
-        const firstPrice = t.prices[0];
-        const defaultMonthly = firstPrice
-          ? `€${parseFloat(firstPrice.price_monthly.gross).toFixed(2)}/mo`
-          : '';
-
         types[t.name] = {
           vcpu: t.cores,
           ram: t.memory,
           disk: t.disk,
-          price: defaultMonthly,
-          locationPrices,
           cpuType: t.cpu_type,
           architecture: t.architecture,
         };
@@ -227,17 +231,19 @@ export class HetznerProvider extends BaseProvider {
       return defaults.workerType;
     }
 
-    // Offline fallback: EU regions have ARM, US regions don't.
-    // Only map to types that exist in the fallback catalog — blindly swapping
-    // the prefix can produce invalid types (e.g. cpx22 → cax22 which doesn't exist).
+    // Offline fallback. The ONLY architecture that isn't universally available
+    // is ARM (cax): EU regions have both cpx (x86) and cax (ARM); US regions
+    // have cpx but NO cax. So the only valid conversion is cax→cpx in a US
+    // region (the requested ARM type can't exist there). x86 (cpx) is available
+    // everywhere, so it must NEVER be flipped to cax — doing so converted an
+    // x86 primary's cpx11 into ARM cax11 on an EU standby, which both mismatches
+    // the primary's architecture (the x86 app image won't run on ARM) and chases
+    // scarcer ARM capacity (RCA 2026-06-23: nbg1 standby failed
+    // resource_unavailable on cax). Keep cpx as-is.
     if (HetznerProvider.US_REGIONS.includes(targetRegion) && serverType.startsWith('cax')) {
       const alt = `cpx${serverType.replace(/^cax/, '')}`;
       if (HetznerProvider.FALLBACK_SERVER_TYPES[alt]) return alt;
     }
-    if (HetznerProvider.EU_REGIONS.includes(targetRegion) && serverType.startsWith('cpx')) {
-      const alt = `cax${serverType.replace(/^cpx/, '')}`;
-      if (HetznerProvider.FALLBACK_SERVER_TYPES[alt]) return alt;
-    }
     return serverType;
   }
 
@@ -251,11 +257,7 @@ export class HetznerProvider extends BaseProvider {
     if (available) {
       return [...available]
         .filter((name) => name in HetznerProvider.SERVER_TYPES)
-        .map((name) => {
-          const spec = HetznerProvider.SERVER_TYPES[name];
-          const price = spec.locationPrices?.[region] || spec.price;
-          return { name, ...spec, price };
-        })
+        .map((name) => ({ name, ...HetznerProvider.SERVER_TYPES[name] }))
         .sort((a, b) => a.vcpu - b.vcpu || a.ram - b.ram);
     }
 
@@ -268,16 +270,6 @@ export class HetznerProvider extends BaseProvider {
       .map(([name, info]) => ({ name, ...info }));
   }
 
-  /**
-   * Returns the monthly price for a server type in a specific location.
-   * Only available after fetchServerTypes() — returns null otherwise.
-   */
-  static getPrice(serverType, location) {
-    const spec = HetznerProvider.SERVER_TYPES[serverType];
-    if (!spec) return null;
-    return (location && spec.locationPrices?.[location]) || spec.price || null;
-  }
-
   /**
    * Create a new Hetzner server
    * @param {object} config - Server configuration

package/src/lib/server-types.js

@@ -36,14 +36,6 @@ export const K8S_PROFILES = [
   },
 ];
 
-/**
- * Parse a price string like "€7.99/mo" into a number.
- */
-export function parsePrice(priceStr) {
-  const match = (priceStr || '').match(/[\d.]+/);
-  return match ? Number.parseFloat(match[0]) : 0;
-}
-
 /**
  * Format a server type label with aligned columns.
  * Pre-computes column widths from the full list so values line up.
@@ -67,7 +59,6 @@ function buildAlignedLabels(types) {
  * Disables types that are too small, marks minimum and recommended.
  */
 export function buildComposeTypeOptions(regionTypes, defaultType) {
-  const { INFRA_COSTS } = HetznerProvider;
   const filtered = regionTypes.filter((t) => !t.cpuType || t.cpuType === 'shared');
   const labels = buildAlignedLabels(filtered);
 
@@ -76,18 +67,13 @@ export function buildComposeTypeOptions(regionTypes, defaultType) {
     const isMinimum = !tooSmall && t.ram === COMPOSE_MIN_RAM_GB && t.disk <= 40;
     const isRecommended = t.name === defaultType;
 
-    const serverCost = parsePrice(t.price);
-    const totalCost = serverCost + INFRA_COSTS.s3MinBucket;
-
     let hint = '';
     if (tooSmall) {
       hint = `need ${COMPOSE_MIN_RAM_GB}GB+ RAM for Supabase`;
     } else if (isMinimum) {
-      hint = `~€${totalCost.toFixed(0)}/mo total — minimum`;
+      hint = 'minimum';
     } else if (isRecommended) {
-      hint = `~€${totalCost.toFixed(0)}/mo total — recommended`;
-    } else {
-      hint = `~€${totalCost.toFixed(0)}/mo total`;
+      hint = 'recommended';
     }
 
     return {
@@ -101,11 +87,8 @@ export function buildComposeTypeOptions(regionTypes, defaultType) {
 
 /**
  * Build select options for K8s cluster size profiles.
- * Calculates total monthly cost including all provisioned infra.
  */
 export function buildK8sProfileOptions(_region, regionTypes, secondaryRegion) {
-  const { INFRA_COSTS, VOLUME_SIZES, SERVER_TYPES } = HetznerProvider;
-
   // Determine available types (intersection of both regions for HA)
   const availableNames = new Set(regionTypes.map((t) => t.name));
   let effectiveAvailable = availableNames;
@@ -117,10 +100,6 @@ export function buildK8sProfileOptions(_region, regionTypes, secondaryRegion) {
   }
 
   const hasArm = effectiveAvailable.has('cax11');
-  const regionMultiplier = secondaryRegion ? 2 : 1;
-
-  // Per-cluster fixed costs: floating IP + base CSI volumes
-  const fixedPerCluster = INFRA_COSTS.floatingIp + VOLUME_SIZES.base * INFRA_COSTS.volumePerGb;
 
   return K8S_PROFILES.map((profile) => {
     const variant = hasArm ? profile.arm : profile.x86;
@@ -131,16 +110,9 @@ export function buildK8sProfileOptions(_region, regionTypes, secondaryRegion) {
     );
     if (!allAvailable) return null;
 
-    const serverCost =
-      parsePrice(SERVER_TYPES[variant.master]?.price) +
-      parsePrice(SERVER_TYPES[variant.supabase]?.price) +
-      parsePrice(SERVER_TYPES[variant.worker]?.price);
-
-    const totalCost = (serverCost + fixedPerCluster) * regionMultiplier + INFRA_COSTS.s3MinBucket;
-
     return {
       value: profile.name,
-      label: `${profile.label}  ~€${totalCost.toFixed(0)}/mo`,
+      label: profile.label,
       hint: `${profile.hint} (${variant.master} + ${variant.supabase} + ${variant.worker})`,
       _variant: variant,
     };

package/src/lib/ssh.js

@@ -16,7 +16,7 @@
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { runCommand } from './command.js';
+import { runCommandAsync } from './command.js';
 import { knownHostsPath } from './host-keys.js';
 import { shEscape } from './shell.js';
 
@@ -130,10 +130,11 @@ export const NO_PIN_SSH_OPTS = sshHostKeyOpts().join(' ');
  * @param {boolean} [options.firstConnect=false]
  * @param {number} [options.timeout=120000]
  * @param {boolean} [options.silent=true]
- * @returns {string} - trimmed stdout
+ * @param {string} [options.input] - stdin piped to the remote command
+ * @returns {Promise<string>} - trimmed stdout
  */
-export function sshRun(ip, sshKeyPath, argv, options = {}) {
-  const { env, firstConnect = false, timeout = 120_000, silent = true } = options;
+export async function sshRun(ip, sshKeyPath, argv, options = {}) {
+  const { env, firstConnect = false, timeout = 120_000, silent = true, input } = options;
   if (!Array.isArray(argv) || argv.length === 0) {
     throw new Error('sshRun requires a non-empty argv array');
   }
@@ -147,7 +148,7 @@ export function sshRun(ip, sshKeyPath, argv, options = {}) {
     `root@${ip}`,
     remoteCmd,
   ];
-  const out = runCommand(cmd, { silent, timeout, returnOutput: true });
+  const out = await runCommandAsync(cmd, { silent, timeout, returnOutput: true, input });
   return typeof out === 'string' ? out.trim() : '';
 }
 
@@ -157,17 +158,17 @@ export function sshRun(ip, sshKeyPath, argv, options = {}) {
  * via bash, then removed. Use for pipelines that genuinely need shell
  * features; never interpolate untrusted values into the script string.
  */
-export function sshRunScript(ip, sshKeyPath, bashScript, options = {}) {
+export async function sshRunScript(ip, sshKeyPath, bashScript, options = {}) {
   const localTmp = mkdtempSync(join(tmpdir(), 'vb-sshscript-'));
   const localPath = join(localTmp, 'script.sh');
   const remotePath = `/tmp/vb-script-${Date.now()}-${Math.random().toString(36).slice(2, 10)}.sh`;
   try {
     writeFileSync(localPath, bashScript, { mode: 0o700 });
-    scpUpload(ip, sshKeyPath, localPath, remotePath, options);
-    return sshRun(ip, sshKeyPath, ['bash', remotePath], options);
+    await scpUpload(ip, sshKeyPath, localPath, remotePath, options);
+    return await sshRun(ip, sshKeyPath, ['bash', remotePath], options);
   } finally {
     try {
-      sshRun(ip, sshKeyPath, ['rm', '-f', remotePath], {
+      await sshRun(ip, sshKeyPath, ['rm', '-f', remotePath], {
         ...options,
         silent: true,
         timeout: 15_000,
@@ -182,7 +183,7 @@ export function sshRunScript(ip, sshKeyPath, bashScript, options = {}) {
 /**
  * Download a file from a remote server via SCP. Argv form.
  */
-export function scpDownload(ip, sshKeyPath, remotePath, localPath, options = {}) {
+export async function scpDownload(ip, sshKeyPath, remotePath, localPath, options = {}) {
   const { env, firstConnect = false, timeout = 300_000 } = options;
   const cmd = [
     'scp',
@@ -193,13 +194,13 @@ export function scpDownload(ip, sshKeyPath, remotePath, localPath, options = {})
     `root@${ip}:${remotePath}`,
     localPath,
   ];
-  runCommand(cmd, { silent: true, timeout });
+  await runCommandAsync(cmd, { silent: true, timeout });
 }
 
 /**
  * Upload a file to a remote server via SCP. Argv form.
  */
-export function scpUpload(ip, sshKeyPath, localPath, remotePath, options = {}) {
+export async function scpUpload(ip, sshKeyPath, localPath, remotePath, options = {}) {
   const { env, firstConnect = false, timeout = 300_000 } = options;
   const cmd = [
     'scp',
@@ -210,7 +211,7 @@ export function scpUpload(ip, sshKeyPath, localPath, remotePath, options = {}) {
     localPath,
     `root@${ip}:${remotePath}`,
   ];
-  runCommand(cmd, { silent: true, timeout });
+  await runCommandAsync(cmd, { silent: true, timeout });
 }
 
 /**
@@ -222,13 +223,13 @@ export function scpUpload(ip, sshKeyPath, localPath, remotePath, options = {}) {
  * @param {string} sshKeyPath
  * @param {string[]} kubectlArgv - kubectl subcommand + args (e.g. ['get', 'pods', '-n', 'vibecarbon'])
  * @param {object} [options]
- * @returns {string} trimmed stdout
+ * @returns {Promise<string>} trimmed stdout
  */
-export function sshKubectl(ip, sshKeyPath, kubectlArgv, options = {}) {
+export async function sshKubectl(ip, sshKeyPath, kubectlArgv, options = {}) {
   if (!Array.isArray(kubectlArgv) || kubectlArgv.length === 0) {
     throw new Error('sshKubectl requires a non-empty argv array (without leading "kubectl")');
   }
-  return sshRun(
+  return await sshRun(
     ip,
     sshKeyPath,
     ['env', `KUBECONFIG=${K3S_KUBECONFIG}`, 'kubectl', ...kubectlArgv],
@@ -239,8 +240,8 @@ export function sshKubectl(ip, sshKeyPath, kubectlArgv, options = {}) {
 /**
  * Get the name of the PostgreSQL pod in the vibecarbon namespace.
  */
-export function getPostgresPod(ip, sshKeyPath) {
-  return sshKubectl(ip, sshKeyPath, [
+export async function getPostgresPod(ip, sshKeyPath) {
+  return await sshKubectl(ip, sshKeyPath, [
     'get',
     'pods',
     '-n',

package/src/lib/walg-backups.js

@@ -0,0 +1,81 @@
+/**
+ * List wal-g base backups by running `wal-g backup-list --json` inside the
+ * Postgres container (compose) or pod (k8s). wal-g is the source of truth for
+ * what is actually restorable — the legacy `backups/*_full.tar.gz` S3 objects
+ * are NOT wal-g backups and must not be offered as restore targets.
+ *
+ * Restore itself always fetches the LATEST base backup and replays WAL (to the
+ * present or a point-in-time target), so this listing is informational — it
+ * tells the operator the available recovery window for PITR.
+ */
+
+import { getPostgresPod, sshKubectl, sshRun } from './ssh.js';
+
+/**
+ * Parse `wal-g backup-list --json` output into normalized entries, newest-first.
+ * Pure (no I/O) so it's unit-testable. Tolerant of wal-g version field-name
+ * drift (backup_name/BackupName, time/start_time/finish_time/…).
+ *
+ * @param {string} jsonStr
+ * @returns {Array<{ name: string, time: Date }>}
+ */
+export function parseWalgBackupList(jsonStr) {
+  let arr;
+  try {
+    arr = JSON.parse(jsonStr);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(arr)) return [];
+  return arr
+    .map((b) => {
+      const name = b.backup_name ?? b.BackupName ?? b.name ?? null;
+      const rawTime =
+        b.time ?? b.start_time ?? b.StartTime ?? b.finish_time ?? b.FinishTime ?? b.creation_time;
+      const time = rawTime ? new Date(rawTime) : null;
+      return { name, time };
+    })
+    .filter((b) => b.name && b.time && !Number.isNaN(b.time.getTime()))
+    .sort((a, b) => b.time.getTime() - a.time.getTime());
+}
+
+/**
+ * List wal-g base backups for an environment. Best-effort: returns [] on any
+ * failure (db down, wal-g missing, no --json support, parse error) so callers
+ * can degrade gracefully without breaking the restore/backup flow.
+ *
+ * @param {object} opts
+ * @param {string} opts.serverIp - master/single node IP
+ * @param {string} opts.sshKeyPath
+ * @param {string} opts.projectName
+ * @param {boolean} opts.isCompose - true for compose, false for k8s
+ * @returns {Promise<Array<{ name: string, time: Date }>>}
+ */
+export async function listWalgBackups({ serverIp, sshKeyPath, projectName, isCompose }) {
+  try {
+    let out;
+    if (isCompose) {
+      out = await sshRun(serverIp, sshKeyPath, [
+        'bash',
+        '-lc',
+        `cd /opt/${projectName} && docker compose exec -T db wal-g backup-list --json`,
+      ]);
+    } else {
+      const pod = await getPostgresPod(serverIp, sshKeyPath);
+      if (!pod) return [];
+      out = await sshKubectl(serverIp, sshKeyPath, [
+        'exec',
+        '-n',
+        'vibecarbon',
+        pod,
+        '--',
+        'wal-g',
+        'backup-list',
+        '--json',
+      ]);
+    }
+    return typeof out === 'string' ? parseWalgBackupList(out) : [];
+  } catch {
+    return [];
+  }
+}