vibecarbon 0.8.0 → 0.10.0

package/src/lib/providers/hetzner-s3.js

@@ -17,6 +17,7 @@
 
 import {
   AbortMultipartUploadCommand,
+  CopyObjectCommand,
   CreateBucketCommand,
   DeleteBucketCommand,
   DeleteObjectsCommand,
@@ -251,6 +252,74 @@ export class HetznerS3Provider {
     }
   }
 
+  /**
+   * Return true if the bucket contains at least one object under `prefix`.
+   * Tolerant of NoSuchBucket (returns false) so callers can probe a bucket
+   * that may not exist yet. Used by the deploy-time Pulumi-state migration to
+   * decide whether the dedicated state bucket has already been seeded and
+   * whether the legacy app bucket still holds state to copy over.
+   * @param {string} bucketName
+   * @param {string} prefix
+   * @returns {Promise<boolean>}
+   */
+  async hasObjectsWithPrefix(bucketName, prefix) {
+    try {
+      const res = await this._send(
+        new ListObjectsV2Command({ Bucket: bucketName, Prefix: prefix, MaxKeys: 1 }),
+        {
+          terminal: (err) => {
+            const status = err.$metadata?.httpStatusCode;
+            return err.name === 'NoSuchBucket' || status === 404;
+          },
+        },
+      );
+      return (res.KeyCount ?? res.Contents?.length ?? 0) > 0;
+    } catch (err) {
+      const status = err.$metadata?.httpStatusCode;
+      if (err.name === 'NoSuchBucket' || status === 404) return false;
+      throw err;
+    }
+  }
+
+  /**
+   * Copy every object under `prefix` from `srcBucket` to `destBucket`,
+   * preserving keys. Server-side copy (CopyObjectCommand) — no bytes transit
+   * the operator. Used to migrate legacy Pulumi state (the `.pulumi/` prefix)
+   * out of the app storage bucket into the dedicated state bucket. Both
+   * buckets must be in this provider's region.
+   * @param {string} srcBucket
+   * @param {string} destBucket
+   * @param {string} prefix
+   * @returns {Promise<{copied: number}>}
+   */
+  async copyPrefix(srcBucket, destBucket, prefix) {
+    let continuationToken;
+    let copied = 0;
+    do {
+      const listResult = await this._send(
+        new ListObjectsV2Command({
+          Bucket: srcBucket,
+          Prefix: prefix,
+          ContinuationToken: continuationToken,
+        }),
+      );
+      for (const obj of listResult.Contents || []) {
+        await this._send(
+          new CopyObjectCommand({
+            Bucket: destBucket,
+            Key: obj.Key,
+            // CopySource must be URL-encoded; keys contain `/` path separators
+            // (`.pulumi/stacks/...`) which encodeURI preserves.
+            CopySource: encodeURI(`${srcBucket}/${obj.Key}`),
+          }),
+        );
+        copied += 1;
+      }
+      continuationToken = listResult.IsTruncated ? listResult.NextContinuationToken : undefined;
+    } while (continuationToken);
+    return { copied };
+  }
+
   /**
    * Search all S3 regions for a bucket we own.
    * Each region's HeadBucket failure is intentionally swallowed — finding
@@ -674,3 +743,19 @@ export function sanitizeBucketName(projectName, suffix = 'storage') {
     .replace(/^-|-$/g, '') // Remove leading/trailing hyphens
     .slice(0, 63); // Truncate to max length
 }
+
+/**
+ * Derive the dedicated Pulumi-state bucket name from the app storage bucket
+ * name. Pulumi state used to live in the app storage bucket, which created a
+ * destroy-time circular hazard (deleting the storage bucket nuked the state
+ * backend mid-destroy). State now lives in a separate bucket derived once,
+ * deterministically, from the app bucket — so the derivation is stable across
+ * deploy / scale / destroy and identical for both HA stacks (they share one
+ * state bucket).
+ *
+ * @param {string} appBucketName - The app storage bucket (e.g. `myapp-storage`)
+ * @returns {string} - Valid state bucket name (e.g. `myapp-storage-pulumi-state`)
+ */
+export function deriveStateBucketName(appBucketName) {
+  return sanitizeBucketName(appBucketName, 'pulumi-state');
+}

package/src/lib/ssh.js

@@ -8,16 +8,22 @@
  *      of dynamic tokens), or
  *   2. Use sshRunScript to execute a bash script SCP'd as a file.
  *
- * Host-key checking: first-provision callers pass { firstConnect: true }
- * which switches StrictHostKeyChecking to accept-new (TOFU). All other
- * calls use strict checking against a per-environment known_hosts file.
+ * Host-key checking: EVERY call pins against a per-environment known_hosts
+ * file — there is no /dev/null + StrictHostKeyChecking=no bypass. When a
+ * caller passes an explicit `env`, first-provision callers pass
+ * { firstConnect: true } to accept-new (TOFU) once and strict-check ('yes')
+ * thereafter. Callers that only have `(ip, sshKeyPath)` get the per-env
+ * known_hosts derived from the key path (knownHostsPathForKey) with
+ * StrictHostKeyChecking=accept-new — which still REJECTS a changed key for an
+ * already-pinned host (MITM on an established env fails) while TOFU-ing a fresh
+ * or recycled IP. The operator's ~/.ssh/known_hosts is never touched.
  */
 
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { runCommandAsync } from './command.js';
-import { knownHostsPath } from './host-keys.js';
+import { knownHostsPath, knownHostsPathForKey } from './host-keys.js';
 import { shEscape } from './shell.js';
 
 // k3s writes its kubeconfig here; kubectl doesn't find it by default in SSH sessions.
@@ -53,30 +59,36 @@ export function getSSHKeyPath(environment) {
 }
 
 /**
- * Build the SSH `-o` option args for host-key checking.
+ * Build the SSH `-o` option args for host-key checking. Always pins against a
+ * per-environment known_hosts file under .vibecarbon/ — never /dev/null.
+ * GlobalKnownHostsFile=/dev/null ignores the system-wide file; the operator's
+ * ~/.ssh/known_hosts is never read or polluted (Hetzner recycles public IPs,
+ * and a stale entry there would reject an unrelated reconnect).
  *
- * - With `env`: StrictHostKeyChecking=yes against .vibecarbon/known_hosts_<env>
- *   (or accept-new if firstConnect=true — used during first provision).
+ * - With explicit `env`: pin to .vibecarbon/known_hosts_<env>,
+ *   StrictHostKeyChecking=yes (or accept-new when firstConnect=true, used
+ *   during first provision).
  *
- * - Without `env`: bypass the user's known_hosts with UserKnownHostsFile=
- *   /dev/null and StrictHostKeyChecking=no, matching the deploy path's long-
- *   standing SSH_OPTS in compose/index.js. This keeps backup/restore/scale/
- *   failover consistent with the deploy flow and avoids the Hetzner recycled-
- *   IP footgun: destroy-then-redeploy gives you the same public IP with a new
- *   host key, and a stale TOFU entry in ~/.ssh/known_hosts would refuse the
- *   reconnect. H-1 (tracked in docs/superpowers/specs/2026-04-17-security-
- *   remediation-design.md) replaces this with env-scoped pinned known_hosts
- *   across every CLI command — callers pass `env` once the deploy path
- *   populates .vibecarbon/known_hosts_<env>.
+ * - With only `sshKeyPath` (backup/restore/scale/failover only receive the key
+ *   path, not an env): derive .vibecarbon/known_hosts_<env> from the key path
+ *   (knownHostsPathForKey) and use StrictHostKeyChecking=accept-new. accept-new
+ *   bootstraps an empty pin and TOFU's a fresh/recycled IP, but REJECTS a
+ *   changed key for an already-pinned host — so a MITM against an established
+ *   env fails, while destroy→redeploy (same IP, new key, re-seeded on
+ *   provision) does not spuriously hard-fail.
  */
-function sshHostKeyOpts(env, { firstConnect = false } = {}) {
+function sshHostKeyOpts(env, { firstConnect = false, sshKeyPath } = {}) {
   const opts = [];
   if (env) {
     opts.push('-o', `UserKnownHostsFile=${knownHostsPath(env)}`);
+    opts.push('-o', 'GlobalKnownHostsFile=/dev/null');
     opts.push('-o', `StrictHostKeyChecking=${firstConnect ? 'accept-new' : 'yes'}`);
+  } else if (sshKeyPath) {
+    opts.push('-o', `UserKnownHostsFile=${knownHostsPathForKey(sshKeyPath)}`);
+    opts.push('-o', 'GlobalKnownHostsFile=/dev/null');
+    opts.push('-o', 'StrictHostKeyChecking=accept-new');
   } else {
-    opts.push('-o', 'UserKnownHostsFile=/dev/null');
-    opts.push('-o', 'StrictHostKeyChecking=no');
+    throw new Error('sshHostKeyOpts requires either `env` or `sshKeyPath` for host-key pinning');
   }
   opts.push('-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10');
   // ConnectTimeout only covers TCP connect — once the socket is open, ssh
@@ -94,18 +106,6 @@ function sshHostKeyOpts(env, { firstConnect = false } = {}) {
   return opts;
 }
 
-/**
- * The no-host-key-pinning SSH option set as a single space-joined string,
- * for the compose deploy path's string-command runners (sshRun/sshRunAsync
- * in compose/index.js) and raw `ssh ${SSH_OPTS}` interpolations.
- *
- * Derived from sshHostKeyOpts() so the string form can never drift from the
- * argv form — the historical footgun was compose/ha.js hand-copying this
- * string and silently dropping the ServerAlive keepalives, letting a
- * banner-exchange hang stall an HA deploy for ~600s.
- */
-export const NO_PIN_SSH_OPTS = sshHostKeyOpts().join(' ');
-
 /**
  * Execute a command on a remote server via SSH using argv form.
  *
@@ -143,7 +143,7 @@ export async function sshRun(ip, sshKeyPath, argv, options = {}) {
     'ssh',
     '-i',
     sshKeyPath,
-    ...sshHostKeyOpts(env, { firstConnect }),
+    ...sshHostKeyOpts(env, { firstConnect, sshKeyPath }),
     '--',
     `root@${ip}`,
     remoteCmd,
@@ -189,7 +189,7 @@ export async function scpDownload(ip, sshKeyPath, remotePath, localPath, options
     'scp',
     '-i',
     sshKeyPath,
-    ...sshHostKeyOpts(env, { firstConnect }),
+    ...sshHostKeyOpts(env, { firstConnect, sshKeyPath }),
     '--',
     `root@${ip}:${remotePath}`,
     localPath,
@@ -206,7 +206,7 @@ export async function scpUpload(ip, sshKeyPath, localPath, remotePath, options =
     'scp',
     '-i',
     sshKeyPath,
-    ...sshHostKeyOpts(env, { firstConnect }),
+    ...sshHostKeyOpts(env, { firstConnect, sshKeyPath }),
     '--',
     localPath,
     `root@${ip}:${remotePath}`,

package/src/restore.js

@@ -19,6 +19,7 @@
 import { existsSync } from 'node:fs';
 import { basename } from 'node:path';
 import * as p from '@clack/prompts';
+import { identifyServers } from './failover.js';
 import { formatInstant } from './lib/backup-format.js';
 import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
@@ -31,9 +32,14 @@ import { loadCredentials, loadProjectConfig } from './lib/config.js';
 // while still accepting injected mocks for unit tests.
 import { configureStandbyReplication as realConfigureStandbyReplication } from './lib/deploy/compose/ha.js';
 import { restoreCompose as realRestoreCompose } from './lib/deploy/compose/index.js';
-import { requireLicense } from './lib/licensing/index.js';
+import {
+  readK8sReplicationState as realReadK8sReplicationState,
+  reseedStandbyFromPrimary as realReseedStandbyFromPrimary,
+  verifyStreaming,
+} from './lib/deploy/replication.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
+import { confirmProdOrExit } from './lib/prod-confirm.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { getPostgresPod, getSSHKeyPath, sshKubectl } from './lib/ssh.js';
 import { createTracker } from './lib/tracker.js';
@@ -245,7 +251,6 @@ export async function run(args) {
   // restore` from a parent directory emits the canonical message.
   assertInProjectDir();
 
-  requireLicense('restore');
   printBanner();
   p.intro(`${c.bold('vibecarbon restore')} ${c.dim(`v${VERSION}`)}`);
 
@@ -392,19 +397,15 @@ export async function run(args) {
       p.cancel('Operation cancelled.');
       process.exit(0);
     }
-
-    if (envName === 'prod' || envName === 'production') {
-      const doubleConfirm = await p.text({
-        message: `Type "${envName}" to confirm restoration of production database:`,
-        validate: (v) => (v !== envName ? `Please type "${envName}" to confirm` : undefined),
-      });
-      if (p.isCancel(doubleConfirm)) {
-        p.cancel('Operation cancelled.');
-        process.exit(0);
-      }
-    }
   }
 
+  // SECURITY: the production type-to-confirm runs UNCONDITIONALLY — even with
+  // -y — so `restore -y prod` can never silently overwrite the production
+  // database. This is deliberately OUTSIDE the `!values.y` block above (the
+  // soft y/N confirm is skippable with -y; this hard gate is not). Mirrors
+  // destroy's prod guard; shared helper so failover can reuse it.
+  await confirmProdOrExit(envName, { actionLabel: 'restore', yes: !!values.y });
+
   // Dispatch by mode
   const tracker = createTracker('restore', { environment: envName });
   const s = tracker.spinner();
@@ -427,6 +428,7 @@ export async function run(args) {
         envName,
         serverIp,
         sshKeyPath,
+        envConfig,
       });
     }
   } catch (error) {
@@ -645,7 +647,21 @@ async function setRestoreMarker(ip, sshKeyPath, value) {
   ]);
 }
 
-async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath }) {
+export async function runK8sRestore({
+  s,
+  chosenSource,
+  envName,
+  serverIp,
+  sshKeyPath,
+  envConfig = {},
+  // Injected so the k8s-HA standby re-seed dispatch is unit-testable without a
+  // real cluster (mirrors runComposeRestore). Production passes none.
+  reseedStandbyFromPrimary = realReseedStandbyFromPrimary,
+  readReplicationState = realReadK8sReplicationState,
+  // Pacing for the post-reseed streaming verify — injectable so tests don't wait
+  // on real timers. Production uses the default setTimeout-backed sleep.
+  verifySleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+}) {
   if (chosenSource.kind === 'local') {
     throw new Error(
       'k8s restore is wal-g-based and pulls from S3 — local backup files are not supported. Use `-source latest` (or a timestamp for PITR).',
@@ -695,6 +711,78 @@ async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath })
 
   p.log.success('Restore completed successfully');
   p.log.info('The application has been scaled back up.');
+
+  // k8s-HA: the standby is a SEPARATE cluster deployed with `restore: null` — a
+  // streaming replica, never wal-g-restored (a wal-g fetch on the standby would
+  // create a divergent timeline; see k8s/ha/index.js). This restore rewound the
+  // PRIMARY to an earlier LSN, so the standby now has WAL AHEAD of the primary
+  // and CANNOT resume streaming (timeline divergence).
+  //
+  // Finding #2: instead of the old warn-and-point-to-`deploy`, perform a
+  // first-class VERIFIED re-seed of the standby using the SHARED reseed
+  // primitive (the same hardened staged-basebackup+atomic-swap the failover path
+  // uses), then confirm streaming from the restored primary. Fail loudly if it
+  // can't complete — never silently leave a diverged standby.
+  const isK8sHA = !!(envConfig.ha?.enabled || envConfig.ha === true || envConfig.secondaryRegion);
+  if (isK8sHA) {
+    const servers = identifyServers(envName, envConfig, {});
+    const standbyIp = servers?.standby?.ip;
+    const primarySupabaseIp = servers?.primary?.supabaseIp || servers?.primary?.ip;
+    if (!standbyIp || !primarySupabaseIp) {
+      // We can't locate the standby / primary source — fail loudly rather than
+      // report a clean restore while the standby silently diverges.
+      throw new Error(
+        'HA restore: the primary was restored, but the standby cluster or the primary ' +
+          'supabase IP could not be resolved from config, so the standby could NOT be ' +
+          `re-seeded and now has a DIVERGED timeline. DR is not guaranteed. Resync with ` +
+          `\`vibecarbon deploy ${envName}\` (re-runs the verified replication setup).`,
+      );
+    }
+
+    s.start('Re-seeding standby cluster from restored primary (pg_basebackup)');
+    let reseedResult;
+    try {
+      reseedResult = await reseedStandbyFromPrimary(standbyIp, sshKeyPath, primarySupabaseIp);
+    } catch (err) {
+      s.stop('Standby re-seed failed');
+      throw new Error(
+        `HA restore: the primary was restored and is serving, but re-seeding the standby ` +
+          `FAILED: ${err.message}\nThe standby has a DIVERGED timeline and is NOT replicating — ` +
+          `DR is not guaranteed. Resync with \`vibecarbon deploy ${envName}\`.`,
+      );
+    }
+    if (reseedResult === 'skipped') {
+      s.stop('Standby re-seed skipped — primary unreachable from standby');
+      throw new Error(
+        'HA restore: the standby could NOT reach the restored primary to re-seed ' +
+          '(cross-cluster connectivity). The standby has a DIVERGED timeline and is NOT ' +
+          `replicating — DR is not guaranteed. Verify the replication firewall/network, then ` +
+          `resync with \`vibecarbon deploy ${envName}\`.`,
+      );
+    }
+    s.stop('Standby re-seeded from restored primary');
+
+    // Confirm streaming from the restored primary — a re-seed that boots but
+    // never streams is still a diverged standby.
+    s.start('Verifying standby is streaming from restored primary');
+    const { streaming, lastState } = await verifyStreaming({
+      readState: async () => readReplicationState(servers.primary.ip, sshKeyPath),
+      attempts: 15,
+      delaysMs: [1000, 2000, 3000],
+      sleep: verifySleep,
+    });
+    if (!streaming) {
+      s.stop('Standby streaming NOT confirmed');
+      throw new Error(
+        `HA restore: the standby was re-seeded but streaming replication is NOT confirmed ` +
+          `(last pg_stat_replication.state=${
+            lastState ? JSON.stringify(lastState) : 'no replica connected'
+          }). DR is not guaranteed. Resync with \`vibecarbon deploy ${envName}\`.`,
+      );
+    }
+    s.stop('Standby streaming from restored primary — DR restored');
+  }
+
   p.log.info(`Verify with: ${c.info(`vibecarbon status ${envName}`)}`);
 }
 

package/src/scale.js

@@ -41,7 +41,6 @@ import { buildRemote } from './lib/deploy/remote-build.js';
 import { DEFAULT_WORKER_MAX, DEFAULT_WORKER_MIN } from './lib/deploy/utils.js';
 import { waitForDNSPropagation } from './lib/dns-propagation.js';
 import { getApiToken, getS3Credentials } from './lib/hetzner-guided-setup.js';
-import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
 import { assertInProjectDir } from './lib/project-guard.js';
@@ -764,7 +763,6 @@ export async function run(args) {
   // scale` from a parent directory emits the canonical message.
   const projectConfig = assertInProjectDir();
 
-  requireLicense('scale');
   printBanner();
   p.intro(`${c.bold('vibecarbon scale')} ${c.dim(`v${VERSION}`)}`);
 
@@ -1140,6 +1138,10 @@ export async function run(args) {
           bucket: envConfig.s3.bucket,
           region: envConfig.s3.region,
           endpoint: envConfig.s3.endpoint,
+          // Dedicated Pulumi-state bucket. Undefined for envs deployed before
+          // the state-bucket split — resolveBackendUrl then falls back to the
+          // app bucket, matching where their state actually still lives.
+          stateBucket: envConfig.s3.stateBucket,
           accessKey: s3Creds.accessKey,
           secretKey: s3Creds.secretKey,
         };

package/src/status.js

@@ -20,6 +20,7 @@ import { c, printBanner } from './lib/colors.js';
 import { runCommand } from './lib/command.js';
 import { cleanStaleProjects, loadGlobalRegistry, loadProjectConfig } from './lib/config.js';
 import { HetznerProvider } from './lib/providers/hetzner.js';
+import { getPostgresPod, getSSHKeyPath, sshKubectl, sshRun } from './lib/ssh.js';
 import { VERSION } from './lib/version.js';
 
 /** @type {import('./lib/cli/parse-flags.js').CommandSpec & { summary?: string, description?: string, examples?: Array<{ command: string, description?: string }> }} */
@@ -324,6 +325,108 @@ async function checkRemoteHealth(domain) {
   };
 }
 
+/**
+ * Read the REAL streaming-replication state for an HA environment by querying
+ * `pg_stat_replication` on the CURRENT primary. Surfaces honest DR state instead
+ * of a hardcoded "streaming" string (finding #4). Best-effort and hard-bounded:
+ * any failure (unreachable, db down, non-HA) resolves to a value the renderer
+ * can degrade on, and the whole probe is raced against a short timeout so
+ * `status` never hangs.
+ *
+ * @returns {Promise<{ streaming: boolean, state: string, lagBytes: number|null } | null>}
+ */
+async function checkReplication(envName, envConfig, projectName, deps = {}) {
+  const {
+    sshRun: _sshRun = sshRun,
+    sshKubectl: _sshKubectl = sshKubectl,
+    getPostgresPod: _getPod = getPostgresPod,
+    getSSHKeyPath: _getKey = getSSHKeyPath,
+    timeoutMs = 10_000,
+  } = deps;
+
+  const isHA = !!(envConfig.ha?.enabled || envConfig.ha === true || envConfig.secondaryRegion);
+  if (!isHA) return null;
+
+  const servers = envConfig.servers || [];
+  const primary = servers.find((sv) => sv.role === 'primary') || servers[0];
+  if (!primary?.ip) return null;
+
+  const sshKeyPath = _getKey(envName);
+  if (!existsSync(sshKeyPath)) return null;
+
+  const isCompose = envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha';
+  // No string literals in the SQL → no shell/psql quoting hazards. `-tA` uses
+  // '|' as the field separator, so a connected standby yields `streaming|<lag>`.
+  const sql =
+    'SELECT state, pg_wal_lsn_diff(pg_current_wal_lsn(), replay_lsn) FROM pg_stat_replication';
+
+  const probe = (async () => {
+    let out;
+    if (isCompose) {
+      out = await _sshRun(
+        primary.ip,
+        sshKeyPath,
+        [
+          'bash',
+          '-lc',
+          `cd /opt/${projectName} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc "${sql}"`,
+        ],
+        { timeout: timeoutMs },
+      );
+    } else {
+      const pod = await _getPod(primary.ip, sshKeyPath);
+      out = await _sshKubectl(
+        primary.ip,
+        sshKeyPath,
+        [
+          'exec',
+          '-n',
+          'vibecarbon',
+          pod,
+          '--',
+          'psql',
+          '-U',
+          'supabase_admin',
+          '-d',
+          'postgres',
+          '-tAc',
+          sql,
+        ],
+        { timeout: timeoutMs },
+      );
+    }
+    const line = (typeof out === 'string' ? out : '')
+      .split('\n')
+      .map((l) => l.trim())
+      .filter(Boolean)[0];
+    if (!line) return { streaming: false, state: 'no standby connected', lagBytes: null };
+    const [state, lagStr] = line.split('|');
+    const lag = lagStr ? Number.parseInt(lagStr, 10) : Number.NaN;
+    return {
+      streaming: state === 'streaming',
+      state: state || 'unknown',
+      lagBytes: Number.isNaN(lag) ? null : lag,
+    };
+  })();
+
+  try {
+    return await Promise.race([
+      probe,
+      new Promise((resolve) => {
+        // .unref() so a fast probe win doesn't leave this timer holding the
+        // event loop open and delaying `status` exit by the timeout window.
+        const t = setTimeout(
+          () => resolve({ streaming: false, state: 'unknown', lagBytes: null }),
+          timeoutMs + 2_000,
+        );
+        if (typeof t?.unref === 'function') t.unref();
+      }),
+    ]);
+  } catch {
+    return { streaming: false, state: 'unknown', lagBytes: null };
+  }
+}
+
 async function getServerInfo(serverId) {
   const apiToken = process.env.HETZNER_API_TOKEN;
   if (!apiToken) return null;
@@ -506,6 +609,20 @@ function renderEnvironment(envName, envConfig, checks) {
       ? `${c.success('Enabled')} ${c.dim(`(failover: ${failoverRegion})`)}`
       : c.success('Enabled');
     lines.push(`${c.dim('HA')}             ${haDisplay}`);
+
+    // Real replication state (finding #4) — never a hardcoded "streaming".
+    if (checks.replication) {
+      const r = checks.replication;
+      let replDisplay;
+      if (r.streaming) {
+        const lag =
+          r.lagBytes != null ? c.dim(` (lag: ${(r.lagBytes / 1024).toFixed(0)} KiB)`) : '';
+        replDisplay = `${c.success('streaming')}${lag}`;
+      } else {
+        replDisplay = `${c.error(r.state || 'not streaming')} ${c.dim('— DR not guaranteed')}`;
+      }
+      lines.push(`${c.dim('Replication')}    ${replDisplay}`);
+    }
   }
 
   // Servers
@@ -816,6 +933,10 @@ async function main() {
       // Git sync
       checks.gitSync = checkGitSync(envName, envConfig);
 
+      // Real replication state for HA envs (best-effort, hard-bounded). null
+      // for non-HA or when the primary/key isn't locally reachable.
+      checks.replication = await checkReplication(envName, envConfig, projectConfig.projectName);
+
       return { envName, config: envConfig, checks };
     }),
   );
@@ -902,6 +1023,7 @@ export {
   checkHttpEndpoint,
   checkLocalDev,
   checkRemoteHealth,
+  checkReplication,
   formatRelativeTime,
   getBranchName,
   getServerInfo,

package/src/upgrade.js

@@ -26,7 +26,6 @@ import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
 import { c, printBanner } from './lib/colors.js';
 import { runCommandAsync } from './lib/command.js';
-import { requireLicense } from './lib/licensing/index.js';
 import { mergePackageJson } from './lib/merge-package-json.js';
 import {
   adaptDockerfileForPackageManager,
@@ -294,9 +293,6 @@ async function main(cliArgs) {
   // Detect project
   assertInProjectDir();
 
-  // Require a paid license (Diamond or Fullerene)
-  requireLicense('upgrade');
-
   const cwd = process.cwd();
   const manifest = loadManifest(cwd);
   const currentTemplateVersion = manifest.templateVersion || '0.0.0';

package/carbon/ha/activate-standby.sh

@@ -1,52 +0,0 @@
-#!/bin/bash
-# Promote a standby PostgreSQL to primary and scale up services.
-#
-# This script runs ON the standby master node and uses kubectl to:
-#   1. Promote PostgreSQL from standby to primary
-#   2. Wait for the promotion to complete
-#   3. Scale up Supabase and application services
-#
-# Optional env vars:
-#   NAMESPACE — Kubernetes namespace (default: vibecarbon)
-
-set -euo pipefail
-
-NAMESPACE="${NAMESPACE:-vibecarbon}"
-PGDATA="/var/lib/postgresql/data"
-
-# Find the postgres pod
-POD=$(kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=supabase-db -o jsonpath='{.items[0].metadata.name}')
-if [ -z "$POD" ]; then
-  echo "ERROR: No postgres pod found in namespace $NAMESPACE"
-  exit 1
-fi
-
-echo "Promoting standby: pod=$POD"
-
-# 1. Promote PostgreSQL
-echo "Promoting PostgreSQL standby to primary..."
-kubectl exec -n "$NAMESPACE" "$POD" -- su postgres -c "pg_ctl promote -D $PGDATA" 2>/dev/null || true
-
-# 2. Wait for promotion to complete
-echo "Waiting for promotion..."
-for i in $(seq 1 30); do
-  result=$(kubectl exec -n "$NAMESPACE" "$POD" -- psql -U supabase_admin -tAc 'SELECT pg_is_in_recovery()' 2>/dev/null || echo "t")
-  if [ "$result" = "f" ]; then
-    echo "PostgreSQL promoted successfully"
-    break
-  fi
-  if [ "$i" = "30" ]; then
-    echo "WARNING: Promotion not confirmed after 60 seconds"
-  fi
-  sleep 2
-done
-
-# 3. Scale up services
-echo "Scaling up services..."
-kubectl scale deployment app -n "$NAMESPACE" --replicas=2
-kubectl scale deployment auth -n "$NAMESPACE" --replicas=2
-kubectl scale deployment rest -n "$NAMESPACE" --replicas=2
-kubectl scale deployment realtime -n "$NAMESPACE" --replicas=2
-kubectl scale deployment storage -n "$NAMESPACE" --replicas=1
-
-echo "Standby activation complete"