vibecarbon 0.9.0 → 0.11.0

package/src/lib/prod-confirm.js

@@ -0,0 +1,65 @@
+/**
+ * Shared production type-to-confirm guard.
+ *
+ * Destructive commands (destroy, restore, failover) must NOT let a `-y` /
+ * `--yes` flag silently blow away a production environment. This module is the
+ * single source of truth for "which envs are production" and for the
+ * type-to-confirm prompt that runs UNCONDITIONALLY (independent of -y) on those
+ * envs — matching `destroy`'s long-standing behavior.
+ *
+ * `src/destroy.js` still carries its own copy of `requiresProdTypeToConfirm`
+ * for its bespoke `projectName-envName` slug; new callers (restore, and later
+ * failover) should import from here.
+ */
+
+import * as p from '@clack/prompts';
+
+/**
+ * Returns true for environment names that require a type-to-confirm prompt even
+ * when -y is passed. Currently: `prod` and `production` (case-insensitive).
+ * A trailing/leading qualifier (e.g. `prod-backup`, `production-us`) is NOT
+ * treated as production — it is a distinct environment.
+ *
+ * @param {string | null | undefined} envName
+ * @returns {boolean}
+ */
+export function requiresProdTypeToConfirm(envName) {
+  if (!envName) return false;
+  return /^(prod|production)$/i.test(envName);
+}
+
+/**
+ * If `envName` is a production environment, require the operator to type a
+ * confirmation string before continuing — even under -y. On cancel or a
+ * non-production env with no confirmation needed, behaves correctly:
+ *   - non-prod env: returns immediately (no prompt).
+ *   - prod env: prompts; a cancel exits(0); a correct entry returns.
+ *
+ * Exits the process (code 0) on cancel — callers do not need to handle it.
+ *
+ * @param {string} envName
+ * @param {object} [opts]
+ * @param {string} [opts.confirmValue=envName] - the exact string to type
+ * @param {string} [opts.actionLabel='this operation'] - verb shown in the prompt (e.g. 'restore')
+ * @param {boolean} [opts.yes=false] - whether -y was passed (only affects the warning copy)
+ * @returns {Promise<void>}
+ */
+export async function confirmProdOrExit(envName, opts = {}) {
+  const { confirmValue = envName, actionLabel = 'this operation', yes = false } = opts;
+  if (!requiresProdTypeToConfirm(envName)) return;
+
+  if (yes) {
+    p.log.warn(
+      `A ${actionLabel} against a production environment still requires type-to-confirm, even with -y.`,
+    );
+  }
+
+  const doubleConfirm = await p.text({
+    message: `Type "${confirmValue}" to confirm ${actionLabel} of the production environment:`,
+    validate: (v) => (v !== confirmValue ? `Please type "${confirmValue}" to confirm` : undefined),
+  });
+  if (p.isCancel(doubleConfirm)) {
+    p.cancel('Operation cancelled.');
+    process.exit(0);
+  }
+}

package/src/lib/providers/hetzner-s3.js

@@ -17,6 +17,7 @@
 
 import {
   AbortMultipartUploadCommand,
+  CopyObjectCommand,
   CreateBucketCommand,
   DeleteBucketCommand,
   DeleteObjectsCommand,
@@ -251,6 +252,74 @@ export class HetznerS3Provider {
     }
   }
 
+  /**
+   * Return true if the bucket contains at least one object under `prefix`.
+   * Tolerant of NoSuchBucket (returns false) so callers can probe a bucket
+   * that may not exist yet. Used by the deploy-time Pulumi-state migration to
+   * decide whether the dedicated state bucket has already been seeded and
+   * whether the legacy app bucket still holds state to copy over.
+   * @param {string} bucketName
+   * @param {string} prefix
+   * @returns {Promise<boolean>}
+   */
+  async hasObjectsWithPrefix(bucketName, prefix) {
+    try {
+      const res = await this._send(
+        new ListObjectsV2Command({ Bucket: bucketName, Prefix: prefix, MaxKeys: 1 }),
+        {
+          terminal: (err) => {
+            const status = err.$metadata?.httpStatusCode;
+            return err.name === 'NoSuchBucket' || status === 404;
+          },
+        },
+      );
+      return (res.KeyCount ?? res.Contents?.length ?? 0) > 0;
+    } catch (err) {
+      const status = err.$metadata?.httpStatusCode;
+      if (err.name === 'NoSuchBucket' || status === 404) return false;
+      throw err;
+    }
+  }
+
+  /**
+   * Copy every object under `prefix` from `srcBucket` to `destBucket`,
+   * preserving keys. Server-side copy (CopyObjectCommand) — no bytes transit
+   * the operator. Used to migrate legacy Pulumi state (the `.pulumi/` prefix)
+   * out of the app storage bucket into the dedicated state bucket. Both
+   * buckets must be in this provider's region.
+   * @param {string} srcBucket
+   * @param {string} destBucket
+   * @param {string} prefix
+   * @returns {Promise<{copied: number}>}
+   */
+  async copyPrefix(srcBucket, destBucket, prefix) {
+    let continuationToken;
+    let copied = 0;
+    do {
+      const listResult = await this._send(
+        new ListObjectsV2Command({
+          Bucket: srcBucket,
+          Prefix: prefix,
+          ContinuationToken: continuationToken,
+        }),
+      );
+      for (const obj of listResult.Contents || []) {
+        await this._send(
+          new CopyObjectCommand({
+            Bucket: destBucket,
+            Key: obj.Key,
+            // CopySource must be URL-encoded; keys contain `/` path separators
+            // (`.pulumi/stacks/...`) which encodeURI preserves.
+            CopySource: encodeURI(`${srcBucket}/${obj.Key}`),
+          }),
+        );
+        copied += 1;
+      }
+      continuationToken = listResult.IsTruncated ? listResult.NextContinuationToken : undefined;
+    } while (continuationToken);
+    return { copied };
+  }
+
   /**
    * Search all S3 regions for a bucket we own.
    * Each region's HeadBucket failure is intentionally swallowed — finding
@@ -674,3 +743,19 @@ export function sanitizeBucketName(projectName, suffix = 'storage') {
     .replace(/^-|-$/g, '') // Remove leading/trailing hyphens
     .slice(0, 63); // Truncate to max length
 }
+
+/**
+ * Derive the dedicated Pulumi-state bucket name from the app storage bucket
+ * name. Pulumi state used to live in the app storage bucket, which created a
+ * destroy-time circular hazard (deleting the storage bucket nuked the state
+ * backend mid-destroy). State now lives in a separate bucket derived once,
+ * deterministically, from the app bucket — so the derivation is stable across
+ * deploy / scale / destroy and identical for both HA stacks (they share one
+ * state bucket).
+ *
+ * @param {string} appBucketName - The app storage bucket (e.g. `myapp-storage`)
+ * @returns {string} - Valid state bucket name (e.g. `myapp-storage-pulumi-state`)
+ */
+export function deriveStateBucketName(appBucketName) {
+  return sanitizeBucketName(appBucketName, 'pulumi-state');
+}

package/src/lib/retry.js

@@ -0,0 +1,59 @@
+/**
+ * Shared retry/polling primitives for the exec layer.
+ *
+ * Two shapes cover every bespoke loop in the codebase:
+ *  - runWithRetry: N attempts with explicit inter-attempt delays
+ *    (kubectl transient retries, ssh transient retries, sideload/push settles).
+ *  - pollUntil: probe under a time budget with capped exponential backoff
+ *    (wait-for-k3s, wait-for-schema, wait-for-API-healthy, delete-until-404).
+ */
+import { setTimeout as sleep } from 'node:timers/promises';
+
+export async function runWithRetry(
+  fn,
+  { delaysMs = [5000, 5000], isTransient = () => true, onRetry } = {},
+) {
+  let attempt = 0;
+  // attempts = delaysMs.length + 1
+  for (;;) {
+    try {
+      return await fn(attempt);
+    } catch (err) {
+      if (attempt >= delaysMs.length || !isTransient(err)) throw err;
+      attempt += 1;
+      if (onRetry) onRetry(err, attempt);
+      await sleep(delaysMs[attempt - 1]);
+    }
+  }
+}
+
+export async function pollUntil(
+  probe,
+  {
+    budgetMs,
+    initialDelayMs = 2000,
+    maxDelayMs = 15_000,
+    backoffFactor = 2,
+    description = 'condition',
+  } = {},
+) {
+  const deadline = Date.now() + budgetMs;
+  let delay = initialDelayMs;
+  let lastErr;
+  for (;;) {
+    try {
+      const result = await probe();
+      if (result) return result;
+      lastErr = undefined;
+    } catch (err) {
+      lastErr = err;
+    }
+    if (Date.now() + delay > deadline) break;
+    await sleep(delay);
+    delay = Math.min(delay * backoffFactor, maxDelayMs);
+  }
+  const cause = lastErr ? `: ${lastErr.message}` : '';
+  const err = new Error(`Timed out after ${budgetMs}ms waiting for ${description}${cause}`);
+  err.cause = lastErr;
+  throw err;
+}

package/src/lib/scale-plan.js

@@ -0,0 +1,159 @@
+/**
+ * Pure planning helpers for `vibecarbon scale` (k8s / k8s-ha).
+ *
+ * These functions carry NO side effects — no clack prompts, no SSH, no fetch,
+ * no Pulumi. They translate parsed flags and resolved config into the plain
+ * data shapes the orchestration code in src/scale.js consumes, which keeps the
+ * two behaviors that matter most testable in isolation:
+ *
+ *   - the non-interactive `-yes`/`-type`/bounds flag matrix, and
+ *   - the Pulumi programConfig assembly, whose output MUST stay byte-identical
+ *     to what `deploy` produced or Pulumi plans a destructive replace of every
+ *     node (etcd loss). See the extensive comments at the call site.
+ */
+import { DEFAULT_WORKER_MAX, DEFAULT_WORKER_MIN } from './deploy/utils.js';
+
+const REGION_TO_NETWORK_ZONE = {
+  nbg1: 'eu-central',
+  hel1: 'eu-central',
+  fsn1: 'eu-central',
+  hil: 'us-west',
+  ash: 'us-east',
+  sin: 'ap-southeast',
+};
+
+/**
+ * Resolve the non-interactive scale plan from parsed flags.
+ *
+ * Returns `{ changes, newValues }` for the two scripted branches:
+ *   - `-yes -type X`  → resize every node role to X (plus workerBounds when
+ *     --min/--max are also present).
+ *   - `-yes` + bounds → cluster-autoscaler bounds only.
+ * Returns `null` when neither branch matches, signalling the caller to fall
+ * back to the interactive multiselect prompt.
+ *
+ * `changes[]` elements are the string ids the caller dispatches on:
+ * 'masterType' | 'supabaseType' | 'workerType' | 'workerBounds'.
+ *
+ * envConfig is accepted for signature parity with the interactive caller; the
+ * non-interactive branches are a pure function of `parsed`.
+ *
+ * @param {{ yes?: boolean, type?: string|null, minWorkers?: number|null, maxWorkers?: number|null }} parsed
+ * @param {object} envConfig
+ * @returns {{ changes: string[], newValues: Record<string, unknown> } | null}
+ */
+export function planK8sScaleChanges(parsed, _envConfig) {
+  const newValues = {};
+
+  if (parsed.yes && parsed.type) {
+    // `--type X` means "scale every node role to X" for parity with compose's
+    // `--type X` (which resizes the one VPS).
+    const changes = ['masterType', 'supabaseType', 'workerType'];
+    newValues.masterType = parsed.type;
+    newValues.supabaseType = parsed.type;
+    newValues.workerType = parsed.type;
+    // Allow --type and bounds to be combined in one invocation.
+    if (parsed.minWorkers != null || parsed.maxWorkers != null) {
+      changes.push('workerBounds');
+      if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
+      if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+    }
+    return { changes, newValues };
+  }
+
+  if (parsed.yes && (parsed.minWorkers != null || parsed.maxWorkers != null)) {
+    // Bounds-only path: --min-workers and/or --max-workers without --type.
+    const changes = ['workerBounds'];
+    if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
+    if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+    return { changes, newValues };
+  }
+
+  return null;
+}
+
+/**
+ * Assemble the Hetzner-k8s Pulumi programConfig. Its output MUST be
+ * byte-identical to what deployK3s passed at deploy time — every field that
+ * flows into a Server's `sshKeys`, `firewallIds`, `labels`, or `userData` is a
+ * tripwire for a destructive replace, and replacing master wipes etcd.
+ *
+ * @param {object} inputs
+ * @param {string} inputs.projectName
+ * @param {string} inputs.environment          Cluster env (e.g. `prod`, `prod-primary`).
+ * @param {string} inputs.sshPublicKey
+ * @param {string[]} inputs.allowedCidrs        Operator CIDRs (SSH + k8s API).
+ * @param {string|undefined} inputs.existingSshKeyId
+ * @param {string} inputs.location              Cluster region.
+ * @param {Record<string, unknown>} inputs.newValues   Plan output; may set *Type/*Workers.
+ * @param {string} inputs.currentMasterType
+ * @param {string} inputs.currentSupabaseType
+ * @param {string} inputs.currentWorkerType
+ * @param {number|undefined} inputs.persistedMinWorkers   envConfig.minWorkers
+ * @param {number|undefined} inputs.persistedMaxWorkers   envConfig.maxWorkers
+ * @param {string} inputs.k3sVersion
+ * @param {Record<string, string>} inputs.labels
+ * @param {string} inputs.apiToken
+ * @returns {object}
+ */
+export function buildProgramConfig({
+  projectName,
+  environment,
+  sshPublicKey,
+  allowedCidrs,
+  existingSshKeyId,
+  location,
+  newValues,
+  currentMasterType,
+  currentSupabaseType,
+  currentWorkerType,
+  persistedMinWorkers,
+  persistedMaxWorkers,
+  k3sVersion,
+  labels,
+  apiToken,
+}) {
+  return {
+    projectName,
+    environment,
+    sshPublicKey,
+    allowedSshIps: allowedCidrs,
+    allowedK8sApiIps: allowedCidrs,
+    // HA deploys share one Hetzner SshKey across primary + standby and pass
+    // `existingSshKeyId` so neither stack manages the resource. Single-cluster
+    // lets Pulumi own the SshKey (existingSshKeyId = undefined).
+    existingSshKeyId,
+    location,
+    networkZone: REGION_TO_NETWORK_ZONE[location] || 'eu-central',
+    masterServerType: newValues.masterType ?? currentMasterType,
+    supabaseServerType: newValues.supabaseType ?? currentSupabaseType,
+    workerServerType: newValues.workerType ?? currentWorkerType,
+    // minWorkers is Pulumi's static worker floor; maxWorkers flows to the CA
+    // patch (not consumed by Pulumi). Replay persisted values when the operator
+    // didn't override, keeping Pulumi's worker-pool plan a no-op.
+    minWorkers: newValues.minWorkers ?? persistedMinWorkers ?? DEFAULT_WORKER_MIN,
+    maxWorkers: newValues.maxWorkers ?? persistedMaxWorkers ?? DEFAULT_WORKER_MAX,
+    k3sVersion,
+    labels,
+    apiToken,
+  };
+}
+
+/**
+ * Rewrite the cluster-autoscaler container's `--nodes=` arg to a freshly
+ * formatted spec, preserving every other arg. Appends the flag if the deploy
+ * container somehow shipped without it. Pure list transform.
+ *
+ * @param {string[]} argList  Current container args (from kubectl jsonpath).
+ * @param {string} caNodesSpec  New `<min>:<max>:<type>:<region>:<pool>` spec.
+ * @returns {string[]}
+ */
+export function updateCaNodesArgs(argList, caNodesSpec) {
+  const updated = (Array.isArray(argList) ? argList : []).map((a) =>
+    typeof a === 'string' && a.startsWith('--nodes=') ? `--nodes=${caNodesSpec}` : a,
+  );
+  if (!updated.some((a) => typeof a === 'string' && a.startsWith('--nodes='))) {
+    updated.push(`--nodes=${caNodesSpec}`);
+  }
+  return updated;
+}

package/src/lib/ssh.js

@@ -8,16 +8,22 @@
  *      of dynamic tokens), or
  *   2. Use sshRunScript to execute a bash script SCP'd as a file.
  *
- * Host-key checking: first-provision callers pass { firstConnect: true }
- * which switches StrictHostKeyChecking to accept-new (TOFU). All other
- * calls use strict checking against a per-environment known_hosts file.
+ * Host-key checking: EVERY call pins against a per-environment known_hosts
+ * file — there is no /dev/null + StrictHostKeyChecking=no bypass. When a
+ * caller passes an explicit `env`, first-provision callers pass
+ * { firstConnect: true } to accept-new (TOFU) once and strict-check ('yes')
+ * thereafter. Callers that only have `(ip, sshKeyPath)` get the per-env
+ * known_hosts derived from the key path (knownHostsPathForKey) with
+ * StrictHostKeyChecking=accept-new — which still REJECTS a changed key for an
+ * already-pinned host (MITM on an established env fails) while TOFU-ing a fresh
+ * or recycled IP. The operator's ~/.ssh/known_hosts is never touched.
  */
 
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { runCommandAsync } from './command.js';
-import { knownHostsPath } from './host-keys.js';
+import { knownHostsPath, knownHostsPathForKey } from './host-keys.js';
 import { shEscape } from './shell.js';
 
 // k3s writes its kubeconfig here; kubectl doesn't find it by default in SSH sessions.
@@ -53,30 +59,36 @@ export function getSSHKeyPath(environment) {
 }
 
 /**
- * Build the SSH `-o` option args for host-key checking.
+ * Build the SSH `-o` option args for host-key checking. Always pins against a
+ * per-environment known_hosts file under .vibecarbon/ — never /dev/null.
+ * GlobalKnownHostsFile=/dev/null ignores the system-wide file; the operator's
+ * ~/.ssh/known_hosts is never read or polluted (Hetzner recycles public IPs,
+ * and a stale entry there would reject an unrelated reconnect).
  *
- * - With `env`: StrictHostKeyChecking=yes against .vibecarbon/known_hosts_<env>
- *   (or accept-new if firstConnect=true — used during first provision).
+ * - With explicit `env`: pin to .vibecarbon/known_hosts_<env>,
+ *   StrictHostKeyChecking=yes (or accept-new when firstConnect=true, used
+ *   during first provision).
  *
- * - Without `env`: bypass the user's known_hosts with UserKnownHostsFile=
- *   /dev/null and StrictHostKeyChecking=no, matching the deploy path's long-
- *   standing SSH_OPTS in compose/index.js. This keeps backup/restore/scale/
- *   failover consistent with the deploy flow and avoids the Hetzner recycled-
- *   IP footgun: destroy-then-redeploy gives you the same public IP with a new
- *   host key, and a stale TOFU entry in ~/.ssh/known_hosts would refuse the
- *   reconnect. H-1 (tracked in docs/superpowers/specs/2026-04-17-security-
- *   remediation-design.md) replaces this with env-scoped pinned known_hosts
- *   across every CLI command — callers pass `env` once the deploy path
- *   populates .vibecarbon/known_hosts_<env>.
+ * - With only `sshKeyPath` (backup/restore/scale/failover only receive the key
+ *   path, not an env): derive .vibecarbon/known_hosts_<env> from the key path
+ *   (knownHostsPathForKey) and use StrictHostKeyChecking=accept-new. accept-new
+ *   bootstraps an empty pin and TOFU's a fresh/recycled IP, but REJECTS a
+ *   changed key for an already-pinned host — so a MITM against an established
+ *   env fails, while destroy→redeploy (same IP, new key, re-seeded on
+ *   provision) does not spuriously hard-fail.
  */
-function sshHostKeyOpts(env, { firstConnect = false } = {}) {
+function sshHostKeyOpts(env, { firstConnect = false, sshKeyPath } = {}) {
   const opts = [];
   if (env) {
     opts.push('-o', `UserKnownHostsFile=${knownHostsPath(env)}`);
+    opts.push('-o', 'GlobalKnownHostsFile=/dev/null');
     opts.push('-o', `StrictHostKeyChecking=${firstConnect ? 'accept-new' : 'yes'}`);
+  } else if (sshKeyPath) {
+    opts.push('-o', `UserKnownHostsFile=${knownHostsPathForKey(sshKeyPath)}`);
+    opts.push('-o', 'GlobalKnownHostsFile=/dev/null');
+    opts.push('-o', 'StrictHostKeyChecking=accept-new');
   } else {
-    opts.push('-o', 'UserKnownHostsFile=/dev/null');
-    opts.push('-o', 'StrictHostKeyChecking=no');
+    throw new Error('sshHostKeyOpts requires either `env` or `sshKeyPath` for host-key pinning');
   }
   opts.push('-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10');
   // ConnectTimeout only covers TCP connect — once the socket is open, ssh
@@ -94,18 +106,6 @@ function sshHostKeyOpts(env, { firstConnect = false } = {}) {
   return opts;
 }
 
-/**
- * The no-host-key-pinning SSH option set as a single space-joined string,
- * for the compose deploy path's string-command runners (sshRun/sshRunAsync
- * in compose/index.js) and raw `ssh ${SSH_OPTS}` interpolations.
- *
- * Derived from sshHostKeyOpts() so the string form can never drift from the
- * argv form — the historical footgun was compose/ha.js hand-copying this
- * string and silently dropping the ServerAlive keepalives, letting a
- * banner-exchange hang stall an HA deploy for ~600s.
- */
-export const NO_PIN_SSH_OPTS = sshHostKeyOpts().join(' ');
-
 /**
  * Execute a command on a remote server via SSH using argv form.
  *
@@ -143,7 +143,7 @@ export async function sshRun(ip, sshKeyPath, argv, options = {}) {
     'ssh',
     '-i',
     sshKeyPath,
-    ...sshHostKeyOpts(env, { firstConnect }),
+    ...sshHostKeyOpts(env, { firstConnect, sshKeyPath }),
     '--',
     `root@${ip}`,
     remoteCmd,
@@ -189,7 +189,7 @@ export async function scpDownload(ip, sshKeyPath, remotePath, localPath, options
     'scp',
     '-i',
     sshKeyPath,
-    ...sshHostKeyOpts(env, { firstConnect }),
+    ...sshHostKeyOpts(env, { firstConnect, sshKeyPath }),
     '--',
     `root@${ip}:${remotePath}`,
     localPath,
@@ -206,7 +206,7 @@ export async function scpUpload(ip, sshKeyPath, localPath, remotePath, options =
     'scp',
     '-i',
     sshKeyPath,
-    ...sshHostKeyOpts(env, { firstConnect }),
+    ...sshHostKeyOpts(env, { firstConnect, sshKeyPath }),
     '--',
     localPath,
     `root@${ip}:${remotePath}`,

package/src/restore.js

@@ -19,6 +19,7 @@
 import { existsSync } from 'node:fs';
 import { basename } from 'node:path';
 import * as p from '@clack/prompts';
+import { identifyServers } from './failover.js';
 import { formatInstant } from './lib/backup-format.js';
 import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
@@ -31,9 +32,14 @@ import { loadCredentials, loadProjectConfig } from './lib/config.js';
 // while still accepting injected mocks for unit tests.
 import { configureStandbyReplication as realConfigureStandbyReplication } from './lib/deploy/compose/ha.js';
 import { restoreCompose as realRestoreCompose } from './lib/deploy/compose/index.js';
-import { requireLicense } from './lib/licensing/index.js';
+import {
+  readK8sReplicationState as realReadK8sReplicationState,
+  reseedStandbyFromPrimary as realReseedStandbyFromPrimary,
+  verifyStreaming,
+} from './lib/deploy/replication.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
+import { confirmProdOrExit } from './lib/prod-confirm.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { getPostgresPod, getSSHKeyPath, sshKubectl } from './lib/ssh.js';
 import { createTracker } from './lib/tracker.js';
@@ -245,7 +251,6 @@ export async function run(args) {
   // restore` from a parent directory emits the canonical message.
   assertInProjectDir();
 
-  requireLicense('restore');
   printBanner();
   p.intro(`${c.bold('vibecarbon restore')} ${c.dim(`v${VERSION}`)}`);
 
@@ -392,19 +397,15 @@ export async function run(args) {
       p.cancel('Operation cancelled.');
       process.exit(0);
     }
-
-    if (envName === 'prod' || envName === 'production') {
-      const doubleConfirm = await p.text({
-        message: `Type "${envName}" to confirm restoration of production database:`,
-        validate: (v) => (v !== envName ? `Please type "${envName}" to confirm` : undefined),
-      });
-      if (p.isCancel(doubleConfirm)) {
-        p.cancel('Operation cancelled.');
-        process.exit(0);
-      }
-    }
   }
 
+  // SECURITY: the production type-to-confirm runs UNCONDITIONALLY — even with
+  // -y — so `restore -y prod` can never silently overwrite the production
+  // database. This is deliberately OUTSIDE the `!values.y` block above (the
+  // soft y/N confirm is skippable with -y; this hard gate is not). Mirrors
+  // destroy's prod guard; shared helper so failover can reuse it.
+  await confirmProdOrExit(envName, { actionLabel: 'restore', yes: !!values.y });
+
   // Dispatch by mode
   const tracker = createTracker('restore', { environment: envName });
   const s = tracker.spinner();
@@ -427,6 +428,7 @@ export async function run(args) {
         envName,
         serverIp,
         sshKeyPath,
+        envConfig,
       });
     }
   } catch (error) {
@@ -645,7 +647,21 @@ async function setRestoreMarker(ip, sshKeyPath, value) {
   ]);
 }
 
-async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath }) {
+export async function runK8sRestore({
+  s,
+  chosenSource,
+  envName,
+  serverIp,
+  sshKeyPath,
+  envConfig = {},
+  // Injected so the k8s-HA standby re-seed dispatch is unit-testable without a
+  // real cluster (mirrors runComposeRestore). Production passes none.
+  reseedStandbyFromPrimary = realReseedStandbyFromPrimary,
+  readReplicationState = realReadK8sReplicationState,
+  // Pacing for the post-reseed streaming verify — injectable so tests don't wait
+  // on real timers. Production uses the default setTimeout-backed sleep.
+  verifySleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+}) {
   if (chosenSource.kind === 'local') {
     throw new Error(
       'k8s restore is wal-g-based and pulls from S3 — local backup files are not supported. Use `-source latest` (or a timestamp for PITR).',
@@ -695,6 +711,78 @@ async function runK8sRestore({ s, chosenSource, envName, serverIp, sshKeyPath })
 
   p.log.success('Restore completed successfully');
   p.log.info('The application has been scaled back up.');
+
+  // k8s-HA: the standby is a SEPARATE cluster deployed with `restore: null` — a
+  // streaming replica, never wal-g-restored (a wal-g fetch on the standby would
+  // create a divergent timeline; see k8s/ha/index.js). This restore rewound the
+  // PRIMARY to an earlier LSN, so the standby now has WAL AHEAD of the primary
+  // and CANNOT resume streaming (timeline divergence).
+  //
+  // Finding #2: instead of the old warn-and-point-to-`deploy`, perform a
+  // first-class VERIFIED re-seed of the standby using the SHARED reseed
+  // primitive (the same hardened staged-basebackup+atomic-swap the failover path
+  // uses), then confirm streaming from the restored primary. Fail loudly if it
+  // can't complete — never silently leave a diverged standby.
+  const isK8sHA = !!(envConfig.ha?.enabled || envConfig.ha === true || envConfig.secondaryRegion);
+  if (isK8sHA) {
+    const servers = identifyServers(envName, envConfig, {});
+    const standbyIp = servers?.standby?.ip;
+    const primarySupabaseIp = servers?.primary?.supabaseIp || servers?.primary?.ip;
+    if (!standbyIp || !primarySupabaseIp) {
+      // We can't locate the standby / primary source — fail loudly rather than
+      // report a clean restore while the standby silently diverges.
+      throw new Error(
+        'HA restore: the primary was restored, but the standby cluster or the primary ' +
+          'supabase IP could not be resolved from config, so the standby could NOT be ' +
+          `re-seeded and now has a DIVERGED timeline. DR is not guaranteed. Resync with ` +
+          `\`vibecarbon deploy ${envName}\` (re-runs the verified replication setup).`,
+      );
+    }
+
+    s.start('Re-seeding standby cluster from restored primary (pg_basebackup)');
+    let reseedResult;
+    try {
+      reseedResult = await reseedStandbyFromPrimary(standbyIp, sshKeyPath, primarySupabaseIp);
+    } catch (err) {
+      s.stop('Standby re-seed failed');
+      throw new Error(
+        `HA restore: the primary was restored and is serving, but re-seeding the standby ` +
+          `FAILED: ${err.message}\nThe standby has a DIVERGED timeline and is NOT replicating — ` +
+          `DR is not guaranteed. Resync with \`vibecarbon deploy ${envName}\`.`,
+      );
+    }
+    if (reseedResult === 'skipped') {
+      s.stop('Standby re-seed skipped — primary unreachable from standby');
+      throw new Error(
+        'HA restore: the standby could NOT reach the restored primary to re-seed ' +
+          '(cross-cluster connectivity). The standby has a DIVERGED timeline and is NOT ' +
+          `replicating — DR is not guaranteed. Verify the replication firewall/network, then ` +
+          `resync with \`vibecarbon deploy ${envName}\`.`,
+      );
+    }
+    s.stop('Standby re-seeded from restored primary');
+
+    // Confirm streaming from the restored primary — a re-seed that boots but
+    // never streams is still a diverged standby.
+    s.start('Verifying standby is streaming from restored primary');
+    const { streaming, lastState } = await verifyStreaming({
+      readState: async () => readReplicationState(servers.primary.ip, sshKeyPath),
+      attempts: 15,
+      delaysMs: [1000, 2000, 3000],
+      sleep: verifySleep,
+    });
+    if (!streaming) {
+      s.stop('Standby streaming NOT confirmed');
+      throw new Error(
+        `HA restore: the standby was re-seeded but streaming replication is NOT confirmed ` +
+          `(last pg_stat_replication.state=${
+            lastState ? JSON.stringify(lastState) : 'no replica connected'
+          }). DR is not guaranteed. Resync with \`vibecarbon deploy ${envName}\`.`,
+      );
+    }
+    s.stop('Standby streaming from restored primary — DR restored');
+  }
+
   p.log.info(`Verify with: ${c.info(`vibecarbon status ${envName}`)}`);
 }