vibecarbon 0.9.0 → 0.11.0

package/src/scale.js

@@ -38,14 +38,16 @@ import {
   waitForSSH,
 } from './lib/deploy/compose/index.js';
 import { buildRemote } from './lib/deploy/remote-build.js';
+import { isHATier, resolveTier } from './lib/deploy/tier-registry.js';
 import { DEFAULT_WORKER_MAX, DEFAULT_WORKER_MIN } from './lib/deploy/utils.js';
 import { waitForDNSPropagation } from './lib/dns-propagation.js';
 import { getApiToken, getS3Credentials } from './lib/hetzner-guided-setup.js';
-import { requireLicense } from './lib/licensing/index.js';
 import { ensureOperatorIpAccess } from './lib/operator-ip.js';
 import { perfAsync } from './lib/perf.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { HETZNER_PRICING_URL, HetznerProvider } from './lib/providers/hetzner.js';
+import { pollUntil } from './lib/retry.js';
+import { buildProgramConfig, planK8sScaleChanges, updateCaNodesArgs } from './lib/scale-plan.js';
 import { buildComposeTypeOptions, buildSimpleTypeOptions } from './lib/server-types.js';
 import { parseDotenv } from './lib/shell.js';
 import { sshRun, sshRunScript } from './lib/ssh.js';
@@ -99,6 +101,7 @@ const SPEC = {
 // ============================================================================
 
 async function scaleCompose(environment, envConfig, projectConfig, options = {}) {
+  const tier = options.tier || resolveTier(envConfig);
   const servers = envConfig.servers || [];
   const projectName = projectConfig.projectName;
 
@@ -132,7 +135,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
 
   // Ensure operator IP is in the firewall allowlist before any SSH work.
   try {
-    const isHA = envConfig.deployMode === 'compose-ha';
+    const isHA = isHATier(tier);
     const result = await ensureOperatorIpAccess({
       projectConfig,
       environment,
@@ -175,7 +178,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
 
   // For compose-ha: select which server(s) to scale
   let targetServers = resizableServers;
-  if (envConfig.deployMode === 'compose-ha' && resizableServers.length > 1) {
+  if (isHATier(tier) && resizableServers.length > 1) {
     const primaryServer = resizableServers.find((s) => s.role === 'primary');
     const standbyServer = resizableServers.find((s) => s.role === 'standby');
 
@@ -233,7 +236,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
     return;
   }
 
-  const ha = envConfig.deployMode === 'compose-ha';
+  const ha = isHATier(tier);
   const services = projectConfig.services || {};
   p.note(`Current Hetzner pricing: ${HETZNER_PRICING_URL}`, 'Cost');
 
@@ -289,8 +292,7 @@ async function scaleCompose(environment, envConfig, projectConfig, options = {})
   // exactly 2× single-server scale (711s vs ~365s); parallelizing makes it
   // ~max(primary, standby) ≈ 6m off the critical path.
   const scaleSingleServer = async (server) => {
-    const label =
-      envConfig.deployMode === 'compose-ha' ? `${server.role} (${server.ip})` : server.ip;
+    const label = isHATier(tier) ? `${server.role} (${server.ip})` : server.ip;
     const s = p.spinner();
 
     // 1. Backup database on old server via wal-g (pushes directly to S3)
@@ -740,6 +742,17 @@ async function updateDNS(envConfig, apiToken, domain, newIp) {
 // MAIN
 // ============================================================================
 
+// Tier → scale strategy. scaleCompose / scaleK8s are hoisted function
+// declarations, so referencing them here at module scope is safe. Compose and
+// compose-ha share one strategy (it branches on isHATier internally); likewise
+// k8s / k8s-ha.
+const SCALE_STRATEGIES = {
+  compose: scaleCompose,
+  'compose-ha': scaleCompose,
+  k8s: scaleK8s,
+  'k8s-ha': scaleK8s,
+};
+
 export async function run(args) {
   const { values, positional, errors } = parseFlags(args, SPEC);
 
@@ -764,7 +777,6 @@ export async function run(args) {
   // scale` from a parent directory emits the canonical message.
   const projectConfig = assertInProjectDir();
 
-  requireLicense('scale');
   printBanner();
   p.intro(`${c.bold('vibecarbon scale')} ${c.dim(`v${VERSION}`)}`);
 
@@ -831,15 +843,18 @@ export async function run(args) {
     process.exit(1);
   }
 
-  // Compose deployments: vertical scaling via Hetzner API
-  if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
-    await scaleCompose(environment, envConfig, projectConfig, {
-      type: parsed.type,
-      yes: parsed.yes,
-    });
-    return;
-  }
+  // Dispatch to the tier's scale strategy. The 4th arg carries the parsed
+  // flags plus the resolved `tier` so each strategy dispatches on tier /
+  // isHATier(tier) instead of re-deriving deployMode+ha.
+  const tier = resolveTier(envConfig);
+  await SCALE_STRATEGIES[tier](environment, envConfig, projectConfig, { ...parsed, tier });
+}
+
+// ============================================================================
+// KUBERNETES SCALING
+// ============================================================================
 
+async function scaleK8s(environment, envConfig, projectConfig, parsed) {
   const region = envConfig.region || 'fsn1';
 
   // Pre-fetch live server types (non-blocking, uses saved credentials if available)
@@ -884,60 +899,28 @@ export async function run(args) {
   const regionTypes = HetznerProvider.getServerTypesForRegion(region);
   const serverTypeOptions = buildSimpleTypeOptions(regionTypes, { filterSharedCpu: false });
 
+  // Non-interactive plan (pure): `-yes -type` → resize every role (matrix run
+  // #10 caught the old behavior of only changing worker pools); `-yes` + bounds
+  // → cluster-autoscaler bounds only. `null` means no scripted plan matched —
+  // fall through to the interactive multiselect. See src/lib/scale-plan.js for
+  // the branch rationale (in-place resize vs. master-replace guard, phase-8
+  // bounds TODO). The user-facing logging stays here (side-effectful).
   let changes;
-  if (parsed.yes && parsed.type) {
-    // Non-interactive: `--type X` means "scale every node role to X" for
-    // parity with compose's `--type X` (which resizes the one VPS).
-    // Without this, a k8s `--type cx33` only changed worker pools and
-    // left master + supabase on the previous type — a UX inconsistency
-    // the e2e verify-scale assertion caught (matrix run #10 k8s
-    // scale: only the worker IP showed cx33 post-scale, supabase stayed
-    // cx23).
-    //
-    // Hetzner server_type changes are in-place resizes (~2 min reboot
-    // per node), so the master-replace guard below does NOT trip on
-    // legitimate type bumps — that guard fires only on userData drift
-    // (k3sToken, labels, cloud-init template), which the probe-and-replay
-    // earlier in this function already prevents. Master upgrades cause
-    // ~2 min of control-plane downtime; running under -y means the
-    // operator accepted the cost.
-    //
-    // Per-role overrides remain available through the interactive
-    // multiselect when finer control is needed.
-    changes = ['masterType', 'supabaseType', 'workerType'];
-    newValues.masterType = parsed.type;
-    newValues.supabaseType = parsed.type;
-    newValues.workerType = parsed.type;
-    // Allow --type and bounds to be combined in one invocation. CA
-    // re-patch happens regardless once changes include 'workerBounds'.
-    if (parsed.minWorkers != null || parsed.maxWorkers != null) {
-      changes.push('workerBounds');
-      if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
-      if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
+  const plan = planK8sScaleChanges(parsed, envConfig);
+  if (plan) {
+    changes = plan.changes;
+    Object.assign(newValues, plan.newValues);
+    if (changes.includes('masterType')) {
+      p.log.info(
+        `Scaling all node roles (master, supabase, worker) to ${c.bold(parsed.type)} ${c.dim('(in-place resize, ~2 min downtime per node)')}`,
+      );
+    } else {
+      p.log.info(
+        `Updating cluster-autoscaler bounds: ${c.bold(
+          `min=${newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN}`,
+        )} ${c.bold(`max=${newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX}`)}`,
+      );
     }
-    p.log.info(
-      `Scaling all node roles (master, supabase, worker) to ${c.bold(parsed.type)} ${c.dim('(in-place resize, ~2 min downtime per node)')}`,
-    );
-  } else if (parsed.yes && (parsed.minWorkers != null || parsed.maxWorkers != null)) {
-    // Non-interactive bounds-only path: --min-workers and/or --max-workers
-    // without --type. We do not run Pulumi here unless minWorkers rose above
-    // the previously persisted floor (which would require new static workers
-    // to be provisioned).
-    //
-    // TODO(phase 8 follow-up): bounds-driven Pulumi changes — when
-    // minWorkers rises above the persisted floor, run Pulumi to add static
-    // workers; when minWorkers drops, leave Pulumi alone (don't reap static
-    // workers on bounds relax). For now we patch CA only; bumping min above
-    // the persisted floor will not provision new static workers until the
-    // next deploy.
-    changes = ['workerBounds'];
-    if (parsed.minWorkers != null) newValues.minWorkers = parsed.minWorkers;
-    if (parsed.maxWorkers != null) newValues.maxWorkers = parsed.maxWorkers;
-    p.log.info(
-      `Updating cluster-autoscaler bounds: ${c.bold(
-        `min=${newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN}`,
-      )} ${c.bold(`max=${newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX}`)}`,
-    );
   } else {
     changes = await p.multiselect({
       message: 'What would you like to change?',
@@ -1005,7 +988,11 @@ export async function run(args) {
     (c) => c === 'workerType' || c === 'masterType' || c === 'supabaseType',
   );
 
-  const isHA = envConfig.ha?.enabled && envConfig.secondaryRegion;
+  // isHATier(tier) is behavior-identical to `envConfig.ha?.enabled` for the k8s
+  // tier; the `&& secondaryRegion` conjunct is kept because HA cluster fan-out
+  // below also requires a configured standby region (registry predicate alone
+  // is NOT equivalent here).
+  const isHA = isHATier(parsed.tier) && envConfig.secondaryRegion;
   p.note(`Current Hetzner pricing: ${HETZNER_PRICING_URL}`, 'Cost');
 
   // 6. Require API token if infra changes (server type swap) needed
@@ -1023,11 +1010,12 @@ export async function run(args) {
   // a no-op scale that just returns) since both paths below require token.
   if (apiToken) {
     try {
-      const isHA = !!envConfig.ha?.enabled;
+      // Firewall allowlist gate uses ha-vs-not only (no secondaryRegion
+      // conjunct) — isHATier(tier) === `!!envConfig.ha?.enabled` for k8s.
       const result = await ensureOperatorIpAccess({
         projectConfig,
         environment,
-        isHA,
+        isHA: isHATier(parsed.tier),
         apiToken,
         yes: !!parsed.yes,
         onMessage: (msg) => p.log.info(msg),
@@ -1056,14 +1044,6 @@ export async function run(args) {
       );
       const { buildHetznerK8sProgram } = await import('./lib/iac/programs/hetzner-k8s.js');
       const { K3S_VERSION } = await import('./lib/deploy/k8s/k3s.js');
-      const REGION_TO_NETWORK_ZONE = {
-        nbg1: 'eu-central',
-        hel1: 'eu-central',
-        fsn1: 'eu-central',
-        hil: 'us-west',
-        ash: 'us-east',
-        sin: 'ap-southeast',
-      };
       // SSH key location depends on deploy topology:
       // - Single-cluster k8s: deployK3s' ensureSshKey writes
       //   `.vibecarbon/ssh-<env>` and lets Pulumi manage the SshKey resource.
@@ -1140,6 +1120,10 @@ export async function run(args) {
           bucket: envConfig.s3.bucket,
           region: envConfig.s3.region,
           endpoint: envConfig.s3.endpoint,
+          // Dedicated Pulumi-state bucket. Undefined for envs deployed before
+          // the state-bucket split — resolveBackendUrl then falls back to the
+          // app bucket, matching where their state actually still lives.
+          stateBucket: envConfig.s3.stateBucket,
           accessKey: s3Creds.accessKey,
           secretKey: s3Creds.secretKey,
         };
@@ -1152,45 +1136,30 @@ export async function run(args) {
       // destructive replace. The k3sToken probe-and-replay (further below)
       // keeps userData stable; HA needed `existingSshKeyId` to also be
       // mirrored or master.sshKeys would still drift and replace etcd.
+      // Byte-identical to deployK3s' program inputs — every field that flows
+      // into a Server's sshKeys/firewallIds/labels/userData is a destructive-
+      // replace tripwire (replacing master = etcd wipe). buildProgramConfig
+      // (src/lib/scale-plan.js) owns the assembly + the region→zone map + the
+      // newValues/persisted/default `??` resolution. k3sVersion and labels MUST
+      // match deployK3s (both are interpolated into userData / resource labels).
       const allowedCidrs = (projectConfig.operatorCidrs ?? []).map((e) => e.cidr);
-      const programConfig = {
+      const programConfig = buildProgramConfig({
         projectName: projectConfig.projectName,
         environment: clusterEnv,
         sshPublicKey,
-        allowedSshIps: allowedCidrs,
-        allowedK8sApiIps: allowedCidrs,
-        // HA deploys share one Hetzner SshKey across primary + standby and
-        // pass `existingSshKeyId` so neither stack manages the resource.
-        // Single-cluster lets Pulumi own the SshKey (existingSshKeyId =
-        // undefined). Mirror whichever the deploy did or master.sshKeys
-        // changes and Pulumi replaces every node.
+        allowedCidrs,
         existingSshKeyId,
         location: clusterRegion,
-        networkZone: REGION_TO_NETWORK_ZONE[clusterRegion] || 'eu-central',
-        masterServerType: newValues.masterType ?? currentMasterType,
-        supabaseServerType: newValues.supabaseType ?? currentSupabaseType,
-        workerServerType: newValues.workerType ?? currentWorkerType,
-        // Phase 8: minWorkers/maxWorkers replace workerCount. minWorkers is
-        // what Pulumi consumes (static floor of worker servers it owns).
-        // maxWorkers is not consumed by Pulumi; it flows to the CA Deployment
-        // patch below. If the operator passed --min-workers/--max-workers
-        // we honor them; otherwise replay the previously persisted values
-        // (which are needed verbatim to keep Pulumi's plan a no-op for the
-        // worker pool when the operator is just resizing types).
-        minWorkers: newValues.minWorkers ?? envConfig.minWorkers ?? DEFAULT_WORKER_MIN,
-        maxWorkers: newValues.maxWorkers ?? envConfig.maxWorkers ?? DEFAULT_WORKER_MAX,
-        // MUST match the K3S_VERSION used by deployK3s — k3sVersion is
-        // interpolated into each server's userData (cloud-init script), so a
-        // mismatch makes Pulumi see ~userData on master/supabase/workers and
-        // tries to replace them. Replacing master = etcd wipe.
+        newValues,
+        currentMasterType,
+        currentSupabaseType,
+        currentWorkerType,
+        persistedMinWorkers: envConfig.minWorkers,
+        persistedMaxWorkers: envConfig.maxWorkers,
         k3sVersion: K3S_VERSION,
-        // MUST match the labels passed by deployK3s (src/lib/deploy/k8s/k3s.js).
-        // Mismatched labels make Pulumi mark every resource as ~labels and
-        // attempt a replace — for hcloud.SshKey, replace = delete+create with
-        // the same public-key bytes, which Hetzner rejects with HTTP 409.
         labels: { 'managed-by': 'vibecarbon', 'os-flavor': 'k3s' },
         apiToken,
-      };
+      });
 
       // Probe prior stack outputs for the k3sToken so we can replay it into
       // the real program. classifyK3sTokenProbe normalizes recovered/empty/
@@ -1386,13 +1355,7 @@ export async function run(args) {
           } catch {
             argList = [];
           }
-          const updated = argList.map((a) =>
-            typeof a === 'string' && a.startsWith('--nodes=') ? `--nodes=${caNodesSpec}` : a,
-          );
-          // If for some reason --nodes wasn't there, append it.
-          if (!updated.some((a) => typeof a === 'string' && a.startsWith('--nodes='))) {
-            updated.push(`--nodes=${caNodesSpec}`);
-          }
+          const updated = updateCaNodesArgs(argList, caNodesSpec);
           const patch = JSON.stringify({
             spec: {
               template: { spec: { containers: [{ name: 'cluster-autoscaler', args: updated }] } },
@@ -1515,31 +1478,40 @@ export async function run(args) {
     // plane has truly stabilized post-resize.
     const apiSpinner = p.spinner();
     apiSpinner.start(`Waiting for API server to be reachable (${label})`);
-    const apiStart = Date.now();
     const API_READY_BUDGET_MS = 300_000;
-    let apiReady = false;
-    let lastApiErr = '';
-    while (Date.now() - apiStart < API_READY_BUDGET_MS) {
-      try {
-        runCommand(['kubectl', '--kubeconfig', kubeconfigPath, 'get', '--raw=/healthz'], {
-          silent: true,
-          timeout: 10_000,
-        });
-        apiReady = true;
-        break;
-      } catch (err) {
-        lastApiErr = err.message?.split('\n')[0]?.slice(0, 120) || String(err).slice(0, 120);
-        await new Promise((r) => setTimeout(r, 5_000));
-      }
-    }
-    if (!apiReady) {
+    // Fixed 5s interval (backoffFactor: 1) under a 300s budget — the probe
+    // throws while the floating IP is re-attaching (runCommand rejects on
+    // nonzero exit when silent), and pollUntil retries a throwing probe.
+    // Timeout still throws (preserving the old fail-fast); we re-wrap so the
+    // operator-facing message and last-error detail are unchanged.
+    try {
+      await pollUntil(
+        () => {
+          runCommand(['kubectl', '--kubeconfig', kubeconfigPath, 'get', '--raw=/healthz'], {
+            silent: true,
+            timeout: 10_000,
+          });
+          return true;
+        },
+        {
+          budgetMs: API_READY_BUDGET_MS,
+          initialDelayMs: 5000,
+          backoffFactor: 1,
+          description: 'k8s API healthy after resize',
+        },
+      );
+      apiSpinner.stop(`API server reachable (${label})`);
+    } catch (err) {
       apiSpinner.stop(`API server (${label}) not reachable within 5 min`);
+      const cause = err.cause;
+      const lastApiErr = cause
+        ? cause.message?.split('\n')[0]?.slice(0, 120) || String(cause).slice(0, 120)
+        : '';
       throw new Error(
         `Kube API server for ${label} never returned /healthz=ok within 5 min after Pulumi resize. ` +
           `Last error: ${lastApiErr}`,
       );
     }
-    apiSpinner.stop(`API server reachable (${label})`);
     // Wait for the Hetzner CSI driver DaemonSet to register on every
     // node BEFORE checking pod-Ready. RCA from k8s-ha standby failure
     // 2026-04-28 (live cluster repro under triple-node-reboot):

package/src/status.js

@@ -20,6 +20,7 @@ import { c, printBanner } from './lib/colors.js';
 import { runCommand } from './lib/command.js';
 import { cleanStaleProjects, loadGlobalRegistry, loadProjectConfig } from './lib/config.js';
 import { HetznerProvider } from './lib/providers/hetzner.js';
+import { getPostgresPod, getSSHKeyPath, sshKubectl, sshRun } from './lib/ssh.js';
 import { VERSION } from './lib/version.js';
 
 /** @type {import('./lib/cli/parse-flags.js').CommandSpec & { summary?: string, description?: string, examples?: Array<{ command: string, description?: string }> }} */
@@ -324,6 +325,108 @@ async function checkRemoteHealth(domain) {
   };
 }
 
+/**
+ * Read the REAL streaming-replication state for an HA environment by querying
+ * `pg_stat_replication` on the CURRENT primary. Surfaces honest DR state instead
+ * of a hardcoded "streaming" string (finding #4). Best-effort and hard-bounded:
+ * any failure (unreachable, db down, non-HA) resolves to a value the renderer
+ * can degrade on, and the whole probe is raced against a short timeout so
+ * `status` never hangs.
+ *
+ * @returns {Promise<{ streaming: boolean, state: string, lagBytes: number|null } | null>}
+ */
+async function checkReplication(envName, envConfig, projectName, deps = {}) {
+  const {
+    sshRun: _sshRun = sshRun,
+    sshKubectl: _sshKubectl = sshKubectl,
+    getPostgresPod: _getPod = getPostgresPod,
+    getSSHKeyPath: _getKey = getSSHKeyPath,
+    timeoutMs = 10_000,
+  } = deps;
+
+  const isHA = !!(envConfig.ha?.enabled || envConfig.ha === true || envConfig.secondaryRegion);
+  if (!isHA) return null;
+
+  const servers = envConfig.servers || [];
+  const primary = servers.find((sv) => sv.role === 'primary') || servers[0];
+  if (!primary?.ip) return null;
+
+  const sshKeyPath = _getKey(envName);
+  if (!existsSync(sshKeyPath)) return null;
+
+  const isCompose = envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha';
+  // No string literals in the SQL → no shell/psql quoting hazards. `-tA` uses
+  // '|' as the field separator, so a connected standby yields `streaming|<lag>`.
+  const sql =
+    'SELECT state, pg_wal_lsn_diff(pg_current_wal_lsn(), replay_lsn) FROM pg_stat_replication';
+
+  const probe = (async () => {
+    let out;
+    if (isCompose) {
+      out = await _sshRun(
+        primary.ip,
+        sshKeyPath,
+        [
+          'bash',
+          '-lc',
+          `cd /opt/${projectName} && docker compose exec -T db psql -U supabase_admin -d postgres -tAc "${sql}"`,
+        ],
+        { timeout: timeoutMs },
+      );
+    } else {
+      const pod = await _getPod(primary.ip, sshKeyPath);
+      out = await _sshKubectl(
+        primary.ip,
+        sshKeyPath,
+        [
+          'exec',
+          '-n',
+          'vibecarbon',
+          pod,
+          '--',
+          'psql',
+          '-U',
+          'supabase_admin',
+          '-d',
+          'postgres',
+          '-tAc',
+          sql,
+        ],
+        { timeout: timeoutMs },
+      );
+    }
+    const line = (typeof out === 'string' ? out : '')
+      .split('\n')
+      .map((l) => l.trim())
+      .filter(Boolean)[0];
+    if (!line) return { streaming: false, state: 'no standby connected', lagBytes: null };
+    const [state, lagStr] = line.split('|');
+    const lag = lagStr ? Number.parseInt(lagStr, 10) : Number.NaN;
+    return {
+      streaming: state === 'streaming',
+      state: state || 'unknown',
+      lagBytes: Number.isNaN(lag) ? null : lag,
+    };
+  })();
+
+  try {
+    return await Promise.race([
+      probe,
+      new Promise((resolve) => {
+        // .unref() so a fast probe win doesn't leave this timer holding the
+        // event loop open and delaying `status` exit by the timeout window.
+        const t = setTimeout(
+          () => resolve({ streaming: false, state: 'unknown', lagBytes: null }),
+          timeoutMs + 2_000,
+        );
+        if (typeof t?.unref === 'function') t.unref();
+      }),
+    ]);
+  } catch {
+    return { streaming: false, state: 'unknown', lagBytes: null };
+  }
+}
+
 async function getServerInfo(serverId) {
   const apiToken = process.env.HETZNER_API_TOKEN;
   if (!apiToken) return null;
@@ -506,6 +609,20 @@ function renderEnvironment(envName, envConfig, checks) {
       ? `${c.success('Enabled')} ${c.dim(`(failover: ${failoverRegion})`)}`
       : c.success('Enabled');
     lines.push(`${c.dim('HA')}             ${haDisplay}`);
+
+    // Real replication state (finding #4) — never a hardcoded "streaming".
+    if (checks.replication) {
+      const r = checks.replication;
+      let replDisplay;
+      if (r.streaming) {
+        const lag =
+          r.lagBytes != null ? c.dim(` (lag: ${(r.lagBytes / 1024).toFixed(0)} KiB)`) : '';
+        replDisplay = `${c.success('streaming')}${lag}`;
+      } else {
+        replDisplay = `${c.error(r.state || 'not streaming')} ${c.dim('— DR not guaranteed')}`;
+      }
+      lines.push(`${c.dim('Replication')}    ${replDisplay}`);
+    }
   }
 
   // Servers
@@ -816,6 +933,10 @@ async function main() {
       // Git sync
       checks.gitSync = checkGitSync(envName, envConfig);
 
+      // Real replication state for HA envs (best-effort, hard-bounded). null
+      // for non-HA or when the primary/key isn't locally reachable.
+      checks.replication = await checkReplication(envName, envConfig, projectConfig.projectName);
+
       return { envName, config: envConfig, checks };
     }),
   );
@@ -902,6 +1023,7 @@ export {
   checkHttpEndpoint,
   checkLocalDev,
   checkRemoteHealth,
+  checkReplication,
   formatRelativeTime,
   getBranchName,
   getServerInfo,

package/src/upgrade.js

@@ -26,7 +26,6 @@ import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
 import { c, printBanner } from './lib/colors.js';
 import { runCommandAsync } from './lib/command.js';
-import { requireLicense } from './lib/licensing/index.js';
 import { mergePackageJson } from './lib/merge-package-json.js';
 import {
   adaptDockerfileForPackageManager,
@@ -294,9 +293,6 @@ async function main(cliArgs) {
   // Detect project
   assertInProjectDir();
 
-  // Require a paid license (Diamond or Fullerene)
-  requireLicense('upgrade');
-
   const cwd = process.cwd();
   const manifest = loadManifest(cwd);
   const currentTemplateVersion = manifest.templateVersion || '0.0.0';

package/carbon/ha/activate-standby.sh

@@ -1,52 +0,0 @@
-#!/bin/bash
-# Promote a standby PostgreSQL to primary and scale up services.
-#
-# This script runs ON the standby master node and uses kubectl to:
-#   1. Promote PostgreSQL from standby to primary
-#   2. Wait for the promotion to complete
-#   3. Scale up Supabase and application services
-#
-# Optional env vars:
-#   NAMESPACE — Kubernetes namespace (default: vibecarbon)
-
-set -euo pipefail
-
-NAMESPACE="${NAMESPACE:-vibecarbon}"
-PGDATA="/var/lib/postgresql/data"
-
-# Find the postgres pod
-POD=$(kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/name=supabase-db -o jsonpath='{.items[0].metadata.name}')
-if [ -z "$POD" ]; then
-  echo "ERROR: No postgres pod found in namespace $NAMESPACE"
-  exit 1
-fi
-
-echo "Promoting standby: pod=$POD"
-
-# 1. Promote PostgreSQL
-echo "Promoting PostgreSQL standby to primary..."
-kubectl exec -n "$NAMESPACE" "$POD" -- su postgres -c "pg_ctl promote -D $PGDATA" 2>/dev/null || true
-
-# 2. Wait for promotion to complete
-echo "Waiting for promotion..."
-for i in $(seq 1 30); do
-  result=$(kubectl exec -n "$NAMESPACE" "$POD" -- psql -U supabase_admin -tAc 'SELECT pg_is_in_recovery()' 2>/dev/null || echo "t")
-  if [ "$result" = "f" ]; then
-    echo "PostgreSQL promoted successfully"
-    break
-  fi
-  if [ "$i" = "30" ]; then
-    echo "WARNING: Promotion not confirmed after 60 seconds"
-  fi
-  sleep 2
-done
-
-# 3. Scale up services
-echo "Scaling up services..."
-kubectl scale deployment app -n "$NAMESPACE" --replicas=2
-kubectl scale deployment auth -n "$NAMESPACE" --replicas=2
-kubectl scale deployment rest -n "$NAMESPACE" --replicas=2
-kubectl scale deployment realtime -n "$NAMESPACE" --replicas=2
-kubectl scale deployment storage -n "$NAMESPACE" --replicas=1
-
-echo "Standby activation complete"