vibecarbon 0.9.0 → 0.11.0

package/src/destroy.js

@@ -32,6 +32,12 @@ import {
 } from './lib/cloudflare.js';
 import { c, printBanner } from './lib/colors.js';
 import { loadCredentials, loadProjectConfig, saveProjectConfig } from './lib/config.js';
+import {
+  isComposeTier,
+  isK8sTier,
+  pulumiStackEnvs,
+  resolveTier,
+} from './lib/deploy/tier-registry.js';
 import { fetchWithRetry } from './lib/fetch-retry.js';
 import {
   deleteDNSRecord as hetznerDnsDeleteRecord,
@@ -41,6 +47,7 @@ import { getApiToken, getS3Credentials } from './lib/hetzner-guided-setup.js';
 import { perfAsync } from './lib/perf.js';
 import { assertInProjectDir } from './lib/project-guard.js';
 import { HetznerS3Provider, sanitizeBucketName } from './lib/providers/hetzner-s3.js';
+import { pollUntil } from './lib/retry.js';
 import { createTracker } from './lib/tracker.js';
 import { VERSION } from './lib/version.js';
 
@@ -54,6 +61,35 @@ export function requiresProdTypeToConfirm(envName) {
   return /^(prod|production)$/i.test(envName);
 }
 
+/**
+ * Pure planner: derive every teardown target from persisted config, with no
+ * network/filesystem access. Returns the canonical tier id plus the derived
+ * Pulumi stack envs, cluster names, whether a k8s Pulumi stack exists, and the
+ * owned server IPs that gate ownership-filtered DNS deletes.
+ *
+ * tier dispatch is the ONLY place allowed to look at deployMode/ha, so this
+ * delegates to tier-registry (resolveTier / pulumiStackEnvs) rather than
+ * re-deriving mode+ha combinations locally.
+ *
+ * @param {object} envConfig - persisted environment config.
+ * @param {object} projectConfig - persisted project config (needs projectName).
+ * @param {string} environment - environment name being destroyed.
+ * @returns {{ tier: string, stackEnvs: string[], hasPulumiStack: boolean, clusterNames: string[], ownedIps: string[] }}
+ */
+export function planDestroyTargets(envConfig, projectConfig, environment) {
+  const tier = resolveTier(envConfig);
+  const stackEnvs = pulumiStackEnvs(tier, environment);
+  const hasPulumiStack = isK8sTier(tier);
+  const projectName = projectConfig.projectName;
+  // For HA k8s each sub-cluster has its own network/naming prefix
+  // (<project>-<env>-primary / -standby); single tiers get one.
+  const clusterNames = stackEnvs.map((stackEnv) => `${projectName}-${stackEnv}`);
+  // Owned IPs gate every DNS delete — only records pointing at this env's
+  // servers are removed. See deleteDNSRecord doc in lib/cloudflare.js.
+  const ownedIps = (envConfig.servers || []).map((srv) => srv.ip).filter(Boolean);
+  return { tier, stackEnvs, hasPulumiStack, clusterNames, ownedIps };
+}
+
 // ============================================================================
 // CLI ARGUMENT PARSING
 // ============================================================================
@@ -278,18 +314,23 @@ async function hetznerDeleteServer(apiToken, serverId) {
   // Observed during compose restore. The same delete-then-poll fix is
   // applied in destroyComposeHA.
   if (response.status !== 404) {
-    const deadline = Date.now() + 90_000;
-    while (Date.now() < deadline) {
-      try {
+    // Poll GET /servers/{id} until 404 (90s budget, 2s fixed interval). A
+    // throwing probe (transient) is treated as falsy and retried; on budget
+    // exhaustion we simply stop waiting — the return value below is unaffected.
+    await pollUntil(
+      async () => {
         const probe = await fetch(`https://api.hetzner.cloud/v1/servers/${serverId}`, {
           headers: { Authorization: `Bearer ${apiToken}` },
         });
-        if (probe.status === 404) break;
-      } catch {
-        // Transient — retry next loop iteration
-      }
-      await new Promise((r) => setTimeout(r, 2_000));
-    }
+        return probe.status === 404;
+      },
+      {
+        budgetMs: 90_000,
+        initialDelayMs: 2_000,
+        backoffFactor: 1,
+        description: `server ${serverId} deletion`,
+      },
+    ).catch(() => {});
   }
 
   return response.status !== 404;
@@ -303,43 +344,65 @@ async function hetznerDeleteFirewall(apiToken, name) {
   // (also fixed identically in destroyComposeHA).
   const headers = { Authorization: `Bearer ${apiToken}` };
   const lookupUrl = `https://api.hetzner.cloud/v1/firewalls?name=${encodeURIComponent(name)}`;
-  const deadlineMs = 30_000;
-  const start = Date.now();
   let everExisted = false;
-  while (Date.now() - start < deadlineMs) {
-    const listResp = await fetchWithRetry(lookupUrl, { headers });
-    const { firewalls } = await listResp.json();
-    const fw = firewalls?.[0];
-    if (!fw) return everExisted;
-    everExisted = true;
-    if (fw.applied_to?.length > 0) {
-      const serverResources = fw.applied_to
-        .filter((a) => a.type === 'server' && a.server?.id)
-        .map((a) => ({ type: 'server', server: { id: a.server.id } }));
-      if (serverResources.length > 0) {
-        try {
-          await fetchWithRetry(
-            `https://api.hetzner.cloud/v1/firewalls/${fw.id}/actions/remove_from_resources`,
-            {
-              method: 'POST',
-              headers: { ...headers, 'Content-Type': 'application/json' },
-              body: JSON.stringify({ remove_from: serverResources }),
-            },
-          );
-        } catch {
-          // Servers may already be gone — proceed to DELETE anyway
+  let apiError = null;
+  // Delete-until-gone under a 30s budget with a fixed 3s interval. Each probe
+  // re-looks-up the firewall (to refresh applied_to), detaches servers, then
+  // DELETEs; a 409 (still attached) returns a falsy result so pollUntil backs
+  // off and retries. A truthy wrapper object signals "done" — needed because
+  // the "firewall gone" outcome can carry `everExisted === false`, which a bare
+  // falsy return would misread as "keep polling". A genuine not-found therefore
+  // returns the truthy { value: false } wrapper PROMPTLY (pollUntil never
+  // throws for it). pollUntil only throws on budget exhaustion, which means the
+  // delete never completed — either the lookup/DELETE kept failing (err.cause
+  // is the last API error) or the firewall stayed attached (persistent 409).
+  // Either way it's a probable LEAK, not a not-found, so we remember the
+  // underlying error and let the caller surface it instead of "not found".
+  const outcome = await pollUntil(
+    async () => {
+      const listResp = await fetchWithRetry(lookupUrl, { headers });
+      const { firewalls } = await listResp.json();
+      const fw = firewalls?.[0];
+      if (!fw) return { value: everExisted };
+      everExisted = true;
+      if (fw.applied_to?.length > 0) {
+        const serverResources = fw.applied_to
+          .filter((a) => a.type === 'server' && a.server?.id)
+          .map((a) => ({ type: 'server', server: { id: a.server.id } }));
+        if (serverResources.length > 0) {
+          try {
+            await fetchWithRetry(
+              `https://api.hetzner.cloud/v1/firewalls/${fw.id}/actions/remove_from_resources`,
+              {
+                method: 'POST',
+                headers: { ...headers, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ remove_from: serverResources }),
+              },
+            );
+          } catch {
+            // Servers may already be gone — proceed to DELETE anyway
+          }
         }
       }
-    }
-    const delResp = await fetchWithRetry(`https://api.hetzner.cloud/v1/firewalls/${fw.id}`, {
-      method: 'DELETE',
-      headers,
-    });
-    if (delResp.ok || delResp.status === 404) return true;
-    // 409 = still attached; back off and re-look-up to refresh applied_to.
-    await new Promise((r) => setTimeout(r, 3_000));
-  }
-  return false;
+      const delResp = await fetchWithRetry(`https://api.hetzner.cloud/v1/firewalls/${fw.id}`, {
+        method: 'DELETE',
+        headers,
+      });
+      if (delResp.ok || delResp.status === 404) return { value: true };
+      // 409 = still attached; back off and re-look-up to refresh applied_to.
+      return null;
+    },
+    {
+      budgetMs: 30_000,
+      initialDelayMs: 3_000,
+      backoffFactor: 1,
+      description: `firewall ${name} deletion`,
+    },
+  ).catch((err) => {
+    apiError = err?.cause ?? err;
+    return { value: false };
+  });
+  return { deleted: outcome.value === true, everExisted, apiError };
 }
 
 async function hetznerDeleteSSHKey(apiToken, name) {
@@ -735,6 +798,62 @@ async function handleBackupBucket(envConfig, projectConfig, args, spinner) {
   }
 }
 
+/**
+ * Delete the dedicated Pulumi state bucket.
+ *
+ * SAFETY: this MUST run only AFTER all Pulumi stack teardown (destroy +
+ * removeStack) has completed — deleting the state backend while a stack op is
+ * still in flight would corrupt the destroy. Callers invoke this at the very
+ * end of their teardown, past the Pulumi destroy step.
+ *
+ * No-op for pre-split envs whose Pulumi state still lived in the app storage
+ * bucket (envConfig.s3.stateBucket unset, or equal to the app bucket) — that
+ * bucket is already removed via the normal app-bucket deletion path, so there's
+ * nothing extra to delete here.
+ */
+async function deleteStateBucket(envConfig, projectConfig, spinner, results) {
+  const stateBucket = envConfig.s3?.stateBucket;
+  if (!stateBucket || stateBucket === envConfig.s3?.bucket) return;
+  const region = envConfig.s3?.region || 'fsn1';
+  spinner.start(`Deleting Pulumi state bucket: ${stateBucket}`);
+  try {
+    const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+    if (!s3Creds) {
+      spinner.stop('State bucket skipped (no credentials available)');
+      results.issues.push({
+        step: 'state bucket',
+        detail: `${stateBucket} (${region}) not deleted: no S3 credentials available`,
+        hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
+      });
+      return;
+    }
+    const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, region);
+    try {
+      const result = await s3Provider.emptyAndDeleteBucket(stateBucket);
+      spinner.stop(
+        result.deleted
+          ? result.objectsRemoved > 0
+            ? `Pulumi state bucket deleted (${result.objectsRemoved} objects removed)`
+            : 'Pulumi state bucket deleted'
+          : 'Pulumi state bucket not found',
+      );
+    } catch (bucketError) {
+      if (bucketError.name === 'NoSuchBucket' || bucketError.$metadata?.httpStatusCode === 404) {
+        spinner.stop('Pulumi state bucket not found (already deleted or never created)');
+      } else {
+        throw bucketError;
+      }
+    }
+  } catch (error) {
+    spinner.stop(`Pulumi state bucket deletion failed: ${error.message}`);
+    results.issues.push({
+      step: 'state bucket',
+      detail: `${stateBucket} (${region}) not deleted: ${error.message}`,
+      hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
+    });
+  }
+}
+
 /**
  * Final outro for the destroy flow. If sub-steps left state behind (e.g. an
  * S3 bucket that couldn't be emptied), surface them with hints and set a
@@ -761,700 +880,402 @@ function destroyOutro(envName, timeStr, results) {
 }
 
 // ============================================================================
-// MAIN DESTRUCTION FLOW
+// SHARED TEARDOWN TAIL
 // ============================================================================
 
-async function main() {
-  const { values, positional, errors } = parseFlags(process.argv.slice(2), SPEC);
-
-  if (errors.length > 0) {
-    for (const e of errors) {
-      process.stderr.write(`${c.error('✗')} ${e}\n`);
+/**
+ * Shared teardown tail run once after the per-tier strategy. Covers, in order:
+ * app S3 bucket delete, Pulumi state bucket, backup bucket, (optional) GitHub
+ * environment, project-config removal + save, local env-file cleanup,
+ * (optional) summary note, and the final outro.
+ *
+ * Tier-specific divergences are explicit booleans rather than silent unions:
+ *  - `deleteGithubEnv` — only k8s deletes the GitHub environment.
+ *  - `showSummary`     — only k8s prints the deleted-resources summary note.
+ *  - `defaultBucketName` — k8s falls back to the predictable deploy-time bucket
+ *    name (sanitizeBucketName(projectName)) when envConfig.s3.bucket is unset;
+ *    compose tiers only delete an explicitly-configured bucket.
+ */
+async function finishDestroy({
+  envConfig,
+  projectConfig,
+  environment,
+  args,
+  results,
+  spinner,
+  tracker,
+  cwd,
+  deleteGithubEnv = false,
+  showSummary = false,
+  defaultBucketName = false,
+}) {
+  // 1. Delete the app S3 bucket (created during deploy bootstrap, not part of
+  //    any Pulumi stack's resource graph). k8s can fall back to the predictable
+  //    deploy-time name; compose tiers only act on a configured bucket.
+  const s3BucketName =
+    envConfig.s3?.bucket ||
+    (defaultBucketName ? sanitizeBucketName(projectConfig.projectName) : null);
+  if (s3BucketName) {
+    const s3Region = envConfig.s3?.region || 'fsn1';
+    spinner.start(`Deleting S3 bucket: ${s3BucketName}`);
+    try {
+      const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
+      if (s3Creds) {
+        const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
+        try {
+          const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
+          if (result.deleted) {
+            results.s3Bucket = s3BucketName;
+            spinner.stop(
+              result.objectsRemoved > 0
+                ? `S3 bucket deleted (${result.objectsRemoved} objects removed)`
+                : 'S3 bucket deleted',
+            );
+          } else {
+            spinner.stop('S3 bucket not found');
+          }
+        } catch (bucketError) {
+          // NoSuchBucket means it was already deleted or never created — not an error
+          if (
+            bucketError.name === 'NoSuchBucket' ||
+            bucketError.$metadata?.httpStatusCode === 404
+          ) {
+            spinner.stop('S3 bucket not found (already deleted or never created)');
+          } else {
+            throw bucketError;
+          }
+        }
+      } else {
+        spinner.stop('S3 bucket skipped (no credentials available)');
+        results.issues.push({
+          step: 'S3 bucket',
+          detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
+          hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
+        });
+      }
+    } catch (error) {
+      spinner.stop(`S3 bucket deletion failed: ${error.message}`);
+      results.issues.push({
+        step: 'S3 bucket',
+        detail: `${s3BucketName} (${s3Region}) not deleted: ${error.message}`,
+        hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
+      });
     }
-    process.stderr.write(`Run ${c.info('vibecarbon destroy -h')} for usage.\n`);
-    process.exit(1);
   }
 
-  if (values.h) {
-    process.stdout.write(renderHelp(SPEC));
-    process.exit(0);
-  }
-  if (values.v) {
-    console.log(`destroy-vibecarbon v${VERSION}`);
-    process.exit(0);
+  // 2. State bucket: deleted LAST relative to any Pulumi stack teardown (the
+  //    strategy already ran `pulumi destroy` + `removeStack` before returning),
+  //    so tearing the state backend down here is safe.
+  await deleteStateBucket(envConfig, projectConfig, spinner, results);
+
+  // 3. Backup bucket: preserved by default, deleted with --purge-backups.
+  await handleBackupBucket(envConfig, projectConfig, args, spinner);
+
+  // 4. GitHub environment (k8s only).
+  if (deleteGithubEnv) {
+    spinner.start(`Deleting GitHub environment: ${environment}`);
+    try {
+      results.github = deleteGitHubEnvironment(environment);
+      spinner.stop(
+        results.github
+          ? 'GitHub environment deleted'
+          : 'GitHub environment not found (or no access)',
+      );
+    } catch (error) {
+      spinner.stop(`Failed to delete GitHub environment: ${error.message}`);
+    }
   }
 
-  // Build the legacy `args` struct that the orchestration code below
-  // reads (env / yes / destroyOrphans / purgeBackups). Field renames
-  // happen at the boundary so the orchestration stays untouched —
-  // each downstream branch is hundreds of lines and well-tested.
-  const envSeed =
-    /** @type {string|undefined} */ (positional.env) ||
-    /** @type {string|null} */ (values.env) ||
-    null;
-  const args = {
-    env: envSeed,
-    yes: !!values.y,
-    destroyOrphans: !!values.orphans,
-    purgeBackups: !!values.purge,
-  };
+  // 5. Remove the destroyed environment from project config.
+  spinner.start('Updating project configuration');
+  const updatedConfig = { ...projectConfig };
+  if (updatedConfig.environments) {
+    delete updatedConfig.environments[environment];
+  }
+  saveProjectConfig(updatedConfig);
+  spinner.stop('Configuration updated');
+
+  // 6. Local env-file cleanup (idempotent — keys, kubeconfigs, deploy-state).
+  cleanupLocalEnvFiles(cwd, environment);
+
+  // 7. Summary note (k8s only).
+  if (showSummary) {
+    const deletedCount =
+      results.servers.length +
+      results.volumes.length +
+      results.firewalls.length +
+      results.sshKeys.length +
+      results.dns.length +
+      results.healthChecks.length +
+      results.loadBalancers.length +
+      (results.s3Bucket ? 1 : 0) +
+      (results.github ? 1 : 0);
+
+    p.note(
+      `
+${c.success('Deleted resources:')}
+    Servers:        ${results.servers.length > 0 ? results.servers.join(', ') : 'None'}
+    Volumes:        ${results.volumes.length > 0 ? results.volumes.join(', ') : 'None'}
+    Firewalls:      ${results.firewalls.length > 0 ? results.firewalls.join(', ') : 'None'}
+    SSH Keys:       ${results.sshKeys.length > 0 ? results.sshKeys.join(', ') : 'None'}
+    DNS Records:    ${results.dns.length > 0 ? results.dns.join(', ') : 'None'}
+    Health Checks:  ${results.healthChecks.length > 0 ? results.healthChecks.join(', ') : 'None'}
+    Load Balancers: ${results.loadBalancers.length > 0 ? results.loadBalancers.join(', ') : 'None'}
+    S3 Bucket:      ${results.s3Bucket || 'None'}
+    GitHub Env:     ${results.github ? environment : 'None'}
 
-  // Check if current working directory exists
-  let cwd;
-  try {
-    cwd = process.cwd();
-  } catch {
-    console.error(`\n${c.error('Error:')} Current working directory does not exist.`);
-    console.error(
-      `This can happen if the project directory was deleted while this command was running.`,
+${c.dim(`Total: ${deletedCount} resources deleted`)}
+  `,
+      'Destruction Complete',
     );
-    console.error(`\nPlease navigate to a valid directory and try again.`);
-    process.exit(1);
   }
 
-  // Project guard runs before banner so an accidental `vibecarbon
-  // destroy` from a parent directory emits the canonical message.
-  assertInProjectDir(cwd);
+  const { formatted: timeStr } = tracker.finish();
+  destroyOutro(environment, timeStr, results);
+}
 
-  console.clear();
-  printBanner();
-  p.intro(`${c.bold('vibecarbon destroy')} ${c.dim(`v${VERSION}`)}`);
+// ============================================================================
+// PER-TIER DESTROY STRATEGIES
+// ============================================================================
 
-  const projectConfig = loadProjectConfig(cwd);
+/**
+ * compose-ha: hand the whole teardown (both nodes, firewalls, DNS) to the
+ * compose HA helper. The shared tail handles buckets/config afterwards.
+ */
+async function destroyComposeHATier({
+  envConfig,
+  projectConfig,
+  environment,
+  hetznerToken,
+  cloudflareToken,
+  tracker,
+}) {
+  const { destroyComposeHA } = await import('./lib/deploy/compose/ha.js');
+
+  const s2 = tracker.spinner();
+  s2.start('Destroying Compose HA environment...');
+  try {
+    await destroyComposeHA({
+      projectName: projectConfig.projectName,
+      environment,
+      envConfig,
+      hetznerToken,
+      cloudflareToken,
+      onProgress: (msg) => s2.message(msg),
+    });
+    s2.stop('Compose HA environment destroyed');
+  } catch (error) {
+    s2.stop(`Compose HA destruction failed: ${error.message}`);
+  }
+}
 
-  // TTY guard: if the operator seeded an env, no env prompt fires;
-  // otherwise we'd open a picker that hangs off-TTY.
-  const envCount = Object.keys(projectConfig?.environments || {}).length;
-  requireTTYOrFlags({
-    requirements: [
-      {
-        flag: 'env',
-        description: 'name an environment to destroy',
-        satisfied: !!envSeed || envCount <= 1,
-      },
-    ],
-  });
+/**
+ * compose (single VPS): stop the stack, then reap the VPS, firewall, SSH key
+ * and DNS via the Hetzner/Cloudflare APIs directly (no Pulumi teardown).
+ */
+async function destroyComposeTier({
+  plan,
+  envConfig,
+  projectConfig,
+  environment,
+  hetznerToken,
+  cloudflareToken,
+  results,
+  spinner: s,
+  cwd,
+}) {
+  const { ownedIps } = plan;
+  const serverIp = envConfig.servers?.[0]?.ip;
+  const sshKeyPath = join(cwd, '.vibecarbon', `deploy_key_${environment}`);
 
-  if (!projectConfig.environments || Object.keys(projectConfig.environments).length === 0) {
-    // Check for orphan Pulumi stacks (deployment interrupted before config save)
-    const orphanScan = p.spinner();
-    orphanScan.start('Scanning for orphan Pulumi stacks...');
-    const orphans = await findOrphanPulumiStacks(projectConfig);
-    orphanScan.stop(
-      orphans.length > 0 ? `Found ${orphans.length} orphan stack(s)` : 'No orphan stacks found',
-    );
+  if (serverIp && existsSync(sshKeyPath)) {
+    // Stop and remove Docker Compose services
+    s.start('Stopping Docker Compose services...');
+    try {
+      const { destroyCompose } = await import('./lib/deploy/compose/index.js');
+      await destroyCompose(serverIp, sshKeyPath, projectConfig.projectName);
+      s.stop('Docker Compose services removed');
+      results.servers.push(`vps-${serverIp}`);
+    } catch (error) {
+      s.stop(`Failed to stop services: ${error.message}`);
+    }
+  }
 
-    if (orphans.length > 0) {
-      p.log.warn('No environments found in .vibecarbon.json');
-      p.log.info(
-        `Found ${orphans.length} orphan Pulumi stack(s) — likely from interrupted deployments:`,
-      );
-      for (const orphan of orphans) {
-        p.log.info(`  • ${c.bold(orphan.name)}`);
+  // Delete Hetzner VPS if auto-provisioned (has server ID in config)
+  const serverId = envConfig.servers?.[0]?.id;
+  // The `name` field in envConfig.servers is a role label ("master") set by
+  // the orchestrator, not the Hetzner-assigned hostname. Pulumi's compose
+  // program names the server `${projectName}-${environment}`. The
+  // orchestrator persists that under `hetznerName`; configs older than
+  // that change only have role-style names, so derive the Pulumi name as
+  // a deterministic fallback — looking up "master" in Hetzner never
+  // matches and leaks the VPS.
+  const serverHetznerName =
+    envConfig.servers?.[0]?.hetznerName || `${projectConfig.projectName}-${environment}`;
+  if (serverId && hetznerToken) {
+    s.start(`Deleting VPS (${serverIp})...`);
+    try {
+      const deleted = await hetznerDeleteServer(hetznerToken, serverId);
+      s.stop(deleted ? 'VPS deleted' : 'VPS not found');
+    } catch (error) {
+      s.stop(`Failed to delete VPS: ${error.message}`);
+    }
+  } else if (!serverId && hetznerToken && serverHetznerName) {
+    // Fallback: find server by name if ID wasn't saved (older deploys
+    // or runs where Pulumi didn't propagate serverId).
+    s.start(`Looking up VPS by name: ${serverHetznerName}...`);
+    try {
+      const servers = await hetznerListServers(hetznerToken);
+      const server = servers.find((sv) => sv.name === serverHetznerName);
+      if (server) {
+        const deleted = await hetznerDeleteServer(hetznerToken, server.id);
+        s.stop(deleted ? 'VPS deleted' : 'VPS not found');
+      } else {
+        s.stop('VPS not found');
       }
+    } catch (error) {
+      s.stop(`Failed to delete VPS: ${error.message}`);
+    }
+  }
 
-      // Auto-destroying orphans is dangerous: when projectConfig.s3Config is
-      // null (e.g., a typo in the saved config), listStacks falls back to
-      // the local file:// backend at ~/.vibecarbon/pulumi-state/, which is
-      // GLOBAL across projects/scenarios. A scenario's --yes destroy then
-      // nukes other scenarios' stacks (observed 2026-04-26 batch run #5:
-      // compose's final-destroy destroyed compose-ha's e2-primary/e2-standby
-      // mid-deploy because compose's empty config let the orphan path fire).
-      //
-      // The auto-destroy used to honor --yes, but cross-scenario blast is
-      // worse than leaving local state around. Require an explicit flag now.
-      // For interactive use, prompt as before.
-      p.log.info('');
-      if (!args.destroyOrphans) {
-        p.log.warn('Skipping orphan cleanup. Re-run with -orphans to remove these stacks.');
-        p.outro('Done (orphans not destroyed)');
-        process.exit(0);
+  // Delete Hetzner firewall.
+  // Pulumi (src/lib/iac/programs/hetzner-compose.js) names the firewall
+  //   `${projectName}-${environment}-firewall`
+  // Earlier this used `vibecarbon-${projectName}-${envName}` which never
+  // matched anything Pulumi created — the firewall always leaked, and
+  // the next compose restore re-deploy hit "name is already used
+  // (uniqueness_error)" on Pulumi up. Match the actual Pulumi naming
+  // convention (the equivalent fix exists in destroyComposeHA).
+  const fwName = `${projectConfig.projectName}-${environment}-firewall`;
+  if (hetznerToken) {
+    s.start(`Deleting firewall: ${fwName}`);
+    try {
+      const result = await hetznerDeleteFirewall(hetznerToken, fwName);
+      if (result.deleted) {
+        results.firewalls.push(fwName);
+        s.stop('Firewall deleted');
+      } else if (result.apiError) {
+        // Delete never confirmed within budget (persistent API error or a
+        // firewall that stayed attached) — a probable LEAK, not a not-found.
+        // A leaked firewall fails the NEXT deploy with uniqueness_error, so
+        // surface it as an issue instead of the misleading "not found".
+        s.stop(`Failed to delete firewall: ${result.apiError.message}`);
+        results.issues.push({
+          step: 'firewall',
+          detail: `${fwName} may still exist (delete did not complete): ${result.apiError.message}`,
+          hint: 'Delete it via the Hetzner console — a leaked firewall makes the next deploy fail with "name is already used (uniqueness_error)".',
+        });
+      } else {
+        s.stop('Firewall not found');
       }
-      const shouldDestroy = args.yes
-        ? true
-        : await p.confirm({
-            message: `Destroy these ${orphans.length} orphan stack(s)?`,
-            initialValue: false, // Default to NO for safety
-          });
+    } catch (error) {
+      s.stop(`Failed to delete firewall: ${error.message}`);
+    }
+  }
 
-      if (p.isCancel(shouldDestroy) || !shouldDestroy) {
-        p.cancel('Operation cancelled.');
-        process.exit(0);
+  // Delete Hetzner SSH key.
+  // Pulumi names the key
+  //   `${projectName}-${environment}-${location}-key`
+  // — the location suffix is what kept the old `vibecarbon-` prefix from
+  // ever matching. Same root cause as the firewall above.
+  const composeRegion = envConfig.region || envConfig.servers?.[0]?.region;
+  const hetznerSshKeyName = composeRegion
+    ? `${projectConfig.projectName}-${environment}-${composeRegion}-key`
+    : null;
+  if (hetznerToken && hetznerSshKeyName) {
+    s.start(`Deleting SSH key: ${hetznerSshKeyName}`);
+    try {
+      const deleted = await hetznerDeleteSSHKey(hetznerToken, hetznerSshKeyName);
+      if (deleted) results.sshKeys.push(hetznerSshKeyName);
+      s.stop(deleted ? 'SSH key deleted' : 'SSH key not found');
+    } catch (error) {
+      s.stop(`Failed to delete SSH key: ${error.message}`);
+    }
+  }
+
+  // DNS cleanup is ownership-filtered (plan.ownedIps): only records pointing at
+  // this env's server IPs are deleted. Shared zones (e.g. parallel e2e
+  // scenarios on the same root domain) used to lose neighbours' records here.
+
+  // Delete Cloudflare DNS if configured
+  if (cloudflareToken && envConfig.dns?.cloudflareZoneId && envConfig.domain) {
+    const zoneId = envConfig.dns.cloudflareZoneId;
+
+    s.start(`Deleting DNS record: ${envConfig.domain}`);
+    try {
+      const result = await cloudflareDeleteDNSRecord(
+        cloudflareToken,
+        zoneId,
+        envConfig.domain,
+        ownedIps,
+      );
+      if (result.deleted > 0) results.dns.push(envConfig.domain);
+      if (result.skipped > 0) {
+        s.stop(
+          `DNS record preserved (${result.skipped} unowned target(s): ${result.skippedTargets.join(', ')})`,
+        );
+      } else {
+        s.stop(result.deleted > 0 ? 'DNS record deleted' : 'DNS record not found');
       }
+    } catch (error) {
+      s.stop(`DNS deletion failed: ${error.message}`);
+    }
+  }
 
-      // Load the HCLOUD token + S3 backend config the same way the
-      // main destroy path does. Pulumi's hcloud provider needs a valid
-      // token to delete resources; an empty token surfaces as
-      // "Missing Hetzner Cloud API token" mid-destroy. The s3Config
-      // must match the one findOrphanPulumiStacks used to discover
-      // these stacks, otherwise resolveBackendUrl picks a different
-      // backend and the destroy can't find them.
-      const orphanCreds = loadCredentials();
-      const orphanApiToken =
-        process.env.HETZNER_API_TOKEN ||
-        orphanCreds?.hetzner?.apiToken ||
-        orphanCreds?.hetznerApiToken ||
-        '';
-      const orphanS3Config =
-        projectConfig?.s3Config && orphanCreds?.s3
-          ? {
-              ...projectConfig.s3Config,
-              accessKey: orphanCreds.s3.accessKey,
-              secretKey: orphanCreds.s3.secretKey,
-            }
-          : null;
-
-      if (!orphanApiToken) {
-        p.log.error(
-          'No Hetzner API token found in HETZNER_API_TOKEN env var or ~/.vibecarbon/credentials.json — cannot destroy orphan stacks.',
-        );
-        process.exit(1);
-      }
-
-      const orphanSpinner = p.spinner();
-      for (const orphan of orphans) {
-        orphanSpinner.start(`Destroying orphan stack ${c.bold(orphan.name)} (pulumi destroy)...`);
-        try {
-          await destroyOrphanPulumiStack(orphan, {
-            apiToken: orphanApiToken,
-            s3Config: orphanS3Config,
-          });
-          orphanSpinner.stop(`Destroyed: ${orphan.name}`);
-        } catch (error) {
-          orphanSpinner.error(`Failed to destroy ${orphan.name}: ${error.message}`);
-        }
-      }
-
-      p.outro('Orphan cleanup complete');
-      process.exit(0);
-    }
-
-    p.log.error('No environments found in .vibecarbon.json');
-    p.log.info('Nothing to destroy.');
-    process.exit(1);
-  }
-
-  p.log.info(`Project: ${c.bold(projectConfig.projectName)}`);
-
-  // Select environment to destroy
-  const envNames = Object.keys(projectConfig.environments);
-  let envName = args.env;
-
-  if (!envName) {
-    if (envNames.length === 1) {
-      envName = envNames[0];
-    } else {
-      envName = await p.select({
-        message: 'Which environment do you want to destroy?',
-        options: envNames.map((name) => ({
-          value: name,
-          label: name,
-          hint: projectConfig.environments[name].servers?.map((s) => s.ip).join(', '),
-        })),
-      });
-    }
-  }
-
-  if (p.isCancel(envName)) {
-    p.cancel('Operation cancelled.');
-    process.exit(0);
-  }
-
-  const envConfig = projectConfig.environments[envName];
-  if (!envConfig) {
-    p.log.error(`Environment '${envName}' not found`);
-    p.log.info(`Available environments: ${envNames.join(', ')}`);
-    process.exit(1);
-  }
-
-  // Show what will be deleted
-  const serverList =
-    envConfig.servers?.map((s) => `    ${c.error('•')} ${s.name} (${s.ip})`).join('\n') ||
-    '    None';
-
-  p.note(
-    `
-${c.danger('This will permanently delete:')}
-
-${c.bold('Servers:')}
-${serverList}
-
-${c.bold('Firewalls:')}
-${envConfig.servers?.map((s) => `    ${c.error('•')} ${s.name}-fw`).join('\n') || '    None'}
-
-${c.bold('SSH Keys:')}
-    ${c.error('•')} vibecarbon-${projectConfig.projectName}-${envName}
-
-${
-  envConfig.dns?.provider === 'cloudflare'
-    ? `${c.bold('Cloudflare Resources:')}
-    ${c.error('•')} DNS record: ${envConfig.domain}
-    ${c.error('•')} Health checks
-    ${envConfig.ha ? `${c.error('•')} Wildcard DNS record` : ''}
-`
-    : ''
-}
-${
-  envConfig.s3?.bucket
-    ? `${c.bold('S3 Storage:')}
-    ${c.error('•')} Bucket: ${envConfig.s3.bucket} (all objects will be deleted)
-`
-    : ''
-}${
-  envConfig.backupS3?.bucket
-    ? `${c.bold('S3 Backups:')}
-    ${args.purgeBackups ? `${c.error('•')} Bucket: ${envConfig.backupS3.bucket} (WILL BE DELETED — --purge-backups)` : `${c.success('•')} Bucket: ${envConfig.backupS3.bucket} (PRESERVED for recovery)`}
-`
-    : ''
-}
-${c.bold('GitHub:')}
-    ${c.error('•')} Environment: ${envName}
-
-${c.danger('WARNING: All data on these servers will be permanently lost!')}
-  `,
-    `Destroying: ${envName}`,
-  );
-
-  const needsProdConfirm = requiresProdTypeToConfirm(envName);
-
-  // First prompt: only when not --yes.
-  if (!args.yes) {
-    const confirmed = await p.confirm({
-      message: `Are you sure you want to destroy the ${c.bold(envName)} environment?`,
-      initialValue: false,
-    });
-    if (!confirmed || p.isCancel(confirmed)) {
-      p.cancel('Operation cancelled.');
-      process.exit(0);
-    }
-  }
-
-  // Type-to-confirm: runs whenever NOT --yes, OR the env is prod/production
-  // (even with --yes). Protects against `--env prod --yes` typos in CI/scripts.
-  if (!args.yes || needsProdConfirm) {
-    const confirmSlug = `${projectConfig.projectName}-${envName}`;
-    if (args.yes && needsProdConfirm) {
-      p.log.warn(
-        `Destroying a production environment still requires type-to-confirm, even with --yes.`,
-      );
-    }
-    const doubleConfirm = await p.text({
-      message: `Type "${confirmSlug}" to confirm:`,
-      validate: (v) => (v !== confirmSlug ? `Please type "${confirmSlug}" to confirm` : undefined),
-    });
-    if (p.isCancel(doubleConfirm)) {
-      p.cancel('Operation cancelled.');
-      process.exit(0);
-    }
-  }
-
-  // Offer to create a backup before destroying
-  const serverIp = envConfig.servers?.[0]?.ip;
-  const sshKeyPath = join(cwd, '.vibecarbon', `deploy_key_${envName}`);
-  if (serverIp && existsSync(sshKeyPath) && !args.yes) {
-    const offerBackup = await p.confirm({
-      message: 'Create a backup before destroying? (recommended)',
-      initialValue: true,
-    });
-
-    if (!p.isCancel(offerBackup) && offerBackup) {
-      const backupSpinner = p.spinner();
-      backupSpinner.start('Creating backup...');
-      try {
-        if (envConfig.deployMode === 'compose' || envConfig.deployMode === 'compose-ha') {
-          const { backupCompose } = await import('./lib/deploy/compose/index.js');
-          await backupCompose(serverIp, sshKeyPath, projectConfig.projectName, {
-            retain: envConfig.backup?.retentionDays,
-          });
-          backupSpinner.stop('wal-g base backup pushed to S3');
-        }
-      } catch (backupError) {
-        backupSpinner.stop(`Backup failed: ${backupError.message}`);
-        p.log.warn('Continuing with destroy...');
-      }
-    }
-  }
-
-  // Get API tokens (env var → credentials file → interactive prompt)
-  const hetznerToken = await getApiToken(projectConfig.projectName);
-  if (!hetznerToken) {
-    p.log.error('Hetzner API token is required');
-    process.exit(1);
-  }
-
-  let cloudflareToken = null;
-  if (envConfig.dns?.provider === 'cloudflare' && envConfig.dns?.cloudflareZoneId) {
-    // Check env var → credentials file → prompt
-    cloudflareToken = process.env.CLOUDFLARE_API_TOKEN;
-
-    if (!cloudflareToken) {
-      const creds = loadCredentials();
-      if (creds.cloudflare?.apiToken) {
-        cloudflareToken = creds.cloudflare.apiToken;
-        p.log.info('✓ Using Cloudflare API token from ~/.vibecarbon/credentials.json');
-      }
-    }
-
-    if (!cloudflareToken) {
-      cloudflareToken = await p.password({
-        message: 'Enter Cloudflare API token (for DNS cleanup)',
-        validate: (v) => (v.length < 10 ? 'API token is required' : undefined),
-      });
-
-      if (p.isCancel(cloudflareToken)) {
-        p.cancel('Operation cancelled.');
-        process.exit(0);
-      }
-    } else if (process.env.CLOUDFLARE_API_TOKEN) {
-      p.log.info('✓ Using Cloudflare API token from CLOUDFLARE_API_TOKEN environment variable');
-    }
-  }
-
-  // ========== DESTRUCTION ==========
-
-  const tracker = createTracker('destroy', { environment: envName });
-  const s = tracker.spinner();
-  const results = {
-    servers: [],
-    volumes: [],
-    firewalls: [],
-    sshKeys: [],
-    dns: [],
-    healthChecks: [],
-    loadBalancers: [],
-    s3Bucket: null,
-    github: false,
-    // Sub-step failures that didn't abort destroy but left state behind
-    // (e.g., S3 bucket couldn't be emptied). The outro surfaces these so the
-    // operator doesn't miss them, and the process exits non-zero so CI sees it.
-    issues: [],
-  };
-
-  // ========== COMPOSE-HA DESTRUCTION (if deployed via Docker Compose HA) ==========
-  if (envConfig.deployMode === 'compose-ha') {
-    const { destroyComposeHA } = await import('./lib/deploy/compose/ha.js');
-
-    const s2 = tracker.spinner();
-    s2.start('Destroying Compose HA environment...');
-    try {
-      await destroyComposeHA({
-        projectName: projectConfig.projectName,
-        environment: envName,
-        envConfig,
-        hetznerToken,
-        cloudflareToken,
-        onProgress: (msg) => s2.message(msg),
-      });
-      s2.stop('Compose HA environment destroyed');
-    } catch (error) {
-      s2.stop(`Compose HA destruction failed: ${error.message}`);
-    }
-
-    // Delete S3 bucket if configured
-    if (envConfig.s3?.bucket) {
-      const s3BucketName = envConfig.s3.bucket;
-      const s3Region = envConfig.s3?.region || 'fsn1';
-      s2.start(`Deleting S3 bucket: ${s3BucketName}`);
-      try {
-        const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
-        if (s3Creds) {
-          const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
-          try {
-            const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
-            s2.stop(result.deleted ? 'S3 bucket deleted' : 'S3 bucket not found');
-          } catch (bucketError) {
-            if (
-              bucketError.name === 'NoSuchBucket' ||
-              bucketError.$metadata?.httpStatusCode === 404
-            ) {
-              s2.stop('S3 bucket not found (already deleted)');
-            } else {
-              s2.stop(`S3 bucket deletion failed: ${bucketError.message}`);
-              results.issues.push({
-                step: 'S3 bucket',
-                detail: `${s3BucketName} (${s3Region}) not deleted: ${bucketError.message}`,
-                hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
-              });
-            }
-          }
-        } else {
-          s2.stop('S3 bucket skipped (no credentials available)');
-          results.issues.push({
-            step: 'S3 bucket',
-            detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
-            hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
-          });
-        }
-      } catch (error) {
-        s2.stop(`S3 bucket deletion failed: ${error.message}`);
-        results.issues.push({
-          step: 'S3 bucket',
-          detail: `${s3BucketName} not deleted: ${error.message}`,
-          hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket.',
-        });
-      }
-    }
-
-    // Backup bucket: preserved by default, deleted with --purge-backups.
-    await handleBackupBucket(envConfig, projectConfig, args, s2);
-
-    // Update project config to remove environment
-    const updatedConfig = { ...projectConfig };
-    if (updatedConfig.environments) {
-      delete updatedConfig.environments[envName];
-    }
-    saveProjectConfig(updatedConfig);
-
-    cleanupLocalEnvFiles(cwd, envName);
-
-    const { formatted: timeStr } = tracker.finish();
-    destroyOutro(envName, timeStr, results);
-    return;
-  }
-
-  // ========== COMPOSE DESTRUCTION (if deployed via Docker Compose) ==========
-  if (envConfig.deployMode === 'compose') {
-    const serverIp = envConfig.servers?.[0]?.ip;
-    const sshKeyPath = join(cwd, '.vibecarbon', `deploy_key_${envName}`);
-
-    if (serverIp && existsSync(sshKeyPath)) {
-      // Stop and remove Docker Compose services
-      s.start('Stopping Docker Compose services...');
-      try {
-        const { destroyCompose } = await import('./lib/deploy/compose/index.js');
-        await destroyCompose(serverIp, sshKeyPath, projectConfig.projectName);
-        s.stop('Docker Compose services removed');
-        results.servers.push(`vps-${serverIp}`);
-      } catch (error) {
-        s.stop(`Failed to stop services: ${error.message}`);
-      }
-    }
-
-    // Delete Hetzner VPS if auto-provisioned (has server ID in config)
-    const serverId = envConfig.servers?.[0]?.id;
-    // The `name` field in envConfig.servers is a role label ("master") set by
-    // the orchestrator, not the Hetzner-assigned hostname. Pulumi's compose
-    // program names the server `${projectName}-${environment}`. The
-    // orchestrator persists that under `hetznerName`; configs older than
-    // that change only have role-style names, so derive the Pulumi name as
-    // a deterministic fallback — looking up "master" in Hetzner never
-    // matches and leaks the VPS.
-    const serverHetznerName =
-      envConfig.servers?.[0]?.hetznerName || `${projectConfig.projectName}-${envName}`;
-    if (serverId && hetznerToken) {
-      s.start(`Deleting VPS (${serverIp})...`);
-      try {
-        const deleted = await hetznerDeleteServer(hetznerToken, serverId);
-        s.stop(deleted ? 'VPS deleted' : 'VPS not found');
-      } catch (error) {
-        s.stop(`Failed to delete VPS: ${error.message}`);
-      }
-    } else if (!serverId && hetznerToken && serverHetznerName) {
-      // Fallback: find server by name if ID wasn't saved (older deploys
-      // or runs where Pulumi didn't propagate serverId).
-      s.start(`Looking up VPS by name: ${serverHetznerName}...`);
-      try {
-        const servers = await hetznerListServers(hetznerToken);
-        const server = servers.find((sv) => sv.name === serverHetznerName);
-        if (server) {
-          const deleted = await hetznerDeleteServer(hetznerToken, server.id);
-          s.stop(deleted ? 'VPS deleted' : 'VPS not found');
-        } else {
-          s.stop('VPS not found');
-        }
-      } catch (error) {
-        s.stop(`Failed to delete VPS: ${error.message}`);
-      }
-    }
-
-    // Delete Hetzner firewall.
-    // Pulumi (src/lib/iac/programs/hetzner-compose.js) names the firewall
-    //   `${projectName}-${environment}-firewall`
-    // Earlier this used `vibecarbon-${projectName}-${envName}` which never
-    // matched anything Pulumi created — the firewall always leaked, and
-    // the next compose restore re-deploy hit "name is already used
-    // (uniqueness_error)" on Pulumi up. Match the actual Pulumi naming
-    // convention (the equivalent fix exists in destroyComposeHA).
-    const fwName = `${projectConfig.projectName}-${envName}-firewall`;
-    if (hetznerToken) {
-      s.start(`Deleting firewall: ${fwName}`);
-      try {
-        const deleted = await hetznerDeleteFirewall(hetznerToken, fwName);
-        if (deleted) results.firewalls.push(fwName);
-        s.stop(deleted ? 'Firewall deleted' : 'Firewall not found');
-      } catch (error) {
-        s.stop(`Failed to delete firewall: ${error.message}`);
-      }
-    }
-
-    // Delete Hetzner SSH key.
-    // Pulumi names the key
-    //   `${projectName}-${environment}-${location}-key`
-    // — the location suffix is what kept the old `vibecarbon-` prefix from
-    // ever matching. Same root cause as the firewall above.
-    const composeRegion = envConfig.region || envConfig.servers?.[0]?.region;
-    const hetznerSshKeyName = composeRegion
-      ? `${projectConfig.projectName}-${envName}-${composeRegion}-key`
-      : null;
-    if (hetznerToken && hetznerSshKeyName) {
-      s.start(`Deleting SSH key: ${hetznerSshKeyName}`);
-      try {
-        const deleted = await hetznerDeleteSSHKey(hetznerToken, hetznerSshKeyName);
-        if (deleted) results.sshKeys.push(hetznerSshKeyName);
-        s.stop(deleted ? 'SSH key deleted' : 'SSH key not found');
-      } catch (error) {
-        s.stop(`Failed to delete SSH key: ${error.message}`);
-      }
-    }
-
-    // DNS cleanup is ownership-filtered: only records pointing at this env's
-    // server IPs are deleted. Shared zones (e.g. parallel e2e scenarios
-    // on the same root domain) used to lose neighbours' records here — see
-    // the deleteDNSRecord doc for context.
-    const ownedIps = (envConfig.servers || []).map((srv) => srv.ip).filter(Boolean);
-
-    // Delete Cloudflare DNS if configured
-    if (cloudflareToken && envConfig.dns?.cloudflareZoneId && envConfig.domain) {
-      const zoneId = envConfig.dns.cloudflareZoneId;
-
-      s.start(`Deleting DNS record: ${envConfig.domain}`);
-      try {
-        const result = await cloudflareDeleteDNSRecord(
-          cloudflareToken,
-          zoneId,
-          envConfig.domain,
-          ownedIps,
-        );
-        if (result.deleted > 0) results.dns.push(envConfig.domain);
-        if (result.skipped > 0) {
-          s.stop(
-            `DNS record preserved (${result.skipped} unowned target(s): ${result.skippedTargets.join(', ')})`,
-          );
-        } else {
-          s.stop(result.deleted > 0 ? 'DNS record deleted' : 'DNS record not found');
-        }
-      } catch (error) {
-        s.stop(`DNS deletion failed: ${error.message}`);
-      }
-    }
-
-    // Delete Hetzner DNS if configured
-    if (envConfig.dns?.provider === 'hetzner' && envConfig.dns?.hetznerZoneId && envConfig.domain) {
-      const zoneId = envConfig.dns.hetznerZoneId;
-      s.start(`Deleting Hetzner DNS record: ${envConfig.domain}`);
-      try {
-        const zone = await hetznerDnsGetZone(hetznerToken, zoneId);
-        const [root, wildcard] = await Promise.all([
-          hetznerDnsDeleteRecord(hetznerToken, zoneId, zone.name, envConfig.domain, ownedIps),
-          hetznerDnsDeleteRecord(
-            hetznerToken,
-            zoneId,
-            zone.name,
-            `*.${envConfig.domain}`,
-            ownedIps,
-          ),
-        ]);
-        if (root.deleted || wildcard.deleted) results.dns.push(envConfig.domain);
-        const preserved = [root, wildcard].filter((r) => r.skipped);
-        if (preserved.length > 0) {
-          const targets = preserved.flatMap((p) => p.skippedTargets);
-          s.stop(`Hetzner DNS records preserved (unowned targets: ${targets.join(', ')})`);
-        } else {
-          s.stop('Hetzner DNS records deleted');
-        }
-      } catch (error) {
-        s.stop(`Hetzner DNS cleanup failed: ${error.message}`);
-      }
-    }
-
-    // Delete S3 bucket if configured
-    if (envConfig.s3?.bucket) {
-      const s3BucketName = envConfig.s3.bucket;
-      const s3Region = envConfig.s3?.region || 'fsn1';
-      s.start(`Deleting S3 bucket: ${s3BucketName}`);
-      try {
-        const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
-        if (s3Creds) {
-          const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
-          try {
-            const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
-            if (result.deleted) results.s3Bucket = s3BucketName;
-            s.stop(result.deleted ? 'S3 bucket deleted' : 'S3 bucket not found');
-          } catch (bucketError) {
-            if (
-              bucketError.name === 'NoSuchBucket' ||
-              bucketError.$metadata?.httpStatusCode === 404
-            ) {
-              s.stop('S3 bucket not found (already deleted or never created)');
-            } else {
-              throw bucketError;
-            }
-          }
-        } else {
-          s.stop('S3 bucket skipped (no credentials available)');
-          results.issues.push({
-            step: 'S3 bucket',
-            detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
-            hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
-          });
-        }
-      } catch (error) {
-        s.stop(`S3 bucket deletion failed: ${error.message}`);
-        results.issues.push({
-          step: 'S3 bucket',
-          detail: `${s3BucketName} (${s3Region}) not deleted: ${error.message}`,
-          hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
-        });
-      }
-    }
-
-    // Backup bucket: preserved by default, deleted with --purge-backups.
-    await handleBackupBucket(envConfig, projectConfig, args, s);
-
-    // Clean up local SSH key files
-    const sshKeyFiles = [sshKeyPath, `${sshKeyPath}.pub`];
-    for (const f of sshKeyFiles) {
-      if (existsSync(f)) {
-        try {
-          rmSync(f);
-        } catch {
-          // Non-fatal
-        }
+  // Delete Hetzner DNS if configured
+  if (envConfig.dns?.provider === 'hetzner' && envConfig.dns?.hetznerZoneId && envConfig.domain) {
+    const zoneId = envConfig.dns.hetznerZoneId;
+    s.start(`Deleting Hetzner DNS record: ${envConfig.domain}`);
+    try {
+      const zone = await hetznerDnsGetZone(hetznerToken, zoneId);
+      const [root, wildcard] = await Promise.all([
+        hetznerDnsDeleteRecord(hetznerToken, zoneId, zone.name, envConfig.domain, ownedIps),
+        hetznerDnsDeleteRecord(hetznerToken, zoneId, zone.name, `*.${envConfig.domain}`, ownedIps),
+      ]);
+      if (root.deleted || wildcard.deleted) results.dns.push(envConfig.domain);
+      const preserved = [root, wildcard].filter((r) => r.skipped);
+      if (preserved.length > 0) {
+        const targets = preserved.flatMap((p) => p.skippedTargets);
+        s.stop(`Hetzner DNS records preserved (unowned targets: ${targets.join(', ')})`);
+      } else {
+        s.stop('Hetzner DNS records deleted');
       }
+    } catch (error) {
+      s.stop(`Hetzner DNS cleanup failed: ${error.message}`);
     }
-
-    // Update project config to remove environment
-    const updatedConfig = { ...projectConfig };
-    if (updatedConfig.environments) {
-      delete updatedConfig.environments[envName];
-    }
-    saveProjectConfig(updatedConfig);
-
-    cleanupLocalEnvFiles(cwd, envName);
-
-    const { formatted: timeStr } = tracker.finish();
-    destroyOutro(envName, timeStr, results);
-    return;
   }
+}
 
-  // Identify Pulumi stacks to destroy. HA k8s uses two stacks:
-  // {env}-primary + {env}-standby; single k8s uses just {env}.
-  const isHAK8s = envConfig.ha?.enabled && envConfig.deployMode === 'kubernetes';
-  const pulumiStackEnvs = isHAK8s ? [`${envName}-primary`, `${envName}-standby`] : [envName];
-  const hasPulumiStack = envConfig.deployMode === 'kubernetes';
+/**
+ * k8s / k8s-ha: Cloudflare + Hetzner DNS, then Pulumi-managed infra teardown
+ * (volume pre-scan, CCM LB cleanup, CSI release, CA-worker sweep, `pulumi
+ * destroy` per stack, orphan sweep, HA shared-key delete), then orphaned CSI
+ * volume cleanup. plan.stackEnvs already differs for k8s vs k8s-ha, so a single
+ * function serves both.
+ */
+async function destroyK8sTier({
+  plan,
+  envConfig,
+  projectConfig,
+  environment,
+  hetznerToken,
+  cloudflareToken,
+  results,
+  spinner: s,
+  cwd,
+}) {
+  const { stackEnvs, clusterNames, hasPulumiStack, ownedIps } = plan;
+  const isHAK8s = plan.tier === 'k8s-ha';
 
   // Volume IDs collected from ALL cluster servers (master, supabase, workers).
-  // Hetzner CSI names volumes pvc-<uuid> — not the cluster name — so we must collect IDs
-  // before the servers are deleted rather than trying to match by name/label afterwards.
+  // Hetzner CSI names volumes pvc-<uuid> — not the cluster name — so we must
+  // collect IDs before the servers are deleted rather than matching by
+  // name/label afterwards.
   const allClusterVolumeIds = [];
-  // Datacenter location names for all servers in the cluster (e.g. "fsn1", "nbg1").
-  // Used to find pvc-* volumes created by CSI that were detached before destroy runs.
+  // Datacenter location names for all servers in the cluster (e.g. "fsn1").
+  // Used to find pvc-* volumes created by CSI that were detached before destroy.
   const clusterLocations = new Set();
 
-  // Owned IPs gate every DNS delete — only records pointing at this env's
-  // servers are removed. See deleteDNSRecord doc in lib/cloudflare.js.
-  const ownedIps = (envConfig.servers || []).map((srv) => srv.ip).filter(Boolean);
-
   // 1. Delete Cloudflare resources first (while servers still exist for reference)
   if (cloudflareToken && envConfig.dns?.cloudflareZoneId) {
     const zoneId = envConfig.dns.cloudflareZoneId;
@@ -1558,18 +1379,11 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     // Pulumi owns the servers, firewalls, SSH keys, and networks — `pulumi
     // destroy` tears them all down in one pass.
 
-    // For HA, each sub-cluster has its own network (e.g. havibes-prod-primary-network)
-    const clusterNames = isHAK8s
-      ? [
-          `${projectConfig.projectName}-${envName}-primary`,
-          `${projectConfig.projectName}-${envName}-standby`,
-        ]
-      : [`${projectConfig.projectName}-${envName}`];
-
-    // Pre-scan: collect volume IDs from ALL servers in the cluster network(s) before deletion.
-    // Hetzner CSI driver names volumes with PVC UUIDs (e.g. pvc-xxxxxxxx), not the cluster
-    // name, so name/label matching in hetznerCleanupOrphanedVolumes is unreliable. By
-    // collecting the IDs now we can delete them reliably after Pulumi tears the servers down.
+    // Pre-scan: collect volume IDs from ALL servers in the cluster network(s)
+    // before deletion. Hetzner CSI driver names volumes with PVC UUIDs (e.g.
+    // pvc-xxxxxxxx), not the cluster name, so name/label matching in
+    // hetznerCleanupOrphanedVolumes is unreliable. By collecting the IDs now we
+    // can delete them reliably after Pulumi tears the servers down.
     s.start('Scanning cluster servers for attached volumes');
     try {
       const networks = await hetznerListNetworks(hetznerToken);
@@ -1601,8 +1415,8 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     }
 
     // Clean up CCM-created load balancers before Pulumi destroys the network.
-    // The cluster network still exists at this point, so matchesNetwork is reliable.
-    // Once the network is gone, matchesNetwork always returns false.
+    // The cluster network still exists at this point, so matchesNetwork is
+    // reliable. Once the network is gone, matchesNetwork always returns false.
     // HA: fan out across primary + standby — clusters are isolated.
     if (clusterNames.length > 0) {
       console.log(`Cleaning up Hetzner load balancers across ${clusterNames.length} cluster(s)...`);
@@ -1638,10 +1452,10 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     // HA: release CSI volumes on primary + standby in parallel — each
     // cluster's controller is independent.
     console.log(
-      `Releasing CSI volumes via cluster finalizers across ${pulumiStackEnvs.length} cluster(s)...`,
+      `Releasing CSI volumes via cluster finalizers across ${stackEnvs.length} cluster(s)...`,
     );
     await Promise.allSettled(
-      pulumiStackEnvs.map(async (stackEnv) => {
+      stackEnvs.map(async (stackEnv) => {
         const kubeconfigPath = join(cwd, '.vibecarbon', `kubeconfig-${stackEnv}`);
         const dirLabel = isHAK8s ? ` (${stackEnv})` : '';
         try {
@@ -1672,6 +1486,10 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
             bucket: envConfig.s3.bucket,
             region: envConfig.s3.region,
             endpoint: envConfig.s3.endpoint,
+            // Resolve the Pulumi backend to the dedicated state bucket. Falls
+            // back (via resolveBackendUrl's `?? bucket`) to the app bucket for
+            // envs deployed before the state-bucket split.
+            stateBucket: envConfig.s3.stateBucket,
             accessKey: credsForDestroy.s3.accessKey,
             secretKey: credsForDestroy.s3.secretKey,
           }
@@ -1683,11 +1501,9 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     // For HA, sweep both primary and standby cluster networks.
     // HA: sweep CA-spawned workers on primary + standby in parallel — each
     // cluster's CA tags its workers with a distinct cluster name.
-    console.log(
-      `Sweeping cluster-autoscaler workers across ${pulumiStackEnvs.length} cluster(s)...`,
-    );
+    console.log(`Sweeping cluster-autoscaler workers across ${stackEnvs.length} cluster(s)...`);
     await Promise.allSettled(
-      pulumiStackEnvs.map(async (stackEnv) => {
+      stackEnvs.map(async (stackEnv) => {
         const dirLabel = isHAK8s ? ` (${stackEnv})` : '';
         const caClusterName = `${projectConfig.projectName}-${stackEnv}`;
         try {
@@ -1717,10 +1533,10 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     // so there's no shared state to race on. Saves ~200s on k8s-ha critical
     // path (Pulumi destroy is ~100s/stack and was strictly sequential).
     console.log(
-      `Destroying infrastructure via Pulumi across ${pulumiStackEnvs.length} stack(s) — this may take a few minutes...`,
+      `Destroying infrastructure via Pulumi across ${stackEnvs.length} stack(s) — this may take a few minutes...`,
     );
     await Promise.allSettled(
-      pulumiStackEnvs.map(async (stackEnv) => {
+      stackEnvs.map(async (stackEnv) => {
         const dirLabel = isHAK8s ? ` (${stackEnv})` : '';
         try {
           await perfAsync(`destroy.pulumi.${stackEnv}`, async () =>
@@ -1788,7 +1604,7 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     // (RCA from k8s-ha 2026-04-30: post-destroy sweep flagged the same
     // key as REGRESSION every run).
     if (isHAK8s && hetznerToken) {
-      const haSshKeyName = `${projectConfig.projectName}-${envName}-ha-key`;
+      const haSshKeyName = `${projectConfig.projectName}-${environment}-ha-key`;
       s.start(`Deleting shared HA SSH key: ${haSshKeyName}`);
       try {
         const deleted = await hetznerDeleteSSHKey(hetznerToken, haSshKeyName);
@@ -1800,183 +1616,448 @@ ${c.danger('WARNING: All data on these servers will be permanently lost!')}
     }
   }
 
-  cleanupLocalEnvFiles(cwd, envName);
+  // Clean up Kubernetes-managed resources (created by CCM/CSI at runtime,
+  // not by the Pulumi program). These aren't in any stack's resource graph.
+  s.start('Cleaning up orphaned volumes');
+  try {
+    const serverNames = (envConfig.servers || []).map((sv) => sv.name);
+    const knownVolumeIds = [...new Set(allClusterVolumeIds)];
+    const deletedVolumes = await hetznerCleanupOrphanedVolumes(
+      hetznerToken,
+      projectConfig.projectName,
+      environment,
+      serverNames,
+      knownVolumeIds,
+      [...clusterLocations],
+    );
+    results.volumes = deletedVolumes;
+    s.stop(
+      deletedVolumes.length > 0
+        ? `Deleted ${deletedVolumes.length} orphaned volume(s)`
+        : 'No orphaned volumes found',
+    );
+  } catch (error) {
+    s.stop(`Volume cleanup failed: ${error.message}`);
+  }
+}
+
+/**
+ * Tier → strategy dispatch table. k8s and k8s-ha share one function; the plan's
+ * stackEnvs/clusterNames already encode the primary+standby fan-out.
+ */
+const DESTROY_STRATEGIES = {
+  compose: destroyComposeTier,
+  'compose-ha': destroyComposeHATier,
+  k8s: destroyK8sTier,
+  'k8s-ha': destroyK8sTier,
+};
+
+// ============================================================================
+// MAIN DESTRUCTION FLOW
+// ============================================================================
+
+async function main() {
+  const { values, positional, errors } = parseFlags(process.argv.slice(2), SPEC);
+
+  if (errors.length > 0) {
+    for (const e of errors) {
+      process.stderr.write(`${c.error('✗')} ${e}\n`);
+    }
+    process.stderr.write(`Run ${c.info('vibecarbon destroy -h')} for usage.\n`);
+    process.exit(1);
+  }
+
+  if (values.h) {
+    process.stdout.write(renderHelp(SPEC));
+    process.exit(0);
+  }
+  if (values.v) {
+    console.log(`destroy-vibecarbon v${VERSION}`);
+    process.exit(0);
+  }
+
+  // Build the legacy `args` struct that the orchestration code below
+  // reads (env / yes / destroyOrphans / purgeBackups). Field renames
+  // happen at the boundary so the orchestration stays untouched —
+  // each downstream branch is hundreds of lines and well-tested.
+  const envSeed =
+    /** @type {string|undefined} */ (positional.env) ||
+    /** @type {string|null} */ (values.env) ||
+    null;
+  const args = {
+    env: envSeed,
+    yes: !!values.y,
+    destroyOrphans: !!values.orphans,
+    purgeBackups: !!values.purge,
+  };
+
+  // Check if current working directory exists
+  let cwd;
+  try {
+    cwd = process.cwd();
+  } catch {
+    console.error(`\n${c.error('Error:')} Current working directory does not exist.`);
+    console.error(
+      `This can happen if the project directory was deleted while this command was running.`,
+    );
+    console.error(`\nPlease navigate to a valid directory and try again.`);
+    process.exit(1);
+  }
+
+  // Project guard runs before banner so an accidental `vibecarbon
+  // destroy` from a parent directory emits the canonical message.
+  assertInProjectDir(cwd);
+
+  console.clear();
+  printBanner();
+  p.intro(`${c.bold('vibecarbon destroy')} ${c.dim(`v${VERSION}`)}`);
+
+  const projectConfig = loadProjectConfig(cwd);
+
+  // TTY guard: if the operator seeded an env, no env prompt fires;
+  // otherwise we'd open a picker that hangs off-TTY.
+  const envCount = Object.keys(projectConfig?.environments || {}).length;
+  requireTTYOrFlags({
+    requirements: [
+      {
+        flag: 'env',
+        description: 'name an environment to destroy',
+        satisfied: !!envSeed || envCount <= 1,
+      },
+    ],
+  });
+
+  if (!projectConfig.environments || Object.keys(projectConfig.environments).length === 0) {
+    // Check for orphan Pulumi stacks (deployment interrupted before config save)
+    const orphanScan = p.spinner();
+    orphanScan.start('Scanning for orphan Pulumi stacks...');
+    const orphans = await findOrphanPulumiStacks(projectConfig);
+    orphanScan.stop(
+      orphans.length > 0 ? `Found ${orphans.length} orphan stack(s)` : 'No orphan stacks found',
+    );
+
+    if (orphans.length > 0) {
+      p.log.warn('No environments found in .vibecarbon.json');
+      p.log.info(
+        `Found ${orphans.length} orphan Pulumi stack(s) — likely from interrupted deployments:`,
+      );
+      for (const orphan of orphans) {
+        p.log.info(`  • ${c.bold(orphan.name)}`);
+      }
+
+      // Auto-destroying orphans is dangerous: when projectConfig.s3Config is
+      // null (e.g., a typo in the saved config), listStacks falls back to
+      // the local file:// backend at ~/.vibecarbon/pulumi-state/, which is
+      // GLOBAL across projects/scenarios. A scenario's --yes destroy then
+      // nukes other scenarios' stacks (observed 2026-04-26 batch run #5:
+      // compose's final-destroy destroyed compose-ha's e2-primary/e2-standby
+      // mid-deploy because compose's empty config let the orphan path fire).
+      //
+      // The auto-destroy used to honor --yes, but cross-scenario blast is
+      // worse than leaving local state around. Require an explicit flag now.
+      // For interactive use, prompt as before.
+      p.log.info('');
+      if (!args.destroyOrphans) {
+        p.log.warn('Skipping orphan cleanup. Re-run with -orphans to remove these stacks.');
+        p.outro('Done (orphans not destroyed)');
+        process.exit(0);
+      }
+      const shouldDestroy = args.yes
+        ? true
+        : await p.confirm({
+            message: `Destroy these ${orphans.length} orphan stack(s)?`,
+            initialValue: false, // Default to NO for safety
+          });
+
+      if (p.isCancel(shouldDestroy) || !shouldDestroy) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+
+      // Load the HCLOUD token + S3 backend config the same way the
+      // main destroy path does. Pulumi's hcloud provider needs a valid
+      // token to delete resources; an empty token surfaces as
+      // "Missing Hetzner Cloud API token" mid-destroy. The s3Config
+      // must match the one findOrphanPulumiStacks used to discover
+      // these stacks, otherwise resolveBackendUrl picks a different
+      // backend and the destroy can't find them.
+      const orphanCreds = loadCredentials();
+      const orphanApiToken =
+        process.env.HETZNER_API_TOKEN ||
+        orphanCreds?.hetzner?.apiToken ||
+        orphanCreds?.hetznerApiToken ||
+        '';
+      const orphanS3Config =
+        projectConfig?.s3Config && orphanCreds?.s3
+          ? {
+              ...projectConfig.s3Config,
+              accessKey: orphanCreds.s3.accessKey,
+              secretKey: orphanCreds.s3.secretKey,
+            }
+          : null;
+
+      if (!orphanApiToken) {
+        p.log.error(
+          'No Hetzner API token found in HETZNER_API_TOKEN env var or ~/.vibecarbon/credentials.json — cannot destroy orphan stacks.',
+        );
+        process.exit(1);
+      }
+
+      const orphanSpinner = p.spinner();
+      for (const orphan of orphans) {
+        orphanSpinner.start(`Destroying orphan stack ${c.bold(orphan.name)} (pulumi destroy)...`);
+        try {
+          await destroyOrphanPulumiStack(orphan, {
+            apiToken: orphanApiToken,
+            s3Config: orphanS3Config,
+          });
+          orphanSpinner.stop(`Destroyed: ${orphan.name}`);
+        } catch (error) {
+          orphanSpinner.error(`Failed to destroy ${orphan.name}: ${error.message}`);
+        }
+      }
+
+      p.outro('Orphan cleanup complete');
+      process.exit(0);
+    }
+
+    p.log.error('No environments found in .vibecarbon.json');
+    p.log.info('Nothing to destroy.');
+    process.exit(1);
+  }
+
+  p.log.info(`Project: ${c.bold(projectConfig.projectName)}`);
 
-  if (!hasPulumiStack) {
-    // Manual API cleanup for compose deployments — k8s mode is fully
-    // Pulumi-managed and was already torn down above.
-    for (const server of envConfig.servers || []) {
-      s.start(`Deleting server: ${server.name} (${server.ip})`);
-      try {
-        const deleted = await hetznerDeleteServer(hetznerToken, server.id);
-        if (deleted) results.servers.push(server.name);
-        s.stop(deleted ? `Server ${server.name} deleted` : `Server ${server.name} not found`);
-      } catch (error) {
-        s.stop(`Failed to delete ${server.name}: ${error.message}`);
-      }
-    }
+  // Select environment to destroy
+  const envNames = Object.keys(projectConfig.environments);
+  let envName = args.env;
 
-    // 3. Delete Hetzner firewalls
-    for (const server of envConfig.servers || []) {
-      const fwName = `${server.name}-fw`;
-      s.start(`Deleting firewall: ${fwName}`);
-      try {
-        const deleted = await hetznerDeleteFirewall(hetznerToken, fwName);
-        if (deleted) results.firewalls.push(fwName);
-        s.stop(deleted ? `Firewall ${fwName} deleted` : `Firewall ${fwName} not found`);
-      } catch (error) {
-        s.stop(`Failed to delete firewall: ${error.message}`);
-      }
+  if (!envName) {
+    if (envNames.length === 1) {
+      envName = envNames[0];
+    } else {
+      envName = await p.select({
+        message: 'Which environment do you want to destroy?',
+        options: envNames.map((name) => ({
+          value: name,
+          label: name,
+          hint: projectConfig.environments[name].servers?.map((s) => s.ip).join(', '),
+        })),
+      });
     }
+  }
 
-    // 4. Delete Hetzner SSH key.
-    // Pulumi (src/lib/iac/programs/hetzner-k8s.js) names the SSH key
-    //   `${projectName}-${environment}-${location}-key`
-    // (`vibecarbon-` prefix dropped — the project name is already unique).
-    // This branch only runs when Pulumi state is missing, so we have to
-    // know the location to find the key. Fall back to the prefix-only
-    // form for older deploys that may not have a region in envConfig.
-    const k8sRegion = envConfig.region || envConfig.servers?.[0]?.region;
-    const sshKeyName = k8sRegion
-      ? `${projectConfig.projectName}-${envName}-${k8sRegion}-key`
-      : null;
-    if (sshKeyName) {
-      s.start(`Deleting SSH key: ${sshKeyName}`);
-      try {
-        const deleted = await hetznerDeleteSSHKey(hetznerToken, sshKeyName);
-        if (deleted) results.sshKeys.push(sshKeyName);
-        s.stop(deleted ? 'SSH key deleted' : 'SSH key not found');
-      } catch (error) {
-        s.stop(`Failed to delete SSH key: ${error.message}`);
-      }
-    }
-  } // end manual API cleanup
+  if (p.isCancel(envName)) {
+    p.cancel('Operation cancelled.');
+    process.exit(0);
+  }
 
-  // Clean up Kubernetes-managed resources (created by CCM/CSI at runtime,
-  // not by the Pulumi program). These must run for ALL deployments since
-  // they aren't in any stack's resource graph.
+  const envConfig = projectConfig.environments[envName];
+  if (!envConfig) {
+    p.log.error(`Environment '${envName}' not found`);
+    p.log.info(`Available environments: ${envNames.join(', ')}`);
+    process.exit(1);
+  }
 
-  s.start('Cleaning up orphaned volumes');
-  try {
-    const serverNames = (envConfig.servers || []).map((sv) => sv.name);
-    const knownVolumeIds = [...new Set(allClusterVolumeIds)];
-    const deletedVolumes = await hetznerCleanupOrphanedVolumes(
-      hetznerToken,
-      projectConfig.projectName,
-      envName,
-      serverNames,
-      knownVolumeIds,
-      [...clusterLocations],
-    );
-    results.volumes = deletedVolumes;
-    s.stop(
-      deletedVolumes.length > 0
-        ? `Deleted ${deletedVolumes.length} orphaned volume(s)`
-        : 'No orphaned volumes found',
-    );
-  } catch (error) {
-    s.stop(`Volume cleanup failed: ${error.message}`);
+  // Show what will be deleted
+  const serverList =
+    envConfig.servers?.map((s) => `    ${c.error('•')} ${s.name} (${s.ip})`).join('\n') ||
+    '    None';
+
+  p.note(
+    `
+${c.danger('This will permanently delete:')}
+
+${c.bold('Servers:')}
+${serverList}
+
+${c.bold('Firewalls:')}
+${envConfig.servers?.map((s) => `    ${c.error('•')} ${s.name}-fw`).join('\n') || '    None'}
+
+${c.bold('SSH Keys:')}
+    ${c.error('•')} vibecarbon-${projectConfig.projectName}-${envName}
+
+${
+  envConfig.dns?.provider === 'cloudflare'
+    ? `${c.bold('Cloudflare Resources:')}
+    ${c.error('•')} DNS record: ${envConfig.domain}
+    ${c.error('•')} Health checks
+    ${envConfig.ha ? `${c.error('•')} Wildcard DNS record` : ''}
+`
+    : ''
+}
+${
+  envConfig.s3?.bucket
+    ? `${c.bold('S3 Storage:')}
+    ${c.error('•')} Bucket: ${envConfig.s3.bucket} (all objects will be deleted)
+`
+    : ''
+}${
+  envConfig.backupS3?.bucket
+    ? `${c.bold('S3 Backups:')}
+    ${args.purgeBackups ? `${c.error('•')} Bucket: ${envConfig.backupS3.bucket} (WILL BE DELETED — --purge-backups)` : `${c.success('•')} Bucket: ${envConfig.backupS3.bucket} (PRESERVED for recovery)`}
+`
+    : ''
+}
+${c.bold('GitHub:')}
+    ${c.error('•')} Environment: ${envName}
+
+${c.danger('WARNING: All data on these servers will be permanently lost!')}
+  `,
+    `Destroying: ${envName}`,
+  );
+
+  const needsProdConfirm = requiresProdTypeToConfirm(envName);
+
+  // First prompt: only when not --yes.
+  if (!args.yes) {
+    const confirmed = await p.confirm({
+      message: `Are you sure you want to destroy the ${c.bold(envName)} environment?`,
+      initialValue: false,
+    });
+    if (!confirmed || p.isCancel(confirmed)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
   }
 
-  // 4.5 Delete S3 bucket (the Pulumi backend bucket itself, created during
-  // deploy bootstrap, not part of any stack's resource graph)
-  // Use the saved bucket name from config, or fall back to the predictable deploy-time name.
-  // The deploy script creates buckets as sanitizeBucketName(projectName) → e.g. "myapp-storage".
-  const s3BucketName = envConfig.s3?.bucket || sanitizeBucketName(projectConfig.projectName);
-  const s3Region = envConfig.s3?.region || 'fsn1';
-  s.start(`Deleting S3 bucket: ${s3BucketName}`);
-  try {
-    // S3 credentials from env vars or credentials file (prompts if needed)
-    const s3Creds = await getS3Credentials(projectConfig.projectName, { save: false });
-    if (s3Creds) {
-      const s3Provider = new HetznerS3Provider(s3Creds.accessKey, s3Creds.secretKey, s3Region);
+  // Type-to-confirm: runs whenever NOT --yes, OR the env is prod/production
+  // (even with --yes). Protects against `--env prod --yes` typos in CI/scripts.
+  if (!args.yes || needsProdConfirm) {
+    const confirmSlug = `${projectConfig.projectName}-${envName}`;
+    if (args.yes && needsProdConfirm) {
+      p.log.warn(
+        `Destroying a production environment still requires type-to-confirm, even with --yes.`,
+      );
+    }
+    const doubleConfirm = await p.text({
+      message: `Type "${confirmSlug}" to confirm:`,
+      validate: (v) => (v !== confirmSlug ? `Please type "${confirmSlug}" to confirm` : undefined),
+    });
+    if (p.isCancel(doubleConfirm)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
+  }
+
+  // Offer to create a backup before destroying
+  const serverIp = envConfig.servers?.[0]?.ip;
+  const sshKeyPath = join(cwd, '.vibecarbon', `deploy_key_${envName}`);
+  if (serverIp && existsSync(sshKeyPath) && !args.yes) {
+    const offerBackup = await p.confirm({
+      message: 'Create a backup before destroying? (recommended)',
+      initialValue: true,
+    });
+
+    if (!p.isCancel(offerBackup) && offerBackup) {
+      const backupSpinner = p.spinner();
+      backupSpinner.start('Creating backup...');
       try {
-        const result = await s3Provider.emptyAndDeleteBucket(s3BucketName);
-        if (result.deleted) {
-          results.s3Bucket = s3BucketName;
-          s.stop(
-            result.objectsRemoved > 0
-              ? `S3 bucket deleted (${result.objectsRemoved} objects removed)`
-              : 'S3 bucket deleted',
-          );
-        }
-      } catch (bucketError) {
-        // NoSuchBucket means it was already deleted or never created — not an error
-        if (bucketError.name === 'NoSuchBucket' || bucketError.$metadata?.httpStatusCode === 404) {
-          s.stop('S3 bucket not found (already deleted or never created)');
-        } else {
-          throw bucketError;
+        if (isComposeTier(resolveTier(envConfig))) {
+          const { backupCompose } = await import('./lib/deploy/compose/index.js');
+          await backupCompose(serverIp, sshKeyPath, projectConfig.projectName, {
+            retain: envConfig.backup?.retentionDays,
+          });
+          backupSpinner.stop('wal-g base backup pushed to S3');
         }
+      } catch (backupError) {
+        backupSpinner.stop(`Backup failed: ${backupError.message}`);
+        p.log.warn('Continuing with destroy...');
       }
-    } else {
-      s.stop('S3 bucket skipped (no credentials available)');
-      results.issues.push({
-        step: 'S3 bucket',
-        detail: `${s3BucketName} (${s3Region}) not deleted: no S3 credentials available`,
-        hint: 'Run `vibecarbon destroy` again with credentials configured, or delete via the Hetzner console.',
-      });
     }
-  } catch (error) {
-    s.stop(`S3 bucket deletion failed: ${error.message}`);
-    results.issues.push({
-      step: 'S3 bucket',
-      detail: `${s3BucketName} (${s3Region}) not deleted: ${error.message}`,
-      hint: 'Empty manually via the Hetzner Object Storage console, then DeleteBucket. Bucket continues to incur storage charges until deleted.',
-    });
   }
 
-  // Backup bucket: preserved by default, deleted with --purge-backups.
-  await handleBackupBucket(envConfig, projectConfig, args, s);
+  // Get API tokens (env var → credentials file → interactive prompt)
+  const hetznerToken = await getApiToken(projectConfig.projectName);
+  if (!hetznerToken) {
+    p.log.error('Hetzner API token is required');
+    process.exit(1);
+  }
 
-  // 5. Delete GitHub environment
-  s.start(`Deleting GitHub environment: ${envName}`);
-  try {
-    results.github = deleteGitHubEnvironment(envName);
-    s.stop(
-      results.github ? 'GitHub environment deleted' : 'GitHub environment not found (or no access)',
-    );
-  } catch (error) {
-    s.stop(`Failed to delete GitHub environment: ${error.message}`);
+  let cloudflareToken = null;
+  if (envConfig.dns?.provider === 'cloudflare' && envConfig.dns?.cloudflareZoneId) {
+    // Check env var → credentials file → prompt
+    cloudflareToken = process.env.CLOUDFLARE_API_TOKEN;
+
+    if (!cloudflareToken) {
+      const creds = loadCredentials();
+      if (creds.cloudflare?.apiToken) {
+        cloudflareToken = creds.cloudflare.apiToken;
+        p.log.info('✓ Using Cloudflare API token from ~/.vibecarbon/credentials.json');
+      }
+    }
+
+    if (!cloudflareToken) {
+      cloudflareToken = await p.password({
+        message: 'Enter Cloudflare API token (for DNS cleanup)',
+        validate: (v) => (v.length < 10 ? 'API token is required' : undefined),
+      });
+
+      if (p.isCancel(cloudflareToken)) {
+        p.cancel('Operation cancelled.');
+        process.exit(0);
+      }
+    } else if (process.env.CLOUDFLARE_API_TOKEN) {
+      p.log.info('✓ Using Cloudflare API token from CLOUDFLARE_API_TOKEN environment variable');
+    }
   }
 
-  // 6. Update project config
-  s.start('Updating project configuration');
-  delete projectConfig.environments[envName];
-  saveProjectConfig(projectConfig);
-  s.stop('Configuration updated');
-
-  // Summary
-  const deletedCount =
-    results.servers.length +
-    results.volumes.length +
-    results.firewalls.length +
-    results.sshKeys.length +
-    results.dns.length +
-    results.healthChecks.length +
-    results.loadBalancers.length +
-    (results.s3Bucket ? 1 : 0) +
-    (results.github ? 1 : 0);
+  // ========== DESTRUCTION ==========
 
-  p.note(
-    `
-${c.success('Deleted resources:')}
-    Servers:        ${results.servers.length > 0 ? results.servers.join(', ') : 'None'}
-    Volumes:        ${results.volumes.length > 0 ? results.volumes.join(', ') : 'None'}
-    Firewalls:      ${results.firewalls.length > 0 ? results.firewalls.join(', ') : 'None'}
-    SSH Keys:       ${results.sshKeys.length > 0 ? results.sshKeys.join(', ') : 'None'}
-    DNS Records:    ${results.dns.length > 0 ? results.dns.join(', ') : 'None'}
-    Health Checks:  ${results.healthChecks.length > 0 ? results.healthChecks.join(', ') : 'None'}
-    Load Balancers: ${results.loadBalancers.length > 0 ? results.loadBalancers.join(', ') : 'None'}
-    S3 Bucket:      ${results.s3Bucket || 'None'}
-    GitHub Env:     ${results.github ? envName : 'None'}
+  const tracker = createTracker('destroy', { environment: envName });
+  const s = tracker.spinner();
+  const results = {
+    servers: [],
+    volumes: [],
+    firewalls: [],
+    sshKeys: [],
+    dns: [],
+    healthChecks: [],
+    loadBalancers: [],
+    s3Bucket: null,
+    github: false,
+    // Sub-step failures that didn't abort destroy but left state behind
+    // (e.g., S3 bucket couldn't be emptied). The outro surfaces these so the
+    // operator doesn't miss them, and the process exits non-zero so CI sees it.
+    issues: [],
+  };
 
-${c.dim(`Total: ${deletedCount} resources deleted`)}
-  `,
-    'Destruction Complete',
-  );
+  // ========== TIER DISPATCH ==========
+  // Pure planner derives every teardown target from persisted config; the
+  // per-tier strategy runs the infra teardown, then a single shared tail
+  // handles buckets/config/summary. k8s and k8s-ha share destroyK8sTier —
+  // the plan's stackEnvs/clusterNames already encode the HA fan-out.
+  const plan = planDestroyTargets(envConfig, projectConfig, envName);
+  const isK8s = isK8sTier(plan.tier);
+
+  await DESTROY_STRATEGIES[plan.tier]({
+    plan,
+    envConfig,
+    projectConfig,
+    environment: envName,
+    args,
+    results,
+    hetznerToken,
+    cloudflareToken,
+    cwd,
+    spinner: s,
+    tracker,
+  });
 
-  const { formatted: timeStr } = tracker.finish();
-  destroyOutro(envName, timeStr, results);
+  await finishDestroy({
+    envConfig,
+    projectConfig,
+    environment: envName,
+    args,
+    results,
+    spinner: s,
+    tracker,
+    cwd,
+    // k8s-only tail steps (compose/compose-ha never did these):
+    deleteGithubEnv: isK8s,
+    showSummary: isK8s,
+    defaultBucketName: isK8s,
+  });
 }
 
 // ============================================================================
@@ -2002,6 +2083,7 @@ export {
   cloudflareDeleteDNSRecord,
   cloudflareDeleteHealthCheck,
   deleteGitHubEnvironment,
+  deleteStateBucket,
   getApiToken,
   hetznerCleanupAutoscalerWorkers,
   hetznerCleanupLoadBalancers,