vibecarbon 0.5.1 → 0.6.1

package/README.md

@@ -118,7 +118,7 @@ DEBUG COMMANDS
 - Auto backup & restore
 - Live monitoring & alerts (Grafana, Prometheus, Loki)
 - Zero vendor lock-in
-- Cost effective ($15-20/mo single region or compose HA, $30+/mo K8s multi-region HA)
+- Cost effective — runs on inexpensive VPS hosting, a fraction of hyperscaler pricing
 
 ### Developer Experience
 - AI-ready codebase (Claude Code, Cursor, Windsurf, Copilot rules included)

package/carbon/.env.example

@@ -20,6 +20,9 @@ SUPABASE_SERVICE_ROLE_KEY="your-service-role-key-here"
 
 # Site URL (your public domain)
 SITE_URL="http://localhost:5173"
+# Public canonical URL baked into the client (og: tags, sitemap). At deploy this
+# is overridden with your real apex domain; localhost is correct for local dev.
+VITE_PUBLIC_URL="http://localhost:5173"
 
 # =============================================================================
 # ADMIN CREDENTIALS

package/carbon/.github/workflows/deploy.yml

@@ -74,34 +74,37 @@ jobs:
 
       # Apply the vibecarbon-secrets Secret. Server-side apply with a
       # distinct field manager ensures Flux doesn't try to prune these
-      # fields later, and that rotations simply overwrite. Secret values
-      # are written via stdin heredoc using $ENV_VARS rather than
-      # `${{ secrets.X }}` interpolation (defense-in-depth).
+      # fields later, and that rotations simply overwrite.
+      #
+      # Self-syncing: instead of enumerating every key (which silently drops
+      # any new `vibecarbon configure` secret that the CLI started seeding),
+      # we materialize ALL environment+repo secrets from `toJSON(secrets)` and
+      # build the Secret from them. Adding a feature key to the CLI's
+      # seedEnvironmentSecrets is enough — no edit here. The exclude list
+      # below is the only maintained piece, and it's an exclude (safe by
+      # default): drop infra/CI secrets that have their own Secret or that
+      # must never reach the app pod (the app envFrom's this whole Secret).
+      # `toJSON(secrets)` is bound to an env var (not interpolated inline in
+      # the script) for defense-in-depth; kubectl --from-literal passes values
+      # through argv with no shell interpretation.
       - name: Apply vibecarbon-secrets Secret
         env:
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
-          JWT_SECRET: ${{ secrets.JWT_SECRET }}
-          SUPABASE_ANON_KEY: ${{ secrets.SUPABASE_ANON_KEY }}
-          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
-          HETZNER_API_TOKEN: ${{ secrets.HETZNER_API_TOKEN }}
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+          ALL_SECRETS: ${{ toJSON(secrets) }}
           SITE_URL: ${{ vars.SITE_URL }}
         run: |
-          # `kubectl create secret --from-literal=KEY=VALUE` handles
-          # arbitrary VALUEs correctly (passes through Unix argv, no
-          # shell interpretation). `--dry-run -o yaml | kubectl apply`
-          # is the idempotent create-or-update pattern.
+          mapfile -t ARGS < <(printf '%s' "$ALL_SECRETS" | jq -r '
+            del(
+              .KUBECONFIG_B64,
+              .GITHUB_TOKEN, .github_token,
+              .HETZNER_API_TOKEN, .CLOUDFLARE_API_TOKEN
+            )
+            | to_entries[]
+            | select(.value != null and .value != "")
+            | "--from-literal=\(.key)=\(.value)"')
           kubectl create secret generic vibecarbon-secrets \
             --namespace=vibecarbon \
-            --from-literal=DB_PASSWORD="$DB_PASSWORD" \
-            --from-literal=JWT_SECRET="$JWT_SECRET" \
-            --from-literal=SUPABASE_ANON_KEY="$SUPABASE_ANON_KEY" \
-            --from-literal=SUPABASE_SERVICE_ROLE_KEY="$SUPABASE_SERVICE_ROLE_KEY" \
-            --from-literal=HETZNER_API_TOKEN="$HETZNER_API_TOKEN" \
-            --from-literal=CLOUDFLARE_API_TOKEN="$CLOUDFLARE_API_TOKEN" \
-            --from-literal=SMTP_PASSWORD="$SMTP_PASSWORD" \
             --from-literal=SITE_URL="$SITE_URL" \
+            "${ARGS[@]}" \
             --dry-run=client -o yaml \
           | kubectl apply --server-side --force-conflicts \
               --field-manager=github-actions-deploy -f -

package/carbon/.github/workflows/vibecarbon-build.yml

@@ -74,6 +74,20 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # Vite inlines import.meta.env.VITE_* at build time, so the browser
+          # bundle bakes whatever these resolve to. They come from repo-level
+          # Actions variables seeded by `vibecarbon deploy` (push mode) via
+          # seedBuildVars. Without them the bundle ships empty VITE_SUPABASE_*
+          # and the SPA throws "Missing Supabase environment variables" on
+          # load. Empty/unset vars resolve to "" — same as a fresh project
+          # before its first push-mode deploy.
+          build-args: |
+            VITE_PROJECT_NAME=${{ vars.VITE_PROJECT_NAME }}
+            VITE_SUPABASE_URL=${{ vars.VITE_SUPABASE_URL }}
+            VITE_SUPABASE_ANON_KEY=${{ vars.VITE_SUPABASE_ANON_KEY }}
+            VITE_PUBLIC_URL=${{ vars.VITE_PUBLIC_URL }}
+            VITE_PLAUSIBLE_DOMAIN=${{ vars.VITE_PLAUSIBLE_DOMAIN }}
+            VITE_PLAUSIBLE_SCRIPT_URL=${{ vars.VITE_PLAUSIBLE_SCRIPT_URL }}
           # GHA cache keyed on Dockerfile + lockfile. `mode=max` caches every
           # layer including intermediate ones, so re-builds with an unchanged
           # install step reuse the pnpm-store layer (biggest single layer).

package/carbon/Dockerfile

@@ -21,6 +21,9 @@ ARG VITE_ROUTING_MODE
 # Analytics (optional — empty by default, no tracking unless configured)
 ARG VITE_PLAUSIBLE_DOMAIN
 ARG VITE_PLAUSIBLE_SCRIPT_URL
+# Public canonical URL (apex domain) for og: tags + sitemap. Set at deploy from
+# the real domain; defaults to localhost for local builds.
+ARG VITE_PUBLIC_URL
 
 # Ensure pnpm is available (runtime base image already has it, standard node image doesn't)
 RUN command -v pnpm >/dev/null 2>&1 || npm install -g pnpm@9

package/carbon/cloud-init/k3s/master-init.sh

@@ -79,8 +79,32 @@ FIPEOF
 systemctl daemon-reload
 systemctl enable floating-ip.service
 
-# Get node IPs for k3s configuration
-PUBLIC_IP=$(curl -s --max-time 10 http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
+# Get node IPs for k3s configuration.
+# Fetch the public IPv4 robustly: k3s installs with --node-ip "$PUBLIC_IP" below,
+# and the Hetzner CCM matches the node against the API by this IP to clear the
+# node.cloudprovider.kubernetes.io/uninitialized taint. The metadata service can
+# be slow/empty on first boot — a single curl that returns "" silently installs
+# k3s with `--node-ip ""`, leaving the node InternalIP=<none> and breaking
+# control-plane<->kubelet comms (RCA 2026-06-23, ash/US: cert-manager-webhook
+# never became Ready because its node was unreachable). Retry the metadata
+# endpoint, fall back to the default-route source address, and FAIL the provision
+# rather than install a node with an empty node-ip.
+PUBLIC_IP=""
+for i in $(seq 1 30); do
+  PUBLIC_IP=$(curl -sf --max-time 5 http://169.254.169.254/hetzner/v1/metadata/public-ipv4 || true)
+  if echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then break; fi
+  PUBLIC_IP=""
+  sleep 2
+done
+if [ -z "$PUBLIC_IP" ]; then
+  echo "Metadata public-ipv4 unavailable after retries — deriving from default route"
+  PUBLIC_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[\d.]+' || true)
+fi
+if ! echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+  echo "FATAL: could not determine public IPv4 for --node-ip; refusing to install k3s with an empty node-ip"
+  exit 1
+fi
+echo "Public IP: $PUBLIC_IP"
 
 # Wait for the private network interface (10.0.x.x) to be assigned.
 # Hetzner attaches the private network after the server boots, so the interface

package/carbon/cloud-init/k3s/supabase-init.sh

@@ -50,8 +50,28 @@ mirrors:
       - "http://10.0.1.1:5000"
 REGEOF
 
-# Get node IPs for k3s configuration
-PUBLIC_IP=$(curl -s --max-time 10 http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
+# Get node IPs for k3s configuration.
+# Robust public-IPv4 fetch — see master-init.sh for the full RCA. A single curl
+# that returns "" installs k3s with `--node-ip ""`, leaving the node
+# InternalIP=<none> and unreachable from the control plane. Retry the metadata
+# endpoint, fall back to the default-route source address, and FAIL rather than
+# install an empty node-ip.
+PUBLIC_IP=""
+for i in $(seq 1 30); do
+  PUBLIC_IP=$(curl -sf --max-time 5 http://169.254.169.254/hetzner/v1/metadata/public-ipv4 || true)
+  if echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then break; fi
+  PUBLIC_IP=""
+  sleep 2
+done
+if [ -z "$PUBLIC_IP" ]; then
+  echo "Metadata public-ipv4 unavailable after retries — deriving from default route"
+  PUBLIC_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[\d.]+' || true)
+fi
+if ! echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+  echo "FATAL: could not determine public IPv4 for --node-ip; refusing to install k3s with an empty node-ip"
+  exit 1
+fi
+echo "Public IP: $PUBLIC_IP"
 
 # Wait for the private network interface (10.0.x.x) to be assigned.
 # Hetzner attaches the private network after the server boots, so the interface

package/carbon/cloud-init/k3s/worker-init.sh

@@ -49,8 +49,28 @@ mirrors:
       - "http://10.0.1.1:5000"
 REGEOF
 
-# Get node IPs for k3s configuration
-PUBLIC_IP=$(curl -s --max-time 10 http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
+# Get node IPs for k3s configuration.
+# Robust public-IPv4 fetch — see master-init.sh for the full RCA. A single curl
+# that returns "" installs k3s with `--node-ip ""`, leaving the node
+# InternalIP=<none> and unreachable from the control plane. Retry the metadata
+# endpoint, fall back to the default-route source address, and FAIL rather than
+# install an empty node-ip.
+PUBLIC_IP=""
+for i in $(seq 1 30); do
+  PUBLIC_IP=$(curl -sf --max-time 5 http://169.254.169.254/hetzner/v1/metadata/public-ipv4 || true)
+  if echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then break; fi
+  PUBLIC_IP=""
+  sleep 2
+done
+if [ -z "$PUBLIC_IP" ]; then
+  echo "Metadata public-ipv4 unavailable after retries — deriving from default route"
+  PUBLIC_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[\d.]+' || true)
+fi
+if ! echo "$PUBLIC_IP" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
+  echo "FATAL: could not determine public IPv4 for --node-ip; refusing to install k3s with an empty node-ip"
+  exit 1
+fi
+echo "Public IP: $PUBLIC_IP"
 
 # Wait for the private network interface (10.0.x.x) to be assigned.
 # Hetzner attaches the private network after the server boots, so the interface

package/carbon/content/docs/cli.mdx

@@ -599,7 +599,7 @@ npx vibecarbon activate vc-xxxxxxxx-signature...
 ```
 
 License keys start with `vc-` or `CARBON-`. Purchase a license at
-[vibecarbon.dev/pricing](https://vibecarbon.dev/pricing).
+[vibecarbon.com/#pricing](https://vibecarbon.com/#pricing).
 
 ---
 

package/carbon/docker-compose.yml

@@ -55,6 +55,12 @@ services:
         VITE_PLAUSIBLE_SCRIPT_URL: ${VITE_PLAUSIBLE_SCRIPT_URL:-}
     container_name: ${PROJECT_NAME}-app
     restart: unless-stopped
+    # Make every configure-managed runtime key (billing/OAuth/SMTP) available to
+    # the app container. `create` writes .env and the deploy bundle stages it
+    # alongside this file; the `environment:` overrides below still take
+    # precedence over anything in .env.
+    env_file:
+      - .env
     security_opt:
       - no-new-privileges:true
     cap_drop:

package/carbon/k8s/base/app/deployment.yaml

@@ -51,6 +51,11 @@ spec:
         envFrom:
         - configMapRef:
             name: vibecarbon-config
+        # All configure-managed runtime keys (billing/OAuth/SMTP) live in
+        # vibecarbon-secrets; envFrom makes them available to the app without a
+        # per-key list here. Explicit env entries below still win on conflict.
+        - secretRef:
+            name: vibecarbon-secrets
         env:
         - name: NODE_ENV
           value: production

package/carbon/k8s/values/supabase.values.yaml

@@ -140,6 +140,36 @@ deployment:
     # Uses the same wal-g-equipped db image. RESTORE_TARGET is an OPTIONAL
     # secretKeyRef so deploys without the key still schedule.
     extraInitContainers:
+      # ROBUSTNESS FIX (RCA 2026-06-23): the chart's init-pgsodium copies the
+      # /etc/postgresql-custom confs into the pgsodium PVC ONLY when it sees the
+      # volume as empty (`[ -z "$(ls -A /mnt/pgsodium)" ]`). A freshly-formatted
+      # Hetzner CSI ext4 volume contains a `lost+found` dir, so init-pgsodium
+      # treats it as "already initialized" and SKIPS the copy — postgres then
+      # FATALs on the missing wal-g.conf / read-replica.conf / supautils.conf
+      # `include` directives and CrashLoopBackOffs (intermittent, gated on the
+      # CSI mke2fs format race; failed k8s + k8s-ha in the 2026-06-22 matrix).
+      # This runs after init-pgsodium and idempotently restores the image's
+      # default confs whenever any required conf is absent — checking the confs
+      # themselves, not dir-emptiness. Same db image (its /etc/postgresql-custom
+      # holds the wal-g-equipped defaults); cp -a only overlays, never deletes.
+      - name: ensure-postgresql-custom
+        image: "{{DB_IMAGE}}:{{DB_IMAGE_TAG}}"
+        imagePullPolicy: IfNotPresent
+        command:
+          - /bin/sh
+          - -c
+          - |
+            for f in supautils.conf wal-g.conf read-replica.conf; do
+              if [ ! -f "/mnt/pgsodium/$f" ]; then
+                echo "postgresql-custom: $f missing (init-pgsodium skipped a non-empty volume, e.g. lost+found) — restoring image defaults"
+                cp -a /etc/postgresql-custom/. /mnt/pgsodium/
+                break
+              fi
+            done
+            echo "postgresql-custom verified: $(ls -A /mnt/pgsodium 2>/dev/null | tr '\n' ' ')"
+        volumeMounts:
+          - name: pgsodium
+            mountPath: /mnt/pgsodium
       - name: walg-restore
         image: "{{DB_IMAGE}}:{{DB_IMAGE_TAG}}"
         imagePullPolicy: IfNotPresent

package/carbon/package.json

@@ -53,13 +53,13 @@
     "@base-ui/react": "^1.5.0",
     "@fontsource-variable/noto-sans": "^5.2.10",
     "@fontsource/jetbrains-mono": "^5.2.8",
-    "@hono/node-server": "^2.0.4",
+    "@hono/node-server": "^2.0.6",
     "@hono/zod-openapi": "^1.4.0",
     "@hookform/resolvers": "^5.4.0",
     "@mdx-js/react": "^3.1.1",
     "@mdx-js/rollup": "^3.1.1",
-    "@scalar/api-reference-react": "^0.9.41",
-    "@supabase/supabase-js": "^2.106.2",
+    "@scalar/api-reference-react": "^0.9.49",
+    "@supabase/supabase-js": "^2.108.2",
     "@tanstack/react-query": "^5.100.14",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -67,12 +67,12 @@
     "date-fns": "^4.4.0",
     "embla-carousel-react": "^8.6.0",
     "framer-motion": "^12.40.0",
-    "hono": "^4.12.23",
-    "i18next": "^26.3.0",
+    "hono": "^4.12.27",
+    "i18next": "^26.3.3",
     "i18next-browser-languagedetector": "^8.2.1",
     "input-otp": "^1.4.2",
-    "ioredis": "^5.11.0",
-    "lenis": "^1.3.23",
+    "ioredis": "^5.11.1",
+    "lenis": "^1.3.25",
     "lucide-react": "^1.17.0",
     "next-themes": "^0.4.6",
     "nodemailer": "^8.0.10",
@@ -125,29 +125,29 @@
     "@biomejs/biome": "^2.4.16",
     "@hono/swagger-ui": "^0.6.1",
     "@scalar/hono-api-reference": "^0.10.19",
-    "@tailwindcss/typography": "^0.5.19",
-    "@tailwindcss/vite": "^4.3.0",
+    "@tailwindcss/typography": "^0.5.20",
+    "@tailwindcss/vite": "^4.3.2",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/node": "^25.9.1",
     "@types/nodemailer": "^8.0.0",
     "@types/pg": "^8.20.0",
-    "@types/react": "^19.2.16",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/coverage-v8": "^4.1.8",
-    "esbuild": "^0.28.0",
+    "@vitejs/plugin-react": "^6.0.3",
+    "@vitest/coverage-v8": "^4.1.9",
+    "esbuild": "^0.28.1",
     "jsdom": "^29.1.1",
     "pg": "^8.21.0",
     "pino-pretty": "^13.1.3",
     "remark-gfm": "^4.0.1",
     "shadcn": "^4.10.0",
-    "tailwindcss": "^4.3.0",
+    "tailwindcss": "^4.3.2",
     "tsx": "^4.22.4",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6.0.3",
     "vite": "^8.0.16",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   }
 }

package/carbon/scripts/generate-sitemap.ts

@@ -17,14 +17,17 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const PUBLIC_ROUTES = ['/', '/login', '/signup', '/blog', '/changelog', '/docs'];
 
 function loadSiteUrl(): string {
+  // Production builds receive the apex URL as VITE_PUBLIC_URL (a build arg);
+  // .env.local is not present in the image. Locally, fall back to .env.local.
+  if (process.env.VITE_PUBLIC_URL) return process.env.VITE_PUBLIC_URL.replace(/\/$/, '');
   try {
     const envContent = readFileSync(resolve(__dirname, '../.env.local'), 'utf-8');
-    const match = envContent.match(/^SITE_URL=["']?(.+?)["']?\s*$/m);
-    if (match) return match[1];
+    const match = envContent.match(/^(?:VITE_PUBLIC_URL|SITE_URL)=["']?(.+?)["']?\s*$/m);
+    if (match) return match[1].replace(/\/$/, '');
   } catch {
     // .env.local may not exist in CI
   }
-  return process.env.SITE_URL || 'http://localhost:5173';
+  return (process.env.SITE_URL || 'http://localhost:5173').replace(/\/$/, '');
 }
 
 function getBlogSlugs(): string[] {
@@ -95,6 +98,18 @@ const outDir = resolve(__dirname, '../dist/client');
 mkdirSync(outDir, { recursive: true });
 writeFileSync(resolve(outDir, 'sitemap.xml'), sitemap);
 
+// robots.txt is a static public/ file (Vite copies it verbatim, so its
+// `Sitemap:` line still carries the create-time {{SITE_URL}} → localhost).
+// Rewrite it to the real base URL now that we know it.
+try {
+  const robotsPath = resolve(outDir, 'robots.txt');
+  const robots = readFileSync(robotsPath, 'utf-8');
+  const fixed = robots.replace(/^Sitemap:.*$/m, `Sitemap: ${siteUrl}/sitemap.xml`);
+  if (fixed !== robots) writeFileSync(robotsPath, fixed);
+} catch {
+  // No robots.txt in dist — nothing to fix.
+}
+
 const blogCount = getBlogSlugs().length;
 const changelogCount = getChangelogSlugs().length;
 const docsCount = getDocsSlugs().length;

package/carbon/src/client/App.tsx

@@ -27,6 +27,7 @@ const Changelog = lazy(() => import('./pages/Changelog'));
 const Docs = lazy(() => import('./pages/Docs'));
 const Legal = lazy(() => import('./pages/Legal'));
 const Checkout = lazy(() => import('./pages/Checkout'));
+const Pricing = lazy(() => import('./pages/Pricing'));
 
 // Settings
 const Profile = lazy(() => import('./pages/settings/Profile'));
@@ -135,6 +136,7 @@ export default function App() {
         <Route path="/changelog" element={<Changelog />} />
         <Route path="/changelog/:slug" element={<Changelog />} />
         <Route path="/checkout" element={<Checkout />} />
+        <Route path="/pricing" element={<Pricing />} />
         <Route path="/docs" element={<Docs />} />
         <Route path="/docs/:slug" element={<Docs />} />
         <Route path="/contact" element={<Contact />} />

package/carbon/src/client/components/NewsletterSignup.tsx

@@ -111,14 +111,14 @@ export function NewsletterSignup({
   }
 
   return (
-    <div className={`flex flex-col gap-2 ${className || ''}`}>
-      <div className="flex items-center gap-2">
+    <div className={`flex w-full flex-col gap-2 sm:w-auto ${className || ''}`}>
+      <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
         <Input
           type="email"
           value={email}
           onChange={handleEmailChange}
           placeholder={t('landing.newsletter.placeholder')}
-          className="bg-background min-w-[280px] sm:min-w-[340px] h-9"
+          className="bg-background h-9 w-full min-w-0 sm:w-[300px]"
           aria-invalid={hasError}
           onKeyDown={(e) => {
             if (e.key === 'Enter') {
@@ -132,6 +132,7 @@ export function NewsletterSignup({
           disabled={subscribeMutation.isPending}
           size="default"
           sparkle
+          className="w-full sm:w-auto"
         >
           {subscribeMutation.isPending && <Loader2 className="size-3 mr-1 animate-spin" />}
           {resolvedButtonText}

package/carbon/src/client/components/PricingSection.tsx

@@ -1,3 +1,4 @@
+import { catalogTiers } from '@shared/pricing';
 import { motion } from 'framer-motion';
 import { Atom, Check, Diamond, Hexagon, type LucideIcon, X } from 'lucide-react';
 import { useEffect, useRef, useState } from 'react';
@@ -8,6 +9,19 @@ import vibecarbonIcon from '../assets/vibecarbon-icon.svg';
 import { FresnelEdge } from './effects/FresnelEdge';
 import { Button } from './ui/button';
 
+/**
+ * Map an activated catalog product to its bespoke design slot by name (the
+ * allotrope tiers are stable). Returns '' for an unrecognized product, which
+ * falls back to default styling.
+ */
+function designSlugFromName(name: string): string {
+  const n = name.toLowerCase();
+  if (n.includes('graphite')) return 'graphite';
+  if (n.includes('diamond')) return 'diamond';
+  if (n.includes('fullerene')) return 'fullerene';
+  return '';
+}
+
 interface Tier {
   id: string;
   name: string;
@@ -132,6 +146,35 @@ export function PricingSection() {
     },
   ];
 
+  // When the operator has activated products via `vibecarbon configure`, those
+  // drive WHICH cards show, their order (price-sorted), and their price —
+  // matched to each tier's bespoke design above. The hardcoded `tiers` are the
+  // fallback when no catalog is configured. Curated visuals, taglines, discounts
+  // and feature copy stay local (they aren't in the provider catalog).
+  const tiersById = new Map(tiers.map((tier) => [tier.id, tier]));
+  const displayTiers: Tier[] = catalogTiers.length
+    ? catalogTiers.map((ct, i) => {
+        const design = tiersById.get(designSlugFromName(ct.name));
+        const price = Math.round(ct.amount / 100);
+        const delay = 0.1 * (i + 1);
+        if (design) return { ...design, price, delay };
+        // Unrecognized product — default (graphite) styling, content from the catalog.
+        return {
+          ...tiers[0],
+          id: ct.priceId,
+          name: ct.name,
+          tagline: ct.description ?? tiers[0].tagline,
+          price,
+          originalPrice: null,
+          popular: false,
+          features: ct.features.length
+            ? ct.features.map((text) => ({ text, included: true }))
+            : tiers[0].features,
+          delay,
+        };
+      })
+    : tiers;
+
   return (
     <section id="pricing" className="py-24 md:py-36 overflow-hidden">
       <div className="mx-auto max-w-7xl px-6">
@@ -173,7 +216,7 @@ export function PricingSection() {
         <div className="relative">
           {/* Pricing Cards */}
           <div className="relative grid gap-8 md:grid-cols-3">
-            {tiers.map((tier) => (
+            {displayTiers.map((tier) => (
               <TierCard key={tier.id} tier={tier} />
             ))}
           </div>

package/carbon/src/client/components/SEO.tsx

@@ -4,6 +4,8 @@ const PROJECT_NAME = import.meta.env.VITE_PROJECT_NAME ?? '{{PROJECT_NAME}}';
 
 interface SEOProps {
   title?: string;
+  /** Exact document title, used verbatim without the `| PROJECT_NAME` suffix. */
+  fullTitle?: string;
   description?: string;
 }
 
@@ -13,11 +15,12 @@ interface SEOProps {
  * Usage:
  *   <SEO title="Pricing" description="See our plans" />
  *   <SEO title="Dashboard" />
+ *   <SEO fullTitle="Acme - The Best Widget" />
  */
-export function SEO({ title, description }: SEOProps) {
+export function SEO({ title, fullTitle, description }: SEOProps) {
   useEffect(() => {
-    document.title = title ? `${title} | ${PROJECT_NAME}` : PROJECT_NAME;
-  }, [title]);
+    document.title = fullTitle ?? (title ? `${title} | ${PROJECT_NAME}` : PROJECT_NAME);
+  }, [title, fullTitle]);
 
   useEffect(() => {
     if (!description) return;

package/carbon/src/client/index.css

@@ -15,11 +15,19 @@ html {
   font-size: 18px;
   scroll-padding-top: 5rem;
   scrollbar-gutter: stable;
+  /* Guard against horizontal overflow from full-bleed decorative glows/orbs.
+     `clip` (not `hidden`) avoids creating a scroll container, so sticky/fixed
+     positioning and 100vh keep working. Body uses `clip` too — `hidden` there
+     forces overflow-y to `auto`, adding a second vertical scrollbar. */
+  overflow-x: clip;
 }
 
 body {
   position: relative;
-  overflow-x: hidden;
+  /* `clip` (not `hidden`) hides horizontal overflow without forcing the
+   * computed overflow-y to `auto`, which would turn <body> into a second
+   * vertical scroll container on top of <html> (→ two scrollbars). */
+  overflow-x: clip;
 }
 
 @custom-variant dark (&:is(.dark *));

package/carbon/src/client/index.html

@@ -13,10 +13,10 @@
     <meta property="og:type" content="website" />
     <meta property="og:title" content="%VITE_PROJECT_NAME%" />
     <meta property="og:description" content="Build, launch, and scale your SaaS product with auth, billing, teams, email, blog, docs, i18n, and production infrastructure included." />
-    <meta property="og:url" content="{{SITE_URL}}" />
+    <meta property="og:url" content="%VITE_PUBLIC_URL%" />
     <meta property="og:site_name" content="%VITE_PROJECT_NAME%" />
     <!-- Replace with your own 1200x630 OG image for social sharing previews -->
-    <meta property="og:image" content="{{SITE_URL}}/og-image.png" />
+    <meta property="og:image" content="%VITE_PUBLIC_URL%/og-image.png" />
     <meta property="og:image:width" content="1200" />
     <meta property="og:image:height" content="630" />
 
@@ -24,7 +24,7 @@
     <meta name="twitter:card" content="summary_large_image" />
     <meta name="twitter:title" content="%VITE_PROJECT_NAME%" />
     <meta name="twitter:description" content="Build, launch, and scale your SaaS product with auth, billing, teams, email, blog, docs, i18n, and production infrastructure included." />
-    <meta name="twitter:image" content="{{SITE_URL}}/og-image.png" />
+    <meta name="twitter:image" content="%VITE_PUBLIC_URL%/og-image.png" />
 
     <!-- RSS -->
     <link rel="alternate" type="application/rss+xml" title="%VITE_PROJECT_NAME% Blog" href="/rss.xml" />

package/carbon/src/client/locales/en.json

@@ -524,7 +524,7 @@
     },
     "cta": {
       "badge": "Secure by design",
-      "headline": "Ship something you own.",
+      "headline": "Ship your next big thing!",
       "subheading": "Production-grade, automated everything."
     },
     "footer": {