vibecarbon 0.9.0 → 0.10.0

package/README.md

@@ -18,7 +18,7 @@ Vibecarbon is a full-stack SaaS starter that combines React 19, Vite, Tailwind v
 
 Skip the choice between vendor lock-in and DIY infrastructure. Create web applications with authentication, billing, teams, email, blog, docs, i18n, and production deployment — without a dedicated DevOps engineer.
 
-Includes Docker Compose, Kubernetes, High-Availability with replication and failover, auto-scaling, and automated backups.
+Includes Docker Compose, Kubernetes, High-Availability with replication and one-command failover, scaling, and automated backups.
 
 ---
 
@@ -39,9 +39,9 @@ npx vibecarbon deploy
 npx vibecarbon destroy
 ```
 
-> **Create for free, always. Pay to deploy.** `create`, `up`, `down`, and all local development are free forever. `deploy`, `destroy`, `backup`, `restore`, `failover`, and `scale` require a Diamond or Fullerene license — a one-time payment, no subscriptions, your servers.
+> **Create for free, always. Pay to deploy.** `create`, `up`, `down`, and all local development are free forever — and so is `destroy`, because teardown is never held hostage. `deploy`, `backup`, `restore`, `failover`, `scale`, and `upgrade` require a Diamond or Fullerene license — a one-time payment, no subscriptions, your servers.
 
-> Open source under AGPL v3. Generated project code is MIT — you own your app.
+> Fair Source (FSL-1.1-MIT) — every release becomes MIT open source after two years. Generated project code is MIT today — you own your app.
 
 ---
 
@@ -171,7 +171,7 @@ _End-to-end wall-clock from the last fully-green e2e matrix run against real Het
 
 ## License & Terms
 
-The CLI is open source under the [GNU Affero General Public License v3.0](./LICENSE). **Building from source is free for any use, forever.**
+The CLI is Fair Source under the [Functional Source License 1.1 with MIT future license](./LICENSE). **Building from source is free for any non-competing use — and every release automatically becomes MIT open source two years after publication.**
 
 Using the distributed `npx vibecarbon` package requires a license for deployment commands:
 

package/carbon/.env.example

@@ -34,6 +34,17 @@ VITE_PUBLIC_URL="http://localhost:5173"
 ADMIN_EMAIL="admin@example.com"
 ADMIN_PASSWORD="your-password-here"
 
+# =============================================================================
+# REVERSE PROXY (optional)
+# =============================================================================
+# Number of trusted reverse-proxy hops in front of the API server. The server
+# uses this to pick the real client IP out of X-Forwarded-For for rate limiting
+# and login lockout — only the entry this many positions from the RIGHT is
+# trusted; everything to its left is treated as attacker-controlled. The default
+# of 1 matches the standard single-Traefik deployment. Increase it only if you
+# add another trusted proxy in front (e.g. Cloudflare -> Traefik -> app = 2).
+TRUSTED_PROXY_HOPS="1"
+
 # =============================================================================
 # OAUTH PROVIDERS (optional)
 # =============================================================================

package/carbon/backup/compose-backup.sh

@@ -54,6 +54,14 @@ docker compose exec -T db bash -c '
     echo "scheduled backup skipped: no S3 credentials configured (empty AWS_ACCESS_KEY_ID/SECRET)."
     exit 0
   fi
+  # WRITE-GUARD (finding #3): a standby must never base-backup into the single
+  # canonical prefix. WALG_ROLE=standby is set on the standby db env. This closes
+  # the bring-up window the pg_is_in_recovery() check below cannot (an
+  # independent primary not yet in recovery).
+  if [ "${WALG_ROLE:-primary}" = "standby" ]; then
+    echo "WALG_ROLE=standby — skipping base backup (only the primary writes to the canonical prefix)."
+    exit 0
+  fi
   if [ "$(psql -U supabase_admin -d postgres -tAc "SELECT pg_is_in_recovery()")" != "f" ]; then
     echo "supabase-db is in recovery (standby) — skipping base backup."
     exit 0

package/carbon/docker-compose.yml

@@ -200,7 +200,18 @@ services:
       # `WARN The "S3_*" variable is not set` for every compose invocation.
       # WAL-G is dormant locally without these anyway; the warns were pure
       # noise.
+      #
+      # WALG_S3_PREFIX is a SINGLE canonical path (NO role segment). Reads
+      # (backup-fetch/restore/reseed) and writes (backup-push/wal-push) must all
+      # agree on ONE prefix — otherwise a standby restoring/reseeding would read
+      # an empty `…/walg/standby` and fail with "No backups found". Anti-collision
+      # (finding #3: a standby / bring-up-phase independent primary must never
+      # WRITE into this prefix) is enforced by the WALG_ROLE WRITE-GUARD:
+      # wal-archive.sh and the backup path both no-op when WALG_ROLE=standby.
+      # WALG_ROLE is exposed to the container so those write guards can read it;
+      # deployComposeHA writes WALG_ROLE=standby into the standby's .env.
       WALG_S3_PREFIX: s3://${S3_BACKUP_BUCKET:-${S3_BUCKET:-}}/backups/${PROJECT_NAME}/walg
+      WALG_ROLE: ${WALG_ROLE:-primary}
       AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-}
       AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY:-}
       AWS_ENDPOINT: ${S3_ENDPOINT:-}

package/carbon/ha/primary-init.sql

@@ -2,14 +2,22 @@
 -- Run on the primary database before initializing the standby.
 --
 -- This script is idempotent: safe to run multiple times.
+--
+-- SECURITY: `{{REPL_PASSWORD}}` below is a PLACEHOLDER, not a real password.
+-- This file MUST be rendered with a real per-deploy password before running;
+-- never run it raw. The vibecarbon deploy tooling renders it automatically
+-- (src/lib/deploy/k8s/ha/index.js substitutes '{{REPL_PASSWORD}}' with the
+-- random REPL_PASSWORD generated at create time). Running this file unrendered
+-- would either fail (invalid SQL) or, if hand-edited, risk a weak-cred
+-- `replicator` role — do not do it.
 
 -- Create dedicated replication role (if not exists), or update its password on re-runs.
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'replicator') THEN
-    CREATE ROLE replicator WITH REPLICATION LOGIN PASSWORD 'repl_password';
+    CREATE ROLE replicator WITH REPLICATION LOGIN PASSWORD '{{REPL_PASSWORD}}';
   ELSE
-    ALTER ROLE replicator WITH PASSWORD 'repl_password';
+    ALTER ROLE replicator WITH PASSWORD '{{REPL_PASSWORD}}';
   END IF;
 END $$;
 

package/carbon/k8s/base/backup/cronjob.yaml

@@ -74,6 +74,15 @@ spec:
                     # (wal-push/archiving and backup-fetch/restore do not connect to
                     # PG, which is why this only bit backup-push. RCA 2026-05-30.)
                     export PGUSER=supabase_admin PGHOST=localhost PGPORT=5432 PGDATABASE=postgres
+                    # WRITE-GUARD (finding #3): never base-backup on a standby into
+                    # the single canonical WALG_S3_PREFIX. WALG_ROLE is rendered
+                    # into the db container env (supabase.values.yaml) and inherited
+                    # by this kubectl-exec. Closes the bring-up window the recovery
+                    # check below cannot (independent primary, not yet in recovery).
+                    if [ "${WALG_ROLE:-primary}" = "standby" ]; then
+                      echo "WALG_ROLE=standby — skipping base backup (only the primary writes the canonical prefix)."
+                      exit 0
+                    fi
                     if [ "$(psql -U supabase_admin -d postgres -tAc "SELECT pg_is_in_recovery()")" != "f" ]; then
                       echo "supabase-db is in recovery (standby) — skipping base backup."
                       exit 0

package/carbon/k8s/base/repl-gateway/kustomization.yaml

@@ -0,0 +1,11 @@
+# repl-gateway — HA-only cross-cluster replication transport (WireGuard + socat).
+#
+# NOTE: this kustomization is intentionally NOT referenced by the parent
+# carbon/k8s/base/kustomization.yaml. The gateway is applied only on HA k8s
+# deploys (by setupReplication), with per-cluster placeholders rendered at apply
+# time. Keeping it as a standalone base lets `kustomize build` validate the
+# manifest in isolation.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - repl-gateway.yaml

package/carbon/k8s/base/repl-gateway/repl-gateway.yaml

@@ -0,0 +1,92 @@
+# =============================================================================
+# VIBECARBON REPLICATION GATEWAY (HA k8s only)
+# =============================================================================
+# Cross-cluster PostgreSQL streaming replication runs over a point-to-point
+# WireGuard tunnel between the two clusters' supabase nodes (wg0, UDP 51821).
+# This gateway is a hostNetwork socat relay pinned to the supabase node; it
+# bridges the intra-cluster db pod to the tunnel.
+#
+#   standby db pod ──tcp <node-priv-ip>:15433──► standby repl-gateway (this pod)
+#        └─ socat into wg0 → 10.99.0.1:15433 ──► primary repl-gateway (this pod)
+#                                                    └─ socat → 127.0.0.1:5433 (primary postgres hostPort)
+#
+# The WireGuard device (wg0) is owned by the HOST kernel (brought up over SSH by
+# setupReplication / exchangeAndBringUpTunnel). Because this pod is
+# `hostNetwork: true`, its socat shares the host netns and reaches wg0 + the
+# node's private IP directly — so the pod itself needs NO extra capabilities.
+#
+# This manifest is NOT part of the base kustomization: it is HA-only and needs
+# per-cluster values (relay direction + node private IP). setupReplication
+# renders the placeholders below and applies it to each cluster via stdin.
+#
+# Placeholders (patched at apply time by setupReplication — NEVER at runtime):
+#   __RELAY_LISTEN__       socat listen address spec  (differs per primary/standby)
+#   __RELAY_TARGET__       socat downstream target    (differs per primary/standby)
+#   __SUPABASE_PRIVATE_IP__  this cluster's supabase node private IP (egress netpol)
+# =============================================================================
+apiVersion: v1
+kind: Pod
+metadata:
+  name: repl-gateway
+  namespace: vibecarbon
+  labels:
+    app: repl-gateway
+spec:
+  # Share the host netns so socat can bind the node's private IP / the wg0
+  # tunnel IP and reach the host WireGuard device.
+  hostNetwork: true
+  dnsPolicy: ClusterFirstWithHostNet
+  # The supabase node carries a dedicated taint; without this toleration the
+  # pod stays Pending ("untolerated taint {dedicated: supabase}").
+  tolerations:
+    - key: dedicated
+      operator: Equal
+      value: supabase
+      effect: NoSchedule
+  nodeSelector:
+    dedicated: supabase
+  restartPolicy: Always
+  containers:
+    - name: relay
+      # Floating tag (no digest pin — users always get the latest socat). The
+      # image ENTRYPOINT is `socat`; args are its two address specs.
+      image: alpine/socat
+      imagePullPolicy: IfNotPresent
+      args:
+        - "__RELAY_LISTEN__"
+        - "__RELAY_TARGET__"
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          cpu: 250m
+          memory: 64Mi
+---
+# The ONE additive egress NetworkPolicy that admits the db pod → local gateway
+# hop. The gateway presents as the node's private IP (inside the 10.0.0.0/8
+# range excluded by supabase-db-s3-egress) on tcp 15433, so the hop is blocked
+# by default. This policy is additive to default-deny-all and scoped to exactly
+# one destination IP + one port. NetworkPolicy is connection-stateful, so
+# allowing the egress SYN clears the return path too — no ingress rule needed
+# (and none applies to the hostNetwork gateway). Shipped on BOTH clusters (each
+# targeting its own node) for failover symmetry.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-db-repl-gateway-egress
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: supabase
+      app.kubernetes.io/name: supabase-db
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: __SUPABASE_PRIVATE_IP__/32
+      ports:
+        - protocol: TCP
+          port: 15433

package/carbon/k8s/values/supabase.values.yaml

@@ -270,9 +270,14 @@ environment:
   # SECRET keys (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) are injected
   # separately via a StatefulSet env patch in applyK3sManifests.
   # {{WALG_S3_PREFIX}} resolves to s3://<backup-bucket|storage-bucket>/
-  # backups/<project>/walg (fallback handled in installSupabase).
+  # backups/<project>/walg (a SINGLE canonical prefix; fallback handled in
+  # installSupabase). {{WALG_ROLE}} is 'primary' or 'standby' — it is NOT part
+  # of the prefix; it's the WRITE-GUARD signal that wal-archive.sh + the backup
+  # CronJob read to no-op on the standby (so a standby never writes into the
+  # canonical prefix), while restore/reseed still READ the one canonical prefix.
   db:
     WALG_S3_PREFIX: "{{WALG_S3_PREFIX}}"
+    WALG_ROLE: "{{WALG_ROLE}}"
     WALG_COMPRESSION_METHOD: lz4
     WALG_UPLOAD_CONCURRENCY: "2"
     AWS_ENDPOINT: "{{S3_ENDPOINT}}"

package/carbon/src/client/lib/supabase.ts

@@ -5,9 +5,50 @@ const supabaseUrl = import.meta.env.VITE_SUPABASE_URL;
 const supabaseAnonKey = import.meta.env.VITE_SUPABASE_ANON_KEY;
 
 if (!supabaseUrl || !supabaseAnonKey) {
+  const missing = [
+    !supabaseUrl ? 'VITE_SUPABASE_URL' : null,
+    !supabaseAnonKey ? 'VITE_SUPABASE_ANON_KEY' : null,
+  ].filter((name): name is string => name !== null);
+  renderConfigError(missing);
   throw new Error('Missing Supabase environment variables');
 }
 
+// This module is evaluated before React mounts, so a bare throw leaves #root
+// empty — a black page with the only clue in the console. Paint a readable
+// error with plain DOM APIs first, then let the throw halt the app.
+function renderConfigError(missing: string[]): void {
+  if (typeof document === 'undefined') return;
+
+  const screen = document.createElement('div');
+  screen.style.cssText =
+    'position:fixed;inset:0;display:flex;align-items:center;justify-content:center;' +
+    'background:#0a0f14;color:#e6edf3;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;' +
+    'padding:2rem;z-index:2147483647;text-align:left';
+
+  const box = document.createElement('div');
+  box.style.cssText = 'max-width:40rem';
+
+  const heading = document.createElement('h1');
+  heading.textContent = 'Configuration error';
+  heading.style.cssText = 'font-size:1.25rem;margin:0 0 0.75rem;color:#f47067';
+
+  const detail = document.createElement('p');
+  detail.textContent =
+    `This build is missing required environment variables: ${missing.join(', ')}. ` +
+    'The frontend cannot start without them.';
+  detail.style.cssText = 'margin:0 0 0.75rem;line-height:1.5';
+
+  const hint = document.createElement('p');
+  hint.textContent =
+    'Rebuild with the variables set — deploys inject them automatically; ' +
+    'for local development, check your .env file.';
+  hint.style.cssText = 'margin:0;line-height:1.5;opacity:0.7';
+
+  box.append(heading, detail, hint);
+  screen.append(box);
+  document.body.append(screen);
+}
+
 /**
  * Cookie-based storage adapter for Supabase auth.
  * Stores auth tokens in cookies so they're sent with requests to /admin/* routes,

package/carbon/src/client/locales/de.json

@@ -293,7 +293,7 @@
       },
       "deploy": {
         "label": "Deployen",
-        "description": "In Produktion pushen mit Auto-Scaling, Hochverfügbarkeit, Monitoring, CI/CD und mehr."
+        "description": "In Produktion pushen mit Skalierung, Hochverfügbarkeit, Monitoring, CI/CD und mehr."
       }
     },
     "techStack": {
@@ -352,7 +352,7 @@
       "traffic": {
         "risk": "Traffic überlastet",
         "protection": "Auto-Scaling",
-        "how": "Kubernetes-Autoscaling über Pods und VPS-Knoten"
+        "how": "Kubernetes-Pod-Autoscaling plus Worker-Skalierung per Befehl"
       },
       "redundancy": {
         "risk": "Keine Redundanz",
@@ -401,25 +401,40 @@
       "compose": {
         "name": "Docker Compose",
         "tagline": "Ein VPS, dein kompletter Stack inklusive.",
-        "features": ["1 Server", "Einzelne Region"],
+        "features": [
+          "1 Server",
+          "Einzelne Region"
+        ],
         "bestFor": "MVPs & interne Tools"
       },
       "composeHa": {
         "name": "Compose HA",
-        "tagline": "Zwei Server, automatisches Failover.",
-        "features": ["2 Server", "Streaming-Replikation", "Auto-Failover"],
+        "tagline": "Zwei Regionen, Failover per Befehl.",
+        "features": [
+          "2 Server",
+          "Streaming-Replikation",
+          "Failover per Befehl"
+        ],
         "bestFor": "Produktions-SaaS ohne Kubernetes"
       },
       "k8s": {
         "name": "Kubernetes",
-        "tagline": "Automatisch skalierender k3s-Cluster.",
-        "features": ["Einzelne Region", "Horizontale Autoskalierung", "Rollierende Updates"],
+        "tagline": "Produktionsreifer k3s-Cluster.",
+        "features": [
+          "Einzelne Region",
+          "Horizontale Autoskalierung",
+          "Rollierende Updates"
+        ],
         "bestFor": "Anwendungen mit hohem Traffic"
       },
       "k8sHa": {
         "name": "Kubernetes HA",
         "tagline": "Multi-Region-Cluster, maximale Verfügbarkeit.",
-        "features": ["2 Regionen", "Regions-Failover", "Autoskalierung"],
+        "features": [
+          "2 Regionen",
+          "Regions-Failover",
+          "Pod-Autoscaling"
+        ],
         "bestFor": "Geschäftskritisch & global"
       }
     },
@@ -459,7 +474,7 @@
           "backups": "Automatische S3-Backups",
           "cicd": "CI/CD via GitHub Actions",
           "unlimited": "Unbegrenzte Server & Projekte",
-          "commercial": "Kommerzielle Nutzungsrechte"
+          "commercial": "FSL-Ausnahme (Einbetten, White-Label, Weiterverkauf)"
         }
       },
       "fullerene": {
@@ -467,7 +482,7 @@
         "cta": "Fullerene kaufen",
         "features": {
           "diamond": "Alles in Diamond",
-          "commercial": "Kommerzielle Nutzungsrechte (AGPL-Ausnahme)",
+          "commercial": "FSL-Ausnahme: Vibecarbon einbetten, als White-Label anbieten oder Vibecarbon-basierte Services weiterverkaufen",
           "clients": "Bereitstellung für Kunden & Organisationen",
           "corporate": "Agenturen & Enterprise-Teams",
           "support": "Prioritäts-E-Mail-Support",
@@ -496,7 +511,7 @@
       },
       "q5": {
         "question": "Wie funktioniert die Preisgestaltung?",
-        "answer": "Graphite ist dauerhaft kostenlos — Projekte erstellen, lokal entwickeln, alle Add-ons nutzen. Diamond (149 $ einmalig) bietet volle Automatisierung für Indie-Entwickler und Startups — alle Deployment-Modi, Backups, CI/CD und Skalierung. Fullerene (499 $ einmalig) ist die kommerzielle Lizenz für Agenturen und Unternehmen — für Kunden deployen, ohne AGPL-Auflagen. Einmalige Zahlung, kein Abo."
+        "answer": "Graphite ist dauerhaft kostenlos — Projekte erstellen, lokal entwickeln, alle Add-ons nutzen. Diamond (149 $ einmalig) bietet volle Automatisierung für Indie-Entwickler und Startups — alle Deployment-Modi, Backups, CI/CD und Skalierung. Fullerene (499 $ einmalig) richtet sich an Agenturen und Unternehmen — für Kunden deployen, plus die FSL-Ausnahme, um Vibecarbon einzubetten, als White-Label anzubieten oder Vibecarbon-basierte Services weiterzuverkaufen. Einmalige Zahlung, kein Abo."
       },
       "q6": {
         "question": "Wie viele Projekte kann ich mit einer Lizenz erstellen?",
@@ -508,7 +523,7 @@
       },
       "q8": {
         "question": "Was passiert, wenn Vibecarbon eingestellt wird?",
-        "answer": "Für deine App ändert sich nichts. Der generierte Code steht unter MIT-Lizenz ohne jegliche Laufzeitabhängigkeit von Vibecarbon — es ist einfach eine Codebasis, die dir vollständig gehört. Die CLI ist Open Source unter AGPL, du kannst sie also dauerhaft aus dem Quellcode ausführen. Deine Infrastruktur läuft auf deinen eigenen Servern."
+        "answer": "Für deine App ändert sich nichts. Der generierte Code steht unter MIT-Lizenz ohne jegliche Laufzeitabhängigkeit von Vibecarbon — es ist einfach eine Codebasis, die dir vollständig gehört. Die CLI ist Fair Source (FSL) — du kannst sie für jede nicht konkurrierende Nutzung dauerhaft aus dem Quellcode ausführen, und jedes Release wird zwei Jahre nach Veröffentlichung MIT-Open-Source. Deine Infrastruktur läuft auf deinen eigenen Servern."
       },
       "q9": {
         "question": "Brauche ich DevOps-Erfahrung, um bereitzustellen?",

package/carbon/src/client/locales/en.json

@@ -217,11 +217,11 @@
   "charts": {
     "title": "Charts",
     "revenue": "Revenue",
-    "revenueDescription": "Monthly revenue, Jan\u2013Jun",
+    "revenueDescription": "Monthly revenue, Jan–Jun",
     "revenueSparkline": "$29.8k",
     "newUsers": "New Users",
     "activeUsers": "Active Users",
-    "activeUsersDescription": "Weekly signups \u2014 new vs. returning",
+    "activeUsersDescription": "Weekly signups — new vs. returning",
     "mrr": "MRR",
     "mrrGrowth": "MRR Growth",
     "mrrGrowthDescription": "Cumulative monthly recurring revenue",
@@ -293,7 +293,7 @@
       },
       "deploy": {
         "label": "Deploy",
-        "description": "Deploy on Hetzner with Docker Compose or Kubernetes. Complete with backups, auto-scaling, high-availability, and more advanced features with simple commands."
+        "description": "Deploy on Hetzner with Docker Compose or Kubernetes. Complete with backups, scaling, high-availability, and more advanced features with simple commands."
       }
     },
     "techStack": {
@@ -352,7 +352,7 @@
       "traffic": {
         "risk": "Can't handle traffic",
         "protection": "Auto-scaling",
-        "how": "Kubernetes autoscaling across pods and VPS nodes"
+        "how": "Kubernetes pod autoscaling plus one-command worker scaling"
       },
       "redundancy": {
         "risk": "Zero redundancy",
@@ -401,25 +401,40 @@
       "compose": {
         "name": "Docker Compose",
         "tagline": "One VPS, your full stack included.",
-        "features": ["1 server", "Single region"],
+        "features": [
+          "1 server",
+          "Single region"
+        ],
         "bestFor": "MVPs & internal tools"
       },
       "composeHa": {
         "name": "Compose HA",
-        "tagline": "Two servers, automatic failover.",
-        "features": ["2 servers", "Streaming replication", "Auto-failover"],
+        "tagline": "Two regions, one-command failover.",
+        "features": [
+          "2 servers",
+          "Streaming replication",
+          "One-command failover"
+        ],
         "bestFor": "Production SaaS without Kubernetes"
       },
       "k8s": {
         "name": "Kubernetes",
-        "tagline": "Auto-scaling k3s cluster.",
-        "features": ["Single region", "Horizontal autoscaling", "Rolling updates"],
+        "tagline": "Production k3s cluster.",
+        "features": [
+          "Single region",
+          "Horizontal autoscaling",
+          "Rolling updates"
+        ],
         "bestFor": "High-traffic apps"
       },
       "k8sHa": {
         "name": "Kubernetes HA",
         "tagline": "Multi-region clusters, maximum uptime.",
-        "features": ["2 regions", "Region failover", "Autoscaling"],
+        "features": [
+          "2 regions",
+          "Region failover",
+          "Pod autoscaling"
+        ],
         "bestFor": "Mission-critical & global"
       }
     },
@@ -459,7 +474,7 @@
           "backups": "Automated S3 backups",
           "cicd": "CI/CD via GitHub Actions",
           "unlimited": "Unlimited servers & projects",
-          "commercial": "Commercial use rights"
+          "commercial": "FSL exception (embed, white-label, resell)"
         }
       },
       "fullerene": {
@@ -467,7 +482,7 @@
         "cta": "Get Fullerene",
         "features": {
           "diamond": "Everything in Diamond",
-          "commercial": "Commercial use rights (AGPL exception)",
+          "commercial": "FSL exception: embed, white-label, or resell Vibecarbon-powered services",
           "clients": "Deploy for clients & organizations",
           "corporate": "Agency & enterprise teams",
           "support": "Priority email support",
@@ -496,7 +511,7 @@
       },
       "q5": {
         "question": "How does pricing work?",
-        "answer": "Graphite is free forever — create projects, develop locally, and use every add-on. Diamond ($149 lifetime) is full automation for indie hackers and startups — all deployment modes, backups, CI/CD, and scaling. Fullerene ($499 lifetime) is the commercial license for agencies and enterprise — deploy for clients and organizations without AGPL restrictions. One-time payment, no subscriptions, your infrastructure."
+        "answer": "Graphite is free forever — create projects, develop locally, and use every add-on. Diamond ($149 lifetime) is full automation for indie hackers and startups — all deployment modes, backups, CI/CD, and scaling. Fullerene ($499 lifetime) is for agencies and enterprise — deploy for clients, plus the FSL exception to embed, white-label, or resell Vibecarbon-powered services. One-time payment, no subscriptions, your infrastructure."
       },
       "q6": {
         "question": "How many projects can I create with one license?",
@@ -508,7 +523,7 @@
       },
       "q8": {
         "question": "What happens if Vibecarbon shuts down?",
-        "answer": "Nothing changes for your app. The generated code is MIT-licensed with zero runtime dependency on Vibecarbon — it's just a codebase you own outright. The CLI is open source under AGPL, so you can run it from source indefinitely. Your infrastructure runs on your own servers."
+        "answer": "Nothing changes for your app. The generated code is MIT-licensed with zero runtime dependency on Vibecarbon — it's just a codebase you own outright. The CLI is Fair Source (FSL) — you can run it from source indefinitely for any non-competing use, and every release becomes MIT open source two years after publication. Your infrastructure runs on your own servers."
       },
       "q9": {
         "question": "Do I need DevOps experience to deploy?",
@@ -537,4 +552,4 @@
       "terms": "Terms"
     }
   }
-}
+}

package/carbon/src/client/locales/es.json

@@ -293,7 +293,7 @@
       },
       "deploy": {
         "label": "Desplegar",
-        "description": "Despliega a producción con auto-escalado, alta disponibilidad, monitoreo, CI/CD y más."
+        "description": "Despliega a producción con escalado, alta disponibilidad, monitoreo, CI/CD y más."
       }
     },
     "techStack": {
@@ -352,7 +352,7 @@
       "traffic": {
         "risk": "No soporta el tráfico",
         "protection": "Auto-escalado",
-        "how": "Kubernetes autoscaling en pods y nodos VPS"
+        "how": "Autoescalado de pods de Kubernetes más escalado de workers con un comando"
       },
       "redundancy": {
         "risk": "Sin redundancia",
@@ -401,25 +401,40 @@
       "compose": {
         "name": "Docker Compose",
         "tagline": "Un VPS, con todo tu stack incluido.",
-        "features": ["1 servidor", "Región única"],
+        "features": [
+          "1 servidor",
+          "Región única"
+        ],
         "bestFor": "MVPs y herramientas internas"
       },
       "composeHa": {
         "name": "Compose HA",
-        "tagline": "Dos servidores, conmutación automática.",
-        "features": ["2 servidores", "Replicación en streaming", "Conmutación automática"],
+        "tagline": "Dos regiones, conmutación con un comando.",
+        "features": [
+          "2 servidores",
+          "Replicación en streaming",
+          "Conmutación con un comando"
+        ],
         "bestFor": "SaaS en producción sin Kubernetes"
       },
       "k8s": {
         "name": "Kubernetes",
-        "tagline": "Clúster k3s con autoescalado.",
-        "features": ["Región única", "Autoescalado horizontal", "Actualizaciones progresivas"],
+        "tagline": "Clúster k3s listo para producción.",
+        "features": [
+          "Región única",
+          "Autoescalado horizontal",
+          "Actualizaciones progresivas"
+        ],
         "bestFor": "Apps de alto tráfico"
       },
       "k8sHa": {
         "name": "Kubernetes HA",
         "tagline": "Clústeres multirregión, máxima disponibilidad.",
-        "features": ["2 regiones", "Conmutación de región", "Autoescalado"],
+        "features": [
+          "2 regiones",
+          "Conmutación de región",
+          "Autoescalado de pods"
+        ],
         "bestFor": "Críticos y globales"
       }
     },
@@ -459,7 +474,7 @@
           "backups": "Copias de seguridad automáticas en S3",
           "cicd": "CI/CD mediante GitHub Actions",
           "unlimited": "Servidores y proyectos ilimitados",
-          "commercial": "Derechos de uso comercial"
+          "commercial": "Excepción FSL (integración, marca blanca, reventa)"
         }
       },
       "fullerene": {
@@ -467,7 +482,7 @@
         "cta": "Ir a Fullerene",
         "features": {
           "diamond": "Todo lo de Diamond",
-          "commercial": "Derechos de uso comercial (excepción AGPL)",
+          "commercial": "Excepción FSL: integra, ofrece marca blanca o revende servicios impulsados por Vibecarbon",
           "clients": "Despliega para clientes y organizaciones",
           "corporate": "Equipos de agencias y empresas",
           "support": "Soporte prioritario por correo",
@@ -496,7 +511,7 @@
       },
       "q5": {
         "question": "¿Cómo funciona el precio?",
-        "answer": "Graphite es gratuito para siempre — crea proyectos, desarrolla localmente y usa todos los complementos. Diamond ($149 de por vida) es automatización completa para indie hackers y startups — todos los modos de despliegue, backups, CI/CD y escalado. Fullerene ($499 de por vida) es la licencia comercial para agencias y empresas — despliega para clientes y organizaciones sin restricciones AGPL. Pago único, sin suscripciones."
+        "answer": "Graphite es gratuito para siempre — crea proyectos, desarrolla localmente y usa todos los complementos. Diamond ($149 de por vida) es automatización completa para indie hackers y startups — todos los modos de despliegue, backups, CI/CD y escalado. Fullerene ($499 de por vida) es para agencias y empresas — despliega para clientes, más la excepción FSL para integrar, ofrecer marca blanca o revender servicios impulsados por Vibecarbon. Pago único, sin suscripciones."
       },
       "q6": {
         "question": "¿Cuántos proyectos puedo crear con una licencia?",
@@ -508,7 +523,7 @@
       },
       "q8": {
         "question": "¿Qué pasa si Vibecarbon cierra?",
-        "answer": "No cambia nada para tu aplicación. El código generado está bajo licencia MIT y sin ninguna dependencia en tiempo de ejecución de Vibecarbon: es simplemente una base de código que te pertenece por completo. La CLI es código abierto bajo AGPL, así que puedes ejecutarla desde el código fuente indefinidamente. Tu infraestructura corre en tus propios servidores."
+        "answer": "No cambia nada para tu aplicación. El código generado está bajo licencia MIT y sin ninguna dependencia en tiempo de ejecución de Vibecarbon: es simplemente una base de código que te pertenece por completo. La CLI es Fair Source (FSL): puedes ejecutarla desde el código fuente indefinidamente para cualquier uso no competidor, y cada versión se convierte en código abierto MIT dos años después de su publicación. Tu infraestructura corre en tus propios servidores."
       },
       "q9": {
         "question": "¿Necesito experiencia en DevOps para desplegar?",