openship 0.4.8 → 0.6.0

package/dist/{chunk-6APULWSU.js → chunk-OTLSJYAC.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   __export
-} from "./chunk-KI2EY3WB.js";
+} from "./chunk-PXKCZB2I.js";
 
 // ../../packages/core/src/stacks.ts
 var LANGUAGES = {
@@ -52,8 +52,15 @@ var LANGUAGES = {
   },
   php: {
     name: "PHP",
-    buildImage: "php:8.3-cli",
-    runtimeImage: "php:8.3-fpm",
+    buildImage: "php:8.4-cli",
+    // FrankenPHP, not php:*-fpm. An fpm image is a FastCGI backend, not a
+    // process host: it ships no web server, and pairing it with an apt nginx
+    // means two processes under a shell that swallows SIGTERM — a container stop
+    // then kills in-flight work instead of draining it. FrankenPHP is ONE
+    // process that owns both the HTTP server and PHP, so signals land where they
+    // should with no supervision tree, it runs fine as a non-root user, and its
+    // docroot convention (`/app/public`) is already the layout our recipes emit.
+    runtimeImage: "dunglas/frankenphp:1-php8.4-bookworm",
     packageManagers: ["composer"],
     requiredTools: ["php", "composer"]
   },
@@ -146,6 +153,34 @@ var STACKS = {
       deps: ["@remix-run/react", "@remix-run/node", "remix"]
     }
   },
+  "tanstack-start": {
+    name: "TanStack Start",
+    language: "typescript",
+    category: "fullstack",
+    outputDirectory: ".output",
+    defaultPort: 3e3,
+    defaultBuildCommand: "vite build",
+    defaultStartCommand: "node .output/server/index.mjs",
+    // Nitro/Vinxi server bundle is self-contained under .output — same shape as Nuxt.
+    productionPaths: [".output"],
+    detection: {
+      // TanStack Start is Vite/Rsbuild-based; app.config.* is the older
+      // framework-specific marker, while current apps commonly ship vite.config.*
+      // or rsbuild.config.* plus the start package dep.
+      rootMarkers: [
+        "app.config.ts",
+        "app.config.js",
+        "app.config.mjs",
+        "vite.config.ts",
+        "vite.config.js",
+        "vite.config.mjs",
+        "rsbuild.config.ts",
+        "rsbuild.config.js",
+        "rsbuild.config.mjs"
+      ],
+      deps: ["@tanstack/react-start", "@tanstack/start"]
+    }
+  },
   astro: {
     name: "Astro",
     language: "typescript",
@@ -515,18 +550,28 @@ var STACKS = {
     }
   },
   // ── PHP ────────────────────────────────────────────────────────────────────
-  // PHP stacks run php-fpm behind nginx (docroot public/). The generated
-  // Dockerfile (docker-build-plan.ts PHP branch) installs nginx + writes the
-  // config template; this start command renders it for the injected $PORT and
-  // launches both processes. Runtime image inherits php:8.3-fpm from the language.
+  // PHP stacks serve `public/` from FrankenPHP (see LANGUAGES.php). `exec` hands
+  // the container's PID to frankenphp so SIGTERM drains in-flight requests
+  // instead of being swallowed by the shell; SERVER_NAME carries the injected
+  // $PORT (a bare `:port` also keeps Caddy's automatic HTTPS out of the way —
+  // TLS terminates at the edge). No build command: `composer install` is the
+  // INSTALL step, and the build step is where a JS asset pipeline goes (the
+  // detector fills it in when the repo has one).
   laravel: {
     name: "Laravel",
     language: "php",
     category: "fullstack",
     outputDirectory: "public",
     defaultPort: 8e3,
-    defaultBuildCommand: "composer install --no-dev --optimize-autoloader",
-    defaultStartCommand: "envsubst '$PORT' < /etc/nginx/app.conf.template > /etc/nginx/conf.d/default.conf && php-fpm -D && nginx -g 'daemon off;'",
+    defaultBuildCommand: "",
+    defaultStartCommand: 'SERVER_NAME=":$PORT" exec frankenphp run --config /etc/frankenphp/Caddyfile --adapter caddyfile',
+    // Everything a stock Laravel app writes lives here: uploads
+    // (storage/app), sessions + cache when the drivers are `file`, and the
+    // framework's own scratch space. `database/` is deliberately NOT persisted —
+    // it holds migrations, so mounting over it would hide the ones a later
+    // release adds. A SQLite app should point DB_DATABASE at a persisted path or
+    // (better) use a database service.
+    persistentPaths: ["storage"],
     detection: {
       rootMarkers: ["artisan", "composer.json"],
       deps: ["laravel/framework"]
@@ -538,8 +583,10 @@ var STACKS = {
     category: "fullstack",
     outputDirectory: "public",
     defaultPort: 8e3,
-    defaultBuildCommand: "composer install --no-dev --optimize-autoloader",
-    defaultStartCommand: "envsubst '$PORT' < /etc/nginx/app.conf.template > /etc/nginx/conf.d/default.conf && php-fpm -D && nginx -g 'daemon off;'",
+    defaultBuildCommand: "",
+    defaultStartCommand: 'SERVER_NAME=":$PORT" exec frankenphp run --config /etc/frankenphp/Caddyfile --adapter caddyfile',
+    // No persistentPaths: Symfony's `var/` is cache + logs, both regenerated,
+    // and it has no convention for where user uploads land.
     detection: {
       rootMarkers: ["composer.json", "symfony.lock"],
       deps: ["symfony/framework-bundle"]
@@ -778,6 +825,9 @@ var STACK_ROOT_MARKERS = new Set(
   Object.values(STACKS).flatMap((stack) => stack.detection?.rootMarkers ?? []).map((marker) => marker.toLowerCase())
 );
 function packageManagerEnsureCommand(packageManager) {
+  if (packageManager === "bun") {
+    return `(command -v bun >/dev/null 2>&1 || npm i -g bun) >/dev/null 2>&1 || true`;
+  }
   if (packageManager !== "pnpm" && packageManager !== "yarn") return "";
   return `(corepack enable ${packageManager} || corepack enable || npm i -g ${packageManager}) >/dev/null 2>&1 || true`;
 }
@@ -788,6 +838,7 @@ var STACK_ICONS = {
   nuxt: `${DI}/nuxtjs/nuxtjs-original.svg`,
   sveltekit: `${DI}/svelte/svelte-original.svg`,
   remix: `${DI}/react/react-original.svg`,
+  "tanstack-start": `${DI}/react/react-original.svg`,
   astro: `${DI}/astro/astro-original.svg`,
   vite: `${DI}/vitejs/vitejs-original.svg`,
   angular: `${DI}/angular/angular-original.svg`,
@@ -841,6 +892,22 @@ var STACK_ICONS = {
   "docker-compose": `${DI}/docker/docker-original.svg`
 };
 
+// ../../packages/core/src/volumes.ts
+var APP_DIR = "/app";
+var MODE_SUFFIX = /:(ro|rw|z|Z|nocopy)$/;
+function appVolumeTargets(volumes, appDir = APP_DIR) {
+  const out = [];
+  for (const spec of volumes) {
+    const body = spec.replace(MODE_SUFFIX, "");
+    const idx = body.indexOf(":");
+    if (idx < 0) continue;
+    const target = body.slice(idx + 1);
+    if (!target.startsWith(`${appDir}/`)) continue;
+    out.push(target.slice(appDir.length + 1));
+  }
+  return out;
+}
+
 // ../../packages/core/src/constants.ts
 var DEFAULT_IMAGE_REGISTRY = "ghcr.io/oblien";
 var PLANS = {
@@ -974,17 +1041,26 @@ var CREDIT_PACKS = [
   }
 ];
 
-// ../../packages/core/src/edge-image-ref.ts
-function buildEdgeImageRef(opts) {
+// ../../packages/core/src/image-ref.ts
+function buildImageRef(opts, image) {
   const explicit = opts?.explicit?.trim();
   if (explicit) return explicit;
-  const override = process.env.OPENSHIP_EDGE_IMAGE?.trim();
+  const override = image.imageOverride?.trim();
   if (override) return override;
   const injected = opts?.injectedDefault?.trim();
   if (injected) return injected;
   const registry2 = process.env.OPENSHIP_IMAGE_REGISTRY?.trim() || DEFAULT_IMAGE_REGISTRY;
-  const tag = process.env.OPENSHIP_EDGE_TAG?.trim() || process.env.OPENSHIP_VERSION?.trim() || opts?.fallbackTag?.trim() || "latest";
-  return `${registry2}/openship-edge:${tag}`;
+  const tag = image.tagOverride?.trim() || process.env.OPENSHIP_VERSION?.trim() || opts?.fallbackTag?.trim() || "latest";
+  return `${registry2}/${image.name}:${tag}`;
+}
+
+// ../../packages/core/src/edge-image-ref.ts
+function buildEdgeImageRef(opts) {
+  return buildImageRef(opts, {
+    name: "openship-edge",
+    imageOverride: process.env.OPENSHIP_EDGE_IMAGE,
+    tagOverride: process.env.OPENSHIP_EDGE_TAG
+  });
 }
 
 // ../../packages/core/src/system.ts
@@ -1017,7 +1093,35 @@ var SYSTEM = {
     /** Maximum length of the error message stored in DB */
     MAX_ERROR_MESSAGE_LENGTH: 512,
     /** Default restart policy for production containers */
-    DEFAULT_RESTART_POLICY: "always"
+    DEFAULT_RESTART_POLICY: "always",
+    /**
+     * How long a just-started container is watched before a deploy may call
+     * itself ready. Container-create succeeding proves nothing: a bad start
+     * command exits within milliseconds and `restart: always` hides it behind a
+     * bounce loop. Measured from each container's OWN start time, so a stack
+     * whose earlier services have already been up this long waits only for the
+     * last one.
+     */
+    STABILIZE_WINDOW_MS: 15e3,
+    /** Inspect poll interval inside that window. */
+    STABILIZE_POLL_MS: 1e3,
+    /**
+     * Restarts within the window that mean "crash loop" rather than "waited for
+     * a dependency and recovered". Docker's restart backoff (100ms doubling)
+     * takes an instantly-exiting process past this in ~2s, while a service that
+     * times out waiting on a slow database manages one or two.
+     */
+    STABILIZE_CRASH_RESTARTS: 3,
+    /** Log lines folded into the failure message, so diagnosing needs no SSH. */
+    STABILIZE_LOG_TAIL_LINES: 20,
+    /**
+     * Readiness-probe budget when a project OPTS IN to the health check. Only
+     * reached with `readiness.enabled` — an unconfigured deploy runs no probe
+     * at all, so this never sits on the default critical path.
+     */
+    READINESS_TIMEOUT_MS: 45e3,
+    /** Readiness-probe poll interval. */
+    READINESS_INTERVAL_MS: 1e3
   },
   // ── SSE / Build Streaming ────────────────────────────────────────────
   SSE: {
@@ -1030,6 +1134,12 @@ var SYSTEM = {
     // 4 hours
     /** Keep-alive heartbeat interval (ms) - prevents proxy/CDN drops */
     HEARTBEAT_INTERVAL_MS: 25e3,
+    /**
+     * How long a finished handler waits for already-queued frames to flush
+     * before the stream closes. Bounded because a client that has gone away
+     * never drains, and that must not hold the response open.
+     */
+    TERMINAL_DRAIN_TIMEOUT_MS: 5e3,
     /** Maximum active sessions in the cache */
     MAX_SESSIONS: 500,
     /** Background sweep interval for stale sessions (ms) */
@@ -1071,11 +1181,12 @@ var SYSTEM = {
     /** Port range */
     MIN_PORT: 1,
     MAX_PORT: 65535,
-    /** Resource limits */
-    MIN_CPU_CORES: 0.25,
-    MAX_CPU_CORES: 4,
-    MIN_MEMORY_MB: 128,
-    MAX_MEMORY_MB: 8192,
+    // Resource bounds deliberately do NOT live here. They belong to
+    // ./resources.ts, which is the single source of truth: the floors
+    // (MIN_CPU_CORES / MIN_MEMORY_MB) plus the rule that the UPPER bound is the
+    // target machine's probed capacity, not a constant. The unread
+    // MAX_CPU_CORES: 4 / MAX_MEMORY_MB: 8192 pair that used to sit here encoded
+    // exactly the fixed ceiling that made a large self-hosted box unusable.
     /** Pagination */
     DEFAULT_PAGE: 1,
     DEFAULT_PER_PAGE: 20,
@@ -1083,6 +1194,41 @@ var SYSTEM = {
   }
 };
 
+// ../../packages/core/src/utils.ts
+var REDIRECT_STATUSES = [301, 302, 307, 308];
+var DEFAULT_REDIRECT_STATUS = 301;
+function resolveRedirectStatus(status) {
+  return REDIRECT_STATUSES.includes(status) ? status : DEFAULT_REDIRECT_STATUS;
+}
+function isValidEmail(value) {
+  const email3 = value?.trim() ?? "";
+  if (!email3 || email3.length > 254) return false;
+  return /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/.test(email3);
+}
+function formatBytes(bytes, decimals = 2) {
+  if (bytes <= 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(decimals))} ${sizes[i]}`;
+}
+function withTimeout(promise2, ms, message) {
+  if (!ms) return promise2;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    promise2.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+
 // ../../packages/core/src/errors.ts
 var AppError = class extends Error {
   constructor(message, statusCode = 500, code) {
@@ -1106,6 +1252,12 @@ function safeErrorMessage(err) {
   return String(err).slice(0, 2e3);
 }
 
+// ../../packages/core/src/types.ts
+var OPENSHIP_READINESS_FAILURE_ACTIONS = [
+  "warn",
+  "fail"
+];
+
 // ../../packages/core/src/openship-config/schema.ts
 var OPENSHIP_RUNTIMES = ["bare", "docker"];
 var OPENSHIP_PRODUCTION_MODES = [
@@ -1121,6 +1273,7 @@ var OPENSHIP_RESTARTS = [
   "unless-stopped"
 ];
 var OPENSHIP_RESOURCE_TIERS = [
+  "unlimited",
   "micro",
   "low",
   "medium",
@@ -1133,12 +1286,14 @@ var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "framework",
   "packageManager",
   "rootDirectory",
+  "composePath",
   "installCommand",
   "buildCommand",
   "startCommand",
   "outputDirectory",
   "buildImage",
   "productionPaths",
+  "volumes",
   "runtime",
   "productionMode",
   "port",
@@ -1146,6 +1301,7 @@ var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "domains",
   "routes",
   "resources",
+  "readiness",
   "services",
   "monorepo"
 ]);
@@ -1320,12 +1476,28 @@ function parseResources(ctx, v, path) {
   }
   const r = {
     tier: ctx.enumOf(v.tier, `${path}.tier`, OPENSHIP_RESOURCE_TIERS),
-    cpuCores: ctx.int(v.cpuCores, `${path}.cpuCores`, 0.25, 4),
-    memoryMb: ctx.int(v.memoryMb, `${path}.memoryMb`, 128, 8192),
-    diskMb: ctx.int(v.diskMb, `${path}.diskMb`, 64, 204800)
+    cpuCores: ctx.int(v.cpuCores, `${path}.cpuCores`, 0, 1024),
+    memoryMb: ctx.int(v.memoryMb, `${path}.memoryMb`, 0, 4194304),
+    diskMb: ctx.int(v.diskMb, `${path}.diskMb`, 0, 204800)
   };
   return r;
 }
+function parseReadiness(ctx, v, path) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path, "must be an object");
+    return void 0;
+  }
+  return {
+    enabled: ctx.bool(v.enabled, `${path}.enabled`),
+    path: ctx.str(v.path, `${path}.path`),
+    port: ctx.int(v.port, `${path}.port`, 1, 65535),
+    timeoutSeconds: ctx.int(v.timeoutSeconds, `${path}.timeoutSeconds`, 1, 600),
+    stabilization: ctx.bool(v.stabilization, `${path}.stabilization`),
+    stabilizationSeconds: ctx.int(v.stabilizationSeconds, `${path}.stabilizationSeconds`, 1, 600),
+    onFailure: ctx.enumOf(v.onFailure, `${path}.onFailure`, OPENSHIP_READINESS_FAILURE_ACTIONS)
+  };
+}
 function parseHealthcheck(ctx, v, path) {
   if (v === void 0) return void 0;
   if (!ctx.isObj(v)) {
@@ -1374,7 +1546,9 @@ function parseServices(ctx, v, path) {
       exposed: ctx.bool(item.exposed, `${p}.exposed`),
       exposedPort: ctx.str(item.exposedPort, `${p}.exposedPort`),
       domain: ctx.str(item.domain, `${p}.domain`),
-      healthcheck: parseHealthcheck(ctx, item.healthcheck, `${p}.healthcheck`)
+      healthcheck: parseHealthcheck(ctx, item.healthcheck, `${p}.healthcheck`),
+      readiness: parseReadiness(ctx, item.readiness, `${p}.readiness`),
+      resources: parseResources(ctx, item.resources, `${p}.resources`)
     });
   });
   return out;
@@ -1458,12 +1632,14 @@ function parseOpenshipConfig(raw) {
     framework: ctx.enumOf(raw.framework, "framework", STACK_IDS),
     packageManager: parsePackageManager(ctx, raw.packageManager, "packageManager"),
     rootDirectory: ctx.str(raw.rootDirectory, "rootDirectory"),
+    composePath: ctx.str(raw.composePath, "composePath"),
     installCommand: ctx.str(raw.installCommand, "installCommand"),
     buildCommand: ctx.str(raw.buildCommand, "buildCommand"),
     startCommand: ctx.str(raw.startCommand, "startCommand"),
     outputDirectory: ctx.str(raw.outputDirectory, "outputDirectory"),
     buildImage: ctx.str(raw.buildImage, "buildImage"),
     productionPaths: ctx.strArray(raw.productionPaths, "productionPaths"),
+    volumes: ctx.strArray(raw.volumes, "volumes"),
     runtime: ctx.enumOf(raw.runtime, "runtime", OPENSHIP_RUNTIMES),
     productionMode: ctx.enumOf(raw.productionMode, "productionMode", OPENSHIP_PRODUCTION_MODES),
     port: ctx.int(raw.port, "port", 1, 65535),
@@ -1471,6 +1647,7 @@ function parseOpenshipConfig(raw) {
     domains: parseDomains(ctx, raw.domains, "domains"),
     routes: parseRoutes(ctx, raw.routes, "routes"),
     resources: parseResources(ctx, raw.resources, "resources"),
+    readiness: parseReadiness(ctx, raw.readiness, "readiness"),
     services: parseServices(ctx, raw.services, "services"),
     monorepo: parseMonorepo(ctx, raw.monorepo, "monorepo")
   };
@@ -1864,57 +2041,279 @@ var METADATA_FILES = new Set(
 );
 
 // ../../packages/core/src/proxy-settings.ts
-var PROXY_SIZE_RE = /^[1-9][0-9]*(k|m|g)$/;
+var PROXY_SIZE_RE = /^(0|[1-9][0-9]*(k|m|g))$/;
 var PROXY_TIME_RE = /^[1-9][0-9]*(s|m|h)$/;
+var PROXY_BUFFERS_RE = /^[1-9][0-9]* [1-9][0-9]*(k|m|g)?$/;
 var PROXY_GZIP_TYPES = "text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml";
-var PROXY_STRING_FIELD_RE = {
-  clientMaxBodySize: PROXY_SIZE_RE,
-  proxyReadTimeout: PROXY_TIME_RE,
-  proxySendTimeout: PROXY_TIME_RE,
-  clientBodyTimeout: PROXY_TIME_RE
-};
+var PROXY_DIRECTIVES = [
+  // ── Request body ────────────────────────────────────────────────────────
+  { key: "clientMaxBodySize", directive: "client_max_body_size", kind: "size", group: "body" },
+  { key: "clientBodyTimeout", directive: "client_body_timeout", kind: "time", group: "body" },
+  {
+    key: "clientBodyBufferSize",
+    directive: "client_body_buffer_size",
+    kind: "size",
+    group: "body"
+  },
+  {
+    key: "proxyRequestBuffering",
+    directive: "proxy_request_buffering",
+    kind: "bool",
+    group: "body"
+  },
+  // ── Upstream timeouts ───────────────────────────────────────────────────
+  { key: "proxyConnectTimeout", directive: "proxy_connect_timeout", kind: "time", group: "timeouts" },
+  { key: "proxyReadTimeout", directive: "proxy_read_timeout", kind: "time", group: "timeouts" },
+  { key: "proxySendTimeout", directive: "proxy_send_timeout", kind: "time", group: "timeouts" },
+  { key: "sendTimeout", directive: "send_timeout", kind: "time", group: "timeouts" },
+  { key: "keepaliveTimeout", directive: "keepalive_timeout", kind: "time", group: "timeouts" },
+  // ── Response buffering ──────────────────────────────────────────────────
+  { key: "proxyBuffering", directive: "proxy_buffering", kind: "bool", group: "buffering" },
+  { key: "proxyBufferSize", directive: "proxy_buffer_size", kind: "size", group: "buffering" },
+  { key: "proxyBuffers", directive: "proxy_buffers", kind: "buffers", group: "buffering" },
+  {
+    key: "proxyBusyBuffersSize",
+    directive: "proxy_busy_buffers_size",
+    kind: "size",
+    group: "buffering"
+  },
+  {
+    key: "proxyMaxTempFileSize",
+    directive: "proxy_max_temp_file_size",
+    kind: "size",
+    group: "buffering"
+  },
+  // ── Compression ─────────────────────────────────────────────────────────
+  {
+    key: "gzip",
+    directive: "gzip",
+    kind: "bool",
+    group: "compression",
+    companionsWhenOn: [
+      `gzip_types ${PROXY_GZIP_TYPES}`,
+      "gzip_vary on",
+      // nginx's own default is 20 bytes, small enough that the gzip header costs
+      // more than the compression saves.
+      "gzip_min_length 1024"
+    ]
+  },
+  {
+    key: "gzipCompLevel",
+    directive: "gzip_comp_level",
+    kind: "int",
+    group: "compression",
+    min: 1,
+    max: 9
+  },
+  // Bytes, as an int — the natural unit here is "1024", and `size` would force "1k".
+  {
+    key: "gzipMinLength",
+    directive: "gzip_min_length",
+    kind: "int",
+    group: "compression",
+    min: 0,
+    max: 10485760
+  },
+  // ── Headers & limits ────────────────────────────────────────────────────
+  {
+    key: "largeClientHeaderBuffers",
+    directive: "large_client_header_buffers",
+    kind: "buffers",
+    group: "headers"
+  },
+  {
+    key: "underscoresInHeaders",
+    directive: "underscores_in_headers",
+    kind: "bool",
+    group: "headers"
+  },
+  { key: "serverTokens", directive: "server_tokens", kind: "bool", group: "headers" },
+  {
+    key: "http2",
+    directive: "http2",
+    kind: "bool",
+    group: "headers",
+    // `http2 on;` at server scope replaced `listen ... http2` in nginx 1.25.1.
+    minNginx: [1, 25, 1],
+    tlsOnly: true
+  },
+  // ── TLS to the upstream ─────────────────────────────────────────────────
+  {
+    key: "proxySslServerName",
+    directive: "proxy_ssl_server_name",
+    kind: "bool",
+    group: "upstreamTls"
+  },
+  { key: "proxySslVerify", directive: "proxy_ssl_verify", kind: "bool", group: "upstreamTls" }
+];
+var PROXY_DIRECTIVE_BY_KEY = new Map(
+  PROXY_DIRECTIVES.map((d) => [d.key, d])
+);
+var PROXY_DIRECTIVE_BY_NAME = new Map(
+  PROXY_DIRECTIVES.map((d) => [d.directive, d])
+);
+function proxyKindRegex(kind) {
+  switch (kind) {
+    case "size":
+      return PROXY_SIZE_RE;
+    case "time":
+      return PROXY_TIME_RE;
+    case "buffers":
+      return PROXY_BUFFERS_RE;
+    default:
+      return void 0;
+  }
+}
+var PROXY_STRING_FIELD_RE = Object.freeze(
+  Object.fromEntries(
+    PROXY_DIRECTIVES.flatMap((d) => {
+      const re = proxyKindRegex(d.kind);
+      return re ? [[d.key, re]] : [];
+    })
+  )
+);
+function coerceProxyValue(spec, value) {
+  if (spec.kind === "bool") return typeof value === "boolean" ? value : void 0;
+  if (spec.kind === "int") {
+    if (typeof value !== "number" || !Number.isInteger(value)) return void 0;
+    if (spec.min !== void 0 && value < spec.min) return void 0;
+    if (spec.max !== void 0 && value > spec.max) return void 0;
+    return value;
+  }
+  const re = proxyKindRegex(spec.kind);
+  if (typeof value !== "string" || !re || !re.test(value)) return void 0;
+  return value;
+}
 function sanitizeProxySettings(input) {
   if (!input || typeof input !== "object") return void 0;
   const src = input;
   const out = {};
-  for (const [key, re] of Object.entries(PROXY_STRING_FIELD_RE)) {
-    const v = src[key];
-    if (typeof v === "string" && re.test(v)) {
-      out[key] = v;
-    }
+  for (const spec of PROXY_DIRECTIVES) {
+    if (!(spec.key in src)) continue;
+    const v = coerceProxyValue(spec, src[spec.key]);
+    if (v !== void 0) out[spec.key] = v;
   }
-  if (typeof src.proxyBuffering === "boolean") out.proxyBuffering = src.proxyBuffering;
-  if (typeof src.gzip === "boolean") out.gzip = src.gzip;
   return Object.keys(out).length > 0 ? out : void 0;
 }
-
-// ../../packages/core/src/utils.ts
-function isValidEmail(value) {
-  const email3 = value?.trim() ?? "";
-  if (!email3 || email3.length > 254) return false;
-  return /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/.test(email3);
+function renderProxyValue(spec, value) {
+  if (spec.kind === "bool") return value ? "on" : "off";
+  return String(value);
 }
-function formatBytes(bytes, decimals = 2) {
-  if (bytes <= 0) return "0 B";
-  const k = 1024;
-  const sizes = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
-  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(decimals))} ${sizes[i]}`;
+function proxyDirectiveAllowed(spec, version2) {
+  if (!spec.minNginx || !version2) return true;
+  for (let i = 0; i < 3; i++) {
+    const need = spec.minNginx[i] ?? 0;
+    const have = version2[i] ?? 0;
+    if (have > need) return true;
+    if (have < need) return false;
+  }
+  return true;
 }
-function withTimeout(promise2, ms, message) {
-  if (!ms) return promise2;
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    promise2.then(
-      (v) => {
-        clearTimeout(timer);
-        resolve(v);
-      },
-      (e) => {
-        clearTimeout(timer);
-        reject(e);
+function resolveProxyDirectives(settings, opts) {
+  const p = sanitizeProxySettings(settings);
+  if (!p) return [];
+  const values = p;
+  const explicit = new Set(
+    PROXY_DIRECTIVES.filter((s) => values[s.key] !== void 0).map((s) => s.directive)
+  );
+  const out = [];
+  for (const spec of PROXY_DIRECTIVES) {
+    const wanted = opts.scope === "all" || opts.scope === "tls" === !!spec.tlsOnly;
+    if (!wanted) continue;
+    if (!proxyDirectiveAllowed(spec, opts.nginxVersion)) continue;
+    const value = values[spec.key];
+    if (value === void 0) continue;
+    out.push({ directive: spec.directive, text: renderProxyValue(spec, value), key: spec.key, value });
+    if (value !== true || !spec.companionsWhenOn) continue;
+    for (const line of spec.companionsWhenOn) {
+      const [name, ...rest] = line.split(/\s+/);
+      if (!name || explicit.has(name)) continue;
+      const text = rest.join(" ");
+      const companion = PROXY_DIRECTIVE_BY_NAME.get(name);
+      const parsed = companion ? parseProxyValue(companion, text) : void 0;
+      out.push({
+        directive: name,
+        text,
+        ...companion && parsed !== void 0 ? { key: companion.key, value: parsed } : {}
+      });
+    }
+  }
+  return out;
+}
+function parseProxyValue(spec, raw) {
+  const text = raw.trim();
+  if (spec.kind === "bool") {
+    if (text === "on") return true;
+    if (text === "off") return false;
+    return void 0;
+  }
+  if (spec.kind === "int") {
+    if (!/^[0-9]+$/.test(text)) return void 0;
+    return coerceProxyValue(spec, Number(text));
+  }
+  const normalized = spec.kind === "buffers" ? text.replace(/\s+/g, " ") : text;
+  return coerceProxyValue(spec, normalized.toLowerCase());
+}
+
+// ../../packages/core/src/object-storage.ts
+function isAwsS3Endpoint(endpoint2) {
+  return !endpoint2 || endpoint2.includes(".amazonaws.com");
+}
+
+// ../../packages/core/src/shell-split.ts
+function shellSplitWords(value) {
+  const words = [];
+  let current = "";
+  let quoted = false;
+  let inSingle = false;
+  let inDouble = false;
+  let escaped = false;
+  for (const char of value.trim()) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\" && !inSingle) {
+      escaped = true;
+      continue;
+    }
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      quoted = true;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      quoted = true;
+      continue;
+    }
+    if (/\s/.test(char) && !inSingle && !inDouble) {
+      if (current || quoted) {
+        words.push(current);
+        current = "";
+        quoted = false;
       }
-    );
+      continue;
+    }
+    current += char;
+  }
+  if (escaped) current += "\\";
+  if (current || quoted) words.push(current);
+  return words;
+}
+function commandToArgv(command) {
+  if (command == null) return null;
+  if (Array.isArray(command)) return command.map((part) => String(part));
+  return shellSplitWords(command);
+}
+
+// ../../packages/core/src/mail-image-ref.ts
+function buildMailImageRef(opts) {
+  return buildImageRef(opts, {
+    name: "openship-mail",
+    imageOverride: process.env.OPENSHIP_MAIL_IMAGE,
+    tagOverride: process.env.OPENSHIP_MAIL_TAG
   });
 }
 
@@ -1977,6 +2376,36 @@ var dashboardRuntimeOrigins = Object.values(DASHBOARD_RUNTIME_TARGETS).flatMap(
   ({ dashboard, api }) => [dashboard, api]
 );
 
+// ../../packages/core/src/resources.ts
+var RESOURCE_TIER_ORDER = ["micro", "low", "medium", "high"];
+var ALL_RESOURCE_TIERS = [
+  "unlimited",
+  ...RESOURCE_TIER_ORDER,
+  "custom"
+];
+var CLOUD_RESOURCE_TIER_IDS = [
+  ...RESOURCE_TIER_ORDER,
+  "custom"
+];
+function hasCpuLimit(r) {
+  return typeof r?.cpuCores === "number" && r.cpuCores > 0;
+}
+function hasMemoryLimit(r) {
+  return typeof r?.memoryMb === "number" && r.memoryMb > 0;
+}
+function formatMemoryMb(mb) {
+  if (!mb || mb <= 0) return "no limit";
+  if (mb >= 1024) return `${(mb / 1024).toFixed(mb % 1024 === 0 ? 0 : 1)} GB`;
+  return `${mb} MB`;
+}
+function formatCpuCores(cores) {
+  if (!cores || cores <= 0) return "no limit";
+  return `${cores} vCPU`;
+}
+
+// ../../packages/core/src/rollback-window.ts
+var ROLLBACK_DISK_BUDGET_CAP_BYTES = 20 * 1024 * 1024 * 1024;
+
 // ../../packages/core/src/workspaces/toml-helpers.ts
 function extractStringArrayFromSection(content, sectionPath, key) {
   const sectionHeader = new RegExp(
@@ -2158,14 +2587,33 @@ var goWorkspaceDetector = {
 };
 
 // ../../packages/core/src/workspaces/gradle.ts
+function readIncludeArgs(content, start) {
+  let i = start;
+  while (content[i] === " " || content[i] === "	") i++;
+  if (content[i] === "(") {
+    let depth = 0;
+    for (let j = i; j < content.length; j++) {
+      if (content[j] === "(") depth++;
+      else if (content[j] === ")" && --depth === 0) return content.slice(i + 1, j);
+    }
+    return content.slice(i + 1);
+  }
+  let args = "";
+  for (; ; ) {
+    const newline = content.indexOf("\n", i);
+    const line = newline === -1 ? content.slice(i) : content.slice(i, newline);
+    args += line;
+    if (newline === -1 || !line.trimEnd().endsWith(",")) return args;
+    i = newline + 1;
+  }
+}
 function parseGradleSettings(content) {
   const cleaned = content.replace(/\/\*[\s\S]*?\*\//g, "").split("\n").map((line) => line.replace(/\/\/.*$/, "")).join("\n");
   const paths = [];
-  const includePattern = /include\s*(?:\(\s*)?((?:[^()\n]+))(?:\))?/g;
+  const includePattern = /\binclude\b/g;
   let match;
   while ((match = includePattern.exec(cleaned)) !== null) {
-    const args = match[1];
-    if (/^Build\b/.test(args)) continue;
+    const args = readIncludeArgs(cleaned, match.index + match[0].length);
     const stringPattern = /"([^"]+)"|'([^']+)'/g;
     let stringMatch;
     while ((stringMatch = stringPattern.exec(args)) !== null) {
@@ -2190,9 +2638,49 @@ var gradleWorkspaceDetector = {
   parseSubProjects: parseGradleSettings
 };
 
+// ../../packages/core/src/workspaces/comments.ts
+function stripJsonComments(content) {
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < content.length; i++) {
+    const ch = content[i];
+    if (inString) {
+      out += ch;
+      if (ch === "\\") {
+        out += content[++i] ?? "";
+        continue;
+      }
+      if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && content[i + 1] === "/") {
+      const newline = content.indexOf("\n", i);
+      if (newline === -1) break;
+      i = newline - 1;
+      continue;
+    }
+    if (ch === "/" && content[i + 1] === "*") {
+      const end = content.indexOf("*/", i + 2);
+      if (end === -1) break;
+      i = end + 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function stripXmlComments(content) {
+  return content.replace(/<!--[\s\S]*?-->/g, "");
+}
+
 // ../../packages/core/src/workspaces/maven.ts
 function parsePomXml(content) {
-  const modulesBlock = content.match(/<modules\b[^>]*>([\s\S]*?)<\/modules>/i);
+  const modulesBlock = stripXmlComments(content).match(/<modules\b[^>]*>([\s\S]*?)<\/modules>/i);
   if (!modulesBlock) return [];
   const moduleEntries = modulesBlock[1].matchAll(/<module\b[^>]*>\s*([\s\S]*?)\s*<\/module>/gi);
   const paths = [];
@@ -2289,7 +2777,7 @@ var uvWorkspaceDetector = {
 function parseRushJson(content) {
   let parsed = null;
   try {
-    parsed = JSON.parse(content);
+    parsed = JSON.parse(stripJsonComments(content));
   } catch {
     return [];
   }
@@ -2367,8 +2855,11 @@ var dockerLanguageDetector = {
 // ../../packages/core/src/languages/elixir.ts
 function parseMixExs2(content) {
   const deps = {};
-  for (const m of content.matchAll(/\{:([\w]+),/g)) {
-    deps[m[1]] = "*";
+  for (const line of content.split("\n")) {
+    if (line.trim().startsWith("#")) continue;
+    for (const m of line.matchAll(/\{:([\w]+),/g)) {
+      deps[m[1]] = "*";
+    }
   }
   return deps;
 }
@@ -2416,6 +2907,34 @@ function clampPort(raw) {
   const port = parseInt(raw, 10);
   return port > 0 && port <= 65535 ? port : null;
 }
+var YAML_PORT_RE = /^port:\s*["']?(\d{2,5})/;
+function springYamlPort(yml) {
+  const inline = yml.match(/^server:\s*\{[^}]*\bport:\s*["']?(\d{2,5})/m);
+  if (inline) return inline[1];
+  let inServer = false;
+  let childIndent = null;
+  for (const raw of yml.split("\n")) {
+    const trimmed2 = raw.trim();
+    if (!trimmed2 || trimmed2.startsWith("#")) continue;
+    const indent = raw.length - raw.trimStart().length;
+    if (inServer) {
+      if (indent > 0) {
+        if (childIndent === null) childIndent = indent;
+        if (indent === childIndent) {
+          const m = trimmed2.match(YAML_PORT_RE);
+          if (m) return m[1];
+        }
+        continue;
+      }
+      inServer = false;
+    }
+    if (indent === 0 && /^server:$/.test(trimmed2)) {
+      inServer = true;
+      childIndent = null;
+    }
+  }
+  return null;
+}
 function detectJavaPort(context) {
   const fc = context.fileContents;
   if (!fc) return null;
@@ -2427,8 +2946,8 @@ function detectJavaPort(context) {
   for (const name of ["application.yml", "application.yaml"]) {
     const yml = fc[name];
     if (!yml) continue;
-    const m = yml.match(/server:[\s\S]*?\bport:\s*["']?(\d{2,5})/) ?? yml.match(/^\s*port:\s*["']?(\d{2,5})/m);
-    if (m) return clampPort(m[1]);
+    const port = springYamlPort(yml) ?? yml.match(/^port:\s*["']?(\d{2,5})/m)?.[1];
+    if (port) return clampPort(port);
   }
   return null;
 }
@@ -2515,11 +3034,30 @@ function parseRequirementsTxt(content) {
   }
   return deps;
 }
+function sliceArrayValue(body, key) {
+  const open = body.match(new RegExp(`(?:^|\\n)\\s*${key}\\s*=\\s*\\[`));
+  if (!open || open.index === void 0) return null;
+  const from = open.index + open[0].length;
+  let depth = 1;
+  let quote = null;
+  for (let i = from; i < body.length; i++) {
+    const char = body[i];
+    if (quote) {
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") quote = char;
+    else if (char === "[") depth++;
+    else if (char === "]" && --depth === 0) return body.slice(from, i);
+  }
+  return null;
+}
 function parsePyprojectToml(content) {
   const deps = {};
-  const pep621 = content.match(/\[project\][^[]*?dependencies\s*=\s*\[([\s\S]*?)\]/);
-  if (pep621) {
-    const items = pep621[1].matchAll(/["']([^"']+)["']/g);
+  const project = content.match(/\[project\]([\s\S]*?)(?=\n\[|$)/);
+  const pep621 = project ? sliceArrayValue(project[1], "dependencies") : null;
+  if (pep621 !== null) {
+    const items = pep621.matchAll(/["']([^"']+)["']/g);
     for (const item of items) {
       const m = item[1].match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
       if (m) deps[normalizeName(m[1])] = "*";
@@ -2576,8 +3114,11 @@ var pythonLanguageDetector = {
 // ../../packages/core/src/languages/ruby.ts
 function parseGemfile(content) {
   const deps = {};
-  for (const m of content.matchAll(/gem\s+['"]([^'"]+)['"]/g)) {
-    deps[m[1].toLowerCase()] = "*";
+  for (const line of content.split("\n")) {
+    if (line.trim().startsWith("#")) continue;
+    for (const m of line.matchAll(/gem\s+['"]([^'"]+)['"]/g)) {
+      deps[m[1].toLowerCase()] = "*";
+    }
   }
   return deps;
 }
@@ -2674,9 +3215,6 @@ var catalog_default = {
         {
           name: "db",
           image: "supabase/postgres:17.6.1.136",
-          ports: [
-            "5432:5432"
-          ],
           environment: {
             POSTGRES_HOST: "/var/run/postgresql",
             PGPORT: "5432",
@@ -2687,7 +3225,8 @@ var catalog_default = {
             JWT_EXP: "3600"
           },
           volumes: [
-            "supabase_db_data:/var/lib/postgresql/data"
+            "supabase_db_data:/var/lib/postgresql/data",
+            "supabase_db_config:/etc/postgresql-custom"
           ],
           healthcheck: {
             test: [
@@ -2707,9 +3246,6 @@ var catalog_default = {
         {
           name: "kong",
           image: "kong:3.9.1",
-          ports: [
-            "8000:8000"
-          ],
           exposedPort: 8e3,
           exposed: true,
           routes: [
@@ -2863,7 +3399,7 @@ var catalog_default = {
               "--no-verbose",
               "--tries=1",
               "--spider",
-              "http://localhost:5000/status"
+              "http://127.0.0.1:5000/status"
             ],
             interval: "5s",
             timeout: "5s",
@@ -3016,8 +3552,231 @@ var catalog_default = {
         },
         {
           service: "db",
-          path: "/docker-entrypoint-initdb.d/99-roles.sql",
-          content: "ALTER USER authenticator WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER pgbouncer WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_auth_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_functions_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_storage_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\n"
+          path: "/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql",
+          content: `BEGIN;
+  -- Create pg_net extension
+  CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+  -- Create supabase_functions schema
+  CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+  GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+  -- supabase_functions.migrations definition
+  CREATE TABLE supabase_functions.migrations (
+    version text PRIMARY KEY,
+    inserted_at timestamptz NOT NULL DEFAULT NOW()
+  );
+  -- Initial supabase_functions migration
+  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+  -- supabase_functions.hooks definition
+  CREATE TABLE supabase_functions.hooks (
+    id bigserial PRIMARY KEY,
+    hook_table_id integer NOT NULL,
+    hook_name text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT NOW(),
+    request_id bigint
+  );
+  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+  CREATE FUNCTION supabase_functions.http_request()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    AS $function$
+    DECLARE
+      request_id bigint;
+      payload jsonb;
+      url text := TG_ARGV[0]::text;
+      method text := TG_ARGV[1]::text;
+      headers jsonb DEFAULT '{}'::jsonb;
+      params jsonb DEFAULT '{}'::jsonb;
+      timeout_ms integer DEFAULT 1000;
+    BEGIN
+      IF url IS NULL OR url = 'null' THEN
+        RAISE EXCEPTION 'url argument is missing';
+      END IF;
+
+      IF method IS NULL OR method = 'null' THEN
+        RAISE EXCEPTION 'method argument is missing';
+      END IF;
+
+      IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+        headers = '{"Content-Type": "application/json"}'::jsonb;
+      ELSE
+        headers = TG_ARGV[2]::jsonb;
+      END IF;
+
+      IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+        params = '{}'::jsonb;
+      ELSE
+        params = TG_ARGV[3]::jsonb;
+      END IF;
+
+      IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+        timeout_ms = 1000;
+      ELSE
+        timeout_ms = TG_ARGV[4]::integer;
+      END IF;
+
+      CASE
+        WHEN method = 'GET' THEN
+          SELECT http_get INTO request_id FROM net.http_get(
+            url,
+            params,
+            headers,
+            timeout_ms
+          );
+        WHEN method = 'POST' THEN
+          payload = jsonb_build_object(
+            'old_record', OLD,
+            'record', NEW,
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'schema', TG_TABLE_SCHEMA
+          );
+
+          SELECT http_post INTO request_id FROM net.http_post(
+            url,
+            payload,
+            params,
+            headers,
+            timeout_ms
+          );
+        ELSE
+          RAISE EXCEPTION 'method argument % is invalid', method;
+      END CASE;
+
+      INSERT INTO supabase_functions.hooks
+        (hook_table_id, hook_name, request_id)
+      VALUES
+        (TG_RELID, TG_NAME, request_id);
+
+      RETURN NEW;
+    END
+  $function$;
+  -- Supabase super admin
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_functions_admin'
+    )
+    THEN
+      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+    END IF;
+  END
+  $$;
+  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+  ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+  ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+  ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+  GRANT supabase_functions_admin TO postgres;
+  -- Remove unused supabase_pg_net_admin role
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_pg_net_admin'
+    )
+    THEN
+      REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+      DROP OWNED BY supabase_pg_net_admin;
+      DROP ROLE supabase_pg_net_admin;
+    END IF;
+  END
+  $$;
+  -- pg_net grants when extension is already enabled
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_extension
+      WHERE extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END
+  $$;
+  -- Event trigger for pg_net
+  CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+  RETURNS event_trigger
+  LANGUAGE plpgsql
+  AS $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_event_trigger_ddl_commands() AS ev
+      JOIN pg_extension AS ext
+      ON ev.objid = ext.oid
+      WHERE ext.extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END;
+  $$;
+  COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_event_trigger
+      WHERE evtname = 'issue_pg_net_access'
+    ) THEN
+      CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+      EXECUTE PROCEDURE extensions.grant_pg_net_access();
+    END IF;
+  END
+  $$;
+  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+  ALTER function supabase_functions.http_request() SECURITY DEFINER;
+  ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+  REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+  GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+COMMIT;
+`
+        },
+        {
+          service: "db",
+          path: "/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql",
+          content: '\\set jwt_secret `echo "$JWT_SECRET"`\n\\set jwt_exp `echo "$JWT_EXP"`\n\nALTER DATABASE postgres SET "app.settings.jwt_secret" TO :\'jwt_secret\';\nALTER DATABASE postgres SET "app.settings.jwt_exp" TO :\'jwt_exp\';\n'
+        },
+        {
+          service: "db",
+          path: "/docker-entrypoint-initdb.d/init-scripts/99-roles.sql",
+          content: "\\set pgpass `echo \"$POSTGRES_PASSWORD\"`\n\nALTER USER authenticator WITH PASSWORD :'pgpass';\nALTER USER pgbouncer WITH PASSWORD :'pgpass';\nALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';\n"
+        },
+        {
+          service: "db",
+          path: "/docker-entrypoint-initdb.d/migrations/99-realtime.sql",
+          content: '\\set pguser `echo "$POSTGRES_USER"`\n\ncreate schema if not exists _realtime;\nalter schema _realtime owner to :pguser;\n'
         }
       ],
       management: {
@@ -3042,6 +3801,7 @@ var catalog_default = {
             id: "studio",
             label: "Studio",
             source: "publicUrl:kong",
+            kind: "url",
             help: "Open in a browser and sign in with the Studio username + password below."
           },
           {
@@ -3072,12 +3832,12 @@ var catalog_default = {
           {
             id: "dbUrl",
             label: "Database URL",
-            source: "template:postgresql://postgres:{{env:db:POSTGRES_PASSWORD}}@{{host}}:5432/postgres",
+            source: "template:postgresql://postgres:{{env:db:POSTGRES_PASSWORD}}@db:5432/postgres",
             service: "db",
             secret: true,
             envKey: "DATABASE_URL",
             recommended: true,
-            help: "Direct Postgres connection (superuser) for psql / ORMs. Published on port 5432."
+            help: "Direct Postgres connection (superuser) reachable over this project's shared network. Connect another project to Supabase to inject it automatically."
           },
           {
             id: "dbPassword",
@@ -3099,7 +3859,8 @@ var catalog_default = {
           service: "db",
           port: 5432,
           label: "Database",
-          kind: "tcp"
+          kind: "tcp",
+          scope: "internal"
         }
       ],
       settings: [
@@ -3192,12 +3953,8 @@ var catalog_default = {
           },
           healthcheck: {
             test: [
-              "CMD",
-              "wget",
-              "--no-verbose",
-              "--tries=1",
-              "--spider",
-              "http://localhost:8081/"
+              "CMD-SHELL",
+              'wget -q -S --spider http://127.0.0.1:8081/ 2>&1 | grep -q "HTTP/"'
             ],
             interval: "10s",
             timeout: "5s",
@@ -3241,6 +3998,7 @@ var catalog_default = {
             id: "admin",
             label: "Mongo Express",
             source: "publicUrl:mongo-express",
+            kind: "url",
             envKey: "MONGO_EXPRESS_URL",
             help: "Sign in with the username + password below."
           },
@@ -3299,6 +4057,7 @@ var catalog_default = {
       id: "convex",
       name: "Convex",
       description: "Self-hosted Convex reactive backend + dashboard, with a persistent data volume.",
+      repository: "https://github.com/get-convex/convex-backend",
       kind: "template",
       logo: "convex",
       category: "backend",
@@ -3311,7 +4070,7 @@ var catalog_default = {
       services: [
         {
           name: "backend",
-          image: "ghcr.io/get-convex/convex-backend:latest",
+          image: "ghcr.io/get-convex/convex-backend:19431ea0dd90bc55ae58dbbd06d9aa045f97336f",
           ports: [
             "3210:3210",
             "3211:3211"
@@ -3353,7 +4112,7 @@ var catalog_default = {
         },
         {
           name: "dashboard",
-          image: "ghcr.io/get-convex/convex-dashboard:latest",
+          image: "ghcr.io/get-convex/convex-dashboard:19431ea0dd90bc55ae58dbbd06d9aa045f97336f",
           ports: [
             "6791:6791"
           ],
@@ -3386,21 +4145,32 @@ var catalog_default = {
           service: "backend",
           command: "./generate_admin_key.sh",
           capture: "adminKey",
-          capturePattern: "Admin key:\\s*(\\S+)",
+          capturePattern: "([^\\r\\n]+)\\s*$",
           persistAs: {
             key: "CONVEX_ADMIN_KEY"
           },
-          once: true
+          once: true,
+          title: "Generate admin key",
+          description: "Mint the dashboard and CLI admin key from the instance secret.",
+          icon: "key"
         }
       ],
       connection: {
         title: "Connect to this deployment",
         description: "Sign in to the Convex dashboard, or point the Convex CLI here, with these values.",
         outputs: [
+          {
+            id: "dashboard",
+            label: "Dashboard URL",
+            source: "publicUrl:dashboard",
+            kind: "url",
+            help: "Open the Convex dashboard UI, then sign in with the deployment URL and admin key below."
+          },
           {
             id: "url",
             label: "Deployment URL",
-            source: "env:backend:CONVEX_CLOUD_ORIGIN"
+            source: "env:backend:CONVEX_CLOUD_ORIGIN",
+            kind: "url"
           },
           {
             id: "adminKey",
@@ -3779,7 +4549,23 @@ var catalog_default = {
           ],
           restart: "unless-stopped"
         }
-      ]
+      ],
+      connection: {
+        title: "Sign in to Grafana",
+        outputs: [
+          {
+            id: "url",
+            label: "URL",
+            source: "publicUrl:grafana",
+            kind: "url"
+          }
+        ],
+        firstLogin: {
+          username: "admin",
+          password: "admin",
+          note: "Change the admin password right after your first login."
+        }
+      }
     },
     {
       available: false,
@@ -4060,7 +4846,7 @@ var catalog_default = {
       verified: true,
       id: "minio",
       name: "MinIO",
-      description: "S3-compatible object storage with a web console \u2014 point any S3 client (aws-cli, SDKs) at it.",
+      description: "S3-compatible object storage with a web console \u2014 point any S3 client (aws-cli, SDKs) at it, or bind a bucket straight into another project's uploads.",
       kind: "template",
       logo: "minio",
       category: "database",
@@ -4119,6 +4905,29 @@ var catalog_default = {
           help: "Auto-generated. The S3 admin secret \u2014 shown once after install.",
           generate: "secret",
           secret: true
+        },
+        {
+          key: "OPENSHIP_BUCKET",
+          service: "minio",
+          label: "First bucket",
+          help: "Created on the first deploy so an app can use this storage immediately. More can be added from the console.",
+          type: "text",
+          default: "uploads",
+          required: true
+        }
+      ],
+      prepare: [
+        {
+          service: "minio",
+          command: `mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null && mc mb --ignore-existing "local/$OPENSHIP_BUCKET" > /dev/null && printf '%s' "$OPENSHIP_BUCKET"`,
+          capture: "bucket",
+          phase: "post-ready",
+          readiness: {
+            test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
+            interval: 1e3,
+            retries: 30
+          },
+          once: true
         }
       ],
       endpoints: [
@@ -4142,26 +4951,60 @@ var catalog_default = {
           {
             id: "console",
             label: "Console",
-            source: "publicUrl:minio:9001"
+            source: "publicUrl:minio:9001",
+            kind: "url"
           },
           {
             id: "endpoint",
             label: "S3 endpoint",
-            source: "publicUrl:minio:9000"
+            source: "publicUrl:minio:9000",
+            service: "minio",
+            envKey: "S3_ENDPOINT",
+            recommended: true
           },
           {
             id: "accessKey",
             label: "Access key",
-            source: "env:minio:MINIO_ROOT_USER"
+            source: "env:minio:MINIO_ROOT_USER",
+            service: "minio",
+            envKey: "S3_ACCESS_KEY_ID",
+            recommended: true
           },
           {
             id: "secretKey",
             label: "Secret key",
             source: "env:minio:MINIO_ROOT_PASSWORD",
-            secret: true
+            service: "minio",
+            envKey: "S3_SECRET_ACCESS_KEY",
+            secret: true,
+            recommended: true
+          },
+          {
+            id: "bucket",
+            label: "Bucket",
+            source: "env:minio:OPENSHIP_BUCKET",
+            service: "minio",
+            envKey: "S3_BUCKET"
           }
-        ]
-      }
+        ],
+        guide: {
+          intro: "Your app gets an S3-compatible bucket it can write uploads to.",
+          useHint: "Bind it from the consuming project's Configuration \u2192 Object storage to get the framework's own env names (Laravel gets FILESYSTEM_DISK + AWS_*), or wire these values by hand.",
+          defaultMode: "internal"
+        }
+      },
+      provides: [
+        {
+          id: "s3",
+          outputRefs: [
+            "endpoint",
+            "accessKey",
+            "secretKey",
+            "bucket"
+          ],
+          category: "database"
+        }
+      ]
     },
     {
       available: true,
@@ -4255,6 +5098,7 @@ var catalog_default = {
             id: "ui",
             label: "Kafka UI",
             source: "publicUrl:kafka-ui",
+            kind: "url",
             help: "Sign in with the username + password below."
           },
           {
@@ -4347,6 +5191,7 @@ var catalog_default = {
             id: "ui",
             label: "Qdrant Web UI",
             source: "publicUrl:qdrant",
+            kind: "url",
             help: "The dashboard is at this URL under /dashboard. Paste the API key when it asks."
           },
           {
@@ -18933,6 +19778,7 @@ var configField = external_exports.object({
   required: external_exports.boolean().optional(),
   secret: external_exports.boolean().optional()
 });
+var localized = external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]);
 var prepareStep = external_exports.object({
   service: external_exports.string(),
   command: external_exports.string(),
@@ -18942,7 +19788,12 @@ var prepareStep = external_exports.object({
   once: external_exports.boolean().optional(),
   phase: external_exports.enum(["pre-deploy", "post-start", "post-ready"]).optional(),
   mustSucceed: external_exports.boolean().optional(),
-  readiness: external_exports.object({ test: external_exports.string(), interval: external_exports.number().optional(), retries: external_exports.number().optional() }).optional()
+  readiness: external_exports.object({ test: external_exports.string(), interval: external_exports.number().optional(), retries: external_exports.number().optional() }).optional(),
+  // Authored display copy for the install stepper's "app-setup" sub-steps. Purely
+  // presentational; absent → the renderer uses a generic label.
+  title: localized.optional(),
+  description: localized.optional(),
+  icon: external_exports.string().optional()
 });
 var outputVariant = external_exports.object({
   id: external_exports.string(),
@@ -18967,7 +19818,11 @@ var connection = external_exports.object({
       recommended: external_exports.boolean().optional(),
       sourceLabel: external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]).optional(),
       variants: external_exports.array(outputVariant).optional(),
-      width: external_exports.enum(["full", "half"]).optional()
+      width: external_exports.enum(["full", "half"]).optional(),
+      /** "url" marks the resolved value as an openable link — the Connection
+       *  card shows an Open-in-new-tab action beside it. Enforced only for a
+       *  resolved http(s) value (checked at render); default "text". Additive. */
+      kind: external_exports.enum(["text", "url"]).optional()
     })
   ),
   guide: external_exports.object({
@@ -18975,6 +19830,14 @@ var connection = external_exports.object({
     intro: external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]).optional(),
     useHint: external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]).optional(),
     defaultMode: external_exports.enum(["internal", "public"]).optional()
+  }).optional(),
+  // Static default credentials the app ships with (e.g. Grafana admin/admin).
+  // These are FIXED values, not derived from a service env, so they can't live in
+  // `outputs` (whose values resolve from running services) — hence their own field.
+  firstLogin: external_exports.object({
+    username: localized.optional(),
+    password: localized.optional(),
+    note: localized.optional()
   }).optional()
 });
 var endpointMode = external_exports.enum(["domain", "port", "publish", "internal"]);
@@ -18988,7 +19851,6 @@ var endpoint = external_exports.object({
   defaultMode: endpointMode.optional(),
   allowedModes: external_exports.array(endpointMode).optional()
 });
-var localized = external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]);
 var provides = external_exports.object({
   id: external_exports.string(),
   outputRefs: external_exports.array(external_exports.string()),
@@ -19073,7 +19935,8 @@ var appTemplateSchema = external_exports.object({
   // Versioning / compat gate (see parseAppTemplate).
   schemaVersion: external_exports.number().optional(),
   minEngine: external_exports.string().optional(),
-  updatedAt: external_exports.string().optional()
+  updatedAt: external_exports.string().optional(),
+  repository: external_exports.string().url().optional()
 }).superRefine((data, ctx) => {
   const svcNames = new Set((data.services ?? []).map((s) => s.name));
   const refSvc = (service, path, where) => {
@@ -19136,6 +19999,757 @@ function cliInstallCommand(pm, version2) {
   return pm === "bun" ? `bun add -g ${ref}` : `npm install -g ${ref}`;
 }
 
+// ../../packages/core/src/audit-taxonomy.ts
+var AUDIT_CATEGORIES = [
+  {
+    id: "deployments",
+    label: "Deployments",
+    description: "Builds and releases \u2014 what shipped, what failed, what was cancelled."
+  },
+  {
+    id: "apps",
+    label: "Apps & services",
+    description: "Projects, the services inside them, and their runtime health."
+  },
+  {
+    id: "domains",
+    label: "Domains & SSL",
+    description: "Custom domains, DNS verification, and certificates."
+  },
+  {
+    id: "servers",
+    label: "Servers",
+    description: "Deployment targets, their configuration, and shell access."
+  },
+  {
+    id: "members",
+    label: "Members & access",
+    description: "Who is in this organization and what they are allowed to do."
+  },
+  {
+    id: "security",
+    label: "Security",
+    description: "Admin credentials, auth mode, data export, and audit recording itself."
+  },
+  {
+    id: "billing",
+    label: "Billing",
+    description: "Subscriptions, credits, spending caps, and quota thresholds."
+  },
+  {
+    id: "system",
+    label: "System",
+    description: "Settings, integrations, notifications, backups, and instance maintenance."
+  }
+];
+var AUDIT_EVENTS = {
+  /* ---------------- Deployments ---------------- */
+  "deployment.succeeded": {
+    category: "deployments",
+    action: "deployed",
+    label: "Deploy succeeded",
+    tone: "success",
+    description: "A deployment finished successfully and is serving traffic."
+  },
+  "deployment.failed": {
+    category: "deployments",
+    action: "failed to deploy",
+    label: "Deploy failed",
+    tone: "danger",
+    description: "A deployment errored out before reaching a healthy state."
+  },
+  "deployment.cancelled": {
+    category: "deployments",
+    action: "cancelled the deploy of",
+    label: "Deploy cancelled",
+    tone: "warning",
+    description: "A deployment was stopped before it finished."
+  },
+  "deployment:write": {
+    category: "deployments",
+    action: "started a deploy for",
+    label: "Deploy action",
+    description: "A deployment endpoint was invoked \u2014 start, retry, rollback, or promote."
+  },
+  "deployment:admin": {
+    category: "deployments",
+    action: "ran an admin action on the deploy for",
+    label: "Deploy admin action",
+    tone: "warning",
+    description: "A destructive deployment endpoint was invoked, such as cancel or destroy."
+  },
+  /* ---------------- Apps & services ---------------- */
+  "project.created": {
+    category: "apps",
+    action: "created",
+    label: "App created",
+    tone: "info"
+  },
+  "project.updated": {
+    category: "apps",
+    action: "updated",
+    label: "App updated",
+    description: "Settings, services, environment variables, or routing were changed."
+  },
+  "project.deleted": {
+    category: "apps",
+    action: "deleted",
+    label: "App deleted",
+    tone: "danger"
+  },
+  "project.deletion.rejected": {
+    category: "apps",
+    action: "tried to delete",
+    label: "App deletion refused",
+    tone: "warning",
+    description: "A delete was refused \u2014 something still depends on this app."
+  },
+  "project:write": {
+    category: "apps",
+    action: "changed",
+    label: "App changed",
+    description: "One of the app's write endpoints was invoked."
+  },
+  "project:admin": {
+    category: "apps",
+    action: "ran an admin action on",
+    label: "App admin action",
+    tone: "warning",
+    description: "A destructive app endpoint was invoked, such as delete or transfer."
+  },
+  "project:service:write": {
+    category: "apps",
+    action: "changed a service in",
+    label: "Service changed",
+    description: "A service was created, updated, started, stopped, or restarted."
+  },
+  "project:service:admin": {
+    category: "apps",
+    action: "ran an admin action on a service in",
+    label: "Service admin action",
+    tone: "warning"
+  },
+  "job:write": {
+    category: "apps",
+    action: "changed the job",
+    label: "Job changed",
+    description: "A scheduled or custom job was created, edited, run, or removed."
+  },
+  "job_run.started": {
+    category: "apps",
+    action: "started the job",
+    label: "Job started"
+  },
+  "job_run.succeeded": {
+    category: "apps",
+    action: "ran the job",
+    label: "Job succeeded",
+    tone: "success"
+  },
+  "job_run.failed": {
+    category: "apps",
+    action: "ran the failing job",
+    label: "Job failed",
+    tone: "danger"
+  },
+  // Written by the health watcher, never by a person — these only ever render
+  // through `label`.
+  "service.down": {
+    category: "apps",
+    action: "reported down",
+    label: "App went down",
+    tone: "danger",
+    description: "A container that should be running isn't \u2014 exited, dead, or OOM-killed."
+  },
+  "service.crash_loop": {
+    category: "apps",
+    action: "reported crash looping",
+    label: "App is crash looping",
+    tone: "danger",
+    description: "A container keeps restarting instead of staying up."
+  },
+  "service.unhealthy": {
+    category: "apps",
+    action: "reported unhealthy",
+    label: "App is unhealthy",
+    tone: "warning",
+    description: "A container is running but its own healthcheck is failing."
+  },
+  "service.recovered": {
+    category: "apps",
+    action: "reported recovered",
+    label: "App recovered",
+    tone: "success",
+    description: "An outage ended and the container is healthy again."
+  },
+  /* ---------------- Domains & SSL ---------------- */
+  "domain.added": {
+    category: "domains",
+    action: "added the domain",
+    label: "Domain added",
+    tone: "info"
+  },
+  "domain.removed": {
+    category: "domains",
+    action: "removed the domain",
+    label: "Domain removed",
+    tone: "danger"
+  },
+  "domain.verified": {
+    category: "domains",
+    action: "verified the domain",
+    label: "Domain verified",
+    tone: "success",
+    description: "DNS verification succeeded, so the domain can be issued a certificate."
+  },
+  "domain.verification_failed": {
+    category: "domains",
+    action: "failed to verify the domain",
+    label: "Domain verification failed",
+    tone: "warning",
+    description: "DNS records for this domain don't point here yet."
+  },
+  "domain.set_primary": {
+    category: "domains",
+    action: "made primary the domain",
+    label: "Primary domain changed",
+    description: "The domain other addresses now redirect to."
+  },
+  "domain.cert_uploaded": {
+    category: "domains",
+    action: "uploaded a certificate for",
+    label: "Certificate uploaded",
+    description: "A certificate and key were supplied by hand instead of issued automatically."
+  },
+  "ssl.renewal_failed": {
+    category: "domains",
+    action: "failed to renew SSL for",
+    label: "SSL renewal failed",
+    tone: "danger",
+    description: "Automatic renewal failed \u2014 the certificate will expire unless this is fixed."
+  },
+  "domain:write": {
+    category: "domains",
+    action: "changed the domain",
+    label: "Domain action",
+    description: "A domain endpoint was invoked \u2014 add, verify, or renew."
+  },
+  "domain:admin": {
+    category: "domains",
+    action: "ran an admin action on the domain",
+    label: "Domain admin action",
+    tone: "warning"
+  },
+  /* ---------------- Servers ---------------- */
+  "server.added": {
+    category: "servers",
+    action: "added the server",
+    label: "Server added",
+    tone: "info"
+  },
+  "server.updated": {
+    category: "servers",
+    action: "updated the server",
+    label: "Server updated"
+  },
+  "server.removed": {
+    category: "servers",
+    action: "removed the server",
+    label: "Server removed",
+    tone: "danger"
+  },
+  "server.unreachable": {
+    category: "servers",
+    action: "reported unreachable",
+    label: "Server unreachable",
+    tone: "danger",
+    description: "Openship could not open an SSH connection to this server."
+  },
+  "server.reachable": {
+    category: "servers",
+    action: "reported reachable",
+    label: "Server reachable again",
+    tone: "success"
+  },
+  "server:write": {
+    category: "servers",
+    action: "changed the server",
+    label: "Server changed"
+  },
+  "server:admin": {
+    category: "servers",
+    action: "ran an admin action on the server",
+    label: "Server admin action",
+    tone: "warning",
+    description: "A destructive server endpoint was invoked, such as delete or component install."
+  },
+  "terminal:write": {
+    category: "servers",
+    action: "opened a terminal on",
+    label: "Terminal session opened",
+    tone: "warning",
+    description: "An interactive shell session was issued against a server."
+  },
+  "mail_server:write": {
+    category: "servers",
+    action: "changed the mail server",
+    label: "Mail server changed",
+    description: "A mail server endpoint was invoked \u2014 setup, domain, DNS acknowledgement."
+  },
+  "mail_server:admin": {
+    category: "servers",
+    action: "ran an admin action on the mail server",
+    label: "Mail server admin action",
+    tone: "warning"
+  },
+  /* ---------------- Members & access ---------------- */
+  "organization.created": {
+    category: "members",
+    action: "created the organization",
+    label: "Organization created",
+    tone: "info"
+  },
+  "organization.deleted": {
+    category: "members",
+    action: "deleted the organization",
+    label: "Organization deleted",
+    tone: "danger"
+  },
+  "organization.deletion.blocked": {
+    category: "members",
+    action: "tried to delete the organization",
+    label: "Organization deletion blocked",
+    tone: "warning",
+    description: "Deletion was refused \u2014 active resources or billing still attached."
+  },
+  "member.added": {
+    category: "members",
+    action: "added",
+    label: "Member added",
+    tone: "info"
+  },
+  "member.removed": {
+    category: "members",
+    action: "removed",
+    label: "Member removed",
+    tone: "danger"
+  },
+  "member.role_changed": {
+    category: "members",
+    action: "changed the role of",
+    label: "Member role changed",
+    tone: "warning"
+  },
+  "member.joined": {
+    category: "members",
+    action: "joined",
+    label: "Member joined",
+    tone: "success",
+    description: "An invitee accepted and now has access."
+  },
+  "member.invited": {
+    category: "members",
+    action: "invited",
+    label: "Member invited",
+    tone: "info"
+  },
+  "member.removal.grant_cleanup_failed": {
+    category: "members",
+    action: "removed, with leftover permissions,",
+    label: "Removed member's permissions not cleaned up",
+    tone: "warning",
+    description: "The member is gone but their permission grants remained \u2014 review by hand."
+  },
+  "member.removal.subscription_cleanup_failed": {
+    category: "members",
+    action: "removed, with leftover billing,",
+    label: "Removed member's billing not cleaned up",
+    tone: "warning",
+    description: "The member is gone but a linked subscription remained \u2014 review billing."
+  },
+  "invitation.created": {
+    category: "members",
+    action: "invited",
+    label: "Invitation sent",
+    tone: "info"
+  },
+  "invitation.sent": {
+    category: "members",
+    action: "invited, with pending permissions,",
+    label: "Invitation sent with pending permissions",
+    tone: "info",
+    description: "Grants were queued and will apply the moment the invitee joins."
+  },
+  "invitation.accepted": {
+    category: "members",
+    action: "accepted the invitation of",
+    label: "Invitation accepted",
+    tone: "success"
+  },
+  "invitation.rejected": {
+    category: "members",
+    action: "declined the invitation of",
+    label: "Invitation declined",
+    tone: "warning"
+  },
+  "invitation.cancelled": {
+    category: "members",
+    action: "cancelled the invitation for",
+    label: "Invitation cancelled",
+    tone: "warning"
+  },
+  "team.created": {
+    category: "members",
+    action: "created the team",
+    label: "Team created",
+    tone: "info"
+  },
+  "grant.granted": {
+    category: "members",
+    action: "granted permissions to",
+    label: "Permission granted",
+    tone: "info"
+  },
+  "grant.revoked": {
+    category: "members",
+    action: "revoked permissions from",
+    label: "Permission revoked",
+    tone: "danger"
+  },
+  "grant.replaced": {
+    category: "members",
+    action: "replaced the permissions of",
+    label: "Permission replaced",
+    tone: "warning",
+    description: "An existing grant was overwritten with a different scope."
+  },
+  "grant.materialized": {
+    category: "members",
+    action: "received their pending permissions,",
+    label: "Pending permission applied",
+    description: "A grant attached to an invitation was applied once the invitee joined."
+  },
+  "permissions:write": {
+    category: "members",
+    action: "changed permissions for",
+    label: "Permissions changed",
+    tone: "warning"
+  },
+  "permissions:admin": {
+    category: "members",
+    action: "ran an admin action on permissions for",
+    label: "Permissions admin action",
+    tone: "warning"
+  },
+  /* ---------------- Security ---------------- */
+  "admin.bootstrapped": {
+    category: "security",
+    action: "bootstrapped the first admin account",
+    label: "First admin account created",
+    tone: "warning",
+    description: "The instance's initial owner was created \u2014 this can only happen once."
+  },
+  "admin.password_reset": {
+    category: "security",
+    action: "reset an admin password",
+    label: "Admin password reset",
+    tone: "danger"
+  },
+  "auth-mode-changed": {
+    category: "security",
+    action: "changed the sign-in mode",
+    label: "Sign-in mode changed",
+    tone: "danger",
+    description: "The instance switched between single-user and full authentication."
+  },
+  "instance.data.exported": {
+    category: "security",
+    action: "exported all instance data",
+    label: "Instance data exported",
+    tone: "warning",
+    description: "A full database dump left this instance."
+  },
+  "instance.data.imported": {
+    category: "security",
+    action: "imported instance data",
+    label: "Instance data imported",
+    tone: "warning",
+    description: "A database dump from another instance was loaded in."
+  },
+  // Written by the audit module itself. "disabled" is recorded before the switch
+  // flips, so turning recording off always leaves this one row behind.
+  "audit.disabled": {
+    category: "security",
+    action: "turned off activity recording",
+    label: "Activity recording turned off",
+    tone: "danger",
+    description: "No further actions were recorded until recording was turned back on."
+  },
+  "audit.enabled": {
+    category: "security",
+    action: "turned on activity recording",
+    label: "Activity recording turned on",
+    tone: "success"
+  },
+  "audit.retention_changed": {
+    category: "security",
+    action: "changed how long activity is kept",
+    label: "Activity retention changed",
+    tone: "warning"
+  },
+  "audit:write": {
+    category: "security",
+    action: "changed activity recording",
+    label: "Activity settings changed",
+    tone: "warning"
+  },
+  /* ---------------- Billing ---------------- */
+  "billing.hard_cap_tripped": {
+    category: "billing",
+    action: "hit the spending cap for",
+    label: "Spending cap reached",
+    tone: "danger",
+    description: "Cloud resources may have been paused \u2014 review billing."
+  },
+  "billing.credit_exhausted": {
+    category: "billing",
+    action: "ran out of credits for",
+    label: "Credits exhausted",
+    tone: "warning",
+    description: "Metered usage is paused until a top-up or the monthly reset."
+  },
+  "billing.credit_restored": {
+    category: "billing",
+    action: "restored credits for",
+    label: "Credits restored",
+    tone: "success"
+  },
+  "billing.anniversary_reset": {
+    category: "billing",
+    action: "reset the monthly credits of",
+    label: "Monthly credits reset"
+  },
+  "quota.threshold_fired": {
+    category: "billing",
+    action: "crossed a usage threshold on",
+    label: "Usage threshold crossed",
+    tone: "warning"
+  },
+  "billing:write": {
+    category: "billing",
+    action: "changed billing for",
+    label: "Billing action",
+    description: "A billing endpoint was invoked \u2014 subscribe, top up, or open the portal."
+  },
+  "billing:admin": {
+    category: "billing",
+    action: "ran an admin action on billing for",
+    label: "Billing admin action",
+    tone: "warning",
+    description: "A destructive billing endpoint was invoked, such as cancelling a subscription."
+  },
+  /* ---------------- System ---------------- */
+  "settings.updated": {
+    category: "system",
+    action: "updated settings",
+    label: "Settings updated"
+  },
+  "settings:write": {
+    category: "system",
+    action: "changed settings",
+    label: "Settings changed"
+  },
+  "settings:admin": {
+    category: "system",
+    action: "ran an admin action on settings",
+    label: "Settings admin action",
+    tone: "warning",
+    description: "A destructive settings endpoint was invoked, such as a wipe or migration."
+  },
+  "updates:write": {
+    category: "system",
+    action: "applied an update",
+    label: "Update applied",
+    description: "An Openship component was updated or an update scan was triggered."
+  },
+  "cloud.disconnect": {
+    category: "system",
+    action: "disconnected from Openship Cloud",
+    label: "Cloud disconnected",
+    tone: "warning"
+  },
+  "cloud:write": {
+    category: "system",
+    action: "ran a cloud action",
+    label: "Cloud action",
+    description: "A cloud bridge endpoint was invoked \u2014 token, preflight, or edge proxy."
+  },
+  "cloud:admin": {
+    category: "system",
+    action: "ran a cloud admin action",
+    label: "Cloud admin action",
+    tone: "warning"
+  },
+  "github.install": {
+    category: "system",
+    action: "installed the GitHub app on",
+    label: "GitHub app installed",
+    tone: "info"
+  },
+  "github.disconnect": {
+    category: "system",
+    action: "disconnected GitHub from",
+    label: "GitHub disconnected",
+    tone: "warning"
+  },
+  "github.repo.create": {
+    category: "system",
+    action: "created the repository",
+    label: "Repository created",
+    tone: "info"
+  },
+  "github.repo.delete": {
+    category: "system",
+    action: "deleted the repository",
+    label: "Repository deleted",
+    tone: "danger"
+  },
+  "github.webhook.register": {
+    category: "system",
+    action: "enabled deploy-on-push for",
+    label: "Deploy-on-push enabled",
+    tone: "info"
+  },
+  "github.webhook.delete": {
+    category: "system",
+    action: "disabled deploy-on-push for",
+    label: "Deploy-on-push disabled",
+    tone: "warning"
+  },
+  "github.instance_token.set": {
+    category: "system",
+    action: "set the instance GitHub token",
+    label: "Instance GitHub token set",
+    tone: "warning",
+    description: "A GitHub token shared by every project on this instance was stored."
+  },
+  "github:write": {
+    category: "system",
+    action: "changed a GitHub connection for",
+    label: "GitHub action"
+  },
+  "github:admin": {
+    category: "system",
+    action: "ran a GitHub admin action on",
+    label: "GitHub admin action",
+    tone: "warning"
+  },
+  "notification_channel.created": {
+    category: "system",
+    action: "added the notification channel",
+    label: "Notification channel added",
+    tone: "info"
+  },
+  "notification_channel.updated": {
+    category: "system",
+    action: "updated the notification channel",
+    label: "Notification channel updated"
+  },
+  "notification_channel.deleted": {
+    category: "system",
+    action: "removed the notification channel",
+    label: "Notification channel removed",
+    tone: "warning"
+  },
+  "notification_subscription.updated": {
+    category: "system",
+    action: "changed what is sent to",
+    label: "Notification subscription changed"
+  },
+  "notification_subscription.deleted": {
+    category: "system",
+    action: "stopped notifications to",
+    label: "Notification subscription removed",
+    tone: "warning"
+  },
+  "notification_default.updated": {
+    category: "system",
+    action: "changed the notification defaults of",
+    label: "Notification defaults changed"
+  },
+  "notifications:write": {
+    category: "system",
+    action: "changed notifications",
+    label: "Notifications changed"
+  },
+  "notifications:admin": {
+    category: "system",
+    action: "ran a notifications admin action",
+    label: "Notifications admin action",
+    tone: "warning"
+  },
+  "backup_run.succeeded": {
+    category: "system",
+    action: "backed up",
+    label: "Backup succeeded",
+    tone: "success"
+  },
+  "backup_run.failed": {
+    category: "system",
+    action: "failed to back up",
+    label: "Backup failed",
+    tone: "danger"
+  },
+  "backup.webhook.fired": {
+    category: "system",
+    action: "triggered a backup of",
+    label: "Backup triggered by webhook"
+  },
+  "backup.webhook.disabled": {
+    category: "system",
+    action: "disabled the backup webhook for",
+    label: "Backup webhook disabled",
+    tone: "warning",
+    description: "The webhook failed too many times and was switched off."
+  },
+  "backup_destination:write": {
+    category: "system",
+    action: "changed the backup destination",
+    label: "Backup destination changed"
+  },
+  "backup_destination:admin": {
+    category: "system",
+    action: "ran an admin action on the backup destination",
+    label: "Backup destination admin action",
+    tone: "warning"
+  },
+  "backup_destination:backup_policy:write": {
+    category: "system",
+    action: "changed the backup schedule of",
+    label: "Backup schedule changed"
+  },
+  "backup_destination:backup_run:write": {
+    category: "system",
+    action: "ran a backup of",
+    label: "Backup run"
+  },
+  "backup_destination:backup_restore:write": {
+    category: "system",
+    action: "restored from a backup of",
+    label: "Restore from backup",
+    tone: "warning"
+  }
+};
+var CATEGORY_IDS = new Set(AUDIT_CATEGORIES.map((c) => c.id));
+var EVENT_TYPES_BY_CATEGORY = (() => {
+  const map2 = {};
+  for (const id of CATEGORY_IDS) map2[id] = [];
+  for (const [eventType, def] of Object.entries(AUDIT_EVENTS)) {
+    map2[def.category]?.push(eventType);
+  }
+  return map2;
+})();
+
 export {
   LANGUAGES,
   STACKS,
@@ -19143,9 +20757,15 @@ export {
   buildOutputTransferExcludes,
   PACKAGE_ROOT_ONLY_EXCLUDES,
   packageManagerEnsureCommand,
+  appVolumeTargets,
+  isAwsS3Endpoint,
   DEFAULT_IMAGE_REGISTRY,
+  shellSplitWords,
+  commandToArgv,
   buildEdgeImageRef,
+  buildMailImageRef,
   SYSTEM,
+  resolveRedirectStatus,
   isValidEmail,
   formatBytes,
   withTimeout,
@@ -19155,11 +20775,17 @@ export {
   LOCAL_DASHBOARD_URL,
   LOCAL_API_URL,
   CLOUD_DASHBOARD_URL,
+  hasCpuLimit,
+  hasMemoryLimit,
+  formatMemoryMb,
+  formatCpuCores,
   parseOpenshipConfigJson,
   missingOutputDirectoryMessage,
   compareSemver,
   resolveCliUpdatePlan,
   cliInstallCommand,
-  PROXY_GZIP_TYPES,
-  sanitizeProxySettings
+  PROXY_DIRECTIVES,
+  sanitizeProxySettings,
+  resolveProxyDirectives,
+  parseProxyValue
 };