openship 0.5.0 → 0.6.0

package/dist/{chunk-UMQP7SYT.js → chunk-OTLSJYAC.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env sh
-":" //# ; exec "$(command -v bun || command -v node)" "$0" "$@"
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   __export
-} from "./chunk-KI2EY3WB.js";
+} from "./chunk-PXKCZB2I.js";
 
 // ../../packages/core/src/stacks.ts
 var LANGUAGES = {
@@ -153,6 +153,34 @@ var STACKS = {
       deps: ["@remix-run/react", "@remix-run/node", "remix"]
     }
   },
+  "tanstack-start": {
+    name: "TanStack Start",
+    language: "typescript",
+    category: "fullstack",
+    outputDirectory: ".output",
+    defaultPort: 3e3,
+    defaultBuildCommand: "vite build",
+    defaultStartCommand: "node .output/server/index.mjs",
+    // Nitro/Vinxi server bundle is self-contained under .output — same shape as Nuxt.
+    productionPaths: [".output"],
+    detection: {
+      // TanStack Start is Vite/Rsbuild-based; app.config.* is the older
+      // framework-specific marker, while current apps commonly ship vite.config.*
+      // or rsbuild.config.* plus the start package dep.
+      rootMarkers: [
+        "app.config.ts",
+        "app.config.js",
+        "app.config.mjs",
+        "vite.config.ts",
+        "vite.config.js",
+        "vite.config.mjs",
+        "rsbuild.config.ts",
+        "rsbuild.config.js",
+        "rsbuild.config.mjs"
+      ],
+      deps: ["@tanstack/react-start", "@tanstack/start"]
+    }
+  },
   astro: {
     name: "Astro",
     language: "typescript",
@@ -810,6 +838,7 @@ var STACK_ICONS = {
   nuxt: `${DI}/nuxtjs/nuxtjs-original.svg`,
   sveltekit: `${DI}/svelte/svelte-original.svg`,
   remix: `${DI}/react/react-original.svg`,
+  "tanstack-start": `${DI}/react/react-original.svg`,
   astro: `${DI}/astro/astro-original.svg`,
   vite: `${DI}/vitejs/vitejs-original.svg`,
   angular: `${DI}/angular/angular-original.svg`,
@@ -1012,17 +1041,26 @@ var CREDIT_PACKS = [
   }
 ];
 
-// ../../packages/core/src/edge-image-ref.ts
-function buildEdgeImageRef(opts) {
+// ../../packages/core/src/image-ref.ts
+function buildImageRef(opts, image) {
   const explicit = opts?.explicit?.trim();
   if (explicit) return explicit;
-  const override = process.env.OPENSHIP_EDGE_IMAGE?.trim();
+  const override = image.imageOverride?.trim();
   if (override) return override;
   const injected = opts?.injectedDefault?.trim();
   if (injected) return injected;
   const registry2 = process.env.OPENSHIP_IMAGE_REGISTRY?.trim() || DEFAULT_IMAGE_REGISTRY;
-  const tag = process.env.OPENSHIP_EDGE_TAG?.trim() || process.env.OPENSHIP_VERSION?.trim() || opts?.fallbackTag?.trim() || "latest";
-  return `${registry2}/openship-edge:${tag}`;
+  const tag = image.tagOverride?.trim() || process.env.OPENSHIP_VERSION?.trim() || opts?.fallbackTag?.trim() || "latest";
+  return `${registry2}/${image.name}:${tag}`;
+}
+
+// ../../packages/core/src/edge-image-ref.ts
+function buildEdgeImageRef(opts) {
+  return buildImageRef(opts, {
+    name: "openship-edge",
+    imageOverride: process.env.OPENSHIP_EDGE_IMAGE,
+    tagOverride: process.env.OPENSHIP_EDGE_TAG
+  });
 }
 
 // ../../packages/core/src/system.ts
@@ -1096,6 +1134,12 @@ var SYSTEM = {
     // 4 hours
     /** Keep-alive heartbeat interval (ms) - prevents proxy/CDN drops */
     HEARTBEAT_INTERVAL_MS: 25e3,
+    /**
+     * How long a finished handler waits for already-queued frames to flush
+     * before the stream closes. Bounded because a client that has gone away
+     * never drains, and that must not hold the response open.
+     */
+    TERMINAL_DRAIN_TIMEOUT_MS: 5e3,
     /** Maximum active sessions in the cache */
     MAX_SESSIONS: 500,
     /** Background sweep interval for stale sessions (ms) */
@@ -1997,29 +2041,219 @@ var METADATA_FILES = new Set(
 );
 
 // ../../packages/core/src/proxy-settings.ts
-var PROXY_SIZE_RE = /^[1-9][0-9]*(k|m|g)$/;
+var PROXY_SIZE_RE = /^(0|[1-9][0-9]*(k|m|g))$/;
 var PROXY_TIME_RE = /^[1-9][0-9]*(s|m|h)$/;
+var PROXY_BUFFERS_RE = /^[1-9][0-9]* [1-9][0-9]*(k|m|g)?$/;
 var PROXY_GZIP_TYPES = "text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml";
-var PROXY_STRING_FIELD_RE = {
-  clientMaxBodySize: PROXY_SIZE_RE,
-  proxyReadTimeout: PROXY_TIME_RE,
-  proxySendTimeout: PROXY_TIME_RE,
-  clientBodyTimeout: PROXY_TIME_RE
-};
+var PROXY_DIRECTIVES = [
+  // ── Request body ────────────────────────────────────────────────────────
+  { key: "clientMaxBodySize", directive: "client_max_body_size", kind: "size", group: "body" },
+  { key: "clientBodyTimeout", directive: "client_body_timeout", kind: "time", group: "body" },
+  {
+    key: "clientBodyBufferSize",
+    directive: "client_body_buffer_size",
+    kind: "size",
+    group: "body"
+  },
+  {
+    key: "proxyRequestBuffering",
+    directive: "proxy_request_buffering",
+    kind: "bool",
+    group: "body"
+  },
+  // ── Upstream timeouts ───────────────────────────────────────────────────
+  { key: "proxyConnectTimeout", directive: "proxy_connect_timeout", kind: "time", group: "timeouts" },
+  { key: "proxyReadTimeout", directive: "proxy_read_timeout", kind: "time", group: "timeouts" },
+  { key: "proxySendTimeout", directive: "proxy_send_timeout", kind: "time", group: "timeouts" },
+  { key: "sendTimeout", directive: "send_timeout", kind: "time", group: "timeouts" },
+  { key: "keepaliveTimeout", directive: "keepalive_timeout", kind: "time", group: "timeouts" },
+  // ── Response buffering ──────────────────────────────────────────────────
+  { key: "proxyBuffering", directive: "proxy_buffering", kind: "bool", group: "buffering" },
+  { key: "proxyBufferSize", directive: "proxy_buffer_size", kind: "size", group: "buffering" },
+  { key: "proxyBuffers", directive: "proxy_buffers", kind: "buffers", group: "buffering" },
+  {
+    key: "proxyBusyBuffersSize",
+    directive: "proxy_busy_buffers_size",
+    kind: "size",
+    group: "buffering"
+  },
+  {
+    key: "proxyMaxTempFileSize",
+    directive: "proxy_max_temp_file_size",
+    kind: "size",
+    group: "buffering"
+  },
+  // ── Compression ─────────────────────────────────────────────────────────
+  {
+    key: "gzip",
+    directive: "gzip",
+    kind: "bool",
+    group: "compression",
+    companionsWhenOn: [
+      `gzip_types ${PROXY_GZIP_TYPES}`,
+      "gzip_vary on",
+      // nginx's own default is 20 bytes, small enough that the gzip header costs
+      // more than the compression saves.
+      "gzip_min_length 1024"
+    ]
+  },
+  {
+    key: "gzipCompLevel",
+    directive: "gzip_comp_level",
+    kind: "int",
+    group: "compression",
+    min: 1,
+    max: 9
+  },
+  // Bytes, as an int — the natural unit here is "1024", and `size` would force "1k".
+  {
+    key: "gzipMinLength",
+    directive: "gzip_min_length",
+    kind: "int",
+    group: "compression",
+    min: 0,
+    max: 10485760
+  },
+  // ── Headers & limits ────────────────────────────────────────────────────
+  {
+    key: "largeClientHeaderBuffers",
+    directive: "large_client_header_buffers",
+    kind: "buffers",
+    group: "headers"
+  },
+  {
+    key: "underscoresInHeaders",
+    directive: "underscores_in_headers",
+    kind: "bool",
+    group: "headers"
+  },
+  { key: "serverTokens", directive: "server_tokens", kind: "bool", group: "headers" },
+  {
+    key: "http2",
+    directive: "http2",
+    kind: "bool",
+    group: "headers",
+    // `http2 on;` at server scope replaced `listen ... http2` in nginx 1.25.1.
+    minNginx: [1, 25, 1],
+    tlsOnly: true
+  },
+  // ── TLS to the upstream ─────────────────────────────────────────────────
+  {
+    key: "proxySslServerName",
+    directive: "proxy_ssl_server_name",
+    kind: "bool",
+    group: "upstreamTls"
+  },
+  { key: "proxySslVerify", directive: "proxy_ssl_verify", kind: "bool", group: "upstreamTls" }
+];
+var PROXY_DIRECTIVE_BY_KEY = new Map(
+  PROXY_DIRECTIVES.map((d) => [d.key, d])
+);
+var PROXY_DIRECTIVE_BY_NAME = new Map(
+  PROXY_DIRECTIVES.map((d) => [d.directive, d])
+);
+function proxyKindRegex(kind) {
+  switch (kind) {
+    case "size":
+      return PROXY_SIZE_RE;
+    case "time":
+      return PROXY_TIME_RE;
+    case "buffers":
+      return PROXY_BUFFERS_RE;
+    default:
+      return void 0;
+  }
+}
+var PROXY_STRING_FIELD_RE = Object.freeze(
+  Object.fromEntries(
+    PROXY_DIRECTIVES.flatMap((d) => {
+      const re = proxyKindRegex(d.kind);
+      return re ? [[d.key, re]] : [];
+    })
+  )
+);
+function coerceProxyValue(spec, value) {
+  if (spec.kind === "bool") return typeof value === "boolean" ? value : void 0;
+  if (spec.kind === "int") {
+    if (typeof value !== "number" || !Number.isInteger(value)) return void 0;
+    if (spec.min !== void 0 && value < spec.min) return void 0;
+    if (spec.max !== void 0 && value > spec.max) return void 0;
+    return value;
+  }
+  const re = proxyKindRegex(spec.kind);
+  if (typeof value !== "string" || !re || !re.test(value)) return void 0;
+  return value;
+}
 function sanitizeProxySettings(input) {
   if (!input || typeof input !== "object") return void 0;
   const src = input;
   const out = {};
-  for (const [key, re] of Object.entries(PROXY_STRING_FIELD_RE)) {
-    const v = src[key];
-    if (typeof v === "string" && re.test(v)) {
-      out[key] = v;
-    }
+  for (const spec of PROXY_DIRECTIVES) {
+    if (!(spec.key in src)) continue;
+    const v = coerceProxyValue(spec, src[spec.key]);
+    if (v !== void 0) out[spec.key] = v;
   }
-  if (typeof src.proxyBuffering === "boolean") out.proxyBuffering = src.proxyBuffering;
-  if (typeof src.gzip === "boolean") out.gzip = src.gzip;
   return Object.keys(out).length > 0 ? out : void 0;
 }
+function renderProxyValue(spec, value) {
+  if (spec.kind === "bool") return value ? "on" : "off";
+  return String(value);
+}
+function proxyDirectiveAllowed(spec, version2) {
+  if (!spec.minNginx || !version2) return true;
+  for (let i = 0; i < 3; i++) {
+    const need = spec.minNginx[i] ?? 0;
+    const have = version2[i] ?? 0;
+    if (have > need) return true;
+    if (have < need) return false;
+  }
+  return true;
+}
+function resolveProxyDirectives(settings, opts) {
+  const p = sanitizeProxySettings(settings);
+  if (!p) return [];
+  const values = p;
+  const explicit = new Set(
+    PROXY_DIRECTIVES.filter((s) => values[s.key] !== void 0).map((s) => s.directive)
+  );
+  const out = [];
+  for (const spec of PROXY_DIRECTIVES) {
+    const wanted = opts.scope === "all" || opts.scope === "tls" === !!spec.tlsOnly;
+    if (!wanted) continue;
+    if (!proxyDirectiveAllowed(spec, opts.nginxVersion)) continue;
+    const value = values[spec.key];
+    if (value === void 0) continue;
+    out.push({ directive: spec.directive, text: renderProxyValue(spec, value), key: spec.key, value });
+    if (value !== true || !spec.companionsWhenOn) continue;
+    for (const line of spec.companionsWhenOn) {
+      const [name, ...rest] = line.split(/\s+/);
+      if (!name || explicit.has(name)) continue;
+      const text = rest.join(" ");
+      const companion = PROXY_DIRECTIVE_BY_NAME.get(name);
+      const parsed = companion ? parseProxyValue(companion, text) : void 0;
+      out.push({
+        directive: name,
+        text,
+        ...companion && parsed !== void 0 ? { key: companion.key, value: parsed } : {}
+      });
+    }
+  }
+  return out;
+}
+function parseProxyValue(spec, raw) {
+  const text = raw.trim();
+  if (spec.kind === "bool") {
+    if (text === "on") return true;
+    if (text === "off") return false;
+    return void 0;
+  }
+  if (spec.kind === "int") {
+    if (!/^[0-9]+$/.test(text)) return void 0;
+    return coerceProxyValue(spec, Number(text));
+  }
+  const normalized = spec.kind === "buffers" ? text.replace(/\s+/g, " ") : text;
+  return coerceProxyValue(spec, normalized.toLowerCase());
+}
 
 // ../../packages/core/src/object-storage.ts
 function isAwsS3Endpoint(endpoint2) {
@@ -2074,6 +2308,15 @@ function commandToArgv(command) {
   return shellSplitWords(command);
 }
 
+// ../../packages/core/src/mail-image-ref.ts
+function buildMailImageRef(opts) {
+  return buildImageRef(opts, {
+    name: "openship-mail",
+    imageOverride: process.env.OPENSHIP_MAIL_IMAGE,
+    tagOverride: process.env.OPENSHIP_MAIL_TAG
+  });
+}
+
 // ../../packages/core/src/runtime-config.ts
 var DEFAULT_PORT = {
   web: 3e3,
@@ -2972,9 +3215,6 @@ var catalog_default = {
         {
           name: "db",
           image: "supabase/postgres:17.6.1.136",
-          ports: [
-            "5432:5432"
-          ],
           environment: {
             POSTGRES_HOST: "/var/run/postgresql",
             PGPORT: "5432",
@@ -2985,7 +3225,8 @@ var catalog_default = {
             JWT_EXP: "3600"
           },
           volumes: [
-            "supabase_db_data:/var/lib/postgresql/data"
+            "supabase_db_data:/var/lib/postgresql/data",
+            "supabase_db_config:/etc/postgresql-custom"
           ],
           healthcheck: {
             test: [
@@ -3005,9 +3246,6 @@ var catalog_default = {
         {
           name: "kong",
           image: "kong:3.9.1",
-          ports: [
-            "8000:8000"
-          ],
           exposedPort: 8e3,
           exposed: true,
           routes: [
@@ -3161,7 +3399,7 @@ var catalog_default = {
               "--no-verbose",
               "--tries=1",
               "--spider",
-              "http://localhost:5000/status"
+              "http://127.0.0.1:5000/status"
             ],
             interval: "5s",
             timeout: "5s",
@@ -3314,8 +3552,231 @@ var catalog_default = {
         },
         {
           service: "db",
-          path: "/docker-entrypoint-initdb.d/99-roles.sql",
-          content: "ALTER USER authenticator WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER pgbouncer WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_auth_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_functions_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_storage_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\nALTER USER supabase_admin WITH PASSWORD '{{config:POSTGRES_PASSWORD}}';\n"
+          path: "/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql",
+          content: `BEGIN;
+  -- Create pg_net extension
+  CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+  -- Create supabase_functions schema
+  CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+  GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+  -- supabase_functions.migrations definition
+  CREATE TABLE supabase_functions.migrations (
+    version text PRIMARY KEY,
+    inserted_at timestamptz NOT NULL DEFAULT NOW()
+  );
+  -- Initial supabase_functions migration
+  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+  -- supabase_functions.hooks definition
+  CREATE TABLE supabase_functions.hooks (
+    id bigserial PRIMARY KEY,
+    hook_table_id integer NOT NULL,
+    hook_name text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT NOW(),
+    request_id bigint
+  );
+  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+  CREATE FUNCTION supabase_functions.http_request()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    AS $function$
+    DECLARE
+      request_id bigint;
+      payload jsonb;
+      url text := TG_ARGV[0]::text;
+      method text := TG_ARGV[1]::text;
+      headers jsonb DEFAULT '{}'::jsonb;
+      params jsonb DEFAULT '{}'::jsonb;
+      timeout_ms integer DEFAULT 1000;
+    BEGIN
+      IF url IS NULL OR url = 'null' THEN
+        RAISE EXCEPTION 'url argument is missing';
+      END IF;
+
+      IF method IS NULL OR method = 'null' THEN
+        RAISE EXCEPTION 'method argument is missing';
+      END IF;
+
+      IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+        headers = '{"Content-Type": "application/json"}'::jsonb;
+      ELSE
+        headers = TG_ARGV[2]::jsonb;
+      END IF;
+
+      IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+        params = '{}'::jsonb;
+      ELSE
+        params = TG_ARGV[3]::jsonb;
+      END IF;
+
+      IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+        timeout_ms = 1000;
+      ELSE
+        timeout_ms = TG_ARGV[4]::integer;
+      END IF;
+
+      CASE
+        WHEN method = 'GET' THEN
+          SELECT http_get INTO request_id FROM net.http_get(
+            url,
+            params,
+            headers,
+            timeout_ms
+          );
+        WHEN method = 'POST' THEN
+          payload = jsonb_build_object(
+            'old_record', OLD,
+            'record', NEW,
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'schema', TG_TABLE_SCHEMA
+          );
+
+          SELECT http_post INTO request_id FROM net.http_post(
+            url,
+            payload,
+            params,
+            headers,
+            timeout_ms
+          );
+        ELSE
+          RAISE EXCEPTION 'method argument % is invalid', method;
+      END CASE;
+
+      INSERT INTO supabase_functions.hooks
+        (hook_table_id, hook_name, request_id)
+      VALUES
+        (TG_RELID, TG_NAME, request_id);
+
+      RETURN NEW;
+    END
+  $function$;
+  -- Supabase super admin
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_functions_admin'
+    )
+    THEN
+      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+    END IF;
+  END
+  $$;
+  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+  ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+  ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+  ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+  GRANT supabase_functions_admin TO postgres;
+  -- Remove unused supabase_pg_net_admin role
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_pg_net_admin'
+    )
+    THEN
+      REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+      DROP OWNED BY supabase_pg_net_admin;
+      DROP ROLE supabase_pg_net_admin;
+    END IF;
+  END
+  $$;
+  -- pg_net grants when extension is already enabled
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_extension
+      WHERE extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END
+  $$;
+  -- Event trigger for pg_net
+  CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+  RETURNS event_trigger
+  LANGUAGE plpgsql
+  AS $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_event_trigger_ddl_commands() AS ev
+      JOIN pg_extension AS ext
+      ON ev.objid = ext.oid
+      WHERE ext.extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END;
+  $$;
+  COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_event_trigger
+      WHERE evtname = 'issue_pg_net_access'
+    ) THEN
+      CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+      EXECUTE PROCEDURE extensions.grant_pg_net_access();
+    END IF;
+  END
+  $$;
+  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+  ALTER function supabase_functions.http_request() SECURITY DEFINER;
+  ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+  REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+  GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+COMMIT;
+`
+        },
+        {
+          service: "db",
+          path: "/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql",
+          content: '\\set jwt_secret `echo "$JWT_SECRET"`\n\\set jwt_exp `echo "$JWT_EXP"`\n\nALTER DATABASE postgres SET "app.settings.jwt_secret" TO :\'jwt_secret\';\nALTER DATABASE postgres SET "app.settings.jwt_exp" TO :\'jwt_exp\';\n'
+        },
+        {
+          service: "db",
+          path: "/docker-entrypoint-initdb.d/init-scripts/99-roles.sql",
+          content: "\\set pgpass `echo \"$POSTGRES_PASSWORD\"`\n\nALTER USER authenticator WITH PASSWORD :'pgpass';\nALTER USER pgbouncer WITH PASSWORD :'pgpass';\nALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';\nALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';\n"
+        },
+        {
+          service: "db",
+          path: "/docker-entrypoint-initdb.d/migrations/99-realtime.sql",
+          content: '\\set pguser `echo "$POSTGRES_USER"`\n\ncreate schema if not exists _realtime;\nalter schema _realtime owner to :pguser;\n'
         }
       ],
       management: {
@@ -3340,6 +3801,7 @@ var catalog_default = {
             id: "studio",
             label: "Studio",
             source: "publicUrl:kong",
+            kind: "url",
             help: "Open in a browser and sign in with the Studio username + password below."
           },
           {
@@ -3370,12 +3832,12 @@ var catalog_default = {
           {
             id: "dbUrl",
             label: "Database URL",
-            source: "template:postgresql://postgres:{{env:db:POSTGRES_PASSWORD}}@{{host}}:5432/postgres",
+            source: "template:postgresql://postgres:{{env:db:POSTGRES_PASSWORD}}@db:5432/postgres",
             service: "db",
             secret: true,
             envKey: "DATABASE_URL",
             recommended: true,
-            help: "Direct Postgres connection (superuser) for psql / ORMs. Published on port 5432."
+            help: "Direct Postgres connection (superuser) reachable over this project's shared network. Connect another project to Supabase to inject it automatically."
           },
           {
             id: "dbPassword",
@@ -3397,7 +3859,8 @@ var catalog_default = {
           service: "db",
           port: 5432,
           label: "Database",
-          kind: "tcp"
+          kind: "tcp",
+          scope: "internal"
         }
       ],
       settings: [
@@ -3490,12 +3953,8 @@ var catalog_default = {
           },
           healthcheck: {
             test: [
-              "CMD",
-              "wget",
-              "--no-verbose",
-              "--tries=1",
-              "--spider",
-              "http://localhost:8081/"
+              "CMD-SHELL",
+              'wget -q -S --spider http://127.0.0.1:8081/ 2>&1 | grep -q "HTTP/"'
             ],
             interval: "10s",
             timeout: "5s",
@@ -3539,6 +3998,7 @@ var catalog_default = {
             id: "admin",
             label: "Mongo Express",
             source: "publicUrl:mongo-express",
+            kind: "url",
             envKey: "MONGO_EXPRESS_URL",
             help: "Sign in with the username + password below."
           },
@@ -3597,6 +4057,7 @@ var catalog_default = {
       id: "convex",
       name: "Convex",
       description: "Self-hosted Convex reactive backend + dashboard, with a persistent data volume.",
+      repository: "https://github.com/get-convex/convex-backend",
       kind: "template",
       logo: "convex",
       category: "backend",
@@ -3609,7 +4070,7 @@ var catalog_default = {
       services: [
         {
           name: "backend",
-          image: "ghcr.io/get-convex/convex-backend:latest",
+          image: "ghcr.io/get-convex/convex-backend:19431ea0dd90bc55ae58dbbd06d9aa045f97336f",
           ports: [
             "3210:3210",
             "3211:3211"
@@ -3651,7 +4112,7 @@ var catalog_default = {
         },
         {
           name: "dashboard",
-          image: "ghcr.io/get-convex/convex-dashboard:latest",
+          image: "ghcr.io/get-convex/convex-dashboard:19431ea0dd90bc55ae58dbbd06d9aa045f97336f",
           ports: [
             "6791:6791"
           ],
@@ -3684,21 +4145,32 @@ var catalog_default = {
           service: "backend",
           command: "./generate_admin_key.sh",
           capture: "adminKey",
-          capturePattern: "Admin key:\\s*(\\S+)",
+          capturePattern: "([^\\r\\n]+)\\s*$",
           persistAs: {
             key: "CONVEX_ADMIN_KEY"
           },
-          once: true
+          once: true,
+          title: "Generate admin key",
+          description: "Mint the dashboard and CLI admin key from the instance secret.",
+          icon: "key"
         }
       ],
       connection: {
         title: "Connect to this deployment",
         description: "Sign in to the Convex dashboard, or point the Convex CLI here, with these values.",
         outputs: [
+          {
+            id: "dashboard",
+            label: "Dashboard URL",
+            source: "publicUrl:dashboard",
+            kind: "url",
+            help: "Open the Convex dashboard UI, then sign in with the deployment URL and admin key below."
+          },
           {
             id: "url",
             label: "Deployment URL",
-            source: "env:backend:CONVEX_CLOUD_ORIGIN"
+            source: "env:backend:CONVEX_CLOUD_ORIGIN",
+            kind: "url"
           },
           {
             id: "adminKey",
@@ -4077,7 +4549,23 @@ var catalog_default = {
           ],
           restart: "unless-stopped"
         }
-      ]
+      ],
+      connection: {
+        title: "Sign in to Grafana",
+        outputs: [
+          {
+            id: "url",
+            label: "URL",
+            source: "publicUrl:grafana",
+            kind: "url"
+          }
+        ],
+        firstLogin: {
+          username: "admin",
+          password: "admin",
+          note: "Change the admin password right after your first login."
+        }
+      }
     },
     {
       available: false,
@@ -4463,7 +4951,8 @@ var catalog_default = {
           {
             id: "console",
             label: "Console",
-            source: "publicUrl:minio:9001"
+            source: "publicUrl:minio:9001",
+            kind: "url"
           },
           {
             id: "endpoint",
@@ -4609,6 +5098,7 @@ var catalog_default = {
             id: "ui",
             label: "Kafka UI",
             source: "publicUrl:kafka-ui",
+            kind: "url",
             help: "Sign in with the username + password below."
           },
           {
@@ -4701,6 +5191,7 @@ var catalog_default = {
             id: "ui",
             label: "Qdrant Web UI",
             source: "publicUrl:qdrant",
+            kind: "url",
             help: "The dashboard is at this URL under /dashboard. Paste the API key when it asks."
           },
           {
@@ -19287,6 +19778,7 @@ var configField = external_exports.object({
   required: external_exports.boolean().optional(),
   secret: external_exports.boolean().optional()
 });
+var localized = external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]);
 var prepareStep = external_exports.object({
   service: external_exports.string(),
   command: external_exports.string(),
@@ -19296,7 +19788,12 @@ var prepareStep = external_exports.object({
   once: external_exports.boolean().optional(),
   phase: external_exports.enum(["pre-deploy", "post-start", "post-ready"]).optional(),
   mustSucceed: external_exports.boolean().optional(),
-  readiness: external_exports.object({ test: external_exports.string(), interval: external_exports.number().optional(), retries: external_exports.number().optional() }).optional()
+  readiness: external_exports.object({ test: external_exports.string(), interval: external_exports.number().optional(), retries: external_exports.number().optional() }).optional(),
+  // Authored display copy for the install stepper's "app-setup" sub-steps. Purely
+  // presentational; absent → the renderer uses a generic label.
+  title: localized.optional(),
+  description: localized.optional(),
+  icon: external_exports.string().optional()
 });
 var outputVariant = external_exports.object({
   id: external_exports.string(),
@@ -19321,7 +19818,11 @@ var connection = external_exports.object({
       recommended: external_exports.boolean().optional(),
       sourceLabel: external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]).optional(),
       variants: external_exports.array(outputVariant).optional(),
-      width: external_exports.enum(["full", "half"]).optional()
+      width: external_exports.enum(["full", "half"]).optional(),
+      /** "url" marks the resolved value as an openable link — the Connection
+       *  card shows an Open-in-new-tab action beside it. Enforced only for a
+       *  resolved http(s) value (checked at render); default "text". Additive. */
+      kind: external_exports.enum(["text", "url"]).optional()
     })
   ),
   guide: external_exports.object({
@@ -19329,6 +19830,14 @@ var connection = external_exports.object({
     intro: external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]).optional(),
     useHint: external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]).optional(),
     defaultMode: external_exports.enum(["internal", "public"]).optional()
+  }).optional(),
+  // Static default credentials the app ships with (e.g. Grafana admin/admin).
+  // These are FIXED values, not derived from a service env, so they can't live in
+  // `outputs` (whose values resolve from running services) — hence their own field.
+  firstLogin: external_exports.object({
+    username: localized.optional(),
+    password: localized.optional(),
+    note: localized.optional()
   }).optional()
 });
 var endpointMode = external_exports.enum(["domain", "port", "publish", "internal"]);
@@ -19342,7 +19851,6 @@ var endpoint = external_exports.object({
   defaultMode: endpointMode.optional(),
   allowedModes: external_exports.array(endpointMode).optional()
 });
-var localized = external_exports.union([external_exports.string(), external_exports.record(external_exports.string(), external_exports.string())]);
 var provides = external_exports.object({
   id: external_exports.string(),
   outputRefs: external_exports.array(external_exports.string()),
@@ -19427,7 +19935,8 @@ var appTemplateSchema = external_exports.object({
   // Versioning / compat gate (see parseAppTemplate).
   schemaVersion: external_exports.number().optional(),
   minEngine: external_exports.string().optional(),
-  updatedAt: external_exports.string().optional()
+  updatedAt: external_exports.string().optional(),
+  repository: external_exports.string().url().optional()
 }).superRefine((data, ctx) => {
   const svcNames = new Set((data.services ?? []).map((s) => s.name));
   const refSvc = (service, path, where) => {
@@ -19490,6 +19999,757 @@ function cliInstallCommand(pm, version2) {
   return pm === "bun" ? `bun add -g ${ref}` : `npm install -g ${ref}`;
 }
 
+// ../../packages/core/src/audit-taxonomy.ts
+var AUDIT_CATEGORIES = [
+  {
+    id: "deployments",
+    label: "Deployments",
+    description: "Builds and releases \u2014 what shipped, what failed, what was cancelled."
+  },
+  {
+    id: "apps",
+    label: "Apps & services",
+    description: "Projects, the services inside them, and their runtime health."
+  },
+  {
+    id: "domains",
+    label: "Domains & SSL",
+    description: "Custom domains, DNS verification, and certificates."
+  },
+  {
+    id: "servers",
+    label: "Servers",
+    description: "Deployment targets, their configuration, and shell access."
+  },
+  {
+    id: "members",
+    label: "Members & access",
+    description: "Who is in this organization and what they are allowed to do."
+  },
+  {
+    id: "security",
+    label: "Security",
+    description: "Admin credentials, auth mode, data export, and audit recording itself."
+  },
+  {
+    id: "billing",
+    label: "Billing",
+    description: "Subscriptions, credits, spending caps, and quota thresholds."
+  },
+  {
+    id: "system",
+    label: "System",
+    description: "Settings, integrations, notifications, backups, and instance maintenance."
+  }
+];
+var AUDIT_EVENTS = {
+  /* ---------------- Deployments ---------------- */
+  "deployment.succeeded": {
+    category: "deployments",
+    action: "deployed",
+    label: "Deploy succeeded",
+    tone: "success",
+    description: "A deployment finished successfully and is serving traffic."
+  },
+  "deployment.failed": {
+    category: "deployments",
+    action: "failed to deploy",
+    label: "Deploy failed",
+    tone: "danger",
+    description: "A deployment errored out before reaching a healthy state."
+  },
+  "deployment.cancelled": {
+    category: "deployments",
+    action: "cancelled the deploy of",
+    label: "Deploy cancelled",
+    tone: "warning",
+    description: "A deployment was stopped before it finished."
+  },
+  "deployment:write": {
+    category: "deployments",
+    action: "started a deploy for",
+    label: "Deploy action",
+    description: "A deployment endpoint was invoked \u2014 start, retry, rollback, or promote."
+  },
+  "deployment:admin": {
+    category: "deployments",
+    action: "ran an admin action on the deploy for",
+    label: "Deploy admin action",
+    tone: "warning",
+    description: "A destructive deployment endpoint was invoked, such as cancel or destroy."
+  },
+  /* ---------------- Apps & services ---------------- */
+  "project.created": {
+    category: "apps",
+    action: "created",
+    label: "App created",
+    tone: "info"
+  },
+  "project.updated": {
+    category: "apps",
+    action: "updated",
+    label: "App updated",
+    description: "Settings, services, environment variables, or routing were changed."
+  },
+  "project.deleted": {
+    category: "apps",
+    action: "deleted",
+    label: "App deleted",
+    tone: "danger"
+  },
+  "project.deletion.rejected": {
+    category: "apps",
+    action: "tried to delete",
+    label: "App deletion refused",
+    tone: "warning",
+    description: "A delete was refused \u2014 something still depends on this app."
+  },
+  "project:write": {
+    category: "apps",
+    action: "changed",
+    label: "App changed",
+    description: "One of the app's write endpoints was invoked."
+  },
+  "project:admin": {
+    category: "apps",
+    action: "ran an admin action on",
+    label: "App admin action",
+    tone: "warning",
+    description: "A destructive app endpoint was invoked, such as delete or transfer."
+  },
+  "project:service:write": {
+    category: "apps",
+    action: "changed a service in",
+    label: "Service changed",
+    description: "A service was created, updated, started, stopped, or restarted."
+  },
+  "project:service:admin": {
+    category: "apps",
+    action: "ran an admin action on a service in",
+    label: "Service admin action",
+    tone: "warning"
+  },
+  "job:write": {
+    category: "apps",
+    action: "changed the job",
+    label: "Job changed",
+    description: "A scheduled or custom job was created, edited, run, or removed."
+  },
+  "job_run.started": {
+    category: "apps",
+    action: "started the job",
+    label: "Job started"
+  },
+  "job_run.succeeded": {
+    category: "apps",
+    action: "ran the job",
+    label: "Job succeeded",
+    tone: "success"
+  },
+  "job_run.failed": {
+    category: "apps",
+    action: "ran the failing job",
+    label: "Job failed",
+    tone: "danger"
+  },
+  // Written by the health watcher, never by a person — these only ever render
+  // through `label`.
+  "service.down": {
+    category: "apps",
+    action: "reported down",
+    label: "App went down",
+    tone: "danger",
+    description: "A container that should be running isn't \u2014 exited, dead, or OOM-killed."
+  },
+  "service.crash_loop": {
+    category: "apps",
+    action: "reported crash looping",
+    label: "App is crash looping",
+    tone: "danger",
+    description: "A container keeps restarting instead of staying up."
+  },
+  "service.unhealthy": {
+    category: "apps",
+    action: "reported unhealthy",
+    label: "App is unhealthy",
+    tone: "warning",
+    description: "A container is running but its own healthcheck is failing."
+  },
+  "service.recovered": {
+    category: "apps",
+    action: "reported recovered",
+    label: "App recovered",
+    tone: "success",
+    description: "An outage ended and the container is healthy again."
+  },
+  /* ---------------- Domains & SSL ---------------- */
+  "domain.added": {
+    category: "domains",
+    action: "added the domain",
+    label: "Domain added",
+    tone: "info"
+  },
+  "domain.removed": {
+    category: "domains",
+    action: "removed the domain",
+    label: "Domain removed",
+    tone: "danger"
+  },
+  "domain.verified": {
+    category: "domains",
+    action: "verified the domain",
+    label: "Domain verified",
+    tone: "success",
+    description: "DNS verification succeeded, so the domain can be issued a certificate."
+  },
+  "domain.verification_failed": {
+    category: "domains",
+    action: "failed to verify the domain",
+    label: "Domain verification failed",
+    tone: "warning",
+    description: "DNS records for this domain don't point here yet."
+  },
+  "domain.set_primary": {
+    category: "domains",
+    action: "made primary the domain",
+    label: "Primary domain changed",
+    description: "The domain other addresses now redirect to."
+  },
+  "domain.cert_uploaded": {
+    category: "domains",
+    action: "uploaded a certificate for",
+    label: "Certificate uploaded",
+    description: "A certificate and key were supplied by hand instead of issued automatically."
+  },
+  "ssl.renewal_failed": {
+    category: "domains",
+    action: "failed to renew SSL for",
+    label: "SSL renewal failed",
+    tone: "danger",
+    description: "Automatic renewal failed \u2014 the certificate will expire unless this is fixed."
+  },
+  "domain:write": {
+    category: "domains",
+    action: "changed the domain",
+    label: "Domain action",
+    description: "A domain endpoint was invoked \u2014 add, verify, or renew."
+  },
+  "domain:admin": {
+    category: "domains",
+    action: "ran an admin action on the domain",
+    label: "Domain admin action",
+    tone: "warning"
+  },
+  /* ---------------- Servers ---------------- */
+  "server.added": {
+    category: "servers",
+    action: "added the server",
+    label: "Server added",
+    tone: "info"
+  },
+  "server.updated": {
+    category: "servers",
+    action: "updated the server",
+    label: "Server updated"
+  },
+  "server.removed": {
+    category: "servers",
+    action: "removed the server",
+    label: "Server removed",
+    tone: "danger"
+  },
+  "server.unreachable": {
+    category: "servers",
+    action: "reported unreachable",
+    label: "Server unreachable",
+    tone: "danger",
+    description: "Openship could not open an SSH connection to this server."
+  },
+  "server.reachable": {
+    category: "servers",
+    action: "reported reachable",
+    label: "Server reachable again",
+    tone: "success"
+  },
+  "server:write": {
+    category: "servers",
+    action: "changed the server",
+    label: "Server changed"
+  },
+  "server:admin": {
+    category: "servers",
+    action: "ran an admin action on the server",
+    label: "Server admin action",
+    tone: "warning",
+    description: "A destructive server endpoint was invoked, such as delete or component install."
+  },
+  "terminal:write": {
+    category: "servers",
+    action: "opened a terminal on",
+    label: "Terminal session opened",
+    tone: "warning",
+    description: "An interactive shell session was issued against a server."
+  },
+  "mail_server:write": {
+    category: "servers",
+    action: "changed the mail server",
+    label: "Mail server changed",
+    description: "A mail server endpoint was invoked \u2014 setup, domain, DNS acknowledgement."
+  },
+  "mail_server:admin": {
+    category: "servers",
+    action: "ran an admin action on the mail server",
+    label: "Mail server admin action",
+    tone: "warning"
+  },
+  /* ---------------- Members & access ---------------- */
+  "organization.created": {
+    category: "members",
+    action: "created the organization",
+    label: "Organization created",
+    tone: "info"
+  },
+  "organization.deleted": {
+    category: "members",
+    action: "deleted the organization",
+    label: "Organization deleted",
+    tone: "danger"
+  },
+  "organization.deletion.blocked": {
+    category: "members",
+    action: "tried to delete the organization",
+    label: "Organization deletion blocked",
+    tone: "warning",
+    description: "Deletion was refused \u2014 active resources or billing still attached."
+  },
+  "member.added": {
+    category: "members",
+    action: "added",
+    label: "Member added",
+    tone: "info"
+  },
+  "member.removed": {
+    category: "members",
+    action: "removed",
+    label: "Member removed",
+    tone: "danger"
+  },
+  "member.role_changed": {
+    category: "members",
+    action: "changed the role of",
+    label: "Member role changed",
+    tone: "warning"
+  },
+  "member.joined": {
+    category: "members",
+    action: "joined",
+    label: "Member joined",
+    tone: "success",
+    description: "An invitee accepted and now has access."
+  },
+  "member.invited": {
+    category: "members",
+    action: "invited",
+    label: "Member invited",
+    tone: "info"
+  },
+  "member.removal.grant_cleanup_failed": {
+    category: "members",
+    action: "removed, with leftover permissions,",
+    label: "Removed member's permissions not cleaned up",
+    tone: "warning",
+    description: "The member is gone but their permission grants remained \u2014 review by hand."
+  },
+  "member.removal.subscription_cleanup_failed": {
+    category: "members",
+    action: "removed, with leftover billing,",
+    label: "Removed member's billing not cleaned up",
+    tone: "warning",
+    description: "The member is gone but a linked subscription remained \u2014 review billing."
+  },
+  "invitation.created": {
+    category: "members",
+    action: "invited",
+    label: "Invitation sent",
+    tone: "info"
+  },
+  "invitation.sent": {
+    category: "members",
+    action: "invited, with pending permissions,",
+    label: "Invitation sent with pending permissions",
+    tone: "info",
+    description: "Grants were queued and will apply the moment the invitee joins."
+  },
+  "invitation.accepted": {
+    category: "members",
+    action: "accepted the invitation of",
+    label: "Invitation accepted",
+    tone: "success"
+  },
+  "invitation.rejected": {
+    category: "members",
+    action: "declined the invitation of",
+    label: "Invitation declined",
+    tone: "warning"
+  },
+  "invitation.cancelled": {
+    category: "members",
+    action: "cancelled the invitation for",
+    label: "Invitation cancelled",
+    tone: "warning"
+  },
+  "team.created": {
+    category: "members",
+    action: "created the team",
+    label: "Team created",
+    tone: "info"
+  },
+  "grant.granted": {
+    category: "members",
+    action: "granted permissions to",
+    label: "Permission granted",
+    tone: "info"
+  },
+  "grant.revoked": {
+    category: "members",
+    action: "revoked permissions from",
+    label: "Permission revoked",
+    tone: "danger"
+  },
+  "grant.replaced": {
+    category: "members",
+    action: "replaced the permissions of",
+    label: "Permission replaced",
+    tone: "warning",
+    description: "An existing grant was overwritten with a different scope."
+  },
+  "grant.materialized": {
+    category: "members",
+    action: "received their pending permissions,",
+    label: "Pending permission applied",
+    description: "A grant attached to an invitation was applied once the invitee joined."
+  },
+  "permissions:write": {
+    category: "members",
+    action: "changed permissions for",
+    label: "Permissions changed",
+    tone: "warning"
+  },
+  "permissions:admin": {
+    category: "members",
+    action: "ran an admin action on permissions for",
+    label: "Permissions admin action",
+    tone: "warning"
+  },
+  /* ---------------- Security ---------------- */
+  "admin.bootstrapped": {
+    category: "security",
+    action: "bootstrapped the first admin account",
+    label: "First admin account created",
+    tone: "warning",
+    description: "The instance's initial owner was created \u2014 this can only happen once."
+  },
+  "admin.password_reset": {
+    category: "security",
+    action: "reset an admin password",
+    label: "Admin password reset",
+    tone: "danger"
+  },
+  "auth-mode-changed": {
+    category: "security",
+    action: "changed the sign-in mode",
+    label: "Sign-in mode changed",
+    tone: "danger",
+    description: "The instance switched between single-user and full authentication."
+  },
+  "instance.data.exported": {
+    category: "security",
+    action: "exported all instance data",
+    label: "Instance data exported",
+    tone: "warning",
+    description: "A full database dump left this instance."
+  },
+  "instance.data.imported": {
+    category: "security",
+    action: "imported instance data",
+    label: "Instance data imported",
+    tone: "warning",
+    description: "A database dump from another instance was loaded in."
+  },
+  // Written by the audit module itself. "disabled" is recorded before the switch
+  // flips, so turning recording off always leaves this one row behind.
+  "audit.disabled": {
+    category: "security",
+    action: "turned off activity recording",
+    label: "Activity recording turned off",
+    tone: "danger",
+    description: "No further actions were recorded until recording was turned back on."
+  },
+  "audit.enabled": {
+    category: "security",
+    action: "turned on activity recording",
+    label: "Activity recording turned on",
+    tone: "success"
+  },
+  "audit.retention_changed": {
+    category: "security",
+    action: "changed how long activity is kept",
+    label: "Activity retention changed",
+    tone: "warning"
+  },
+  "audit:write": {
+    category: "security",
+    action: "changed activity recording",
+    label: "Activity settings changed",
+    tone: "warning"
+  },
+  /* ---------------- Billing ---------------- */
+  "billing.hard_cap_tripped": {
+    category: "billing",
+    action: "hit the spending cap for",
+    label: "Spending cap reached",
+    tone: "danger",
+    description: "Cloud resources may have been paused \u2014 review billing."
+  },
+  "billing.credit_exhausted": {
+    category: "billing",
+    action: "ran out of credits for",
+    label: "Credits exhausted",
+    tone: "warning",
+    description: "Metered usage is paused until a top-up or the monthly reset."
+  },
+  "billing.credit_restored": {
+    category: "billing",
+    action: "restored credits for",
+    label: "Credits restored",
+    tone: "success"
+  },
+  "billing.anniversary_reset": {
+    category: "billing",
+    action: "reset the monthly credits of",
+    label: "Monthly credits reset"
+  },
+  "quota.threshold_fired": {
+    category: "billing",
+    action: "crossed a usage threshold on",
+    label: "Usage threshold crossed",
+    tone: "warning"
+  },
+  "billing:write": {
+    category: "billing",
+    action: "changed billing for",
+    label: "Billing action",
+    description: "A billing endpoint was invoked \u2014 subscribe, top up, or open the portal."
+  },
+  "billing:admin": {
+    category: "billing",
+    action: "ran an admin action on billing for",
+    label: "Billing admin action",
+    tone: "warning",
+    description: "A destructive billing endpoint was invoked, such as cancelling a subscription."
+  },
+  /* ---------------- System ---------------- */
+  "settings.updated": {
+    category: "system",
+    action: "updated settings",
+    label: "Settings updated"
+  },
+  "settings:write": {
+    category: "system",
+    action: "changed settings",
+    label: "Settings changed"
+  },
+  "settings:admin": {
+    category: "system",
+    action: "ran an admin action on settings",
+    label: "Settings admin action",
+    tone: "warning",
+    description: "A destructive settings endpoint was invoked, such as a wipe or migration."
+  },
+  "updates:write": {
+    category: "system",
+    action: "applied an update",
+    label: "Update applied",
+    description: "An Openship component was updated or an update scan was triggered."
+  },
+  "cloud.disconnect": {
+    category: "system",
+    action: "disconnected from Openship Cloud",
+    label: "Cloud disconnected",
+    tone: "warning"
+  },
+  "cloud:write": {
+    category: "system",
+    action: "ran a cloud action",
+    label: "Cloud action",
+    description: "A cloud bridge endpoint was invoked \u2014 token, preflight, or edge proxy."
+  },
+  "cloud:admin": {
+    category: "system",
+    action: "ran a cloud admin action",
+    label: "Cloud admin action",
+    tone: "warning"
+  },
+  "github.install": {
+    category: "system",
+    action: "installed the GitHub app on",
+    label: "GitHub app installed",
+    tone: "info"
+  },
+  "github.disconnect": {
+    category: "system",
+    action: "disconnected GitHub from",
+    label: "GitHub disconnected",
+    tone: "warning"
+  },
+  "github.repo.create": {
+    category: "system",
+    action: "created the repository",
+    label: "Repository created",
+    tone: "info"
+  },
+  "github.repo.delete": {
+    category: "system",
+    action: "deleted the repository",
+    label: "Repository deleted",
+    tone: "danger"
+  },
+  "github.webhook.register": {
+    category: "system",
+    action: "enabled deploy-on-push for",
+    label: "Deploy-on-push enabled",
+    tone: "info"
+  },
+  "github.webhook.delete": {
+    category: "system",
+    action: "disabled deploy-on-push for",
+    label: "Deploy-on-push disabled",
+    tone: "warning"
+  },
+  "github.instance_token.set": {
+    category: "system",
+    action: "set the instance GitHub token",
+    label: "Instance GitHub token set",
+    tone: "warning",
+    description: "A GitHub token shared by every project on this instance was stored."
+  },
+  "github:write": {
+    category: "system",
+    action: "changed a GitHub connection for",
+    label: "GitHub action"
+  },
+  "github:admin": {
+    category: "system",
+    action: "ran a GitHub admin action on",
+    label: "GitHub admin action",
+    tone: "warning"
+  },
+  "notification_channel.created": {
+    category: "system",
+    action: "added the notification channel",
+    label: "Notification channel added",
+    tone: "info"
+  },
+  "notification_channel.updated": {
+    category: "system",
+    action: "updated the notification channel",
+    label: "Notification channel updated"
+  },
+  "notification_channel.deleted": {
+    category: "system",
+    action: "removed the notification channel",
+    label: "Notification channel removed",
+    tone: "warning"
+  },
+  "notification_subscription.updated": {
+    category: "system",
+    action: "changed what is sent to",
+    label: "Notification subscription changed"
+  },
+  "notification_subscription.deleted": {
+    category: "system",
+    action: "stopped notifications to",
+    label: "Notification subscription removed",
+    tone: "warning"
+  },
+  "notification_default.updated": {
+    category: "system",
+    action: "changed the notification defaults of",
+    label: "Notification defaults changed"
+  },
+  "notifications:write": {
+    category: "system",
+    action: "changed notifications",
+    label: "Notifications changed"
+  },
+  "notifications:admin": {
+    category: "system",
+    action: "ran a notifications admin action",
+    label: "Notifications admin action",
+    tone: "warning"
+  },
+  "backup_run.succeeded": {
+    category: "system",
+    action: "backed up",
+    label: "Backup succeeded",
+    tone: "success"
+  },
+  "backup_run.failed": {
+    category: "system",
+    action: "failed to back up",
+    label: "Backup failed",
+    tone: "danger"
+  },
+  "backup.webhook.fired": {
+    category: "system",
+    action: "triggered a backup of",
+    label: "Backup triggered by webhook"
+  },
+  "backup.webhook.disabled": {
+    category: "system",
+    action: "disabled the backup webhook for",
+    label: "Backup webhook disabled",
+    tone: "warning",
+    description: "The webhook failed too many times and was switched off."
+  },
+  "backup_destination:write": {
+    category: "system",
+    action: "changed the backup destination",
+    label: "Backup destination changed"
+  },
+  "backup_destination:admin": {
+    category: "system",
+    action: "ran an admin action on the backup destination",
+    label: "Backup destination admin action",
+    tone: "warning"
+  },
+  "backup_destination:backup_policy:write": {
+    category: "system",
+    action: "changed the backup schedule of",
+    label: "Backup schedule changed"
+  },
+  "backup_destination:backup_run:write": {
+    category: "system",
+    action: "ran a backup of",
+    label: "Backup run"
+  },
+  "backup_destination:backup_restore:write": {
+    category: "system",
+    action: "restored from a backup of",
+    label: "Restore from backup",
+    tone: "warning"
+  }
+};
+var CATEGORY_IDS = new Set(AUDIT_CATEGORIES.map((c) => c.id));
+var EVENT_TYPES_BY_CATEGORY = (() => {
+  const map2 = {};
+  for (const id of CATEGORY_IDS) map2[id] = [];
+  for (const [eventType, def] of Object.entries(AUDIT_EVENTS)) {
+    map2[def.category]?.push(eventType);
+  }
+  return map2;
+})();
+
 export {
   LANGUAGES,
   STACKS,
@@ -19503,6 +20763,7 @@ export {
   shellSplitWords,
   commandToArgv,
   buildEdgeImageRef,
+  buildMailImageRef,
   SYSTEM,
   resolveRedirectStatus,
   isValidEmail,
@@ -19523,6 +20784,8 @@ export {
   compareSemver,
   resolveCliUpdatePlan,
   cliInstallCommand,
-  PROXY_GZIP_TYPES,
-  sanitizeProxySettings
+  PROXY_DIRECTIVES,
+  sanitizeProxySettings,
+  resolveProxyDirectives,
+  parseProxyValue
 };