openship 0.6.5 → 0.6.6

package/dist/{chunk-LEYSL46B.js → chunk-UJ6JZM65.js}

@@ -953,136 +953,6 @@ function ownsNetworkEndpoint(resolvedNetworkMode) {
 
 // ../../packages/core/src/constants.ts
 var DEFAULT_IMAGE_REGISTRY = "ghcr.io/oblien";
-var PLANS = {
-  free: {
-    id: "free",
-    name: "Free",
-    description: "Get started for free",
-    price: { monthly: 0, annual: 0 },
-    stripePriceId: { monthly: null, annual: null },
-    // Public dollar `price` on the paid tiers is `null` — the UI renders
-    // "coming soon" and the Subscribe CTA stays disabled. Cloud pricing is
-    // intentionally NOT published yet. `monthlyCredits` (the CPU-time/credit
-    // quota pushed to Oblien) is real so tiers still enforce — it's an internal
-    // number, never shown as a price. NOTE (tune before launch): these credit
-    // numbers are placeholders sized to Oblien's 10,000,000-credit ceiling; the
-    // true credit-per-$/per-cpu-minute rate is Oblien-configured. 1 openship
-    // credit = 1 Oblien credit = 1000 milli (the wrapper divides by 1000 at the
-    // Oblien boundary). Self-hosted is free and surfaces none of these numbers.
-    monthlyCredits: 5e5,
-    // 500 credits — free-tier allowance
-    oblienLimits: {
-      max_workspaces: 1,
-      max_vcpus: 2,
-      max_ram_mb: 2048,
-      max_disk_gb: 10
-    },
-    features: [
-      "1 workspace",
-      "Community support"
-    ],
-    popular: false,
-    support: "community"
-  },
-  pro: {
-    id: "pro",
-    name: "Pro",
-    description: "For solo builders shipping production workloads",
-    price: { monthly: null, annual: null },
-    // coming soon — pricing not published
-    stripePriceId: {
-      monthly: process.env.STRIPE_PRICE_PRO_MONTHLY ?? "price_pro_monthly_placeholder",
-      annual: process.env.STRIPE_PRICE_PRO_ANNUAL ?? "price_pro_annual_placeholder"
-    },
-    monthlyCredits: 1e7,
-    // 10,000 credits/mo (placeholder — tune before launch)
-    oblienLimits: {
-      max_workspaces: 10,
-      max_vcpus: 16,
-      max_ram_mb: 32768,
-      max_disk_gb: 100
-    },
-    features: [
-      "Up to 10 workspaces",
-      "Email support"
-    ],
-    popular: true,
-    support: "email"
-  },
-  team: {
-    id: "team",
-    name: "Team",
-    description: "For teams collaborating on shared infra",
-    price: { monthly: null, annual: null },
-    // coming soon — pricing not published
-    stripePriceId: {
-      monthly: process.env.STRIPE_PRICE_TEAM_MONTHLY ?? "price_team_monthly_placeholder",
-      annual: process.env.STRIPE_PRICE_TEAM_ANNUAL ?? "price_team_annual_placeholder"
-    },
-    monthlyCredits: 6e7,
-    // 60,000 credits/mo (placeholder — tune before launch)
-    oblienLimits: {
-      max_workspaces: 50,
-      max_vcpus: 64,
-      max_ram_mb: 131072,
-      max_disk_gb: 500
-    },
-    features: [
-      "Up to 50 workspaces",
-      "Team collaboration",
-      "Priority email support"
-    ],
-    popular: false,
-    support: "priority email"
-  },
-  enterprise: {
-    id: "enterprise",
-    name: "Enterprise",
-    description: "Custom limits, SLAs, dedicated infra",
-    price: { monthly: null, annual: null },
-    // contact sales
-    stripePriceId: { monthly: null, annual: null },
-    monthlyCredits: null,
-    // admin grants
-    oblienLimits: null,
-    // custom per contract
-    features: [
-      "Custom credit allocation",
-      "Custom workspace limits",
-      "SSO / SAML",
-      "Dedicated support & SLA"
-    ],
-    popular: false,
-    support: "dedicated",
-    contactSales: "mailto:sales@openship.io"
-  }
-};
-var CREDIT_PACKS = [
-  {
-    id: "pack_5k",
-    name: "5,000 credits",
-    credits_milli: 5e6,
-    price_cents: 500,
-    stripePriceId: process.env.STRIPE_PRICE_PACK_5K ?? "price_pack_5k_placeholder",
-    sortOrder: 10
-  },
-  {
-    id: "pack_25k",
-    name: "25,000 credits",
-    credits_milli: 25e6,
-    price_cents: 2e3,
-    stripePriceId: process.env.STRIPE_PRICE_PACK_25K ?? "price_pack_25k_placeholder",
-    sortOrder: 20
-  },
-  {
-    id: "pack_100k",
-    name: "100,000 credits",
-    credits_milli: 1e8,
-    price_cents: 7e3,
-    stripePriceId: process.env.STRIPE_PRICE_PACK_100K ?? "price_pack_100k_placeholder",
-    sortOrder: 30
-  }
-];
 
 // ../../packages/core/src/image-ref.ts
 function buildImageRef(opts, image) {
@@ -1096,6 +966,32 @@ function buildImageRef(opts, image) {
   const tag = image.tagOverride?.trim() || process.env.OPENSHIP_VERSION?.trim() || opts?.fallbackTag?.trim() || "latest";
   return `${registry2}/${image.name}:${tag}`;
 }
+var DOCKER_HUB_REGISTRY = "docker.io";
+var DOCKER_HUB_ALIASES = [
+  "https://index.docker.io/v1/",
+  "https://index.docker.io/v1",
+  "index.docker.io",
+  "registry-1.docker.io",
+  DOCKER_HUB_REGISTRY
+];
+function registryForImage(ref) {
+  const trimmed2 = ref.trim();
+  const slash = trimmed2.indexOf("/");
+  if (slash === -1) return DOCKER_HUB_REGISTRY;
+  const first = trimmed2.slice(0, slash);
+  const looksLikeHost = first.includes(".") || first.includes(":") || first === "localhost";
+  return looksLikeHost ? first.toLowerCase() : DOCKER_HUB_REGISTRY;
+}
+function normalizeRegistryHost(input) {
+  const bare = input.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/\/+$/, "");
+  const host = bare.split("/")[0] ?? "";
+  return DOCKER_HUB_ALIASES.includes(bare) || DOCKER_HUB_ALIASES.includes(host) ? DOCKER_HUB_REGISTRY : host;
+}
+function registryConfigKeys(registry2) {
+  const host = normalizeRegistryHost(registry2);
+  if (host === DOCKER_HUB_REGISTRY) return [...DOCKER_HUB_ALIASES];
+  return [host, `https://${host}`, `https://${host}/`, `${host}/`, `http://${host}`];
+}
 
 // ../../packages/core/src/edge-image-ref.ts
 function buildEdgeImageRef(opts) {
@@ -1342,7 +1238,8 @@ var OPENSHIP_RESOURCE_TIERS = [
   "micro",
   "low",
   "medium",
-  "high"
+  "high",
+  "xlarge"
 ];
 
 // ../../packages/core/src/openship-config/parse.ts
@@ -2440,6 +2337,13 @@ var HOST_CHANNEL_NOT_PROVISIONED = (
   `Re-run \`${HOST_CHANNEL_PROVISION_COMMAND}\` to provision the host channel. \`${HOST_CHANNEL_RECHECK_COMMAND}\` reports whether it worked.`
 );
 var HOST_CHANNEL_UNPROVISIONED = "Openship is running in a container with no host channel \u2014 OPENSHIP_HOST_SSH_HOST is unset, so there is no address to reach the host at and nothing has been dialed.";
+var HOST_CHANNEL_DEFAULT_ACCOUNT = "root";
+function hostChannelAccount(env) {
+  return env.OPENSHIP_HOST_SSH_USER?.trim() || HOST_CHANNEL_DEFAULT_ACCOUNT;
+}
+var HOST_CHANNEL_AUTH_REJECTED = "The host accepted the connection and then refused Openship's key. Either the key is no longer in the target account's `authorized_keys`, or sshd does not permit that account to log in at all (for a root channel, check `sshd -T | grep -i permitrootlogin`).";
+var HOST_CHANNEL_AUTH_REJECTED_SHORT = "the host refused the channel key \u2014 re-authorize it, or permit that account to log in";
+var HOST_CHANNEL_ROW_CREDENTIALS_UNUSED = `The SSH credentials stored on this server are not used for this connection \u2014 the host channel has its own key, provisioned by \`${HOST_CHANNEL_PROVISION_COMMAND}\`.`;
 var HOST_CHANNEL_OPT_OUT = (
   // The command sits early in the sentence on purpose: every surface wraps this to a
   // terminal width, and a line break through the middle of a command is a command an
@@ -2777,7 +2681,19 @@ var dashboardRuntimeOrigins = Object.values(DASHBOARD_RUNTIME_TARGETS).flatMap(
 );
 
 // ../../packages/core/src/resources.ts
-var RESOURCE_TIER_ORDER = ["micro", "low", "medium", "high"];
+var RESOURCE_TIER_SPECS = {
+  micro: { cpuCores: 0.25, memoryMb: 256, diskMb: 4096 },
+  low: { cpuCores: 0.5, memoryMb: 512, diskMb: 8192 },
+  medium: { cpuCores: 1, memoryMb: 1024, diskMb: 16384 },
+  high: { cpuCores: 2, memoryMb: 2048, diskMb: 32768 },
+  // The table stopped at `high` (2 vCPU), which meant the top paid plan could
+  // offer no more POWER per service than the one below it — only more services —
+  // and anything larger was reachable only through `custom`, the one path with no
+  // bounds at all. 4 vCPU / 8 GB matches the build machine and the
+  // resource-schema ceiling, so it needs no new limits anywhere.
+  xlarge: { cpuCores: 4, memoryMb: 8192, diskMb: 65536 }
+};
+var RESOURCE_TIER_ORDER = ["micro", "low", "medium", "high", "xlarge"];
 var ALL_RESOURCE_TIERS = [
   "unlimited",
   ...RESOURCE_TIER_ORDER,
@@ -4356,7 +4272,7 @@ COMMIT;
     },
     {
       available: true,
-      verified: true,
+      verified: false,
       id: "mongodb",
       name: "MongoDB",
       description: "MongoDB document database with the Mongo Express web admin UI.",
@@ -4403,9 +4319,6 @@ COMMIT;
           image: "mongo-express:1.0.2",
           exposedPort: 8081,
           exposed: true,
-          ports: [
-            "8081:8081"
-          ],
           routes: [
             {
               port: 8081
@@ -4429,7 +4342,10 @@ COMMIT;
             retries: 5,
             startPeriod: "20s"
           },
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8216:8081"
+          ]
         }
       ],
       configFields: [
@@ -4488,19 +4404,19 @@ COMMIT;
           {
             id: "dbUrl",
             label: "Database URL",
-            source: "template:mongodb://root:{{env:mongo:MONGO_INITDB_ROOT_PASSWORD}}@{{host}}:27017/",
-            sourceLabel: "Public",
+            source: "template:mongodb://root:{{env:mongo:MONGO_INITDB_ROOT_PASSWORD}}@mongo:27017/",
+            sourceLabel: "Internal",
             variants: [
               {
-                id: "internal",
-                label: "Internal",
-                source: "template:mongodb://root:{{env:mongo:MONGO_INITDB_ROOT_PASSWORD}}@mongo:27017/"
+                id: "host",
+                label: "From this server",
+                source: "template:mongodb://root:{{env:mongo:MONGO_INITDB_ROOT_PASSWORD}}@{{host}}:27017/"
               }
             ],
             secret: true,
             envKey: "MONGODB_URI",
             recommended: true,
-            help: "Direct MongoDB connection (root user). Published on port 27017. Switch to Internal for apps on the same project network."
+            help: 'Direct MongoDB connection (root user) on the project\u2019s private network \u2014 use it from another service, or bind this app into a project. Port 27017 publishes on 127.0.0.1 only, so the "From this server" form works from the box itself or through an SSH tunnel, not from the internet.'
           }
         ]
       },
@@ -4712,9 +4628,6 @@ COMMIT;
         {
           name: "n8n",
           image: "n8nio/n8n:latest",
-          ports: [
-            "5678:5678"
-          ],
           exposedPort: 5678,
           exposed: true,
           environment: {
@@ -4729,7 +4642,10 @@ COMMIT;
           volumes: [
             "n8n_data:/home/node/.n8n"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8213:5678"
+          ]
         }
       ],
       configFields: [
@@ -4795,13 +4711,43 @@ COMMIT;
             }
           ]
         }
-      ]
+      ],
+      connection: {
+        title: "Set up n8n",
+        description: "n8n has no preset login. Open the editor and the first screen creates your owner account.",
+        guide: {
+          defaultMode: "public",
+          intro: "Your project gets a private n8n instance for building workflows.",
+          useHint: "Webhook nodes are published under the webhook base URL below \u2014 use that origin when registering callbacks with third parties."
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Editor",
+            source: "publicUrl:n8n",
+            kind: "url",
+            recommended: true,
+            help: "First visit asks you to create the owner account."
+          },
+          {
+            id: "webhookUrl",
+            label: "Webhook base URL",
+            source: "env:n8n:WEBHOOK_URL",
+            kind: "url",
+            envKey: "N8N_WEBHOOK_URL",
+            help: "Base origin n8n advertises for Webhook nodes."
+          }
+        ],
+        firstLogin: {
+          note: "Create the owner account as soon as it deploys \u2014 the setup screen is unauthenticated until you do. Never change the generated encryption key afterwards or every stored credential becomes unreadable. n8n issues https-only session cookies, so sign in over the domain rather than a plain-http address."
+        }
+      }
     },
     {
-      available: false,
+      available: true,
       id: "ghost",
       name: "Ghost",
-      description: "Modern publishing platform for blogs, newsletters, and membership sites.",
+      description: "Modern publishing platform for blogs, newsletters, and membership sites. Claim the owner account on your first visit.",
       kind: "template",
       logo: "ghost",
       category: "cms",
@@ -4829,9 +4775,6 @@ COMMIT;
         {
           name: "ghost",
           image: "ghost:5-alpine",
-          ports: [
-            "2368:2368"
-          ],
           exposedPort: 2368,
           exposed: true,
           dependsOn: [
@@ -4851,7 +4794,10 @@ COMMIT;
           volumes: [
             "ghost_content:/var/lib/ghost/content"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8212:2368"
+          ]
         }
       ],
       configFields: [
@@ -4871,13 +4817,43 @@ COMMIT;
           generateGroup: "ghostdb",
           secret: true
         }
-      ]
+      ],
+      connection: {
+        title: "Set up Ghost",
+        description: "Ghost has no preset login. Open Ghost Admin and the first screen creates the owner account.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "admin",
+            label: "Ghost Admin",
+            source: "template:{{env:ghost:url}}/ghost/",
+            kind: "url",
+            recommended: true,
+            help: "Create the owner account here on first visit."
+          },
+          {
+            id: "url",
+            label: "Site",
+            source: "publicUrl:ghost",
+            kind: "url",
+            help: "The public blog."
+          }
+        ],
+        firstLogin: {
+          note: "Claim the owner account at /ghost/ immediately \u2014 it is unauthenticated until you do, so the first visitor owns the blog. Ghost may restart a few times on first boot while MySQL initialises; that is expected."
+        }
+      },
+      verified: true
     },
     {
-      available: false,
+      available: true,
+      verified: true,
       id: "directus",
       name: "Directus",
-      description: "Headless CMS with an instant REST + GraphQL API over your data. Create the admin on first visit.",
+      description: "Headless CMS with an instant REST + GraphQL API over your data. Sign in with the admin email and generated password below.",
+      repository: "https://github.com/directus/directus",
       kind: "template",
       logo: "directus",
       category: "cms",
@@ -4891,24 +4867,41 @@ COMMIT;
         {
           name: "directus",
           image: "directus/directus:latest",
-          ports: [
-            "8055:8055"
-          ],
           exposedPort: 8055,
           exposed: true,
+          routes: [
+            {
+              port: 8055
+            }
+          ],
           environment: {
             DB_CLIENT: "sqlite3",
             DB_FILENAME: "/directus/database/data.db",
-            PUBLIC_URL: "{{publicUrl:directus}}"
+            PUBLIC_URL: "{{publicUrl:directus}}",
+            ADMIN_EMAIL: "admin@example.com"
           },
           secretEnv: [
-            "SECRET"
+            "SECRET",
+            "ADMIN_PASSWORD"
           ],
           volumes: [
             "directus_database:/directus/database",
             "directus_uploads:/directus/uploads"
           ],
-          restart: "unless-stopped"
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget -q -O /dev/null http://127.0.0.1:8055/server/health || exit 1"
+            ],
+            interval: "15s",
+            timeout: "5s",
+            retries: 8,
+            startPeriod: "30s"
+          },
+          restart: "unless-stopped",
+          ports: [
+            "8211:8055"
+          ]
         }
       ],
       configFields: [
@@ -4919,14 +4912,76 @@ COMMIT;
           help: "Auto-generated. Signs access tokens.",
           generate: "secret",
           secret: true
+        },
+        {
+          key: "ADMIN_PASSWORD",
+          service: "directus",
+          label: "Admin password",
+          help: "Auto-generated. The password for the admin account created on first boot. Directus has no sign-up screen, so without this no account would exist at all.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Sign in to Directus",
+        description: "The admin account below is created automatically on the first boot. Change the password after your first sign-in.",
+        guide: {
+          intro: "A headless CMS plus a REST and GraphQL API over whatever collections you create.",
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "admin",
+            label: "Admin app",
+            source: "template:{{env:directus:PUBLIC_URL}}/admin",
+            kind: "url",
+            recommended: true,
+            help: "The Directus admin app. Sign in with the email and password below."
+          },
+          {
+            id: "url",
+            label: "API URL",
+            source: "publicUrl:directus",
+            kind: "url",
+            envKey: "DIRECTUS_URL",
+            help: "Base URL for the REST + GraphQL API."
+          },
+          {
+            id: "email",
+            label: "Admin email",
+            source: "env:directus:ADMIN_EMAIL",
+            width: "half"
+          },
+          {
+            id: "password",
+            label: "Admin password",
+            source: "env:directus:ADMIN_PASSWORD",
+            secret: true,
+            width: "half"
+          }
+        ],
+        firstLogin: {
+          note: "The admin is created only on the FIRST boot against an empty database. If you reinstall over an existing directus_database volume no new admin is made \u2014 reset one with `npx directus users passwd` inside the container."
+        }
+      },
+      endpoints: [
+        {
+          service: "directus",
+          port: 8055,
+          label: "Directus",
+          kind: "http",
+          defaultMode: "domain"
         }
       ]
     },
     {
-      available: false,
+      available: true,
       id: "nocodb",
       name: "NocoDB",
-      description: "Airtable-style spreadsheet UI over an SQL database. The first sign-up becomes the admin.",
+      description: "Airtable-style spreadsheet UI over an SQL database. Sign in with the admin account below.",
       kind: "template",
       logo: "nocodb",
       category: "database",
@@ -4940,23 +4995,73 @@ COMMIT;
         {
           name: "nocodb",
           image: "nocodb/nocodb:latest",
-          ports: [
-            "8080:8080"
-          ],
           exposedPort: 8080,
           exposed: true,
           volumes: [
             "nocodb_data:/usr/app/data"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          environment: {
+            NC_ADMIN_EMAIL: "admin@example.com"
+          },
+          secretEnv: [
+            "NC_ADMIN_PASSWORD"
+          ],
+          ports: [
+            "8208:8080"
+          ]
         }
-      ]
+      ],
+      configFields: [
+        {
+          key: "NC_ADMIN_PASSWORD",
+          service: "nocodb",
+          label: "Admin password",
+          help: "Auto-generated. Password for the super-admin account created on first boot.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      connection: {
+        title: "Sign in to NocoDB",
+        description: "The super-admin account below is created on first boot. Change the password after signing in.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "NocoDB",
+            source: "publicUrl:nocodb",
+            kind: "url",
+            recommended: true,
+            help: "Sign in with the email and password below."
+          },
+          {
+            id: "email",
+            label: "Admin email",
+            source: "env:nocodb:NC_ADMIN_EMAIL",
+            width: "half"
+          },
+          {
+            id: "password",
+            label: "Admin password",
+            source: "env:nocodb:NC_ADMIN_PASSWORD",
+            secret: true,
+            width: "half"
+          }
+        ],
+        firstLogin: {
+          note: "Anyone who reaches this URL can still create their own account (they land in their own workspace and cannot see your bases). Turn sign-up off in Account Settings \u2192 Authentication right after your first sign-in \u2014 the NC_INVITE_ONLY_SIGNUP env var no longer works in this version."
+        }
+      },
+      verified: true
     },
     {
-      available: false,
+      available: true,
       id: "metabase",
       name: "Metabase",
-      description: "Open-source business intelligence \u2014 dashboards and questions over your data.",
+      description: "Open-source business intelligence \u2014 dashboards and questions over your data. Create your admin account in the browser on first visit.",
       kind: "template",
       logo: "metabase",
       category: "analytics",
@@ -4970,20 +5075,55 @@ COMMIT;
         {
           name: "metabase",
           image: "metabase/metabase:latest",
-          ports: [
-            "3000:3000"
-          ],
           exposedPort: 3e3,
           exposed: true,
           environment: {
-            MB_DB_FILE: "/metabase-data/metabase.db"
+            MB_DB_FILE: "/metabase-data/metabase.db",
+            MB_SITE_URL: "{{publicUrl:metabase}}"
           },
           volumes: [
             "metabase_data:/metabase-data"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          secretEnv: [
+            "MB_ENCRYPTION_SECRET_KEY"
+          ],
+          ports: [
+            "3010:3000"
+          ]
         }
-      ]
+      ],
+      configFields: [
+        {
+          key: "MB_ENCRYPTION_SECRET_KEY",
+          service: "metabase",
+          label: "Encryption key",
+          help: "Auto-generated. Encrypts saved database credentials at rest. Never change it after setup.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      connection: {
+        title: "Set up Metabase",
+        description: "Metabase has no preset login. Open the link and the setup wizard will walk you through creating the admin account.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Metabase",
+            source: "publicUrl:metabase",
+            kind: "url",
+            recommended: true,
+            help: "First visit runs the setup wizard \u2014 the account you create there is the admin."
+          }
+        ],
+        firstLogin: {
+          note: "Complete the setup wizard immediately: it is unauthenticated, so whoever opens this URL first becomes the admin. Metabase can take a minute to finish migrations on first boot."
+        }
+      },
+      verified: true
     },
     {
       available: true,
@@ -5036,10 +5176,10 @@ COMMIT;
       }
     },
     {
-      available: false,
+      available: true,
       id: "gitea",
       name: "Gitea",
-      description: "Self-hosted Git with issues, pull requests, and a first-run setup wizard.",
+      description: "Self-hosted Git with issues and pull requests. The admin account below is created for you.",
       kind: "template",
       logo: "gitea",
       category: "other",
@@ -5053,71 +5193,201 @@ COMMIT;
         {
           name: "gitea",
           image: "gitea/gitea:1",
-          ports: [
-            "3000:3000"
-          ],
           exposedPort: 3e3,
           exposed: true,
           environment: {
-            GITEA__server__ROOT_URL: "{{publicUrl:gitea}}"
+            GITEA__server__ROOT_URL: "{{publicUrl:gitea}}",
+            GITEA__security__INSTALL_LOCK: "true",
+            GITEA__security__SECRET_KEY: "{{config:GITEA_SECRET_KEY}}",
+            GITEA__database__DB_TYPE: "sqlite3",
+            GITEA__service__DISABLE_REGISTRATION: "true",
+            GITEA_ADMIN_USERNAME: "admin",
+            GITEA_ADMIN_EMAIL: "admin@example.com"
           },
           volumes: [
             "gitea_data:/data"
           ],
-          restart: "unless-stopped"
-        }
-      ]
-    },
-    {
-      available: false,
-      id: "code-server",
-      name: "code-server",
-      description: "Run VS Code in your browser, on your server. Login uses an auto-generated password.",
-      kind: "template",
-      logo: "code-server",
-      category: "other",
-      tags: [
-        "developer",
-        "ide",
-        "vscode"
-      ],
-      framework: "docker-compose",
-      services: [
-        {
-          name: "code-server",
-          image: "codercom/code-server:latest",
-          ports: [
-            "8080:8080"
-          ],
-          exposedPort: 8080,
-          exposed: true,
+          restart: "unless-stopped",
           secretEnv: [
-            "PASSWORD"
-          ],
-          volumes: [
-            "code_server_config:/home/coder/.config",
-            "code_server_local:/home/coder/.local",
-            "code_server_project:/home/coder/project"
+            "GITEA_ADMIN_PASSWORD"
           ],
-          restart: "unless-stopped"
+          ports: [
+            "3009:3000"
+          ]
         }
       ],
       configFields: [
         {
-          key: "PASSWORD",
-          service: "code-server",
+          key: "GITEA_SECRET_KEY",
+          service: "gitea",
+          label: "Secret key",
+          help: "Auto-generated. Signs Gitea's tokens and locks the installer.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "GITEA_ADMIN_PASSWORD",
+          service: "gitea",
+          label: "Admin password",
+          help: "Auto-generated. Password for the seeded admin account.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      prepare: [
+        {
+          service: "gitea",
+          title: "Create the Gitea admin",
+          description: "Seeds the administrator account so you can sign in immediately.",
+          command: 'su-exec git gitea admin user create --admin --username "$GITEA_ADMIN_USERNAME" --password "$GITEA_ADMIN_PASSWORD" --email "$GITEA_ADMIN_EMAIL" --must-change-password=false 2>&1 || true; echo done',
+          capture: "gitea_admin",
+          phase: "post-ready",
+          readiness: {
+            test: "su-exec git gitea admin user list >/dev/null 2>&1",
+            interval: 3e3,
+            retries: 40
+          }
+        }
+      ],
+      connection: {
+        title: "Sign in to Gitea",
+        description: "Your admin account is created during install. New self-registration is disabled \u2014 invite users from Site Administration.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Gitea",
+            source: "publicUrl:gitea",
+            kind: "url",
+            recommended: true,
+            help: "Sign in with the username and password below."
+          },
+          {
+            id: "username",
+            label: "Admin username",
+            source: "env:gitea:GITEA_ADMIN_USERNAME",
+            width: "half"
+          },
+          {
+            id: "password",
+            label: "Admin password",
+            source: "env:gitea:GITEA_ADMIN_PASSWORD",
+            secret: true,
+            width: "half"
+          }
+        ],
+        firstLogin: {
+          note: "INSTALL_LOCK is on, so the public setup wizard is disabled and cannot be used to hijack the instance. The password above works as-is."
+        }
+      },
+      verified: true
+    },
+    {
+      available: true,
+      verified: true,
+      id: "code-server",
+      name: "code-server",
+      description: "Run VS Code in your browser, on your server. Sign in with the auto-generated password below.",
+      repository: "https://github.com/coder/code-server",
+      kind: "template",
+      logo: "code-server",
+      category: "other",
+      tags: [
+        "developer",
+        "ide",
+        "vscode"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "code-server",
+          image: "codercom/code-server:4.132.0",
+          exposedPort: 8080,
+          exposed: true,
+          routes: [
+            {
+              port: 8080
+            }
+          ],
+          secretEnv: [
+            "PASSWORD"
+          ],
+          volumes: [
+            "code_server_home:/home/coder"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "curl -fsS -o /dev/null http://127.0.0.1:8080/healthz || exit 1"
+            ],
+            interval: "15s",
+            timeout: "5s",
+            retries: 6,
+            startPeriod: "20s"
+          },
+          restart: "unless-stopped",
+          ports: [
+            "8207:8080"
+          ]
+        }
+      ],
+      configFields: [
+        {
+          key: "PASSWORD",
+          service: "code-server",
           label: "Login password",
-          help: "Auto-generated. Required to sign in.",
+          help: "Auto-generated. Required to sign in. Uses PASSWORD (plaintext) rather than HASHED_PASSWORD, which expects an argon2 digest.",
           generate: "secret",
           secret: true
         }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Sign in to code-server",
+        description: "VS Code in the browser. Sign in with the generated password below.",
+        guide: {
+          intro: "A full VS Code editor running on your server, reachable from any browser.",
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Editor",
+            source: "publicUrl:code-server",
+            kind: "url",
+            recommended: true,
+            help: "Opens the browser IDE. Sign in with the password below."
+          },
+          {
+            id: "password",
+            label: "Login password",
+            source: "env:code-server:PASSWORD",
+            secret: true
+          }
+        ],
+        firstLogin: {
+          note: "Your whole home directory is the persisted volume, so files, extensions and settings all survive a redeploy. The editor opens /home/coder by default."
+        }
+      },
+      endpoints: [
+        {
+          service: "code-server",
+          port: 8080,
+          label: "Editor",
+          kind: "http",
+          defaultMode: "domain"
+        }
       ]
     },
     {
-      available: false,
+      available: true,
       id: "uptime-kuma",
       name: "Uptime Kuma",
-      description: "Self-hosted uptime monitoring with status pages and alerts.",
+      description: "Self-hosted uptime monitoring with status pages and alerts. Create your admin account on the first visit.",
       kind: "template",
       logo: "uptime-kuma",
       category: "other",
@@ -5131,23 +5401,44 @@ COMMIT;
         {
           name: "uptime-kuma",
           image: "louislam/uptime-kuma:1",
-          ports: [
-            "3001:3001"
-          ],
           exposedPort: 3001,
           exposed: true,
           volumes: [
             "uptime_kuma_data:/app/data"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "3008:3001"
+          ]
         }
-      ]
+      ],
+      connection: {
+        title: "Set up Uptime Kuma",
+        description: "Uptime Kuma ships with no default login \u2014 the first page you see creates the admin account.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Uptime Kuma",
+            source: "publicUrl:uptime-kuma",
+            kind: "url",
+            recommended: true,
+            help: "First visit prompts you to create the administrator account."
+          }
+        ],
+        firstLogin: {
+          note: "Do this immediately after deploy: until you create the admin, anyone who opens this URL can claim the instance. Monitors and history live in the uptime_kuma_data volume."
+        }
+      },
+      verified: true
     },
     {
-      available: false,
+      available: true,
       id: "vaultwarden",
       name: "Vaultwarden",
-      description: "Lightweight self-hosted password manager (Bitwarden-compatible).",
+      description: "Lightweight self-hosted password manager (Bitwarden-compatible). Open the admin panel with the token below to invite your first account.",
       kind: "template",
       logo: "vaultwarden",
       category: "other",
@@ -5161,26 +5452,75 @@ COMMIT;
         {
           name: "vaultwarden",
           image: "vaultwarden/server:latest",
-          ports: [
-            "80:80"
-          ],
           exposedPort: 80,
           exposed: true,
           environment: {
-            DOMAIN: "{{publicUrl:vaultwarden}}"
+            DOMAIN: "{{publicUrl:vaultwarden}}",
+            SIGNUPS_ALLOWED: "false"
           },
           volumes: [
             "vaultwarden_data:/data"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          secretEnv: [
+            "ADMIN_TOKEN"
+          ],
+          ports: [
+            "8206:80"
+          ]
         }
-      ]
+      ],
+      configFields: [
+        {
+          key: "ADMIN_TOKEN",
+          service: "vaultwarden",
+          label: "Admin panel token",
+          help: "Auto-generated. Unlocks /admin, where you invite your own account.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      connection: {
+        title: "Set up Vaultwarden",
+        description: "Public sign-up is disabled. Open the admin panel with the token below, invite your own email address, then register that address in any Bitwarden client.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "admin",
+            label: "Admin panel",
+            source: "template:{{env:vaultwarden:DOMAIN}}/admin",
+            kind: "url",
+            recommended: true,
+            help: "Paste the admin token below to sign in, then use Invite User."
+          },
+          {
+            id: "url",
+            label: "Vault URL",
+            source: "publicUrl:vaultwarden",
+            kind: "url",
+            help: "Point the Bitwarden app/extension at this as its self-hosted server URL."
+          },
+          {
+            id: "adminToken",
+            label: "Admin token",
+            source: "env:vaultwarden:ADMIN_TOKEN",
+            secret: true,
+            help: "Full control of the server. Treat it like a root password."
+          }
+        ],
+        firstLogin: {
+          note: "Invitations work without SMTP: after inviting your address in /admin, register that same address from the vault URL to set your master password."
+        }
+      },
+      verified: true
     },
     {
-      available: false,
+      available: true,
       id: "freshrss",
       name: "FreshRSS",
-      description: "Self-hosted RSS and Atom feed reader with a first-run setup wizard.",
+      description: "Self-hosted RSS and Atom feed reader. Your account is created during install.",
       kind: "template",
       logo: "freshrss",
       category: "other",
@@ -5194,23 +5534,88 @@ COMMIT;
         {
           name: "freshrss",
           image: "freshrss/freshrss:latest",
-          ports: [
-            "80:80"
-          ],
           exposedPort: 80,
           exposed: true,
           volumes: [
             "freshrss_data:/var/www/FreshRSS/data"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          environment: {
+            FRESHRSS_ADMIN_USERNAME: "admin"
+          },
+          secretEnv: [
+            "FRESHRSS_ADMIN_PASSWORD"
+          ],
+          ports: [
+            "8204:80"
+          ]
         }
-      ]
+      ],
+      configFields: [
+        {
+          key: "FRESHRSS_ADMIN_PASSWORD",
+          service: "freshrss",
+          label: "Admin password",
+          help: "Auto-generated. Password for the account created during install.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      prepare: [
+        {
+          service: "freshrss",
+          title: "Install FreshRSS",
+          description: "Runs the headless installer and creates your account.",
+          command: 'cd /var/www/FreshRSS && { [ -f ./data/config.php ] || php ./cli/do-install.php --default-user="$FRESHRSS_ADMIN_USERNAME" --auth-type=form --db-type=sqlite --api-enabled; } && { php ./cli/list-users.php 2>/dev/null | grep -qx "$FRESHRSS_ADMIN_USERNAME" || php ./cli/create-user.php --user "$FRESHRSS_ADMIN_USERNAME" --password "$FRESHRSS_ADMIN_PASSWORD" --language en; } && ./cli/access-permissions.sh >/dev/null 2>&1; echo done',
+          capture: "freshrss_install",
+          phase: "post-ready",
+          readiness: {
+            test: "test -d /var/www/FreshRSS/cli",
+            interval: 3e3,
+            retries: 30
+          }
+        }
+      ],
+      connection: {
+        title: "Sign in to FreshRSS",
+        description: "FreshRSS is installed headlessly during setup \u2014 sign in with the credentials below.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Reader",
+            source: "publicUrl:freshrss",
+            kind: "url",
+            recommended: true,
+            help: "Sign in with the username and password below."
+          },
+          {
+            id: "username",
+            label: "Username",
+            source: "env:freshrss:FRESHRSS_ADMIN_USERNAME",
+            width: "half"
+          },
+          {
+            id: "password",
+            label: "Password",
+            source: "env:freshrss:FRESHRSS_ADMIN_PASSWORD",
+            secret: true,
+            width: "half"
+          }
+        ],
+        firstLogin: {
+          note: 'Deliberately NOT deployed with the public web installer, so nobody can claim your instance first. Feeds refresh on a schedule only if you set CRON_MIN (e.g. "*/20").'
+        }
+      },
+      verified: true
     },
     {
-      available: false,
+      available: true,
       id: "stirling-pdf",
       name: "Stirling PDF",
-      description: "Split, merge, convert, OCR and edit PDFs locally. Default login is admin / stirling \u2014 change it.",
+      description: "Split, merge, convert, OCR and edit PDFs locally. Sign in with the admin account below.",
       kind: "template",
       logo: "stirling-pdf",
       category: "other",
@@ -5224,21 +5629,72 @@ COMMIT;
         {
           name: "stirling-pdf",
           image: "stirlingtools/stirling-pdf:latest",
-          ports: [
-            "8080:8080"
-          ],
           exposedPort: 8080,
           exposed: true,
           volumes: [
             "stirling_config:/configs",
             "stirling_tessdata:/usr/share/tessdata"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          environment: {
+            SECURITY_ENABLELOGIN: "true",
+            SECURITY_INITIALLOGIN_USERNAME: "admin"
+          },
+          secretEnv: [
+            "SECURITY_INITIALLOGIN_PASSWORD"
+          ],
+          ports: [
+            "8209:8080"
+          ]
         }
-      ]
+      ],
+      configFields: [
+        {
+          key: "SECURITY_INITIALLOGIN_PASSWORD",
+          service: "stirling-pdf",
+          label: "Admin password",
+          help: "Auto-generated. Replaces Stirling's public default password.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      connection: {
+        title: "Sign in to Stirling PDF",
+        description: "Login is enabled and the admin account below is seeded on first boot, so the well-known default password is never used.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Stirling PDF",
+            source: "publicUrl:stirling-pdf",
+            kind: "url",
+            recommended: true,
+            help: "Sign in with the username and password below."
+          },
+          {
+            id: "username",
+            label: "Admin username",
+            source: "env:stirling-pdf:SECURITY_INITIALLOGIN_USERNAME",
+            width: "half"
+          },
+          {
+            id: "password",
+            label: "Admin password",
+            source: "env:stirling-pdf:SECURITY_INITIALLOGIN_PASSWORD",
+            secret: true,
+            width: "half"
+          }
+        ],
+        firstLogin: {
+          note: "Seeding these two values is what prevents Stirling from creating its documented admin/stirling account. The password above works as-is."
+        }
+      },
+      verified: true
     },
     {
-      available: false,
+      available: true,
       id: "it-tools",
       name: "IT-Tools",
       description: "A handy collection of developer and sysadmin utilities. No login, no setup.",
@@ -5255,14 +5711,35 @@ COMMIT;
         {
           name: "it-tools",
           image: "corentinth/it-tools:latest",
-          ports: [
-            "80:80"
-          ],
           exposedPort: 80,
           exposed: true,
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8205:80"
+          ]
         }
-      ]
+      ],
+      connection: {
+        title: "Open IT-Tools",
+        description: "A collection of developer and sysadmin utilities. No login, no setup, nothing stored.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "IT-Tools",
+            source: "publicUrl:it-tools",
+            kind: "url",
+            recommended: true,
+            help: "Opens the tool collection. No sign-in required."
+          }
+        ],
+        firstLogin: {
+          note: "Nothing to log into and nothing persisted \u2014 every tool runs in your browser. Anyone who can reach this URL can use it, so keep it internal if that matters."
+        }
+      },
+      verified: true
     },
     {
       available: true,
@@ -5283,14 +5760,34 @@ COMMIT;
         {
           name: "excalidraw",
           image: "excalidraw/excalidraw:latest",
-          ports: [
-            "8203:80"
-          ],
           exposedPort: 80,
           exposed: true,
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8203:80"
+          ]
         }
-      ]
+      ],
+      connection: {
+        title: "Open Excalidraw",
+        description: "No login and no server-side storage \u2014 open the link and start drawing.",
+        guide: {
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Whiteboard",
+            source: "publicUrl:excalidraw",
+            kind: "url",
+            recommended: true,
+            help: "Opens the whiteboard. No sign-in required."
+          }
+        ],
+        firstLogin: {
+          note: "There is nothing to log into and nothing stored on the server: drawings live in your browser, so use Export to save anything you want to keep. Anyone who can reach this URL can use it \u2014 put it behind your own access control if that matters."
+        }
+      }
     },
     {
       available: false,
@@ -5328,10 +5825,11 @@ COMMIT;
         {
           name: "minio",
           image: "minio/minio:latest",
-          command: "server /data --console-address :9001",
-          ports: [
-            "9000:9000",
-            "9001:9001"
+          commandArgv: [
+            "server",
+            "/data",
+            "--console-address",
+            ":9001"
           ],
           exposedPort: 9001,
           routes: [
@@ -5353,7 +5851,11 @@ COMMIT;
           volumes: [
             "minio_data:/data"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "9001:9001",
+            "9000:9000"
+          ]
         }
       ],
       configFields: [
@@ -5394,8 +5896,7 @@ COMMIT;
             test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
             interval: 1e3,
             retries: 30
-          },
-          once: true
+          }
         }
       ],
       endpoints: [
@@ -5476,7 +5977,7 @@ COMMIT;
     },
     {
       available: true,
-      verified: true,
+      verified: false,
       id: "kafka",
       name: "Apache Kafka",
       description: "Apache Kafka event-streaming broker (KRaft mode \u2014 no ZooKeeper) with the Kafbat Kafka UI web console for topics, messages, and consumer groups.",
@@ -5521,9 +6022,6 @@ COMMIT;
           image: "ghcr.io/kafbat/kafka-ui:latest",
           exposedPort: 8080,
           exposed: true,
-          ports: [
-            "8080:8080"
-          ],
           routes: [
             {
               port: 8080
@@ -5542,7 +6040,10 @@ COMMIT;
           secretEnv: [
             "SPRING_SECURITY_USER_PASSWORD"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8210:8080"
+          ]
         }
       ],
       configFields: [
@@ -5619,9 +6120,6 @@ COMMIT;
         {
           name: "qdrant",
           image: "qdrant/qdrant:v1.18.3",
-          ports: [
-            "6333:6333"
-          ],
           exposedPort: 6333,
           exposed: true,
           routes: [
@@ -5635,7 +6133,10 @@ COMMIT;
           volumes: [
             "qdrant_storage:/qdrant/storage"
           ],
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8215:6333"
+          ]
         }
       ],
       configFields: [
@@ -5697,9 +6198,6 @@ COMMIT;
         {
           name: "meilisearch",
           image: "getmeili/meilisearch:v1.12",
-          ports: [
-            "7700:7700"
-          ],
           exposedPort: 7700,
           exposed: true,
           routes: [
@@ -5727,7 +6225,10 @@ COMMIT;
             retries: 5,
             startPeriod: "10s"
           },
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "8214:7700"
+          ]
         }
       ],
       configFields: [
@@ -5745,7 +6246,7 @@ COMMIT;
       },
       connection: {
         title: "Connect to Meilisearch",
-        description: "Point a Meilisearch client at the URL with the master key. Every request needs the key as a Bearer token.",
+        description: "Point a Meilisearch client at the URL with the master key. Every request needs the key as a Bearer token. There is no web dashboard in production mode \u2014 drive it from a Meilisearch client or curl.",
         guide: {
           intro: "Your project gets a Meilisearch endpoint plus its master key.",
           useHint: "Read `process.env.MEILISEARCH_URL` and `process.env.MEILISEARCH_KEY` in your code \u2014 set on your next deploy.",
@@ -5766,7 +6267,8 @@ COMMIT;
             ],
             envKey: "MEILISEARCH_URL",
             recommended: true,
-            help: "The Meilisearch HTTP endpoint. Switch to Internal for apps on the same project network."
+            help: "HTTP API endpoint \u2014 opening it in a browser returns a JSON status, not a UI (the bundled dashboard is off in production mode). Switch to Internal for apps on the same project network.",
+            kind: "url"
           },
           {
             id: "masterKey",
@@ -5801,14 +6303,14 @@ COMMIT;
     {
       available: true,
       verified: false,
-      hosting: "experimental",
       minResources: {
-        memoryMb: 8192
+        memoryMb: 4096,
+        cpuCores: 2
       },
       id: "neon",
       name: "Neon",
-      description: "Self-hosted Neon \u2014 the serverless-Postgres storage engine (pageserver, 3 safekeepers, storage broker) on S3-backed object storage, with a Neon compute node built from source. EXPERIMENTAL and heavy: ~9 containers, needs roughly 8 GB RAM, and is a test-grade topology, not a production HA cluster. Not for production data.",
-      repository: "https://github.com/neondatabase/neon",
+      description: "Self-hosted Neon \u2014 serverless Postgres with database branching, a web console and per-branch connection strings, in a single container. Built on the community `neond` control plane (Apache-2.0), which bundles Neon's pageserver, safekeeper, storage broker and storage controller behind a management API and dashboard. Neon's own cloud console is proprietary and the upstream neon repo ships no web UI, so a community control plane is the only way to run self-hosted Neon with a dashboard. One container with no HA, a ~1.2 GB image, and it publishes fixed host ports for branch endpoints \u2014 sized for development and preview databases rather than critical data.",
+      repository: "https://github.com/matisiekpl/neond",
       kind: "template",
       logo: "neon",
       category: "database",
@@ -5817,159 +6319,87 @@ COMMIT;
         "postgres",
         "postgresql",
         "serverless",
-        "sql"
+        "sql",
+        "branching"
       ],
       framework: "docker-compose",
       services: [
         {
-          name: "storage_broker",
-          image: "ghcr.io/neondatabase/neon:latest",
-          command: "storage_broker --listen-addr=0.0.0.0:50051",
-          restart: "unless-stopped"
-        },
-        {
-          name: "minio",
-          image: "minio/minio:RELEASE.2025-04-22T22-12-26Z",
-          command: "server /data --address :9000 --console-address :9001",
-          volumes: [
-            "neon_minio_data:/data"
-          ],
-          restart: "unless-stopped"
-        },
-        {
-          name: "pageserver",
-          image: "ghcr.io/neondatabase/neon:latest",
-          dependsOn: [
-            "storage_broker",
-            "minio"
-          ],
-          environment: {
-            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
-          },
-          secretEnv: [
-            "AWS_SECRET_ACCESS_KEY"
-          ],
-          restart: "unless-stopped"
-        },
-        {
-          name: "safekeeper1",
-          image: "ghcr.io/neondatabase/neon:latest",
-          command: "safekeeper --listen-pg=safekeeper1:5454 --listen-http=0.0.0.0:7676 --id=1 --broker-endpoint=http://storage_broker:50051 -D /data --remote-storage={endpoint='http://minio:9000',bucket_name='neon',bucket_region='eu-north-1',prefix_in_bucket='/safekeeper/'}",
-          dependsOn: [
-            "storage_broker",
-            "minio"
-          ],
-          environment: {
-            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
-          },
-          secretEnv: [
-            "AWS_SECRET_ACCESS_KEY"
-          ],
-          restart: "unless-stopped"
-        },
-        {
-          name: "safekeeper2",
-          image: "ghcr.io/neondatabase/neon:latest",
-          command: "safekeeper --listen-pg=safekeeper2:5454 --listen-http=0.0.0.0:7676 --id=2 --broker-endpoint=http://storage_broker:50051 -D /data --remote-storage={endpoint='http://minio:9000',bucket_name='neon',bucket_region='eu-north-1',prefix_in_bucket='/safekeeper/'}",
-          dependsOn: [
-            "storage_broker",
-            "minio"
-          ],
-          environment: {
-            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
-          },
-          secretEnv: [
-            "AWS_SECRET_ACCESS_KEY"
-          ],
-          restart: "unless-stopped"
-        },
-        {
-          name: "safekeeper3",
-          image: "ghcr.io/neondatabase/neon:latest",
-          command: "safekeeper --listen-pg=safekeeper3:5454 --listen-http=0.0.0.0:7676 --id=3 --broker-endpoint=http://storage_broker:50051 -D /data --remote-storage={endpoint='http://minio:9000',bucket_name='neon',bucket_region='eu-north-1',prefix_in_bucket='/safekeeper/'}",
-          dependsOn: [
-            "storage_broker",
-            "minio"
-          ],
-          environment: {
-            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
-          },
-          secretEnv: [
-            "AWS_SECRET_ACCESS_KEY"
-          ],
-          restart: "unless-stopped"
-        },
-        {
-          name: "compute",
-          build: {
-            dockerfile: `FROM ghcr.io/neondatabase/compute-node-v16:latest
-
-USER root
-RUN echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries && \\
-    apt-get update && \\
-    apt-get install -y curl jq netcat-openbsd && \\
-    rm -rf /var/lib/apt/lists/*
-
-COPY compute/compute.sh /shell/compute.sh
-RUN chmod +x /shell/compute.sh
-
-USER postgres
-ENTRYPOINT ["/shell/compute.sh"]
-`,
-            files: [
-              {
-                path: "compute.sh",
-                content: '#!/usr/bin/env bash\nset -eux\n\n# Generate a random tenant or timeline ID\n#\n# Takes a variable name as argument. The result is stored in that variable.\ngenerate_id() {\n    local -n resvar=${1}\n    printf -v resvar \'%08x%08x%08x%08x\' ${SRANDOM} ${SRANDOM} ${SRANDOM} ${SRANDOM}\n}\n\nPG_VERSION=${PG_VERSION:-16}\n\nreadonly CONFIG_FILE_ORG=/var/db/postgres/configs/config.json\nreadonly CONFIG_FILE=/tmp/config.json\n\necho "Waiting pageserver become ready."\nwhile ! nc -z pageserver 6400; do\n     sleep 1\ndone\necho "Page server is ready."\n\ncp "${CONFIG_FILE_ORG}" "${CONFIG_FILE}"\n\nif [[ -n "${TENANT_ID:-}" && -n "${TIMELINE_ID:-}" ]]; then\n   tenant_id=${TENANT_ID}\n   timeline_id=${TIMELINE_ID}\nelse\n  echo "Check if a tenant present"\n  PARAMS=(\n       -X GET\n       -H "Content-Type: application/json"\n       "http://pageserver:9898/v1/tenant"\n  )\n  tenant_id=$(curl "${PARAMS[@]}" | jq -r .[0].id)\n  if [[ -z "${tenant_id}" || "${tenant_id}" = null ]]; then\n    echo "Create a tenant"\n    generate_id tenant_id\n    PARAMS=(\n         -X PUT\n         -H "Content-Type: application/json"\n         -d "{\\"mode\\": \\"AttachedSingle\\", \\"generation\\": 1, \\"tenant_conf\\": {}}"\n        "http://pageserver:9898/v1/tenant/${tenant_id}/location_config"\n    )\n    result=$(curl "${PARAMS[@]}")\n    printf \'%s\\n\' "${result}" | jq .\n  fi\n\n  echo "Check if a timeline present"\n  PARAMS=(\n       -X GET\n       -H "Content-Type: application/json"\n      "http://pageserver:9898/v1/tenant/${tenant_id}/timeline"\n  )\n  timeline_id=$(curl "${PARAMS[@]}" | jq -r .[0].timeline_id)\n  if [[ -z "${timeline_id}" || "${timeline_id}" = null ]]; then\n    generate_id timeline_id\n    PARAMS=(\n        -sbf\n        -X POST\n        -H "Content-Type: application/json"\n        -d "{\\"new_timeline_id\\": \\"${timeline_id}\\", \\"pg_version\\": ${PG_VERSION}}"\n        "http://pageserver:9898/v1/tenant/${tenant_id}/timeline/"\n    )\n    result=$(curl "${PARAMS[@]}")\n    printf \'%s\\n\' "${result}" | jq .\n  fi\nfi\n\necho "Overwrite tenant id and timeline id in spec file"\nsed -i "s|TENANT_ID|${tenant_id}|" ${CONFIG_FILE}\nsed -i "s|TIMELINE_ID|${timeline_id}|" ${CONFIG_FILE}\n\ncat ${CONFIG_FILE}\n\necho "Start compute node"\n/usr/local/bin/compute_ctl --pgdata /var/db/postgres/compute \\\n     -C "postgresql://cloud_admin@localhost:55433/postgres"  \\\n     -b /usr/local/bin/postgres                              \\\n     --compute-id "compute-${RANDOM}"                        \\\n     --config "${CONFIG_FILE}"\n'
-              }
-            ]
-          },
-          dependsOn: [
-            "pageserver",
-            "safekeeper1",
-            "safekeeper2",
-            "safekeeper3"
+          name: "neond",
+          image: "neond/neond:f04d396c133d81e28cf52560ea11ef7e9b814d71",
+          exposed: true,
+          exposedPort: 3e3,
+          routes: [
+            {
+              port: 3e3
+            }
           ],
           environment: {
-            PG_VERSION: "16"
+            PORT: "3000",
+            PORT_RANGE: "55432-55437",
+            DO_NOT_TRACK: "1",
+            TELEMETRY_DISABLED: "1",
+            RUST_LOG: "info"
           },
           ports: [
-            "55433:55433"
+            "8220:3000",
+            "0.0.0.0:55432:55432",
+            "0.0.0.0:55433:55433",
+            "0.0.0.0:55434:55434",
+            "0.0.0.0:55435:55435",
+            "0.0.0.0:55436:55436",
+            "0.0.0.0:55437:55437"
           ],
           volumes: [
-            "neon_compute_data:/var/db/postgres/compute"
+            "neond_data:/neond"
           ],
           healthcheck: {
             test: [
-              "CMD-SHELL",
-              "pg_isready -h 127.0.0.1 -p 55433 -U cloud_admin || exit 1"
+              "CMD",
+              "curl",
+              "-fsS",
+              "http://127.0.0.1:3000/api/auth/setup"
             ],
-            interval: "10s",
+            interval: "30s",
             timeout: "5s",
-            retries: 10,
-            startPeriod: "90s"
+            retries: 3,
+            startPeriod: "5m"
           },
+          stopGracePeriod: "10m",
           restart: "unless-stopped"
         }
       ],
       configFields: [
         {
-          key: "MINIO_ROOT_USER",
-          service: "minio",
-          label: "Object-storage access key",
-          help: "The S3 access key the Neon storage layer uses against its bundled MinIO.",
+          key: "SERVER_SECRET",
+          service: "neond",
+          label: "Server secret",
+          help: "Auto-generated, and PERMANENT \u2014 it is also the password of the internal management Postgres role, so changing it after the first launch makes the control plane unable to open its own database.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "ADMIN_EMAIL",
+          service: "neond",
+          label: "Console admin email",
+          help: "The first account is created for you and is the instance admin. Sign-up closes as soon as it exists.",
           type: "text",
-          default: "neon",
+          default: "admin@openship.local",
           required: true
         },
         {
-          key: "MINIO_ROOT_PASSWORD",
-          service: "minio",
-          label: "Object-storage secret key",
-          help: "Auto-generated. The S3 secret key shared by the pageserver and safekeepers.",
+          key: "ADMIN_PASSWORD",
+          service: "neond",
+          label: "Console admin password",
+          help: "Auto-generated. Use it with the admin email to sign in to the console.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "PG_PASSWORD",
+          service: "neond",
+          label: "Database password",
+          help: "Auto-generated. Set as the password of the `postgres` role on the first branch so the connection string below is usable immediately.",
           generate: "secret",
           secret: true
         }
@@ -5979,100 +6409,88 @@ ENTRYPOINT ["/shell/compute.sh"]
       },
       prepare: [
         {
-          service: "minio",
-          command: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null && mc mb --ignore-existing --region eu-north-1 local/neon > /dev/null && printf %s neon',
-          capture: "bucket",
+          service: "neond",
+          title: "Create the console account and first branch",
+          description: "Signs in (registering the admin on a first install), then ensures an organization, project and branch exist and an endpoint is running, and reports its port. Every run reports a REAL port, so a first attempt that raced the endpoint cannot leave the connection string permanently blank.",
+          command: `set -e; API=http://127.0.0.1:3000/api; J='Content-Type: application/json'; id1() { sed -n 's/.*"id":"\\([^"]*\\)".*/\\1/p' | head -1; }; port1() { sed -n -e 's|.*"connection_string":"[^"]*@[^:"]*:\\([0-9][0-9]*\\)/.*|\\1|p' -e 's/.*"port":\\([0-9][0-9]*\\).*/\\1/p' | head -1; }; get() { curl -fsS -H "$A" "$1" 2>/dev/null || printf ''; }; post() { n=0; while [ $n -lt 20 ]; do r=$(curl -fsS -X POST "$1" -H "$J" -H "$A" -d "$2" 2>/dev/null || printf ''); [ -n "$r" ] && { printf %s "$r"; return 0; }; n=$((n+1)); sleep 2; done; printf ''; }; SETUP=$(curl -fsS "$API/auth/setup" || printf ''); case "$SETUP" in *'"registration_open":true'*) TOKEN=$(curl -fsS -X POST "$API/auth/register" -H "$J" -d "{\\"name\\":\\"Admin\\",\\"email\\":\\"$ADMIN_EMAIL\\",\\"password\\":\\"$ADMIN_PASSWORD\\"}" 2>/dev/null | sed -n 's/.*"token":"\\([^"]*\\)".*/\\1/p') ;; *) TOKEN=$(curl -fsS -X POST "$API/auth/login" -H "$J" -d "{\\"email\\":\\"$ADMIN_EMAIL\\",\\"password\\":\\"$ADMIN_PASSWORD\\"}" 2>/dev/null | sed -n 's/.*"token":"\\([^"]*\\)".*/\\1/p') ;; esac; [ -n "$TOKEN" ] || { echo "pg_port=no-token"; exit 0; }; A="Authorization: Bearer $TOKEN"; ORG=$(get "$API/organizations" | id1); [ -n "$ORG" ] || ORG=$(post "$API/organizations" '{"name":"Default"}' | id1); [ -n "$ORG" ] || { echo "pg_port=no-org"; exit 0; }; P="$API/organizations/$ORG/projects"; PROJ=$(get "$P" | id1); [ -n "$PROJ" ] || PROJ=$(post "$P" '{"name":"main"}' | id1); [ -n "$PROJ" ] || { echo "pg_port=no-project"; exit 0; }; B="$P/$PROJ/branches"; BRJSON=$(get "$B"); BR=$(printf %s "$BRJSON" | id1); if [ -z "$BR" ]; then BR=$(post "$B" '{"name":"production"}' | id1); [ -n "$BR" ] || { echo "pg_port=branch-failed"; exit 0; }; curl -fsS -X PUT "$B/$BR/password" -H "$J" -H "$A" -d "{\\"password\\":\\"$PG_PASSWORD\\"}" >/dev/null 2>&1 || true; fi; PORT=$(printf %s "$BRJSON" | port1); [ -n "$PORT" ] || PORT=$(post "$B/$BR/endpoint" '' | port1); echo "pg_port=\${PORT:-unstarted}"`,
+          capture: "pgPort",
+          capturePattern: "pg_port=([0-9]+)",
+          persistAs: {
+            key: "NEOND_PG_PORT"
+          },
+          once: true,
           phase: "post-ready",
           readiness: {
-            test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
-            interval: 1e3,
-            retries: 30
-          },
-          once: true
+            test: "curl -fsS http://127.0.0.1:3000/api/auth/setup",
+            interval: 5e3,
+            retries: 60
+          }
         }
       ],
       connection: {
-        title: "Connect to Neon",
-        description: "Point a Postgres driver at the compute node. The compute serves the Postgres wire protocol on port 55433 as user cloud_admin.",
+        title: "Open the Neon console",
+        description: "Sign in to the console to manage projects and branches. The install pre-creates the admin account plus a `production` branch with a running endpoint, so the Postgres URL below works immediately.",
         guide: {
-          intro: "Your project gets a Postgres connection served by the Neon compute node.",
-          useHint: "Read process.env.DATABASE_URL in your code \u2014 it's set the next time your project deploys.",
-          defaultMode: "internal"
+          intro: "You get a Neon console for branching plus a normal Postgres connection string for the first branch.",
+          useHint: "Each branch gets its own endpoint on its own port. Create a branch in the console, press Start endpoint, and copy that branch's connection string \u2014 six host ports (55432-55437) are published for endpoints, which is three concurrent branches.",
+          defaultMode: "public"
         },
         outputs: [
+          {
+            id: "console",
+            label: "Neon console",
+            source: "publicUrl:neond",
+            kind: "url",
+            recommended: true,
+            help: "Sign in with the admin email and password below."
+          },
+          {
+            id: "adminEmail",
+            label: "Admin email",
+            source: "env:neond:ADMIN_EMAIL",
+            help: "The instance admin. Sign-up is closed once this account exists."
+          },
+          {
+            id: "adminPassword",
+            label: "Admin password",
+            source: "env:neond:ADMIN_PASSWORD",
+            secret: true
+          },
           {
             id: "dbUrl",
             label: "Database URL",
-            source: "template:postgresql://cloud_admin:cloud_admin@{{host}}:55433/postgres",
-            sourceLabel: "Public",
-            variants: [
-              {
-                id: "internal",
-                label: "Internal",
-                source: "template:postgresql://cloud_admin:cloud_admin@compute:55433/postgres"
-              }
-            ],
+            source: "template:postgresql://postgres:{{env:neond:PG_PASSWORD}}@{{host}}:{{env:neond:NEOND_PG_PORT}}/postgres?sslmode=require",
             secret: true,
             envKey: "DATABASE_URL",
-            recommended: true,
-            help: "Postgres connection (cloud_admin). Published on port 55433. Switch to Internal for apps on the same project network."
-          }
-        ]
-      },
-      endpoints: [
-        {
-          service: "compute",
-          port: 55433,
-          label: "Postgres",
-          kind: "tcp"
-        }
-      ],
-      files: [
-        {
-          service: "pageserver",
-          path: "/data/.neon/pageserver.toml",
-          content: `broker_endpoint='http://storage_broker:50051'
-pg_distrib_dir='/usr/local/'
-listen_pg_addr='0.0.0.0:6400'
-listen_http_addr='0.0.0.0:9898'
-remote_storage={ endpoint='http://minio:9000', bucket_name='neon', bucket_region='eu-north-1', prefix_in_bucket='/pageserver' }
-control_plane_api='http://0.0.0.0:6666'
-control_plane_emergency_mode=true
-virtual_file_io_mode="buffered"
-`
-        },
-        {
-          service: "pageserver",
-          path: "/data/.neon/identity.toml",
-          content: "id=1234\n"
-        },
-        {
-          service: "compute",
-          path: "/var/db/postgres/configs/config.json",
-          content: '{\n    "spec": {\n        "format_version": 1.0,\n\n        "timestamp": "2022-10-12T18:00:00.000Z",\n        "operation_uuid": "0f657b36-4b0f-4a2d-9c2e-1dcd615e7d8c",\n        "suspend_timeout_seconds": -1,\n\n        "cluster": {\n            "cluster_id": "docker_compose",\n            "name": "docker_compose_test",\n            "state": "restarted",\n            "roles": [\n                {\n                    "name": "cloud_admin",\n                    "encrypted_password": "b093c0d3b281ba6da1eacc608620abd8",\n                    "options": null\n                }\n            ],\n            "databases": [\n            ],\n            "settings": [\n                {\n                    "name": "fsync",\n                    "value": "off",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "wal_level",\n                    "value": "logical",\n                    "vartype": "enum"\n                },\n                {\n                    "name": "wal_log_hints",\n                    "value": "on",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "log_connections",\n                    "value": "on",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "port",\n                    "value": "55433",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "shared_buffers",\n                    "value": "1MB",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_connections",\n                    "value": "100",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "listen_addresses",\n                    "value": "0.0.0.0",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_wal_senders",\n                    "value": "10",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "max_replication_slots",\n                    "value": "10",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "wal_sender_timeout",\n                    "value": "5s",\n                    "vartype": "string"\n                },\n                {\n                    "name": "wal_keep_size",\n                    "value": "0",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "password_encryption",\n                    "value": "md5",\n                    "vartype": "enum"\n                },\n                {\n                    "name": "restart_after_crash",\n                    "value": "off",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "synchronous_standby_names",\n                    "value": "walproposer",\n                    "vartype": "string"\n                },\n                {\n                    "name": "shared_preload_libraries",\n                    "value": "neon,pg_cron,timescaledb,pg_stat_statements",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.safekeepers",\n                    "value": "safekeeper1:5454,safekeeper2:5454,safekeeper3:5454",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.timeline_id",\n                    "value": "TIMELINE_ID",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.tenant_id",\n                    "value": "TENANT_ID",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.pageserver_connstring",\n                    "value": "host=pageserver port=6400",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_replication_write_lag",\n                    "value": "500MB",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_replication_flush_lag",\n                    "value": "10GB",\n                    "vartype": "string"\n                },\n                {\n                    "name": "cron.database",\n                    "value": "postgres",\n                    "vartype": "string"\n                }\n            ]\n        },\n\n        "delta_operations": [\n        ]\n    },\n    "compute_ctl_config": {\n        "jwks": {\n            "keys": [\n                {\n                    "use": "sig",\n                    "key_ops": [\n                        "verify"\n                    ],\n                    "alg": "EdDSA",\n                    "kid": "ZGIxMzAzOGY0YWQwODk2ODU1MTk1NzMxMDFkYmUyOWU2NzZkOWNjNjMyMGRkZGJjOWY0MjdjYWVmNzE1MjUyOAo=",\n                    "kty": "OKP",\n                    "crv": "Ed25519",\n                    "x": "MGQ4ZDFhOTdmNTM0NmUwMDc3ZmJkN2Q0MWE0ZmI3M2NhNWE3YjFjOTNkM2IyYzRkZTQzOGM3MjBkZTk3N2E5ZAo="\n                }\n            ]\n        }\n    }\n}\n'
+            help: "The `production` branch endpoint. Neon assigns each endpoint its own port, so if this shows no port the endpoint has not started yet \u2014 open the console and press Start endpoint, then read the connection string there."
+          }
+        ],
+        firstLogin: {
+          note: `The admin account is created during install \u2014 use the email and password above. First boot initialises two embedded Postgres instances and can take a couple of minutes after a ~1.2 GB image pull.
+
+Two things worth knowing, both upstream behaviour: if the console shows a branch as running but connections fail, stop and start that endpoint from the console \u2014 restarting the container can leave a stale compute lock behind while the API still reports it healthy. And if the container is killed hard (out of memory, power loss) it can refuse to boot with "lease already held"; delete neon_daemon_data/.lock inside the app's volume while nothing is running. An ordinary redeploy is safe \u2014 it shuts down gracefully and releases the lock.`
         }
-      ],
-      provides: [
+      },
+      endpoints: [
         {
-          id: "postgres",
-          outputRefs: [
-            "dbUrl"
-          ],
-          category: "database"
+          service: "neond",
+          port: 3e3,
+          label: "Console",
+          kind: "http",
+          defaultMode: "domain"
         }
       ]
     },
     {
       available: true,
       verified: false,
-      hosting: "experimental",
       minResources: {
-        memoryMb: 8192,
+        memoryMb: 16384,
         cpuCores: 4
       },
       id: "posthog",
       name: "PostHog",
-      description: "Self-hosted PostHog \u2014 product analytics, session replay, and feature flags. EXPERIMENTAL and heavy: the hobby stack runs the PostHog app plus Postgres, Redis, ClickHouse, Zookeeper, a Kafka-compatible broker (Redpanda), and MinIO (~9 containers) and wants roughly 4 vCPU / 8\u201316 GB RAM. Not for production.",
+      description: "Self-hosted PostHog \u2014 product analytics, session replay, and feature flags, with real event ingestion. This mirrors PostHog's own hobby topology: a Caddy path router in front of the Django app, the Rust capture/flags/hypercache/persons services, the Node ingestion consumers, ClickHouse + Kafka + Postgres + Redis + Valkey + S3. Heavy: 21 containers, roughly 4 vCPU / 16 GB RAM and 30+ GB disk. PostHog ships no tagged releases for self-hosting and rebuilds `latest` hourly, so this tracks a moving upstream.",
       repository: "https://github.com/PostHog/posthog",
       kind: "template",
       logo: "posthog",
@@ -6086,6 +6504,37 @@ virtual_file_io_mode="buffered"
       ],
       framework: "docker-compose",
       services: [
+        {
+          name: "proxy",
+          image: "caddy:2.10-alpine",
+          exposed: true,
+          exposedPort: 80,
+          routes: [
+            {
+              port: 80
+            }
+          ],
+          dependsOn: [
+            "web",
+            "capture",
+            "replay-capture",
+            "feature-flags",
+            "hypercache-server",
+            "plugins",
+            "objectstorage"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget --no-verbose --tries=1 --spider http://127.0.0.1:80/openship-health || exit 1"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 12,
+            startPeriod: "60s"
+          },
+          restart: "unless-stopped"
+        },
         {
           name: "db",
           image: "postgres:15.12-alpine",
@@ -6105,16 +6554,22 @@ virtual_file_io_mode="buffered"
               "pg_isready -U posthog"
             ],
             interval: "5s",
-            timeout: "5s",
-            retries: 10,
+            timeout: "30s",
+            retries: 30,
             startPeriod: "10s"
           },
           restart: "unless-stopped"
         },
         {
-          name: "redis",
+          name: "redis7",
           image: "redis:7.2-alpine",
-          command: "redis-server --maxmemory-policy allkeys-lru --maxmemory 200mb",
+          commandArgv: [
+            "redis-server",
+            "--maxmemory-policy",
+            "allkeys-lru",
+            "--maxmemory",
+            "200mb"
+          ],
           volumes: [
             "posthog_redis:/data"
           ],
@@ -6124,8 +6579,30 @@ virtual_file_io_mode="buffered"
               "redis-cli",
               "ping"
             ],
-            interval: "5s",
-            timeout: "5s",
+            interval: "3s",
+            timeout: "10s",
+            retries: 10
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "valkey",
+          image: "valkey/valkey:8.1-alpine",
+          commandArgv: [
+            "valkey-server",
+            "--maxmemory-policy",
+            "allkeys-lru",
+            "--maxmemory",
+            "200mb"
+          ],
+          healthcheck: {
+            test: [
+              "CMD",
+              "valkey-cli",
+              "ping"
+            ],
+            interval: "3s",
+            timeout: "10s",
             retries: 10
           },
           restart: "unless-stopped"
@@ -6139,41 +6616,90 @@ virtual_file_io_mode="buffered"
           },
           volumes: [
             "posthog_zk_data:/data",
-            "posthog_zk_datalog:/datalog"
+            "posthog_zk_datalog:/datalog",
+            "posthog_zk_logs:/logs"
           ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "echo ruok | nc -w 2 localhost 2181 | grep -q imok"
+            ],
+            interval: "5s",
+            timeout: "10s",
+            retries: 20,
+            startPeriod: "10s"
+          },
           restart: "unless-stopped"
         },
         {
           name: "kafka",
-          image: "docker.io/redpandadata/redpanda:v25.1.9",
-          command: "redpanda start --kafka-addr internal://0.0.0.0:9092 --advertise-kafka-addr internal://kafka:9092 --mode dev-container --smp 1 --memory 1G",
+          image: "apache/kafka:4.1.0",
+          environment: {
+            KAFKA_NODE_ID: "1",
+            KAFKA_PROCESS_ROLES: "broker,controller",
+            KAFKA_LISTENERS: "PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093",
+            KAFKA_ADVERTISED_LISTENERS: "PLAINTEXT://kafka:9092",
+            KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: "CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT",
+            KAFKA_CONTROLLER_LISTENER_NAMES: "CONTROLLER",
+            KAFKA_INTER_BROKER_LISTENER_NAME: "PLAINTEXT",
+            KAFKA_CONTROLLER_QUORUM_VOTERS: "1@kafka:9093",
+            KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: "1",
+            KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: "1",
+            KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: "1",
+            KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: "0",
+            KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true",
+            KAFKA_NUM_PARTITIONS: "1",
+            KAFKA_DEFAULT_REPLICATION_FACTOR: "1",
+            KAFKA_LOG_RETENTION_HOURS: "1",
+            KAFKA_LOG_DIRS: "/var/lib/kafka/data"
+          },
           volumes: [
-            "posthog_kafka:/var/lib/redpanda/data"
+            "posthog_kafka:/var/lib/kafka/data"
           ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092 >/dev/null 2>&1 || exit 1"
+            ],
+            interval: "5s",
+            timeout: "10s",
+            retries: 30,
+            startPeriod: "20s"
+          },
           restart: "unless-stopped"
         },
         {
           name: "clickhouse",
-          image: "clickhouse/clickhouse-server:24.12",
+          image: "clickhouse/clickhouse-server:26.6.2.158",
           dependsOn: [
-            "kafka",
-            "zookeeper"
+            "zookeeper",
+            "kafka"
           ],
           environment: {
-            CLICKHOUSE_SKIP_USER_SETUP: "1"
+            CLICKHOUSE_SKIP_USER_SETUP: "1",
+            KAFKA_HOSTS: "kafka:9092"
           },
           volumes: [
             "posthog_clickhouse:/var/lib/clickhouse"
           ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget --no-verbose --tries=1 --spider http://localhost:8123/ping || exit 1"
+            ],
+            interval: "3s",
+            timeout: "10s",
+            retries: 30,
+            startPeriod: "20s"
+          },
           restart: "unless-stopped"
         },
         {
           name: "objectstorage",
-          image: "minio/minio:RELEASE.2025-04-22T22-12-26Z",
-          command: "server /data --console-address :9001",
-          secretEnv: [
-            "MINIO_ROOT_PASSWORD"
-          ],
+          image: "chrislusf/seaweedfs:4.29",
+          environment: {
+            S3_BUCKET: "posthog,ducklake-dev,ai-blobs"
+          },
           volumes: [
             "posthog_objectstorage:/data"
           ],
@@ -6182,116 +6708,468 @@ virtual_file_io_mode="buffered"
         {
           name: "web",
           image: "posthog/posthog:latest",
-          command: "./bin/docker-server",
+          commandArgv: [
+            "sh",
+            "-c",
+            "./bin/migrate && exec ./bin/docker-server"
+          ],
           dependsOn: [
             "db",
-            "redis",
+            "redis7",
             "clickhouse",
             "kafka",
-            "objectstorage"
-          ],
-          exposedPort: 8e3,
-          exposed: true,
-          routes: [
-            {
-              port: 8e3
-            }
+            "objectstorage",
+            "personhog-router"
           ],
           environment: {
             DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_DB_WRITER_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_DB_READER_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PGHOST: "db",
+            PGUSER: "posthog",
+            PGPASSWORD: "{{config:POSTGRES_PASSWORD}}",
             CLICKHOUSE_HOST: "clickhouse",
             CLICKHOUSE_DATABASE: "posthog",
             CLICKHOUSE_SECURE: "false",
             CLICKHOUSE_VERIFY: "false",
-            KAFKA_HOSTS: "kafka:9092",
-            KAFKA_URL: "kafka://kafka:9092",
-            REDIS_URL: "redis://redis:6379/",
+            CLICKHOUSE_API_USER: "api",
+            CLICKHOUSE_API_PASSWORD: "apipass",
+            CLICKHOUSE_APP_USER: "app",
+            CLICKHOUSE_APP_PASSWORD: "apppass",
+            CLICKHOUSE_BILLING_USER: "billing",
+            CLICKHOUSE_BILLING_PASSWORD: "billingpass",
+            CLICKHOUSE_DICT_READER_USER: "dict_reader",
+            CLICKHOUSE_DICT_READER_PASSWORD: "dictreaderpass",
+            CLICKHOUSE_LOGS_CLUSTER_HOST: "clickhouse",
+            CLICKHOUSE_LOGS_CLUSTER_SECURE: "false",
+            REDIS_URL: "redis://redis7:6379/",
+            KAFKA_HOSTS: "kafka",
+            DEPLOYMENT: "hobby",
             SECRET_KEY: "{{config:POSTHOG_SECRET}}",
-            OBJECT_STORAGE_ENABLED: "True",
-            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:9000",
-            OBJECT_STORAGE_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            OBJECT_STORAGE_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}",
-            OBJECT_STORAGE_BUCKET: "posthog",
-            SITE_URL: "{{publicUrl:web}}",
-            DISABLE_SECURE_SSL_REDIRECT: "true",
+            SITE_URL: "{{publicUrl:proxy}}",
             IS_BEHIND_PROXY: "true",
-            TRUST_ALL_PROXIES: "true"
+            DISABLE_SECURE_SSL_REDIRECT: "true",
+            OTEL_SDK_DISABLED: "true",
+            OPT_OUT_CAPTURE: "false",
+            FLAGS_REDIS_ENABLED: "false",
+            FEATURE_FLAGS_SERVICE_URL: "http://feature-flags:3001",
+            CDP_API_URL: "http://plugins:6738",
+            RECORDING_API_URL: "http://recording-api:6738",
+            PERSONHOG_ADDR: "personhog-router:50052",
+            PERSONHOG_ENABLED: "true",
+            OBJECT_STORAGE_ENABLED: "true",
+            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:8333",
+            OBJECT_STORAGE_PUBLIC_ENDPOINT: "{{publicUrl:proxy}}",
+            OBJECT_STORAGE_FORCE_PATH_STYLE: "true",
+            OBJECT_STORAGE_BUCKET: "posthog",
+            OBJECT_STORAGE_ACCESS_KEY_ID: "posthog",
+            OBJECT_STORAGE_SECRET_ACCESS_KEY: "posthog",
+            SESSION_RECORDING_V2_S3_ENDPOINT: "http://objectstorage:8333",
+            SESSION_RECORDING_V2_S3_ACCESS_KEY_ID: "any",
+            SESSION_RECORDING_V2_S3_SECRET_ACCESS_KEY: "any"
           },
           secretEnv: [
             "DATABASE_URL",
-            "SECRET_KEY",
-            "OBJECT_STORAGE_SECRET_ACCESS_KEY"
+            "PERSONS_DB_WRITER_URL",
+            "PERSONS_DB_READER_URL",
+            "PGPASSWORD",
+            "SECRET_KEY"
           ],
           restart: "unless-stopped"
         },
         {
           name: "worker",
           image: "posthog/posthog:latest",
-          command: "./bin/docker-worker-celery --with-scheduler",
+          commandArgv: [
+            "./bin/docker-worker-celery",
+            "--with-scheduler"
+          ],
+          dependsOn: [
+            "db",
+            "redis7",
+            "clickhouse",
+            "kafka",
+            "objectstorage",
+            "web",
+            "personhog-router"
+          ],
+          environment: {
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_DB_WRITER_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_DB_READER_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PGHOST: "db",
+            PGUSER: "posthog",
+            PGPASSWORD: "{{config:POSTGRES_PASSWORD}}",
+            CLICKHOUSE_HOST: "clickhouse",
+            CLICKHOUSE_DATABASE: "posthog",
+            CLICKHOUSE_SECURE: "false",
+            CLICKHOUSE_VERIFY: "false",
+            CLICKHOUSE_API_USER: "api",
+            CLICKHOUSE_API_PASSWORD: "apipass",
+            CLICKHOUSE_APP_USER: "app",
+            CLICKHOUSE_APP_PASSWORD: "apppass",
+            CLICKHOUSE_BILLING_USER: "billing",
+            CLICKHOUSE_BILLING_PASSWORD: "billingpass",
+            CLICKHOUSE_DICT_READER_USER: "dict_reader",
+            CLICKHOUSE_DICT_READER_PASSWORD: "dictreaderpass",
+            CLICKHOUSE_LOGS_CLUSTER_HOST: "clickhouse",
+            CLICKHOUSE_LOGS_CLUSTER_SECURE: "false",
+            REDIS_URL: "redis://redis7:6379/",
+            KAFKA_HOSTS: "kafka",
+            DEPLOYMENT: "hobby",
+            POSTHOG_SKIP_MIGRATION_CHECKS: "1",
+            SECRET_KEY: "{{config:POSTHOG_SECRET}}",
+            SITE_URL: "{{publicUrl:proxy}}",
+            IS_BEHIND_PROXY: "true",
+            DISABLE_SECURE_SSL_REDIRECT: "true",
+            OTEL_SDK_DISABLED: "true",
+            FLAGS_REDIS_ENABLED: "false",
+            FEATURE_FLAGS_SERVICE_URL: "http://feature-flags:3001",
+            CDP_API_URL: "http://plugins:6738",
+            RECORDING_API_URL: "http://recording-api:6738",
+            PERSONHOG_ADDR: "personhog-router:50052",
+            PERSONHOG_ENABLED: "true",
+            OBJECT_STORAGE_ENABLED: "true",
+            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:8333",
+            OBJECT_STORAGE_PUBLIC_ENDPOINT: "{{publicUrl:proxy}}",
+            OBJECT_STORAGE_FORCE_PATH_STYLE: "true",
+            OBJECT_STORAGE_BUCKET: "posthog",
+            OBJECT_STORAGE_ACCESS_KEY_ID: "posthog",
+            OBJECT_STORAGE_SECRET_ACCESS_KEY: "posthog",
+            SESSION_RECORDING_V2_S3_ENDPOINT: "http://objectstorage:8333",
+            SESSION_RECORDING_V2_S3_ACCESS_KEY_ID: "any",
+            SESSION_RECORDING_V2_S3_SECRET_ACCESS_KEY: "any"
+          },
+          secretEnv: [
+            "DATABASE_URL",
+            "PERSONS_DB_WRITER_URL",
+            "PERSONS_DB_READER_URL",
+            "PGPASSWORD",
+            "SECRET_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "capture",
+          image: "ghcr.io/posthog/posthog/capture:master",
+          dependsOn: [
+            "kafka",
+            "redis7"
+          ],
+          environment: {
+            ADDRESS: "0.0.0.0:3000",
+            CAPTURE_MODE: "events",
+            KAFKA_TOPIC: "events_plugin_ingestion",
+            KAFKA_HOSTS: "kafka:9092",
+            REDIS_URL: "redis://redis7:6379/",
+            RUST_LOG: "info,rdkafka=warn",
+            CAPTURE_V1_SINKS: "msk",
+            CAPTURE_V1_SINK_MSK_KAFKA_HOSTS: "kafka:9092",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_MAIN: "events_plugin_ingestion",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_HISTORICAL: "events_plugin_ingestion_historical",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_OVERFLOW: "events_plugin_ingestion_overflow",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_DLQ: "events_plugin_ingestion_dlq",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_EXCEPTION: "ingestion-errortracking-main",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_HEATMAP: "heatmaps_ingestion",
+            CAPTURE_V1_SINK_MSK_KAFKA_TOPIC_CLIENT_INGESTION_WARNING: "ingestion-clientwarnings-main-1"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "replay-capture",
+          image: "ghcr.io/posthog/posthog/capture:master",
+          dependsOn: [
+            "kafka",
+            "redis7"
+          ],
+          environment: {
+            ADDRESS: "0.0.0.0:3000",
+            CAPTURE_MODE: "recordings",
+            KAFKA_TOPIC: "session_recording_snapshot_item_events",
+            KAFKA_HOSTS: "kafka:9092",
+            REDIS_URL: "redis://redis7:6379/",
+            RUST_LOG: "info,rdkafka=warn"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "ingestion-general",
+          image: "posthog/posthog-node:latest",
+          commandArgv: [
+            "node",
+            "nodejs/dist/index.js"
+          ],
+          dependsOn: [
+            "db",
+            "redis7",
+            "clickhouse",
+            "kafka",
+            "objectstorage",
+            "personhog-router"
+          ],
+          environment: {
+            PLUGIN_SERVER_MODE: "ingestion-v2-combined",
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            BEHAVIORAL_COHORTS_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            KAFKA_HOSTS: "kafka:9092",
+            REDIS_URL: "redis://redis7:6379/",
+            CLICKHOUSE_HOST: "clickhouse",
+            CLICKHOUSE_DATABASE: "posthog",
+            CLICKHOUSE_SECURE: "false",
+            CLICKHOUSE_VERIFY: "false",
+            COOKIELESS_REDIS_HOST: "redis7",
+            COOKIELESS_REDIS_PORT: "6379",
+            CDP_REDIS_HOST: "redis7",
+            CDP_REDIS_PORT: "6379",
+            CDP_VALKEY_HOST: "valkey",
+            CDP_VALKEY_PORT: "6379",
+            PERSONHOG_ADDR: "personhog-router:50052",
+            PERSONHOG_ENABLED: "true",
+            AI_BLOB_S3_BUCKET: "ai-blobs",
+            AI_BLOB_S3_PREFIX: "aio/",
+            AI_BLOB_S3_ENDPOINT: "http://objectstorage:8333",
+            AI_BLOB_S3_REGION: "us-east-1",
+            AI_BLOB_S3_ACCESS_KEY_ID: "any",
+            AI_BLOB_S3_SECRET_ACCESS_KEY: "any",
+            AI_BLOB_OFFLOAD_TEAMS: "*"
+          },
+          secretEnv: [
+            "DATABASE_URL",
+            "PERSONS_DATABASE_URL",
+            "BEHAVIORAL_COHORTS_DATABASE_URL"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "ingestion-sessionreplay",
+          image: "posthog/posthog-node:latest",
+          commandArgv: [
+            "node",
+            "nodejs/dist/index.js"
+          ],
+          dependsOn: [
+            "db",
+            "redis7",
+            "kafka",
+            "objectstorage"
+          ],
+          environment: {
+            PLUGIN_SERVER_MODE: "recordings-blob-ingestion-v2",
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            KAFKA_HOSTS: "kafka:9092",
+            REDIS_URL: "redis://redis7:6379/",
+            SESSION_RECORDING_V2_S3_ENDPOINT: "http://objectstorage:8333",
+            SESSION_RECORDING_V2_S3_ACCESS_KEY_ID: "any",
+            SESSION_RECORDING_V2_S3_SECRET_ACCESS_KEY: "any",
+            SESSION_RECORDING_V2_S3_TIMEOUT_MS: "120000",
+            CDP_REDIS_HOST: "redis7",
+            CDP_REDIS_PORT: "6379",
+            CDP_VALKEY_HOST: "valkey",
+            CDP_VALKEY_PORT: "6379"
+          },
+          secretEnv: [
+            "DATABASE_URL"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "recording-api",
+          image: "posthog/posthog-node:latest",
+          commandArgv: [
+            "node",
+            "nodejs/dist/index.js"
+          ],
+          dependsOn: [
+            "db",
+            "redis7",
+            "clickhouse"
+          ],
+          environment: {
+            PLUGIN_SERVER_MODE: "recording-api",
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            REDIS_URL: "redis://redis7:6379/",
+            CLICKHOUSE_HOST: "clickhouse",
+            CLICKHOUSE_DATABASE: "posthog",
+            CLICKHOUSE_SECURE: "false",
+            CLICKHOUSE_VERIFY: "false",
+            SESSION_RECORDING_API_REDIS_HOST: "redis7",
+            SESSION_RECORDING_API_REDIS_PORT: "6379",
+            SESSION_RECORDING_V2_S3_ENDPOINT: "http://objectstorage:8333",
+            SESSION_RECORDING_V2_S3_ACCESS_KEY_ID: "any",
+            SESSION_RECORDING_V2_S3_SECRET_ACCESS_KEY: "any",
+            CDP_REDIS_HOST: "redis7",
+            CDP_REDIS_PORT: "6379",
+            CDP_VALKEY_HOST: "valkey",
+            CDP_VALKEY_PORT: "6379"
+          },
+          secretEnv: [
+            "DATABASE_URL"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "feature-flags",
+          image: "ghcr.io/posthog/posthog/feature-flags:master",
+          dependsOn: [
+            "db",
+            "redis7"
+          ],
+          environment: {
+            ADDRESS: "0.0.0.0:3001",
+            WRITE_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            READ_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_WRITE_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_READ_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            REDIS_URL: "redis://redis7:6379/",
+            COOKIELESS_REDIS_HOST: "redis7",
+            COOKIELESS_REDIS_PORT: "6379",
+            MAXMIND_DB_PATH: "/app/share/GeoLite2-City.mmdb",
+            RUST_LOG: "info"
+          },
+          secretEnv: [
+            "WRITE_DATABASE_URL",
+            "READ_DATABASE_URL",
+            "PERSONS_WRITE_DATABASE_URL",
+            "PERSONS_READ_DATABASE_URL"
+          ],
+          healthcheck: {
+            test: [
+              "CMD",
+              "curl",
+              "-f",
+              "http://localhost:3001/_readiness"
+            ],
+            interval: "5s",
+            timeout: "5s",
+            retries: 12,
+            startPeriod: "10s"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "hypercache-server",
+          image: "ghcr.io/posthog/posthog/hypercache-server:master",
+          dependsOn: [
+            "redis7"
+          ],
+          environment: {
+            ADDRESS: "0.0.0.0:3002",
+            REDIS_URL: "redis://redis7:6379/",
+            RUST_LOG: "info"
+          },
+          healthcheck: {
+            test: [
+              "CMD",
+              "curl",
+              "-f",
+              "http://localhost:3002/_readiness"
+            ],
+            interval: "5s",
+            timeout: "5s",
+            retries: 12,
+            startPeriod: "10s"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "personhog-replica",
+          image: "ghcr.io/posthog/posthog/personhog-replica:master",
+          dependsOn: [
+            "db"
+          ],
+          environment: {
+            GRPC_ADDRESS: "0.0.0.0:50051",
+            PRIMARY_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            METRICS_PORT: "9100",
+            RUST_LOG: "info"
+          },
+          secretEnv: [
+            "PRIMARY_DATABASE_URL"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "personhog-router",
+          image: "ghcr.io/posthog/posthog/personhog-router:master",
+          dependsOn: [
+            "personhog-replica"
+          ],
+          environment: {
+            GRPC_ADDRESS: "0.0.0.0:50052",
+            REPLICA_URL: "http://personhog-replica:50051",
+            BACKEND_TIMEOUT_MS: "5000",
+            METRICS_PORT: "9101",
+            RUST_LOG: "info"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "property-defs-rs",
+          image: "ghcr.io/posthog/posthog/property-defs-rs:master",
           dependsOn: [
             "db",
-            "redis",
-            "clickhouse",
-            "kafka",
-            "objectstorage",
-            "web"
+            "kafka"
           ],
           environment: {
             DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
-            CLICKHOUSE_HOST: "clickhouse",
-            CLICKHOUSE_DATABASE: "posthog",
-            CLICKHOUSE_SECURE: "false",
-            CLICKHOUSE_VERIFY: "false",
             KAFKA_HOSTS: "kafka:9092",
-            KAFKA_URL: "kafka://kafka:9092",
-            REDIS_URL: "redis://redis:6379/",
-            SECRET_KEY: "{{config:POSTHOG_SECRET}}",
-            OBJECT_STORAGE_ENABLED: "True",
-            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:9000",
-            OBJECT_STORAGE_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            OBJECT_STORAGE_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}",
-            OBJECT_STORAGE_BUCKET: "posthog",
-            SITE_URL: "{{publicUrl:web}}"
+            SKIP_WRITES: "false",
+            SKIP_READS: "false",
+            FILTER_MODE: "opt-out",
+            RUST_LOG: "info"
           },
           secretEnv: [
-            "DATABASE_URL",
-            "SECRET_KEY",
-            "OBJECT_STORAGE_SECRET_ACCESS_KEY"
+            "DATABASE_URL"
           ],
           restart: "unless-stopped"
         },
         {
           name: "plugins",
-          image: "posthog/posthog:latest",
-          command: "./bin/plugin-server --no-restart-loop",
+          image: "posthog/posthog-node:latest",
+          commandArgv: [
+            "node",
+            "nodejs/dist/index.js"
+          ],
           dependsOn: [
             "db",
-            "redis",
+            "redis7",
+            "valkey",
             "clickhouse",
             "kafka",
-            "objectstorage",
-            "web"
+            "objectstorage"
           ],
           environment: {
             DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            PERSONS_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            BEHAVIORAL_COHORTS_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            CYCLOTRON_DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            KAFKA_HOSTS: "kafka:9092",
+            REDIS_URL: "redis://redis7:6379/",
             CLICKHOUSE_HOST: "clickhouse",
             CLICKHOUSE_DATABASE: "posthog",
             CLICKHOUSE_SECURE: "false",
             CLICKHOUSE_VERIFY: "false",
-            KAFKA_HOSTS: "kafka:9092",
-            KAFKA_URL: "kafka://kafka:9092",
-            REDIS_URL: "redis://redis:6379/",
+            SITE_URL: "{{publicUrl:proxy}}",
             SECRET_KEY: "{{config:POSTHOG_SECRET}}",
-            OBJECT_STORAGE_ENABLED: "True",
-            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:9000",
-            OBJECT_STORAGE_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
-            OBJECT_STORAGE_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}",
-            OBJECT_STORAGE_BUCKET: "posthog"
+            CDP_REDIS_HOST: "redis7",
+            CDP_REDIS_PORT: "6379",
+            CDP_VALKEY_HOST: "valkey",
+            CDP_VALKEY_PORT: "6379",
+            OBJECT_STORAGE_ENABLED: "true",
+            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:8333",
+            OBJECT_STORAGE_PUBLIC_ENDPOINT: "{{publicUrl:proxy}}",
+            OBJECT_STORAGE_FORCE_PATH_STYLE: "true",
+            OBJECT_STORAGE_BUCKET: "posthog",
+            OBJECT_STORAGE_ACCESS_KEY_ID: "any",
+            OBJECT_STORAGE_SECRET_ACCESS_KEY: "any"
           },
           secretEnv: [
             "DATABASE_URL",
-            "SECRET_KEY",
-            "OBJECT_STORAGE_SECRET_ACCESS_KEY"
+            "PERSONS_DATABASE_URL",
+            "BEHAVIORAL_COHORTS_DATABASE_URL",
+            "CYCLOTRON_DATABASE_URL",
+            "SECRET_KEY"
           ],
           restart: "unless-stopped"
         }
@@ -6301,7 +7179,7 @@ virtual_file_io_mode="buffered"
           key: "POSTGRES_PASSWORD",
           service: "db",
           label: "Database password",
-          help: "Auto-generated. The Postgres password PostHog uses.",
+          help: "Auto-generated. The Postgres password every PostHog service uses.",
           generate: "secret",
           secret: true
         },
@@ -6312,77 +7190,126 @@ virtual_file_io_mode="buffered"
           help: "Auto-generated. Signs sessions and cookies (SECRET_KEY).",
           generate: "secret",
           secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      files: [
+        {
+          service: "proxy",
+          path: "/etc/caddy/Caddyfile",
+          content: "{\n	servers {\n		trusted_proxies static 127.0.0.1/32 ::1/128 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16\n	}\n}\n\n# Host-less site address on purpose. PostHog's own default is\n# `http://localhost:8000`, which compiles to a Host matcher \u2014 behind Openship's\n# edge a foreign Host then returns an empty HTTP 200 instead of a 404, so every\n# ingestion POST would look successful while the events were silently dropped.\n# `:80` also emits no automatic_https and no tls app, so Caddy never tries ACME.\n:80 {\n	# Health target for the container healthcheck. Deliberately answered by\n	# Caddy itself: proxying /_health through to Django would report unhealthy\n	# for the whole first-boot migration window and raise a false incident.\n	@openship-health {\n		path /openship-health\n	}\n\n	handle @openship-health {\n		respond \"ok\" 200\n	}\n\n	@replay-capture {\n		path /s\n		path /s/\n		path /s/*\n	}\n\n	@capture {\n		path /e\n		path /e/\n		path /e/*\n		path /i/v0\n		path /i/v0/\n		path /i/v0/*\n		path /i/v1/analytics/events\n		path /i/v1/analytics/events/\n		path /batch\n		path /batch/\n		path /batch/*\n		path /capture\n		path /capture/\n		path /capture/*\n	}\n\n	@flags {\n		path /flags\n		path /flags/\n		path /flags/*\n		path /api/feature_flag/local_evaluation\n		path /api/feature_flag/local_evaluation/\n		path /api/feature_flag/local_evaluation/*\n	}\n\n	@surveys {\n		path /surveys\n		path /surveys/\n		path /api/surveys\n		path /api/surveys/\n	}\n\n	@remote-config {\n		path /array/*\n	}\n\n	@webhooks {\n		path /public/webhooks\n		path /public/webhooks/\n		path /public/webhooks/*\n		path /public/m/\n		path /public/m/*\n	}\n\n	@objectstorage {\n		path /posthog\n		path /posthog/\n		path /posthog/*\n	}\n\n	handle @capture {\n		reverse_proxy capture:3000\n	}\n\n	handle @replay-capture {\n		reverse_proxy replay-capture:3000\n	}\n\n	handle @flags {\n		reverse_proxy feature-flags:3001\n	}\n\n	handle @surveys {\n		reverse_proxy hypercache-server:3002\n	}\n\n	handle @remote-config {\n		reverse_proxy hypercache-server:3002\n	}\n\n	handle @webhooks {\n		reverse_proxy plugins:6738\n	}\n\n	handle @objectstorage {\n		reverse_proxy objectstorage:8333\n	}\n\n	handle {\n		reverse_proxy web:8000\n	}\n}\n"
         },
         {
-          key: "MINIO_ROOT_USER",
-          service: "objectstorage",
-          label: "Object-storage access key",
-          help: "The S3 access key PostHog uses against its bundled MinIO (session recordings).",
-          type: "text",
-          default: "posthog",
-          required: true
+          service: "clickhouse",
+          path: "/etc/clickhouse-server/config.d/openship-posthog.xml",
+          content: `<clickhouse>
+  <!-- PostHog creates every table as ReplicatedMergeTree ON CLUSTER, so the
+       macros, the clusters and ZooKeeper must all resolve or migrate_clickhouse
+       cannot create a single table. Shipped as a config.d overlay rather than a
+       replacement config.xml so the image's own defaults still apply. -->
+  <zookeeper>
+    <node>
+      <host>zookeeper</host>
+      <port>2181</port>
+    </node>
+  </zookeeper>
+  <macros>
+    <shard>01</shard>
+    <replica>ch1</replica>
+  </macros>
+  <distributed_ddl>
+    <path>/clickhouse/task_queue/ddl</path>
+  </distributed_ddl>
+  <!-- ~95 Kafka-engine tables each hold a background schedule slot. -->
+  <background_schedule_pool_size>256</background_schedule_pool_size>
+  <format_schema_path>/var/lib/clickhouse/format_schemas/</format_schema_path>
+  <remote_servers>
+    <posthog><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></posthog>
+    <posthog_single_shard><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></posthog_single_shard>
+    <posthog_migrations><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></posthog_migrations>
+    <posthog_writable><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></posthog_writable>
+    <posthog_primary_replica><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></posthog_primary_replica>
+    <ai_events><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></ai_events>
+    <aux><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></aux>
+    <ops><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></ops>
+    <sessions><shard><replica><host>clickhouse</host><port>9000</port></replica></shard></sessions>
+  </remote_servers>
+  <!-- PostHog's Kafka tables reference a named collection, not a broker list. -->
+  <named_collections>
+    <msk_cluster><kafka_broker_list from_env="KAFKA_HOSTS"/></msk_cluster>
+    <warpstream_ingestion><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_ingestion>
+    <warpstream_calculated_events><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_calculated_events>
+    <warpstream_replay><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_replay>
+    <warpstream_shared><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_shared>
+    <warpstream_cyclotron><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_cyclotron>
+    <warpstream_logs><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_logs>
+    <warpstream_traces><kafka_broker_list from_env="KAFKA_HOSTS"/></warpstream_traces>
+  </named_collections>
+</clickhouse>
+`
         },
         {
-          key: "MINIO_ROOT_PASSWORD",
-          service: "objectstorage",
-          label: "Object-storage secret key",
-          help: "Auto-generated. The S3 secret key for the bundled MinIO.",
-          generate: "secret",
-          secret: true
+          service: "clickhouse",
+          path: "/etc/clickhouse-server/users.d/openship-posthog.xml",
+          content: "<clickhouse>\n  <!-- CLICKHOUSE_SKIP_USER_SETUP=1 means the image creates no users, but the\n       Django app connects as api/app/billing/dict_reader on different query\n       paths. Passwords match the values the app is configured with; ClickHouse\n       is never published outside the project network. -->\n  <profiles>\n    <default>\n      <max_memory_usage>10000000000</max_memory_usage>\n      <use_uncompressed_cache>0</use_uncompressed_cache>\n      <load_balancing>random</load_balancing>\n    </default>\n  </profiles>\n  <users>\n    <default>\n      <password></password>\n      <networks><ip>::/0</ip></networks>\n      <profile>default</profile>\n      <quota>default</quota>\n      <access_management>1</access_management>\n    </default>\n    <api>\n      <password>apipass</password>\n      <networks><ip>::/0</ip></networks>\n      <profile>default</profile>\n      <quota>default</quota>\n    </api>\n    <app>\n      <password>apppass</password>\n      <networks><ip>::/0</ip></networks>\n      <profile>default</profile>\n      <quota>default</quota>\n    </app>\n    <billing>\n      <password>billingpass</password>\n      <networks><ip>::/0</ip></networks>\n      <profile>default</profile>\n      <quota>default</quota>\n    </billing>\n    <dict_reader>\n      <password>dictreaderpass</password>\n      <networks><ip>::/0</ip></networks>\n      <profile>default</profile>\n      <quota>default</quota>\n    </dict_reader>\n  </users>\n  <quotas>\n    <default><interval><duration>3600</duration></interval></default>\n  </quotas>\n</clickhouse>\n"
         }
       ],
-      management: {
-        kind: "schema"
-      },
       prepare: [
         {
-          service: "objectstorage",
-          command: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null && mc mb --ignore-existing local/posthog > /dev/null && printf %s posthog',
-          capture: "bucket",
+          service: "kafka",
+          title: "Create Kafka topics",
+          description: "Pre-creates the ingestion topics the Node consumers verify at startup.",
+          command: 'for t in events_plugin_ingestion events_plugin_ingestion_historical events_plugin_ingestion_overflow events_plugin_ingestion_dlq events_plugin_ingestion_ai events_plugin_ingestion_async session_recording_snapshot_item_events clickhouse_events_json clickhouse_ai_events_json clickhouse_heatmap_events clickhouse_flag_evaluations clickhouse_ingestion_warnings clickhouse_groups clickhouse_person clickhouse_person_distinct_id clickhouse_person_distinct_id2 clickhouse_person_overrides clickhouse_app_metrics2 clickhouse_session_replay_events clickhouse_session_recording_events clickhouse_tophog heatmaps_ingestion ingestion-clientwarnings-main-1 ingestion-errortracking-main log_entries plugin_log_entries events_dead_letter_queue; do /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --create --if-not-exists --topic "$t" --partitions 1 --replication-factor 1 >/dev/null 2>&1 || true; done; echo done',
+          capture: "topics",
           phase: "post-ready",
           readiness: {
-            test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
-            interval: 1e3,
+            test: "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092",
+            interval: 3e3,
             retries: 30
-          },
-          once: true
+          }
         }
       ],
       connection: {
         title: "Open PostHog",
-        description: "Open the PostHog UI and create your admin account on first load.",
+        description: "Open the PostHog UI and create your admin account on first load. The same hostname serves the UI and the event-ingestion endpoints, so an SDK pointed at this URL works with no extra configuration.",
         guide: {
-          intro: "PostHog runs its own analytics UI \u2014 create the admin account when you first open it.",
+          intro: "PostHog runs its own analytics UI \u2014 create the admin account when you first open it, then use the project API key it gives you in your SDK.",
+          useHint: "Point your SDK's host at this URL. Caddy routes /e, /capture, /batch and /i/* to the capture service, /s/* to session replay, /flags to feature flags, and everything else to the app.",
           defaultMode: "public"
         },
         outputs: [
           {
             id: "ui",
             label: "PostHog",
-            source: "publicUrl:web",
+            source: "publicUrl:proxy",
             kind: "url",
-            help: "PostHog has no default login \u2014 the first visitor creates the admin account."
+            recommended: true,
+            help: "PostHog has no default login \u2014 the first visitor creates the admin account. This host also receives your events."
           }
         ],
         firstLogin: {
-          note: "PostHog ships no default credentials \u2014 open the URL above and sign up to create the first (admin) account."
+          note: "PostHog ships no default credentials \u2014 open the URL above and sign up to create the first (admin) account. First boot runs database migrations and can take several minutes before the UI answers."
         }
       },
       endpoints: [
         {
-          service: "web",
-          port: 8e3,
+          service: "proxy",
+          port: 80,
           label: "PostHog",
-          kind: "http"
+          kind: "http",
+          defaultMode: "domain"
         }
       ]
     },
     {
       available: true,
-      verified: true,
+      verified: false,
       id: "redis",
       name: "Valkey (Redis)",
-      description: "In-memory data store for caching, sessions, rate limits, and queues \u2014 Valkey, the open-source Redis fork. Drop-in Redis-compatible: point any redis client at it.",
+      description: "In-memory data store for caching, sessions, rate limits, and queues \u2014 Valkey, the open-source Redis fork. Drop-in Redis-compatible: point any redis client at it. Ships with RedisInsight, a browser UI that arrives already connected to this instance.",
+      repository: "https://github.com/valkey-io/valkey",
       kind: "template",
       logo: "valkey",
       category: "database",
@@ -6391,16 +7318,22 @@ virtual_file_io_mode="buffered"
         "redis",
         "valkey",
         "key-value",
-        "queue"
+        "queue",
+        "gui"
       ],
       framework: "docker-compose",
       services: [
         {
           name: "valkey",
           image: "valkey/valkey:8.1-alpine",
-          command: "valkey-server /etc/valkey/valkey.conf",
-          ports: [
-            "6379:6379"
+          commandArgv: [
+            "valkey-server"
+          ],
+          environment: {
+            VALKEY_EXTRA_FLAGS: "--requirepass {{config:VALKEY_PASSWORD}} --appendonly yes --appendfsync everysec --save 300 100"
+          },
+          secretEnv: [
+            "VALKEY_EXTRA_FLAGS"
           ],
           volumes: [
             "valkey_data:/data"
@@ -6408,7 +7341,7 @@ virtual_file_io_mode="buffered"
           healthcheck: {
             test: [
               "CMD-SHELL",
-              'valkey-cli --no-auth-warning -a "$VALKEY_PASSWORD" ping | grep -q PONG'
+              'valkey-cli ping 2>&1 | grep -q NOAUTH && valkey-cli --no-auth-warning -a "$VALKEY_PASSWORD" ping | grep -q PONG'
             ],
             interval: "10s",
             timeout: "5s",
@@ -6416,6 +7349,38 @@ virtual_file_io_mode="buffered"
             startPeriod: "10s"
           },
           restart: "unless-stopped"
+        },
+        {
+          name: "redisinsight",
+          image: "redis/redisinsight:3.8.0",
+          exposedPort: 5540,
+          exposed: true,
+          routes: [
+            {
+              port: 5540
+            }
+          ],
+          dependsOn: [
+            "valkey"
+          ],
+          environment: {
+            RI_ACCEPT_TERMS_AND_CONDITIONS: "true",
+            RI_REDIS_HOST: "valkey",
+            RI_REDIS_PORT: "6379",
+            RI_REDIS_DB: "0",
+            RI_REDIS_ALIAS: "Valkey (this app)",
+            RI_REDIS_PASSWORD: "{{config:VALKEY_PASSWORD}}"
+          },
+          secretEnv: [
+            "RI_REDIS_PASSWORD"
+          ],
+          volumes: [
+            "redisinsight_data:/data"
+          ],
+          restart: "unless-stopped",
+          ports: [
+            "8219:5540"
+          ]
         }
       ],
       configFields: [
@@ -6423,46 +7388,58 @@ virtual_file_io_mode="buffered"
           key: "VALKEY_PASSWORD",
           service: "valkey",
           label: "Password",
-          help: "Auto-generated. Required by every client (Valkey's `requirepass` auth).",
+          help: "Auto-generated. Required by every client (Valkey's `requirepass` auth). The bundled browser UI is pre-loaded with it.",
           generate: "secret",
           secret: true
         }
       ],
-      files: [
-        {
-          service: "valkey",
-          path: "/etc/valkey/valkey.conf",
-          content: "requirepass {{config:VALKEY_PASSWORD}}\nappendonly yes\nappendfsync everysec\nsave 300 100\n"
-        }
-      ],
       management: {
         kind: "schema"
       },
       connection: {
         title: "Connect to Valkey",
-        description: "A Redis-compatible endpoint. Point any redis client at the URL below \u2014 it already carries the password.",
+        description: "A Redis-compatible endpoint on your project's private network. Point any redis client at the URL below \u2014 it already carries the password.",
         guide: {
-          intro: "Your project gets a Redis-compatible cache, ready to use.",
+          intro: "Your project gets a Redis-compatible cache plus a browser UI that is already connected to it.",
           useHint: "Read `process.env.REDIS_URL` in your code \u2014 it's set the next time your project deploys.",
           defaultMode: "internal"
         },
         outputs: [
+          {
+            id: "ui",
+            label: "Browser UI",
+            source: "publicUrl:redisinsight",
+            kind: "url",
+            recommended: true,
+            help: "RedisInsight, already pointed at this instance \u2014 no connection details to enter. It has NO login of its own, so anyone who can reach this address can read and write your data: keep it on the published port (reachable through an SSH tunnel) unless you deliberately put it on a domain you protect.",
+            width: "full"
+          },
           {
             id: "url",
             label: "Connection URL",
-            source: "template:redis://:{{env:valkey:VALKEY_PASSWORD}}@{{host}}:6379",
-            sourceLabel: "Public",
-            variants: [
-              {
-                id: "internal",
-                label: "Internal",
-                source: "template:redis://:{{env:valkey:VALKEY_PASSWORD}}@valkey:6379"
-              }
-            ],
+            source: "template:redis://:{{env:valkey:VALKEY_PASSWORD}}@valkey:6379",
+            sourceLabel: "Internal",
+            service: "valkey",
             secret: true,
             envKey: "REDIS_URL",
             recommended: true,
-            help: "Redis-protocol URL with the password embedded. Published on port 6379. Switch to Internal for apps on the same project network."
+            help: "Redis-protocol URL with the password embedded, on the project's private network. Port 6379 is not published to the internet \u2014 bind this app into another project to use it, or reach it from the server with `docker exec`."
+          },
+          {
+            id: "host",
+            label: "Host",
+            source: "template:valkey",
+            service: "valkey",
+            envKey: "REDIS_HOST",
+            width: "half"
+          },
+          {
+            id: "port",
+            label: "Port",
+            source: "template:6379",
+            service: "valkey",
+            envKey: "REDIS_PORT",
+            width: "half"
           },
           {
             id: "password",
@@ -6484,11 +7461,23 @@ virtual_file_io_mode="buffered"
         }
       ],
       endpoints: [
+        {
+          service: "redisinsight",
+          port: 5540,
+          label: "Browser UI",
+          kind: "http",
+          scope: "public"
+        },
         {
           service: "valkey",
           port: 6379,
-          label: "Redis / Valkey",
-          kind: "tcp"
+          label: "Redis / Valkey (private)",
+          kind: "tcp",
+          scope: "internal",
+          defaultMode: "internal",
+          allowedModes: [
+            "internal"
+          ]
         }
       ]
     },
@@ -6514,9 +7503,6 @@ virtual_file_io_mode="buffered"
           image: "ghcr.io/umami-software/umami:postgresql-v2.19.0",
           exposedPort: 3e3,
           exposed: true,
-          ports: [
-            "3000:3000"
-          ],
           routes: [
             {
               port: 3e3
@@ -6542,7 +7528,10 @@ virtual_file_io_mode="buffered"
             retries: 10,
             startPeriod: "30s"
           },
-          restart: "unless-stopped"
+          restart: "unless-stopped",
+          ports: [
+            "3011:3000"
+          ]
         },
         {
           name: "umami-db",
@@ -6785,9 +7774,279 @@ virtual_file_io_mode="buffered"
           port: 4080,
           label: "Webmail",
           kind: "http",
-          defaultMode: "domain",
+          defaultMode: "domain",
+          allowedModes: [
+            "domain"
+          ]
+        }
+      ]
+    },
+    {
+      available: true,
+      verified: false,
+      id: "clickhouse",
+      name: "ClickHouse",
+      description: "The columnar SQL database for analytics \u2014 billions of rows scanned per second. Ships with the CH-UI console, so you get a SQL editor, schema browser and dashboards the moment it installs: sign in with the ClickHouse user and password below, no extra setup.",
+      repository: "https://github.com/ClickHouse/ClickHouse",
+      kind: "template",
+      logo: "clickhouse",
+      category: "database",
+      tags: [
+        "analytics",
+        "olap",
+        "sql",
+        "columnar",
+        "warehouse",
+        "timeseries"
+      ],
+      framework: "docker-compose",
+      minResources: {
+        memoryMb: 2048
+      },
+      services: [
+        {
+          name: "clickhouse",
+          image: "clickhouse/clickhouse-server:26.3.17.110",
+          exposedPort: 8123,
+          exposed: true,
+          routes: [
+            {
+              port: 8123
+            }
+          ],
+          environment: {
+            CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
+          },
+          secretEnv: [
+            "CLICKHOUSE_PASSWORD"
+          ],
+          volumes: [
+            "clickhouse_data:/var/lib/clickhouse"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget -q -O /dev/null http://127.0.0.1:8123/ping || exit 1"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 12,
+            startPeriod: "30s"
+          },
+          restart: "unless-stopped",
+          stopGracePeriod: "60s",
+          ports: [
+            "8218:8123"
+          ]
+        },
+        {
+          name: "ch-ui",
+          image: "ghcr.io/caioricciuti/ch-ui:v2.6.1",
+          exposedPort: 3488,
+          exposed: true,
+          routes: [
+            {
+              port: 3488
+            }
+          ],
+          dependsOn: [
+            "clickhouse"
+          ],
+          environment: {
+            CLICKHOUSE_URL: "http://clickhouse:8123",
+            CONNECTION_NAME: "ClickHouse",
+            APP_URL: "{{publicUrl:ch-ui}}",
+            DATABASE_PATH: "/app/data/ch-ui.db"
+          },
+          secretEnv: [
+            "APP_SECRET_KEY"
+          ],
+          volumes: [
+            "ch_ui_data:/app/data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget -q -O /dev/null http://127.0.0.1:3488/health || exit 1"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 6,
+            startPeriod: "15s"
+          },
+          restart: "unless-stopped",
+          ports: [
+            "8217:3488"
+          ]
+        }
+      ],
+      configFields: [
+        {
+          key: "CLICKHOUSE_USER",
+          service: "clickhouse",
+          label: "Database user",
+          help: "The account the server creates on its first boot. It owns the data and is the sign-in for the console.",
+          type: "text",
+          default: "default",
+          required: true
+        },
+        {
+          key: "CLICKHOUSE_PASSWORD",
+          service: "clickhouse",
+          label: "Password",
+          help: "Auto-generated. Set on the account at first boot \u2014 it is the console sign-in and the credential every SQL client needs. Without it the server would refuse all non-localhost connections.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "CLICKHOUSE_DB",
+          service: "clickhouse",
+          label: "First database",
+          help: "Created on the first boot so you can write a table immediately. More can be added from the console.",
+          type: "text",
+          default: "analytics",
+          required: true
+        },
+        {
+          key: "APP_SECRET_KEY",
+          service: "ch-ui",
+          label: "Console session key",
+          help: "Auto-generated. Encrypts the ClickHouse credentials the console holds for a signed-in session. Rotating it signs everyone out.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Connect to ClickHouse",
+        description: "Open the console and sign in with the user and password below \u2014 the console talks to ClickHouse over the private project network, so the database itself never has to be public. For your own code, use the DSN.",
+        guide: {
+          intro: "Your project gets a ClickHouse server plus a web console for querying it.",
+          useHint: "Read `process.env.CLICKHOUSE_URL` with `CLICKHOUSE_USER` / `CLICKHOUSE_PASSWORD` (or the single `CLICKHOUSE_DSN`) \u2014 set on your next deploy.",
+          defaultMode: "internal"
+        },
+        firstLogin: {
+          username: "default",
+          note: "The console has no account of its own: sign in with the ClickHouse user above and the generated password from this page. Three wrong tries locks that user out for 15 minutes, so paste the password rather than typing it."
+        },
+        outputs: [
+          {
+            id: "console",
+            label: "Console",
+            source: "publicUrl:ch-ui",
+            kind: "url",
+            recommended: true,
+            help: "The CH-UI web console \u2014 SQL editor, schema browser, saved queries and dashboards. Sign in with the user and password below."
+          },
+          {
+            id: "httpUrl",
+            label: "HTTP endpoint",
+            source: "publicUrl:clickhouse",
+            sourceLabel: "Public",
+            variants: [
+              {
+                id: "internal",
+                label: "Internal",
+                source: "template:http://clickhouse:8123"
+              }
+            ],
+            service: "clickhouse",
+            envKey: "CLICKHOUSE_URL",
+            recommended: true,
+            help: "ClickHouse's HTTP interface (port 8123) \u2014 what clickhouse-connect, clickhouse-js, the JDBC/ODBC drivers and plain curl talk to. Send the user and password as basic auth. Switch to Internal for apps on the same project network; Public only resolves if you gave this port a domain."
+          },
+          {
+            id: "httpDsn",
+            label: "HTTP DSN",
+            source: "template:http://{{env:clickhouse:CLICKHOUSE_USER}}:{{env:clickhouse:CLICKHOUSE_PASSWORD}}@clickhouse:8123/{{env:clickhouse:CLICKHOUSE_DB}}",
+            sourceLabel: "Internal",
+            service: "clickhouse",
+            secret: true,
+            envKey: "CLICKHOUSE_HTTP_DSN",
+            recommended: true,
+            help: "One string with the credentials baked in, over the private project network. For a client outside this server, use the public HTTP endpoint above plus the user and password."
+          },
+          {
+            id: "nativeDsn",
+            label: "Native TCP DSN",
+            source: "template:clickhouse://{{env:clickhouse:CLICKHOUSE_USER}}:{{env:clickhouse:CLICKHOUSE_PASSWORD}}@clickhouse:9000/{{env:clickhouse:CLICKHOUSE_DB}}",
+            sourceLabel: "Internal",
+            service: "clickhouse",
+            secret: true,
+            envKey: "CLICKHOUSE_DSN",
+            help: "ClickHouse's native protocol (port 9000) \u2014 faster and what clickhouse-client, clickhouse-go and clickhouse-driver prefer. Reachable from inside the project only; the port is never published to the host."
+          },
+          {
+            id: "user",
+            label: "User",
+            source: "env:clickhouse:CLICKHOUSE_USER",
+            service: "clickhouse",
+            envKey: "CLICKHOUSE_USER",
+            recommended: true,
+            width: "half"
+          },
+          {
+            id: "password",
+            label: "Password",
+            source: "env:clickhouse:CLICKHOUSE_PASSWORD",
+            service: "clickhouse",
+            envKey: "CLICKHOUSE_PASSWORD",
+            secret: true,
+            recommended: true,
+            width: "half"
+          },
+          {
+            id: "database",
+            label: "Database",
+            source: "env:clickhouse:CLICKHOUSE_DB",
+            service: "clickhouse",
+            envKey: "CLICKHOUSE_DATABASE",
+            width: "half"
+          }
+        ]
+      },
+      provides: [
+        {
+          id: "clickhouse",
+          outputRefs: [
+            "httpUrl",
+            "httpDsn",
+            "user",
+            "password",
+            "database"
+          ],
+          category: "database"
+        }
+      ],
+      endpoints: [
+        {
+          service: "ch-ui",
+          port: 3488,
+          label: "Console",
+          kind: "http",
+          required: true,
+          scope: "public",
+          defaultMode: "domain"
+        },
+        {
+          service: "clickhouse",
+          port: 8123,
+          label: "HTTP API",
+          kind: "http",
+          scope: "public",
+          defaultMode: "port"
+        },
+        {
+          service: "clickhouse",
+          port: 9e3,
+          label: "Native protocol",
+          kind: "tcp",
+          scope: "internal",
+          defaultMode: "internal",
           allowedModes: [
-            "domain"
+            "internal"
           ]
         }
       ]
@@ -21355,7 +22614,30 @@ var serviceSpec = external_exports.object({
   exposed: external_exports.boolean().optional(),
   healthcheck: external_exports.unknown().optional(),
   restart: external_exports.enum(["no", "always", "on-failure", "unless-stopped"]).optional(),
-  command: external_exports.string().optional()
+  command: external_exports.string().optional(),
+  /**
+   * Structured argv, passed through as the container Cmd with NO `sh -c` wrap.
+   * Wins over `command` when both are set.
+   *
+   * `command` is convenient but it is a SHELL string, so the container's argv
+   * becomes ["sh","-c",cmd] — and an image whose entrypoint rewrites argv rather
+   * than `exec "$@"` then sees the wrong thing. MinIO is the worked example: its
+   * entrypoint prepends `minio` unless argv[0] already is, so a `command` turned
+   * into `minio sh -c "server /data"` and the container exited with "'sh' is not
+   * a minio sub-command" on every boot. There is no command string that fixes
+   * that; the argv has to arrive unwrapped. Use `command` when you need a shell
+   * (`a && b`), `commandArgv` when the image needs exact argv.
+   */
+  commandArgv: external_exports.array(external_exports.string()).optional(),
+  /**
+   * How long Docker waits after SIGTERM before SIGKILL (compose duration, e.g.
+   * "10m"). The engine has always honored `advanced.stopGracePeriod`; only the
+   * template could not ask for it, which silently capped every app at Docker's
+   * 10s default. That is not a tuning knob for an app whose clean shutdown does
+   * a final checkpoint and whose boot lease is a lockfile — being killed
+   * mid-checkpoint leaves the lock behind and the next boot refuses to start.
+   */
+  stopGracePeriod: external_exports.string().optional()
 });
 var configField = external_exports.object({
   key: external_exports.string(),
@@ -21532,6 +22814,20 @@ var appTemplateSchema = external_exports.object({
     memoryMb: external_exports.number().positive().optional(),
     cpuCores: external_exports.number().positive().optional()
   }).optional(),
+  /**
+   * Trust mark: official open-source image plus a reviewable pipeline.
+   *
+   * A claim about PROVENANCE, not about whether we got the app running. Booting a
+   * template proves it works; it does not make its publisher vouched for. Set it
+   * only when EVERY image is published by the project the app actually is, or is
+   * a composition upstream itself documents (Ghost + MySQL, Supabase's own
+   * compose, Convex's backend/dashboard pair).
+   *
+   * Leave it off when WE picked a third-party companion the upstream project
+   * neither ships nor endorses — ClickHouse + ch-ui, Kafka + kafbat-ui,
+   * MongoDB + mongo-express, Valkey + RedisInsight — or when the publisher is a
+   * single maintainer whose build pipeline cannot be reviewed (neond).
+   */
   verified: external_exports.boolean().optional(),
   // Hidden from the browsable catalog while staying fully installable — for an app
   // reached through another app's wizard rather than the grid. NOT `available:
@@ -21606,6 +22902,1436 @@ var appTemplateSchema = external_exports.object({
   });
 });
 
+// ../../packages/core/src/deployment-class.ts
+var WORKLOAD_TYPES = ["web", "worker", "static"];
+
+// ../../packages/core/src/pricing/schema.ts
+var MAX_SUPPORTED_PRICING_SCHEMA = 1;
+var limitNumber = external_exports.number().int().nonnegative().nullable();
+var planLimitsSchema = external_exports.object({
+  /** Which deployment workloads the tier may run. Free ships `["static"]`. */
+  workloads: external_exports.array(external_exports.enum(WORKLOAD_TYPES)).min(1),
+  /** May the tier run multi-service stacks — Compose, catalog apps, managed DBs? */
+  services: external_exports.boolean(),
+  /**
+   * Concurrently running services — one Oblien workspace each. This is the
+   * ceiling customers feel: an app + Postgres + Redis is 3, a static site is 0
+   * at rest. Drives `max_workspaces` (plus build headroom).
+   */
+  runningServices: limitNumber,
+  /** Projects (project groups). Oblien has no project concept — Openship gates it. */
+  maxProjects: limitNumber,
+  /**
+   * The largest per-service machine this tier may select, named in the deploy
+   * wizard's OWN vocabulary (`RESOURCE_TIER_SPECS`). Stating a raw vCPU number
+   * here is what made the pricing page advertise sizes no picker offered.
+   * `null` = uncapped (enterprise).
+   */
+  maxResourceTier: external_exports.enum(RESOURCE_TIER_ORDER).nullable(),
+  buildMinutesPerMonth: limitNumber,
+  freeSubdomains: limitNumber,
+  customDomains: limitNumber,
+  seats: limitNumber
+});
+var planSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  price: external_exports.object({
+    /** USD cents, or null for "contact sales". */
+    monthly: external_exports.number().int().nonnegative().nullable(),
+    annual: external_exports.number().int().nonnegative().nullable()
+  }),
+  stripePriceEnv: external_exports.object({
+    monthly: external_exports.string().min(1).nullable(),
+    annual: external_exports.string().min(1).nullable()
+  }),
+  popular: external_exports.boolean(),
+  contactSales: external_exports.string().min(1).nullable(),
+  support: external_exports.enum(["community", "email", "priority", "dedicated"]),
+  /** Tier whose features this one builds on — drives the "Everything in X" line. */
+  inherits: external_exports.string().min(1).optional(),
+  credits: external_exports.object({
+    /** Milli-credits granted per period; null = granted by hand (enterprise). */
+    monthlyMilli: external_exports.number().int().positive().nullable()
+  }),
+  limits: planLimitsSchema,
+  /** Copy keys, in display order. Each must exist in `locales/en.json#features`. */
+  features: external_exports.array(external_exports.string().min(1)).min(1)
+});
+var isoInstant = external_exports.string().regex(
+  /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/,
+  'must be a full ISO-8601 instant with an offset, e.g. "2026-09-30T23:59:59Z" \u2014 a bare date is timezone-ambiguous and ends a day early'
+).refine((s) => !Number.isNaN(Date.parse(s)), "must be a parseable date");
+var campaignSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  /** Percent off the monthly price, 1–100. */
+  percentOff: external_exports.number().int().min(1).max(100),
+  /** Plan ids the campaign applies to, or `"all"` for every purchasable tier. */
+  appliesTo: external_exports.union([external_exports.literal("all"), external_exports.array(external_exports.string().min(1)).min(1)]),
+  startsAt: isoInstant,
+  endsAt: isoInstant,
+  /** How many months the discount lasts per customer; null = for the whole
+   *  subscription lifetime. Must match the Stripe coupon's duration. */
+  durationMonths: external_exports.number().int().positive().nullable(),
+  /** Env var NAMING the Stripe coupon id — same indirection as price ids, so
+   *  no live Stripe id is committed or shipped to a browser bundle. */
+  stripeCouponEnv: external_exports.string().min(1)
+}).superRefine((c, ctx) => {
+  if (Date.parse(c.endsAt) <= Date.parse(c.startsAt)) {
+    ctx.addIssue({ code: "custom", path: ["endsAt"], message: `campaign "${c.id}" ends before it starts` });
+  }
+});
+var creditPackSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  creditsMilli: external_exports.number().int().positive(),
+  priceCents: external_exports.number().int().positive(),
+  stripePriceEnv: external_exports.string().min(1),
+  sortOrder: external_exports.number().int()
+});
+var pricingCatalogSchema = external_exports.object({
+  schemaVersion: external_exports.number().int().positive(),
+  currency: external_exports.string().length(3),
+  /** Suffix of the managed free domain, e.g. `.opsh.io`. Copy interpolates it. */
+  freeDomainSuffix: external_exports.string().min(1),
+  annual: external_exports.object({
+    /** False hides every annual affordance; annual prices may stay null. */
+    enabled: external_exports.boolean(),
+    monthsFree: external_exports.number().int().nonnegative()
+  }),
+  /**
+   * How customer-facing limits translate into Oblien's per-namespace ceilings.
+   *
+   * `buildResources` MIRRORS `DEFAULT_BUILD_RESOURCE_CONFIG` in adapters — a
+   * build runs in its own Oblien workspace, and since `max_vcpus`/`max_ram_mb`/
+   * `max_disk_gb` are per-workspace caps, a tier whose ceiling sits below the
+   * build machine cannot build AT ALL (Oblien 409s the create). That is not
+   * hypothetical: free published 2 vCPU / 2 GB against a 4 vCPU / 8 GB build,
+   * so the one workload free is allowed to run would have failed the moment
+   * ceilings went live. The mirror is asserted by test.
+   *
+   * `buildWorkspaceHeadroom` is how many transient build workspaces a tier may
+   * hold ON TOP of its running services, because Oblien counts build
+   * workspaces in `max_workspaces` too. Without it a free user with one
+   * service could never deploy — the build would have nowhere to go.
+   */
+  oblien: external_exports.object({
+    buildWorkspaceHeadroom: external_exports.number().int().nonnegative(),
+    buildResources: external_exports.object({
+      cpuCores: external_exports.number().positive(),
+      memoryMb: external_exports.number().int().positive(),
+      diskGb: external_exports.number().int().positive()
+    })
+  }),
+  /** Time-bounded automatic discounts. Empty = list price. */
+  campaigns: external_exports.array(campaignSchema),
+  plans: external_exports.array(planSchema).min(1),
+  creditPacks: external_exports.array(creditPackSchema),
+  selfHosted: external_exports.object({ features: external_exports.array(external_exports.string().min(1)).min(1) })
+}).superRefine((data, ctx) => {
+  if (data.schemaVersion > MAX_SUPPORTED_PRICING_SCHEMA) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["schemaVersion"],
+      message: `pricing.json schemaVersion ${data.schemaVersion} is newer than this build supports (${MAX_SUPPORTED_PRICING_SCHEMA})`
+    });
+  }
+  const ids = /* @__PURE__ */ new Set();
+  data.plans.forEach((plan, i) => {
+    if (ids.has(plan.id)) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "id"], message: `duplicate plan id "${plan.id}"` });
+    }
+    ids.add(plan.id);
+  });
+  data.plans.forEach((plan, i) => {
+    if (plan.inherits && !ids.has(plan.inherits)) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "inherits"], message: `plan "${plan.id}" inherits unknown plan "${plan.inherits}"` });
+    }
+    if (plan.inherits === plan.id) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "inherits"], message: `plan "${plan.id}" inherits itself` });
+    }
+    const monthlyPurchasable = plan.price.monthly !== null && plan.price.monthly > 0;
+    if (monthlyPurchasable && !plan.stripePriceEnv.monthly) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "stripePriceEnv", "monthly"], message: `plan "${plan.id}" has a monthly price but no Stripe price env name` });
+    }
+    const annualPurchasable = plan.price.annual !== null && plan.price.annual > 0;
+    if (annualPurchasable && !plan.stripePriceEnv.annual) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "stripePriceEnv", "annual"], message: `plan "${plan.id}" has an annual price but no Stripe price env name` });
+    }
+    if (plan.contactSales && plan.price.monthly !== null) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "contactSales"], message: `plan "${plan.id}" sets contactSales but also a monthly price` });
+    }
+    if (!plan.contactSales && plan.price.monthly === null) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "price", "monthly"], message: `plan "${plan.id}" has no monthly price and no contactSales \u2014 it would render as an unbuyable blank` });
+    }
+    if (plan.features.includes("everythingIn") && !plan.inherits) {
+      ctx.addIssue({ code: "custom", path: ["plans", i, "features"], message: `plan "${plan.id}" uses the "everythingIn" feature key without an "inherits" tier` });
+    }
+  });
+  const campaignIds = /* @__PURE__ */ new Set();
+  data.campaigns.forEach((c, i) => {
+    if (campaignIds.has(c.id)) {
+      ctx.addIssue({ code: "custom", path: ["campaigns", i, "id"], message: `duplicate campaign id "${c.id}"` });
+    }
+    campaignIds.add(c.id);
+    if (c.appliesTo !== "all") {
+      for (const target of c.appliesTo) {
+        if (!ids.has(target)) {
+          ctx.addIssue({ code: "custom", path: ["campaigns", i, "appliesTo"], message: `campaign "${c.id}" targets unknown plan "${target}"` });
+        }
+      }
+    }
+  });
+  for (let i = 0; i < data.campaigns.length; i++) {
+    for (let j = i + 1; j < data.campaigns.length; j++) {
+      const a = data.campaigns[i];
+      const b = data.campaigns[j];
+      const overlapsInTime = Date.parse(a.startsAt) < Date.parse(b.endsAt) && Date.parse(b.startsAt) < Date.parse(a.endsAt);
+      if (!overlapsInTime) continue;
+      const sharesAPlan = a.appliesTo === "all" || b.appliesTo === "all" || a.appliesTo.some((p) => b.appliesTo.includes(p));
+      if (sharesAPlan) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["campaigns", j],
+          message: `campaigns "${a.id}" and "${b.id}" overlap in time on the same plan \u2014 only one discount can apply`
+        });
+      }
+    }
+  }
+  const packIds = /* @__PURE__ */ new Set();
+  data.creditPacks.forEach((pack, i) => {
+    if (packIds.has(pack.id)) {
+      ctx.addIssue({ code: "custom", path: ["creditPacks", i, "id"], message: `duplicate credit pack id "${pack.id}"` });
+    }
+    packIds.add(pack.id);
+  });
+});
+var pricingCopySchema = external_exports.object({
+  plans: external_exports.record(external_exports.string(), external_exports.object({ name: external_exports.string(), tagline: external_exports.string() }).partial()).optional(),
+  features: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  selfHosted: external_exports.object({ name: external_exports.string(), tagline: external_exports.string(), priceLabel: external_exports.string(), priceNote: external_exports.string(), cta: external_exports.string() }).partial().optional(),
+  creditPacks: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  ui: external_exports.object({
+    perMonth: external_exports.string(),
+    perYear: external_exports.string(),
+    custom: external_exports.string(),
+    free: external_exports.string(),
+    unlimited: external_exports.string(),
+    mostPopular: external_exports.string(),
+    monthsFree: external_exports.string(),
+    ctaStart: external_exports.string(),
+    ctaChoose: external_exports.string(),
+    ctaContact: external_exports.string(),
+    billedMonthly: external_exports.string(),
+    campaignBadge: external_exports.string(),
+    campaignEnds: external_exports.string(),
+    wasPrice: external_exports.string()
+  }).partial().optional()
+});
+
+// ../../packages/core/src/pricing/pricing.json
+var pricing_default = {
+  schemaVersion: 1,
+  currency: "usd",
+  freeDomainSuffix: ".opsh.io",
+  annual: {
+    enabled: false,
+    monthsFree: 2
+  },
+  oblien: {
+    buildWorkspaceHeadroom: 2,
+    buildResources: {
+      cpuCores: 4,
+      memoryMb: 8192,
+      diskGb: 10
+    }
+  },
+  campaigns: [],
+  plans: [
+    {
+      id: "free",
+      price: {
+        monthly: 0,
+        annual: null
+      },
+      stripePriceEnv: {
+        monthly: null,
+        annual: null
+      },
+      popular: false,
+      contactSales: null,
+      support: "community",
+      credits: {
+        monthlyMilli: 5e5
+      },
+      limits: {
+        workloads: [
+          "static"
+        ],
+        services: false,
+        runningServices: 0,
+        maxProjects: 3,
+        maxResourceTier: "low",
+        buildMinutesPerMonth: 15,
+        freeSubdomains: 10,
+        customDomains: null,
+        seats: null
+      },
+      features: [
+        "staticOnly",
+        "buildMinutes",
+        "freeSubdomains",
+        "customDomains",
+        "projects",
+        "unlimitedSeats",
+        "communitySupport"
+      ]
+    },
+    {
+      id: "starter",
+      price: {
+        monthly: 1e3,
+        annual: null
+      },
+      stripePriceEnv: {
+        monthly: "STRIPE_PRICE_STARTER_MONTHLY",
+        annual: "STRIPE_PRICE_STARTER_ANNUAL"
+      },
+      popular: false,
+      contactSales: null,
+      support: "email",
+      inherits: "free",
+      credits: {
+        monthlyMilli: 2e6
+      },
+      limits: {
+        workloads: [
+          "static",
+          "web",
+          "worker"
+        ],
+        services: true,
+        runningServices: 3,
+        maxProjects: 5,
+        maxResourceTier: "medium",
+        buildMinutesPerMonth: 400,
+        freeSubdomains: 25,
+        customDomains: null,
+        seats: null
+      },
+      features: [
+        "everythingIn",
+        "anyWorkload",
+        "managedServices",
+        "runningServices",
+        "power",
+        "projects",
+        "buildMinutes",
+        "credits",
+        "meteredCredits",
+        "freeSubdomains",
+        "previewDeploys",
+        "emailSupport"
+      ]
+    },
+    {
+      id: "pro",
+      price: {
+        monthly: 3900,
+        annual: null
+      },
+      stripePriceEnv: {
+        monthly: "STRIPE_PRICE_PRO_MONTHLY",
+        annual: "STRIPE_PRICE_PRO_ANNUAL"
+      },
+      popular: true,
+      contactSales: null,
+      support: "priority",
+      inherits: "starter",
+      credits: {
+        monthlyMilli: 1e7
+      },
+      limits: {
+        workloads: [
+          "static",
+          "web",
+          "worker"
+        ],
+        services: true,
+        runningServices: 10,
+        maxProjects: 25,
+        maxResourceTier: "high",
+        buildMinutesPerMonth: 2e3,
+        freeSubdomains: 100,
+        customDomains: null,
+        seats: null
+      },
+      features: [
+        "everythingIn",
+        "runningServices",
+        "power",
+        "projects",
+        "buildMinutes",
+        "credits",
+        "meteredCredits",
+        "freeSubdomains",
+        "backups",
+        "observability",
+        "mailServer",
+        "prioritySupport"
+      ]
+    },
+    {
+      id: "team",
+      price: {
+        monthly: 9900,
+        annual: null
+      },
+      stripePriceEnv: {
+        monthly: "STRIPE_PRICE_TEAM_MONTHLY",
+        annual: "STRIPE_PRICE_TEAM_ANNUAL"
+      },
+      popular: false,
+      contactSales: null,
+      support: "priority",
+      inherits: "pro",
+      credits: {
+        monthlyMilli: 6e7
+      },
+      limits: {
+        workloads: [
+          "static",
+          "web",
+          "worker"
+        ],
+        services: true,
+        runningServices: 50,
+        maxProjects: null,
+        maxResourceTier: "xlarge",
+        buildMinutesPerMonth: 6e3,
+        freeSubdomains: null,
+        customDomains: null,
+        seats: null
+      },
+      features: [
+        "everythingIn",
+        "runningServices",
+        "power",
+        "projectsUnlimited",
+        "buildMinutes",
+        "credits",
+        "meteredCredits",
+        "freeSubdomainsUnlimited",
+        "auditLog",
+        "sharedChannel",
+        "prioritySupport"
+      ]
+    },
+    {
+      id: "enterprise",
+      price: {
+        monthly: null,
+        annual: null
+      },
+      stripePriceEnv: {
+        monthly: null,
+        annual: null
+      },
+      popular: false,
+      contactSales: "mailto:sales@openship.io",
+      support: "dedicated",
+      inherits: "team",
+      credits: {
+        monthlyMilli: null
+      },
+      limits: {
+        workloads: [
+          "static",
+          "web",
+          "worker"
+        ],
+        services: true,
+        runningServices: null,
+        maxProjects: null,
+        maxResourceTier: null,
+        buildMinutesPerMonth: null,
+        freeSubdomains: null,
+        customDomains: null,
+        seats: null
+      },
+      features: [
+        "everythingIn",
+        "customLimits",
+        "sso",
+        "dedicatedInfra",
+        "onboarding",
+        "dedicatedSupport"
+      ]
+    }
+  ],
+  creditPacks: [
+    {
+      id: "pack_5k",
+      creditsMilli: 5e6,
+      priceCents: 500,
+      stripePriceEnv: "STRIPE_PRICE_PACK_5K",
+      sortOrder: 10
+    },
+    {
+      id: "pack_25k",
+      creditsMilli: 25e6,
+      priceCents: 2e3,
+      stripePriceEnv: "STRIPE_PRICE_PACK_25K",
+      sortOrder: 20
+    },
+    {
+      id: "pack_100k",
+      creditsMilli: 1e8,
+      priceCents: 7e3,
+      stripePriceEnv: "STRIPE_PRICE_PACK_100K",
+      sortOrder: 30
+    }
+  ],
+  selfHosted: {
+    features: [
+      "selfHostedOpenSource",
+      "selfHostedUnlimited",
+      "selfHostedServices",
+      "selfHostedClients",
+      "selfHostedFreeSubdomains",
+      "communitySupport"
+    ]
+  }
+};
+
+// ../../packages/core/src/pricing/locales/en.json
+var en_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "Ship static sites on Openship Cloud at no cost."
+    },
+    starter: {
+      name: "Starter",
+      tagline: "For your first real app \u2014 containers, databases, the works."
+    },
+    pro: {
+      name: "Pro",
+      tagline: "For production apps that need room to grow."
+    },
+    team: {
+      name: "Scale",
+      tagline: "For teams running serious traffic on shared infrastructure."
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "Custom limits, dedicated infrastructure, and an SLA."
+    }
+  },
+  features: {
+    everythingIn: "Everything in {inherited}, plus:",
+    staticOnly: "Static sites only \u2014 SSG, SPA, and plain HTML",
+    anyWorkload: "Run anything \u2014 containers, Compose stacks, and workers",
+    managedServices: "Managed Postgres, Redis, and the full app catalog",
+    buildMinutes: "{buildMinutes} build minutes per month",
+    credits: "{credits} compute credits per month",
+    freeSubdomains: "{freeSubdomains} free {freeDomainSuffix} subdomains",
+    freeSubdomainsUnlimited: "Unlimited free {freeDomainSuffix} subdomains",
+    customDomains: "Unlimited custom domains, TLS included",
+    unlimitedSeats: "Unlimited team members \u2014 never pay per seat",
+    previewDeploys: "Preview deploys on every push",
+    backups: "Daily backups with point-in-time recovery",
+    observability: "Live logs, metrics, and health alerts",
+    mailServer: "Built-in mail server \u2014 SMTP, IMAP, and webmail",
+    auditLog: "Audit log with extended retention",
+    sharedChannel: "Shared Slack or Discord channel",
+    sso: "SSO and SAML",
+    customLimits: "Custom limits, negotiated per contract",
+    dedicatedInfra: "Dedicated infrastructure and regions",
+    onboarding: "White-glove onboarding and migration",
+    communitySupport: "Community support",
+    emailSupport: "Email support",
+    prioritySupport: "Priority support",
+    dedicatedSupport: "Dedicated support with an SLA",
+    selfHostedOpenSource: "The whole platform, open source (Apache 2.0)",
+    selfHostedUnlimited: "Unlimited deploys, projects, servers, and domains",
+    selfHostedServices: "Every managed service \u2014 Postgres, Redis, mail",
+    selfHostedClients: "CLI, web, and desktop \u2014 one backend",
+    selfHostedFreeSubdomains: "{freeSubdomains} free {freeDomainSuffix} subdomains when you connect to Cloud",
+    runningServices: "{runningServices} running services \u2014 apps, databases, workers",
+    power: "Up to {powerCpu} vCPU and {powerRamGb} GB RAM per service",
+    projects: "{maxProjects} projects",
+    projectsUnlimited: "Unlimited projects",
+    meteredCredits: "Compute, bandwidth and storage all draw from your monthly credits"
+  },
+  selfHosted: {
+    name: "Self-hosted",
+    tagline: "Run the whole platform on machines you own. Any Linux box, any provider, any region. No metering, no seat caps, no telemetry.",
+    priceLabel: "Free",
+    priceNote: "Apache 2.0 \u2014 free forever, no credit card",
+    cta: "Start self-hosting"
+  },
+  creditPacks: {
+    pack_5k: "{credits} credits",
+    pack_25k: "{credits} credits",
+    pack_100k: "{credits} credits"
+  },
+  ui: {
+    perMonth: "/mo",
+    perYear: "/yr",
+    custom: "Custom",
+    free: "Free",
+    unlimited: "Unlimited",
+    mostPopular: "Most popular",
+    monthsFree: "{months} months free",
+    ctaStart: "Start for free",
+    ctaChoose: "Choose {name}",
+    ctaContact: "Talk to sales",
+    billedMonthly: "billed monthly, cancel anytime",
+    campaignBadge: "{percentOff}% off",
+    campaignEnds: "Offer ends {date}",
+    wasPrice: "was {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/ar.json
+var ar_default2 = {
+  plans: {
+    free: {
+      name: "\u0645\u062C\u0627\u0646\u064A",
+      tagline: "\u0627\u0646\u0634\u0631 \u0627\u0644\u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u062B\u0627\u0628\u062A\u0629 \u0639\u0644\u0649 Openship Cloud \u062F\u0648\u0646 \u0623\u064A \u062A\u0643\u0644\u0641\u0629."
+    },
+    starter: {
+      name: "\u0627\u0644\u0628\u062F\u0627\u064A\u0629",
+      tagline: "\u0644\u0623\u0648\u0644 \u062A\u0637\u0628\u064A\u0642 \u062D\u0642\u064A\u0642\u064A \u0644\u0643 \u2014 \u062D\u0627\u0648\u064A\u0627\u062A \u0648\u0642\u0648\u0627\u0639\u062F \u0628\u064A\u0627\u0646\u0627\u062A \u0648\u0643\u0644 \u0645\u0627 \u062A\u062D\u062A\u0627\u062C\u0647."
+    },
+    pro: {
+      name: "\u0627\u062D\u062A\u0631\u0627\u0641\u064A",
+      tagline: "\u0644\u062A\u0637\u0628\u064A\u0642\u0627\u062A \u0627\u0644\u0625\u0646\u062A\u0627\u062C \u0627\u0644\u062A\u064A \u062A\u062D\u062A\u0627\u062C \u0645\u0633\u0627\u062D\u0629 \u0644\u0644\u0646\u0645\u0648."
+    },
+    team: {
+      name: "\u0627\u0644\u062A\u0648\u0633\u0651\u0639",
+      tagline: "\u0644\u0644\u0641\u0631\u0642 \u0627\u0644\u062A\u064A \u062A\u062F\u064A\u0631 \u062D\u0631\u0643\u0629 \u0645\u0631\u0648\u0631 \u0643\u062B\u064A\u0641\u0629 \u0639\u0644\u0649 \u0628\u0646\u064A\u0629 \u062A\u062D\u062A\u064A\u0629 \u0645\u0634\u062A\u0631\u0643\u0629."
+    },
+    enterprise: {
+      name: "\u0627\u0644\u0645\u0624\u0633\u0633\u0627\u062A",
+      tagline: "\u062D\u062F\u0648\u062F \u0645\u062E\u0635\u0651\u0635\u0629 \u0648\u0628\u0646\u064A\u0629 \u062A\u062D\u062A\u064A\u0629 \u0645\u062E\u0635\u0651\u0635\u0629 \u0648\u0627\u062A\u0641\u0627\u0642\u064A\u0629 SLA."
+    }
+  },
+  features: {
+    everythingIn: "\u0643\u0644 \u0645\u0627 \u0641\u064A \u062E\u0637\u0629 \xAB{inherited}\xBB\u060C \u0628\u0627\u0644\u0625\u0636\u0627\u0641\u0629 \u0625\u0644\u0649:",
+    staticOnly: "\u0627\u0644\u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u062B\u0627\u0628\u062A\u0629 \u0641\u0642\u0637 \u2014 SSG \u0648SPA \u0648HTML \u0639\u0627\u062F\u064A",
+    anyWorkload: "\u0634\u063A\u0651\u0644 \u0623\u064A \u0634\u064A\u0621 \u2014 \u062D\u0627\u0648\u064A\u0627\u062A \u0648\u062D\u0650\u0632\u0645 Compose \u0648\u0639\u0645\u0644\u064A\u0627\u062A \u062E\u0644\u0641\u064A\u0629",
+    managedServices: "\u062E\u062F\u0645\u0627\u062A Postgres \u0648Redis \u0645\u064F\u062F\u0627\u0631\u0629\u060C \u0645\u0639 \u0643\u062A\u0627\u0644\u0648\u062C \u0627\u0644\u062A\u0637\u0628\u064A\u0642\u0627\u062A \u0627\u0644\u0643\u0627\u0645\u0644",
+    buildMinutes: "{buildMinutes} \u062F\u0642\u064A\u0642\u0629 \u0628\u0646\u0627\u0621 \u0634\u0647\u0631\u064A\u064B\u0627",
+    credits: "{credits} \u0648\u062D\u062F\u0629 \u0631\u0635\u064A\u062F \u062D\u0648\u0633\u0628\u0629 \u0634\u0647\u0631\u064A\u064B\u0627",
+    freeSubdomains: "{freeSubdomains} \u0646\u0637\u0627\u0642 \u0641\u0631\u0639\u064A \u0645\u062C\u0627\u0646\u064A \u0639\u0644\u0649 {freeDomainSuffix}",
+    freeSubdomainsUnlimited: "\u0646\u0637\u0627\u0642\u0627\u062A \u0641\u0631\u0639\u064A\u0629 \u0645\u062C\u0627\u0646\u064A\u0629 \u063A\u064A\u0631 \u0645\u062D\u062F\u0648\u062F\u0629 \u0639\u0644\u0649 {freeDomainSuffix}",
+    customDomains: "\u0646\u0637\u0627\u0642\u0627\u062A \u0645\u062E\u0635\u0651\u0635\u0629 \u063A\u064A\u0631 \u0645\u062D\u062F\u0648\u062F\u0629\u060C \u0645\u0639 TLS",
+    unlimitedSeats: "\u0623\u0639\u0636\u0627\u0621 \u0641\u0631\u064A\u0642 \u063A\u064A\u0631 \u0645\u062D\u062F\u0648\u062F\u064A\u0646 \u2014 \u0628\u0644\u0627 \u0631\u0633\u0648\u0645 \u0639\u0644\u0649 \u0643\u0644 \u0645\u0633\u062A\u062E\u062F\u0645",
+    previewDeploys: "\u0646\u0634\u0631 \u0645\u0639\u0627\u064A\u0646\u0629 \u0639\u0646\u062F \u0643\u0644 \u062F\u0641\u0639 \u0644\u0644\u0643\u0648\u062F",
+    backups: "\u0646\u0633\u062E \u0627\u062D\u062A\u064A\u0627\u0637\u064A \u064A\u0648\u0645\u064A \u0645\u0639 \u0627\u0633\u062A\u0639\u0627\u062F\u0629 \u0625\u0644\u0649 \u0644\u062D\u0638\u0629 \u0632\u0645\u0646\u064A\u0629 \u0645\u062D\u062F\u0651\u062F\u0629",
+    observability: "\u0633\u062C\u0644\u0627\u062A \u062D\u064A\u0651\u0629 \u0648\u0645\u0642\u0627\u064A\u064A\u0633 \u0648\u062A\u0646\u0628\u064A\u0647\u0627\u062A \u0644\u0635\u062D\u0629 \u0627\u0644\u062E\u062F\u0645\u0629",
+    mailServer: "\u062E\u0627\u062F\u0645 \u0628\u0631\u064A\u062F \u0645\u062F\u0645\u062C \u2014 SMTP \u0648IMAP \u0648\u0628\u0631\u064A\u062F \u0639\u0644\u0649 \u0627\u0644\u0648\u064A\u0628",
+    auditLog: "\u0633\u062C\u0644 \u062A\u062F\u0642\u064A\u0642 \u0628\u0645\u062F\u0629 \u062D\u0641\u0638 \u0645\u0645\u062A\u062F\u0629",
+    sharedChannel: "\u0642\u0646\u0627\u0629 \u0645\u0634\u062A\u0631\u0643\u0629 \u0639\u0644\u0649 Slack \u0623\u0648 Discord",
+    sso: "SSO \u0648SAML",
+    customLimits: "\u062D\u062F\u0648\u062F \u0645\u062E\u0635\u0651\u0635\u0629 \u064A\u064F\u062A\u0641\u0642 \u0639\u0644\u064A\u0647\u0627 \u0641\u064A \u0627\u0644\u0639\u0642\u062F",
+    dedicatedInfra: "\u0628\u0646\u064A\u0629 \u062A\u062D\u062A\u064A\u0629 \u0648\u0645\u0646\u0627\u0637\u0642 \u0645\u062E\u0635\u0651\u0635\u0629",
+    onboarding: "\u0625\u0639\u062F\u0627\u062F \u0648\u062A\u0631\u062D\u064A\u0644 \u0628\u0645\u062A\u0627\u0628\u0639\u0629 \u0643\u0627\u0645\u0644\u0629 \u0645\u0646 \u0641\u0631\u064A\u0642\u0646\u0627",
+    communitySupport: "\u062F\u0639\u0645 \u0645\u0646 \u0627\u0644\u0645\u062C\u062A\u0645\u0639",
+    emailSupport: "\u062F\u0639\u0645 \u0639\u0628\u0631 \u0627\u0644\u0628\u0631\u064A\u062F \u0627\u0644\u0625\u0644\u0643\u062A\u0631\u0648\u0646\u064A",
+    prioritySupport: "\u062F\u0639\u0645 \u0630\u0648 \u0623\u0648\u0644\u0648\u064A\u0629",
+    dedicatedSupport: "\u062F\u0639\u0645 \u0645\u062E\u0635\u0651\u0635 \u0645\u0639 \u0627\u062A\u0641\u0627\u0642\u064A\u0629 SLA",
+    selfHostedOpenSource: "\u0627\u0644\u0645\u0646\u0635\u0651\u0629 \u0643\u0627\u0645\u0644\u0629\u060C \u0645\u0641\u062A\u0648\u062D\u0629 \u0627\u0644\u0645\u0635\u062F\u0631 (Apache 2.0)",
+    selfHostedUnlimited: "\u0639\u0645\u0644\u064A\u0627\u062A \u0646\u0634\u0631 \u0648\u0645\u0634\u0627\u0631\u064A\u0639 \u0648\u062E\u0648\u0627\u062F\u0645 \u0648\u0646\u0637\u0627\u0642\u0627\u062A \u063A\u064A\u0631 \u0645\u062D\u062F\u0648\u062F\u0629",
+    selfHostedServices: "\u0643\u0644 \u0627\u0644\u062E\u062F\u0645\u0627\u062A \u0627\u0644\u0645\u064F\u062F\u0627\u0631\u0629 \u2014 Postgres \u0648Redis \u0648\u0627\u0644\u0628\u0631\u064A\u062F",
+    selfHostedClients: "CLI \u0648\u0648\u0627\u062C\u0647\u0629 \u0648\u064A\u0628 \u0648\u062A\u0637\u0628\u064A\u0642 \u0633\u0637\u062D \u0645\u0643\u062A\u0628 \u2014 \u062E\u062F\u0645\u0629 \u062E\u0644\u0641\u064A\u0629 \u0648\u0627\u062D\u062F\u0629",
+    selfHostedFreeSubdomains: "{freeSubdomains} \u0646\u0637\u0627\u0642 \u0641\u0631\u0639\u064A \u0645\u062C\u0627\u0646\u064A \u0639\u0644\u0649 {freeDomainSuffix} \u0639\u0646\u062F \u0627\u0644\u0631\u0628\u0637 \u0645\u0639 Openship Cloud",
+    runningServices: "{runningServices} \u062E\u062F\u0645\u0629 \u0642\u064A\u062F \u0627\u0644\u062A\u0634\u063A\u064A\u0644 \u2014 \u062A\u0637\u0628\u064A\u0642\u0627\u062A \u0648\u0642\u0648\u0627\u0639\u062F \u0628\u064A\u0627\u0646\u0627\u062A \u0648\u0639\u0645\u0644\u064A\u0627\u062A \u062E\u0644\u0641\u064A\u0629",
+    power: "\u062D\u062A\u0649 {powerCpu} vCPU \u0648{powerRamGb} GB RAM \u0644\u0643\u0644 \u062E\u062F\u0645\u0629",
+    projects: "{maxProjects} \u0645\u0634\u0631\u0648\u0639",
+    projectsUnlimited: "\u0645\u0634\u0627\u0631\u064A\u0639 \u063A\u064A\u0631 \u0645\u062D\u062F\u0648\u062F\u0629",
+    meteredCredits: "\u0627\u0644\u062D\u0648\u0633\u0628\u0629 \u0648\u0627\u0644\u0646\u0637\u0627\u0642 \u0627\u0644\u062A\u0631\u062F\u062F\u064A \u0648\u0627\u0644\u062A\u062E\u0632\u064A\u0646 \u062A\u064F\u062E\u0635\u0645 \u0643\u0644\u0647\u0627 \u0645\u0646 \u0631\u0635\u064A\u062F\u0643 \u0627\u0644\u0634\u0647\u0631\u064A"
+  },
+  selfHosted: {
+    name: "\u0627\u0633\u062A\u0636\u0627\u0641\u0629 \u0630\u0627\u062A\u064A\u0629",
+    tagline: "\u0634\u063A\u0651\u0644 \u0627\u0644\u0645\u0646\u0635\u0651\u0629 \u0643\u0627\u0645\u0644\u0629 \u0639\u0644\u0649 \u0623\u062C\u0647\u0632\u0629 \u062A\u0645\u0644\u0643\u0647\u0627. \u0623\u064A \u062C\u0647\u0627\u0632 Linux\u060C \u0648\u0623\u064A \u0645\u0632\u0648\u0651\u062F\u060C \u0648\u0623\u064A \u0645\u0646\u0637\u0642\u0629. \u0628\u0644\u0627 \u0642\u064A\u0627\u0633 \u0627\u0633\u062A\u0647\u0644\u0627\u0643\u060C \u0648\u0628\u0644\u0627 \u062D\u062F \u0644\u0639\u062F\u062F \u0627\u0644\u0645\u0633\u062A\u062E\u062F\u0645\u064A\u0646\u060C \u0648\u0628\u0644\u0627 \u062A\u062A\u0628\u0651\u0639.",
+    priceLabel: "\u0645\u062C\u0627\u0646\u064A",
+    priceNote: "Apache 2.0 \u2014 \u0645\u062C\u0627\u0646\u064A \u062F\u0627\u0626\u0645\u064B\u0627\u060C \u062F\u0648\u0646 \u0628\u0637\u0627\u0642\u0629 \u0627\u0626\u062A\u0645\u0627\u0646",
+    cta: "\u0627\u0628\u062F\u0623 \u0627\u0644\u0627\u0633\u062A\u0636\u0627\u0641\u0629 \u0627\u0644\u0630\u0627\u062A\u064A\u0629"
+  },
+  creditPacks: {
+    pack_5k: "{credits} \u0648\u062D\u062F\u0629 \u0631\u0635\u064A\u062F",
+    pack_25k: "{credits} \u0648\u062D\u062F\u0629 \u0631\u0635\u064A\u062F",
+    pack_100k: "{credits} \u0648\u062D\u062F\u0629 \u0631\u0635\u064A\u062F"
+  },
+  ui: {
+    perMonth: "/\u0634\u0647\u0631",
+    perYear: "/\u0633\u0646\u0629",
+    custom: "\u0645\u062E\u0635\u0651\u0635",
+    free: "\u0645\u062C\u0627\u0646\u064B\u0627",
+    unlimited: "\u063A\u064A\u0631 \u0645\u062D\u062F\u0648\u062F",
+    mostPopular: "\u0627\u0644\u0623\u0643\u062B\u0631 \u0634\u064A\u0648\u0639\u064B\u0627",
+    monthsFree: "{months} \u0634\u0647\u0631 \u0645\u062C\u0627\u0646\u064B\u0627",
+    ctaStart: "\u0627\u0628\u062F\u0623 \u0645\u062C\u0627\u0646\u064B\u0627",
+    ctaChoose: "\u0627\u062E\u062A\u0631 \u062E\u0637\u0629 {name}",
+    ctaContact: "\u062A\u0648\u0627\u0635\u0644 \u0645\u0639 \u0641\u0631\u064A\u0642 \u0627\u0644\u0645\u0628\u064A\u0639\u0627\u062A",
+    billedMonthly: "\u0641\u0627\u062A\u0648\u0631\u0629 \u0634\u0647\u0631\u064A\u0629\u060C \u0648\u0627\u0644\u0625\u0644\u063A\u0627\u0621 \u0645\u062A\u0627\u062D \u0641\u064A \u0623\u064A \u0648\u0642\u062A",
+    campaignBadge: "\u062E\u0635\u0645 {percentOff}%",
+    campaignEnds: "\u064A\u0646\u062A\u0647\u064A \u0627\u0644\u0639\u0631\u0636 \u0641\u064A {date}",
+    wasPrice: "\u0633\u0627\u0628\u0642\u064B\u0627 {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/de.json
+var de_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "Statische Websites kostenlos auf Openship Cloud deployen."
+    },
+    starter: {
+      name: "Starter",
+      tagline: "F\xFCr die erste echte App \u2013 Container, Datenbanken, alles dabei."
+    },
+    pro: {
+      name: "Pro",
+      tagline: "F\xFCr Produktions-Apps, die Platz zum Wachsen brauchen."
+    },
+    team: {
+      name: "Scale",
+      tagline: "F\xFCr Teams mit hohem Traffic auf gemeinsamer Infrastruktur."
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "Individuelle Limits, dedizierte Infrastruktur und ein SLA."
+    }
+  },
+  features: {
+    everythingIn: "Alles aus {inherited}, plus:",
+    staticOnly: "Nur statische Websites \u2013 SSG, SPA und reines HTML",
+    anyWorkload: "Beliebige Workloads \u2013 Container, Compose-Stacks und Worker",
+    managedServices: "Managed Postgres, Redis und der komplette App-Katalog",
+    buildMinutes: "{buildMinutes} Build-Minuten pro Monat",
+    credits: "{credits} Compute-Credits pro Monat",
+    freeSubdomains: "{freeSubdomains} kostenlose Subdomains unter {freeDomainSuffix}",
+    freeSubdomainsUnlimited: "Unbegrenzt viele kostenlose Subdomains unter {freeDomainSuffix}",
+    customDomains: "Unbegrenzt viele eigene Domains, TLS inklusive",
+    unlimitedSeats: "Unbegrenzt viele Teammitglieder \u2013 nie Kosten pro Nutzer",
+    previewDeploys: "Preview-Deploys bei jedem Push",
+    backups: "T\xE4gliche Backups mit Point-in-Time-Recovery",
+    observability: "Live-Logs, Metriken und Health-Alerts",
+    mailServer: "Integrierter Mailserver \u2013 SMTP, IMAP und Webmail",
+    auditLog: "Audit-Log mit verl\xE4ngerter Aufbewahrungsdauer",
+    sharedChannel: "Gemeinsamer Slack- oder Discord-Channel",
+    sso: "SSO und SAML",
+    customLimits: "Individuelle Limits, vertraglich vereinbart",
+    dedicatedInfra: "Dedizierte Infrastruktur und Regionen",
+    onboarding: "Pers\xF6nlich begleitetes Onboarding und Migration",
+    communitySupport: "Community-Support",
+    emailSupport: "E-Mail-Support",
+    prioritySupport: "Priorisierter Support",
+    dedicatedSupport: "Dedizierter Support mit SLA",
+    selfHostedOpenSource: "Die komplette Plattform als Open Source (Apache 2.0)",
+    selfHostedUnlimited: "Unbegrenzt viele Deploys, Projekte, Server und Domains",
+    selfHostedServices: "Alle Managed Services \u2013 Postgres, Redis, Mail",
+    selfHostedClients: "CLI, Web und Desktop \u2013 ein Backend",
+    selfHostedFreeSubdomains: "{freeSubdomains} kostenlose Subdomains unter {freeDomainSuffix} bei Verbindung mit Openship Cloud",
+    runningServices: "{runningServices} laufende Services \u2013 Apps, Datenbanken, Worker",
+    power: "Bis zu {powerCpu} vCPU und {powerRamGb} GB RAM pro Service",
+    projects: "{maxProjects} Projekte",
+    projectsUnlimited: "Unbegrenzt viele Projekte",
+    meteredCredits: "Compute, Daten\xFCbertragung und Speicher werden alle \xFCber die monatlichen Credits abgerechnet"
+  },
+  selfHosted: {
+    name: "Selbst gehostet",
+    tagline: "Die komplette Plattform auf eigenen Maschinen betreiben. Jeder Linux-Server, jeder Anbieter, jede Region. Keine verbrauchsabh\xE4ngige Abrechnung, keine Nutzerlimits, keine Telemetrie.",
+    priceLabel: "Kostenlos",
+    priceNote: "Apache 2.0 \u2013 f\xFCr immer kostenlos, keine Kreditkarte",
+    cta: "Self-Hosting starten"
+  },
+  creditPacks: {
+    pack_5k: "{credits} Credits",
+    pack_25k: "{credits} Credits",
+    pack_100k: "{credits} Credits"
+  },
+  ui: {
+    perMonth: "/Mon.",
+    perYear: "/Jahr",
+    custom: "Individuell",
+    free: "Kostenlos",
+    unlimited: "Unbegrenzt",
+    mostPopular: "Am beliebtesten",
+    monthsFree: "{months} Monate kostenlos",
+    ctaStart: "Kostenlos starten",
+    ctaChoose: "{name} w\xE4hlen",
+    ctaContact: "Vertrieb kontaktieren",
+    billedMonthly: "monatliche Abrechnung, jederzeit k\xFCndbar",
+    campaignBadge: "{percentOff} % Rabatt",
+    campaignEnds: "Angebot endet am {date}",
+    wasPrice: "vorher {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/es.json
+var es_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "Publica sitios est\xE1ticos en Openship Cloud sin costo."
+    },
+    starter: {
+      name: "Starter",
+      tagline: "Para tu primera app en serio: contenedores, bases de datos y todo lo necesario."
+    },
+    pro: {
+      name: "Pro",
+      tagline: "Para apps en producci\xF3n que necesitan espacio para crecer."
+    },
+    team: {
+      name: "Scale",
+      tagline: "Para equipos que mueven tr\xE1fico serio sobre infraestructura compartida."
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "L\xEDmites a medida, infraestructura dedicada y un SLA."
+    }
+  },
+  features: {
+    everythingIn: "Todo lo de {inherited}, y adem\xE1s:",
+    staticOnly: "Solo sitios est\xE1ticos: SSG, SPA y HTML puro",
+    anyWorkload: "Ejecuta lo que sea: contenedores, stacks de Compose y workers",
+    managedServices: "Postgres y Redis gestionados, y el cat\xE1logo completo de apps",
+    buildMinutes: "{buildMinutes} minutos de build al mes",
+    credits: "{credits} cr\xE9ditos de c\xF3mputo al mes",
+    freeSubdomains: "{freeSubdomains} subdominios {freeDomainSuffix} gratis",
+    freeSubdomainsUnlimited: "Subdominios {freeDomainSuffix} gratis e ilimitados",
+    customDomains: "Dominios propios ilimitados, con TLS incluido",
+    unlimitedSeats: "Miembros de equipo ilimitados: nunca pagas por usuario",
+    previewDeploys: "Despliegues de vista previa en cada push",
+    backups: "Copias de seguridad diarias con recuperaci\xF3n a un punto en el tiempo",
+    observability: "Logs en vivo, m\xE9tricas y alertas de estado",
+    mailServer: "Servidor de correo integrado: SMTP, IMAP y webmail",
+    auditLog: "Registro de auditor\xEDa con retenci\xF3n ampliada",
+    sharedChannel: "Canal compartido en Slack o Discord",
+    sso: "SSO y SAML",
+    customLimits: "L\xEDmites a medida, negociados por contrato",
+    dedicatedInfra: "Infraestructura y regiones dedicadas",
+    onboarding: "Puesta en marcha y migraci\xF3n asistidas paso a paso",
+    communitySupport: "Soporte de la comunidad",
+    emailSupport: "Soporte por correo",
+    prioritySupport: "Soporte prioritario",
+    dedicatedSupport: "Soporte dedicado con SLA",
+    selfHostedOpenSource: "La plataforma completa, de c\xF3digo abierto (Apache 2.0)",
+    selfHostedUnlimited: "Despliegues, proyectos, servidores y dominios ilimitados",
+    selfHostedServices: "Todos los servicios gestionados: Postgres, Redis, correo",
+    selfHostedClients: "CLI, web y escritorio: un solo backend",
+    selfHostedFreeSubdomains: "{freeSubdomains} subdominios {freeDomainSuffix} gratis al conectarte a Cloud",
+    runningServices: "{runningServices} servicios en ejecuci\xF3n: apps, bases de datos, workers",
+    power: "Hasta {powerCpu} vCPU y {powerRamGb} GB de RAM por servicio",
+    projects: "{maxProjects} proyectos",
+    projectsUnlimited: "Proyectos ilimitados",
+    meteredCredits: "El c\xF3mputo, el ancho de banda y el almacenamiento se descuentan de tus cr\xE9ditos mensuales"
+  },
+  selfHosted: {
+    name: "Autoalojado",
+    tagline: "Ejecuta la plataforma completa en m\xE1quinas propias. Cualquier equipo Linux, cualquier proveedor, cualquier regi\xF3n. Sin medici\xF3n de consumo, sin l\xEDmite de usuarios, sin telemetr\xEDa.",
+    priceLabel: "Gratis",
+    priceNote: "Apache 2.0: gratis para siempre, sin tarjeta de cr\xE9dito",
+    cta: "Empezar a autoalojar"
+  },
+  creditPacks: {
+    pack_5k: "{credits} cr\xE9ditos",
+    pack_25k: "{credits} cr\xE9ditos",
+    pack_100k: "{credits} cr\xE9ditos"
+  },
+  ui: {
+    perMonth: "/mes",
+    perYear: "/a\xF1o",
+    custom: "A medida",
+    free: "Gratis",
+    unlimited: "Ilimitado",
+    mostPopular: "El m\xE1s popular",
+    monthsFree: "{months} meses gratis",
+    ctaStart: "Empezar gratis",
+    ctaChoose: "Elegir {name}",
+    ctaContact: "Hablar con ventas",
+    billedMonthly: "facturaci\xF3n mensual, cancela cuando quieras",
+    campaignBadge: "{percentOff}% de descuento",
+    campaignEnds: "La oferta termina el {date}",
+    wasPrice: "antes {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/fr.json
+var fr_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "D\xE9ployez des sites statiques sur Openship Cloud, gratuitement."
+    },
+    starter: {
+      name: "Starter",
+      tagline: "Pour votre premi\xE8re vraie application \u2014 conteneurs, bases de donn\xE9es et tout le reste."
+    },
+    pro: {
+      name: "Pro",
+      tagline: "Pour les applications en production qui ont besoin de marge pour grandir."
+    },
+    team: {
+      name: "Scale",
+      tagline: "Pour les \xE9quipes qui encaissent un trafic s\xE9rieux sur une infrastructure partag\xE9e."
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "Limites sur mesure, infrastructure d\xE9di\xE9e et un SLA."
+    }
+  },
+  features: {
+    everythingIn: "Tout ce que contient {inherited}, plus :",
+    staticOnly: "Sites statiques uniquement \u2014 SSG, SPA et HTML brut",
+    anyWorkload: "Ex\xE9cutez ce que vous voulez \u2014 conteneurs, stacks Compose et workers",
+    managedServices: "Postgres et Redis manag\xE9s, et tout le catalogue d'applications",
+    buildMinutes: "{buildMinutes} minutes de build par mois",
+    credits: "{credits} cr\xE9dits de calcul par mois",
+    freeSubdomains: "{freeSubdomains} sous-domaines {freeDomainSuffix} gratuits",
+    freeSubdomainsUnlimited: "Sous-domaines {freeDomainSuffix} gratuits en illimit\xE9",
+    customDomains: "Domaines personnalis\xE9s illimit\xE9s, TLS inclus",
+    unlimitedSeats: "Membres d'\xE9quipe illimit\xE9s \u2014 jamais de facturation par utilisateur",
+    previewDeploys: "D\xE9ploiements de pr\xE9visualisation \xE0 chaque push",
+    backups: "Sauvegardes quotidiennes avec restauration \xE0 un instant pr\xE9cis",
+    observability: "Logs en direct, m\xE9triques et alertes de sant\xE9",
+    mailServer: "Serveur mail int\xE9gr\xE9 \u2014 SMTP, IMAP et webmail",
+    auditLog: "Journal d'audit avec r\xE9tention \xE9tendue",
+    sharedChannel: "Canal Slack ou Discord partag\xE9",
+    sso: "SSO et SAML",
+    customLimits: "Limites sur mesure, n\xE9goci\xE9es par contrat",
+    dedicatedInfra: "Infrastructure et r\xE9gions d\xE9di\xE9es",
+    onboarding: "Mise en route et migration accompagn\xE9es",
+    communitySupport: "Support communautaire",
+    emailSupport: "Support par e-mail",
+    prioritySupport: "Support prioritaire",
+    dedicatedSupport: "Support d\xE9di\xE9 avec SLA",
+    selfHostedOpenSource: "Toute la plateforme, en open source (Apache 2.0)",
+    selfHostedUnlimited: "D\xE9ploiements, projets, serveurs et domaines illimit\xE9s",
+    selfHostedServices: "Tous les services manag\xE9s \u2014 Postgres, Redis, mail",
+    selfHostedClients: "CLI, web et desktop \u2014 un seul backend",
+    selfHostedFreeSubdomains: "{freeSubdomains} sous-domaines {freeDomainSuffix} gratuits en vous connectant au Cloud",
+    runningServices: "{runningServices} services actifs \u2014 applications, bases de donn\xE9es, workers",
+    power: "Jusqu'\xE0 {powerCpu} vCPU et {powerRamGb} GB de RAM par service",
+    projects: "{maxProjects} projets",
+    projectsUnlimited: "Projets illimit\xE9s",
+    meteredCredits: "Le calcul, la bande passante et le stockage sont tous d\xE9duits de vos cr\xE9dits mensuels"
+  },
+  selfHosted: {
+    name: "Auto-h\xE9berg\xE9",
+    tagline: "Faites tourner toute la plateforme sur vos propres machines. N'importe quelle machine Linux, n'importe quel fournisseur, n'importe quelle r\xE9gion. Pas de comptage \xE0 l'usage, pas de limite d'utilisateurs, pas de t\xE9l\xE9m\xE9trie.",
+    priceLabel: "Gratuit",
+    priceNote: "Apache 2.0 \u2014 gratuit \xE0 vie, sans carte bancaire",
+    cta: "Commencer l'auto-h\xE9bergement"
+  },
+  creditPacks: {
+    pack_5k: "{credits} cr\xE9dits",
+    pack_25k: "{credits} cr\xE9dits",
+    pack_100k: "{credits} cr\xE9dits"
+  },
+  ui: {
+    perMonth: "/mois",
+    perYear: "/an",
+    custom: "Sur mesure",
+    free: "Gratuit",
+    unlimited: "Illimit\xE9",
+    mostPopular: "Le plus populaire",
+    monthsFree: "{months} mois offerts",
+    ctaStart: "Commencer gratuitement",
+    ctaChoose: "Choisir {name}",
+    ctaContact: "Contacter l'\xE9quipe commerciale",
+    billedMonthly: "factur\xE9 mensuellement, r\xE9siliable \xE0 tout moment",
+    campaignBadge: "{percentOff} % de remise",
+    campaignEnds: "L'offre se termine le {date}",
+    wasPrice: "avant {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/ja.json
+var ja_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "\u9759\u7684\u30B5\u30A4\u30C8\u3092 Openship Cloud \u306B\u7121\u6599\u3067\u30C7\u30D7\u30ED\u30A4\u3067\u304D\u307E\u3059\u3002"
+    },
+    starter: {
+      name: "Starter",
+      tagline: "\u306F\u3058\u3081\u3066\u306E\u672C\u683C\u7684\u306A\u30A2\u30D7\u30EA\u306B\u3002\u30B3\u30F3\u30C6\u30CA\u3001\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u3001\u5FC5\u8981\u306A\u3082\u306E\u304C\u4E00\u5F0F\u305D\u308D\u3044\u307E\u3059\u3002"
+    },
+    pro: {
+      name: "Pro",
+      tagline: "\u6210\u9577\u306E\u4F59\u5730\u304C\u5FC5\u8981\u306A\u672C\u756A\u30A2\u30D7\u30EA\u5411\u3051\u3002"
+    },
+    team: {
+      name: "Scale",
+      tagline: "\u5171\u6709\u30A4\u30F3\u30D5\u30E9\u3067\u5927\u91CF\u306E\u30C8\u30E9\u30D5\u30A3\u30C3\u30AF\u3092\u3055\u3070\u304F\u30C1\u30FC\u30E0\u5411\u3051\u3002"
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "\u30AB\u30B9\u30BF\u30E0\u306E\u4E0A\u9650\u3001\u5C02\u7528\u30A4\u30F3\u30D5\u30E9\u3001SLA\u3002"
+    }
+  },
+  features: {
+    everythingIn: "{inherited} \u306E\u5168\u6A5F\u80FD\u306B\u52A0\u3048\u3066:",
+    staticOnly: "\u9759\u7684\u30B5\u30A4\u30C8\u306E\u307F \u2014 SSG\u3001SPA\u3001\u7D20\u306E HTML",
+    anyWorkload: "\u4F55\u3067\u3082\u52D5\u304B\u305B\u308B \u2014 \u30B3\u30F3\u30C6\u30CA\u3001Compose \u30B9\u30BF\u30C3\u30AF\u3001\u30EF\u30FC\u30AB\u30FC",
+    managedServices: "\u30DE\u30CD\u30FC\u30B8\u30C9\u306E Postgres \u3068 Redis\u3001\u30A2\u30D7\u30EA\u30AB\u30BF\u30ED\u30B0\u3059\u3079\u3066",
+    buildMinutes: "\u6BCE\u6708 {buildMinutes} \u5206\u306E\u30D3\u30EB\u30C9\u6642\u9593",
+    credits: "\u6BCE\u6708 {credits} \u30B3\u30F3\u30D4\u30E5\u30FC\u30C8\u30AF\u30EC\u30B8\u30C3\u30C8",
+    freeSubdomains: "\u7121\u6599\u306E {freeDomainSuffix} \u30B5\u30D6\u30C9\u30E1\u30A4\u30F3 {freeSubdomains} \u500B",
+    freeSubdomainsUnlimited: "\u7121\u6599\u306E {freeDomainSuffix} \u30B5\u30D6\u30C9\u30E1\u30A4\u30F3\u304C\u7121\u5236\u9650",
+    customDomains: "\u30AB\u30B9\u30BF\u30E0\u30C9\u30E1\u30A4\u30F3\u306F\u7121\u5236\u9650\u3001TLS \u8FBC\u307F",
+    unlimitedSeats: "\u30C1\u30FC\u30E0\u30E1\u30F3\u30D0\u30FC\u306F\u7121\u5236\u9650 \u2014 \u4EBA\u6570\u8AB2\u91D1\u306F\u4E00\u5207\u306A\u3057",
+    previewDeploys: "\u30D7\u30C3\u30B7\u30E5\u3054\u3068\u306B\u30D7\u30EC\u30D3\u30E5\u30FC\u30C7\u30D7\u30ED\u30A4",
+    backups: "\u65E5\u6B21\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u3068\u30DD\u30A4\u30F3\u30C8\u30A4\u30F3\u30BF\u30A4\u30E0\u30EA\u30AB\u30D0\u30EA",
+    observability: "\u30E9\u30A4\u30D6\u30ED\u30B0\u3001\u30E1\u30C8\u30EA\u30AF\u30B9\u3001\u30D8\u30EB\u30B9\u30A2\u30E9\u30FC\u30C8",
+    mailServer: "\u30E1\u30FC\u30EB\u30B5\u30FC\u30D0\u30FC\u5185\u8535 \u2014 SMTP\u3001IMAP\u3001\u30A6\u30A7\u30D6\u30E1\u30FC\u30EB",
+    auditLog: "\u4FDD\u6301\u671F\u9593\u3092\u5EF6\u9577\u3057\u305F\u76E3\u67FB\u30ED\u30B0",
+    sharedChannel: "Slack \u307E\u305F\u306F Discord \u306E\u5171\u6709\u30C1\u30E3\u30F3\u30CD\u30EB",
+    sso: "SSO \u3068 SAML",
+    customLimits: "\u5951\u7D04\u3054\u3068\u306B\u8ABF\u6574\u3059\u308B\u30AB\u30B9\u30BF\u30E0\u306E\u4E0A\u9650",
+    dedicatedInfra: "\u5C02\u7528\u30A4\u30F3\u30D5\u30E9\u3068\u5C02\u7528\u30EA\u30FC\u30B8\u30E7\u30F3",
+    onboarding: "\u5C0E\u5165\u3068\u79FB\u884C\u3092\u5C02\u4EFB\u30C1\u30FC\u30E0\u304C\u30D5\u30EB\u30B5\u30DD\u30FC\u30C8",
+    communitySupport: "\u30B3\u30DF\u30E5\u30CB\u30C6\u30A3\u30B5\u30DD\u30FC\u30C8",
+    emailSupport: "\u30E1\u30FC\u30EB\u30B5\u30DD\u30FC\u30C8",
+    prioritySupport: "\u512A\u5148\u30B5\u30DD\u30FC\u30C8",
+    dedicatedSupport: "SLA \u4ED8\u304D\u306E\u5C02\u4EFB\u30B5\u30DD\u30FC\u30C8",
+    selfHostedOpenSource: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u5168\u4F53\u304C\u30AA\u30FC\u30D7\u30F3\u30BD\u30FC\u30B9(Apache 2.0)",
+    selfHostedUnlimited: "\u30C7\u30D7\u30ED\u30A4\u3001\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u3001\u30B5\u30FC\u30D0\u30FC\u3001\u30C9\u30E1\u30A4\u30F3\u3059\u3079\u3066\u7121\u5236\u9650",
+    selfHostedServices: "\u30DE\u30CD\u30FC\u30B8\u30C9\u30B5\u30FC\u30D3\u30B9\u306F\u3059\u3079\u3066\u5229\u7528\u53EF\u80FD \u2014 Postgres\u3001Redis\u3001\u30E1\u30FC\u30EB",
+    selfHostedClients: "CLI\u3001Web\u3001\u30C7\u30B9\u30AF\u30C8\u30C3\u30D7 \u2014 \u30D0\u30C3\u30AF\u30A8\u30F3\u30C9\u306F\u4E00\u3064",
+    selfHostedFreeSubdomains: "Openship Cloud \u306B\u63A5\u7D9A\u3059\u308B\u3068\u3001\u7121\u6599\u306E {freeDomainSuffix} \u30B5\u30D6\u30C9\u30E1\u30A4\u30F3\u304C {freeSubdomains} \u500B",
+    runningServices: "\u540C\u6642\u306B\u7A3C\u50CD\u3059\u308B\u30B5\u30FC\u30D3\u30B9 {runningServices} \u500B \u2014 \u30A2\u30D7\u30EA\u3001\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u3001\u30EF\u30FC\u30AB\u30FC",
+    power: "\u30B5\u30FC\u30D3\u30B9 1 \u3064\u3042\u305F\u308A\u6700\u5927 {powerCpu} vCPU \u3068 {powerRamGb} GB RAM",
+    projects: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8 {maxProjects} \u500B",
+    projectsUnlimited: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306F\u7121\u5236\u9650",
+    meteredCredits: "\u30B3\u30F3\u30D4\u30E5\u30FC\u30C8\u3001\u5E2F\u57DF\u5E45\u3001\u30B9\u30C8\u30EC\u30FC\u30B8\u306F\u3059\u3079\u3066\u6BCE\u6708\u306E\u30AF\u30EC\u30B8\u30C3\u30C8\u304B\u3089\u6D88\u8CBB\u3055\u308C\u307E\u3059"
+  },
+  selfHosted: {
+    name: "\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8",
+    tagline: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u5168\u4F53\u3092\u81EA\u5206\u306E\u30DE\u30B7\u30F3\u3067\u52D5\u304B\u305B\u307E\u3059\u3002Linux \u30DE\u30B7\u30F3\u306A\u3089\u3069\u308C\u3067\u3082\u3001\u3069\u306E\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u3067\u3082\u3001\u3069\u306E\u30EA\u30FC\u30B8\u30E7\u30F3\u3067\u3082\u3002\u4F7F\u7528\u91CF\u306E\u8A08\u6E2C\u3082\u30E6\u30FC\u30B6\u30FC\u6570\u306E\u4E0A\u9650\u3082\u30C6\u30EC\u30E1\u30C8\u30EA\u3082\u3042\u308A\u307E\u305B\u3093\u3002",
+    priceLabel: "\u7121\u6599",
+    priceNote: "Apache 2.0 \u2014 \u6C38\u4E45\u7121\u6599\u3001\u30AF\u30EC\u30B8\u30C3\u30C8\u30AB\u30FC\u30C9\u4E0D\u8981",
+    cta: "\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8\u3092\u59CB\u3081\u308B"
+  },
+  creditPacks: {
+    pack_5k: "{credits} \u30AF\u30EC\u30B8\u30C3\u30C8",
+    pack_25k: "{credits} \u30AF\u30EC\u30B8\u30C3\u30C8",
+    pack_100k: "{credits} \u30AF\u30EC\u30B8\u30C3\u30C8"
+  },
+  ui: {
+    perMonth: "/\u6708",
+    perYear: "/\u5E74",
+    custom: "\u30AB\u30B9\u30BF\u30E0",
+    free: "\u7121\u6599",
+    unlimited: "\u7121\u5236\u9650",
+    mostPopular: "\u4E00\u756A\u4EBA\u6C17",
+    monthsFree: "{months} \u304B\u6708\u7121\u6599",
+    ctaStart: "\u7121\u6599\u3067\u59CB\u3081\u308B",
+    ctaChoose: "{name} \u3092\u9078\u629E",
+    ctaContact: "\u55B6\u696D\u306B\u76F8\u8AC7",
+    billedMonthly: "\u6708\u984D\u8ACB\u6C42\u3001\u3044\u3064\u3067\u3082\u30AD\u30E3\u30F3\u30BB\u30EB\u53EF\u80FD",
+    campaignBadge: "{percentOff}% \u30AA\u30D5",
+    campaignEnds: "\u30AD\u30E3\u30F3\u30DA\u30FC\u30F3\u306F {date} \u307E\u3067",
+    wasPrice: "\u901A\u5E38 {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/pt.json
+var pt_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "Publique sites est\xE1ticos na Openship Cloud sem custo."
+    },
+    starter: {
+      name: "Starter",
+      tagline: "Para o seu primeiro app de verdade: cont\xEAineres, bancos de dados e tudo o mais."
+    },
+    pro: {
+      name: "Pro",
+      tagline: "Para apps em produ\xE7\xE3o que precisam de espa\xE7o para crescer."
+    },
+    team: {
+      name: "Scale",
+      tagline: "Para equipes com tr\xE1fego pesado em infraestrutura compartilhada."
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "Limites sob medida, infraestrutura dedicada e um SLA."
+    }
+  },
+  features: {
+    everythingIn: "Tudo do {inherited}, e mais:",
+    staticOnly: "Somente sites est\xE1ticos: SSG, SPA e HTML puro",
+    anyWorkload: "Execute qualquer coisa: cont\xEAineres, stacks do Compose e workers",
+    managedServices: "Postgres e Redis gerenciados, e o cat\xE1logo completo de apps",
+    buildMinutes: "{buildMinutes} minutos de build por m\xEAs",
+    credits: "{credits} cr\xE9ditos de computa\xE7\xE3o por m\xEAs",
+    freeSubdomains: "{freeSubdomains} subdom\xEDnios {freeDomainSuffix} gratuitos",
+    freeSubdomainsUnlimited: "Subdom\xEDnios {freeDomainSuffix} gratuitos e ilimitados",
+    customDomains: "Dom\xEDnios pr\xF3prios ilimitados, com TLS inclu\xEDdo",
+    unlimitedSeats: "Membros de equipe ilimitados: nunca pague por usu\xE1rio",
+    previewDeploys: "Deploys de pr\xE9-visualiza\xE7\xE3o a cada push",
+    backups: "Backups di\xE1rios com recupera\xE7\xE3o para um ponto no tempo",
+    observability: "Logs em tempo real, m\xE9tricas e alertas de sa\xFAde",
+    mailServer: "Servidor de e-mail integrado: SMTP, IMAP e webmail",
+    auditLog: "Log de auditoria com reten\xE7\xE3o estendida",
+    sharedChannel: "Canal compartilhado no Slack ou Discord",
+    sso: "SSO e SAML",
+    customLimits: "Limites sob medida, negociados por contrato",
+    dedicatedInfra: "Infraestrutura e regi\xF5es dedicadas",
+    onboarding: "Configura\xE7\xE3o inicial e migra\xE7\xE3o acompanhadas de ponta a ponta",
+    communitySupport: "Suporte da comunidade",
+    emailSupport: "Suporte por e-mail",
+    prioritySupport: "Suporte priorit\xE1rio",
+    dedicatedSupport: "Suporte dedicado com SLA",
+    selfHostedOpenSource: "A plataforma inteira, de c\xF3digo aberto (Apache 2.0)",
+    selfHostedUnlimited: "Deploys, projetos, servidores e dom\xEDnios ilimitados",
+    selfHostedServices: "Todos os servi\xE7os gerenciados: Postgres, Redis, e-mail",
+    selfHostedClients: "CLI, web e desktop: um \xFAnico backend",
+    selfHostedFreeSubdomains: "{freeSubdomains} subdom\xEDnios {freeDomainSuffix} gratuitos ao conectar \xE0 Cloud",
+    runningServices: "{runningServices} servi\xE7os em execu\xE7\xE3o: apps, bancos de dados, workers",
+    power: "At\xE9 {powerCpu} vCPU e {powerRamGb} GB de RAM por servi\xE7o",
+    projects: "{maxProjects} projetos",
+    projectsUnlimited: "Projetos ilimitados",
+    meteredCredits: "Computa\xE7\xE3o, largura de banda e armazenamento consomem os seus cr\xE9ditos mensais"
+  },
+  selfHosted: {
+    name: "Auto-hospedado",
+    tagline: "Rode a plataforma inteira em m\xE1quinas suas. Qualquer m\xE1quina Linux, qualquer provedor, qualquer regi\xE3o. Sem medi\xE7\xE3o de uso, sem limite de usu\xE1rios, sem telemetria.",
+    priceLabel: "Gr\xE1tis",
+    priceNote: "Apache 2.0: gr\xE1tis para sempre, sem cart\xE3o de cr\xE9dito",
+    cta: "Come\xE7ar a auto-hospedar"
+  },
+  creditPacks: {
+    pack_5k: "{credits} cr\xE9ditos",
+    pack_25k: "{credits} cr\xE9ditos",
+    pack_100k: "{credits} cr\xE9ditos"
+  },
+  ui: {
+    perMonth: "/m\xEAs",
+    perYear: "/ano",
+    custom: "Sob medida",
+    free: "Gr\xE1tis",
+    unlimited: "Ilimitado",
+    mostPopular: "Mais popular",
+    monthsFree: "{months} meses gr\xE1tis",
+    ctaStart: "Come\xE7ar gr\xE1tis",
+    ctaChoose: "Escolher {name}",
+    ctaContact: "Falar com vendas",
+    billedMonthly: "cobran\xE7a mensal, cancele quando quiser",
+    campaignBadge: "{percentOff}% de desconto",
+    campaignEnds: "Oferta termina em {date}",
+    wasPrice: "antes {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/tr.json
+var tr_default2 = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "Statik sitelerinizi Openship Cloud'da \xFCcretsiz yay\u0131na al\u0131n."
+    },
+    starter: {
+      name: "Starter",
+      tagline: "\u0130lk ger\xE7ek uygulaman\u0131z i\xE7in \u2014 container'lar, veritabanlar\u0131, hepsi."
+    },
+    pro: {
+      name: "Pro",
+      tagline: "B\xFCy\xFCmek i\xE7in yer isteyen \xFCretim uygulamalar\u0131 i\xE7in."
+    },
+    team: {
+      name: "Scale",
+      tagline: "Payla\u015F\u0131ml\u0131 altyap\u0131da ciddi trafik y\xF6neten ekipler i\xE7in."
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "\xD6zel limitler, size ayr\u0131lm\u0131\u015F altyap\u0131 ve SLA."
+    }
+  },
+  features: {
+    everythingIn: "{inherited} plan\u0131ndaki her \u015Fey, ayr\u0131ca:",
+    staticOnly: "Yaln\u0131zca statik siteler \u2014 SSG, SPA ve d\xFCz HTML",
+    anyWorkload: "Her \u015Feyi \xE7al\u0131\u015Ft\u0131r\u0131n \u2014 container'lar, Compose y\u0131\u011F\u0131nlar\u0131 ve worker'lar",
+    managedServices: "Y\xF6netilen Postgres, Redis ve uygulama katalo\u011Funun tamam\u0131",
+    buildMinutes: "Ayda {buildMinutes} build dakikas\u0131",
+    credits: "Ayda {credits} hesaplama kredisi",
+    freeSubdomains: "{freeSubdomains} \xFCcretsiz {freeDomainSuffix} alt alan ad\u0131",
+    freeSubdomainsUnlimited: "S\u0131n\u0131rs\u0131z \xFCcretsiz {freeDomainSuffix} alt alan ad\u0131",
+    customDomains: "S\u0131n\u0131rs\u0131z \xF6zel alan ad\u0131, TLS dahil",
+    unlimitedSeats: "S\u0131n\u0131rs\u0131z ekip \xFCyesi \u2014 kullan\u0131c\u0131 ba\u015F\u0131na \xF6deme yok",
+    previewDeploys: "Her push'ta \xF6nizleme da\u011F\u0131t\u0131m\u0131",
+    backups: "G\xFCnl\xFCk yedekler ve belirli bir ana geri d\xF6n\xFC\u015F",
+    observability: "Canl\u0131 loglar, metrikler ve sa\u011Fl\u0131k uyar\u0131lar\u0131",
+    mailServer: "Dahili posta sunucusu \u2014 SMTP, IMAP ve webmail",
+    auditLog: "Denetim kayd\u0131, uzat\u0131lm\u0131\u015F saklama s\xFCresiyle",
+    sharedChannel: "Payla\u015F\u0131ml\u0131 Slack veya Discord kanal\u0131",
+    sso: "SSO ve SAML",
+    customLimits: "S\xF6zle\u015Fmeye g\xF6re belirlenen \xF6zel limitler",
+    dedicatedInfra: "Size ayr\u0131lm\u0131\u015F altyap\u0131 ve b\xF6lgeler",
+    onboarding: "U\xE7tan uca kurulum ve ge\xE7i\u015F deste\u011Fi",
+    communitySupport: "Topluluk deste\u011Fi",
+    emailSupport: "E-posta deste\u011Fi",
+    prioritySupport: "\xD6ncelikli destek",
+    dedicatedSupport: "SLA garantili \xF6zel destek",
+    selfHostedOpenSource: "Platformun tamam\u0131, a\xE7\u0131k kaynak (Apache 2.0)",
+    selfHostedUnlimited: "S\u0131n\u0131rs\u0131z da\u011F\u0131t\u0131m, proje, sunucu ve alan ad\u0131",
+    selfHostedServices: "T\xFCm y\xF6netilen servisler \u2014 Postgres, Redis, posta",
+    selfHostedClients: "CLI, web ve masa\xFCst\xFC \u2014 tek backend",
+    selfHostedFreeSubdomains: "Cloud'a ba\u011Fland\u0131\u011F\u0131n\u0131zda {freeSubdomains} \xFCcretsiz {freeDomainSuffix} alt alan ad\u0131",
+    runningServices: "{runningServices} \xE7al\u0131\u015Fan servis \u2014 uygulamalar, veritabanlar\u0131, worker'lar",
+    power: "Servis ba\u015F\u0131na en fazla {powerCpu} vCPU ve {powerRamGb} GB RAM",
+    projects: "{maxProjects} proje",
+    projectsUnlimited: "S\u0131n\u0131rs\u0131z proje",
+    meteredCredits: "Hesaplama, bant geni\u015Fli\u011Fi ve depolaman\u0131n tamam\u0131 ayl\u0131k kredilerinizden d\xFC\u015Fer"
+  },
+  selfHosted: {
+    name: "Kendi sunucunuzda",
+    tagline: "Platformun tamam\u0131n\u0131 kendi makinelerinizde \xE7al\u0131\u015Ft\u0131r\u0131n. Her Linux makinesi, her sa\u011Flay\u0131c\u0131, her b\xF6lge. Kullan\u0131m \xF6l\xE7\xFCm\xFC yok, kullan\u0131c\u0131 s\u0131n\u0131r\u0131 yok, telemetri yok.",
+    priceLabel: "\xDCcretsiz",
+    priceNote: "Apache 2.0 \u2014 her zaman \xFCcretsiz, kredi kart\u0131 gerekmez",
+    cta: "Kendi sunucunuzda ba\u015Flay\u0131n"
+  },
+  creditPacks: {
+    pack_5k: "{credits} kredi",
+    pack_25k: "{credits} kredi",
+    pack_100k: "{credits} kredi"
+  },
+  ui: {
+    perMonth: "/ay",
+    perYear: "/y\u0131l",
+    custom: "\xD6zel",
+    free: "\xDCcretsiz",
+    unlimited: "S\u0131n\u0131rs\u0131z",
+    mostPopular: "En pop\xFCler",
+    monthsFree: "{months} ay \xFCcretsiz",
+    ctaStart: "\xDCcretsiz ba\u015Flay\u0131n",
+    ctaChoose: "{name} plan\u0131n\u0131 se\xE7in",
+    ctaContact: "Sat\u0131\u015F ekibiyle g\xF6r\xFC\u015F\xFCn",
+    billedMonthly: "ayl\u0131k faturalan\u0131r, istedi\u011Finiz zaman iptal edin",
+    campaignBadge: "%{percentOff} indirim",
+    campaignEnds: "Kampanya {date} tarihinde sona eriyor",
+    wasPrice: "eski fiyat {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/locales/zh.json
+var zh_default = {
+  plans: {
+    free: {
+      name: "Free",
+      tagline: "\u5728 Openship Cloud \u4E0A\u514D\u8D39\u90E8\u7F72\u9759\u6001\u7AD9\u70B9\u3002"
+    },
+    starter: {
+      name: "Starter",
+      tagline: "\u9002\u5408\u4F60\u7684\u7B2C\u4E00\u4E2A\u6B63\u5F0F\u5E94\u7528:\u5BB9\u5668\u3001\u6570\u636E\u5E93,\u4E00\u5E94\u4FF1\u5168\u3002"
+    },
+    pro: {
+      name: "Pro",
+      tagline: "\u9002\u5408\u9700\u8981\u589E\u957F\u7A7A\u95F4\u7684\u751F\u4EA7\u5E94\u7528\u3002"
+    },
+    team: {
+      name: "Scale",
+      tagline: "\u9002\u5408\u5728\u5171\u4EAB\u57FA\u7840\u8BBE\u65BD\u4E0A\u627F\u8F7D\u5927\u6D41\u91CF\u7684\u56E2\u961F\u3002"
+    },
+    enterprise: {
+      name: "Enterprise",
+      tagline: "\u81EA\u5B9A\u4E49\u914D\u989D\u3001\u4E13\u5C5E\u57FA\u7840\u8BBE\u65BD,\u5E76\u63D0\u4F9B SLA\u3002"
+    }
+  },
+  features: {
+    everythingIn: "\u5305\u542B {inherited} \u7684\u5168\u90E8\u529F\u80FD,\u53E6\u6709:",
+    staticOnly: "\u4EC5\u652F\u6301\u9759\u6001\u7AD9\u70B9:SSG\u3001SPA \u548C\u7EAF HTML",
+    anyWorkload: "\u4EFB\u610F\u5DE5\u4F5C\u8D1F\u8F7D\u90FD\u80FD\u8FD0\u884C:\u5BB9\u5668\u3001Compose \u7F16\u6392\u548C\u540E\u53F0\u4EFB\u52A1",
+    managedServices: "\u6258\u7BA1\u7684 Postgres\u3001Redis \u548C\u5B8C\u6574\u5E94\u7528\u76EE\u5F55",
+    buildMinutes: "\u6BCF\u6708 {buildMinutes} \u5206\u949F\u6784\u5EFA\u65F6\u957F",
+    credits: "\u6BCF\u6708 {credits} \u8BA1\u7B97\u79EF\u5206",
+    freeSubdomains: "{freeSubdomains} \u4E2A\u514D\u8D39 {freeDomainSuffix} \u5B50\u57DF\u540D",
+    freeSubdomainsUnlimited: "\u514D\u8D39 {freeDomainSuffix} \u5B50\u57DF\u540D\u4E0D\u9650\u6570\u91CF",
+    customDomains: "\u81EA\u5B9A\u4E49\u57DF\u540D\u4E0D\u9650\u6570\u91CF,\u542B TLS",
+    unlimitedSeats: "\u56E2\u961F\u6210\u5458\u4E0D\u9650\u4EBA\u6570,\u6C38\u4E0D\u6309\u5E2D\u4F4D\u8BA1\u8D39",
+    previewDeploys: "\u6BCF\u6B21\u63A8\u9001\u90FD\u751F\u6210\u9884\u89C8\u90E8\u7F72",
+    backups: "\u6BCF\u65E5\u5907\u4EFD,\u652F\u6301\u6309\u65F6\u95F4\u70B9\u6062\u590D",
+    observability: "\u5B9E\u65F6\u65E5\u5FD7\u3001\u6307\u6807\u548C\u5065\u5EB7\u544A\u8B66",
+    mailServer: "\u5185\u7F6E\u90AE\u4EF6\u670D\u52A1\u5668:SMTP\u3001IMAP \u548C\u7F51\u9875\u90AE\u7BB1",
+    auditLog: "\u5BA1\u8BA1\u65E5\u5FD7,\u4FDD\u7559\u671F\u66F4\u957F",
+    sharedChannel: "\u5171\u4EAB\u7684 Slack \u6216 Discord \u9891\u9053",
+    sso: "SSO \u4E0E SAML",
+    customLimits: "\u81EA\u5B9A\u4E49\u914D\u989D,\u6309\u5408\u540C\u5546\u5B9A",
+    dedicatedInfra: "\u4E13\u5C5E\u57FA\u7840\u8BBE\u65BD\u4E0E\u4E13\u5C5E\u533A\u57DF",
+    onboarding: "\u4E13\u4EBA\u5168\u7A0B\u534F\u52A9\u7684\u63A5\u5165\u4E0E\u8FC1\u79FB",
+    communitySupport: "\u793E\u533A\u652F\u6301",
+    emailSupport: "\u90AE\u4EF6\u652F\u6301",
+    prioritySupport: "\u4F18\u5148\u652F\u6301",
+    dedicatedSupport: "\u4E13\u5C5E\u652F\u6301,\u5E76\u63D0\u4F9B SLA",
+    selfHostedOpenSource: "\u6574\u4E2A\u5E73\u53F0\u5F00\u6E90(Apache 2.0)",
+    selfHostedUnlimited: "\u90E8\u7F72\u3001\u9879\u76EE\u3001\u670D\u52A1\u5668\u548C\u57DF\u540D\u5747\u4E0D\u9650\u6570\u91CF",
+    selfHostedServices: "\u5168\u90E8\u6258\u7BA1\u670D\u52A1:Postgres\u3001Redis\u3001\u90AE\u4EF6\u670D\u52A1",
+    selfHostedClients: "CLI\u3001\u7F51\u9875\u7AEF\u548C\u684C\u9762\u7AEF,\u5171\u7528\u4E00\u4E2A\u540E\u7AEF",
+    selfHostedFreeSubdomains: "\u8FDE\u63A5 Cloud \u540E\u53EF\u83B7\u5F97 {freeSubdomains} \u4E2A\u514D\u8D39 {freeDomainSuffix} \u5B50\u57DF\u540D",
+    runningServices: "{runningServices} \u4E2A\u540C\u65F6\u8FD0\u884C\u7684\u670D\u52A1:\u5E94\u7528\u3001\u6570\u636E\u5E93\u3001\u540E\u53F0\u4EFB\u52A1",
+    power: "\u6BCF\u4E2A\u670D\u52A1\u6700\u9AD8\u53EF\u8FBE {powerCpu} vCPU \u548C {powerRamGb} GB RAM",
+    projects: "{maxProjects} \u4E2A\u9879\u76EE",
+    projectsUnlimited: "\u9879\u76EE\u4E0D\u9650\u6570\u91CF",
+    meteredCredits: "\u8BA1\u7B97\u3001\u6D41\u91CF\u548C\u5B58\u50A8\u90FD\u4ECE\u4F60\u7684\u6BCF\u6708\u79EF\u5206\u4E2D\u6263\u9664"
+  },
+  selfHosted: {
+    name: "\u81EA\u6258\u7BA1",
+    tagline: "\u5728\u4F60\u81EA\u5DF1\u7684\u673A\u5668\u4E0A\u8FD0\u884C\u6574\u4E2A\u5E73\u53F0\u3002\u4EFB\u610F Linux \u4E3B\u673A\u3001\u4EFB\u610F\u4E91\u5382\u5546\u3001\u4EFB\u610F\u533A\u57DF\u3002\u4E0D\u8BA1\u91CF\u3001\u4E0D\u9650\u5E2D\u4F4D\u3001\u65E0\u9065\u6D4B\u3002",
+    priceLabel: "\u514D\u8D39",
+    priceNote: "Apache 2.0,\u6C38\u4E45\u514D\u8D39,\u65E0\u9700\u4FE1\u7528\u5361",
+    cta: "\u5F00\u59CB\u81EA\u6258\u7BA1"
+  },
+  creditPacks: {
+    pack_5k: "{credits} \u79EF\u5206",
+    pack_25k: "{credits} \u79EF\u5206",
+    pack_100k: "{credits} \u79EF\u5206"
+  },
+  ui: {
+    perMonth: "/\u6708",
+    perYear: "/\u5E74",
+    custom: "\u5B9A\u5236",
+    free: "\u514D\u8D39",
+    unlimited: "\u65E0\u9650",
+    mostPopular: "\u6700\u53D7\u6B22\u8FCE",
+    monthsFree: "{months} \u4E2A\u6708\u514D\u8D39",
+    ctaStart: "\u514D\u8D39\u5F00\u59CB\u4F7F\u7528",
+    ctaChoose: "\u9009\u62E9 {name}",
+    ctaContact: "\u8054\u7CFB\u9500\u552E",
+    billedMonthly: "\u6309\u6708\u8BA1\u8D39,\u53EF\u968F\u65F6\u53D6\u6D88",
+    campaignBadge: "\u7ACB\u51CF {percentOff}%",
+    campaignEnds: "\u4F18\u60E0\u622A\u6B62 {date}",
+    wasPrice: "\u539F\u4EF7 {price}"
+  }
+};
+
+// ../../packages/core/src/pricing/index.ts
+var PRICING = pricingCatalogSchema.parse(pricing_default);
+var PLAN_IDS = PRICING.plans.map((p) => p.id);
+var DEFAULT_PLAN_TIER = "free";
+var COPY = {
+  en: en_default2,
+  ar: ar_default2,
+  de: de_default2,
+  es: es_default2,
+  fr: fr_default2,
+  ja: ja_default2,
+  pt: pt_default2,
+  tr: tr_default2,
+  zh: zh_default
+};
+var NUMBER_LOCALE = { ar: "ar-u-nu-latn" };
+function formatCount(value, locale) {
+  return new Intl.NumberFormat(NUMBER_LOCALE[locale] ?? locale).format(value);
+}
+function formatDecimal(value, locale) {
+  return new Intl.NumberFormat(NUMBER_LOCALE[locale] ?? locale, {
+    maximumFractionDigits: Number.isInteger(value) ? 0 : 2
+  }).format(value);
+}
+function fill(template, values) {
+  return template.replace(
+    /\{(\w+)\}/g,
+    (match, key) => Object.prototype.hasOwnProperty.call(values, key) ? values[key] : match
+  );
+}
+function copyFor(locale) {
+  return COPY[locale] ?? COPY.en;
+}
+function uiString(locale, key) {
+  return copyFor(locale).ui?.[key] ?? en_default2.ui[key];
+}
+function planName(planId, locale) {
+  return copyFor(locale).plans?.[planId]?.name ?? en_default2.plans[planId]?.name ?? planId;
+}
+function planTagline(planId, locale) {
+  return copyFor(locale).plans?.[planId]?.tagline ?? en_default2.plans[planId]?.tagline ?? "";
+}
+function featureTemplate(key, locale) {
+  return copyFor(locale).features?.[key] ?? en_default2.features[key] ?? null;
+}
+var PLAN_BY_ID = new Map(PRICING.plans.map((p) => [p.id, p]));
+function toOblienLimits(limits) {
+  const { runningServices, maxResourceTier } = limits;
+  if (runningServices === null && maxResourceTier === null) return null;
+  const build = PRICING.oblien.buildResources;
+  const svc = maxResourceTier ? RESOURCE_TIER_SPECS[maxResourceTier] : null;
+  return {
+    max_workspaces: runningServices === null ? UNCAPPED_WORKSPACES : runningServices + PRICING.oblien.buildWorkspaceHeadroom,
+    max_vcpus: Math.ceil(Math.max(svc?.cpuCores ?? 0, build.cpuCores)),
+    max_ram_mb: Math.max(svc?.memoryMb ?? 0, build.memoryMb),
+    max_disk_gb: Math.max(svc ? Math.ceil(svc.diskMb / 1024) : 0, build.diskGb)
+  };
+}
+var UNCAPPED_WORKSPACES = 1e4;
+function placeholders(plan, locale) {
+  const unlimited = uiString(locale, "unlimited");
+  const n = (v) => v === null ? unlimited : formatCount(v, locale);
+  const { limits } = plan;
+  const svc = limits.maxResourceTier ? RESOURCE_TIER_SPECS[limits.maxResourceTier] : null;
+  return {
+    buildMinutes: n(limits.buildMinutesPerMonth),
+    freeSubdomains: n(limits.freeSubdomains),
+    customDomains: n(limits.customDomains),
+    seats: n(limits.seats),
+    runningServices: n(limits.runningServices),
+    maxProjects: n(limits.maxProjects),
+    // Per-SERVICE machine size, not a pool — the copy must say so.
+    powerCpu: svc ? formatDecimal(svc.cpuCores, locale) : unlimited,
+    powerRamGb: svc ? formatDecimal(svc.memoryMb / 1024, locale) : unlimited,
+    powerDiskGb: svc ? formatCount(Math.round(svc.diskMb / 1024), locale) : unlimited,
+    credits: plan.credits.monthlyMilli === null ? unlimited : formatCount(plan.credits.monthlyMilli / 1e3, locale),
+    inherited: plan.inherits ? planName(plan.inherits, locale) : "",
+    freeDomainSuffix: PRICING.freeDomainSuffix
+  };
+}
+function resolvePlan(planId, locale = "en") {
+  const plan = PLAN_BY_ID.get(planId) ?? PLAN_BY_ID.get(DEFAULT_PLAN_TIER);
+  const values = placeholders(plan, locale);
+  return {
+    id: plan.id,
+    name: planName(plan.id, locale),
+    description: planTagline(plan.id, locale),
+    price: plan.price,
+    monthlyCredits: plan.credits.monthlyMilli,
+    oblienLimits: toOblienLimits(plan.limits),
+    limits: plan.limits,
+    features: plan.features.map((key) => {
+      const template = featureTemplate(key, locale);
+      return template === null ? null : fill(template, values);
+    }).filter((s) => s !== null),
+    popular: plan.popular,
+    support: plan.support,
+    ...plan.contactSales ? { contactSales: plan.contactSales } : {}
+  };
+}
+var PLANS = Object.fromEntries(
+  PLAN_IDS.map((id) => [id, resolvePlan(id, "en")])
+);
+function resolveCreditPacks(locale = "en") {
+  return [...PRICING.creditPacks].sort((a, b) => a.sortOrder - b.sortOrder).map((pack) => {
+    const template = copyFor(locale).creditPacks?.[pack.id] ?? en_default2.creditPacks[pack.id] ?? "{credits}";
+    return {
+      id: pack.id,
+      name: fill(template, { credits: formatCount(pack.creditsMilli / 1e3, locale) }),
+      credits_milli: pack.creditsMilli,
+      price_cents: pack.priceCents,
+      sortOrder: pack.sortOrder
+    };
+  });
+}
+var CREDIT_PACKS = resolveCreditPacks("en");
+var ANNUAL_ENABLED = PRICING.annual.enabled;
+var ANNUAL_MONTHS_FREE = PRICING.annual.monthsFree;
+var FREE_DOMAIN_SUFFIX = PRICING.freeDomainSuffix;
+
 // ../../packages/core/src/updates/types.ts
 var GITHUB_REPO = "oblien/openship";
 var RELEASES_LATEST_API = `https://api.github.com/repos/${GITHUB_REPO}/releases/latest`;
@@ -21647,6 +24373,11 @@ var AUDIT_CATEGORIES = [
     label: "Members & access",
     description: "Who is in this organization and what they are allowed to do."
   },
+  {
+    id: "agent",
+    label: "AI agents",
+    description: "What connected assistants did over MCP \u2014 every tool call, and the scope they hold."
+  },
   {
     id: "security",
     label: "Security",
@@ -21881,6 +24612,38 @@ var AUDIT_EVENTS = {
     tone: "danger",
     description: "Automatic renewal failed \u2014 the certificate will expire unless this is fixed."
   },
+  // Third-party credentials (the generic store: registry logins, DNS tokens, …).
+  // Category `system`: these are instance-wide settings, not a domain operation — unlike
+  // the dns_credential pair below, which stays under `domains` because that is where the
+  // operator was standing when they connected it.
+  "credential.created": {
+    category: "system",
+    action: "added a credential for",
+    label: "Credential added",
+    tone: "info",
+    description: "A credential for a third-party service (a registry login, a DNS token) was stored. The secret itself is never recorded."
+  },
+  "credential.updated": {
+    category: "system",
+    action: "updated the credential for",
+    label: "Credential updated",
+    tone: "info",
+    description: "A stored credential's label, scope or secret was changed. Neither the old nor the new secret is recorded."
+  },
+  "credential.deleted": {
+    category: "system",
+    action: "deleted the credential for",
+    label: "Credential deleted",
+    tone: "warning",
+    description: "A stored credential was removed. Anything relying on it \u2014 a private image pull, a DNS record write \u2014 stops working until another is added."
+  },
+  "credential.verified": {
+    category: "system",
+    action: "verified the credential for",
+    label: "Credential verified",
+    tone: "info",
+    description: "Openship asked the provider whether a stored credential still works."
+  },
   "dns_credential.connected": {
     category: "domains",
     action: "connected the DNS provider",
@@ -21976,6 +24739,16 @@ var AUDIT_EVENTS = {
     label: "Mail server admin action",
     tone: "warning"
   },
+  // Catalogued because the taxonomy scan is deliberately over-inclusive: it greps
+  // apps/api/src for `eventType:` literals, so a notification-only emit that never
+  // writes an audit_event row is caught the same as an audit write. Without this the
+  // suite fails; with it, an operator who DOES surface these sees a real label.
+  "mail.inbound_received": {
+    category: "servers",
+    action: "received mail matching a notification rule on",
+    label: "Mail arrived at a watched address",
+    tone: "info"
+  },
   /* ---------------- Members & access ---------------- */
   "organization.created": {
     category: "members",
@@ -22098,19 +24871,32 @@ var AUDIT_EVENTS = {
     description: "An existing grant was overwritten with a different scope."
   },
   "mcp.authorized": {
-    category: "members",
+    category: "agent",
     action: "authorized the MCP client",
     label: "MCP client authorized",
     tone: "info",
     description: "An AI agent was connected and given a scope to act within."
   },
   "mcp.scope_changed": {
-    category: "members",
+    category: "agent",
     action: "changed the access of the MCP client",
     label: "MCP access changed",
     tone: "warning",
     description: "A connected agent's scope was edited. It takes effect on the agent's next request \u2014 no reconnect."
   },
+  "mcp.disconnected": {
+    category: "agent",
+    action: "disconnected the MCP client",
+    label: "MCP client disconnected",
+    tone: "warning",
+    description: "A connected agent's tokens, consent and scope were torn down. It stops working immediately and must re-consent to return."
+  },
+  "mcp.tool_called": {
+    category: "agent",
+    action: "ran the MCP tool",
+    label: "Agent tool call",
+    description: "A tool call that left no other trace: a read, or an attempt that was refused or errored. A tool call that successfully changed something is recorded as the change itself, so it is not duplicated here."
+  },
   "grant.materialized": {
     category: "members",
     action: "received their pending permissions,",
@@ -22778,6 +25564,8 @@ export {
   shellQuote,
   shellSplitWords,
   commandToArgv,
+  registryForImage,
+  registryConfigKeys,
   buildEdgeImageRef,
   buildMailImageRef,
   SYSTEM,
@@ -22799,6 +25587,7 @@ export {
   parseOpenshipConfigJson,
   missingOutputDirectoryMessage,
   compareSemver,
+  PRICING,
   resolveCliUpdatePlan,
   cliInstallCommand,
   PROXY_DIRECTIVES,
@@ -22823,6 +25612,11 @@ export {
   HOST_CHANNEL_RECHECK,
   HOST_CHANNEL_NOT_PROVISIONED,
   HOST_CHANNEL_UNPROVISIONED,
+  HOST_CHANNEL_DEFAULT_ACCOUNT,
+  hostChannelAccount,
+  HOST_CHANNEL_AUTH_REJECTED,
+  HOST_CHANNEL_AUTH_REJECTED_SHORT,
+  HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
   HOST_CHANNEL_OPT_OUT,
   explainHostChannelCause,
   summarizeHostChannelCause,