openship 0.6.7 → 0.6.8

package/dist/{chunk-2VSW6Q6C.js → chunk-WEZFTL4V.js}

@@ -1017,6 +1017,65 @@ function ownsNetworkEndpoint(resolvedNetworkMode) {
   return !resolvedNetworkMode;
 }
 
+// ../../packages/core/src/utils.ts
+var REDIRECT_STATUSES = [301, 302, 307, 308];
+var DEFAULT_REDIRECT_STATUS = 301;
+function resolveRedirectStatus(status) {
+  return REDIRECT_STATUSES.includes(status) ? status : DEFAULT_REDIRECT_STATUS;
+}
+function isValidEmail(value) {
+  const email3 = value?.trim() ?? "";
+  if (!email3 || email3.length > 254) return false;
+  return /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/.test(email3);
+}
+function formatBytes(bytes, decimals = 2) {
+  if (bytes <= 0) return "0 B";
+  const k = 1024;
+  const sizes = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
+  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(decimals))} ${sizes[i]}`;
+}
+function withTimeout(promise2, ms, message) {
+  if (!ms) return promise2;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    promise2.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e) => {
+        clearTimeout(timer);
+        reject(e);
+      }
+    );
+  });
+}
+function isValidEnvKey(key) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+}
+function wrapText(text, width = 88) {
+  const out = [];
+  for (const paragraph of text.split("\n")) {
+    const words = paragraph.split(/\s+/).filter(Boolean);
+    if (words.length === 0) {
+      out.push("");
+      continue;
+    }
+    let line = "";
+    for (const word of words) {
+      if (line && line.length + 1 + word.length > width) {
+        out.push(line);
+        line = word;
+      } else {
+        line = line ? `${line} ${word}` : word;
+      }
+    }
+    if (line) out.push(line);
+  }
+  return out;
+}
+
 // ../../packages/core/src/constants.ts
 var DEFAULT_IMAGE_REGISTRY = "ghcr.io/oblien";
 
@@ -1199,62 +1258,6 @@ var SYSTEM = {
   }
 };
 
-// ../../packages/core/src/utils.ts
-var REDIRECT_STATUSES = [301, 302, 307, 308];
-var DEFAULT_REDIRECT_STATUS = 301;
-function resolveRedirectStatus(status) {
-  return REDIRECT_STATUSES.includes(status) ? status : DEFAULT_REDIRECT_STATUS;
-}
-function isValidEmail(value) {
-  const email3 = value?.trim() ?? "";
-  if (!email3 || email3.length > 254) return false;
-  return /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/.test(email3);
-}
-function formatBytes(bytes, decimals = 2) {
-  if (bytes <= 0) return "0 B";
-  const k = 1024;
-  const sizes = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.min(Math.max(Math.floor(Math.log(bytes) / Math.log(k)), 0), sizes.length - 1);
-  return `${parseFloat((bytes / Math.pow(k, i)).toFixed(decimals))} ${sizes[i]}`;
-}
-function withTimeout(promise2, ms, message) {
-  if (!ms) return promise2;
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    promise2.then(
-      (v) => {
-        clearTimeout(timer);
-        resolve(v);
-      },
-      (e) => {
-        clearTimeout(timer);
-        reject(e);
-      }
-    );
-  });
-}
-function wrapText(text, width = 88) {
-  const out = [];
-  for (const paragraph of text.split("\n")) {
-    const words = paragraph.split(/\s+/).filter(Boolean);
-    if (words.length === 0) {
-      out.push("");
-      continue;
-    }
-    let line = "";
-    for (const word of words) {
-      if (line && line.length + 1 + word.length > width) {
-        out.push(line);
-        line = word;
-      } else {
-        line = line ? `${line} ${word}` : word;
-      }
-    }
-    if (line) out.push(line);
-  }
-  return out;
-}
-
 // ../../packages/core/src/errors.ts
 var AppError = class extends Error {
   constructor(message, statusCode = 500, code) {
@@ -2548,6 +2551,104 @@ function hostFirewallRuleRemoval(firewall, cidrs, port) {
 
 // ../../packages/core/src/compose-spec.ts
 var asIs = (s) => s;
+var REMOTE_BUILD_CONTEXT_RE = /^(?:[A-Za-z][A-Za-z0-9+.-]*:\/\/|[^@\s]+@[^:\s]+:)/;
+var ABSOLUTE_BUILD_CONTEXT_RE = /^(?:[\\/]|~(?:[\\/]|$)|[A-Za-z]:[\\/]|\\\\)/;
+function composeOptionRequestsSomething(value) {
+  if (value === void 0 || value === null || value === false || value === "" || value === 0) {
+    return false;
+  }
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "object") return Object.keys(value).length > 0;
+  return true;
+}
+function composeBuildIssues(build, options = {}) {
+  if (build === void 0 || build === null) return [];
+  const issues = [];
+  const block = (field, reason) => issues.push({ field, reason, blocking: true });
+  const validateContext = (context) => {
+    const resolved = (options.interpolate?.(context) ?? context).trim();
+    if (!resolved) {
+      block("build.context", "build.context must not be empty.");
+    } else if (REMOTE_BUILD_CONTEXT_RE.test(resolved)) {
+      block(
+        "build.context",
+        "build.context uses a remote URL, which Openship cannot build as a repository-relative context."
+      );
+    } else if (!options.allowAbsoluteContext && ABSOLUTE_BUILD_CONTEXT_RE.test(resolved)) {
+      block(
+        "build.context",
+        "build.context is absolute or home-relative; Openship requires a path inside the linked repository."
+      );
+    }
+  };
+  if (typeof build === "string") {
+    validateContext(build);
+    return issues;
+  }
+  if (typeof build !== "object" || Array.isArray(build)) {
+    block("build", "build must be a context string or an object.");
+    return issues;
+  }
+  const value = build;
+  if (value.context !== void 0) {
+    if (typeof value.context !== "string") {
+      block("build.context", "build.context must be a string.");
+    } else {
+      validateContext(value.context);
+    }
+  }
+  if (value.dockerfile !== void 0) {
+    if (typeof value.dockerfile !== "string") {
+      block("build.dockerfile", "build.dockerfile must be a string.");
+    } else {
+      const dockerfile = (options.interpolate?.(value.dockerfile) ?? value.dockerfile).trim();
+      if (!dockerfile) {
+        block("build.dockerfile", "build.dockerfile must not be empty.");
+      } else if (REMOTE_BUILD_CONTEXT_RE.test(dockerfile) || ABSOLUTE_BUILD_CONTEXT_RE.test(dockerfile) || dockerfile.split(/[\\/]/).includes("..")) {
+        block("build.dockerfile", "build.dockerfile must be a path inside its build context.");
+      }
+    }
+  }
+  const args = value.args;
+  if (args !== void 0) {
+    if (Array.isArray(args)) {
+      args.forEach((entry, index) => {
+        if (typeof entry !== "string") {
+          block(`build.args[${index}]`, "build.args list entries must be strings.");
+          return;
+        }
+        const resolvedEntry = options.interpolate?.(entry) ?? entry;
+        const equals = resolvedEntry.indexOf("=");
+        const key = (equals >= 0 ? resolvedEntry.slice(0, equals) : resolvedEntry).trim();
+        if (!isValidEnvKey(key)) {
+          block(`build.args[${index}]`, "build.args contains an invalid argument name.");
+        }
+      });
+    } else if (args && typeof args === "object") {
+      for (const [key, argValue] of Object.entries(args)) {
+        if (!isValidEnvKey(key)) {
+          block("build.args", "build.args contains an invalid argument name.");
+        }
+        if (argValue !== null && argValue !== void 0 && !["string", "number", "boolean"].includes(typeof argValue)) {
+          block(`build.args.${key}`, "build.args values must be scalar or null.");
+        }
+      }
+    } else {
+      block("build.args", "build.args must be a list of strings or a scalar/null map.");
+    }
+  }
+  const modeled = /* @__PURE__ */ new Set(["context", "dockerfile", "args"]);
+  for (const [key, optionValue] of Object.entries(value)) {
+    if (modeled.has(key) || /^x-/i.test(key) || !composeOptionRequestsSomething(optionValue)) {
+      continue;
+    }
+    block(
+      `build.${key}`,
+      `build.${key} is not supported; ignoring it could change the produced image or omit requested build behavior.`
+    );
+  }
+  return issues;
+}
 function composeMountToSpec(mount, interpolate = asIs) {
   const source = mount.source ?? mount.name;
   const target = mount.target;
@@ -6102,6 +6203,7 @@ COMMIT;
     {
       available: true,
       verified: true,
+      minEngine: "0.6.6",
       id: "minio",
       name: "MinIO",
       description: "S3-compatible object storage with a web console \u2014 point any S3 client (aws-cli, SDKs) at it, or bind a bucket straight into another project's uploads.",
@@ -6596,6 +6698,7 @@ COMMIT;
     {
       available: true,
       verified: false,
+      minEngine: "0.6.6",
       minResources: {
         memoryMb: 4096,
         cpuCores: 2
@@ -6777,6 +6880,7 @@ Two things worth knowing, both upstream behaviour: if the console shows a branch
     {
       available: true,
       verified: false,
+      minEngine: "0.6.6",
       minResources: {
         memoryMb: 16384,
         cpuCores: 4
@@ -7599,6 +7703,7 @@ Two things worth knowing, both upstream behaviour: if the console shows a branch
     {
       available: true,
       verified: false,
+      minEngine: "0.6.6",
       id: "redis",
       name: "Valkey (Redis)",
       description: "In-memory data store for caching, sessions, rate limits, and queues \u2014 Valkey, the open-source Redis fork. Drop-in Redis-compatible: point any redis client at it. Ships with RedisInsight, a browser UI that arrives already connected to this instance.",
@@ -8077,6 +8182,7 @@ Two things worth knowing, both upstream behaviour: if the console shows a branch
     {
       available: true,
       verified: false,
+      minEngine: "0.6.6",
       id: "clickhouse",
       name: "ClickHouse",
       description: "The columnar SQL database for analytics \u2014 billions of rows scanned per second. Ships with the CH-UI console, so you get a SQL editor, schema browser and dashboards the moment it installs: sign in with the ClickHouse user and password below, no extra setup.",
@@ -8343,6 +8449,178 @@ Two things worth knowing, both upstream behaviour: if the console shows a branch
           ]
         }
       ]
+    },
+    {
+      available: true,
+      verified: true,
+      id: "mindwire",
+      name: "MindWire",
+      description: "Run coding-agent runtimes behind a self-hosted control plane. MindWire keeps the runtime private and gives you one console to manage agents, credentials, and sessions.",
+      repository: "https://github.com/oblien/mindwire",
+      kind: "template",
+      logo: "mindwire",
+      category: "automation",
+      tags: [
+        "ai",
+        "agents",
+        "coding",
+        "control-plane"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "runtime",
+          image: "ghcr.io/oblien/mindwire-runtime:0.1.3",
+          environment: {
+            ADDR: "0.0.0.0:8790",
+            AGENT_TYPE: "claude-code",
+            DAEMON_TOKEN: "{{config:MINDWIRE_RUNTIME_TOKEN}}"
+          },
+          secretEnv: [
+            "DAEMON_TOKEN"
+          ],
+          volumes: [
+            "mindwire_runtime:/home/node"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "console",
+          image: "ghcr.io/oblien/mindwire-console:0.1.3",
+          exposedPort: 8787,
+          exposed: true,
+          routes: [
+            {
+              port: 8787
+            }
+          ],
+          dependsOn: [
+            "runtime"
+          ],
+          environment: {
+            NODE_ENV: "production",
+            PORT: "8787",
+            BASE_URL: "{{publicUrl:console}}",
+            AUTH_DB_PATH: "/data/auth.db",
+            CONSOLE_MODE: "self-hosted",
+            CONSOLE_USERNAME: "{{config:CONSOLE_USERNAME}}",
+            CONSOLE_PASSWORD: "{{config:CONSOLE_PASSWORD}}",
+            AUTH_SECRET: "{{config:AUTH_SECRET}}",
+            SECRETS_ENCRYPTION_KEY: "{{config:SECRETS_ENCRYPTION_KEY}}",
+            ALLOW_LOCAL_RUNTIME: "true",
+            ALLOW_SSH_RUNTIME: "true",
+            ALLOW_DOCKER_RUNTIME: "true",
+            ALLOW_REMOTE_RUNTIME: "true",
+            DAEMON_URL: "http://runtime:8790",
+            MINDWIRE_RUNTIME_TOKEN: "{{config:MINDWIRE_RUNTIME_TOKEN}}",
+            SEED_DEFAULT_DAEMON: "true"
+          },
+          secretEnv: [
+            "CONSOLE_PASSWORD",
+            "AUTH_SECRET",
+            "SECRETS_ENCRYPTION_KEY",
+            "MINDWIRE_RUNTIME_TOKEN"
+          ],
+          volumes: [
+            "mindwire_console:/data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              `node -e "fetch('http://127.0.0.1:8787/api/ping').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"`
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 12,
+            startPeriod: "20s"
+          },
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "CONSOLE_USERNAME",
+          service: "console",
+          label: "Console username",
+          help: "The single owner account for this self-hosted console.",
+          default: "admin",
+          required: true
+        },
+        {
+          key: "CONSOLE_PASSWORD",
+          service: "console",
+          label: "Console password",
+          help: "Auto-generated. Use this with the owner username to sign in.",
+          type: "password",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "AUTH_SECRET",
+          service: "console",
+          label: "Session signing secret",
+          help: "Auto-generated. Keep it stable so existing sign-in sessions remain valid after upgrades.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "SECRETS_ENCRYPTION_KEY",
+          service: "console",
+          label: "Credential vault key",
+          help: "Auto-generated 32-byte key used to encrypt provider and runtime credentials at rest.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "MINDWIRE_RUNTIME_TOKEN",
+          service: "runtime",
+          label: "Runtime bearer token",
+          help: "Auto-generated. Authenticates the Console to the private MindWire runtime.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Sign in to MindWire",
+        description: "Open the Console and sign in with the generated owner credentials. The runtime stays private to this deployment.",
+        guide: {
+          intro: "MindWire gives you a production control plane for coding-agent runtimes without exposing the runtime API to the public internet.",
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "console",
+            label: "MindWire Console",
+            source: "publicUrl:console",
+            kind: "url",
+            recommended: true,
+            help: "Open the control plane in your browser."
+          },
+          {
+            id: "username",
+            label: "Owner username",
+            source: "env:console:CONSOLE_USERNAME"
+          },
+          {
+            id: "password",
+            label: "Owner password",
+            source: "env:console:CONSOLE_PASSWORD",
+            secret: true
+          }
+        ]
+      },
+      endpoints: [
+        {
+          service: "console",
+          port: 8787,
+          label: "MindWire Console",
+          kind: "http",
+          defaultMode: "domain"
+        }
+      ]
     }
   ]
 };
@@ -24641,6 +24919,240 @@ var ANNUAL_ENABLED = PRICING.annual.enabled;
 var ANNUAL_MONTHS_FREE = PRICING.annual.monthsFree;
 var FREE_DOMAIN_SUFFIX = PRICING.freeDomainSuffix;
 
+// ../../packages/core/src/project-source.ts
+var MAX_IMAGE_NAME_LENGTH = 255;
+var MAX_IMAGE_TAG_LENGTH = 128;
+var IMAGE_PATH_COMPONENT_RE = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*$/;
+var IMAGE_TAG_RE = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+var IMAGE_DIGEST_RE = /^([A-Za-z][A-Za-z0-9]*(?:[+._-][A-Za-z][A-Za-z0-9]*)*):([A-Za-z0-9=_-]+)$/;
+var IMAGE_DOMAIN_LABEL_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
+function validateImageReference(ref) {
+  if (typeof ref !== "string") return "Container image reference must be a string.";
+  if (!ref) return "Container image reference cannot be empty.";
+  if (ref !== ref.trim()) return "Container image reference cannot have surrounding whitespace.";
+  if (/\s/.test(ref))
+    return `Container image reference ${JSON.stringify(ref)} cannot contain whitespace.`;
+  if (ref.includes("\0"))
+    return `Container image reference ${JSON.stringify(ref)} contains a NUL byte.`;
+  if (ref.includes("://")) {
+    return `Container image reference ${JSON.stringify(ref)} must not include a URL scheme.`;
+  }
+  const at = ref.indexOf("@");
+  if (at !== -1 && at !== ref.lastIndexOf("@")) {
+    return `Container image reference ${JSON.stringify(ref)} contains more than one digest separator (@).`;
+  }
+  const nameAndTag = at === -1 ? ref : ref.slice(0, at);
+  const digest = at === -1 ? null : ref.slice(at + 1);
+  if (!nameAndTag)
+    return `Container image reference ${JSON.stringify(ref)} is missing a repository name.`;
+  if (digest !== null) {
+    const parsed = IMAGE_DIGEST_RE.exec(digest);
+    if (!parsed) {
+      return `Container image reference ${JSON.stringify(ref)} has an invalid OCI digest.`;
+    }
+    if (parsed[1].toLowerCase() === "sha256" && !/^[a-fA-F0-9]{64}$/.test(parsed[2])) {
+      return `Container image reference ${JSON.stringify(ref)} has an invalid sha256 digest (expected 64 hexadecimal characters).`;
+    }
+  }
+  const lastSlash = nameAndTag.lastIndexOf("/");
+  const lastColon = nameAndTag.lastIndexOf(":");
+  const hasTag = lastColon > lastSlash;
+  const name = hasTag ? nameAndTag.slice(0, lastColon) : nameAndTag;
+  const tag = hasTag ? nameAndTag.slice(lastColon + 1) : null;
+  if (!name)
+    return `Container image reference ${JSON.stringify(ref)} is missing a repository name.`;
+  if (name.length > MAX_IMAGE_NAME_LENGTH) {
+    return `Container image repository name is too long (${name.length}; maximum ${MAX_IMAGE_NAME_LENGTH}).`;
+  }
+  if (tag !== null) {
+    if (!tag) return `Container image reference ${JSON.stringify(ref)} has an empty tag.`;
+    if (tag.length > MAX_IMAGE_TAG_LENGTH || !IMAGE_TAG_RE.test(tag)) {
+      return `Container image reference ${JSON.stringify(ref)} has an invalid tag; tags must be 1-${MAX_IMAGE_TAG_LENGTH} ASCII letters, digits, underscores, periods, or hyphens and cannot start with a period or hyphen.`;
+    }
+  }
+  const parts = name.split("/");
+  if (parts.some((part) => !part)) {
+    return `Container image reference ${JSON.stringify(ref)} contains an empty repository path component.`;
+  }
+  const first = parts[0];
+  const hasRegistry = parts.length > 1 && (first.includes(".") || first.includes(":") || first === "localhost" || first.startsWith("["));
+  const path = hasRegistry ? parts.slice(1) : parts;
+  if (path.length === 0 || path.some((part) => !IMAGE_PATH_COMPONENT_RE.test(part))) {
+    return `Container image reference ${JSON.stringify(ref)} has an invalid repository path; repository names must be lowercase OCI path components.`;
+  }
+  if (hasRegistry) {
+    const registryError = validateImageRegistry(first);
+    if (registryError) return `Container image reference ${JSON.stringify(ref)} ${registryError}`;
+  }
+  return null;
+}
+function validateReleaseVersionUrl(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    return "Release version URL cannot be empty.";
+  }
+  if (value !== value.trim()) {
+    return "Release version URL cannot have surrounding whitespace.";
+  }
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return "Release version URL must be a valid HTTPS URL.";
+  }
+  if (url2.protocol !== "https:") {
+    return "Release version URL must use HTTPS.";
+  }
+  if (url2.username || url2.password) {
+    return "Release version URL must not include embedded credentials.";
+  }
+  return null;
+}
+function validateReleaseRepository(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    return 'GitHub release repository must use the "owner/repository" format.';
+  }
+  if (value !== value.trim()) {
+    return "GitHub release repository cannot have surrounding whitespace.";
+  }
+  const parts = value.split("/");
+  if (parts.length !== 2) {
+    return 'GitHub release repository must use the "owner/repository" format.';
+  }
+  const [owner, repository] = parts;
+  const ownerValid = owner.length <= 39 && /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(owner);
+  const repositoryValid = repository.length <= 100 && repository !== "." && repository !== ".." && /^[A-Za-z0-9_.-]+$/.test(repository);
+  if (!ownerValid || !repositoryValid) {
+    return "GitHub release repository contains an invalid owner or repository name.";
+  }
+  return null;
+}
+function isValidBracketedIpv6Host(host) {
+  if (!/^\[[0-9a-fA-F:]+\]$/.test(host)) return false;
+  try {
+    const parsed = new URL(`http://${host}/`);
+    return parsed.hostname.startsWith("[") && parsed.hostname.endsWith("]");
+  } catch {
+    return false;
+  }
+}
+function validateImageRegistry(registry2) {
+  let host = registry2;
+  let port = null;
+  if (registry2.startsWith("[")) {
+    const close = registry2.indexOf("]");
+    if (close <= 1) return "has an invalid bracketed IPv6 registry host.";
+    host = registry2.slice(0, close + 1);
+    const rest = registry2.slice(close + 1);
+    if (rest) {
+      if (!rest.startsWith(":")) return "has invalid characters after its registry host.";
+      port = rest.slice(1);
+    }
+    if (!isValidBracketedIpv6Host(host)) {
+      return "has an invalid bracketed IPv6 registry host.";
+    }
+  } else {
+    const colon = registry2.lastIndexOf(":");
+    if (colon !== -1) {
+      host = registry2.slice(0, colon);
+      port = registry2.slice(colon + 1);
+    }
+    if (!host) return "is missing its registry host.";
+    const labels = host.split(".");
+    if (labels.some((label) => !IMAGE_DOMAIN_LABEL_RE.test(label))) {
+      return "has an invalid registry hostname.";
+    }
+  }
+  if (port !== null) {
+    if (!/^\d+$/.test(port)) return "has a non-numeric registry port.";
+    const value = Number(port);
+    if (value < 1 || value > 65535) return "has a registry port outside 1-65535.";
+  }
+  return null;
+}
+var RELEASE_IMAGE_PLACEHOLDERS = ["version", "tag"];
+function renderReleaseImage(template, opts) {
+  if (typeof template !== "string" || !template.trim()) {
+    throw new Error("Release image template cannot be empty.");
+  }
+  if (template !== template.trim()) {
+    throw new Error("Release image template cannot have surrounding whitespace.");
+  }
+  let insidePlaceholder = false;
+  for (const char of template) {
+    if (char === "{") {
+      if (insidePlaceholder) {
+        throw new Error(
+          `Release image template ${JSON.stringify(template)} contains malformed placeholder braces.`
+        );
+      }
+      insidePlaceholder = true;
+    } else if (char === "}") {
+      if (!insidePlaceholder) {
+        throw new Error(
+          `Release image template ${JSON.stringify(template)} contains malformed placeholder braces.`
+        );
+      }
+      insidePlaceholder = false;
+    }
+  }
+  if (insidePlaceholder) {
+    throw new Error(
+      `Release image template ${JSON.stringify(template)} contains malformed placeholder braces.`
+    );
+  }
+  const placeholders2 = template.match(/\{[^{}]*\}/g) ?? [];
+  const unknown2 = placeholders2.filter(
+    (placeholder) => !RELEASE_IMAGE_PLACEHOLDERS.includes(placeholder.slice(1, -1))
+  );
+  if (unknown2.length > 0) {
+    throw new Error(
+      `Release image template ${JSON.stringify(template)} uses unknown placeholder(s) ${unknown2.join(", ")}. Supported: ${RELEASE_IMAGE_PLACEHOLDERS.map((p) => `{${p}}`).join(" ")}.`
+    );
+  }
+  if (!template.includes("{version}") && !template.includes("{tag}")) {
+    throw new Error(
+      `Release image template ${JSON.stringify(template)} must contain {version} or {tag}.`
+    );
+  }
+  if (template.includes("@")) {
+    throw new Error(
+      `Release image template ${JSON.stringify(template)} must use a tag, not a digest.`
+    );
+  }
+  const lastSlash = template.lastIndexOf("/");
+  const tagColon = template.lastIndexOf(":");
+  if (tagColon <= lastSlash) {
+    throw new Error(
+      `Release image template ${JSON.stringify(template)} must put {version} or {tag} in an explicit image tag.`
+    );
+  }
+  const tagStart = tagColon + 1;
+  for (const placeholder of ["{version}", "{tag}"]) {
+    let at = template.indexOf(placeholder);
+    while (at !== -1) {
+      if (at < tagStart) {
+        throw new Error(
+          `Release image template ${JSON.stringify(template)} may use ${placeholder} only in the image tag.`
+        );
+      }
+      at = template.indexOf(placeholder, at + placeholder.length);
+    }
+  }
+  const rawVersion = opts.version?.trim();
+  const rawTag = opts.tag?.trim();
+  if (!rawVersion) throw new Error("Release image version cannot be empty.");
+  if (!rawTag) throw new Error("Release image tag cannot be empty.");
+  const version2 = rawVersion.replace(/^v/i, "");
+  if (!version2) throw new Error("Release image version cannot contain only a leading v.");
+  const rendered = template.replace(
+    /\{(?:version|tag)\}/g,
+    (placeholder) => placeholder === "{version}" ? version2 : rawTag
+  );
+  const invalid = validateImageReference(rendered);
+  if (invalid) throw new Error(invalid);
+  return rendered;
+}
+
 // ../../packages/core/src/updates/types.ts
 var GITHUB_REPO = "oblien/openship";
 var RELEASES_LATEST_API = `https://api.github.com/repos/${GITHUB_REPO}/releases/latest`;
@@ -24772,6 +25284,13 @@ var AUDIT_EVENTS = {
     tone: "warning",
     description: "A delete was refused \u2014 something still depends on this app."
   },
+  "project.deletion.failed": {
+    category: "apps",
+    action: "failed to delete",
+    label: "App deletion failed",
+    tone: "warning",
+    description: "Cleanup did not complete, so the app record was kept for a safe retry."
+  },
   "project:write": {
     category: "apps",
     action: "changed",
@@ -25259,6 +25778,20 @@ var AUDIT_EVENTS = {
     tone: "warning",
     description: "A full database dump left this instance."
   },
+  "instance.data.receive_code_created": {
+    category: "security",
+    action: "created a direct data-transfer receive code",
+    label: "Data-transfer receive code created",
+    tone: "warning",
+    description: "A short-lived code was created to receive instance data directly."
+  },
+  "instance.data.sent": {
+    category: "security",
+    action: "sent instance data to another instance",
+    label: "Instance data sent",
+    tone: "warning",
+    description: "Selected instance data was transferred directly to another instance."
+  },
   "instance.data.imported": {
     category: "security",
     action: "imported instance data",
@@ -25767,6 +26300,60 @@ function idSuffix(distroId) {
   return distroId ? ` (os-release ID=${JSON.stringify(distroId)})` : "";
 }
 
+// ../../packages/core/src/network.ts
+function ipv4Octets(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => /^(?:0|[1-9]\d{0,2})$/.test(part) ? Number(part) : NaN);
+  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+    return null;
+  }
+  return octets;
+}
+function ipv6Words(host) {
+  let value = host;
+  const zone = value.indexOf("%");
+  if (zone >= 0) value = value.slice(0, zone);
+  const dottedTail = /(?:^|:)(\d+\.\d+\.\d+\.\d+)$/.exec(value)?.[1];
+  if (dottedTail) {
+    const octets = ipv4Octets(dottedTail);
+    if (!octets) return null;
+    const replacement = `${(octets[0] << 8 | octets[1]).toString(16)}:${(octets[2] << 8 | octets[3]).toString(16)}`;
+    value = value.slice(0, -dottedTail.length) + replacement;
+  }
+  if ((value.match(/::/g) ?? []).length > 1) return null;
+  const [leftRaw, rightRaw] = value.split("::");
+  const left = leftRaw ? leftRaw.split(":") : [];
+  const right = rightRaw ? rightRaw.split(":") : [];
+  if ([...left, ...right].some((word) => !/^[0-9a-f]{1,4}$/i.test(word))) return null;
+  const compressed = value.includes("::");
+  const missing = 8 - left.length - right.length;
+  if (!compressed && missing !== 0 || compressed && missing < 1) return null;
+  return [...left, ...Array.from({ length: missing }, () => "0"), ...right].map(
+    (word) => Number.parseInt(word, 16)
+  );
+}
+function isLoopbackHost(host) {
+  if (!host) return false;
+  let value = host.trim().toLowerCase();
+  if (value.startsWith("[") && value.endsWith("]")) value = value.slice(1, -1);
+  value = value.replace(/\.+$/, "");
+  if (!value) return false;
+  if (value === "localhost" || value.endsWith(".localhost") || value === "localhost.localdomain" || value === "ip6-localhost" || value === "ip6-loopback") {
+    return true;
+  }
+  const ipv43 = ipv4Octets(value);
+  if (ipv43) return ipv43[0] === 127 || ipv43.every((octet) => octet === 0);
+  const words = ipv6Words(value);
+  if (!words) return false;
+  if (words.every((word) => word === 0)) return true;
+  if (words.slice(0, 7).every((word) => word === 0) && words[7] === 1) return true;
+  const ipv4PrefixIsLocal = words[6] >> 8 === 127;
+  const mapped = words.slice(0, 5).every((word) => word === 0) && words[5] === 65535;
+  const compatible = words.slice(0, 6).every((word) => word === 0);
+  return ipv4PrefixIsLocal && (mapped || compatible);
+}
+
 export {
   shellQuote,
   shellSplitWords,
@@ -25782,6 +26369,13 @@ export {
   appVolumeTargets,
   parseComposeNamespace,
   ownsNetworkEndpoint,
+  resolveRedirectStatus,
+  isValidEmail,
+  formatBytes,
+  withTimeout,
+  isValidEnvKey,
+  wrapText,
+  composeBuildIssues,
   composeMountToSpec,
   composeMountIssues,
   composePortToSpec,
@@ -25792,11 +26386,6 @@ export {
   buildEdgeImageRef,
   buildMailImageRef,
   SYSTEM,
-  resolveRedirectStatus,
-  isValidEmail,
-  formatBytes,
-  withTimeout,
-  wrapText,
   AppError,
   DeployError,
   safeErrorMessage,
@@ -25816,6 +26405,9 @@ export {
   missingOutputDirectoryMessage,
   compareSemver,
   PRICING,
+  validateReleaseVersionUrl,
+  validateReleaseRepository,
+  renderReleaseImage,
   resolveCliUpdatePlan,
   cliInstallCommand,
   PROXY_DIRECTIVES,
@@ -25850,5 +26442,6 @@ export {
   summarizeHostChannelCause,
   hostChannelRuleScope,
   hostFirewallRule,
-  hostFirewallRuleRemoval
+  hostFirewallRuleRemoval,
+  isLoopbackHost
 };