@stacksjs/ts-cloud 0.2.26 → 0.2.27

package/dist/deploy/site-target.d.ts

@@ -7,7 +7,13 @@ import type { CloudConfig, SiteConfig, SiteDeployTarget } from '@ts-cloud/core';
  *                        site built and shipped to `/var/www/<site>` on the box
  *                        (served by the operator's own proxy, e.g. rpx + tlsx).
  */
-export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static';
+export type SiteDeployKind = 'bucket' | 'server-app' | 'server-static' | 'server-php';
+/**
+ * A PHP/Laravel site: deployed to the compute box via git clone into atomic
+ * release directories and served by nginx + php-fpm. Identified by a PHP
+ * `type` (laravel/php/statamic/wordpress).
+ */
+export declare function isPhpSite(site: SiteConfig): boolean;
 /**
  * Resolve the explicit-or-inferred {@link SiteDeployTarget} for a site.
  *

package/dist/drivers/aws/driver.d.ts

@@ -8,9 +8,30 @@ export declare class AwsDriver implements CloudDriver {
     private region;
     constructor(options?: AwsDriverOptions);
     private resolveRegion;
+    /**
+     * Provision a single Ubuntu EC2 box for the Forge/PHP path — mirroring the
+     * Hetzner driver, bypassing the heavy CloudFormation stack. Boots the shared
+     * Ubuntu bootstrap (or a baked golden AMI), fronted by a security group, and
+     * tagged so deploys (SSM) find it. Idempotent: reuses a running instance.
+     *
+     * NOTE: deploys run over SSM, so the instance needs the SSM agent + an IAM
+     * instance profile granting AmazonSSMManagedInstanceCore. Provide it via
+     * `compute.server.iamInstanceProfile` (live-verified step).
+     */
+    provisionComputeInfrastructure(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
+    /** Terminate the lightweight EC2 box + delete its security group. */
+    destroyCompute(options: ProvisionComputeOptions): Promise<{
+        destroyed: string[];
+    }>;
     getComputeOutputs(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
     uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;
     findComputeTargets(options: FindComputeTargetsOptions): Promise<ComputeTarget[]>;
+    /**
+     * SSM AWS-RunShellScript executes the joined commands with `/bin/sh` (dash on
+     * Ubuntu), which rejects bash-only syntax like `set -o pipefail`. Our deploy
+     * scripts are bash, so run them through a bash heredoc.
+     */
+    private bashWrap;
     runRemoteDeploy(options: RunRemoteDeployOptions): Promise<RemoteDeployResult>;
     private pollSsmCommand;
 }

package/dist/drivers/aws/provision.d.ts

@@ -0,0 +1,41 @@
+/**
+ * AWS EC2 provisioning composition for the Forge/PHP path — the pure, testable
+ * pieces shared by {@link import('./driver').AwsDriver.provisionComputeInfrastructure}.
+ *
+ * Mirrors the Hetzner path: boot a single **Ubuntu** box (same base as Hetzner,
+ * so the apt provisioning + nginx vhosts + php-fpm sockets are identical) with
+ * the shared bootstrap as UserData, fronted by a security group. The live API
+ * orchestration (AMI resolve, VPC/subnet, runInstances, wait) lives in the
+ * driver; this module builds the inputs.
+ */
+import type { CloudConfig } from '@ts-cloud/core';
+/**
+ * SSM public parameter for the latest Canonical Ubuntu 24.04 (Noble) AMI —
+ * region-agnostic, so we never hardcode region-specific AMI ids.
+ */
+export declare const UBUNTU_AMI_SSM_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
+/** A security-group ingress rule. */
+export interface AwsIngressRule {
+    port: number;
+    protocol: 'tcp';
+    cidr: string;
+}
+/**
+ * Ingress rules for a PHP/app box: SSH (deploy fallback), HTTP, HTTPS, and any
+ * extra app ports any site declares. Deploys themselves run over SSM.
+ */
+export declare function awsComputeIngressRules(config: CloudConfig): AwsIngressRule[];
+/**
+ * Build the EC2 UserData (raw bash, not yet base64) from the shared Ubuntu
+ * bootstrap — the exact same recipe Hetzner uses. Honors a baked golden image
+ * (`compute.bakedImage`) by skipping the install-heavy steps.
+ */
+export declare function buildAwsUserData(config: CloudConfig): string;
+/** Base64-encode UserData for the EC2 RunInstances API. */
+export declare function encodeUserData(userData: string): string;
+/**
+ * Resolve the AMI to boot: an explicit `compute.image` (a golden AMI), else the
+ * caller resolves {@link UBUNTU_AMI_SSM_PARAM} via SSM. Returns the explicit id
+ * or `null` to signal "resolve Ubuntu via SSM".
+ */
+export declare function resolveAwsImageId(config: CloudConfig): string | null;

package/dist/drivers/hetzner/client.d.ts

@@ -76,6 +76,44 @@ export interface CreateServerOptions {
     firewalls?: Array<{
         firewall: number;
     }>;
+    /** Private networks to attach the server to (fleet topology). */
+    networks?: number[];
+}
+export interface HetznerNetwork {
+    id: number;
+    name: string;
+    ip_range: string;
+}
+export interface HetznerLoadBalancer {
+    id: number;
+    name: string;
+    public_net?: {
+        ipv4?: {
+            ip?: string;
+        };
+    };
+}
+export interface CreateNetworkOptions {
+    name: string;
+    ipRange?: string;
+    labels?: Record<string, string>;
+}
+export interface CreateLoadBalancerOptions {
+    name: string;
+    /** LB type (e.g. 'lb11'). @default 'lb11' */
+    type?: string;
+    location?: string;
+    networkZone?: string;
+    network?: number;
+    labels?: Record<string, string>;
+    /** Listener services (e.g. 80→80, 443→443). */
+    services: Array<{
+        listenPort: number;
+        destinationPort: number;
+        protocol?: 'tcp' | 'http';
+    }>;
+    /** Target app servers by label selector (e.g. `ts-cloud/role=app`). */
+    labelSelector: string;
 }
 export interface CreateFirewallOptions {
     name: string;
@@ -111,6 +149,12 @@ export declare class HetznerClient {
         server: HetznerServer;
         action: HetznerAction;
     }>;
+    listNetworks(): Promise<HetznerNetwork[]>;
+    createNetwork(options: CreateNetworkOptions): Promise<HetznerNetwork>;
+    deleteNetwork(id: number): Promise<void>;
+    listLoadBalancers(): Promise<HetznerLoadBalancer[]>;
+    createLoadBalancer(options: CreateLoadBalancerOptions): Promise<HetznerLoadBalancer>;
+    deleteLoadBalancer(id: number): Promise<void>;
     deleteServer(id: number): Promise<HetznerAction>;
     listFirewalls(): Promise<HetznerFirewall[]>;
     createFirewall(options: CreateFirewallOptions): Promise<{
@@ -122,6 +166,8 @@ export declare class HetznerClient {
      * firewall's rules in sync with the desired config without recreating it.
      */
     setFirewallRules(firewallId: number, rules: HetznerFirewallRule[]): Promise<HetznerAction[]>;
+    /** Delete a firewall. A firewall still applied to a server cannot be deleted. */
+    deleteFirewall(firewallId: number): Promise<void>;
     applyFirewallToResources(firewallId: number, applyTo: Array<{
         type: 'server';
         server: number;

package/dist/drivers/hetzner/cloud-init.d.ts

@@ -1,23 +1,12 @@
 /**
- * Ubuntu cloud-init bootstrap for Hetzner compute targets.
- * Mirrors Compute.UserData.generateBunAppScript but uses apt instead of dnf
- * and omits AWS CLI (deploys use SCP + SSH).
+ * Hetzner cloud-init: wraps the shared Ubuntu bootstrap as #cloud-config.
+ *
+ * The provisioning recipe itself lives in
+ * {@link import('../shared/ubuntu-bootstrap')} (shared with the AWS path and
+ * the golden-image bake). `generateUbuntuAppCloudInit` is kept as a back-compat
+ * alias for the shared builder.
  */
-export interface UbuntuBootstrapOptions {
-    runtime?: 'bun' | 'node' | 'deno';
-    runtimeVersion?: string;
-    systemPackages?: string[];
-    database?: 'sqlite' | 'mysql' | 'postgres';
-    caddyfile?: string;
-    /**
-     * Shell commands that install + start the rpx reverse-proxy gateway, built by
-     * {@link import('../shared/rpx-gateway').buildRpxProvisionScript}. Appended
-     * after the runtime is installed so `bun add -g @stacksjs/rpx` works. Mutually
-     * exclusive with `caddyfile` (the box runs one gateway).
-     */
-    rpxProvision?: string[];
-}
-export declare function generateUbuntuAppCloudInit(options?: UbuntuBootstrapOptions): string;
+export { buildUbuntuBootstrapScript as generateUbuntuAppCloudInit, type UbuntuBootstrapOptions } from '../shared/ubuntu-bootstrap';
 /**
  * Wrap a bash bootstrap script as Hetzner cloud-init user_data (#cloud-config).
  *

package/dist/drivers/hetzner/driver.d.ts

@@ -41,6 +41,21 @@ export declare class HetznerDriver implements CloudDriver {
     private bootWait;
     constructor(options?: HetznerDriverOptions);
     provisionComputeInfrastructure(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
+    /**
+     * Provision a load-balanced fleet: a private network, a dedicated services
+     * box (DB/cache/search), N app servers (nginx + php-fpm), and a load
+     * balancer fronting the app servers. App servers connect to the services box
+     * over the private network (wired into their `.env` at deploy time).
+     */
+    private provisionFleet;
+    /**
+     * Tear down the compute — single server or full fleet (load balancer, all
+     * app + services servers, firewalls, and the private network) — and clear
+     * local state.
+     */
+    destroyCompute(options: ProvisionComputeOptions): Promise<{
+        destroyed: string[];
+    }>;
     getComputeOutputs(options: ProvisionComputeOptions): Promise<ComputeStackOutputs>;
     uploadRelease(options: UploadReleaseOptions): Promise<UploadReleaseResult>;
     findComputeTargets(options: FindComputeTargetsOptions): Promise<ComputeTarget[]>;
@@ -87,6 +102,15 @@ export declare class HetznerDriver implements CloudDriver {
      */
     private waitForCloudInit;
     private outputsFromState;
+    /**
+     * SSH options for connecting to freshly-created cloud servers. Host-key
+     * pinning is disabled (`StrictHostKeyChecking=no` + `UserKnownHostsFile`
+     * `/dev/null`): the box is identified + trusted via the Hetzner API, and
+     * providers recycle public IPs, so a stale `known_hosts` entry from a prior
+     * (now-deleted) server would otherwise abort the deploy with
+     * "REMOTE HOST IDENTIFICATION HAS CHANGED".
+     */
+    private static readonly SSH_HOST_KEY_OPTS;
     private sshBaseArgs;
     private scpToHost;
     private sshExec;

package/dist/drivers/hetzner/state.d.ts

@@ -1,12 +1,18 @@
 export interface HetznerDriverState {
     provider: 'hetzner';
     stackName: string;
-    serverId: number;
-    serverName: string;
+    /** Absent after teardown (destroyCompute clears it). */
+    serverId?: number;
+    serverName?: string;
     firewallId?: number;
     publicIp?: string;
     deployStoragePath?: string;
     sshUser?: string;
+    /** Fleet: network/LB ids + the services box private IP, for deploy + teardown. */
+    networkId?: number;
+    loadBalancerId?: number;
+    servicesServerId?: number;
+    servicesPrivateIp?: string;
 }
 export declare function driverStatePath(stackName: string): string;
 export declare function readDriverState(stackName: string): Promise<HetznerDriverState | null>;

package/dist/drivers/shared/backups.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Scheduled database backups powered by `ts-backups`, synced to object storage.
+ *
+ * On the box we generate a `ts-backups` config from the ts-cloud database
+ * config, install the tool (Bun + `ts-backups`), and add a cron job that runs
+ * the backup and syncs the output directory to an S3-compatible bucket
+ * (AWS S3 or Hetzner object storage). `ts-backups` handles dump + local
+ * retention; ts-cloud handles the off-box copy.
+ */
+import type { ComputeBackupConfig, DatabaseConfig } from '@ts-cloud/core';
+/** Where backups are written on the box before being synced off. */
+export declare const BACKUP_OUTPUT_DIR = "/var/backups/ts-cloud";
+/** Generated ts-backups config location. */
+export declare const BACKUP_CONFIG_PATH = "/etc/ts-cloud/backups.config.ts";
+/** Cron file + runner paths. */
+export declare const BACKUP_CRON_PATH = "/etc/cron.d/ts-cloud-backups";
+export declare const BACKUP_RUNNER_PATH = "/usr/local/bin/ts-cloud-backup.sh";
+/** Generate the `ts-backups` config file content from the database config. */
+export declare function buildBackupsConfigTs(database: DatabaseConfig | undefined, backups: ComputeBackupConfig): string;
+export interface BackupProvisionOptions {
+    database?: DatabaseConfig;
+    backups: ComputeBackupConfig;
+}
+/**
+ * Build the commands that install + schedule backups. Returns `[]` when
+ * disabled. Assumes the box can install Bun (to run `ts-backups`).
+ */
+export declare function buildBackupProvisionScript(options: BackupProvisionOptions): string[];

package/dist/drivers/shared/certbot.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Let's Encrypt TLS for nginx vhosts via certbot — issuance + automatic
+ * renewal, mirroring Forge's SSL handling.
+ *
+ * `certbot --nginx` reads the site's :80 server block, obtains a certificate
+ * for its `server_name`s, and rewrites the vhost to serve :443 + redirect
+ * :80 → :443. The apt `certbot` package installs a `certbot.timer` that renews
+ * twice daily; we add a deploy-hook so nginx reloads after a renewal.
+ *
+ * For the `custom` provider the vhost is rendered with the operator's cert
+ * directly (see nginx-vhost's `ssl` option), so certbot is not involved.
+ */
+import type { SiteConfig } from '@ts-cloud/core';
+/** Resolve the effective SSL provider for a site (Let's Encrypt by default when it has a domain). */
+export declare function resolveSslProvider(site: SiteConfig): 'letsencrypt' | 'custom' | 'none';
+/** Install certbot + the nginx plugin and ensure the auto-renew timer is enabled. */
+export declare function buildCertbotInstallScript(): string[];
+export interface CertbotIssueOptions {
+    /** Primary domain. */
+    domain: string;
+    /** Additional SANs (site aliases). */
+    aliases?: string[];
+    /** Contact email for registration / expiry notices. */
+    email?: string;
+    /** Redirect HTTP → HTTPS (Forge default). @default true */
+    redirect?: boolean;
+}
+/**
+ * Issue (or expand) a Let's Encrypt cert for the domain via the nginx plugin.
+ * Idempotent: `--keep-until-expiring` reuses a valid cert, so re-running on
+ * every deploy is safe.
+ */
+export declare function buildCertbotIssueScript(options: CertbotIssueOptions): string[];
+/**
+ * Full SSL script for a site, dispatched on its provider. Returns `[]` for
+ * `custom`/`none` (custom certs are baked into the vhost already).
+ */
+export declare function buildSslScript(site: SiteConfig): string[];

package/dist/drivers/shared/compute-deploy.d.ts

@@ -15,7 +15,7 @@ export interface DeployAllSitesOptions {
     environment: EnvironmentType;
     driver: CloudDriver;
     sha: string;
-    runtime: 'bun' | 'node' | 'deno';
+    runtime: 'bun' | 'node' | 'deno' | 'php';
     tarballForSite: (siteName: string) => string;
     logger?: ComputeDeployLogger;
 }

package/dist/drivers/shared/compute-provision.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Compose the full machine-provisioning scripts for a compute box from a
+ * CloudConfig — PHP/nginx/Composer, on-box services + app database, host
+ * firewall, auto-updates, monitoring, SSH keys, notifier, and scheduled
+ * backups.
+ *
+ * Single source of truth shared by:
+ *  - the **driver cold-boot** path (Hetzner cloud-init / AWS UserData), and
+ *  - the **golden-image bake** (which runs the same provisioning then snapshots),
+ * so a baked image and a cold boot install exactly the same stack.
+ */
+import type { CloudConfig } from '@ts-cloud/core';
+export interface ComputeProvisionScripts {
+    /** Effective runtime to install (bun/node/deno/php). */
+    runtime: 'bun' | 'node' | 'deno' | 'php';
+    /** Pinned runtime version (or 'latest'). */
+    runtimeVersion: string;
+    /** Whether this box runs PHP (drives UFW/auto-updates/monitoring defaults). */
+    phpBox: boolean;
+    /** nginx + php-fpm + Composer install commands (undefined for non-PHP boxes). */
+    phpProvision?: string[];
+    /** services + db + firewall + updates + monitoring + ssh + notifier + backups. */
+    servicesProvision?: string[];
+}
+/**
+ * Build the machine provisioning scripts from a CloudConfig. Returns the
+ * pieces the Ubuntu bootstrap (and the image bake) splice in.
+ */
+export declare function buildComputeProvisionScripts(config: CloudConfig): ComputeProvisionScripts;

package/dist/drivers/shared/db-provision.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Provision on-box managed services (Forge single-server model): the database
+ * engine, cache, and search, plus create the application database + user.
+ *
+ * These run at bootstrap (cloud-init), not on deploy, since installing an
+ * engine is a machine-level, one-time operation. The app's database
+ * credentials are referenced from the site's `.env` (`DB_*`). When the app
+ * points at a managed/external database instead, install nothing and just wire
+ * `.env` — see {@link buildManagedDbEnv}.
+ */
+import type { ComputeServicesConfig, DatabaseConfig } from '@ts-cloud/core';
+/**
+ * Build apt install + enable commands for each requested on-box service.
+ * Idempotent: apt install is a no-op when already present.
+ */
+export declare function buildServicesProvisionScript(services?: ComputeServicesConfig, options?: {
+    bindPrivate?: boolean;
+}): string[];
+/**
+ * Build the commands that create the application database + user on the on-box
+ * engine. Idempotent (uses IF NOT EXISTS / existence guards). Returns `[]` when
+ * the database points at a managed host or lacks a name.
+ */
+export declare function buildDatabaseSetupScript(database: DatabaseConfig | undefined, services?: ComputeServicesConfig): string[];
+/**
+ * `.env` key/value pairs wiring a Laravel app at the (on-box or managed)
+ * database. Merge into a site's `env` so `DB_*` is set without hand-copying
+ * credentials. Returns `{}` when there's nothing to wire.
+ */
+export declare function buildManagedDbEnv(database: DatabaseConfig | undefined): Record<string, string>;

package/dist/drivers/shared/deploy-script.d.ts

@@ -1,6 +1,3 @@
-/**
- * Shared deploy script helpers for Forge-style compute deploys.
- */
 /**
  * Translate a `start` command (e.g. "bun run server.ts") into an absolute
  * systemd ExecStart by swapping the leading runtime word for its absolute path.

package/dist/drivers/shared/env-file.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Encode an environment map as a `.env` file body that round-trips correctly
+ * through PHP dotenv (Laravel) and Bun's `.env` loader.
+ *
+ * Values are double-quoted with the standard dotenv escapes (`\\`, `\"`, `\n`,
+ * `\r`, `\t`) so secrets/keys containing spaces, `#`, `=`, quotes, backslashes,
+ * or newlines survive intact. (The previous `JSON.stringify` approach
+ * over-escaped some values and corrupted multi-line ones.)
+ */
+export declare function formatEnvFile(env: Record<string, string>): string;
+/** Double-quote + escape a single `.env` value. */
+export declare function quoteEnvValue(value: string): string;

package/dist/drivers/shared/fleet.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Resolve a Forge-style fleet topology from a compute config, and wire app
+ * servers at a dedicated services box.
+ *
+ * Roles:
+ *  - `app`      — runs nginx + php-fpm, the app is deployed to every app server.
+ *  - `services` — a dedicated box running the database/cache/search.
+ *  - `lb`       — the load balancer fronting the app servers.
+ *
+ * Single-server (the common case) resolves to one `app` box with services
+ * co-located. A multi-app fleet (`appServers > 1`) gets a load balancer, a
+ * private network, and (required) a dedicated services box so every app server
+ * shares one database/cache.
+ */
+import type { ComputeConfig, DatabaseConfig } from '@ts-cloud/core';
+export type FleetRole = 'app' | 'services' | 'lb';
+export interface FleetTopology {
+    /** Number of application servers. */
+    appServers: number;
+    /** Provision a load balancer in front of the app servers. */
+    loadBalancer: boolean;
+    /** Provision a dedicated services box (DB/cache/search off the app servers). */
+    dedicatedServices: boolean;
+    /** Whether the app servers should install services locally (single-box only). */
+    servicesOnApp: boolean;
+}
+/** Resolve the fleet topology from the compute config. */
+export declare function resolveFleetTopology(compute?: ComputeConfig): FleetTopology;
+/**
+ * Build the `.env` overrides that point a PHP app at a dedicated services box
+ * over the private network (DB + Redis + Meilisearch all live there). Merge
+ * under `site.env` (explicit values win).
+ */
+export declare function buildFleetServicesEnv(servicesPrivateIp: string, database?: DatabaseConfig): Record<string, string>;

package/dist/drivers/shared/git-deploy.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Forge-style git-clone-on-server deploys: the box clones the site's repository
+ * into a fresh release directory rather than receiving a tarball over SCP.
+ *
+ * The clone is shallow (`--depth 1`) on the configured branch for speed. When a
+ * specific commit is requested, it is fetched and checked out so deploys are
+ * reproducible. The resolved commit SHA is written to `<release>/.ts-cloud-sha`
+ * so later steps (and rollbacks) can identify the release.
+ */
+import type { SiteRepositoryConfig } from '@ts-cloud/core';
+export interface GitCheckoutOptions {
+    /** Repository to clone. */
+    repository: SiteRepositoryConfig;
+    /** Absolute release directory to clone into (`<base>/releases/<id>`). */
+    releaseDir: string;
+    /**
+     * Specific commit to deploy. When omitted, the branch tip is used (Forge's
+     * push-to-deploy behaviour).
+     */
+    commit?: string;
+}
+/** Default branch when the repository config omits one. */
+export declare const DEFAULT_DEPLOY_BRANCH = "main";
+/** Default tag glob when `strategy: 'tag'` and no explicit tag is set. */
+export declare const DEFAULT_TAG_PATTERN = "v*";
+/**
+ * Build the shell commands that clone + checkout the repository into the
+ * release directory. Assumes `git` is installed (the bootstrap installs it).
+ *
+ * Strategy is taken from `repository.strategy`:
+ *  - `'push'` (default) — clone the branch tip (or a pinned `commit`).
+ *  - `'tag'` — clone a version tag: the explicit `repository.tag`, else the
+ *    highest tag matching `repository.tagPattern`, resolved on the box via
+ *    `git ls-remote --sort=-v:refname`.
+ */
+export declare function buildGitCheckoutScript(options: GitCheckoutOptions): string[];

package/dist/drivers/shared/image-recipe.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Golden-image bake recipe.
+ *
+ * Produces the bash script Packer (or a manual snapshot run) executes on a base
+ * Ubuntu box to pre-install the full ts-cloud stack (nginx, php-fpm, Composer,
+ * services, hardening). The box is then snapshotted into a Hetzner snapshot /
+ * AWS AMI and referenced via `compute.image` + `compute.bakedImage: true`, so
+ * production boots are near-instant.
+ *
+ * Because it reuses {@link buildComputeProvisionScripts} + the shared
+ * {@link buildUbuntuBootstrapScript}, a baked image and a cold boot install the
+ * exact same stack — there is no separate, drift-prone image definition.
+ */
+import type { CloudConfig } from '@ts-cloud/core';
+export interface ImageRecipeOptions {
+    /**
+     * Exclude per-app/per-deploy state from the image so it stays generic and
+     * reusable across projects: SSH keys, the app database creation, and
+     * scheduled backups are applied at boot/deploy instead of baked in.
+     * @default true
+     */
+    generic?: boolean;
+    /**
+     * Append an image-minimization pass (clear apt/composer caches, logs, tmp;
+     * reset machine-id + cloud-init so clones boot fresh; trim free space). Keeps
+     * the published snapshot/AMI as small as possible. @default true
+     */
+    optimize?: boolean;
+}
+/**
+ * Image-minimization commands appended after provisioning so the published
+ * snapshot/AMI is as small as possible. Safe to run at the end of a bake (the
+ * box is snapshotted immediately after).
+ */
+export declare function buildImageCleanupScript(): string[];
+/**
+ * Build the bake recipe (a bash script) for a config. Runs the full
+ * provisioning with `baked: false` so everything is installed into the image.
+ */
+export declare function buildImageRecipe(config: CloudConfig, options?: ImageRecipeOptions): string;

package/dist/drivers/shared/laravel-deploy.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Assemble the remote deploy script for a Forge-style PHP/Laravel site: a
+ * git-clone-on-server, zero-downtime atomic-release deploy.
+ *
+ * The deploy script is a list of steps run in order on the box. Three Forge
+ * macros expand to the release machinery:
+ *   $CREATE_RELEASE   — clone the repo into a new release dir, link shared
+ *                       paths, and `cd` into it (subsequent steps run there).
+ *   $ACTIVATE_RELEASE — flip the `current` symlink atomically, prune old
+ *                       releases, and reload php-fpm so opcache sees new code.
+ *   $RESTART_QUEUES   — gracefully restart Laravel queue workers / Horizon.
+ *
+ * Everything between $CREATE_RELEASE and $ACTIVATE_RELEASE runs inside the new
+ * (not-yet-live) release, so a failure leaves the previous release serving —
+ * the Envoyer zero-downtime guarantee.
+ */
+import type { SiteConfig } from '@ts-cloud/core';
+export declare const MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
+export declare const MACRO_ACTIVATE_RELEASE = "$ACTIVATE_RELEASE";
+export declare const MACRO_RESTART_QUEUES = "$RESTART_QUEUES";
+/**
+ * Default deploy script (with macros) for a site type. Overridden by
+ * {@link SiteConfig.deployScript}.
+ */
+export declare function defaultDeployScriptFor(type: NonNullable<SiteConfig['type']>): string[];
+export interface LaravelDeployOptions {
+    siteName: string;
+    site: SiteConfig;
+    /** Unique release identifier (timestamp or sha) → `releases/<id>`. */
+    releaseId: string;
+    /** Site base dir. @default `/var/www/<siteName>` */
+    appBase?: string;
+    /** Exact commit to deploy (else the branch tip). */
+    commit?: string;
+    /** PHP version selecting the `phpX.Y` binary. @default `site.phpVersion` ?? '8.3' */
+    defaultPhpVersion?: string;
+}
+/**
+ * Build the full remote shell script for a PHP/Laravel git deploy, expanding the
+ * release macros. Requires `site.repository` to be set.
+ */
+export declare function buildLaravelDeployScript(options: LaravelDeployOptions): string[];

package/dist/drivers/shared/laravel-services.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Generate the per-site runtime services for a Forge-style PHP box: queue
+ * workers / Horizon (systemd), the Laravel scheduler (cron), and arbitrary
+ * daemons (systemd). Reconciled on every deploy so units track the config —
+ * units no longer in the config are stopped and removed.
+ *
+ * Unit naming (so a site's units can be globbed for pruning):
+ *   <slug>-<site>-queue-<i>.service
+ *   <slug>-<site>-daemon-<slug-of-name>.service
+ * Scheduler cron lives at /etc/cron.d/<slug>-<site>-scheduler.
+ *
+ * ExecStart commands target `<base>/current/...` (the active-release symlink),
+ * so workers/daemons always run the live code; `queue:restart` (run by the
+ * deploy's $RESTART_QUEUES macro) cycles them onto the new release.
+ */
+import type { DaemonConfig, SiteConfig } from '@ts-cloud/core';
+export interface SiteServicesOptions {
+    slug: string;
+    siteName: string;
+    site: SiteConfig;
+    /** PHP version selecting the `phpX.Y` binary. @default '8.3' */
+    phpVersion?: string;
+    /** Site base dir. @default `/var/www/<siteName>` */
+    appBase?: string;
+}
+export declare function queueUnitName(slug: string, siteName: string, index: number): string;
+export declare function daemonUnitName(slug: string, siteName: string, daemon: DaemonConfig, index: number): string;
+/** Path of the scheduler cron file for a site. */
+export declare function schedulerCronPath(slug: string, siteName: string): string;
+/**
+ * Build the full reconcile script: (re)write desired queue/daemon units +
+ * scheduler cron, prune stale units for this site, and reload systemd.
+ */
+export declare function buildSiteServicesScript(options: SiteServicesOptions): string[];
+/** Whether a site declares any runtime services (avoids emitting an empty reconcile). */
+export declare function siteHasServices(site: SiteConfig): boolean;

package/dist/drivers/shared/maintenance.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Automatic unattended security/system updates, mirroring Forge's scheduled
+ * maintenance. Installs `unattended-upgrades` and enables the daily APT
+ * auto-update timers so security patches land without manual intervention.
+ */
+/**
+ * Build the commands that enable automatic security updates. Idempotent.
+ * Returns `[]` when disabled.
+ */
+export declare function buildAutoUpdatesScript(enabled?: boolean): string[];

package/dist/drivers/shared/monitoring.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Lightweight server monitoring, mirroring Forge's basic server metrics.
+ *
+ * Dependency-free: a small shell collector reads load average, memory, and
+ * disk usage and writes a JSON snapshot to `/var/lib/ts-cloud/metrics.json`
+ * every minute via a systemd timer. The ts-cloud UI (and any operator tooling)
+ * can read that file for at-a-glance server health.
+ */
+/** Where the metrics snapshot is written. */
+export declare const METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
+/**
+ * Build the commands that install the metrics collector + systemd timer.
+ * Idempotent. Returns `[]` when disabled.
+ */
+export declare function buildMonitoringScript(enabled?: boolean): string[];