@stacksjs/ts-cloud 0.7.16 → 0.7.18

package/dist/{chunk-hb06vk29.js → chunk-vpyd42tp.js}

@@ -545,6 +545,473 @@ function buildNginxServiceScript(projectDir = "/opt/pantry") {
   ];
 }
 
+// src/deploy/site-target.ts
+function siteInstallBase(slug, siteName) {
+  return `/var/www/${slug}-${siteName}`;
+}
+var PHP_SITE_TYPES = new Set([
+  "laravel",
+  "php",
+  "statamic",
+  "wordpress"
+]);
+function isPhpSite(site) {
+  return site.type != null && PHP_SITE_TYPES.has(site.type);
+}
+function resolveSiteDeployTarget(site) {
+  if (site.deploy)
+    return site.deploy;
+  if (isPhpSite(site))
+    return "server";
+  if (site.start)
+    return "server";
+  return "bucket";
+}
+function resolveSiteKind(site) {
+  if (site.redirect)
+    return "redirect";
+  if (isPhpSite(site))
+    return "server-php";
+  const target = resolveSiteDeployTarget(site);
+  if (target === "bucket")
+    return "bucket";
+  return site.start ? "server-app" : "server-static";
+}
+function hasComputeConfigured(config) {
+  return config.infrastructure?.compute != null;
+}
+function validateDeploymentConfig(config) {
+  const errors = [];
+  const warnings = [];
+  const sites = config.sites || {};
+  const computeConfigured = hasComputeConfigured(config);
+  const coexistence = deploymentCoexistenceError(config);
+  if (coexistence)
+    errors.push(coexistence);
+  const portOwners = new Map;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site) {
+      continue;
+    }
+    const target = resolveSiteDeployTarget(site);
+    const kind = resolveSiteKind(site);
+    if (kind === "redirect") {
+      if (!site.domain)
+        errors.push(`Site '${name}' is a redirect site but has no \`domain\` to redirect from.`);
+      const to = typeof site.redirect === "string" ? site.redirect : site.redirect?.to;
+      if (!to)
+        errors.push(`Site '${name}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (site.root)
+        serverOnly.push("root");
+      if (serverOnly.length > 0)
+        warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
+      continue;
+    }
+    if (target === "server" && !site.start && !site.root) {
+      errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
+      continue;
+    }
+    if (kind === "server-php") {
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);
+      }
+      if (!site.repository?.url) {
+        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`);
+      }
+    } else if (kind === "server-app") {
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' deploys to a server (deploy:'server'${site.deploy ? "" : " inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
+      }
+      if (typeof site.port === "number") {
+        const existing = portOwners.get(site.port);
+        if (existing) {
+          errors.push(`Sites '${existing}' and '${name}' both use port ${site.port}. Server apps sharing a box must use distinct ports.`);
+        } else {
+          portOwners.set(site.port, name);
+        }
+      }
+    } else if (kind === "server-static") {
+      if (!site.root) {
+        errors.push(`Site '${name}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);
+      }
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
+      }
+    } else {
+      if (!site.root) {
+        errors.push(`Site '${name}' deploys to a bucket but has no \`root\` directory to upload.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (typeof site.port === "number")
+        serverOnly.push("port");
+      if (site.preStart && site.preStart.length > 0)
+        serverOnly.push("preStart");
+      if (serverOnly.length > 0) {
+        warnings.push(`Site '${name}' deploys to a bucket but sets server-only field(s): ${serverOnly.join(", ")}. These are ignored. Set deploy:'server' to use them.`);
+      }
+    }
+  }
+  return { errors, warnings };
+}
+
+// src/drivers/shared/rpx-gateway.ts
+var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
+function normalizeSiteRedirect(input) {
+  if (typeof input === "string")
+    return { to: input };
+  const out = { to: input.to };
+  if (input.status != null)
+    out.status = input.status;
+  if (input.preservePath != null)
+    out.preservePath = input.preservePath;
+  return out;
+}
+function resolveRouteAuth(site) {
+  const auth = site.auth;
+  if (!auth || auth.enabled === false || !auth.password)
+    return;
+  return {
+    username: auth.username || "admin",
+    password: auth.password,
+    ...auth.realm ? { realm: auth.realm } : {}
+  };
+}
+function normalizeRoutePath(path) {
+  if (!path || path === "/")
+    return;
+  let p = `/${path}`.replace(/\/+/g, "/").replace(/\/+$/, "");
+  if (!p.startsWith("/"))
+    p = `/${p}`;
+  return p === "" || p === "/" ? undefined : p;
+}
+function deriveRouteId(to, path) {
+  const base = path ? `${to}${path}` : to;
+  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
+  return cleaned.length > 0 ? cleaned : "rpx";
+}
+function resolveServerAppFrom(port, appBoxes) {
+  if (!appBoxes || appBoxes.length === 0)
+    return `localhost:${port}`;
+  return appBoxes.map((box) => `${box.privateIp ?? box.publicIp}:${port}`);
+}
+function buildRpxConfigInternal(sites, options, appBoxes) {
+  const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
+  const installSlug = options.slug ?? "app";
+  const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
+  const loadBalancer = options.proxy.loadBalancer;
+  const proxies = [];
+  const domains = new Set;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site || !site.domain)
+      continue;
+    const kind = resolveSiteKind(site);
+    if (kind === "bucket")
+      continue;
+    const path = normalizeRoutePath(site.path);
+    const id = deriveRouteId(site.domain, path);
+    const auth = resolveRouteAuth(site);
+    if (kind === "redirect") {
+      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
+      domains.add(site.domain);
+      continue;
+    }
+    if (kind === "server-app") {
+      if (typeof site.port !== "number")
+        continue;
+      const from = resolveServerAppFrom(site.port, appBoxes);
+      proxies.push({
+        to: site.domain,
+        path,
+        from,
+        id,
+        ...auth ? { auth } : {},
+        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
+      });
+    } else {
+      proxies.push({
+        to: site.domain,
+        path,
+        static: {
+          dir: `${wwwRoot}/${installSlug}-${name}/current`,
+          spa: site.spa ?? false,
+          pathRewriteStyle: site.pathRewriteStyle ?? "directory"
+        },
+        cleanUrls: site.pathRewriteStyle !== "flat",
+        ...auth ? { auth } : {},
+        id
+      });
+    }
+    domains.add(site.domain);
+  }
+  if (options.proxy.autoWww !== false) {
+    for (const domain of [...domains]) {
+      if (domain.split(".").length !== 2)
+        continue;
+      const wwwDomain = `www.${domain}`;
+      if (domains.has(wwwDomain))
+        continue;
+      proxies.push({ to: wwwDomain, redirect: { to: `https://${domain}` }, id: deriveRouteId(wwwDomain) });
+      domains.add(wwwDomain);
+    }
+  }
+  proxies.sort((a, b) => {
+    if (a.to !== b.to)
+      return a.to.localeCompare(b.to);
+    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
+  });
+  const config = {
+    proxies,
+    productionCerts: { certsDir },
+    https: true,
+    hostsManagement: false,
+    cleanup: { hosts: false, certs: false }
+  };
+  if (options.proxy.onDemandTls && domains.size > 0) {
+    config.onDemandTls = {
+      enabled: true,
+      allowedSuffixes: [...domains],
+      email: options.proxy.onDemandTlsEmail,
+      certsDir
+    };
+  }
+  if (options.proxy.onDemandTls) {
+    config.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
+  }
+  const cdn = options.proxy.cdn;
+  if (cdn?.secret && cdn.frontedHosts.length > 0) {
+    config.originGuard = {
+      header: cdn.secretHeader ?? "X-Origin-Verify",
+      value: cdn.secret,
+      hosts: cdn.frontedHosts
+    };
+  }
+  return config;
+}
+function buildRpxConfig(sites, options) {
+  return buildRpxConfigInternal(sites, options);
+}
+function buildRpxLbConfig(sites, appBoxes, options) {
+  return buildRpxConfigInternal(sites, options, appBoxes);
+}
+function renderRpxLauncher(config) {
+  const json = JSON.stringify(config, null, 2);
+  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
+// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
+import { startProxies } from '@stacksjs/rpx'
+
+const config = ${json} as const
+
+await startProxies(config as any)
+`;
+}
+function usesRpxProxy(compute) {
+  return compute?.webServer === "rpx" || compute?.proxy?.engine === "rpx";
+}
+var RPX_DIR = "/etc/rpx";
+var RPX_INSTALL_DIR = "/opt/rpx-gateway";
+var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
+var RPX_SERVICE_NAME = "rpx-gateway.service";
+var RPX_SITES_DIR = "/etc/rpx/sites.d";
+function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
+  return `// Generated by ts-cloud — rpx gateway assembler.
+// Merges every app's fragment in ${sitesDir} so independent deploys compose
+// without clobbering each other. Each deploy writes only its own <slug>.json.
+import { startProxies } from '@stacksjs/rpx'
+import { readdirSync, readFileSync } from 'node:fs'
+
+const dir = ${JSON.stringify(sitesDir)}
+const proxies = []
+const seen = new Set()
+const suffixes = new Set()
+const guardHosts = new Set()
+let email
+let certsDir = ${JSON.stringify(defaultCertsDir)}
+let acmeChallengeWebroot
+let guard
+let files = []
+try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
+for (const f of files) {
+  let frag
+  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) } catch { continue }
+  for (const p of frag.proxies ?? []) {
+    const key = p.id || (p.to + (p.path ?? ''))
+    if (seen.has(key)) continue
+    seen.add(key)
+    proxies.push(p)
+  }
+  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
+  email ??= frag.onDemandTls?.email
+  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
+  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
+  if (frag.originGuard) {
+    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
+    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+  }
+}
+const config = {
+  proxies,
+  productionCerts: { certsDir },
+  https: true,
+  hostsManagement: false,
+  cleanup: { hosts: false, certs: false },
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
+  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
+  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+}
+
+await startProxies(config)
+`;
+}
+function writeFileHeredoc(path, content, delimiter) {
+  return [
+    `cat > ${path} <<'${delimiter}'`,
+    content,
+    delimiter
+  ];
+}
+function certDomainsForConfig(config) {
+  const seen = new Set;
+  for (const r of config.proxies) {
+    const host = r.to;
+    if (!host || host.startsWith("*") || host.includes(":") || !host.includes("."))
+      continue;
+    seen.add(host);
+  }
+  return [...seen];
+}
+function buildCertManagementCommands(options) {
+  const { config, proxy } = options;
+  const webroot = config.acmeChallengeWebroot;
+  const domains = certDomainsForConfig(config);
+  if (!proxy.onDemandTls || !webroot || domains.length === 0)
+    return [];
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version = proxy.version ?? "latest";
+  const certsDir = config.productionCerts.certsDir;
+  const email = proxy.onDemandTlsEmail ?? `webmaster@${domains[0]}`;
+  const tlsxCli = `${bunBin} ${RPX_INSTALL_DIR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`;
+  const csv = domains.join(",");
+  const spaced = domains.join(" ");
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
+  const renewServiceName = `rpx-cert-renew-${slug}.service`;
+  const renewTimerName = `rpx-cert-renew-${slug}.timer`;
+  const renewScript = [
+    "#!/bin/sh",
+    "# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.",
+    "# The running gateway serves the challenge from $WEBROOT on :80, so this needs",
+    "# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.",
+    "set -u",
+    `CERTS='${certsDir}'`,
+    `WEBROOT='${webroot}'`,
+    `EMAIL='${email}'`,
+    `TLSX="${tlsxCli}"`,
+    `DOMAINS='${csv}'`,
+    'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `for d in ${spaced}; do`,
+    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    "done",
+    '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
+    'rm -f "$CERTS"/*.chain.crt',
+    'after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `[ "$before" = "$after" ] || systemctl restart ${RPX_SERVICE_NAME}`
+  ].join(`
+`);
+  const renewService = [
+    "[Unit]",
+    `Description=Issue/renew rpx gateway TLS certs for ${slug} (tlsx http-01)`,
+    `After=network-online.target ${RPX_SERVICE_NAME}`,
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    `ExecStart=${renewScriptPath}`
+  ].join(`
+`);
+  const renewTimer = [
+    "[Unit]",
+    `Description=Daily rpx gateway TLS cert issuance/renewal for ${slug}`,
+    "",
+    "[Timer]",
+    "OnCalendar=*-*-* 03:30:00",
+    "RandomizedDelaySec=1h",
+    "Persistent=true",
+    "",
+    "[Install]",
+    "WantedBy=timers.target"
+  ].join(`
+`);
+  return [
+    `mkdir -p ${webroot}`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/tlsx@${version}) || true`,
+    ...writeFileHeredoc(renewScriptPath, renewScript, "TS_CLOUD_RENEW_EOF"),
+    `chmod +x ${renewScriptPath}`,
+    ...writeFileHeredoc(`/etc/systemd/system/${renewServiceName}`, renewService, "TS_CLOUD_RENEW_SVC_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${renewTimerName}`, renewTimer, "TS_CLOUD_RENEW_TIMER_EOF"),
+    "systemctl daemon-reload",
+    `systemctl enable --now ${renewTimerName} || true`,
+    `${renewScriptPath} || true`
+  ];
+}
+function buildRpxProvisionScript(options) {
+  const { config, proxy } = options;
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version = proxy.version ?? "latest";
+  const certsDir = config.productionCerts.certsDir;
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const fragment = JSON.stringify({ slug, ...config }, null, 2);
+  const assembler = renderRpxAssembler(RPX_SITES_DIR, certsDir);
+  const upstreamTimeout = proxy.upstreamTimeout ?? 60;
+  const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
+  if (typeof proxy.maxUpstreamConns === "number")
+    poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
+    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version})`,
+    `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
+    ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
+      "[Unit]",
+      "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
+      "After=network.target network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      "Type=simple",
+      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
+      `WorkingDirectory=${RPX_INSTALL_DIR}`,
+      `Environment=BUN_INSTALL=/root/.bun`,
+      ...poolEnv,
+      "Restart=always",
+      "RestartSec=5",
+      "LimitNOFILE=1048576",
+      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target"
+    ].join(`
+`), "TS_CLOUD_RPX_UNIT_EOF"),
+    "systemctl daemon-reload",
+    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
+    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
+    `systemctl enable ${RPX_SERVICE_NAME}`,
+    `systemctl restart ${RPX_SERVICE_NAME}`,
+    ...buildCertManagementCommands(options)
+  ];
+}
+
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
 function buildUfwScript(firewall = {}) {
@@ -909,7 +1376,7 @@ function buildComputeProvisionScripts(config) {
   const phpBox = compute.runtime === "php" || !!compute.php;
   const needsPantry = phpBox || !!compute.managedServices;
   const pantryBootstrap = needsPantry ? buildPantryBootstrapScript() : [];
-  const useNginx = compute.webServer !== "rpx";
+  const useNginx = !usesRpxProxy(compute);
   const phpProvision = phpBox ? [
     ...pantryBootstrap,
     ...buildPhpProvisionScript({
@@ -1355,768 +1822,307 @@ class AwsDriver {
         const nameTag = instance.Tags?.find((tag) => tag.Key === "Name")?.Value;
         targets.push({
           id: instance.InstanceId,
-          name: nameTag,
-          publicIp: instance.PublicIpAddress,
-          privateIp: instance.PrivateIpAddress,
-          status: instance.State?.Name
-        });
-      }
-    }
-    return targets;
-  }
-  bashWrap(commands) {
-    return ["bash <<'TS_CLOUD_BASH_EOF'", commands.join(`
-`), "TS_CLOUD_BASH_EOF"];
-  }
-  async runRemoteDeploy(options) {
-    const region = this.region;
-    const ssm = new SSMClient(region);
-    if (options.targets.length > 0) {
-      const sendResult = await ssm.sendCommand({
-        InstanceIds: options.targets.map((target) => target.id),
-        DocumentName: "AWS-RunShellScript",
-        Parameters: { commands: this.bashWrap(options.commands) },
-        TimeoutSeconds: options.timeoutSeconds || 600,
-        Comment: options.comment
-      });
-      if (!sendResult.CommandId) {
-        return { success: false, instanceCount: 0, perInstance: [], error: "Failed to send SSM command" };
-      }
-      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length);
-    }
-    if (!options.tags || Object.keys(options.tags).length === 0) {
-      return { success: false, instanceCount: 0, perInstance: [], error: "No targets or tags provided for AWS deploy" };
-    }
-    const result = await ssm.sendCommandByTags({
-      tags: options.tags,
-      commands: this.bashWrap(options.commands),
-      timeoutSeconds: options.timeoutSeconds || 600,
-      comment: options.comment
-    });
-    return {
-      success: result.success,
-      instanceCount: result.instanceCount,
-      perInstance: result.perInstance.map((item) => ({
-        instanceId: item.instanceId,
-        status: item.status,
-        output: item.output,
-        error: item.error
-      })),
-      error: result.error
-    };
-  }
-  async pollSsmCommand(ssm, commandId, expectedCount) {
-    const pollInterval = 3000;
-    const maxWait = 600000;
-    const startTime = Date.now();
-    const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
-    let lastInvocations = [];
-    while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-      try {
-        const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
-        lastInvocations = invocations;
-        if (lastInvocations.length >= expectedCount && lastInvocations.every((i) => terminalStatuses.has(i.Status || ""))) {
-          break;
-        }
-      } catch {}
-    }
-    const perInstance = lastInvocations.map((item) => ({
-      instanceId: item.InstanceId,
-      status: item.Status || "Unknown",
-      output: item.StandardOutputContent,
-      error: item.StandardErrorContent
-    }));
-    const success = perInstance.length > 0 && perInstance.every((item) => item.status === "Success");
-    return {
-      success,
-      instanceCount: perInstance.length,
-      perInstance,
-      error: success ? undefined : "One or more SSM command invocations failed"
-    };
-  }
-}
-
-// src/drivers/hetzner/driver.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join3 } from "node:path";
-import { execSync } from "node:child_process";
-
-// src/drivers/hetzner/client.ts
-var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
-
-class HetznerClient {
-  name = "hetzner";
-  apiToken;
-  baseUrl;
-  fetchImpl;
-  constructor(options) {
-    this.apiToken = options.apiToken;
-    this.baseUrl = options.baseUrl ?? DEFAULT_API_URL;
-    this.fetchImpl = options.fetchImpl ?? fetch;
-  }
-  async request(method, path, body) {
-    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.apiToken}`,
-        "Content-Type": "application/json"
-      },
-      body: body === undefined ? undefined : JSON.stringify(body)
-    });
-    const text = await response.text();
-    let data;
-    try {
-      data = text ? JSON.parse(text) : {};
-    } catch {
-      if (!response.ok) {
-        const snippet = text.trim().slice(0, 200) || response.statusText || "Hetzner API error";
-        throw new Error(`Hetzner API ${method} ${path} (${response.status}): ${snippet}`);
-      }
-      throw new Error(`Hetzner API ${method} ${path}: unexpected non-JSON response`);
-    }
-    if (!response.ok) {
-      const message = data.error?.message || response.statusText || "Hetzner API error";
-      const code = data.error?.code ? ` [${data.error.code}]` : "";
-      throw new Error(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`);
-    }
-    return data;
-  }
-  async listServers() {
-    const data = await this.request("GET", "/servers");
-    return data.servers;
-  }
-  async getServer(id) {
-    const data = await this.request("GET", `/servers/${id}`);
-    return data.server;
-  }
-  async createServer(options) {
-    const data = await this.request("POST", "/servers", {
-      name: options.name,
-      server_type: options.serverType,
-      image: options.image,
-      location: options.location,
-      datacenter: options.datacenter,
-      ssh_keys: options.sshKeys,
-      user_data: options.userData,
-      labels: options.labels,
-      firewalls: options.firewalls,
-      networks: options.networks,
-      start_after_create: true
-    });
-    return { server: data.server, action: data.action };
-  }
-  async listNetworks() {
-    const data = await this.request("GET", "/networks");
-    return data.networks;
-  }
-  async createNetwork(options) {
-    const ipRange = options.ipRange ?? "10.0.0.0/16";
-    const data = await this.request("POST", "/networks", {
-      name: options.name,
-      ip_range: ipRange,
-      subnets: [{ type: "cloud", ip_range: ipRange, network_zone: "eu-central" }],
-      labels: options.labels
-    });
-    return data.network;
-  }
-  async deleteNetwork(id) {
-    await this.request("DELETE", `/networks/${id}`);
-  }
-  async listLoadBalancers() {
-    const data = await this.request("GET", "/load_balancers");
-    return data.load_balancers;
-  }
-  async createLoadBalancer(options) {
-    const data = await this.request("POST", "/load_balancers", {
-      name: options.name,
-      load_balancer_type: options.type ?? "lb11",
-      location: options.location,
-      network_zone: options.network ? undefined : options.networkZone ?? "eu-central",
-      network: options.network,
-      labels: options.labels,
-      targets: [{ type: "label_selector", label_selector: { selector: options.labelSelector }, use_private_ip: !!options.network }],
-      services: options.services.map((s) => ({
-        protocol: s.protocol ?? "tcp",
-        listen_port: s.listenPort,
-        destination_port: s.destinationPort,
-        health_check: {
-          protocol: "http",
-          port: 80,
-          interval: 15,
-          timeout: 10,
-          retries: 3,
-          http: { path: "/", status_codes: ["2??", "3??"] }
-        }
-      }))
-    });
-    return data.load_balancer;
-  }
-  async deleteLoadBalancer(id) {
-    await this.request("DELETE", `/load_balancers/${id}`);
-  }
-  async deleteServer(id) {
-    const data = await this.request("DELETE", `/servers/${id}`);
-    return data.action;
-  }
-  async listFirewalls() {
-    const data = await this.request("GET", "/firewalls");
-    return data.firewalls;
-  }
-  async createFirewall(options) {
-    const data = await this.request("POST", "/firewalls", {
-      name: options.name,
-      rules: options.rules,
-      labels: options.labels,
-      apply_to: options.applyTo
-    });
-    return { firewall: data.firewall, actions: data.actions };
-  }
-  async setFirewallRules(firewallId, rules) {
-    const data = await this.request("POST", `/firewalls/${firewallId}/actions/set_rules`, {
-      rules
-    });
-    return data.actions ?? [];
-  }
-  async deleteFirewall(firewallId) {
-    await this.request("DELETE", `/firewalls/${firewallId}`);
-  }
-  async applyFirewallToResources(firewallId, applyTo) {
-    const data = await this.request("POST", `/firewalls/${firewallId}/actions/apply_to_resources`, {
-      apply_to: applyTo
-    });
-    return data.actions;
-  }
-  async listSshKeys() {
-    const data = await this.request("GET", "/ssh_keys");
-    return data.ssh_keys;
-  }
-  async createSshKey(options) {
-    const data = await this.request("POST", "/ssh_keys", {
-      name: options.name,
-      public_key: options.publicKey,
-      labels: options.labels
-    });
-    return data.ssh_key;
-  }
-  async waitForAction(actionId, options) {
-    const pollInterval = options?.pollIntervalMs ?? 2000;
-    const maxWait = options?.maxWaitMs ?? 300000;
-    const start = Date.now();
-    while (Date.now() - start < maxWait) {
-      const data = await this.request("GET", `/actions/${actionId}`);
-      if (data.action.status === "success")
-        return data.action;
-      if (data.action.status === "error") {
-        throw new Error(data.action.error?.message || "Hetzner action failed");
+          name: nameTag,
+          publicIp: instance.PublicIpAddress,
+          privateIp: instance.PrivateIpAddress,
+          status: instance.State?.Name
+        });
       }
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-    }
-    throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
-  }
-  async waitForServerRunning(serverId, options) {
-    const pollInterval = options?.pollIntervalMs ?? 3000;
-    const maxWait = options?.maxWaitMs ?? 600000;
-    const start = Date.now();
-    while (Date.now() - start < maxWait) {
-      const server = await this.getServer(serverId);
-      if (server.status === "running")
-        return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
     }
-    throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
+    return targets;
   }
-}
-function resolveHetznerApiToken(configToken) {
-  const token = configToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
-  if (!token) {
-    throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
+  bashWrap(commands) {
+    return ["bash <<'TS_CLOUD_BASH_EOF'", commands.join(`
+`), "TS_CLOUD_BASH_EOF"];
   }
-  return token;
-}
-function normalizeSshPublicKey(publicKey) {
-  const [type, body] = publicKey.trim().split(/\s+/);
-  return body ? `${type} ${body}` : type;
-}
-
-// src/drivers/hetzner/cloud-init.ts
-function wrapCloudInitUserData(bootstrapScript) {
-  const scriptPath = "/var/lib/cloud/ts-cloud-bootstrap.sh";
-  const indented = bootstrapScript.split(`
-`).map((line) => `      ${line}`).join(`
-`);
-  return `#cloud-config
-write_files:
-  - path: ${scriptPath}
-    permissions: '0755'
-    owner: root:root
-    content: |
-${indented}
-runcmd:
-  - [ bash, ${scriptPath} ]
-`;
-}
-
-// src/deploy/site-target.ts
-function siteInstallBase(slug, siteName) {
-  return `/var/www/${slug}-${siteName}`;
-}
-var PHP_SITE_TYPES = new Set([
-  "laravel",
-  "php",
-  "statamic",
-  "wordpress"
-]);
-function isPhpSite(site) {
-  return site.type != null && PHP_SITE_TYPES.has(site.type);
-}
-function resolveSiteDeployTarget(site) {
-  if (site.deploy)
-    return site.deploy;
-  if (isPhpSite(site))
-    return "server";
-  if (site.start)
-    return "server";
-  return "bucket";
-}
-function resolveSiteKind(site) {
-  if (site.redirect)
-    return "redirect";
-  if (isPhpSite(site))
-    return "server-php";
-  const target = resolveSiteDeployTarget(site);
-  if (target === "bucket")
-    return "bucket";
-  return site.start ? "server-app" : "server-static";
-}
-function hasComputeConfigured(config) {
-  return config.infrastructure?.compute != null;
-}
-function validateDeploymentConfig(config) {
-  const errors = [];
-  const warnings = [];
-  const sites = config.sites || {};
-  const computeConfigured = hasComputeConfigured(config);
-  const coexistence = deploymentCoexistenceError(config);
-  if (coexistence)
-    errors.push(coexistence);
-  const portOwners = new Map;
-  for (const [name, site] of Object.entries(sites)) {
-    if (!site) {
-      continue;
-    }
-    const target = resolveSiteDeployTarget(site);
-    const kind = resolveSiteKind(site);
-    if (kind === "redirect") {
-      if (!site.domain)
-        errors.push(`Site '${name}' is a redirect site but has no \`domain\` to redirect from.`);
-      const to = typeof site.redirect === "string" ? site.redirect : site.redirect?.to;
-      if (!to)
-        errors.push(`Site '${name}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);
+  async runRemoteDeploy(options) {
+    const region = this.region;
+    const ssm = new SSMClient(region);
+    if (options.targets.length > 0) {
+      const sendResult = await ssm.sendCommand({
+        InstanceIds: options.targets.map((target) => target.id),
+        DocumentName: "AWS-RunShellScript",
+        Parameters: { commands: this.bashWrap(options.commands) },
+        TimeoutSeconds: options.timeoutSeconds || 600,
+        Comment: options.comment
+      });
+      if (!sendResult.CommandId) {
+        return { success: false, instanceCount: 0, perInstance: [], error: "Failed to send SSM command" };
       }
-      const serverOnly = [];
-      if (site.start)
-        serverOnly.push("start");
-      if (site.root)
-        serverOnly.push("root");
-      if (serverOnly.length > 0)
-        warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
-      continue;
+      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length);
     }
-    if (target === "server" && !site.start && !site.root) {
-      errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
-      continue;
+    if (!options.tags || Object.keys(options.tags).length === 0) {
+      return { success: false, instanceCount: 0, perInstance: [], error: "No targets or tags provided for AWS deploy" };
     }
-    if (kind === "server-php") {
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);
-      }
-      if (!site.repository?.url) {
-        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`);
-      }
-    } else if (kind === "server-app") {
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' deploys to a server (deploy:'server'${site.deploy ? "" : " inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
-      }
-      if (typeof site.port === "number") {
-        const existing = portOwners.get(site.port);
-        if (existing) {
-          errors.push(`Sites '${existing}' and '${name}' both use port ${site.port}. Server apps sharing a box must use distinct ports.`);
-        } else {
-          portOwners.set(site.port, name);
+    const result = await ssm.sendCommandByTags({
+      tags: options.tags,
+      commands: this.bashWrap(options.commands),
+      timeoutSeconds: options.timeoutSeconds || 600,
+      comment: options.comment
+    });
+    return {
+      success: result.success,
+      instanceCount: result.instanceCount,
+      perInstance: result.perInstance.map((item) => ({
+        instanceId: item.instanceId,
+        status: item.status,
+        output: item.output,
+        error: item.error
+      })),
+      error: result.error
+    };
+  }
+  async pollSsmCommand(ssm, commandId, expectedCount) {
+    const pollInterval = 3000;
+    const maxWait = 600000;
+    const startTime = Date.now();
+    const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
+    let lastInvocations = [];
+    while (Date.now() - startTime < maxWait) {
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      try {
+        const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
+        lastInvocations = invocations;
+        if (lastInvocations.length >= expectedCount && lastInvocations.every((i) => terminalStatuses.has(i.Status || ""))) {
+          break;
         }
-      }
-    } else if (kind === "server-static") {
-      if (!site.root) {
-        errors.push(`Site '${name}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);
-      }
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
-      }
-    } else {
-      if (!site.root) {
-        errors.push(`Site '${name}' deploys to a bucket but has no \`root\` directory to upload.`);
-      }
-      const serverOnly = [];
-      if (site.start)
-        serverOnly.push("start");
-      if (typeof site.port === "number")
-        serverOnly.push("port");
-      if (site.preStart && site.preStart.length > 0)
-        serverOnly.push("preStart");
-      if (serverOnly.length > 0) {
-        warnings.push(`Site '${name}' deploys to a bucket but sets server-only field(s): ${serverOnly.join(", ")}. These are ignored. Set deploy:'server' to use them.`);
-      }
+      } catch {}
     }
-  }
-  return { errors, warnings };
-}
-
-// src/drivers/shared/rpx-gateway.ts
-var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
-var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
-function normalizeSiteRedirect(input) {
-  if (typeof input === "string")
-    return { to: input };
-  const out = { to: input.to };
-  if (input.status != null)
-    out.status = input.status;
-  if (input.preservePath != null)
-    out.preservePath = input.preservePath;
-  return out;
-}
-function resolveRouteAuth(site) {
-  const auth = site.auth;
-  if (!auth || auth.enabled === false || !auth.password)
-    return;
-  return {
-    username: auth.username || "admin",
-    password: auth.password,
-    ...auth.realm ? { realm: auth.realm } : {}
-  };
-}
-function normalizeRoutePath(path) {
-  if (!path || path === "/")
-    return;
-  let p = `/${path}`.replace(/\/+/g, "/").replace(/\/+$/, "");
-  if (!p.startsWith("/"))
-    p = `/${p}`;
-  return p === "" || p === "/" ? undefined : p;
-}
-function deriveRouteId(to, path) {
-  const base = path ? `${to}${path}` : to;
-  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
-  return cleaned.length > 0 ? cleaned : "rpx";
-}
-function resolveServerAppFrom(port, appBoxes) {
-  if (!appBoxes || appBoxes.length === 0)
-    return `localhost:${port}`;
-  return appBoxes.map((box) => `${box.privateIp ?? box.publicIp}:${port}`);
+    const perInstance = lastInvocations.map((item) => ({
+      instanceId: item.InstanceId,
+      status: item.Status || "Unknown",
+      output: item.StandardOutputContent,
+      error: item.StandardErrorContent
+    }));
+    const success = perInstance.length > 0 && perInstance.every((item) => item.status === "Success");
+    return {
+      success,
+      instanceCount: perInstance.length,
+      perInstance,
+      error: success ? undefined : "One or more SSM command invocations failed"
+    };
+  }
 }
-function buildRpxConfigInternal(sites, options, appBoxes) {
-  const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
-  const installSlug = options.slug ?? "app";
-  const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
-  const loadBalancer = options.proxy.loadBalancer;
-  const proxies = [];
-  const domains = new Set;
-  for (const [name, site] of Object.entries(sites)) {
-    if (!site || !site.domain)
-      continue;
-    const kind = resolveSiteKind(site);
-    if (kind === "bucket")
-      continue;
-    const path = normalizeRoutePath(site.path);
-    const id = deriveRouteId(site.domain, path);
-    const auth = resolveRouteAuth(site);
-    if (kind === "redirect") {
-      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
-      domains.add(site.domain);
-      continue;
+
+// src/drivers/hetzner/driver.ts
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+import { execSync } from "node:child_process";
+
+// src/drivers/hetzner/client.ts
+var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
+
+class HetznerClient {
+  name = "hetzner";
+  apiToken;
+  baseUrl;
+  fetchImpl;
+  constructor(options) {
+    this.apiToken = options.apiToken;
+    this.baseUrl = options.baseUrl ?? DEFAULT_API_URL;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async request(method, path, body) {
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.apiToken}`,
+        "Content-Type": "application/json"
+      },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+    const text = await response.text();
+    let data;
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      if (!response.ok) {
+        const snippet = text.trim().slice(0, 200) || response.statusText || "Hetzner API error";
+        throw new Error(`Hetzner API ${method} ${path} (${response.status}): ${snippet}`);
+      }
+      throw new Error(`Hetzner API ${method} ${path}: unexpected non-JSON response`);
     }
-    if (kind === "server-app") {
-      if (typeof site.port !== "number")
-        continue;
-      const from = resolveServerAppFrom(site.port, appBoxes);
-      proxies.push({
-        to: site.domain,
-        path,
-        from,
-        id,
-        ...auth ? { auth } : {},
-        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
-      });
-    } else {
-      proxies.push({
-        to: site.domain,
-        path,
-        static: `${wwwRoot}/${installSlug}-${name}/current`,
-        cleanUrls: site.pathRewriteStyle !== "flat",
-        spa: site.spa ?? false,
-        ...auth ? { auth } : {},
-        id
-      });
+    if (!response.ok) {
+      const message = data.error?.message || response.statusText || "Hetzner API error";
+      const code = data.error?.code ? ` [${data.error.code}]` : "";
+      throw new Error(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`);
     }
-    domains.add(site.domain);
+    return data;
   }
-  if (options.proxy.autoWww !== false) {
-    for (const domain of [...domains]) {
-      if (domain.split(".").length !== 2)
-        continue;
-      const wwwDomain = `www.${domain}`;
-      if (domains.has(wwwDomain))
-        continue;
-      proxies.push({ to: wwwDomain, redirect: { to: `https://${domain}` }, id: deriveRouteId(wwwDomain) });
-      domains.add(wwwDomain);
-    }
+  async listServers() {
+    const data = await this.request("GET", "/servers");
+    return data.servers;
   }
-  proxies.sort((a, b) => {
-    if (a.to !== b.to)
-      return a.to.localeCompare(b.to);
-    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
-  });
-  const config = {
-    proxies,
-    productionCerts: { certsDir },
-    https: true,
-    hostsManagement: false,
-    cleanup: { hosts: false, certs: false }
-  };
-  if (options.proxy.onDemandTls && domains.size > 0) {
-    config.onDemandTls = {
-      enabled: true,
-      allowedSuffixes: [...domains],
-      email: options.proxy.onDemandTlsEmail,
-      certsDir
-    };
+  async getServer(id) {
+    const data = await this.request("GET", `/servers/${id}`);
+    return data.server;
   }
-  if (options.proxy.onDemandTls) {
-    config.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
+  async createServer(options) {
+    const data = await this.request("POST", "/servers", {
+      name: options.name,
+      server_type: options.serverType,
+      image: options.image,
+      location: options.location,
+      datacenter: options.datacenter,
+      ssh_keys: options.sshKeys,
+      user_data: options.userData,
+      labels: options.labels,
+      firewalls: options.firewalls,
+      networks: options.networks,
+      start_after_create: true
+    });
+    return { server: data.server, action: data.action };
+  }
+  async listNetworks() {
+    const data = await this.request("GET", "/networks");
+    return data.networks;
+  }
+  async createNetwork(options) {
+    const ipRange = options.ipRange ?? "10.0.0.0/16";
+    const data = await this.request("POST", "/networks", {
+      name: options.name,
+      ip_range: ipRange,
+      subnets: [{ type: "cloud", ip_range: ipRange, network_zone: "eu-central" }],
+      labels: options.labels
+    });
+    return data.network;
+  }
+  async deleteNetwork(id) {
+    await this.request("DELETE", `/networks/${id}`);
+  }
+  async listLoadBalancers() {
+    const data = await this.request("GET", "/load_balancers");
+    return data.load_balancers;
+  }
+  async createLoadBalancer(options) {
+    const data = await this.request("POST", "/load_balancers", {
+      name: options.name,
+      load_balancer_type: options.type ?? "lb11",
+      location: options.location,
+      network_zone: options.network ? undefined : options.networkZone ?? "eu-central",
+      network: options.network,
+      labels: options.labels,
+      targets: [{ type: "label_selector", label_selector: { selector: options.labelSelector }, use_private_ip: !!options.network }],
+      services: options.services.map((s) => ({
+        protocol: s.protocol ?? "tcp",
+        listen_port: s.listenPort,
+        destination_port: s.destinationPort,
+        health_check: {
+          protocol: "http",
+          port: 80,
+          interval: 15,
+          timeout: 10,
+          retries: 3,
+          http: { path: "/", status_codes: ["2??", "3??"] }
+        }
+      }))
+    });
+    return data.load_balancer;
+  }
+  async deleteLoadBalancer(id) {
+    await this.request("DELETE", `/load_balancers/${id}`);
+  }
+  async deleteServer(id) {
+    const data = await this.request("DELETE", `/servers/${id}`);
+    return data.action;
+  }
+  async listFirewalls() {
+    const data = await this.request("GET", "/firewalls");
+    return data.firewalls;
+  }
+  async createFirewall(options) {
+    const data = await this.request("POST", "/firewalls", {
+      name: options.name,
+      rules: options.rules,
+      labels: options.labels,
+      apply_to: options.applyTo
+    });
+    return { firewall: data.firewall, actions: data.actions };
+  }
+  async setFirewallRules(firewallId, rules) {
+    const data = await this.request("POST", `/firewalls/${firewallId}/actions/set_rules`, {
+      rules
+    });
+    return data.actions ?? [];
+  }
+  async deleteFirewall(firewallId) {
+    await this.request("DELETE", `/firewalls/${firewallId}`);
+  }
+  async applyFirewallToResources(firewallId, applyTo) {
+    const data = await this.request("POST", `/firewalls/${firewallId}/actions/apply_to_resources`, {
+      apply_to: applyTo
+    });
+    return data.actions;
+  }
+  async listSshKeys() {
+    const data = await this.request("GET", "/ssh_keys");
+    return data.ssh_keys;
+  }
+  async createSshKey(options) {
+    const data = await this.request("POST", "/ssh_keys", {
+      name: options.name,
+      public_key: options.publicKey,
+      labels: options.labels
+    });
+    return data.ssh_key;
+  }
+  async waitForAction(actionId, options) {
+    const pollInterval = options?.pollIntervalMs ?? 2000;
+    const maxWait = options?.maxWaitMs ?? 300000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const data = await this.request("GET", `/actions/${actionId}`);
+      if (data.action.status === "success")
+        return data.action;
+      if (data.action.status === "error") {
+        throw new Error(data.action.error?.message || "Hetzner action failed");
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
   }
-  const cdn = options.proxy.cdn;
-  if (cdn?.secret && cdn.frontedHosts.length > 0) {
-    config.originGuard = {
-      header: cdn.secretHeader ?? "X-Origin-Verify",
-      value: cdn.secret,
-      hosts: cdn.frontedHosts
-    };
+  async waitForServerRunning(serverId, options) {
+    const pollInterval = options?.pollIntervalMs ?? 3000;
+    const maxWait = options?.maxWaitMs ?? 600000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const server = await this.getServer(serverId);
+      if (server.status === "running")
+        return server;
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
-  return config;
-}
-function buildRpxConfig(sites, options) {
-  return buildRpxConfigInternal(sites, options);
-}
-function buildRpxLbConfig(sites, appBoxes, options) {
-  return buildRpxConfigInternal(sites, options, appBoxes);
-}
-function renderRpxLauncher(config) {
-  const json = JSON.stringify(config, null, 2);
-  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
-// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
-import { startProxies } from '@stacksjs/rpx'
-
-const config = ${json} as const
-
-await startProxies(config as any)
-`;
 }
-var RPX_DIR = "/etc/rpx";
-var RPX_INSTALL_DIR = "/opt/rpx-gateway";
-var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
-var RPX_SERVICE_NAME = "rpx-gateway.service";
-var RPX_SITES_DIR = "/etc/rpx/sites.d";
-function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
-  return `// Generated by ts-cloud — rpx gateway assembler.
-// Merges every app's fragment in ${sitesDir} so independent deploys compose
-// without clobbering each other. Each deploy writes only its own <slug>.json.
-import { startProxies } from '@stacksjs/rpx'
-import { readdirSync, readFileSync } from 'node:fs'
-
-const dir = ${JSON.stringify(sitesDir)}
-const proxies = []
-const seen = new Set()
-const suffixes = new Set()
-const guardHosts = new Set()
-let email
-let certsDir = ${JSON.stringify(defaultCertsDir)}
-let acmeChallengeWebroot
-let guard
-let files = []
-try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
-for (const f of files) {
-  let frag
-  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) } catch { continue }
-  for (const p of frag.proxies ?? []) {
-    const key = p.id || (p.to + (p.path ?? ''))
-    if (seen.has(key)) continue
-    seen.add(key)
-    proxies.push(p)
-  }
-  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
-  email ??= frag.onDemandTls?.email
-  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
-  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
-  if (frag.originGuard) {
-    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
-    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+function resolveHetznerApiToken(configToken) {
+  const token = configToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
+  if (!token) {
+    throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
   }
+  return token;
 }
-const config = {
-  proxies,
-  productionCerts: { certsDir },
-  https: true,
-  hostsManagement: false,
-  cleanup: { hosts: false, certs: false },
-  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
-  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
-  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+function normalizeSshPublicKey(publicKey) {
+  const [type, body] = publicKey.trim().split(/\s+/);
+  return body ? `${type} ${body}` : type;
 }
 
-await startProxies(config)
-`;
-}
-function writeFileHeredoc(path, content, delimiter) {
-  return [
-    `cat > ${path} <<'${delimiter}'`,
-    content,
-    delimiter
-  ];
-}
-function certDomainsForConfig(config) {
-  const seen = new Set;
-  for (const r of config.proxies) {
-    const host = r.to;
-    if (!host || host.startsWith("*") || host.includes(":") || !host.includes("."))
-      continue;
-    seen.add(host);
-  }
-  return [...seen];
-}
-function buildCertManagementCommands(options) {
-  const { config, proxy } = options;
-  const webroot = config.acmeChallengeWebroot;
-  const domains = certDomainsForConfig(config);
-  if (!proxy.onDemandTls || !webroot || domains.length === 0)
-    return [];
-  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
-  const version = proxy.version ?? "latest";
-  const certsDir = config.productionCerts.certsDir;
-  const email = proxy.onDemandTlsEmail ?? `webmaster@${domains[0]}`;
-  const tlsxCli = `${bunBin} ${RPX_INSTALL_DIR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`;
-  const csv = domains.join(",");
-  const spaced = domains.join(" ");
-  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
-  const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
-  const renewServiceName = `rpx-cert-renew-${slug}.service`;
-  const renewTimerName = `rpx-cert-renew-${slug}.timer`;
-  const renewScript = [
-    "#!/bin/sh",
-    "# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.",
-    "# The running gateway serves the challenge from $WEBROOT on :80, so this needs",
-    "# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.",
-    "set -u",
-    `CERTS='${certsDir}'`,
-    `WEBROOT='${webroot}'`,
-    `EMAIL='${email}'`,
-    `TLSX="${tlsxCli}"`,
-    `DOMAINS='${csv}'`,
-    'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
-    `for d in ${spaced}; do`,
-    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
-    "done",
-    '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
-    'rm -f "$CERTS"/*.chain.crt',
-    'after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
-    `[ "$before" = "$after" ] || systemctl restart ${RPX_SERVICE_NAME}`
-  ].join(`
-`);
-  const renewService = [
-    "[Unit]",
-    `Description=Issue/renew rpx gateway TLS certs for ${slug} (tlsx http-01)`,
-    `After=network-online.target ${RPX_SERVICE_NAME}`,
-    "Wants=network-online.target",
-    "",
-    "[Service]",
-    "Type=oneshot",
-    `ExecStart=${renewScriptPath}`
-  ].join(`
-`);
-  const renewTimer = [
-    "[Unit]",
-    `Description=Daily rpx gateway TLS cert issuance/renewal for ${slug}`,
-    "",
-    "[Timer]",
-    "OnCalendar=*-*-* 03:30:00",
-    "RandomizedDelaySec=1h",
-    "Persistent=true",
-    "",
-    "[Install]",
-    "WantedBy=timers.target"
-  ].join(`
+// src/drivers/hetzner/cloud-init.ts
+function wrapCloudInitUserData(bootstrapScript) {
+  const scriptPath = "/var/lib/cloud/ts-cloud-bootstrap.sh";
+  const indented = bootstrapScript.split(`
+`).map((line) => `      ${line}`).join(`
 `);
-  return [
-    `mkdir -p ${webroot}`,
-    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/tlsx@${version}) || true`,
-    ...writeFileHeredoc(renewScriptPath, renewScript, "TS_CLOUD_RENEW_EOF"),
-    `chmod +x ${renewScriptPath}`,
-    ...writeFileHeredoc(`/etc/systemd/system/${renewServiceName}`, renewService, "TS_CLOUD_RENEW_SVC_EOF"),
-    ...writeFileHeredoc(`/etc/systemd/system/${renewTimerName}`, renewTimer, "TS_CLOUD_RENEW_TIMER_EOF"),
-    "systemctl daemon-reload",
-    `systemctl enable --now ${renewTimerName} || true`,
-    `${renewScriptPath} || true`
-  ];
-}
-function buildRpxProvisionScript(options) {
-  const { config, proxy } = options;
-  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
-  const version = proxy.version ?? "latest";
-  const certsDir = config.productionCerts.certsDir;
-  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
-  const fragment = JSON.stringify({ slug, ...config }, null, 2);
-  const assembler = renderRpxAssembler(RPX_SITES_DIR, certsDir);
-  const upstreamTimeout = proxy.upstreamTimeout ?? 60;
-  const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
-  if (typeof proxy.maxUpstreamConns === "number")
-    poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
-  return [
-    "set -euo pipefail",
-    `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
-    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
-    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version})`,
-    `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
-    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
-    ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
-    ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
-      "[Unit]",
-      "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
-      "After=network.target network-online.target",
-      "Wants=network-online.target",
-      "",
-      "[Service]",
-      "Type=simple",
-      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
-      `WorkingDirectory=${RPX_INSTALL_DIR}`,
-      `Environment=BUN_INSTALL=/root/.bun`,
-      ...poolEnv,
-      "Restart=always",
-      "RestartSec=5",
-      "LimitNOFILE=1048576",
-      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
-      "",
-      "[Install]",
-      "WantedBy=multi-user.target"
-    ].join(`
-`), "TS_CLOUD_RPX_UNIT_EOF"),
-    "systemctl daemon-reload",
-    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
-    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
-    `systemctl enable ${RPX_SERVICE_NAME}`,
-    `systemctl restart ${RPX_SERVICE_NAME}`,
-    ...buildCertManagementCommands(options)
-  ];
+  return `#cloud-config
+write_files:
+  - path: ${scriptPath}
+    permissions: '0755'
+    owner: root:root
+    content: |
+${indented}
+runcmd:
+  - [ bash, ${scriptPath} ]
+`;
 }
 
 // src/drivers/shared/fleet.ts
@@ -2435,7 +2441,7 @@ class HetznerDriver {
       versions: compute.php?.versions,
       default: compute.php?.default,
       extensions: compute.php?.extensions,
-      installNginx: compute.webServer !== "rpx",
+      installNginx: !usesRpxProxy(compute),
       optimizeForProduction: compute.php?.optimizeForProduction,
       ini: compute.php?.ini
     });
@@ -3019,11 +3025,20 @@ ${out}`);
     "-o",
     "LogLevel=ERROR"
   ];
+  static SSH_KEEPALIVE_OPTS = [
+    "-o",
+    "ConnectTimeout=30",
+    "-o",
+    "ServerAliveInterval=15",
+    "-o",
+    "ServerAliveCountMax=4"
+  ];
   sshBaseArgs(host, extra = []) {
     return [
       "-i",
       this.sshPrivateKeyPath,
       ...HetznerDriver.SSH_HOST_KEY_OPTS,
+      ...HetznerDriver.SSH_KEEPALIVE_OPTS,
       "-o",
       "BatchMode=yes",
       ...extra,
@@ -3031,16 +3046,27 @@ ${out}`);
     ];
   }
   scpToHost(host, localPath, remotePath) {
-    execSync([
+    const cmd = [
       "scp",
       "-i",
       this.sshPrivateKeyPath,
       ...HetznerDriver.SSH_HOST_KEY_OPTS,
+      ...HetznerDriver.SSH_KEEPALIVE_OPTS,
       "-o",
       "BatchMode=yes",
       localPath,
       `${this.sshUser}@${host}:${remotePath}`
-    ].map((arg) => `"${arg.replace(/"/g, "\\\"")}"`).join(" "), { stdio: "pipe", maxBuffer: SSH_MAX_BUFFER });
+    ].map((arg) => `"${arg.replace(/"/g, "\\\"")}"`).join(" ");
+    const attempts = 3;
+    for (let attempt = 1;attempt <= attempts; attempt++) {
+      try {
+        execSync(cmd, { stdio: "pipe", maxBuffer: SSH_MAX_BUFFER });
+        return;
+      } catch (error) {
+        if (attempt === attempts)
+          throw new Error(formatSshFailure(error));
+      }
+    }
   }
   sshExec(host, script) {
     const escaped = script.replace(/'/g, `'\\''`);
@@ -4398,7 +4424,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       appBase: appBase2,
       defaultPhpVersion: phpVersion
     });
-    const useNginx = compute2?.webServer !== "rpx";
+    const useNginx = !usesRpxProxy(compute2);
     const sslProvider = resolveSslProvider(site);
     const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
     const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase: appBase2 }) : [];
@@ -4480,7 +4506,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     healthCheckPath: site.healthCheck?.path
   });
   const compute = config.infrastructure?.compute;
-  const wantsNginxStatic = kind === "server-static" && compute?.webServer !== "rpx" && !!site.domain;
+  const wantsNginxStatic = kind === "server-static" && !usesRpxProxy(compute) && !!site.domain;
   const staticVhost = wantsNginxStatic ? buildNginxVhostScript({
     siteName,
     domain: site.domain,
@@ -4741,4 +4767,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };