@stacksjs/ts-cloud 0.7.17 → 0.7.18

package/dist/{chunk-qergre5a.js → chunk-vpyd42tp.js}

@@ -545,1578 +545,1584 @@ function buildNginxServiceScript(projectDir = "/opt/pantry") {
   ];
 }
 
-// src/drivers/shared/ufw.ts
-var UFW_BASE_PORTS = [80, 443];
-function buildUfwScript(firewall = {}) {
-  if (firewall.enabled === false)
-    return [];
-  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => p > 0).sort((a, b) => a - b);
-  const lines = [
-    "export DEBIAN_FRONTEND=noninteractive",
-    "apt-get install -y ufw",
-    "ufw default deny incoming",
-    "ufw default allow outgoing",
-    "ufw allow OpenSSH"
-  ];
-  for (const port of ports)
-    lines.push(`ufw allow ${port}/tcp`);
-  lines.push("ufw --force enable");
-  return lines;
-}
-
-// src/drivers/shared/maintenance.ts
-function buildAutoUpdatesScript(enabled2 = true) {
-  if (!enabled2)
-    return [];
-  return [
-    "export DEBIAN_FRONTEND=noninteractive",
-    "apt-get install -y unattended-upgrades",
-    "cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",
-    'APT::Periodic::Update-Package-Lists "1";',
-    'APT::Periodic::Unattended-Upgrade "1";',
-    'APT::Periodic::Download-Upgradeable-Packages "1";',
-    'APT::Periodic::AutocleanInterval "7";',
-    "TS_CLOUD_AUTOUPD_EOF",
-    "systemctl enable unattended-upgrades 2>/dev/null || true",
-    "systemctl restart unattended-upgrades 2>/dev/null || true"
-  ];
-}
-
-// src/drivers/shared/monitoring.ts
-var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
-var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
-var DEFAULT_CPU_LOAD_PER_CORE = 2;
-var DEFAULT_MEM_PERCENT = 90;
-var DEFAULT_DISK_PERCENT = 90;
-var SERVICE_PROBES = [
-  ["nginx", 80],
-  ["phpFpm", 9074],
-  ["mysql", 3306],
-  ["postgres", 5432],
-  ["redis", 6379],
-  ["meilisearch", 7700]
-];
-function resolveMonitoring(monitoring = true) {
-  const obj = typeof monitoring === "object" ? monitoring : {};
-  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
-  return {
-    enabled: enabled2,
-    cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
-    memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
-    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
-  };
+// src/deploy/site-target.ts
+function siteInstallBase(slug, siteName) {
+  return `/var/www/${slug}-${siteName}`;
 }
-function buildMonitoringScript(monitoring = true) {
-  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
-  if (!enabled2)
-    return [];
-  const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
-  const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
-  return [
-    "mkdir -p /var/lib/ts-cloud",
-    "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
-    "#!/bin/bash",
-    "set -uo pipefail",
-    "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
-    "CPUS=$(nproc)",
-    "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
-    "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
-    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
-    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
-    `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
-    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
-    `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
-    `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
-    "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
-    ...probeLines,
-    "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
-    "SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}",
-    "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
-    "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
-    `cat > ${METRICS_PATH}.tmp <<JSON`,
-    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
-    "JSON",
-    `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
-    'ALERTS=""',
-    `if awk -v l="$LOAD" -v c="$CPUS" -v t=${cpuLoadPerCore} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${cpuLoadPerCore}xCPU"; fi`,
-    `if [ "\${MEM_PCT:-0}" -ge ${memPercent} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,
-    `if [ "\${DISK_PCT:-0}" -ge ${diskPercent} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,
-    `PREV=$(cat ${ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
-    'if [ -n "$ALERTS" ]; then',
-    '  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',
-    `  echo alert > ${ALERT_STATE_PATH}`,
-    "else",
-    '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
-    `  echo ok > ${ALERT_STATE_PATH}`,
-    "fi",
-    "TS_CLOUD_METRICS_EOF",
-    "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
-    "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
-    "[Unit]",
-    "Description=ts-cloud metrics collector",
-    "",
-    "[Service]",
-    "Type=oneshot",
-    "ExecStart=/usr/local/bin/ts-cloud-metrics.sh",
-    "TS_CLOUD_METRICS_SVC_EOF",
-    "cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'",
-    "[Unit]",
-    "Description=Run ts-cloud metrics collector every minute",
-    "",
-    "[Timer]",
-    "OnBootSec=60",
-    "OnUnitActiveSec=60",
-    "",
-    "[Install]",
-    "WantedBy=timers.target",
-    "TS_CLOUD_METRICS_TMR_EOF",
-    "systemctl daemon-reload",
-    "systemctl enable ts-cloud-metrics.timer",
-    "systemctl start ts-cloud-metrics.timer"
-  ];
+var PHP_SITE_TYPES = new Set([
+  "laravel",
+  "php",
+  "statamic",
+  "wordpress"
+]);
+function isPhpSite(site) {
+  return site.type != null && PHP_SITE_TYPES.has(site.type);
 }
-
-// src/drivers/shared/ssh-keys.ts
-var BLOCK_BEGIN = "# >>> ts-cloud managed keys >>>";
-var BLOCK_END = "# <<< ts-cloud managed keys <<<";
-var DEFAULT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
-function buildAuthorizedKeysScript(keys = [], options = {}) {
-  if (keys.length === 0)
-    return [];
-  const path = options.path ?? DEFAULT_AUTHORIZED_KEYS;
-  const dir = path.replace(/\/[^/]*$/, "");
-  const block = [
-    BLOCK_BEGIN,
-    ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`),
-    BLOCK_END
-  ].join(`
-`);
-  return [
-    `mkdir -p ${dir}`,
-    `touch ${path}`,
-    `sed -i '/^${escapeSed(BLOCK_BEGIN)}$/,/^${escapeSed(BLOCK_END)}$/d' ${path}`,
-    `cat >> ${path} <<'TS_CLOUD_KEYS_EOF'`,
-    block,
-    "TS_CLOUD_KEYS_EOF",
-    `chmod 600 ${path}`
-  ];
+function resolveSiteDeployTarget(site) {
+  if (site.deploy)
+    return site.deploy;
+  if (isPhpSite(site))
+    return "server";
+  if (site.start)
+    return "server";
+  return "bucket";
 }
-function escapeSed(value) {
-  return value.replace(/[.*[\]\\/^$]/g, "\\$&");
+function resolveSiteKind(site) {
+  if (site.redirect)
+    return "redirect";
+  if (isPhpSite(site))
+    return "server-php";
+  const target = resolveSiteDeployTarget(site);
+  if (target === "bucket")
+    return "bucket";
+  return site.start ? "server-app" : "server-static";
 }
-
-// src/drivers/shared/notifications.ts
-function wantsEvent(config, event) {
-  return !config.events || config.events.includes(event);
+function hasComputeConfigured(config) {
+  return config.infrastructure?.compute != null;
 }
-async function sendNotifications(config, event, message, options = {}) {
-  if (!config)
-    return [];
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  const attempted = [];
-  const tasks = [];
-  const post = (url, body) => fetchImpl(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }).catch(() => {
-    return;
-  });
-  if (config.slack?.webhookUrl && wantsEvent(config, event)) {
-    attempted.push("slack");
-    tasks.push(post(config.slack.webhookUrl, { text: message }));
-  }
-  if (config.discord?.webhookUrl && wantsEvent(config, event)) {
-    attempted.push("discord");
-    tasks.push(post(config.discord.webhookUrl, { content: message }));
-  }
-  if (config.telegram?.botToken && config.telegram.chatId && wantsEvent(config, event)) {
-    attempted.push("telegram");
-    const url = `https://api.telegram.org/bot${config.telegram.botToken}/sendMessage`;
-    tasks.push(post(url, { chat_id: config.telegram.chatId, text: message }));
-  }
-  if (config.webhook?.url && wantsEvent(config, event)) {
-    attempted.push("webhook");
-    if ((config.webhook.method || "POST") === "GET") {
-      const sep = config.webhook.url.includes("?") ? "&" : "?";
-      const url = `${config.webhook.url}${sep}event=${encodeURIComponent(event)}&message=${encodeURIComponent(message)}`;
-      tasks.push(fetchImpl(url, { method: "GET" }).catch(() => {
-        return;
-      }));
-    } else {
-      tasks.push(post(config.webhook.url, { event, message }));
+function validateDeploymentConfig(config) {
+  const errors = [];
+  const warnings = [];
+  const sites = config.sites || {};
+  const computeConfigured = hasComputeConfigured(config);
+  const coexistence = deploymentCoexistenceError(config);
+  if (coexistence)
+    errors.push(coexistence);
+  const portOwners = new Map;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site) {
+      continue;
     }
-  }
-  if (config.email?.to && wantsEvent(config, event)) {
-    attempted.push("email");
-    tasks.push(sendEmailNotification(config.email, event, message));
-  }
-  await Promise.all(tasks);
-  return attempted;
-}
-async function sendEmailNotification(email, event, message) {
-  try {
-    const mod = await import("./chunk-pqfzdg68.js");
-    await mod.email.send({
-      to: email.to,
-      from: email.from,
-      subject: `[ts-cloud] ${event}`,
-      text: message
-    });
-  } catch {}
-}
-function resolveNotifications(project, site) {
-  return site ?? project;
-}
-function buildNotifierScript(config) {
-  if (!config)
-    return [];
-  const curls = [];
-  if (config.slack?.webhookUrl)
-    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${config.slack.webhookUrl} || true`);
-  if (config.discord?.webhookUrl)
-    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${config.discord.webhookUrl} || true`);
-  if (config.telegram?.botToken && config.telegram.chatId)
-    curls.push(`curl -fsS -X POST "https://api.telegram.org/bot${config.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${config.telegram.chatId}" --data-urlencode "text=$MSG" || true`);
-  if (config.webhook?.url)
-    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${config.webhook.url} || true`);
-  if (curls.length === 0)
-    return [];
-  return [
-    "cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'",
-    "#!/bin/bash",
-    'MSG="$1"',
-    ...curls,
-    "TS_CLOUD_NOTIFY_EOF",
-    "chmod +x /usr/local/bin/ts-cloud-notify"
-  ];
+    const target = resolveSiteDeployTarget(site);
+    const kind = resolveSiteKind(site);
+    if (kind === "redirect") {
+      if (!site.domain)
+        errors.push(`Site '${name}' is a redirect site but has no \`domain\` to redirect from.`);
+      const to = typeof site.redirect === "string" ? site.redirect : site.redirect?.to;
+      if (!to)
+        errors.push(`Site '${name}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (site.root)
+        serverOnly.push("root");
+      if (serverOnly.length > 0)
+        warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
+      continue;
+    }
+    if (target === "server" && !site.start && !site.root) {
+      errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
+      continue;
+    }
+    if (kind === "server-php") {
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);
+      }
+      if (!site.repository?.url) {
+        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`);
+      }
+    } else if (kind === "server-app") {
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' deploys to a server (deploy:'server'${site.deploy ? "" : " inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
+      }
+      if (typeof site.port === "number") {
+        const existing = portOwners.get(site.port);
+        if (existing) {
+          errors.push(`Sites '${existing}' and '${name}' both use port ${site.port}. Server apps sharing a box must use distinct ports.`);
+        } else {
+          portOwners.set(site.port, name);
+        }
+      }
+    } else if (kind === "server-static") {
+      if (!site.root) {
+        errors.push(`Site '${name}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);
+      }
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
+      }
+    } else {
+      if (!site.root) {
+        errors.push(`Site '${name}' deploys to a bucket but has no \`root\` directory to upload.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (typeof site.port === "number")
+        serverOnly.push("port");
+      if (site.preStart && site.preStart.length > 0)
+        serverOnly.push("preStart");
+      if (serverOnly.length > 0) {
+        warnings.push(`Site '${name}' deploys to a bucket but sets server-only field(s): ${serverOnly.join(", ")}. These are ignored. Set deploy:'server' to use them.`);
+      }
+    }
+  }
+  return { errors, warnings };
 }
 
-// src/drivers/shared/backups.ts
-var BACKUP_OUTPUT_DIR = "/var/backups/ts-cloud";
-var BACKUP_CONFIG_PATH = "/etc/ts-cloud/backups.config.ts";
-var BACKUP_CRON_PATH = "/etc/cron.d/ts-cloud-backups";
-var BACKUP_RUNNER_PATH = "/usr/local/bin/ts-cloud-backup.sh";
-function backupEntryFor(database) {
-  if (!database.name)
-    return null;
-  const host = database.host || "127.0.0.1";
-  const isPostgres = database.engine === "postgres";
-  const type = isPostgres ? "postgresql" : "mysql";
-  const port = database.port ?? (isPostgres ? 5432 : 3306);
-  const ts = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-  return [
-    "  {",
-    `    type: '${type}',`,
-    `    name: '${ts(database.name)}',`,
-    "    connection: {",
-    `      hostname: '${ts(host)}',`,
-    `      port: ${port},`,
-    `      database: '${ts(database.name)}',`,
-    `      username: '${ts(database.username || database.name)}',`,
-    `      password: '${ts(database.password || "")}',`,
-    "      ssl: false,",
-    "    },",
-    "    includeSchema: true,",
-    "    includeData: true,",
-    "  },"
-  ].join(`
-`);
+// src/drivers/shared/rpx-gateway.ts
+var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
+function normalizeSiteRedirect(input) {
+  if (typeof input === "string")
+    return { to: input };
+  const out = { to: input.to };
+  if (input.status != null)
+    out.status = input.status;
+  if (input.preservePath != null)
+    out.preservePath = input.preservePath;
+  return out;
 }
-function buildBackupsConfigTs(database, backups) {
-  const entry = database ? backupEntryFor(database) : null;
-  const destinations = backups.bucket ? [
-    "  destinations: [",
-    "    {",
-    "      type: 's3',",
-    `      bucket: '${backups.bucket}',`,
-    "      prefix: 'db-backups',",
-    ...backups.endpoint ? [`      endpoint: '${backups.endpoint}',`] : [],
-    "      optional: false,",
-    "    },",
-    "  ],"
-  ] : [];
-  return [
-    "import type { BackupConfig } from 'ts-backups'",
-    "",
-    "const config: BackupConfig = {",
-    "  verbose: true,",
-    `  outputPath: '${BACKUP_OUTPUT_DIR}',`,
-    "  retention: {",
-    `    count: ${backups.retentionCount ?? 5},`,
-    `    maxAge: ${backups.retentionDays ?? 30},`,
-    "  },",
-    "  databases: [",
-    ...entry ? [entry] : [],
-    "  ],",
-    ...destinations,
-    "}",
-    "",
-    "export default config",
-    ""
-  ].join(`
-`);
+function resolveRouteAuth(site) {
+  const auth = site.auth;
+  if (!auth || auth.enabled === false || !auth.password)
+    return;
+  return {
+    username: auth.username || "admin",
+    password: auth.password,
+    ...auth.realm ? { realm: auth.realm } : {}
+  };
 }
-function buildBackupProvisionScript(options) {
-  const { database, backups } = options;
-  if (!backups.enabled)
-    return [];
-  const schedule = backups.schedule || "0 2 * * *";
-  const configTs = buildBackupsConfigTs(database, backups);
-  return [
-    "export DEBIAN_FRONTEND=noninteractive",
-    `mkdir -p /etc/ts-cloud ${BACKUP_OUTPUT_DIR}`,
-    "command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)",
-    "bun add -g ts-backups || true",
-    `cat > ${BACKUP_CONFIG_PATH} <<'TS_CLOUD_BACKUP_CFG_EOF'`,
-    configTs.replace(/\n$/, ""),
-    "TS_CLOUD_BACKUP_CFG_EOF",
-    `cat > ${BACKUP_RUNNER_PATH} <<'TS_CLOUD_BACKUP_RUN_EOF'`,
-    "#!/bin/bash",
-    "set -uo pipefail",
-    'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"',
-    'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',
-    "cd /etc/ts-cloud",
-    'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',
-    "TS_CLOUD_BACKUP_RUN_EOF",
-    `chmod +x ${BACKUP_RUNNER_PATH}`,
-    `cat > ${BACKUP_CRON_PATH} <<'TS_CLOUD_BACKUP_CRON_EOF'`,
-    `${schedule} root ${BACKUP_RUNNER_PATH} >> /var/log/ts-cloud-backup.log 2>&1`,
-    "TS_CLOUD_BACKUP_CRON_EOF",
-    `chmod 644 ${BACKUP_CRON_PATH}`
-  ];
+function normalizeRoutePath(path) {
+  if (!path || path === "/")
+    return;
+  let p = `/${path}`.replace(/\/+/g, "/").replace(/\/+$/, "");
+  if (!p.startsWith("/"))
+    p = `/${p}`;
+  return p === "" || p === "/" ? undefined : p;
 }
-function engineSocket(engine) {
-  return engine === "mariadb" ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
+function deriveRouteId(to, path) {
+  const base = path ? `${to}${path}` : to;
+  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
+  return cleaned.length > 0 ? cleaned : "rpx";
 }
-function buildBackupRestoreScript(database, options = {}) {
-  if (!database?.name)
-    return [];
-  const name = database.name;
-  const isPg = database.engine === "postgres";
-  const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
-  const client = isPg ? `psql -h 127.0.0.1 -p ${database.port ?? 5432} -U postgres -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
-  return [
-    "set -uo pipefail",
-    'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
-    locate,
-    '[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }',
-    'echo "[ts-cloud] restoring ' + name + ' from $TS_CLOUD_DUMP"',
-    `case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${client}`,
-    'echo "restore complete"'
-  ];
+function resolveServerAppFrom(port, appBoxes) {
+  if (!appBoxes || appBoxes.length === 0)
+    return `localhost:${port}`;
+  return appBoxes.map((box) => `${box.privateIp ?? box.publicIp}:${port}`);
 }
-
-// src/drivers/shared/compute-provision.ts
-function buildComputeProvisionScripts(config) {
-  const compute = config.infrastructure?.compute ?? {};
-  const phpBox = compute.runtime === "php" || !!compute.php;
-  const needsPantry = phpBox || !!compute.managedServices;
-  const pantryBootstrap = needsPantry ? buildPantryBootstrapScript() : [];
-  const useNginx = compute.webServer !== "rpx";
-  const phpProvision = phpBox ? [
-    ...pantryBootstrap,
-    ...buildPhpProvisionScript({
-      versions: compute.php?.versions,
-      default: compute.php?.default,
-      extensions: compute.php?.extensions,
-      installNginx: useNginx,
-      optimizeForProduction: compute.php?.optimizeForProduction,
-      ini: compute.php?.ini
-    }),
-    ...useNginx ? buildNginxServiceScript() : []
-  ] : undefined;
-  const extras = [];
-  if (!phpBox && needsPantry)
-    extras.push(...pantryBootstrap);
-  extras.push(...buildNotifierScript(config.notifications));
-  if (compute.managedServices) {
-    extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices));
-  }
-  extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
-  extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
-  extras.push(...buildMonitoringScript(compute.monitoring ?? phpBox));
-  extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
-  if (compute.backups?.enabled) {
-    extras.push(...buildBackupProvisionScript({
-      database: config.infrastructure?.appDatabase,
-      backups: compute.backups
-    }));
-  }
-  return {
-    runtime: compute.runtime || "bun",
-    runtimeVersion: compute.runtimeVersion || "latest",
-    phpBox,
-    phpProvision,
-    servicesProvision: extras.length > 0 ? extras : undefined
-  };
-}
-
-// src/drivers/shared/ubuntu-bootstrap.ts
-function buildUbuntuBootstrapScript(options = {}) {
-  const {
-    runtime = "bun",
-    runtimeVersion = "latest",
-    systemPackages = [],
-    database,
-    phpProvision,
-    servicesProvision,
-    caddyfile,
-    rpxProvision,
-    baked = false
-  } = options;
-  const packages = new Set(systemPackages);
-  if (database === "sqlite")
-    packages.add("sqlite3");
-  else if (database === "mysql")
-    packages.add("mysql-client");
-  else if (database === "postgres")
-    packages.add("postgresql-client");
-  let script = `#!/bin/bash
-set -euo pipefail
-`;
-  if (!baked) {
-    script += `
-export DEBIAN_FRONTEND=noninteractive
-apt-get update -y
-apt-get upgrade -y
-apt-get install -y curl tar gzip unzip git ca-certificates
-`;
-    if (packages.size > 0) {
-      script += `
-apt-get install -y ${[...packages].join(" ")}
-`;
-    }
-    if (phpProvision && phpProvision.length > 0) {
-      script += `
-${phpProvision.join(`
-`)}
-`;
+function buildRpxConfigInternal(sites, options, appBoxes) {
+  const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
+  const installSlug = options.slug ?? "app";
+  const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
+  const loadBalancer = options.proxy.loadBalancer;
+  const proxies = [];
+  const domains = new Set;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site || !site.domain)
+      continue;
+    const kind = resolveSiteKind(site);
+    if (kind === "bucket")
+      continue;
+    const path = normalizeRoutePath(site.path);
+    const id = deriveRouteId(site.domain, path);
+    const auth = resolveRouteAuth(site);
+    if (kind === "redirect") {
+      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
+      domains.add(site.domain);
+      continue;
     }
-    if (servicesProvision && servicesProvision.length > 0) {
-      script += `
-${servicesProvision.join(`
-`)}
-`;
+    if (kind === "server-app") {
+      if (typeof site.port !== "number")
+        continue;
+      const from = resolveServerAppFrom(site.port, appBoxes);
+      proxies.push({
+        to: site.domain,
+        path,
+        from,
+        id,
+        ...auth ? { auth } : {},
+        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
+      });
+    } else {
+      proxies.push({
+        to: site.domain,
+        path,
+        static: {
+          dir: `${wwwRoot}/${installSlug}-${name}/current`,
+          spa: site.spa ?? false,
+          pathRewriteStyle: site.pathRewriteStyle ?? "directory"
+        },
+        cleanUrls: site.pathRewriteStyle !== "flat",
+        ...auth ? { auth } : {},
+        id
+      });
     }
-    if (runtime === "bun") {
-      script += `
-# cloud-init runs this with \`set -u\` and NO $HOME set. bun's install.sh
-# dereferences $HOME even when BUN_INSTALL is set, so without this the install
-# aborts with "HOME: unbound variable" and /usr/local/bin/bun never appears —
-# breaking a from-scratch provision (adopting an existing box masked it).
-export HOME="\${HOME:-/root}"
-export BUN_INSTALL="/root/.bun"
-# bun.sh's installer references $HOME internally and runs under this
-# script's \`set -u\` (inherited by the piped bash) — cloud-init's runcmd
-# environment doesn't export HOME by default, so without this the
-# installer dies with "HOME: unbound variable" partway through (after
-# the binary is already downloaded, so it looks like a partial success)
-# and \`set -e\` aborts everything after it: the bun symlink, /var/www +
-# /var/ts-cloud dirs, and the whole rpx gateway install/systemd setup
-# never run. Confirmed against a real Hetzner box (stacksjs/status#1
-# Phase 9 e2e deploy) — cloud-init reported success with none of that
-# actually done.
-export HOME="\${HOME:-/root}"
-curl -fsSL https://bun.sh/install | bash${runtimeVersion === "latest" ? "" : ` -s "bun-v${runtimeVersion}"`}
-ln -sf /root/.bun/bin/bun /usr/local/bin/bun
-echo 'export BUN_INSTALL="/root/.bun"' > /etc/profile.d/bun.sh
-echo 'export PATH="$BUN_INSTALL/bin:$PATH"' >> /etc/profile.d/bun.sh
-`;
-    } else if (runtime === "node") {
-      const nodeMajor = runtimeVersion === "latest" || !runtimeVersion ? "20" : runtimeVersion.split(".")[0];
-      script += `
-curl -fsSL https://deb.nodesource.com/setup_${nodeMajor}.x | bash -
-apt-get install -y nodejs
-ln -sf /usr/bin/node /usr/local/bin/node
-ln -sf /usr/bin/npm /usr/local/bin/npm
-`;
-    } else if (runtime === "deno") {
-      script += `
-curl -fsSL https://deno.land/install.sh | sh
-ln -sf /root/.deno/bin/deno /usr/local/bin/deno
-`;
+    domains.add(site.domain);
+  }
+  if (options.proxy.autoWww !== false) {
+    for (const domain of [...domains]) {
+      if (domain.split(".").length !== 2)
+        continue;
+      const wwwDomain = `www.${domain}`;
+      if (domains.has(wwwDomain))
+        continue;
+      proxies.push({ to: wwwDomain, redirect: { to: `https://${domain}` }, id: deriveRouteId(wwwDomain) });
+      domains.add(wwwDomain);
     }
   }
-  script += `
-mkdir -p /var/www /var/ts-cloud/staging /var/ts-cloud/releases
-`;
-  if (caddyfile) {
-    const escaped = caddyfile.replace(/\$/g, "\\$");
-    script += `
-ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=\${ARCH}" -o /usr/local/bin/caddy
-chmod +x /usr/local/bin/caddy
-
-getent group caddy >/dev/null || groupadd --system caddy
-getent passwd caddy >/dev/null || useradd --system --gid caddy \\
-  --create-home --home-dir /var/lib/caddy \\
-  --shell /usr/sbin/nologin --comment "Caddy web server" caddy
-
-mkdir -p /etc/caddy /var/lib/caddy /var/log/caddy
-chown -R caddy:caddy /var/lib/caddy /var/log/caddy
-
-cat > /etc/systemd/system/caddy.service <<'CADDY_UNIT_EOF'
-[Unit]
-Description=Caddy
-Documentation=https://caddyserver.com/docs/
-After=network.target network-online.target
-Requires=network-online.target
-
-[Service]
-Type=notify
-User=caddy
-Group=caddy
-ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
-ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
-TimeoutStopSec=5s
-LimitNOFILE=1048576
-PrivateTmp=true
-ProtectSystem=full
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target
-CADDY_UNIT_EOF
-
-cat > /etc/caddy/Caddyfile <<'CADDY_CONFIG_EOF'
-${escaped}
-CADDY_CONFIG_EOF
-
-systemctl daemon-reload
-systemctl enable caddy
-systemctl start caddy
-`;
+  proxies.sort((a, b) => {
+    if (a.to !== b.to)
+      return a.to.localeCompare(b.to);
+    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
+  });
+  const config = {
+    proxies,
+    productionCerts: { certsDir },
+    https: true,
+    hostsManagement: false,
+    cleanup: { hosts: false, certs: false }
+  };
+  if (options.proxy.onDemandTls && domains.size > 0) {
+    config.onDemandTls = {
+      enabled: true,
+      allowedSuffixes: [...domains],
+      email: options.proxy.onDemandTlsEmail,
+      certsDir
+    };
   }
-  if (rpxProvision && rpxProvision.length > 0) {
-    const body = rpxProvision[0] === "set -euo pipefail" ? rpxProvision.slice(1) : rpxProvision;
-    script += `
-${body.join(`
-`)}
-`;
+  if (options.proxy.onDemandTls) {
+    config.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
   }
-  script += `
-echo "ts-cloud bootstrap complete — instance is ready for site deploys"
-`;
-  return script;
+  const cdn = options.proxy.cdn;
+  if (cdn?.secret && cdn.frontedHosts.length > 0) {
+    config.originGuard = {
+      header: cdn.secretHeader ?? "X-Origin-Verify",
+      value: cdn.secret,
+      hosts: cdn.frontedHosts
+    };
+  }
+  return config;
+}
+function buildRpxConfig(sites, options) {
+  return buildRpxConfigInternal(sites, options);
 }
+function buildRpxLbConfig(sites, appBoxes, options) {
+  return buildRpxConfigInternal(sites, options, appBoxes);
+}
+function renderRpxLauncher(config) {
+  const json = JSON.stringify(config, null, 2);
+  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
+// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
+import { startProxies } from '@stacksjs/rpx'
 
-// src/drivers/aws/provision.ts
-var UBUNTU_AMI_SSM_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
-function awsComputeIngressRules(config) {
-  const rules = [
-    { port: 22, protocol: "tcp", cidr: "0.0.0.0/0" },
-    { port: 80, protocol: "tcp", cidr: "0.0.0.0/0" },
-    { port: 443, protocol: "tcp", cidr: "0.0.0.0/0" }
-  ];
-  const extra = new Set;
-  for (const site of Object.values(config.sites || {})) {
-    if (site && typeof site.port === "number" && ![22, 80, 443].includes(site.port))
-      extra.add(site.port);
-  }
-  for (const port of extra)
-    rules.push({ port, protocol: "tcp", cidr: "0.0.0.0/0" });
-  return rules;
+const config = ${json} as const
+
+await startProxies(config as any)
+`;
 }
-function buildAwsUserData(config) {
-  const compute = config.infrastructure?.compute ?? {};
-  const provision = buildComputeProvisionScripts(config);
-  return buildUbuntuBootstrapScript({
-    runtime: provision.runtime,
-    runtimeVersion: provision.runtimeVersion,
-    systemPackages: compute.systemPackages,
-    database: config.infrastructure?.database,
-    phpProvision: provision.phpProvision,
-    servicesProvision: provision.servicesProvision,
-    baked: compute.bakedImage === true
-  });
+function usesRpxProxy(compute) {
+  return compute?.webServer === "rpx" || compute?.proxy?.engine === "rpx";
 }
-function encodeUserData(userData) {
-  return Buffer.from(userData, "utf8").toString("base64");
+var RPX_DIR = "/etc/rpx";
+var RPX_INSTALL_DIR = "/opt/rpx-gateway";
+var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
+var RPX_SERVICE_NAME = "rpx-gateway.service";
+var RPX_SITES_DIR = "/etc/rpx/sites.d";
+function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
+  return `// Generated by ts-cloud — rpx gateway assembler.
+// Merges every app's fragment in ${sitesDir} so independent deploys compose
+// without clobbering each other. Each deploy writes only its own <slug>.json.
+import { startProxies } from '@stacksjs/rpx'
+import { readdirSync, readFileSync } from 'node:fs'
+
+const dir = ${JSON.stringify(sitesDir)}
+const proxies = []
+const seen = new Set()
+const suffixes = new Set()
+const guardHosts = new Set()
+let email
+let certsDir = ${JSON.stringify(defaultCertsDir)}
+let acmeChallengeWebroot
+let guard
+let files = []
+try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
+for (const f of files) {
+  let frag
+  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) } catch { continue }
+  for (const p of frag.proxies ?? []) {
+    const key = p.id || (p.to + (p.path ?? ''))
+    if (seen.has(key)) continue
+    seen.add(key)
+    proxies.push(p)
+  }
+  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
+  email ??= frag.onDemandTls?.email
+  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
+  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
+  if (frag.originGuard) {
+    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
+    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+  }
 }
-function resolveAwsImageId(config) {
-  return config.infrastructure?.compute?.image ?? null;
+const config = {
+  proxies,
+  productionCerts: { certsDir },
+  https: true,
+  hostsManagement: false,
+  cleanup: { hosts: false, certs: false },
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
+  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
+  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
 }
 
-// src/drivers/aws/driver.ts
-function readPinnedInstanceId(stackName) {
-  try {
-    const raw = readFileSync(join(process.cwd(), ".ts-cloud/state", `${stackName}.json`), "utf8");
-    const state = JSON.parse(raw);
-    return typeof state.instanceId === "string" && state.instanceId.length > 0 ? state.instanceId : null;
-  } catch {
-    return null;
+await startProxies(config)
+`;
+}
+function writeFileHeredoc(path, content, delimiter) {
+  return [
+    `cat > ${path} <<'${delimiter}'`,
+    content,
+    delimiter
+  ];
+}
+function certDomainsForConfig(config) {
+  const seen = new Set;
+  for (const r of config.proxies) {
+    const host = r.to;
+    if (!host || host.startsWith("*") || host.includes(":") || !host.includes("."))
+      continue;
+    seen.add(host);
   }
+  return [...seen];
+}
+function buildCertManagementCommands(options) {
+  const { config, proxy } = options;
+  const webroot = config.acmeChallengeWebroot;
+  const domains = certDomainsForConfig(config);
+  if (!proxy.onDemandTls || !webroot || domains.length === 0)
+    return [];
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version = proxy.version ?? "latest";
+  const certsDir = config.productionCerts.certsDir;
+  const email = proxy.onDemandTlsEmail ?? `webmaster@${domains[0]}`;
+  const tlsxCli = `${bunBin} ${RPX_INSTALL_DIR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`;
+  const csv = domains.join(",");
+  const spaced = domains.join(" ");
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
+  const renewServiceName = `rpx-cert-renew-${slug}.service`;
+  const renewTimerName = `rpx-cert-renew-${slug}.timer`;
+  const renewScript = [
+    "#!/bin/sh",
+    "# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.",
+    "# The running gateway serves the challenge from $WEBROOT on :80, so this needs",
+    "# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.",
+    "set -u",
+    `CERTS='${certsDir}'`,
+    `WEBROOT='${webroot}'`,
+    `EMAIL='${email}'`,
+    `TLSX="${tlsxCli}"`,
+    `DOMAINS='${csv}'`,
+    'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `for d in ${spaced}; do`,
+    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    "done",
+    '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
+    'rm -f "$CERTS"/*.chain.crt',
+    'after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `[ "$before" = "$after" ] || systemctl restart ${RPX_SERVICE_NAME}`
+  ].join(`
+`);
+  const renewService = [
+    "[Unit]",
+    `Description=Issue/renew rpx gateway TLS certs for ${slug} (tlsx http-01)`,
+    `After=network-online.target ${RPX_SERVICE_NAME}`,
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    `ExecStart=${renewScriptPath}`
+  ].join(`
+`);
+  const renewTimer = [
+    "[Unit]",
+    `Description=Daily rpx gateway TLS cert issuance/renewal for ${slug}`,
+    "",
+    "[Timer]",
+    "OnCalendar=*-*-* 03:30:00",
+    "RandomizedDelaySec=1h",
+    "Persistent=true",
+    "",
+    "[Install]",
+    "WantedBy=timers.target"
+  ].join(`
+`);
+  return [
+    `mkdir -p ${webroot}`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/tlsx@${version}) || true`,
+    ...writeFileHeredoc(renewScriptPath, renewScript, "TS_CLOUD_RENEW_EOF"),
+    `chmod +x ${renewScriptPath}`,
+    ...writeFileHeredoc(`/etc/systemd/system/${renewServiceName}`, renewService, "TS_CLOUD_RENEW_SVC_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${renewTimerName}`, renewTimer, "TS_CLOUD_RENEW_TIMER_EOF"),
+    "systemctl daemon-reload",
+    `systemctl enable --now ${renewTimerName} || true`,
+    `${renewScriptPath} || true`
+  ];
+}
+function buildRpxProvisionScript(options) {
+  const { config, proxy } = options;
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version = proxy.version ?? "latest";
+  const certsDir = config.productionCerts.certsDir;
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const fragment = JSON.stringify({ slug, ...config }, null, 2);
+  const assembler = renderRpxAssembler(RPX_SITES_DIR, certsDir);
+  const upstreamTimeout = proxy.upstreamTimeout ?? 60;
+  const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
+  if (typeof proxy.maxUpstreamConns === "number")
+    poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
+    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version})`,
+    `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
+    ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
+      "[Unit]",
+      "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
+      "After=network.target network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      "Type=simple",
+      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
+      `WorkingDirectory=${RPX_INSTALL_DIR}`,
+      `Environment=BUN_INSTALL=/root/.bun`,
+      ...poolEnv,
+      "Restart=always",
+      "RestartSec=5",
+      "LimitNOFILE=1048576",
+      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target"
+    ].join(`
+`), "TS_CLOUD_RPX_UNIT_EOF"),
+    "systemctl daemon-reload",
+    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
+    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
+    `systemctl enable ${RPX_SERVICE_NAME}`,
+    `systemctl restart ${RPX_SERVICE_NAME}`,
+    ...buildCertManagementCommands(options)
+  ];
 }
 
-class AwsDriver {
-  name = "aws";
-  usesCloudFormation = true;
-  region;
-  constructor(options = {}) {
-    this.region = options.region || "us-east-1";
-  }
-  resolveRegion(config) {
-    return config.project.region || this.region;
-  }
-  async provisionComputeInfrastructure(options) {
-    const { config, environment } = options;
-    const region = this.resolveRegion(config);
-    const slug = config.project.slug;
-    const compute = config.infrastructure?.compute;
-    if (!compute)
-      throw new Error("infrastructure.compute is required to provision AWS compute");
-    const ec2 = new EC2Client(region);
-    const existing = await this.findComputeTargets({ slug, environment, role: "app" });
-    if (existing.length > 0) {
-      const first = existing[0];
-      return { appInstanceId: first.id, appPublicIp: first.publicIp, sshUser: "ubuntu", deployStoragePath: "/var/ts-cloud/staging" };
-    }
-    let imageId = resolveAwsImageId(config);
-    if (!imageId) {
-      const ssm = new SSMClient(region);
-      const param = await ssm.getParameter({ Name: UBUNTU_AMI_SSM_PARAM });
-      imageId = param.Parameter?.Value ?? null;
-      if (!imageId)
-        throw new Error("Could not resolve the Ubuntu 24.04 AMI from SSM");
-    }
-    const vpcs = await ec2.describeVpcs();
-    const vpc = (vpcs.Vpcs || []).find((v) => v.IsDefault) || (vpcs.Vpcs || [])[0];
-    if (!vpc?.VpcId)
-      throw new Error("No VPC found to launch the instance into");
-    const subnets = (await ec2.describeSubnets({ Filters: [{ Name: "vpc-id", Values: [vpc.VpcId] }] })).Subnets || [];
-    const subnet = subnets.find((s) => s.MapPublicIpOnLaunch) || subnets[0];
-    const subnetId = subnet?.SubnetId;
-    if (!subnet?.MapPublicIpOnLaunch)
-      console.warn("ts-cloud: no public subnet found; the instance may not get a public IP (deploys/SSL need one).");
-    const sgName = `${slug}-${environment}-app-sg`;
-    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }, { Name: "vpc-id", Values: [vpc.VpcId] }] });
-    let groupId = found.SecurityGroups?.[0]?.GroupId;
-    if (!groupId) {
-      const created = await ec2.createSecurityGroup({ GroupName: sgName, Description: `ts-cloud ${slug}/${environment} app`, VpcId: vpc.VpcId });
-      groupId = created.GroupId;
-    }
-    const rules = awsComputeIngressRules(config);
-    await ec2.authorizeSecurityGroupIngress({
-      GroupId: groupId,
-      IpPermissions: rules.map((r) => ({ IpProtocol: r.protocol, FromPort: r.port, ToPort: r.port, IpRanges: [{ CidrIp: r.cidr }] }))
-    }).catch((e) => {
-      if (!/InvalidPermission\.Duplicate/.test(e instanceof Error ? e.message : ""))
-        throw e;
-    });
-    const userData = encodeUserData(buildAwsUserData(config));
-    const instanceType = compute.server?.instanceType || "t3.small";
-    const run = await ec2.runInstances({
-      ImageId: imageId,
-      InstanceType: instanceType,
-      MinCount: 1,
-      MaxCount: 1,
-      SecurityGroupIds: groupId ? [groupId] : undefined,
-      SubnetId: subnetId,
-      UserData: userData,
-      IamInstanceProfile: compute.server?.iamInstanceProfile ? { Name: compute.server.iamInstanceProfile } : undefined,
-      TagSpecifications: [{
-        ResourceType: "instance",
-        Tags: [
-          { Key: "Name", Value: `${slug}-${environment}-app` },
-          { Key: "Project", Value: slug },
-          { Key: "Environment", Value: environment },
-          { Key: "Role", Value: "app" }
-        ]
-      }]
-    });
-    const instanceId = run.Instances?.[0]?.InstanceId;
-    if (!instanceId)
-      throw new Error("RunInstances did not return an instance id");
-    const running = await ec2.waitForInstanceState(instanceId, "running");
-    if (!running)
-      throw new Error(`Instance ${instanceId} did not reach 'running' before timeout`);
-    return {
-      appInstanceId: instanceId,
-      appPublicIp: running.PublicIpAddress,
-      sshUser: "ubuntu",
-      deployStoragePath: "/var/ts-cloud/staging"
-    };
+// src/drivers/shared/ufw.ts
+var UFW_BASE_PORTS = [80, 443];
+function buildUfwScript(firewall = {}) {
+  if (firewall.enabled === false)
+    return [];
+  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => p > 0).sort((a, b) => a - b);
+  const lines = [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "apt-get install -y ufw",
+    "ufw default deny incoming",
+    "ufw default allow outgoing",
+    "ufw allow OpenSSH"
+  ];
+  for (const port of ports)
+    lines.push(`ufw allow ${port}/tcp`);
+  lines.push("ufw --force enable");
+  return lines;
+}
+
+// src/drivers/shared/maintenance.ts
+function buildAutoUpdatesScript(enabled2 = true) {
+  if (!enabled2)
+    return [];
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "apt-get install -y unattended-upgrades",
+    "cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",
+    'APT::Periodic::Update-Package-Lists "1";',
+    'APT::Periodic::Unattended-Upgrade "1";',
+    'APT::Periodic::Download-Upgradeable-Packages "1";',
+    'APT::Periodic::AutocleanInterval "7";',
+    "TS_CLOUD_AUTOUPD_EOF",
+    "systemctl enable unattended-upgrades 2>/dev/null || true",
+    "systemctl restart unattended-upgrades 2>/dev/null || true"
+  ];
+}
+
+// src/drivers/shared/monitoring.ts
+var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
+var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
+var DEFAULT_CPU_LOAD_PER_CORE = 2;
+var DEFAULT_MEM_PERCENT = 90;
+var DEFAULT_DISK_PERCENT = 90;
+var SERVICE_PROBES = [
+  ["nginx", 80],
+  ["phpFpm", 9074],
+  ["mysql", 3306],
+  ["postgres", 5432],
+  ["redis", 6379],
+  ["meilisearch", 7700]
+];
+function resolveMonitoring(monitoring = true) {
+  const obj = typeof monitoring === "object" ? monitoring : {};
+  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
+  return {
+    enabled: enabled2,
+    cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
+    memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
+    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
+  };
+}
+function buildMonitoringScript(monitoring = true) {
+  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
+  if (!enabled2)
+    return [];
+  const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
+  const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
+  return [
+    "mkdir -p /var/lib/ts-cloud",
+    "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
+    "#!/bin/bash",
+    "set -uo pipefail",
+    "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
+    "CPUS=$(nproc)",
+    "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
+    "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
+    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
+    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
+    `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
+    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
+    `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
+    `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
+    "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
+    ...probeLines,
+    "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
+    "SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}",
+    "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
+    "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
+    `cat > ${METRICS_PATH}.tmp <<JSON`,
+    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
+    "JSON",
+    `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
+    'ALERTS=""',
+    `if awk -v l="$LOAD" -v c="$CPUS" -v t=${cpuLoadPerCore} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${cpuLoadPerCore}xCPU"; fi`,
+    `if [ "\${MEM_PCT:-0}" -ge ${memPercent} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,
+    `if [ "\${DISK_PCT:-0}" -ge ${diskPercent} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,
+    `PREV=$(cat ${ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
+    'if [ -n "$ALERTS" ]; then',
+    '  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',
+    `  echo alert > ${ALERT_STATE_PATH}`,
+    "else",
+    '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
+    `  echo ok > ${ALERT_STATE_PATH}`,
+    "fi",
+    "TS_CLOUD_METRICS_EOF",
+    "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
+    "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
+    "[Unit]",
+    "Description=ts-cloud metrics collector",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    "ExecStart=/usr/local/bin/ts-cloud-metrics.sh",
+    "TS_CLOUD_METRICS_SVC_EOF",
+    "cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'",
+    "[Unit]",
+    "Description=Run ts-cloud metrics collector every minute",
+    "",
+    "[Timer]",
+    "OnBootSec=60",
+    "OnUnitActiveSec=60",
+    "",
+    "[Install]",
+    "WantedBy=timers.target",
+    "TS_CLOUD_METRICS_TMR_EOF",
+    "systemctl daemon-reload",
+    "systemctl enable ts-cloud-metrics.timer",
+    "systemctl start ts-cloud-metrics.timer"
+  ];
+}
+
+// src/drivers/shared/ssh-keys.ts
+var BLOCK_BEGIN = "# >>> ts-cloud managed keys >>>";
+var BLOCK_END = "# <<< ts-cloud managed keys <<<";
+var DEFAULT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+function buildAuthorizedKeysScript(keys = [], options = {}) {
+  if (keys.length === 0)
+    return [];
+  const path = options.path ?? DEFAULT_AUTHORIZED_KEYS;
+  const dir = path.replace(/\/[^/]*$/, "");
+  const block = [
+    BLOCK_BEGIN,
+    ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`),
+    BLOCK_END
+  ].join(`
+`);
+  return [
+    `mkdir -p ${dir}`,
+    `touch ${path}`,
+    `sed -i '/^${escapeSed(BLOCK_BEGIN)}$/,/^${escapeSed(BLOCK_END)}$/d' ${path}`,
+    `cat >> ${path} <<'TS_CLOUD_KEYS_EOF'`,
+    block,
+    "TS_CLOUD_KEYS_EOF",
+    `chmod 600 ${path}`
+  ];
+}
+function escapeSed(value) {
+  return value.replace(/[.*[\]\\/^$]/g, "\\$&");
+}
+
+// src/drivers/shared/notifications.ts
+function wantsEvent(config, event) {
+  return !config.events || config.events.includes(event);
+}
+async function sendNotifications(config, event, message, options = {}) {
+  if (!config)
+    return [];
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const attempted = [];
+  const tasks = [];
+  const post = (url, body) => fetchImpl(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }).catch(() => {
+    return;
+  });
+  if (config.slack?.webhookUrl && wantsEvent(config, event)) {
+    attempted.push("slack");
+    tasks.push(post(config.slack.webhookUrl, { text: message }));
   }
-  async destroyCompute(options) {
-    const { config, environment } = options;
-    const region = this.resolveRegion(config);
-    const ec2 = new EC2Client(region);
-    const destroyed = [];
-    const targets = await this.findComputeTargets({ slug: config.project.slug, environment, role: "app" });
-    const ids = targets.map((t) => t.id);
-    if (ids.length > 0) {
-      await ec2.terminateInstances(ids);
-      destroyed.push(...ids.map((id) => `instance ${id}`));
-      await Promise.all(ids.map((id) => ec2.waitForInstanceState(id, "terminated").catch(() => {
+  if (config.discord?.webhookUrl && wantsEvent(config, event)) {
+    attempted.push("discord");
+    tasks.push(post(config.discord.webhookUrl, { content: message }));
+  }
+  if (config.telegram?.botToken && config.telegram.chatId && wantsEvent(config, event)) {
+    attempted.push("telegram");
+    const url = `https://api.telegram.org/bot${config.telegram.botToken}/sendMessage`;
+    tasks.push(post(url, { chat_id: config.telegram.chatId, text: message }));
+  }
+  if (config.webhook?.url && wantsEvent(config, event)) {
+    attempted.push("webhook");
+    if ((config.webhook.method || "POST") === "GET") {
+      const sep = config.webhook.url.includes("?") ? "&" : "?";
+      const url = `${config.webhook.url}${sep}event=${encodeURIComponent(event)}&message=${encodeURIComponent(message)}`;
+      tasks.push(fetchImpl(url, { method: "GET" }).catch(() => {
         return;
-      })));
-    }
-    const sgName = `${config.project.slug}-${environment}-app-sg`;
-    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }] }).catch(() => ({ SecurityGroups: [] }));
-    const groupId = found.SecurityGroups?.[0]?.GroupId;
-    if (groupId) {
-      for (let i = 0;i < 10; i++) {
-        try {
-          await ec2.deleteSecurityGroup(groupId);
-          destroyed.push(`security group ${sgName}`);
-          break;
-        } catch {
-          await new Promise((r) => setTimeout(r, 3000));
-        }
-      }
+      }));
+    } else {
+      tasks.push(post(config.webhook.url, { event, message }));
     }
-    return { destroyed };
   }
-  async getComputeOutputs(options) {
-    const region = this.resolveRegion(options.config);
-    const stackName = resolveProjectStackName(options.config, options.environment);
-    const cfn = new CloudFormationClient(region);
-    try {
-      const outputs = await cfn.getStackOutputs(stackName);
-      return {
-        deployBucketName: outputs.deployBucketName,
-        appInstanceId: outputs.appInstanceId,
-        appPublicIp: outputs.appPublicIp,
-        sshUser: "ec2-user"
-      };
-    } catch (err) {
-      if (!/does not exist|ValidationError/i.test(err instanceof Error ? err.message : ""))
-        throw err;
-      const targets = await this.findComputeTargets({
-        slug: options.config.project.slug,
-        environment: options.environment,
-        role: "app"
-      });
-      const first = targets[0];
-      return {
-        appInstanceId: first?.id,
-        appPublicIp: first?.publicIp,
-        sshUser: "ubuntu",
-        deployStoragePath: "/var/ts-cloud/staging"
-      };
-    }
+  if (config.email?.to && wantsEvent(config, event)) {
+    attempted.push("email");
+    tasks.push(sendEmailNotification(config.email, event, message));
   }
-  async uploadRelease(options) {
-    const region = this.resolveRegion(options.config);
-    const outputs = await this.getComputeOutputs({
-      config: options.config,
-      environment: options.environment
-    });
-    const bucket = outputs.deployBucketName;
-    if (!bucket) {
-      throw new Error("No deployBucketName in stack outputs. Re-deploy infrastructure to add the staging bucket.");
-    }
-    const s3 = new S3Client(region);
-    await s3.putObject({
-      bucket,
-      key: options.remoteKey,
-      body: readFileSync(options.localPath),
-      contentType: "application/gzip"
+  await Promise.all(tasks);
+  return attempted;
+}
+async function sendEmailNotification(email, event, message) {
+  try {
+    const mod = await import("./chunk-pqfzdg68.js");
+    await mod.email.send({
+      to: email.to,
+      from: email.from,
+      subject: `[ts-cloud] ${event}`,
+      text: message
     });
-    return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
+  } catch {}
+}
+function resolveNotifications(project, site) {
+  return site ?? project;
+}
+function buildNotifierScript(config) {
+  if (!config)
+    return [];
+  const curls = [];
+  if (config.slack?.webhookUrl)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${config.slack.webhookUrl} || true`);
+  if (config.discord?.webhookUrl)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${config.discord.webhookUrl} || true`);
+  if (config.telegram?.botToken && config.telegram.chatId)
+    curls.push(`curl -fsS -X POST "https://api.telegram.org/bot${config.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${config.telegram.chatId}" --data-urlencode "text=$MSG" || true`);
+  if (config.webhook?.url)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${config.webhook.url} || true`);
+  if (curls.length === 0)
+    return [];
+  return [
+    "cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'",
+    "#!/bin/bash",
+    'MSG="$1"',
+    ...curls,
+    "TS_CLOUD_NOTIFY_EOF",
+    "chmod +x /usr/local/bin/ts-cloud-notify"
+  ];
+}
+
+// src/drivers/shared/backups.ts
+var BACKUP_OUTPUT_DIR = "/var/backups/ts-cloud";
+var BACKUP_CONFIG_PATH = "/etc/ts-cloud/backups.config.ts";
+var BACKUP_CRON_PATH = "/etc/cron.d/ts-cloud-backups";
+var BACKUP_RUNNER_PATH = "/usr/local/bin/ts-cloud-backup.sh";
+function backupEntryFor(database) {
+  if (!database.name)
+    return null;
+  const host = database.host || "127.0.0.1";
+  const isPostgres = database.engine === "postgres";
+  const type = isPostgres ? "postgresql" : "mysql";
+  const port = database.port ?? (isPostgres ? 5432 : 3306);
+  const ts = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  return [
+    "  {",
+    `    type: '${type}',`,
+    `    name: '${ts(database.name)}',`,
+    "    connection: {",
+    `      hostname: '${ts(host)}',`,
+    `      port: ${port},`,
+    `      database: '${ts(database.name)}',`,
+    `      username: '${ts(database.username || database.name)}',`,
+    `      password: '${ts(database.password || "")}',`,
+    "      ssl: false,",
+    "    },",
+    "    includeSchema: true,",
+    "    includeData: true,",
+    "  },"
+  ].join(`
+`);
+}
+function buildBackupsConfigTs(database, backups) {
+  const entry = database ? backupEntryFor(database) : null;
+  const destinations = backups.bucket ? [
+    "  destinations: [",
+    "    {",
+    "      type: 's3',",
+    `      bucket: '${backups.bucket}',`,
+    "      prefix: 'db-backups',",
+    ...backups.endpoint ? [`      endpoint: '${backups.endpoint}',`] : [],
+    "      optional: false,",
+    "    },",
+    "  ],"
+  ] : [];
+  return [
+    "import type { BackupConfig } from 'ts-backups'",
+    "",
+    "const config: BackupConfig = {",
+    "  verbose: true,",
+    `  outputPath: '${BACKUP_OUTPUT_DIR}',`,
+    "  retention: {",
+    `    count: ${backups.retentionCount ?? 5},`,
+    `    maxAge: ${backups.retentionDays ?? 30},`,
+    "  },",
+    "  databases: [",
+    ...entry ? [entry] : [],
+    "  ],",
+    ...destinations,
+    "}",
+    "",
+    "export default config",
+    ""
+  ].join(`
+`);
+}
+function buildBackupProvisionScript(options) {
+  const { database, backups } = options;
+  if (!backups.enabled)
+    return [];
+  const schedule = backups.schedule || "0 2 * * *";
+  const configTs = buildBackupsConfigTs(database, backups);
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    `mkdir -p /etc/ts-cloud ${BACKUP_OUTPUT_DIR}`,
+    "command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)",
+    "bun add -g ts-backups || true",
+    `cat > ${BACKUP_CONFIG_PATH} <<'TS_CLOUD_BACKUP_CFG_EOF'`,
+    configTs.replace(/\n$/, ""),
+    "TS_CLOUD_BACKUP_CFG_EOF",
+    `cat > ${BACKUP_RUNNER_PATH} <<'TS_CLOUD_BACKUP_RUN_EOF'`,
+    "#!/bin/bash",
+    "set -uo pipefail",
+    'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"',
+    'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',
+    "cd /etc/ts-cloud",
+    'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',
+    "TS_CLOUD_BACKUP_RUN_EOF",
+    `chmod +x ${BACKUP_RUNNER_PATH}`,
+    `cat > ${BACKUP_CRON_PATH} <<'TS_CLOUD_BACKUP_CRON_EOF'`,
+    `${schedule} root ${BACKUP_RUNNER_PATH} >> /var/log/ts-cloud-backup.log 2>&1`,
+    "TS_CLOUD_BACKUP_CRON_EOF",
+    `chmod 644 ${BACKUP_CRON_PATH}`
+  ];
+}
+function engineSocket(engine) {
+  return engine === "mariadb" ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
+}
+function buildBackupRestoreScript(database, options = {}) {
+  if (!database?.name)
+    return [];
+  const name = database.name;
+  const isPg = database.engine === "postgres";
+  const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
+  const client = isPg ? `psql -h 127.0.0.1 -p ${database.port ?? 5432} -U postgres -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
+  return [
+    "set -uo pipefail",
+    'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
+    locate,
+    '[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }',
+    'echo "[ts-cloud] restoring ' + name + ' from $TS_CLOUD_DUMP"',
+    `case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${client}`,
+    'echo "restore complete"'
+  ];
+}
+
+// src/drivers/shared/compute-provision.ts
+function buildComputeProvisionScripts(config) {
+  const compute = config.infrastructure?.compute ?? {};
+  const phpBox = compute.runtime === "php" || !!compute.php;
+  const needsPantry = phpBox || !!compute.managedServices;
+  const pantryBootstrap = needsPantry ? buildPantryBootstrapScript() : [];
+  const useNginx = !usesRpxProxy(compute);
+  const phpProvision = phpBox ? [
+    ...pantryBootstrap,
+    ...buildPhpProvisionScript({
+      versions: compute.php?.versions,
+      default: compute.php?.default,
+      extensions: compute.php?.extensions,
+      installNginx: useNginx,
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
+    }),
+    ...useNginx ? buildNginxServiceScript() : []
+  ] : undefined;
+  const extras = [];
+  if (!phpBox && needsPantry)
+    extras.push(...pantryBootstrap);
+  extras.push(...buildNotifierScript(config.notifications));
+  if (compute.managedServices) {
+    extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices));
   }
-  async findComputeTargets(options) {
-    const region = this.region;
-    const ec2 = new EC2Client(region);
-    const filters = [
-      { Name: "tag:Project", Values: [options.slug] },
-      { Name: "tag:Environment", Values: [options.environment] },
-      { Name: "tag:Role", Values: [options.role || "app"] },
-      { Name: "instance-state-name", Values: ["running", "pending"] }
-    ];
-    const result = await ec2.describeInstances({ Filters: filters });
-    const targets = this.reservationsToTargets(result.Reservations);
-    if (targets.length > 0 || (options.role || "app") !== "app")
-      return targets;
-    const stackName = options.stackName ?? `${options.slug}-${options.environment}`;
-    let pinnedId = readPinnedInstanceId(stackName);
-    if (!pinnedId) {
-      try {
-        pinnedId = (await new CloudFormationClient(region).getStackOutputs(stackName)).appInstanceId ?? null;
-      } catch {
-        pinnedId = null;
-      }
-    }
-    if (!pinnedId)
-      return [];
-    try {
-      const pinned = await ec2.describeInstances({
-        InstanceIds: [pinnedId],
-        Filters: [{ Name: "instance-state-name", Values: ["running", "pending"] }]
-      });
-      return this.reservationsToTargets(pinned.Reservations);
-    } catch {
-      return [];
-    }
+  extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
+  extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
+  extras.push(...buildMonitoringScript(compute.monitoring ?? phpBox));
+  extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
+  if (compute.backups?.enabled) {
+    extras.push(...buildBackupProvisionScript({
+      database: config.infrastructure?.appDatabase,
+      backups: compute.backups
+    }));
   }
-  reservationsToTargets(reservations) {
-    const targets = [];
-    for (const reservation of reservations || []) {
-      for (const instance of reservation.Instances || []) {
-        if (!instance.InstanceId)
-          continue;
-        const nameTag = instance.Tags?.find((tag) => tag.Key === "Name")?.Value;
-        targets.push({
-          id: instance.InstanceId,
-          name: nameTag,
-          publicIp: instance.PublicIpAddress,
-          privateIp: instance.PrivateIpAddress,
-          status: instance.State?.Name
-        });
-      }
+  return {
+    runtime: compute.runtime || "bun",
+    runtimeVersion: compute.runtimeVersion || "latest",
+    phpBox,
+    phpProvision,
+    servicesProvision: extras.length > 0 ? extras : undefined
+  };
+}
+
+// src/drivers/shared/ubuntu-bootstrap.ts
+function buildUbuntuBootstrapScript(options = {}) {
+  const {
+    runtime = "bun",
+    runtimeVersion = "latest",
+    systemPackages = [],
+    database,
+    phpProvision,
+    servicesProvision,
+    caddyfile,
+    rpxProvision,
+    baked = false
+  } = options;
+  const packages = new Set(systemPackages);
+  if (database === "sqlite")
+    packages.add("sqlite3");
+  else if (database === "mysql")
+    packages.add("mysql-client");
+  else if (database === "postgres")
+    packages.add("postgresql-client");
+  let script = `#!/bin/bash
+set -euo pipefail
+`;
+  if (!baked) {
+    script += `
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -y
+apt-get upgrade -y
+apt-get install -y curl tar gzip unzip git ca-certificates
+`;
+    if (packages.size > 0) {
+      script += `
+apt-get install -y ${[...packages].join(" ")}
+`;
     }
-    return targets;
-  }
-  bashWrap(commands) {
-    return ["bash <<'TS_CLOUD_BASH_EOF'", commands.join(`
-`), "TS_CLOUD_BASH_EOF"];
-  }
-  async runRemoteDeploy(options) {
-    const region = this.region;
-    const ssm = new SSMClient(region);
-    if (options.targets.length > 0) {
-      const sendResult = await ssm.sendCommand({
-        InstanceIds: options.targets.map((target) => target.id),
-        DocumentName: "AWS-RunShellScript",
-        Parameters: { commands: this.bashWrap(options.commands) },
-        TimeoutSeconds: options.timeoutSeconds || 600,
-        Comment: options.comment
-      });
-      if (!sendResult.CommandId) {
-        return { success: false, instanceCount: 0, perInstance: [], error: "Failed to send SSM command" };
-      }
-      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length);
+    if (phpProvision && phpProvision.length > 0) {
+      script += `
+${phpProvision.join(`
+`)}
+`;
     }
-    if (!options.tags || Object.keys(options.tags).length === 0) {
-      return { success: false, instanceCount: 0, perInstance: [], error: "No targets or tags provided for AWS deploy" };
+    if (servicesProvision && servicesProvision.length > 0) {
+      script += `
+${servicesProvision.join(`
+`)}
+`;
     }
-    const result = await ssm.sendCommandByTags({
-      tags: options.tags,
-      commands: this.bashWrap(options.commands),
-      timeoutSeconds: options.timeoutSeconds || 600,
-      comment: options.comment
-    });
-    return {
-      success: result.success,
-      instanceCount: result.instanceCount,
-      perInstance: result.perInstance.map((item) => ({
-        instanceId: item.instanceId,
-        status: item.status,
-        output: item.output,
-        error: item.error
-      })),
-      error: result.error
-    };
-  }
-  async pollSsmCommand(ssm, commandId, expectedCount) {
-    const pollInterval = 3000;
-    const maxWait = 600000;
-    const startTime = Date.now();
-    const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
-    let lastInvocations = [];
-    while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-      try {
-        const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
-        lastInvocations = invocations;
-        if (lastInvocations.length >= expectedCount && lastInvocations.every((i) => terminalStatuses.has(i.Status || ""))) {
-          break;
-        }
-      } catch {}
+    if (runtime === "bun") {
+      script += `
+# cloud-init runs this with \`set -u\` and NO $HOME set. bun's install.sh
+# dereferences $HOME even when BUN_INSTALL is set, so without this the install
+# aborts with "HOME: unbound variable" and /usr/local/bin/bun never appears —
+# breaking a from-scratch provision (adopting an existing box masked it).
+export HOME="\${HOME:-/root}"
+export BUN_INSTALL="/root/.bun"
+# bun.sh's installer references $HOME internally and runs under this
+# script's \`set -u\` (inherited by the piped bash) — cloud-init's runcmd
+# environment doesn't export HOME by default, so without this the
+# installer dies with "HOME: unbound variable" partway through (after
+# the binary is already downloaded, so it looks like a partial success)
+# and \`set -e\` aborts everything after it: the bun symlink, /var/www +
+# /var/ts-cloud dirs, and the whole rpx gateway install/systemd setup
+# never run. Confirmed against a real Hetzner box (stacksjs/status#1
+# Phase 9 e2e deploy) — cloud-init reported success with none of that
+# actually done.
+export HOME="\${HOME:-/root}"
+curl -fsSL https://bun.sh/install | bash${runtimeVersion === "latest" ? "" : ` -s "bun-v${runtimeVersion}"`}
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+echo 'export BUN_INSTALL="/root/.bun"' > /etc/profile.d/bun.sh
+echo 'export PATH="$BUN_INSTALL/bin:$PATH"' >> /etc/profile.d/bun.sh
+`;
+    } else if (runtime === "node") {
+      const nodeMajor = runtimeVersion === "latest" || !runtimeVersion ? "20" : runtimeVersion.split(".")[0];
+      script += `
+curl -fsSL https://deb.nodesource.com/setup_${nodeMajor}.x | bash -
+apt-get install -y nodejs
+ln -sf /usr/bin/node /usr/local/bin/node
+ln -sf /usr/bin/npm /usr/local/bin/npm
+`;
+    } else if (runtime === "deno") {
+      script += `
+curl -fsSL https://deno.land/install.sh | sh
+ln -sf /root/.deno/bin/deno /usr/local/bin/deno
+`;
     }
-    const perInstance = lastInvocations.map((item) => ({
-      instanceId: item.InstanceId,
-      status: item.Status || "Unknown",
-      output: item.StandardOutputContent,
-      error: item.StandardErrorContent
-    }));
-    const success = perInstance.length > 0 && perInstance.every((item) => item.status === "Success");
-    return {
-      success,
-      instanceCount: perInstance.length,
-      perInstance,
-      error: success ? undefined : "One or more SSM command invocations failed"
-    };
   }
-}
+  script += `
+mkdir -p /var/www /var/ts-cloud/staging /var/ts-cloud/releases
+`;
+  if (caddyfile) {
+    const escaped = caddyfile.replace(/\$/g, "\\$");
+    script += `
+ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=\${ARCH}" -o /usr/local/bin/caddy
+chmod +x /usr/local/bin/caddy
 
-// src/drivers/hetzner/driver.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join3 } from "node:path";
-import { execSync } from "node:child_process";
+getent group caddy >/dev/null || groupadd --system caddy
+getent passwd caddy >/dev/null || useradd --system --gid caddy \\
+  --create-home --home-dir /var/lib/caddy \\
+  --shell /usr/sbin/nologin --comment "Caddy web server" caddy
 
-// src/drivers/hetzner/client.ts
-var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
+mkdir -p /etc/caddy /var/lib/caddy /var/log/caddy
+chown -R caddy:caddy /var/lib/caddy /var/log/caddy
 
-class HetznerClient {
-  name = "hetzner";
-  apiToken;
-  baseUrl;
-  fetchImpl;
-  constructor(options) {
-    this.apiToken = options.apiToken;
-    this.baseUrl = options.baseUrl ?? DEFAULT_API_URL;
-    this.fetchImpl = options.fetchImpl ?? fetch;
-  }
-  async request(method, path, body) {
-    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${this.apiToken}`,
-        "Content-Type": "application/json"
-      },
-      body: body === undefined ? undefined : JSON.stringify(body)
-    });
-    const text = await response.text();
-    let data;
-    try {
-      data = text ? JSON.parse(text) : {};
-    } catch {
-      if (!response.ok) {
-        const snippet = text.trim().slice(0, 200) || response.statusText || "Hetzner API error";
-        throw new Error(`Hetzner API ${method} ${path} (${response.status}): ${snippet}`);
-      }
-      throw new Error(`Hetzner API ${method} ${path}: unexpected non-JSON response`);
-    }
-    if (!response.ok) {
-      const message = data.error?.message || response.statusText || "Hetzner API error";
-      const code = data.error?.code ? ` [${data.error.code}]` : "";
-      throw new Error(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`);
-    }
-    return data;
-  }
-  async listServers() {
-    const data = await this.request("GET", "/servers");
-    return data.servers;
-  }
-  async getServer(id) {
-    const data = await this.request("GET", `/servers/${id}`);
-    return data.server;
-  }
-  async createServer(options) {
-    const data = await this.request("POST", "/servers", {
-      name: options.name,
-      server_type: options.serverType,
-      image: options.image,
-      location: options.location,
-      datacenter: options.datacenter,
-      ssh_keys: options.sshKeys,
-      user_data: options.userData,
-      labels: options.labels,
-      firewalls: options.firewalls,
-      networks: options.networks,
-      start_after_create: true
-    });
-    return { server: data.server, action: data.action };
-  }
-  async listNetworks() {
-    const data = await this.request("GET", "/networks");
-    return data.networks;
-  }
-  async createNetwork(options) {
-    const ipRange = options.ipRange ?? "10.0.0.0/16";
-    const data = await this.request("POST", "/networks", {
-      name: options.name,
-      ip_range: ipRange,
-      subnets: [{ type: "cloud", ip_range: ipRange, network_zone: "eu-central" }],
-      labels: options.labels
-    });
-    return data.network;
-  }
-  async deleteNetwork(id) {
-    await this.request("DELETE", `/networks/${id}`);
-  }
-  async listLoadBalancers() {
-    const data = await this.request("GET", "/load_balancers");
-    return data.load_balancers;
-  }
-  async createLoadBalancer(options) {
-    const data = await this.request("POST", "/load_balancers", {
-      name: options.name,
-      load_balancer_type: options.type ?? "lb11",
-      location: options.location,
-      network_zone: options.network ? undefined : options.networkZone ?? "eu-central",
-      network: options.network,
-      labels: options.labels,
-      targets: [{ type: "label_selector", label_selector: { selector: options.labelSelector }, use_private_ip: !!options.network }],
-      services: options.services.map((s) => ({
-        protocol: s.protocol ?? "tcp",
-        listen_port: s.listenPort,
-        destination_port: s.destinationPort,
-        health_check: {
-          protocol: "http",
-          port: 80,
-          interval: 15,
-          timeout: 10,
-          retries: 3,
-          http: { path: "/", status_codes: ["2??", "3??"] }
-        }
-      }))
-    });
-    return data.load_balancer;
-  }
-  async deleteLoadBalancer(id) {
-    await this.request("DELETE", `/load_balancers/${id}`);
-  }
-  async deleteServer(id) {
-    const data = await this.request("DELETE", `/servers/${id}`);
-    return data.action;
-  }
-  async listFirewalls() {
-    const data = await this.request("GET", "/firewalls");
-    return data.firewalls;
-  }
-  async createFirewall(options) {
-    const data = await this.request("POST", "/firewalls", {
-      name: options.name,
-      rules: options.rules,
-      labels: options.labels,
-      apply_to: options.applyTo
-    });
-    return { firewall: data.firewall, actions: data.actions };
-  }
-  async setFirewallRules(firewallId, rules) {
-    const data = await this.request("POST", `/firewalls/${firewallId}/actions/set_rules`, {
-      rules
-    });
-    return data.actions ?? [];
-  }
-  async deleteFirewall(firewallId) {
-    await this.request("DELETE", `/firewalls/${firewallId}`);
-  }
-  async applyFirewallToResources(firewallId, applyTo) {
-    const data = await this.request("POST", `/firewalls/${firewallId}/actions/apply_to_resources`, {
-      apply_to: applyTo
-    });
-    return data.actions;
-  }
-  async listSshKeys() {
-    const data = await this.request("GET", "/ssh_keys");
-    return data.ssh_keys;
-  }
-  async createSshKey(options) {
-    const data = await this.request("POST", "/ssh_keys", {
-      name: options.name,
-      public_key: options.publicKey,
-      labels: options.labels
-    });
-    return data.ssh_key;
-  }
-  async waitForAction(actionId, options) {
-    const pollInterval = options?.pollIntervalMs ?? 2000;
-    const maxWait = options?.maxWaitMs ?? 300000;
-    const start = Date.now();
-    while (Date.now() - start < maxWait) {
-      const data = await this.request("GET", `/actions/${actionId}`);
-      if (data.action.status === "success")
-        return data.action;
-      if (data.action.status === "error") {
-        throw new Error(data.action.error?.message || "Hetzner action failed");
-      }
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-    }
-    throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
-  }
-  async waitForServerRunning(serverId, options) {
-    const pollInterval = options?.pollIntervalMs ?? 3000;
-    const maxWait = options?.maxWaitMs ?? 600000;
-    const start = Date.now();
-    while (Date.now() - start < maxWait) {
-      const server = await this.getServer(serverId);
-      if (server.status === "running")
-        return server;
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-    }
-    throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
+cat > /etc/systemd/system/caddy.service <<'CADDY_UNIT_EOF'
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+CADDY_UNIT_EOF
+
+cat > /etc/caddy/Caddyfile <<'CADDY_CONFIG_EOF'
+${escaped}
+CADDY_CONFIG_EOF
+
+systemctl daemon-reload
+systemctl enable caddy
+systemctl start caddy
+`;
   }
-}
-function resolveHetznerApiToken(configToken) {
-  const token = configToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
-  if (!token) {
-    throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
+  if (rpxProvision && rpxProvision.length > 0) {
+    const body = rpxProvision[0] === "set -euo pipefail" ? rpxProvision.slice(1) : rpxProvision;
+    script += `
+${body.join(`
+`)}
+`;
   }
-  return token;
-}
-function normalizeSshPublicKey(publicKey) {
-  const [type, body] = publicKey.trim().split(/\s+/);
-  return body ? `${type} ${body}` : type;
-}
-
-// src/drivers/hetzner/cloud-init.ts
-function wrapCloudInitUserData(bootstrapScript) {
-  const scriptPath = "/var/lib/cloud/ts-cloud-bootstrap.sh";
-  const indented = bootstrapScript.split(`
-`).map((line) => `      ${line}`).join(`
-`);
-  return `#cloud-config
-write_files:
-  - path: ${scriptPath}
-    permissions: '0755'
-    owner: root:root
-    content: |
-${indented}
-runcmd:
-  - [ bash, ${scriptPath} ]
+  script += `
+echo "ts-cloud bootstrap complete — instance is ready for site deploys"
 `;
+  return script;
 }
 
-// src/deploy/site-target.ts
-function siteInstallBase(slug, siteName) {
-  return `/var/www/${slug}-${siteName}`;
+// src/drivers/aws/provision.ts
+var UBUNTU_AMI_SSM_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
+function awsComputeIngressRules(config) {
+  const rules = [
+    { port: 22, protocol: "tcp", cidr: "0.0.0.0/0" },
+    { port: 80, protocol: "tcp", cidr: "0.0.0.0/0" },
+    { port: 443, protocol: "tcp", cidr: "0.0.0.0/0" }
+  ];
+  const extra = new Set;
+  for (const site of Object.values(config.sites || {})) {
+    if (site && typeof site.port === "number" && ![22, 80, 443].includes(site.port))
+      extra.add(site.port);
+  }
+  for (const port of extra)
+    rules.push({ port, protocol: "tcp", cidr: "0.0.0.0/0" });
+  return rules;
 }
-var PHP_SITE_TYPES = new Set([
-  "laravel",
-  "php",
-  "statamic",
-  "wordpress"
-]);
-function isPhpSite(site) {
-  return site.type != null && PHP_SITE_TYPES.has(site.type);
+function buildAwsUserData(config) {
+  const compute = config.infrastructure?.compute ?? {};
+  const provision = buildComputeProvisionScripts(config);
+  return buildUbuntuBootstrapScript({
+    runtime: provision.runtime,
+    runtimeVersion: provision.runtimeVersion,
+    systemPackages: compute.systemPackages,
+    database: config.infrastructure?.database,
+    phpProvision: provision.phpProvision,
+    servicesProvision: provision.servicesProvision,
+    baked: compute.bakedImage === true
+  });
 }
-function resolveSiteDeployTarget(site) {
-  if (site.deploy)
-    return site.deploy;
-  if (isPhpSite(site))
-    return "server";
-  if (site.start)
-    return "server";
-  return "bucket";
+function encodeUserData(userData) {
+  return Buffer.from(userData, "utf8").toString("base64");
 }
-function resolveSiteKind(site) {
-  if (site.redirect)
-    return "redirect";
-  if (isPhpSite(site))
-    return "server-php";
-  const target = resolveSiteDeployTarget(site);
-  if (target === "bucket")
-    return "bucket";
-  return site.start ? "server-app" : "server-static";
+function resolveAwsImageId(config) {
+  return config.infrastructure?.compute?.image ?? null;
 }
-function hasComputeConfigured(config) {
-  return config.infrastructure?.compute != null;
+
+// src/drivers/aws/driver.ts
+function readPinnedInstanceId(stackName) {
+  try {
+    const raw = readFileSync(join(process.cwd(), ".ts-cloud/state", `${stackName}.json`), "utf8");
+    const state = JSON.parse(raw);
+    return typeof state.instanceId === "string" && state.instanceId.length > 0 ? state.instanceId : null;
+  } catch {
+    return null;
+  }
 }
-function validateDeploymentConfig(config) {
-  const errors = [];
-  const warnings = [];
-  const sites = config.sites || {};
-  const computeConfigured = hasComputeConfigured(config);
-  const coexistence = deploymentCoexistenceError(config);
-  if (coexistence)
-    errors.push(coexistence);
-  const portOwners = new Map;
-  for (const [name, site] of Object.entries(sites)) {
-    if (!site) {
-      continue;
+
+class AwsDriver {
+  name = "aws";
+  usesCloudFormation = true;
+  region;
+  constructor(options = {}) {
+    this.region = options.region || "us-east-1";
+  }
+  resolveRegion(config) {
+    return config.project.region || this.region;
+  }
+  async provisionComputeInfrastructure(options) {
+    const { config, environment } = options;
+    const region = this.resolveRegion(config);
+    const slug = config.project.slug;
+    const compute = config.infrastructure?.compute;
+    if (!compute)
+      throw new Error("infrastructure.compute is required to provision AWS compute");
+    const ec2 = new EC2Client(region);
+    const existing = await this.findComputeTargets({ slug, environment, role: "app" });
+    if (existing.length > 0) {
+      const first = existing[0];
+      return { appInstanceId: first.id, appPublicIp: first.publicIp, sshUser: "ubuntu", deployStoragePath: "/var/ts-cloud/staging" };
     }
-    const target = resolveSiteDeployTarget(site);
-    const kind = resolveSiteKind(site);
-    if (kind === "redirect") {
-      if (!site.domain)
-        errors.push(`Site '${name}' is a redirect site but has no \`domain\` to redirect from.`);
-      const to = typeof site.redirect === "string" ? site.redirect : site.redirect?.to;
-      if (!to)
-        errors.push(`Site '${name}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);
-      }
-      const serverOnly = [];
-      if (site.start)
-        serverOnly.push("start");
-      if (site.root)
-        serverOnly.push("root");
-      if (serverOnly.length > 0)
-        warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
-      continue;
+    let imageId = resolveAwsImageId(config);
+    if (!imageId) {
+      const ssm = new SSMClient(region);
+      const param = await ssm.getParameter({ Name: UBUNTU_AMI_SSM_PARAM });
+      imageId = param.Parameter?.Value ?? null;
+      if (!imageId)
+        throw new Error("Could not resolve the Ubuntu 24.04 AMI from SSM");
     }
-    if (target === "server" && !site.start && !site.root) {
-      errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
-      continue;
+    const vpcs = await ec2.describeVpcs();
+    const vpc = (vpcs.Vpcs || []).find((v) => v.IsDefault) || (vpcs.Vpcs || [])[0];
+    if (!vpc?.VpcId)
+      throw new Error("No VPC found to launch the instance into");
+    const subnets = (await ec2.describeSubnets({ Filters: [{ Name: "vpc-id", Values: [vpc.VpcId] }] })).Subnets || [];
+    const subnet = subnets.find((s) => s.MapPublicIpOnLaunch) || subnets[0];
+    const subnetId = subnet?.SubnetId;
+    if (!subnet?.MapPublicIpOnLaunch)
+      console.warn("ts-cloud: no public subnet found; the instance may not get a public IP (deploys/SSL need one).");
+    const sgName = `${slug}-${environment}-app-sg`;
+    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }, { Name: "vpc-id", Values: [vpc.VpcId] }] });
+    let groupId = found.SecurityGroups?.[0]?.GroupId;
+    if (!groupId) {
+      const created = await ec2.createSecurityGroup({ GroupName: sgName, Description: `ts-cloud ${slug}/${environment} app`, VpcId: vpc.VpcId });
+      groupId = created.GroupId;
+    }
+    const rules = awsComputeIngressRules(config);
+    await ec2.authorizeSecurityGroupIngress({
+      GroupId: groupId,
+      IpPermissions: rules.map((r) => ({ IpProtocol: r.protocol, FromPort: r.port, ToPort: r.port, IpRanges: [{ CidrIp: r.cidr }] }))
+    }).catch((e) => {
+      if (!/InvalidPermission\.Duplicate/.test(e instanceof Error ? e.message : ""))
+        throw e;
+    });
+    const userData = encodeUserData(buildAwsUserData(config));
+    const instanceType = compute.server?.instanceType || "t3.small";
+    const run = await ec2.runInstances({
+      ImageId: imageId,
+      InstanceType: instanceType,
+      MinCount: 1,
+      MaxCount: 1,
+      SecurityGroupIds: groupId ? [groupId] : undefined,
+      SubnetId: subnetId,
+      UserData: userData,
+      IamInstanceProfile: compute.server?.iamInstanceProfile ? { Name: compute.server.iamInstanceProfile } : undefined,
+      TagSpecifications: [{
+        ResourceType: "instance",
+        Tags: [
+          { Key: "Name", Value: `${slug}-${environment}-app` },
+          { Key: "Project", Value: slug },
+          { Key: "Environment", Value: environment },
+          { Key: "Role", Value: "app" }
+        ]
+      }]
+    });
+    const instanceId = run.Instances?.[0]?.InstanceId;
+    if (!instanceId)
+      throw new Error("RunInstances did not return an instance id");
+    const running = await ec2.waitForInstanceState(instanceId, "running");
+    if (!running)
+      throw new Error(`Instance ${instanceId} did not reach 'running' before timeout`);
+    return {
+      appInstanceId: instanceId,
+      appPublicIp: running.PublicIpAddress,
+      sshUser: "ubuntu",
+      deployStoragePath: "/var/ts-cloud/staging"
+    };
+  }
+  async destroyCompute(options) {
+    const { config, environment } = options;
+    const region = this.resolveRegion(config);
+    const ec2 = new EC2Client(region);
+    const destroyed = [];
+    const targets = await this.findComputeTargets({ slug: config.project.slug, environment, role: "app" });
+    const ids = targets.map((t) => t.id);
+    if (ids.length > 0) {
+      await ec2.terminateInstances(ids);
+      destroyed.push(...ids.map((id) => `instance ${id}`));
+      await Promise.all(ids.map((id) => ec2.waitForInstanceState(id, "terminated").catch(() => {
+        return;
+      })));
     }
-    if (kind === "server-php") {
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);
-      }
-      if (!site.repository?.url) {
-        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`);
-      }
-    } else if (kind === "server-app") {
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' deploys to a server (deploy:'server'${site.deploy ? "" : " inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
-      }
-      if (typeof site.port === "number") {
-        const existing = portOwners.get(site.port);
-        if (existing) {
-          errors.push(`Sites '${existing}' and '${name}' both use port ${site.port}. Server apps sharing a box must use distinct ports.`);
-        } else {
-          portOwners.set(site.port, name);
+    const sgName = `${config.project.slug}-${environment}-app-sg`;
+    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }] }).catch(() => ({ SecurityGroups: [] }));
+    const groupId = found.SecurityGroups?.[0]?.GroupId;
+    if (groupId) {
+      for (let i = 0;i < 10; i++) {
+        try {
+          await ec2.deleteSecurityGroup(groupId);
+          destroyed.push(`security group ${sgName}`);
+          break;
+        } catch {
+          await new Promise((r) => setTimeout(r, 3000));
         }
       }
-    } else if (kind === "server-static") {
-      if (!site.root) {
-        errors.push(`Site '${name}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);
-      }
-      if (!computeConfigured) {
-        errors.push(`Site '${name}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
-      }
-    } else {
-      if (!site.root) {
-        errors.push(`Site '${name}' deploys to a bucket but has no \`root\` directory to upload.`);
-      }
-      const serverOnly = [];
-      if (site.start)
-        serverOnly.push("start");
-      if (typeof site.port === "number")
-        serverOnly.push("port");
-      if (site.preStart && site.preStart.length > 0)
-        serverOnly.push("preStart");
-      if (serverOnly.length > 0) {
-        warnings.push(`Site '${name}' deploys to a bucket but sets server-only field(s): ${serverOnly.join(", ")}. These are ignored. Set deploy:'server' to use them.`);
-      }
     }
+    return { destroyed };
   }
-  return { errors, warnings };
-}
-
-// src/drivers/shared/rpx-gateway.ts
-var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
-var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
-function normalizeSiteRedirect(input) {
-  if (typeof input === "string")
-    return { to: input };
-  const out = { to: input.to };
-  if (input.status != null)
-    out.status = input.status;
-  if (input.preservePath != null)
-    out.preservePath = input.preservePath;
-  return out;
-}
-function resolveRouteAuth(site) {
-  const auth = site.auth;
-  if (!auth || auth.enabled === false || !auth.password)
-    return;
-  return {
-    username: auth.username || "admin",
-    password: auth.password,
-    ...auth.realm ? { realm: auth.realm } : {}
-  };
-}
-function normalizeRoutePath(path) {
-  if (!path || path === "/")
-    return;
-  let p = `/${path}`.replace(/\/+/g, "/").replace(/\/+$/, "");
-  if (!p.startsWith("/"))
-    p = `/${p}`;
-  return p === "" || p === "/" ? undefined : p;
-}
-function deriveRouteId(to, path) {
-  const base = path ? `${to}${path}` : to;
-  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
-  return cleaned.length > 0 ? cleaned : "rpx";
-}
-function resolveServerAppFrom(port, appBoxes) {
-  if (!appBoxes || appBoxes.length === 0)
-    return `localhost:${port}`;
-  return appBoxes.map((box) => `${box.privateIp ?? box.publicIp}:${port}`);
-}
-function buildRpxConfigInternal(sites, options, appBoxes) {
-  const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
-  const installSlug = options.slug ?? "app";
-  const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
-  const loadBalancer = options.proxy.loadBalancer;
-  const proxies = [];
-  const domains = new Set;
-  for (const [name, site] of Object.entries(sites)) {
-    if (!site || !site.domain)
-      continue;
-    const kind = resolveSiteKind(site);
-    if (kind === "bucket")
-      continue;
-    const path = normalizeRoutePath(site.path);
-    const id = deriveRouteId(site.domain, path);
-    const auth = resolveRouteAuth(site);
-    if (kind === "redirect") {
-      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
-      domains.add(site.domain);
-      continue;
+  async getComputeOutputs(options) {
+    const region = this.resolveRegion(options.config);
+    const stackName = resolveProjectStackName(options.config, options.environment);
+    const cfn = new CloudFormationClient(region);
+    try {
+      const outputs = await cfn.getStackOutputs(stackName);
+      return {
+        deployBucketName: outputs.deployBucketName,
+        appInstanceId: outputs.appInstanceId,
+        appPublicIp: outputs.appPublicIp,
+        sshUser: "ec2-user"
+      };
+    } catch (err) {
+      if (!/does not exist|ValidationError/i.test(err instanceof Error ? err.message : ""))
+        throw err;
+      const targets = await this.findComputeTargets({
+        slug: options.config.project.slug,
+        environment: options.environment,
+        role: "app"
+      });
+      const first = targets[0];
+      return {
+        appInstanceId: first?.id,
+        appPublicIp: first?.publicIp,
+        sshUser: "ubuntu",
+        deployStoragePath: "/var/ts-cloud/staging"
+      };
     }
-    if (kind === "server-app") {
-      if (typeof site.port !== "number")
-        continue;
-      const from = resolveServerAppFrom(site.port, appBoxes);
-      proxies.push({
-        to: site.domain,
-        path,
-        from,
-        id,
-        ...auth ? { auth } : {},
-        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
+  }
+  async uploadRelease(options) {
+    const region = this.resolveRegion(options.config);
+    const outputs = await this.getComputeOutputs({
+      config: options.config,
+      environment: options.environment
+    });
+    const bucket = outputs.deployBucketName;
+    if (!bucket) {
+      throw new Error("No deployBucketName in stack outputs. Re-deploy infrastructure to add the staging bucket.");
+    }
+    const s3 = new S3Client(region);
+    await s3.putObject({
+      bucket,
+      key: options.remoteKey,
+      body: readFileSync(options.localPath),
+      contentType: "application/gzip"
+    });
+    return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
+  }
+  async findComputeTargets(options) {
+    const region = this.region;
+    const ec2 = new EC2Client(region);
+    const filters = [
+      { Name: "tag:Project", Values: [options.slug] },
+      { Name: "tag:Environment", Values: [options.environment] },
+      { Name: "tag:Role", Values: [options.role || "app"] },
+      { Name: "instance-state-name", Values: ["running", "pending"] }
+    ];
+    const result = await ec2.describeInstances({ Filters: filters });
+    const targets = this.reservationsToTargets(result.Reservations);
+    if (targets.length > 0 || (options.role || "app") !== "app")
+      return targets;
+    const stackName = options.stackName ?? `${options.slug}-${options.environment}`;
+    let pinnedId = readPinnedInstanceId(stackName);
+    if (!pinnedId) {
+      try {
+        pinnedId = (await new CloudFormationClient(region).getStackOutputs(stackName)).appInstanceId ?? null;
+      } catch {
+        pinnedId = null;
+      }
+    }
+    if (!pinnedId)
+      return [];
+    try {
+      const pinned = await ec2.describeInstances({
+        InstanceIds: [pinnedId],
+        Filters: [{ Name: "instance-state-name", Values: ["running", "pending"] }]
       });
-    } else {
-      proxies.push({
-        to: site.domain,
-        path,
-        static: `${wwwRoot}/${installSlug}-${name}/current`,
-        cleanUrls: site.pathRewriteStyle !== "flat",
-        spa: site.spa ?? false,
-        ...auth ? { auth } : {},
-        id
+      return this.reservationsToTargets(pinned.Reservations);
+    } catch {
+      return [];
+    }
+  }
+  reservationsToTargets(reservations) {
+    const targets = [];
+    for (const reservation of reservations || []) {
+      for (const instance of reservation.Instances || []) {
+        if (!instance.InstanceId)
+          continue;
+        const nameTag = instance.Tags?.find((tag) => tag.Key === "Name")?.Value;
+        targets.push({
+          id: instance.InstanceId,
+          name: nameTag,
+          publicIp: instance.PublicIpAddress,
+          privateIp: instance.PrivateIpAddress,
+          status: instance.State?.Name
+        });
+      }
+    }
+    return targets;
+  }
+  bashWrap(commands) {
+    return ["bash <<'TS_CLOUD_BASH_EOF'", commands.join(`
+`), "TS_CLOUD_BASH_EOF"];
+  }
+  async runRemoteDeploy(options) {
+    const region = this.region;
+    const ssm = new SSMClient(region);
+    if (options.targets.length > 0) {
+      const sendResult = await ssm.sendCommand({
+        InstanceIds: options.targets.map((target) => target.id),
+        DocumentName: "AWS-RunShellScript",
+        Parameters: { commands: this.bashWrap(options.commands) },
+        TimeoutSeconds: options.timeoutSeconds || 600,
+        Comment: options.comment
       });
+      if (!sendResult.CommandId) {
+        return { success: false, instanceCount: 0, perInstance: [], error: "Failed to send SSM command" };
+      }
+      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length);
     }
-    domains.add(site.domain);
-  }
-  if (options.proxy.autoWww !== false) {
-    for (const domain of [...domains]) {
-      if (domain.split(".").length !== 2)
-        continue;
-      const wwwDomain = `www.${domain}`;
-      if (domains.has(wwwDomain))
-        continue;
-      proxies.push({ to: wwwDomain, redirect: { to: `https://${domain}` }, id: deriveRouteId(wwwDomain) });
-      domains.add(wwwDomain);
+    if (!options.tags || Object.keys(options.tags).length === 0) {
+      return { success: false, instanceCount: 0, perInstance: [], error: "No targets or tags provided for AWS deploy" };
     }
+    const result = await ssm.sendCommandByTags({
+      tags: options.tags,
+      commands: this.bashWrap(options.commands),
+      timeoutSeconds: options.timeoutSeconds || 600,
+      comment: options.comment
+    });
+    return {
+      success: result.success,
+      instanceCount: result.instanceCount,
+      perInstance: result.perInstance.map((item) => ({
+        instanceId: item.instanceId,
+        status: item.status,
+        output: item.output,
+        error: item.error
+      })),
+      error: result.error
+    };
   }
-  proxies.sort((a, b) => {
-    if (a.to !== b.to)
-      return a.to.localeCompare(b.to);
-    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
-  });
-  const config = {
-    proxies,
-    productionCerts: { certsDir },
-    https: true,
-    hostsManagement: false,
-    cleanup: { hosts: false, certs: false }
-  };
-  if (options.proxy.onDemandTls && domains.size > 0) {
-    config.onDemandTls = {
-      enabled: true,
-      allowedSuffixes: [...domains],
-      email: options.proxy.onDemandTlsEmail,
-      certsDir
+  async pollSsmCommand(ssm, commandId, expectedCount) {
+    const pollInterval = 3000;
+    const maxWait = 600000;
+    const startTime = Date.now();
+    const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
+    let lastInvocations = [];
+    while (Date.now() - startTime < maxWait) {
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      try {
+        const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
+        lastInvocations = invocations;
+        if (lastInvocations.length >= expectedCount && lastInvocations.every((i) => terminalStatuses.has(i.Status || ""))) {
+          break;
+        }
+      } catch {}
+    }
+    const perInstance = lastInvocations.map((item) => ({
+      instanceId: item.InstanceId,
+      status: item.Status || "Unknown",
+      output: item.StandardOutputContent,
+      error: item.StandardErrorContent
+    }));
+    const success = perInstance.length > 0 && perInstance.every((item) => item.status === "Success");
+    return {
+      success,
+      instanceCount: perInstance.length,
+      perInstance,
+      error: success ? undefined : "One or more SSM command invocations failed"
     };
   }
-  if (options.proxy.onDemandTls) {
-    config.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
+}
+
+// src/drivers/hetzner/driver.ts
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+import { execSync } from "node:child_process";
+
+// src/drivers/hetzner/client.ts
+var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
+
+class HetznerClient {
+  name = "hetzner";
+  apiToken;
+  baseUrl;
+  fetchImpl;
+  constructor(options) {
+    this.apiToken = options.apiToken;
+    this.baseUrl = options.baseUrl ?? DEFAULT_API_URL;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async request(method, path, body) {
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.apiToken}`,
+        "Content-Type": "application/json"
+      },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+    const text = await response.text();
+    let data;
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      if (!response.ok) {
+        const snippet = text.trim().slice(0, 200) || response.statusText || "Hetzner API error";
+        throw new Error(`Hetzner API ${method} ${path} (${response.status}): ${snippet}`);
+      }
+      throw new Error(`Hetzner API ${method} ${path}: unexpected non-JSON response`);
+    }
+    if (!response.ok) {
+      const message = data.error?.message || response.statusText || "Hetzner API error";
+      const code = data.error?.code ? ` [${data.error.code}]` : "";
+      throw new Error(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`);
+    }
+    return data;
+  }
+  async listServers() {
+    const data = await this.request("GET", "/servers");
+    return data.servers;
+  }
+  async getServer(id) {
+    const data = await this.request("GET", `/servers/${id}`);
+    return data.server;
+  }
+  async createServer(options) {
+    const data = await this.request("POST", "/servers", {
+      name: options.name,
+      server_type: options.serverType,
+      image: options.image,
+      location: options.location,
+      datacenter: options.datacenter,
+      ssh_keys: options.sshKeys,
+      user_data: options.userData,
+      labels: options.labels,
+      firewalls: options.firewalls,
+      networks: options.networks,
+      start_after_create: true
+    });
+    return { server: data.server, action: data.action };
+  }
+  async listNetworks() {
+    const data = await this.request("GET", "/networks");
+    return data.networks;
+  }
+  async createNetwork(options) {
+    const ipRange = options.ipRange ?? "10.0.0.0/16";
+    const data = await this.request("POST", "/networks", {
+      name: options.name,
+      ip_range: ipRange,
+      subnets: [{ type: "cloud", ip_range: ipRange, network_zone: "eu-central" }],
+      labels: options.labels
+    });
+    return data.network;
+  }
+  async deleteNetwork(id) {
+    await this.request("DELETE", `/networks/${id}`);
+  }
+  async listLoadBalancers() {
+    const data = await this.request("GET", "/load_balancers");
+    return data.load_balancers;
+  }
+  async createLoadBalancer(options) {
+    const data = await this.request("POST", "/load_balancers", {
+      name: options.name,
+      load_balancer_type: options.type ?? "lb11",
+      location: options.location,
+      network_zone: options.network ? undefined : options.networkZone ?? "eu-central",
+      network: options.network,
+      labels: options.labels,
+      targets: [{ type: "label_selector", label_selector: { selector: options.labelSelector }, use_private_ip: !!options.network }],
+      services: options.services.map((s) => ({
+        protocol: s.protocol ?? "tcp",
+        listen_port: s.listenPort,
+        destination_port: s.destinationPort,
+        health_check: {
+          protocol: "http",
+          port: 80,
+          interval: 15,
+          timeout: 10,
+          retries: 3,
+          http: { path: "/", status_codes: ["2??", "3??"] }
+        }
+      }))
+    });
+    return data.load_balancer;
+  }
+  async deleteLoadBalancer(id) {
+    await this.request("DELETE", `/load_balancers/${id}`);
+  }
+  async deleteServer(id) {
+    const data = await this.request("DELETE", `/servers/${id}`);
+    return data.action;
+  }
+  async listFirewalls() {
+    const data = await this.request("GET", "/firewalls");
+    return data.firewalls;
+  }
+  async createFirewall(options) {
+    const data = await this.request("POST", "/firewalls", {
+      name: options.name,
+      rules: options.rules,
+      labels: options.labels,
+      apply_to: options.applyTo
+    });
+    return { firewall: data.firewall, actions: data.actions };
+  }
+  async setFirewallRules(firewallId, rules) {
+    const data = await this.request("POST", `/firewalls/${firewallId}/actions/set_rules`, {
+      rules
+    });
+    return data.actions ?? [];
+  }
+  async deleteFirewall(firewallId) {
+    await this.request("DELETE", `/firewalls/${firewallId}`);
+  }
+  async applyFirewallToResources(firewallId, applyTo) {
+    const data = await this.request("POST", `/firewalls/${firewallId}/actions/apply_to_resources`, {
+      apply_to: applyTo
+    });
+    return data.actions;
+  }
+  async listSshKeys() {
+    const data = await this.request("GET", "/ssh_keys");
+    return data.ssh_keys;
+  }
+  async createSshKey(options) {
+    const data = await this.request("POST", "/ssh_keys", {
+      name: options.name,
+      public_key: options.publicKey,
+      labels: options.labels
+    });
+    return data.ssh_key;
+  }
+  async waitForAction(actionId, options) {
+    const pollInterval = options?.pollIntervalMs ?? 2000;
+    const maxWait = options?.maxWaitMs ?? 300000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const data = await this.request("GET", `/actions/${actionId}`);
+      if (data.action.status === "success")
+        return data.action;
+      if (data.action.status === "error") {
+        throw new Error(data.action.error?.message || "Hetzner action failed");
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
   }
-  const cdn = options.proxy.cdn;
-  if (cdn?.secret && cdn.frontedHosts.length > 0) {
-    config.originGuard = {
-      header: cdn.secretHeader ?? "X-Origin-Verify",
-      value: cdn.secret,
-      hosts: cdn.frontedHosts
-    };
+  async waitForServerRunning(serverId, options) {
+    const pollInterval = options?.pollIntervalMs ?? 3000;
+    const maxWait = options?.maxWaitMs ?? 600000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const server = await this.getServer(serverId);
+      if (server.status === "running")
+        return server;
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
-  return config;
-}
-function buildRpxConfig(sites, options) {
-  return buildRpxConfigInternal(sites, options);
-}
-function buildRpxLbConfig(sites, appBoxes, options) {
-  return buildRpxConfigInternal(sites, options, appBoxes);
-}
-function renderRpxLauncher(config) {
-  const json = JSON.stringify(config, null, 2);
-  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
-// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
-import { startProxies } from '@stacksjs/rpx'
-
-const config = ${json} as const
-
-await startProxies(config as any)
-`;
 }
-var RPX_DIR = "/etc/rpx";
-var RPX_INSTALL_DIR = "/opt/rpx-gateway";
-var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
-var RPX_SERVICE_NAME = "rpx-gateway.service";
-var RPX_SITES_DIR = "/etc/rpx/sites.d";
-function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
-  return `// Generated by ts-cloud — rpx gateway assembler.
-// Merges every app's fragment in ${sitesDir} so independent deploys compose
-// without clobbering each other. Each deploy writes only its own <slug>.json.
-import { startProxies } from '@stacksjs/rpx'
-import { readdirSync, readFileSync } from 'node:fs'
-
-const dir = ${JSON.stringify(sitesDir)}
-const proxies = []
-const seen = new Set()
-const suffixes = new Set()
-const guardHosts = new Set()
-let email
-let certsDir = ${JSON.stringify(defaultCertsDir)}
-let acmeChallengeWebroot
-let guard
-let files = []
-try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
-for (const f of files) {
-  let frag
-  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) } catch { continue }
-  for (const p of frag.proxies ?? []) {
-    const key = p.id || (p.to + (p.path ?? ''))
-    if (seen.has(key)) continue
-    seen.add(key)
-    proxies.push(p)
-  }
-  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
-  email ??= frag.onDemandTls?.email
-  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
-  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
-  if (frag.originGuard) {
-    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
-    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+function resolveHetznerApiToken(configToken) {
+  const token = configToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
+  if (!token) {
+    throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
   }
+  return token;
 }
-const config = {
-  proxies,
-  productionCerts: { certsDir },
-  https: true,
-  hostsManagement: false,
-  cleanup: { hosts: false, certs: false },
-  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
-  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
-  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+function normalizeSshPublicKey(publicKey) {
+  const [type, body] = publicKey.trim().split(/\s+/);
+  return body ? `${type} ${body}` : type;
 }
 
-await startProxies(config)
-`;
-}
-function writeFileHeredoc(path, content, delimiter) {
-  return [
-    `cat > ${path} <<'${delimiter}'`,
-    content,
-    delimiter
-  ];
-}
-function certDomainsForConfig(config) {
-  const seen = new Set;
-  for (const r of config.proxies) {
-    const host = r.to;
-    if (!host || host.startsWith("*") || host.includes(":") || !host.includes("."))
-      continue;
-    seen.add(host);
-  }
-  return [...seen];
-}
-function buildCertManagementCommands(options) {
-  const { config, proxy } = options;
-  const webroot = config.acmeChallengeWebroot;
-  const domains = certDomainsForConfig(config);
-  if (!proxy.onDemandTls || !webroot || domains.length === 0)
-    return [];
-  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
-  const version = proxy.version ?? "latest";
-  const certsDir = config.productionCerts.certsDir;
-  const email = proxy.onDemandTlsEmail ?? `webmaster@${domains[0]}`;
-  const tlsxCli = `${bunBin} ${RPX_INSTALL_DIR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`;
-  const csv = domains.join(",");
-  const spaced = domains.join(" ");
-  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
-  const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
-  const renewServiceName = `rpx-cert-renew-${slug}.service`;
-  const renewTimerName = `rpx-cert-renew-${slug}.timer`;
-  const renewScript = [
-    "#!/bin/sh",
-    "# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.",
-    "# The running gateway serves the challenge from $WEBROOT on :80, so this needs",
-    "# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.",
-    "set -u",
-    `CERTS='${certsDir}'`,
-    `WEBROOT='${webroot}'`,
-    `EMAIL='${email}'`,
-    `TLSX="${tlsxCli}"`,
-    `DOMAINS='${csv}'`,
-    'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
-    `for d in ${spaced}; do`,
-    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
-    "done",
-    '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
-    'rm -f "$CERTS"/*.chain.crt',
-    'after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
-    `[ "$before" = "$after" ] || systemctl restart ${RPX_SERVICE_NAME}`
-  ].join(`
-`);
-  const renewService = [
-    "[Unit]",
-    `Description=Issue/renew rpx gateway TLS certs for ${slug} (tlsx http-01)`,
-    `After=network-online.target ${RPX_SERVICE_NAME}`,
-    "Wants=network-online.target",
-    "",
-    "[Service]",
-    "Type=oneshot",
-    `ExecStart=${renewScriptPath}`
-  ].join(`
-`);
-  const renewTimer = [
-    "[Unit]",
-    `Description=Daily rpx gateway TLS cert issuance/renewal for ${slug}`,
-    "",
-    "[Timer]",
-    "OnCalendar=*-*-* 03:30:00",
-    "RandomizedDelaySec=1h",
-    "Persistent=true",
-    "",
-    "[Install]",
-    "WantedBy=timers.target"
-  ].join(`
+// src/drivers/hetzner/cloud-init.ts
+function wrapCloudInitUserData(bootstrapScript) {
+  const scriptPath = "/var/lib/cloud/ts-cloud-bootstrap.sh";
+  const indented = bootstrapScript.split(`
+`).map((line) => `      ${line}`).join(`
 `);
-  return [
-    `mkdir -p ${webroot}`,
-    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/tlsx@${version}) || true`,
-    ...writeFileHeredoc(renewScriptPath, renewScript, "TS_CLOUD_RENEW_EOF"),
-    `chmod +x ${renewScriptPath}`,
-    ...writeFileHeredoc(`/etc/systemd/system/${renewServiceName}`, renewService, "TS_CLOUD_RENEW_SVC_EOF"),
-    ...writeFileHeredoc(`/etc/systemd/system/${renewTimerName}`, renewTimer, "TS_CLOUD_RENEW_TIMER_EOF"),
-    "systemctl daemon-reload",
-    `systemctl enable --now ${renewTimerName} || true`,
-    `${renewScriptPath} || true`
-  ];
-}
-function buildRpxProvisionScript(options) {
-  const { config, proxy } = options;
-  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
-  const version = proxy.version ?? "latest";
-  const certsDir = config.productionCerts.certsDir;
-  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
-  const fragment = JSON.stringify({ slug, ...config }, null, 2);
-  const assembler = renderRpxAssembler(RPX_SITES_DIR, certsDir);
-  const upstreamTimeout = proxy.upstreamTimeout ?? 60;
-  const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
-  if (typeof proxy.maxUpstreamConns === "number")
-    poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
-  return [
-    "set -euo pipefail",
-    `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
-    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
-    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version})`,
-    `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
-    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
-    ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
-    ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
-      "[Unit]",
-      "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
-      "After=network.target network-online.target",
-      "Wants=network-online.target",
-      "",
-      "[Service]",
-      "Type=simple",
-      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
-      `WorkingDirectory=${RPX_INSTALL_DIR}`,
-      `Environment=BUN_INSTALL=/root/.bun`,
-      ...poolEnv,
-      "Restart=always",
-      "RestartSec=5",
-      "LimitNOFILE=1048576",
-      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
-      "",
-      "[Install]",
-      "WantedBy=multi-user.target"
-    ].join(`
-`), "TS_CLOUD_RPX_UNIT_EOF"),
-    "systemctl daemon-reload",
-    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
-    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
-    `systemctl enable ${RPX_SERVICE_NAME}`,
-    `systemctl restart ${RPX_SERVICE_NAME}`,
-    ...buildCertManagementCommands(options)
-  ];
+  return `#cloud-config
+write_files:
+  - path: ${scriptPath}
+    permissions: '0755'
+    owner: root:root
+    content: |
+${indented}
+runcmd:
+  - [ bash, ${scriptPath} ]
+`;
 }
 
 // src/drivers/shared/fleet.ts
@@ -2435,7 +2441,7 @@ class HetznerDriver {
       versions: compute.php?.versions,
       default: compute.php?.default,
       extensions: compute.php?.extensions,
-      installNginx: compute.webServer !== "rpx",
+      installNginx: !usesRpxProxy(compute),
       optimizeForProduction: compute.php?.optimizeForProduction,
       ini: compute.php?.ini
     });
@@ -4418,7 +4424,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
       appBase: appBase2,
       defaultPhpVersion: phpVersion
     });
-    const useNginx = compute2?.webServer !== "rpx";
+    const useNginx = !usesRpxProxy(compute2);
     const sslProvider = resolveSslProvider(site);
     const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
     const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase: appBase2 }) : [];
@@ -4500,7 +4506,7 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     healthCheckPath: site.healthCheck?.path
   });
   const compute = config.infrastructure?.compute;
-  const wantsNginxStatic = kind === "server-static" && compute?.webServer !== "rpx" && !!site.domain;
+  const wantsNginxStatic = kind === "server-static" && !usesRpxProxy(compute) && !!site.domain;
   const staticVhost = wantsNginxStatic ? buildNginxVhostScript({
     siteName,
     domain: site.domain,
@@ -4761,4 +4767,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };