@stacksjs/ts-cloud 0.7.4 → 0.7.6

package/dist/chunk-dpkk640m.js

@@ -0,0 +1,4392 @@
+import {
+  deploymentCoexistenceError,
+  hasManagementDashboardSite,
+  resolveCloudProvider,
+  resolveManagementDashboardSite,
+  resolveProjectStackName
+} from "./chunk-c6rgvg1j.js";
+import {
+  EC2Client,
+  SSMClient
+} from "./chunk-93hjhs78.js";
+import {
+  CloudFormationClient
+} from "./chunk-qpj3edwz.js";
+import {
+  S3Client
+} from "./chunk-vd87cpvn.js";
+import {
+  __require
+} from "./chunk-v0bahtg2.js";
+
+// src/drivers/aws/driver.ts
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// src/drivers/shared/package-manager.ts
+var PANTRY_PACKAGES = {
+  php: "php.net",
+  nginx: "nginx.org",
+  composer: "getcomposer.org",
+  mysql: "mysql.com",
+  mariadb: "mariadb.com/server",
+  postgres: "postgresql.org",
+  redis: "redis.io",
+  memcached: "memcached.org",
+  meilisearch: "meilisearch.com",
+  git: "git-scm.com",
+  certbot: "certbot.eff.org",
+  bun: "bun.sh",
+  node: "nodejs.org",
+  deno: "deno.land"
+};
+var PANTRY_INSTALL_DIR = "/usr/local/bin";
+var PANTRY_PROJECT_DIR = "/opt/pantry";
+function sh(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
+function buildPantryBootstrapScript(options = {}) {
+  const versionLine = options.version ? `export PANTRY_VERSION=${sh(options.version)}` : 'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"';
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "export PANTRY_SERVICE_SCOPE=system",
+    `export PANTRY_INSTALL_DIR=${PANTRY_INSTALL_DIR}`,
+    versionLine,
+    "command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)",
+    "command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",
+    "command -v pantry >/dev/null 2>&1 || curl -fsSL https://pantry.dev | bash",
+    `export PATH="${PANTRY_INSTALL_DIR}:$PATH"`,
+    `mkdir -p ${PANTRY_PROJECT_DIR}`
+  ];
+}
+function pantryEnvActivation() {
+  return `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)" || true`;
+}
+function buildPantryInstallScript(specs) {
+  if (specs.length === 0)
+    return [];
+  const unique = [...new Set(specs)];
+  return [`(cd ${PANTRY_PROJECT_DIR} && pantry install ${unique.map(sh).join(" ")})`];
+}
+function buildPantryServiceScript(services) {
+  return [...new Set(services)].flatMap((name) => [
+    `(cd ${PANTRY_PROJECT_DIR} && pantry start ${sh(name)})`,
+    `(cd ${PANTRY_PROJECT_DIR} && pantry enable ${sh(name)})`
+  ]);
+}
+
+// src/drivers/shared/db-provision.ts
+function enabled(spec) {
+  return spec === true || typeof spec === "object" && spec != null;
+}
+function planServices(services) {
+  const packages = [];
+  const names = [];
+  if (enabled(services.mysql)) {
+    packages.push(typeof services.mysql === "object" && services.mysql.version ? `mysql.com@${services.mysql.version}` : "mysql.com@8.0.43");
+    names.push("mysql");
+  } else if (enabled(services.mariadb)) {
+    packages.push(PANTRY_PACKAGES.mariadb);
+    names.push("mariadb");
+  }
+  if (enabled(services.postgres)) {
+    packages.push("postgresql.org");
+    names.push("postgres");
+  }
+  if (enabled(services.redis)) {
+    packages.push("redis.io");
+    names.push("redis");
+  }
+  if (enabled(services.memcached)) {
+    packages.push("memcached.org");
+    names.push("memcached");
+  }
+  if (enabled(services.meilisearch)) {
+    packages.push("meilisearch.com");
+    names.push("meilisearch");
+  }
+  return { packages, services: names };
+}
+function buildServicesProvisionScript(services = {}, _options = {}) {
+  const plan = planServices(services);
+  if (plan.packages.length === 0)
+    return [];
+  return [
+    ...buildPantryInstallScript(plan.packages),
+    ...buildPantryServiceScript(plan.services)
+  ];
+}
+function buildDatabaseSetupScript(database, services = {}) {
+  if (!database?.name)
+    return [];
+  if (database.host && database.host !== "127.0.0.1" && database.host !== "localhost")
+    return [];
+  const name = database.name;
+  const user = database.username || name;
+  const pass = database.password || "";
+  const usePostgres = enabled(services.postgres) || database.engine === "postgres";
+  const useMariadb = enabled(services.mariadb) || database.engine === "mariadb";
+  const useMysql = enabled(services.mysql) || database.engine === "mysql";
+  if (usePostgres && !useMysql && !useMariadb) {
+    const pgIdent = (v) => `"${v.replace(/"/g, '""')}"`;
+    const pgLit = (v) => `'${v.replace(/'/g, "''")}'`;
+    const pgEnsureRole = (u, p) => [
+      "DO $$ BEGIN",
+      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(u)}) THEN`,
+      `    CREATE ROLE ${pgIdent(u)} LOGIN PASSWORD ${pgLit(p)};`,
+      "  ELSE",
+      `    ALTER ROLE ${pgIdent(u)} LOGIN PASSWORD ${pgLit(p)};`,
+      "  END IF;",
+      "END $$;"
+    ];
+    const pgGrant = (u) => {
+      const dbs = u.databases && u.databases.length > 0 ? u.databases : [name];
+      const lines = [];
+      for (const db of dbs) {
+        if (u.access === "readonly") {
+          lines.push(`GRANT CONNECT ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`, `\\connect ${pgIdent(db)}`, `GRANT USAGE ON SCHEMA public TO ${pgIdent(u.username)};`, `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${pgIdent(u.username)};`, `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${pgIdent(u.username)};`, "\\connect postgres");
+        } else {
+          lines.push(`GRANT ALL PRIVILEGES ON DATABASE ${pgIdent(db)} TO ${pgIdent(u.username)};`);
+        }
+      }
+      return lines;
+    };
+    const extraUsers2 = database.users || [];
+    return [
+      pantryEnvActivation(),
+      "for i in $(seq 1 30); do pg_isready -h 127.0.0.1 -p 5432 -q && break; sleep 2; done",
+      "psql -h 127.0.0.1 -p 5432 -U postgres <<'TS_CLOUD_PG_EOF'",
+      ...pgEnsureRole(user, pass),
+      `SELECT 'CREATE DATABASE ${pgIdent(name)} OWNER ${pgIdent(user)}' ` + `WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`,
+      ...extraUsers2.flatMap((u) => [...pgEnsureRole(u.username, u.password), ...pgGrant(u)]),
+      "TS_CLOUD_PG_EOF"
+    ];
+  }
+  const sock = useMariadb ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
+  const ident = (v) => v.replace(/`/g, "``");
+  const lit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  const mysqlUser = (u) => {
+    const dbs = u.databases && u.databases.length > 0 ? u.databases : [name];
+    const priv = u.access === "readonly" ? "SELECT" : "ALL PRIVILEGES";
+    const lines = [
+      `CREATE USER IF NOT EXISTS '${lit(u.username)}'@'%' IDENTIFIED BY '${lit(u.password)}';`,
+      `CREATE USER IF NOT EXISTS '${lit(u.username)}'@'localhost' IDENTIFIED BY '${lit(u.password)}';`,
+      `ALTER USER '${lit(u.username)}'@'%' IDENTIFIED BY '${lit(u.password)}';`,
+      `ALTER USER '${lit(u.username)}'@'localhost' IDENTIFIED BY '${lit(u.password)}';`
+    ];
+    for (const db of dbs) {
+      lines.push(`GRANT ${priv} ON \`${ident(db)}\`.* TO '${lit(u.username)}'@'%';`, `GRANT ${priv} ON \`${ident(db)}\`.* TO '${lit(u.username)}'@'localhost';`);
+    }
+    return lines;
+  };
+  const extraUsers = database.users || [];
+  return [
+    pantryEnvActivation(),
+    `for i in $(seq 1 30); do mysqladmin --socket=${sock} -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done`,
+    `mysql --socket=${sock} -u root <<'TS_CLOUD_SQL_EOF'`,
+    `CREATE DATABASE IF NOT EXISTS \`${ident(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
+    ...mysqlUser({ username: user, password: pass }),
+    ...extraUsers.flatMap(mysqlUser),
+    "FLUSH PRIVILEGES;",
+    "TS_CLOUD_SQL_EOF"
+  ];
+}
+function buildManagedDbEnv(database) {
+  if (!database?.name)
+    return {};
+  const connection = database.engine === "postgres" ? "pgsql" : "mysql";
+  const port = database.port ?? (database.engine === "postgres" ? 5432 : 3306);
+  const env = {
+    DB_CONNECTION: connection,
+    DB_HOST: database.host || "127.0.0.1",
+    DB_PORT: String(port),
+    DB_DATABASE: database.name
+  };
+  if (database.username)
+    env.DB_USERNAME = database.username;
+  if (database.password)
+    env.DB_PASSWORD = database.password;
+  return env;
+}
+
+// src/drivers/shared/php-provision.ts
+var PRODUCTION_PHP_INI = {
+  "opcache.enable": "1",
+  "opcache.enable_cli": "1",
+  "opcache.memory_consumption": "256",
+  "opcache.interned_strings_buffer": "16",
+  "opcache.max_accelerated_files": "20000",
+  "opcache.validate_timestamps": "0",
+  "opcache.revalidate_freq": "0",
+  "opcache.save_comments": "1",
+  "opcache.fast_shutdown": "1",
+  realpath_cache_size: "4096K",
+  realpath_cache_ttl: "600"
+};
+var PHP_FPM_LISTEN = "127.0.0.1:9074";
+function phpFpmSocketPath(_version) {
+  return PHP_FPM_LISTEN;
+}
+function resolveDefaultPhpVersion(options = {}) {
+  const versions = options.versions?.length ? options.versions : ["8.3"];
+  return options.default && versions.includes(options.default) ? options.default : versions[0];
+}
+function resolvePhpIni(options = {}) {
+  const base = options.optimizeForProduction === false ? {} : { ...PRODUCTION_PHP_INI };
+  return { ...base, ...options.ini || {} };
+}
+function buildPhpTuningScript(options = {}) {
+  const ini = resolvePhpIni(options);
+  const keys = Object.keys(ini);
+  if (keys.length === 0)
+    return [];
+  const body = keys.map((k) => `${k}=${ini[k]}`);
+  const marker = "ts-cloud-managed";
+  return [
+    pantryEnvActivation(),
+    "TS_CLOUD_SCAN_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Scan this dir for additional .ini files/{print $2}' | head -1)",
+    `TS_CLOUD_LOADED_INI=$(php -r 'echo php_ini_loaded_file() ?: "";' 2>/dev/null)`,
+    'if [ -n "$TS_CLOUD_SCAN_DIR" ] && [ "$TS_CLOUD_SCAN_DIR" != "(none)" ]; then',
+    '  mkdir -p "$TS_CLOUD_SCAN_DIR"',
+    '  TS_CLOUD_PHP_INI="$TS_CLOUD_SCAN_DIR/zz-ts-cloud.ini"',
+    `  cat > "$TS_CLOUD_PHP_INI" <<'TS_CLOUD_PHPINI_EOF'`,
+    `; ${marker} — production PHP tuning`,
+    ...body,
+    "TS_CLOUD_PHPINI_EOF",
+    "else",
+    '  if [ -z "$TS_CLOUD_LOADED_INI" ]; then',
+    "    TS_CLOUD_INI_DIR=$(php -i 2>/dev/null | awk -F' => ' '/^Configuration File \\(php.ini\\) Path/{print $2}' | head -1)",
+    '    TS_CLOUD_LOADED_INI="$TS_CLOUD_INI_DIR/php.ini"',
+    '    mkdir -p "$TS_CLOUD_INI_DIR"',
+    '    touch "$TS_CLOUD_LOADED_INI"',
+    "  fi",
+    `  sed -i '/; ${marker} BEGIN/,/; ${marker} END/d' "$TS_CLOUD_LOADED_INI"`,
+    `  cat >> "$TS_CLOUD_LOADED_INI" <<'TS_CLOUD_PHPINI_EOF'`,
+    `; ${marker} BEGIN`,
+    ...body,
+    `; ${marker} END`,
+    "TS_CLOUD_PHPINI_EOF",
+    "fi",
+    `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`
+  ];
+}
+function buildPhpProvisionScript(options = {}) {
+  const defaultVersion = resolveDefaultPhpVersion(options);
+  const installNginx = options.installNginx !== false;
+  const installComposer = options.installComposer !== false;
+  const specs = [`php.net@${defaultVersion}`];
+  if (installComposer)
+    specs.push("getcomposer.org");
+  if (installNginx)
+    specs.push("nginx.org");
+  return [
+    ...buildPantryInstallScript(specs),
+    ...buildPantryServiceScript(["php-fpm"]),
+    ...buildPhpTuningScript(options)
+  ];
+}
+
+// src/drivers/shared/nginx-vhost.ts
+function resolveNginxSnippet(nginx, templates) {
+  if (!nginx)
+    return [];
+  const out = [];
+  if (nginx.template && templates?.[nginx.template])
+    out.push(...templates[nginx.template]);
+  if (nginx.serverSnippet)
+    out.push(...nginx.serverSnippet);
+  return out;
+}
+function hstsHeader(hsts) {
+  if (!hsts)
+    return "";
+  const o = typeof hsts === "object" ? hsts : {};
+  const maxAge = o.maxAge ?? 31536000;
+  const parts = [`max-age=${maxAge}`];
+  if (o.includeSubDomains ?? true)
+    parts.push("includeSubDomains");
+  if (o.preload)
+    parts.push("preload");
+  return `    add_header Strict-Transport-Security "${parts.join("; ")}" always;`;
+}
+function securityRules(security) {
+  if (!security || !security.allow?.length && !security.deny?.length)
+    return [];
+  const lines = [];
+  for (const ip of security.deny || [])
+    lines.push(`    deny ${ip};`);
+  if (security.allow?.length) {
+    for (const ip of security.allow)
+      lines.push(`    allow ${ip};`);
+    lines.push("    deny all;");
+  }
+  return lines;
+}
+function htpasswdPath(siteName) {
+  return `/etc/nginx/.htpasswd-${siteName}`;
+}
+var PHP_TYPES = new Set(["laravel", "php", "statamic", "wordpress"]);
+function isPhpSiteType(type) {
+  return PHP_TYPES.has(type);
+}
+function defaultWebDirectory(type) {
+  return type === "laravel" || type === "statamic" ? "public" : "";
+}
+function resolveRoot(appDir, webDirectory) {
+  const base = appDir.replace(/\/+$/, "");
+  const sub = webDirectory.replace(/^\/+|\/+$/g, "");
+  return sub ? `${base}/${sub}` : base;
+}
+function vhostBody(options) {
+  const type = options.type ?? "laravel";
+  const webDirectory = options.webDirectory ?? defaultWebDirectory(type);
+  const root = resolveRoot(options.appDir, webDirectory);
+  const isPhp = isPhpSiteType(type);
+  const phpVersion = options.phpVersion ?? "8.3";
+  const lines = [
+    `    root ${root};`,
+    "",
+    '    add_header X-Frame-Options "SAMEORIGIN";',
+    '    add_header X-Content-Type-Options "nosniff";'
+  ];
+  const hsts = hstsHeader(options.hsts);
+  if (hsts)
+    lines.push(hsts);
+  for (const rule of securityRules(options.security))
+    lines.push(rule);
+  lines.push("", `    index ${isPhp ? "index.php index.html" : "index.html index.htm"};`, "", "    charset utf-8;", "");
+  if (options.clientMaxBodySize) {
+    lines.push(`    client_max_body_size ${options.clientMaxBodySize};`, "");
+  }
+  if (options.auth) {
+    lines.push(`    auth_basic "${options.auth.realm || "Restricted"}";`, `    auth_basic_user_file ${htpasswdPath(options.siteName)};`, "");
+  }
+  for (const [from, to] of Object.entries(options.redirects || {})) {
+    lines.push(`    location = ${from} { return 301 ${to}; }`);
+  }
+  if (Object.keys(options.redirects || {}).length > 0)
+    lines.push("");
+  if (isPhp) {
+    lines.push("    location / {", "        try_files $uri $uri/ /index.php?$query_string;", "    }", "", "    location = /favicon.ico { access_log off; log_not_found off; }", "    location = /robots.txt  { access_log off; log_not_found off; }", "", "    error_page 404 /index.php;", "", "    location ~ \\.php$ {", `        fastcgi_pass ${options.fastcgiPass ?? phpFpmSocketPath(phpVersion)};`, "        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;", "        include fastcgi_params;", "    }", "", "    location ~ /\\.(?!well-known).* {", "        deny all;", "    }");
+    if (type === "wordpress") {
+      lines.push("", "    location = /xmlrpc.php { deny all; }", "    location ~* /(?:wp-config\\.php|readme\\.html|license\\.txt)$ { deny all; }", "    location ~* /wp-content/uploads/.*\\.php$ { deny all; }");
+    }
+  } else if (type === "spa") {
+    lines.push("    location / {", "        try_files $uri $uri/ /index.html;", "    }");
+  } else {
+    lines.push("    location / {", "        try_files $uri $uri/ =404;", "    }");
+  }
+  if (options.serverSnippet && options.serverSnippet.length > 0) {
+    lines.push("");
+    for (const line of options.serverSnippet)
+      lines.push(line ? `    ${line}` : "");
+  }
+  return lines;
+}
+function buildNginxVhost(options) {
+  const serverNames = [options.domain, ...options.aliases || []].filter(Boolean).join(" ");
+  const body = vhostBody(options);
+  if (options.ssl) {
+    const redirect = [
+      "server {",
+      "    listen 80;",
+      "    listen [::]:80;",
+      `    server_name ${serverNames};`,
+      "    return 301 https://$host$request_uri;",
+      "}"
+    ];
+    const tls = [
+      "server {",
+      "    listen 443 ssl;",
+      "    listen [::]:443 ssl;",
+      `    server_name ${serverNames};`,
+      `    ssl_certificate ${options.ssl.certPath};`,
+      `    ssl_certificate_key ${options.ssl.keyPath};`,
+      ...options.tlsProtocols?.length ? [`    ssl_protocols ${options.tlsProtocols.join(" ")};`] : [],
+      "",
+      ...body,
+      "}"
+    ];
+    return `${[...redirect, "", ...tls].join(`
+`)}
+`;
+  }
+  const lines = [
+    "server {",
+    "    listen 80;",
+    "    listen [::]:80;",
+    `    server_name ${serverNames};`,
+    ...body,
+    "}"
+  ];
+  return `${lines.join(`
+`)}
+`;
+}
+function buildNginxVhostScript(options) {
+  const available = `/etc/nginx/sites-available/${options.siteName}`;
+  const enabled2 = `/etc/nginx/sites-enabled/${options.siteName}`;
+  const vhost = buildNginxVhost(options);
+  const out = [...buildNginxServiceScript()];
+  if (options.auth) {
+    const file = htpasswdPath(options.siteName);
+    const sq = (v) => v.split("'").join("'\\''");
+    const pw = sq(options.auth.password);
+    const user = sq(options.auth.username);
+    out.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${pw}')`, `printf '%s:%s\\n' '${user}' "$TS_CLOUD_HTPASS" > ${file}`, `chmod 640 ${file}`, `chown root:www-data ${file} 2>/dev/null || true`);
+  }
+  out.push(`cat > ${available} <<'TS_CLOUD_NGINX_EOF'`, vhost.replace(/\n$/, ""), "TS_CLOUD_NGINX_EOF", `ln -sf ${available} ${enabled2}`, "rm -f /etc/nginx/sites-enabled/default", `${NGINX_WRAPPER} -t`, "systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true");
+  return out;
+}
+var NGINX_WRAPPER = "/usr/local/bin/ts-cloud-nginx";
+function buildNginxServiceScript(projectDir = "/opt/pantry") {
+  return [
+    ...buildPantryBootstrapScript(),
+    ...buildPantryInstallScript(["nginx.org"]),
+    "mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi",
+    "getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data",
+    "chown -R www-data:www-data /var/lib/nginx /var/log/nginx",
+    `cat > ${NGINX_WRAPPER} <<'TS_CLOUD_NGINXBIN_EOF'`,
+    "#!/bin/sh",
+    `eval "$(cd ${projectDir} && pantry env 2>/dev/null)"`,
+    "NGINX_BIN=/opt/pantry/pantry/.bin/nginx",
+    'if [ ! -x "$NGINX_BIN" ]; then NGINX_BIN=$(command -v nginx || true); fi',
+    'if [ -z "$NGINX_BIN" ]; then echo "nginx binary not found; run pantry install nginx.org or install nginx explicitly" >&2; exit 1; fi',
+    'exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',
+    "TS_CLOUD_NGINXBIN_EOF",
+    `chmod +x ${NGINX_WRAPPER}`,
+    "cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'",
+    "fastcgi_param  QUERY_STRING       $query_string;",
+    "fastcgi_param  REQUEST_METHOD     $request_method;",
+    "fastcgi_param  CONTENT_TYPE       $content_type;",
+    "fastcgi_param  CONTENT_LENGTH     $content_length;",
+    "fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;",
+    "fastcgi_param  REQUEST_URI        $request_uri;",
+    "fastcgi_param  DOCUMENT_URI       $document_uri;",
+    "fastcgi_param  DOCUMENT_ROOT      $document_root;",
+    "fastcgi_param  SERVER_PROTOCOL    $server_protocol;",
+    "fastcgi_param  REQUEST_SCHEME     $scheme;",
+    "fastcgi_param  HTTPS              $https if_not_empty;",
+    "fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;",
+    "fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;",
+    "fastcgi_param  REMOTE_ADDR        $remote_addr;",
+    "fastcgi_param  REMOTE_PORT        $remote_port;",
+    "fastcgi_param  SERVER_ADDR        $server_addr;",
+    "fastcgi_param  SERVER_PORT        $server_port;",
+    "fastcgi_param  SERVER_NAME        $server_name;",
+    "fastcgi_param  REDIRECT_STATUS    200;",
+    "TS_CLOUD_FCGI_EOF",
+    "cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'",
+    "user www-data;",
+    "worker_processes auto;",
+    "pid /run/nginx.pid;",
+    "error_log /var/log/nginx/error.log;",
+    "events { worker_connections 1024; }",
+    "http {",
+    "    default_type application/octet-stream;",
+    "    types {",
+    "        text/html html htm;",
+    "        text/css css;",
+    "        application/javascript js;",
+    "        application/json json;",
+    "        image/svg+xml svg;",
+    "        image/png png;",
+    "        image/jpeg jpg jpeg;",
+    "        image/gif gif;",
+    "        image/x-icon ico;",
+    "        image/webp webp;",
+    "        font/woff2 woff2;",
+    "        font/woff woff;",
+    "        text/plain txt;",
+    "    }",
+    "    access_log /var/log/nginx/access.log;",
+    "    sendfile on;",
+    "    tcp_nopush on;",
+    "    keepalive_timeout 65;",
+    "    server_tokens off;",
+    "    client_max_body_size 100m;",
+    "    client_body_temp_path /var/lib/nginx/body;",
+    "    proxy_temp_path /var/lib/nginx/proxy;",
+    "    fastcgi_temp_path /var/lib/nginx/fastcgi;",
+    "    uwsgi_temp_path /var/lib/nginx/uwsgi;",
+    "    scgi_temp_path /var/lib/nginx/scgi;",
+    "    server {",
+    "        listen 80 default_server;",
+    "        listen [::]:80 default_server;",
+    "        server_name _;",
+    "        return 444;",
+    "    }",
+    "    include /etc/nginx/sites-enabled/*;",
+    "}",
+    "TS_CLOUD_NGINXCONF_EOF",
+    "cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'",
+    "[Unit]",
+    "Description=ts-cloud nginx (pantry)",
+    "After=network.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `ExecStartPre=${NGINX_WRAPPER} -t`,
+    `ExecStart=${NGINX_WRAPPER} -g 'daemon off;'`,
+    `ExecReload=${NGINX_WRAPPER} -s reload`,
+    "Restart=always",
+    "RestartSec=3",
+    "",
+    "[Install]",
+    "WantedBy=multi-user.target",
+    "TS_CLOUD_NGINXUNIT_EOF",
+    "systemctl daemon-reload",
+    "systemctl enable ts-cloud-nginx",
+    "ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"
+  ];
+}
+
+// src/drivers/shared/ufw.ts
+var UFW_BASE_PORTS = [80, 443];
+function buildUfwScript(firewall = {}) {
+  if (firewall.enabled === false)
+    return [];
+  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => p > 0).sort((a, b) => a - b);
+  const lines = [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "apt-get install -y ufw",
+    "ufw default deny incoming",
+    "ufw default allow outgoing",
+    "ufw allow OpenSSH"
+  ];
+  for (const port of ports)
+    lines.push(`ufw allow ${port}/tcp`);
+  lines.push("ufw --force enable");
+  return lines;
+}
+
+// src/drivers/shared/maintenance.ts
+function buildAutoUpdatesScript(enabled2 = true) {
+  if (!enabled2)
+    return [];
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "apt-get install -y unattended-upgrades",
+    "cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",
+    'APT::Periodic::Update-Package-Lists "1";',
+    'APT::Periodic::Unattended-Upgrade "1";',
+    'APT::Periodic::Download-Upgradeable-Packages "1";',
+    'APT::Periodic::AutocleanInterval "7";',
+    "TS_CLOUD_AUTOUPD_EOF",
+    "systemctl enable unattended-upgrades 2>/dev/null || true",
+    "systemctl restart unattended-upgrades 2>/dev/null || true"
+  ];
+}
+
+// src/drivers/shared/monitoring.ts
+var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
+var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
+var DEFAULT_CPU_LOAD_PER_CORE = 2;
+var DEFAULT_MEM_PERCENT = 90;
+var DEFAULT_DISK_PERCENT = 90;
+var SERVICE_PROBES = [
+  ["nginx", 80],
+  ["phpFpm", 9074],
+  ["mysql", 3306],
+  ["postgres", 5432],
+  ["redis", 6379],
+  ["meilisearch", 7700]
+];
+function resolveMonitoring(monitoring = true) {
+  const obj = typeof monitoring === "object" ? monitoring : {};
+  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
+  return {
+    enabled: enabled2,
+    cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
+    memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
+    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
+  };
+}
+function buildMonitoringScript(monitoring = true) {
+  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
+  if (!enabled2)
+    return [];
+  const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
+  const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
+  return [
+    "mkdir -p /var/lib/ts-cloud",
+    "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
+    "#!/bin/bash",
+    "set -uo pipefail",
+    "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
+    "CPUS=$(nproc)",
+    "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
+    "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
+    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
+    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
+    `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
+    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
+    `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
+    `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
+    "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
+    ...probeLines,
+    "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
+    "SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}",
+    "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
+    "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
+    `cat > ${METRICS_PATH}.tmp <<JSON`,
+    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
+    "JSON",
+    `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
+    'ALERTS=""',
+    `if awk -v l="$LOAD" -v c="$CPUS" -v t=${cpuLoadPerCore} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${cpuLoadPerCore}xCPU"; fi`,
+    `if [ "\${MEM_PCT:-0}" -ge ${memPercent} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,
+    `if [ "\${DISK_PCT:-0}" -ge ${diskPercent} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,
+    `PREV=$(cat ${ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
+    'if [ -n "$ALERTS" ]; then',
+    '  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',
+    `  echo alert > ${ALERT_STATE_PATH}`,
+    "else",
+    '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
+    `  echo ok > ${ALERT_STATE_PATH}`,
+    "fi",
+    "TS_CLOUD_METRICS_EOF",
+    "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
+    "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
+    "[Unit]",
+    "Description=ts-cloud metrics collector",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    "ExecStart=/usr/local/bin/ts-cloud-metrics.sh",
+    "TS_CLOUD_METRICS_SVC_EOF",
+    "cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'",
+    "[Unit]",
+    "Description=Run ts-cloud metrics collector every minute",
+    "",
+    "[Timer]",
+    "OnBootSec=60",
+    "OnUnitActiveSec=60",
+    "",
+    "[Install]",
+    "WantedBy=timers.target",
+    "TS_CLOUD_METRICS_TMR_EOF",
+    "systemctl daemon-reload",
+    "systemctl enable ts-cloud-metrics.timer",
+    "systemctl start ts-cloud-metrics.timer"
+  ];
+}
+
+// src/drivers/shared/ssh-keys.ts
+var BLOCK_BEGIN = "# >>> ts-cloud managed keys >>>";
+var BLOCK_END = "# <<< ts-cloud managed keys <<<";
+var DEFAULT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
+function buildAuthorizedKeysScript(keys = [], options = {}) {
+  if (keys.length === 0)
+    return [];
+  const path = options.path ?? DEFAULT_AUTHORIZED_KEYS;
+  const dir = path.replace(/\/[^/]*$/, "");
+  const block = [
+    BLOCK_BEGIN,
+    ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`),
+    BLOCK_END
+  ].join(`
+`);
+  return [
+    `mkdir -p ${dir}`,
+    `touch ${path}`,
+    `sed -i '/^${escapeSed(BLOCK_BEGIN)}$/,/^${escapeSed(BLOCK_END)}$/d' ${path}`,
+    `cat >> ${path} <<'TS_CLOUD_KEYS_EOF'`,
+    block,
+    "TS_CLOUD_KEYS_EOF",
+    `chmod 600 ${path}`
+  ];
+}
+function escapeSed(value) {
+  return value.replace(/[.*[\]\\/^$]/g, "\\$&");
+}
+
+// src/drivers/shared/notifications.ts
+function wantsEvent(config, event) {
+  return !config.events || config.events.includes(event);
+}
+async function sendNotifications(config, event, message, options = {}) {
+  if (!config)
+    return [];
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const attempted = [];
+  const tasks = [];
+  const post = (url, body) => fetchImpl(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }).catch(() => {
+    return;
+  });
+  if (config.slack?.webhookUrl && wantsEvent(config, event)) {
+    attempted.push("slack");
+    tasks.push(post(config.slack.webhookUrl, { text: message }));
+  }
+  if (config.discord?.webhookUrl && wantsEvent(config, event)) {
+    attempted.push("discord");
+    tasks.push(post(config.discord.webhookUrl, { content: message }));
+  }
+  if (config.telegram?.botToken && config.telegram.chatId && wantsEvent(config, event)) {
+    attempted.push("telegram");
+    const url = `https://api.telegram.org/bot${config.telegram.botToken}/sendMessage`;
+    tasks.push(post(url, { chat_id: config.telegram.chatId, text: message }));
+  }
+  if (config.webhook?.url && wantsEvent(config, event)) {
+    attempted.push("webhook");
+    if ((config.webhook.method || "POST") === "GET") {
+      const sep = config.webhook.url.includes("?") ? "&" : "?";
+      const url = `${config.webhook.url}${sep}event=${encodeURIComponent(event)}&message=${encodeURIComponent(message)}`;
+      tasks.push(fetchImpl(url, { method: "GET" }).catch(() => {
+        return;
+      }));
+    } else {
+      tasks.push(post(config.webhook.url, { event, message }));
+    }
+  }
+  if (config.email?.to && wantsEvent(config, event)) {
+    attempted.push("email");
+    tasks.push(sendEmailNotification(config.email, event, message));
+  }
+  await Promise.all(tasks);
+  return attempted;
+}
+async function sendEmailNotification(email, event, message) {
+  try {
+    const mod = await import("./chunk-pqfzdg68.js");
+    await mod.email.send({
+      to: email.to,
+      from: email.from,
+      subject: `[ts-cloud] ${event}`,
+      text: message
+    });
+  } catch {}
+}
+function resolveNotifications(project, site) {
+  return site ?? project;
+}
+function buildNotifierScript(config) {
+  if (!config)
+    return [];
+  const curls = [];
+  if (config.slack?.webhookUrl)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${config.slack.webhookUrl} || true`);
+  if (config.discord?.webhookUrl)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${config.discord.webhookUrl} || true`);
+  if (config.telegram?.botToken && config.telegram.chatId)
+    curls.push(`curl -fsS -X POST "https://api.telegram.org/bot${config.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${config.telegram.chatId}" --data-urlencode "text=$MSG" || true`);
+  if (config.webhook?.url)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${config.webhook.url} || true`);
+  if (curls.length === 0)
+    return [];
+  return [
+    "cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'",
+    "#!/bin/bash",
+    'MSG="$1"',
+    ...curls,
+    "TS_CLOUD_NOTIFY_EOF",
+    "chmod +x /usr/local/bin/ts-cloud-notify"
+  ];
+}
+
+// src/drivers/shared/backups.ts
+var BACKUP_OUTPUT_DIR = "/var/backups/ts-cloud";
+var BACKUP_CONFIG_PATH = "/etc/ts-cloud/backups.config.ts";
+var BACKUP_CRON_PATH = "/etc/cron.d/ts-cloud-backups";
+var BACKUP_RUNNER_PATH = "/usr/local/bin/ts-cloud-backup.sh";
+function backupEntryFor(database) {
+  if (!database.name)
+    return null;
+  const host = database.host || "127.0.0.1";
+  const isPostgres = database.engine === "postgres";
+  const type = isPostgres ? "postgresql" : "mysql";
+  const port = database.port ?? (isPostgres ? 5432 : 3306);
+  const ts = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  return [
+    "  {",
+    `    type: '${type}',`,
+    `    name: '${ts(database.name)}',`,
+    "    connection: {",
+    `      hostname: '${ts(host)}',`,
+    `      port: ${port},`,
+    `      database: '${ts(database.name)}',`,
+    `      username: '${ts(database.username || database.name)}',`,
+    `      password: '${ts(database.password || "")}',`,
+    "      ssl: false,",
+    "    },",
+    "    includeSchema: true,",
+    "    includeData: true,",
+    "  },"
+  ].join(`
+`);
+}
+function buildBackupsConfigTs(database, backups) {
+  const entry = database ? backupEntryFor(database) : null;
+  const destinations = backups.bucket ? [
+    "  destinations: [",
+    "    {",
+    "      type: 's3',",
+    `      bucket: '${backups.bucket}',`,
+    "      prefix: 'db-backups',",
+    ...backups.endpoint ? [`      endpoint: '${backups.endpoint}',`] : [],
+    "      optional: false,",
+    "    },",
+    "  ],"
+  ] : [];
+  return [
+    "import type { BackupConfig } from 'ts-backups'",
+    "",
+    "const config: BackupConfig = {",
+    "  verbose: true,",
+    `  outputPath: '${BACKUP_OUTPUT_DIR}',`,
+    "  retention: {",
+    `    count: ${backups.retentionCount ?? 5},`,
+    `    maxAge: ${backups.retentionDays ?? 30},`,
+    "  },",
+    "  databases: [",
+    ...entry ? [entry] : [],
+    "  ],",
+    ...destinations,
+    "}",
+    "",
+    "export default config",
+    ""
+  ].join(`
+`);
+}
+function buildBackupProvisionScript(options) {
+  const { database, backups } = options;
+  if (!backups.enabled)
+    return [];
+  const schedule = backups.schedule || "0 2 * * *";
+  const configTs = buildBackupsConfigTs(database, backups);
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    `mkdir -p /etc/ts-cloud ${BACKUP_OUTPUT_DIR}`,
+    "command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)",
+    "bun add -g ts-backups || true",
+    `cat > ${BACKUP_CONFIG_PATH} <<'TS_CLOUD_BACKUP_CFG_EOF'`,
+    configTs.replace(/\n$/, ""),
+    "TS_CLOUD_BACKUP_CFG_EOF",
+    `cat > ${BACKUP_RUNNER_PATH} <<'TS_CLOUD_BACKUP_RUN_EOF'`,
+    "#!/bin/bash",
+    "set -uo pipefail",
+    'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"',
+    'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',
+    "cd /etc/ts-cloud",
+    'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',
+    "TS_CLOUD_BACKUP_RUN_EOF",
+    `chmod +x ${BACKUP_RUNNER_PATH}`,
+    `cat > ${BACKUP_CRON_PATH} <<'TS_CLOUD_BACKUP_CRON_EOF'`,
+    `${schedule} root ${BACKUP_RUNNER_PATH} >> /var/log/ts-cloud-backup.log 2>&1`,
+    "TS_CLOUD_BACKUP_CRON_EOF",
+    `chmod 644 ${BACKUP_CRON_PATH}`
+  ];
+}
+function engineSocket(engine) {
+  return engine === "mariadb" ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
+}
+function buildBackupRestoreScript(database, options = {}) {
+  if (!database?.name)
+    return [];
+  const name = database.name;
+  const isPg = database.engine === "postgres";
+  const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
+  const client = isPg ? `psql -h 127.0.0.1 -p ${database.port ?? 5432} -U postgres -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
+  return [
+    "set -uo pipefail",
+    'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
+    locate,
+    '[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }',
+    'echo "[ts-cloud] restoring ' + name + ' from $TS_CLOUD_DUMP"',
+    `case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${client}`,
+    'echo "restore complete"'
+  ];
+}
+
+// src/drivers/shared/compute-provision.ts
+function buildComputeProvisionScripts(config) {
+  const compute = config.infrastructure?.compute ?? {};
+  const phpBox = compute.runtime === "php" || !!compute.php;
+  const needsPantry = phpBox || !!compute.managedServices;
+  const pantryBootstrap = needsPantry ? buildPantryBootstrapScript() : [];
+  const useNginx = compute.webServer !== "rpx";
+  const phpProvision = phpBox ? [
+    ...pantryBootstrap,
+    ...buildPhpProvisionScript({
+      versions: compute.php?.versions,
+      default: compute.php?.default,
+      extensions: compute.php?.extensions,
+      installNginx: useNginx,
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
+    }),
+    ...useNginx ? buildNginxServiceScript() : []
+  ] : undefined;
+  const extras = [];
+  if (!phpBox && needsPantry)
+    extras.push(...pantryBootstrap);
+  extras.push(...buildNotifierScript(config.notifications));
+  if (compute.managedServices) {
+    extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices));
+  }
+  extras.push(...buildUfwScript(compute.firewall ?? (phpBox ? { enabled: true } : { enabled: false })));
+  extras.push(...buildAutoUpdatesScript(compute.autoUpdates ?? phpBox));
+  extras.push(...buildMonitoringScript(compute.monitoring ?? phpBox));
+  extras.push(...buildAuthorizedKeysScript(compute.sshKeys));
+  if (compute.backups?.enabled) {
+    extras.push(...buildBackupProvisionScript({
+      database: config.infrastructure?.appDatabase,
+      backups: compute.backups
+    }));
+  }
+  return {
+    runtime: compute.runtime || "bun",
+    runtimeVersion: compute.runtimeVersion || "latest",
+    phpBox,
+    phpProvision,
+    servicesProvision: extras.length > 0 ? extras : undefined
+  };
+}
+
+// src/drivers/shared/ubuntu-bootstrap.ts
+function buildUbuntuBootstrapScript(options = {}) {
+  const {
+    runtime = "bun",
+    runtimeVersion = "latest",
+    systemPackages = [],
+    database,
+    phpProvision,
+    servicesProvision,
+    caddyfile,
+    rpxProvision,
+    baked = false
+  } = options;
+  const packages = new Set(systemPackages);
+  if (database === "sqlite")
+    packages.add("sqlite3");
+  else if (database === "mysql")
+    packages.add("mysql-client");
+  else if (database === "postgres")
+    packages.add("postgresql-client");
+  let script = `#!/bin/bash
+set -euo pipefail
+`;
+  if (!baked) {
+    script += `
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -y
+apt-get upgrade -y
+apt-get install -y curl tar gzip unzip git ca-certificates
+`;
+    if (packages.size > 0) {
+      script += `
+apt-get install -y ${[...packages].join(" ")}
+`;
+    }
+    if (phpProvision && phpProvision.length > 0) {
+      script += `
+${phpProvision.join(`
+`)}
+`;
+    }
+    if (servicesProvision && servicesProvision.length > 0) {
+      script += `
+${servicesProvision.join(`
+`)}
+`;
+    }
+    if (runtime === "bun") {
+      script += `
+# cloud-init runs this with \`set -u\` and NO $HOME set. bun's install.sh
+# dereferences $HOME even when BUN_INSTALL is set, so without this the install
+# aborts with "HOME: unbound variable" and /usr/local/bin/bun never appears —
+# breaking a from-scratch provision (adopting an existing box masked it).
+export HOME="\${HOME:-/root}"
+export BUN_INSTALL="/root/.bun"
+# bun.sh's installer references $HOME internally and runs under this
+# script's \`set -u\` (inherited by the piped bash) — cloud-init's runcmd
+# environment doesn't export HOME by default, so without this the
+# installer dies with "HOME: unbound variable" partway through (after
+# the binary is already downloaded, so it looks like a partial success)
+# and \`set -e\` aborts everything after it: the bun symlink, /var/www +
+# /var/ts-cloud dirs, and the whole rpx gateway install/systemd setup
+# never run. Confirmed against a real Hetzner box (stacksjs/status#1
+# Phase 9 e2e deploy) — cloud-init reported success with none of that
+# actually done.
+export HOME="\${HOME:-/root}"
+curl -fsSL https://bun.sh/install | bash${runtimeVersion === "latest" ? "" : ` -s "bun-v${runtimeVersion}"`}
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+echo 'export BUN_INSTALL="/root/.bun"' > /etc/profile.d/bun.sh
+echo 'export PATH="$BUN_INSTALL/bin:$PATH"' >> /etc/profile.d/bun.sh
+`;
+    } else if (runtime === "node") {
+      const nodeMajor = runtimeVersion === "latest" || !runtimeVersion ? "20" : runtimeVersion.split(".")[0];
+      script += `
+curl -fsSL https://deb.nodesource.com/setup_${nodeMajor}.x | bash -
+apt-get install -y nodejs
+ln -sf /usr/bin/node /usr/local/bin/node
+ln -sf /usr/bin/npm /usr/local/bin/npm
+`;
+    } else if (runtime === "deno") {
+      script += `
+curl -fsSL https://deno.land/install.sh | sh
+ln -sf /root/.deno/bin/deno /usr/local/bin/deno
+`;
+    }
+  }
+  script += `
+mkdir -p /var/www /var/ts-cloud/staging /var/ts-cloud/releases
+`;
+  if (caddyfile) {
+    const escaped = caddyfile.replace(/\$/g, "\\$");
+    script += `
+ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=\${ARCH}" -o /usr/local/bin/caddy
+chmod +x /usr/local/bin/caddy
+
+getent group caddy >/dev/null || groupadd --system caddy
+getent passwd caddy >/dev/null || useradd --system --gid caddy \\
+  --create-home --home-dir /var/lib/caddy \\
+  --shell /usr/sbin/nologin --comment "Caddy web server" caddy
+
+mkdir -p /etc/caddy /var/lib/caddy /var/log/caddy
+chown -R caddy:caddy /var/lib/caddy /var/log/caddy
+
+cat > /etc/systemd/system/caddy.service <<'CADDY_UNIT_EOF'
+[Unit]
+Description=Caddy
+Documentation=https://caddyserver.com/docs/
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=notify
+User=caddy
+Group=caddy
+ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
+ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
+TimeoutStopSec=5s
+LimitNOFILE=1048576
+PrivateTmp=true
+ProtectSystem=full
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target
+CADDY_UNIT_EOF
+
+cat > /etc/caddy/Caddyfile <<'CADDY_CONFIG_EOF'
+${escaped}
+CADDY_CONFIG_EOF
+
+systemctl daemon-reload
+systemctl enable caddy
+systemctl start caddy
+`;
+  }
+  if (rpxProvision && rpxProvision.length > 0) {
+    const body = rpxProvision[0] === "set -euo pipefail" ? rpxProvision.slice(1) : rpxProvision;
+    script += `
+${body.join(`
+`)}
+`;
+  }
+  script += `
+echo "ts-cloud bootstrap complete — instance is ready for site deploys"
+`;
+  return script;
+}
+
+// src/drivers/aws/provision.ts
+var UBUNTU_AMI_SSM_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
+function awsComputeIngressRules(config) {
+  const rules = [
+    { port: 22, protocol: "tcp", cidr: "0.0.0.0/0" },
+    { port: 80, protocol: "tcp", cidr: "0.0.0.0/0" },
+    { port: 443, protocol: "tcp", cidr: "0.0.0.0/0" }
+  ];
+  const extra = new Set;
+  for (const site of Object.values(config.sites || {})) {
+    if (site && typeof site.port === "number" && ![22, 80, 443].includes(site.port))
+      extra.add(site.port);
+  }
+  for (const port of extra)
+    rules.push({ port, protocol: "tcp", cidr: "0.0.0.0/0" });
+  return rules;
+}
+function buildAwsUserData(config) {
+  const compute = config.infrastructure?.compute ?? {};
+  const provision = buildComputeProvisionScripts(config);
+  return buildUbuntuBootstrapScript({
+    runtime: provision.runtime,
+    runtimeVersion: provision.runtimeVersion,
+    systemPackages: compute.systemPackages,
+    database: config.infrastructure?.database,
+    phpProvision: provision.phpProvision,
+    servicesProvision: provision.servicesProvision,
+    baked: compute.bakedImage === true
+  });
+}
+function encodeUserData(userData) {
+  return Buffer.from(userData, "utf8").toString("base64");
+}
+function resolveAwsImageId(config) {
+  return config.infrastructure?.compute?.image ?? null;
+}
+
+// src/drivers/aws/driver.ts
+function readPinnedInstanceId(stackName) {
+  try {
+    const raw = readFileSync(join(process.cwd(), ".ts-cloud/state", `${stackName}.json`), "utf8");
+    const state = JSON.parse(raw);
+    return typeof state.instanceId === "string" && state.instanceId.length > 0 ? state.instanceId : null;
+  } catch {
+    return null;
+  }
+}
+
+class AwsDriver {
+  name = "aws";
+  usesCloudFormation = true;
+  region;
+  constructor(options = {}) {
+    this.region = options.region || "us-east-1";
+  }
+  resolveRegion(config) {
+    return config.project.region || this.region;
+  }
+  async provisionComputeInfrastructure(options) {
+    const { config, environment } = options;
+    const region = this.resolveRegion(config);
+    const slug = config.project.slug;
+    const compute = config.infrastructure?.compute;
+    if (!compute)
+      throw new Error("infrastructure.compute is required to provision AWS compute");
+    const ec2 = new EC2Client(region);
+    const existing = await this.findComputeTargets({ slug, environment, role: "app" });
+    if (existing.length > 0) {
+      const first = existing[0];
+      return { appInstanceId: first.id, appPublicIp: first.publicIp, sshUser: "ubuntu", deployStoragePath: "/var/ts-cloud/staging" };
+    }
+    let imageId = resolveAwsImageId(config);
+    if (!imageId) {
+      const ssm = new SSMClient(region);
+      const param = await ssm.getParameter({ Name: UBUNTU_AMI_SSM_PARAM });
+      imageId = param.Parameter?.Value ?? null;
+      if (!imageId)
+        throw new Error("Could not resolve the Ubuntu 24.04 AMI from SSM");
+    }
+    const vpcs = await ec2.describeVpcs();
+    const vpc = (vpcs.Vpcs || []).find((v) => v.IsDefault) || (vpcs.Vpcs || [])[0];
+    if (!vpc?.VpcId)
+      throw new Error("No VPC found to launch the instance into");
+    const subnets = (await ec2.describeSubnets({ Filters: [{ Name: "vpc-id", Values: [vpc.VpcId] }] })).Subnets || [];
+    const subnet = subnets.find((s) => s.MapPublicIpOnLaunch) || subnets[0];
+    const subnetId = subnet?.SubnetId;
+    if (!subnet?.MapPublicIpOnLaunch)
+      console.warn("ts-cloud: no public subnet found; the instance may not get a public IP (deploys/SSL need one).");
+    const sgName = `${slug}-${environment}-app-sg`;
+    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }, { Name: "vpc-id", Values: [vpc.VpcId] }] });
+    let groupId = found.SecurityGroups?.[0]?.GroupId;
+    if (!groupId) {
+      const created = await ec2.createSecurityGroup({ GroupName: sgName, Description: `ts-cloud ${slug}/${environment} app`, VpcId: vpc.VpcId });
+      groupId = created.GroupId;
+    }
+    const rules = awsComputeIngressRules(config);
+    await ec2.authorizeSecurityGroupIngress({
+      GroupId: groupId,
+      IpPermissions: rules.map((r) => ({ IpProtocol: r.protocol, FromPort: r.port, ToPort: r.port, IpRanges: [{ CidrIp: r.cidr }] }))
+    }).catch((e) => {
+      if (!/InvalidPermission\.Duplicate/.test(e instanceof Error ? e.message : ""))
+        throw e;
+    });
+    const userData = encodeUserData(buildAwsUserData(config));
+    const instanceType = compute.server?.instanceType || "t3.small";
+    const run = await ec2.runInstances({
+      ImageId: imageId,
+      InstanceType: instanceType,
+      MinCount: 1,
+      MaxCount: 1,
+      SecurityGroupIds: groupId ? [groupId] : undefined,
+      SubnetId: subnetId,
+      UserData: userData,
+      IamInstanceProfile: compute.server?.iamInstanceProfile ? { Name: compute.server.iamInstanceProfile } : undefined,
+      TagSpecifications: [{
+        ResourceType: "instance",
+        Tags: [
+          { Key: "Name", Value: `${slug}-${environment}-app` },
+          { Key: "Project", Value: slug },
+          { Key: "Environment", Value: environment },
+          { Key: "Role", Value: "app" }
+        ]
+      }]
+    });
+    const instanceId = run.Instances?.[0]?.InstanceId;
+    if (!instanceId)
+      throw new Error("RunInstances did not return an instance id");
+    const running = await ec2.waitForInstanceState(instanceId, "running");
+    if (!running)
+      throw new Error(`Instance ${instanceId} did not reach 'running' before timeout`);
+    return {
+      appInstanceId: instanceId,
+      appPublicIp: running.PublicIpAddress,
+      sshUser: "ubuntu",
+      deployStoragePath: "/var/ts-cloud/staging"
+    };
+  }
+  async destroyCompute(options) {
+    const { config, environment } = options;
+    const region = this.resolveRegion(config);
+    const ec2 = new EC2Client(region);
+    const destroyed = [];
+    const targets = await this.findComputeTargets({ slug: config.project.slug, environment, role: "app" });
+    const ids = targets.map((t) => t.id);
+    if (ids.length > 0) {
+      await ec2.terminateInstances(ids);
+      destroyed.push(...ids.map((id) => `instance ${id}`));
+      await Promise.all(ids.map((id) => ec2.waitForInstanceState(id, "terminated").catch(() => {
+        return;
+      })));
+    }
+    const sgName = `${config.project.slug}-${environment}-app-sg`;
+    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }] }).catch(() => ({ SecurityGroups: [] }));
+    const groupId = found.SecurityGroups?.[0]?.GroupId;
+    if (groupId) {
+      for (let i = 0;i < 10; i++) {
+        try {
+          await ec2.deleteSecurityGroup(groupId);
+          destroyed.push(`security group ${sgName}`);
+          break;
+        } catch {
+          await new Promise((r) => setTimeout(r, 3000));
+        }
+      }
+    }
+    return { destroyed };
+  }
+  async getComputeOutputs(options) {
+    const region = this.resolveRegion(options.config);
+    const stackName = resolveProjectStackName(options.config, options.environment);
+    const cfn = new CloudFormationClient(region);
+    try {
+      const outputs = await cfn.getStackOutputs(stackName);
+      return {
+        deployBucketName: outputs.deployBucketName,
+        appInstanceId: outputs.appInstanceId,
+        appPublicIp: outputs.appPublicIp,
+        sshUser: "ec2-user"
+      };
+    } catch (err) {
+      if (!/does not exist|ValidationError/i.test(err instanceof Error ? err.message : ""))
+        throw err;
+      const targets = await this.findComputeTargets({
+        slug: options.config.project.slug,
+        environment: options.environment,
+        role: "app"
+      });
+      const first = targets[0];
+      return {
+        appInstanceId: first?.id,
+        appPublicIp: first?.publicIp,
+        sshUser: "ubuntu",
+        deployStoragePath: "/var/ts-cloud/staging"
+      };
+    }
+  }
+  async uploadRelease(options) {
+    const region = this.resolveRegion(options.config);
+    const outputs = await this.getComputeOutputs({
+      config: options.config,
+      environment: options.environment
+    });
+    const bucket = outputs.deployBucketName;
+    if (!bucket) {
+      throw new Error("No deployBucketName in stack outputs. Re-deploy infrastructure to add the staging bucket.");
+    }
+    const s3 = new S3Client(region);
+    await s3.putObject({
+      bucket,
+      key: options.remoteKey,
+      body: readFileSync(options.localPath),
+      contentType: "application/gzip"
+    });
+    return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
+  }
+  async findComputeTargets(options) {
+    const region = this.region;
+    const ec2 = new EC2Client(region);
+    const filters = [
+      { Name: "tag:Project", Values: [options.slug] },
+      { Name: "tag:Environment", Values: [options.environment] },
+      { Name: "tag:Role", Values: [options.role || "app"] },
+      { Name: "instance-state-name", Values: ["running", "pending"] }
+    ];
+    const result = await ec2.describeInstances({ Filters: filters });
+    const targets = this.reservationsToTargets(result.Reservations);
+    if (targets.length > 0 || (options.role || "app") !== "app")
+      return targets;
+    const stackName = options.stackName ?? `${options.slug}-${options.environment}`;
+    let pinnedId = readPinnedInstanceId(stackName);
+    if (!pinnedId) {
+      try {
+        pinnedId = (await new CloudFormationClient(region).getStackOutputs(stackName)).appInstanceId ?? null;
+      } catch {
+        pinnedId = null;
+      }
+    }
+    if (!pinnedId)
+      return [];
+    try {
+      const pinned = await ec2.describeInstances({
+        InstanceIds: [pinnedId],
+        Filters: [{ Name: "instance-state-name", Values: ["running", "pending"] }]
+      });
+      return this.reservationsToTargets(pinned.Reservations);
+    } catch {
+      return [];
+    }
+  }
+  reservationsToTargets(reservations) {
+    const targets = [];
+    for (const reservation of reservations || []) {
+      for (const instance of reservation.Instances || []) {
+        if (!instance.InstanceId)
+          continue;
+        const nameTag = instance.Tags?.find((tag) => tag.Key === "Name")?.Value;
+        targets.push({
+          id: instance.InstanceId,
+          name: nameTag,
+          publicIp: instance.PublicIpAddress,
+          privateIp: instance.PrivateIpAddress,
+          status: instance.State?.Name
+        });
+      }
+    }
+    return targets;
+  }
+  bashWrap(commands) {
+    return ["bash <<'TS_CLOUD_BASH_EOF'", commands.join(`
+`), "TS_CLOUD_BASH_EOF"];
+  }
+  async runRemoteDeploy(options) {
+    const region = this.region;
+    const ssm = new SSMClient(region);
+    if (options.targets.length > 0) {
+      const sendResult = await ssm.sendCommand({
+        InstanceIds: options.targets.map((target) => target.id),
+        DocumentName: "AWS-RunShellScript",
+        Parameters: { commands: this.bashWrap(options.commands) },
+        TimeoutSeconds: options.timeoutSeconds || 600,
+        Comment: options.comment
+      });
+      if (!sendResult.CommandId) {
+        return { success: false, instanceCount: 0, perInstance: [], error: "Failed to send SSM command" };
+      }
+      return this.pollSsmCommand(ssm, sendResult.CommandId, options.targets.length);
+    }
+    if (!options.tags || Object.keys(options.tags).length === 0) {
+      return { success: false, instanceCount: 0, perInstance: [], error: "No targets or tags provided for AWS deploy" };
+    }
+    const result = await ssm.sendCommandByTags({
+      tags: options.tags,
+      commands: this.bashWrap(options.commands),
+      timeoutSeconds: options.timeoutSeconds || 600,
+      comment: options.comment
+    });
+    return {
+      success: result.success,
+      instanceCount: result.instanceCount,
+      perInstance: result.perInstance.map((item) => ({
+        instanceId: item.instanceId,
+        status: item.status,
+        output: item.output,
+        error: item.error
+      })),
+      error: result.error
+    };
+  }
+  async pollSsmCommand(ssm, commandId, expectedCount) {
+    const pollInterval = 3000;
+    const maxWait = 600000;
+    const startTime = Date.now();
+    const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
+    let lastInvocations = [];
+    while (Date.now() - startTime < maxWait) {
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      try {
+        const invocations = await ssm.listCommandInvocations({ CommandId: commandId, Details: true });
+        lastInvocations = invocations;
+        if (lastInvocations.length >= expectedCount && lastInvocations.every((i) => terminalStatuses.has(i.Status || ""))) {
+          break;
+        }
+      } catch {}
+    }
+    const perInstance = lastInvocations.map((item) => ({
+      instanceId: item.InstanceId,
+      status: item.Status || "Unknown",
+      output: item.StandardOutputContent,
+      error: item.StandardErrorContent
+    }));
+    const success = perInstance.length > 0 && perInstance.every((item) => item.status === "Success");
+    return {
+      success,
+      instanceCount: perInstance.length,
+      perInstance,
+      error: success ? undefined : "One or more SSM command invocations failed"
+    };
+  }
+}
+
+// src/drivers/hetzner/driver.ts
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join3 } from "node:path";
+import { execSync } from "node:child_process";
+
+// src/drivers/hetzner/client.ts
+var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
+
+class HetznerClient {
+  name = "hetzner";
+  apiToken;
+  baseUrl;
+  fetchImpl;
+  constructor(options) {
+    this.apiToken = options.apiToken;
+    this.baseUrl = options.baseUrl ?? DEFAULT_API_URL;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async request(method, path, body) {
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.apiToken}`,
+        "Content-Type": "application/json"
+      },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+    const text = await response.text();
+    let data;
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      if (!response.ok) {
+        const snippet = text.trim().slice(0, 200) || response.statusText || "Hetzner API error";
+        throw new Error(`Hetzner API ${method} ${path} (${response.status}): ${snippet}`);
+      }
+      throw new Error(`Hetzner API ${method} ${path}: unexpected non-JSON response`);
+    }
+    if (!response.ok) {
+      const message = data.error?.message || response.statusText || "Hetzner API error";
+      const code = data.error?.code ? ` [${data.error.code}]` : "";
+      throw new Error(`Hetzner API ${method} ${path} (${response.status})${code}: ${message}`);
+    }
+    return data;
+  }
+  async listServers() {
+    const data = await this.request("GET", "/servers");
+    return data.servers;
+  }
+  async getServer(id) {
+    const data = await this.request("GET", `/servers/${id}`);
+    return data.server;
+  }
+  async createServer(options) {
+    const data = await this.request("POST", "/servers", {
+      name: options.name,
+      server_type: options.serverType,
+      image: options.image,
+      location: options.location,
+      datacenter: options.datacenter,
+      ssh_keys: options.sshKeys,
+      user_data: options.userData,
+      labels: options.labels,
+      firewalls: options.firewalls,
+      networks: options.networks,
+      start_after_create: true
+    });
+    return { server: data.server, action: data.action };
+  }
+  async listNetworks() {
+    const data = await this.request("GET", "/networks");
+    return data.networks;
+  }
+  async createNetwork(options) {
+    const ipRange = options.ipRange ?? "10.0.0.0/16";
+    const data = await this.request("POST", "/networks", {
+      name: options.name,
+      ip_range: ipRange,
+      subnets: [{ type: "cloud", ip_range: ipRange, network_zone: "eu-central" }],
+      labels: options.labels
+    });
+    return data.network;
+  }
+  async deleteNetwork(id) {
+    await this.request("DELETE", `/networks/${id}`);
+  }
+  async listLoadBalancers() {
+    const data = await this.request("GET", "/load_balancers");
+    return data.load_balancers;
+  }
+  async createLoadBalancer(options) {
+    const data = await this.request("POST", "/load_balancers", {
+      name: options.name,
+      load_balancer_type: options.type ?? "lb11",
+      location: options.location,
+      network_zone: options.network ? undefined : options.networkZone ?? "eu-central",
+      network: options.network,
+      labels: options.labels,
+      targets: [{ type: "label_selector", label_selector: { selector: options.labelSelector }, use_private_ip: !!options.network }],
+      services: options.services.map((s) => ({
+        protocol: s.protocol ?? "tcp",
+        listen_port: s.listenPort,
+        destination_port: s.destinationPort,
+        health_check: {
+          protocol: "http",
+          port: 80,
+          interval: 15,
+          timeout: 10,
+          retries: 3,
+          http: { path: "/", status_codes: ["2??", "3??"] }
+        }
+      }))
+    });
+    return data.load_balancer;
+  }
+  async deleteLoadBalancer(id) {
+    await this.request("DELETE", `/load_balancers/${id}`);
+  }
+  async deleteServer(id) {
+    const data = await this.request("DELETE", `/servers/${id}`);
+    return data.action;
+  }
+  async listFirewalls() {
+    const data = await this.request("GET", "/firewalls");
+    return data.firewalls;
+  }
+  async createFirewall(options) {
+    const data = await this.request("POST", "/firewalls", {
+      name: options.name,
+      rules: options.rules,
+      labels: options.labels,
+      apply_to: options.applyTo
+    });
+    return { firewall: data.firewall, actions: data.actions };
+  }
+  async setFirewallRules(firewallId, rules) {
+    const data = await this.request("POST", `/firewalls/${firewallId}/actions/set_rules`, {
+      rules
+    });
+    return data.actions ?? [];
+  }
+  async deleteFirewall(firewallId) {
+    await this.request("DELETE", `/firewalls/${firewallId}`);
+  }
+  async applyFirewallToResources(firewallId, applyTo) {
+    const data = await this.request("POST", `/firewalls/${firewallId}/actions/apply_to_resources`, {
+      apply_to: applyTo
+    });
+    return data.actions;
+  }
+  async listSshKeys() {
+    const data = await this.request("GET", "/ssh_keys");
+    return data.ssh_keys;
+  }
+  async createSshKey(options) {
+    const data = await this.request("POST", "/ssh_keys", {
+      name: options.name,
+      public_key: options.publicKey,
+      labels: options.labels
+    });
+    return data.ssh_key;
+  }
+  async waitForAction(actionId, options) {
+    const pollInterval = options?.pollIntervalMs ?? 2000;
+    const maxWait = options?.maxWaitMs ?? 300000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const data = await this.request("GET", `/actions/${actionId}`);
+      if (data.action.status === "success")
+        return data.action;
+      if (data.action.status === "error") {
+        throw new Error(data.action.error?.message || "Hetzner action failed");
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
+  }
+  async waitForServerRunning(serverId, options) {
+    const pollInterval = options?.pollIntervalMs ?? 3000;
+    const maxWait = options?.maxWaitMs ?? 600000;
+    const start = Date.now();
+    while (Date.now() - start < maxWait) {
+      const server = await this.getServer(serverId);
+      if (server.status === "running")
+        return server;
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
+  }
+}
+function resolveHetznerApiToken(configToken) {
+  const token = configToken || process.env.HCLOUD_TOKEN || process.env.HETZNER_API_TOKEN;
+  if (!token) {
+    throw new Error("Hetzner API token required. Set hetzner.apiToken in cloud.config.ts or HCLOUD_TOKEN / HETZNER_API_TOKEN.");
+  }
+  return token;
+}
+function normalizeSshPublicKey(publicKey) {
+  const [type, body] = publicKey.trim().split(/\s+/);
+  return body ? `${type} ${body}` : type;
+}
+
+// src/drivers/hetzner/cloud-init.ts
+function wrapCloudInitUserData(bootstrapScript) {
+  const scriptPath = "/var/lib/cloud/ts-cloud-bootstrap.sh";
+  const indented = bootstrapScript.split(`
+`).map((line) => `      ${line}`).join(`
+`);
+  return `#cloud-config
+write_files:
+  - path: ${scriptPath}
+    permissions: '0755'
+    owner: root:root
+    content: |
+${indented}
+runcmd:
+  - [ bash, ${scriptPath} ]
+`;
+}
+
+// src/deploy/site-target.ts
+var PHP_SITE_TYPES = new Set([
+  "laravel",
+  "php",
+  "statamic",
+  "wordpress"
+]);
+function isPhpSite(site) {
+  return site.type != null && PHP_SITE_TYPES.has(site.type);
+}
+function resolveSiteDeployTarget(site) {
+  if (site.deploy)
+    return site.deploy;
+  if (isPhpSite(site))
+    return "server";
+  if (site.start)
+    return "server";
+  return "bucket";
+}
+function resolveSiteKind(site) {
+  if (site.redirect)
+    return "redirect";
+  if (isPhpSite(site))
+    return "server-php";
+  const target = resolveSiteDeployTarget(site);
+  if (target === "bucket")
+    return "bucket";
+  return site.start ? "server-app" : "server-static";
+}
+function hasComputeConfigured(config) {
+  return config.infrastructure?.compute != null;
+}
+function validateDeploymentConfig(config) {
+  const errors = [];
+  const warnings = [];
+  const sites = config.sites || {};
+  const computeConfigured = hasComputeConfigured(config);
+  const coexistence = deploymentCoexistenceError(config);
+  if (coexistence)
+    errors.push(coexistence);
+  const portOwners = new Map;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site) {
+      continue;
+    }
+    const target = resolveSiteDeployTarget(site);
+    const kind = resolveSiteKind(site);
+    if (kind === "redirect") {
+      if (!site.domain)
+        errors.push(`Site '${name}' is a redirect site but has no \`domain\` to redirect from.`);
+      const to = typeof site.redirect === "string" ? site.redirect : site.redirect?.to;
+      if (!to)
+        errors.push(`Site '${name}' is a redirect site but has no redirect target (\`redirect\` / \`redirect.to\`).`);
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a redirect site but no \`infrastructure.compute\` is configured to host the gateway that serves the redirect.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (site.root)
+        serverOnly.push("root");
+      if (serverOnly.length > 0)
+        warnings.push(`Site '${name}' is a redirect site but also sets ${serverOnly.join(", ")}. These are ignored.`);
+      continue;
+    }
+    if (target === "server" && !site.start && !site.root) {
+      errors.push(`Site '${name}' sets deploy:'server' but declares neither \`start\` (dynamic app) nor \`root\` (static site to serve). Add one.`);
+      continue;
+    }
+    if (kind === "server-php") {
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but no \`infrastructure.compute\` is configured. Add a server (infrastructure.compute) with PHP provisioning.`);
+      }
+      if (!site.repository?.url) {
+        errors.push(`Site '${name}' is a PHP site (type:'${site.type}') but has no \`repository.url\` to clone. PHP sites deploy via git.`);
+      }
+    } else if (kind === "server-app") {
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' deploys to a server (deploy:'server'${site.deploy ? "" : " inferred from `start`"}) but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
+      }
+      if (typeof site.port === "number") {
+        const existing = portOwners.get(site.port);
+        if (existing) {
+          errors.push(`Sites '${existing}' and '${name}' both use port ${site.port}. Server apps sharing a box must use distinct ports.`);
+        } else {
+          portOwners.set(site.port, name);
+        }
+      }
+    } else if (kind === "server-static") {
+      if (!site.root) {
+        errors.push(`Site '${name}' is a server static site (deploy:'server', no \`start\`) but has no \`root\` directory to serve.`);
+      }
+      if (!computeConfigured) {
+        errors.push(`Site '${name}' deploys to a server (deploy:'server') but no \`infrastructure.compute\` is configured. Set deploy:'bucket' or add a server (infrastructure.compute).`);
+      }
+    } else {
+      if (!site.root) {
+        errors.push(`Site '${name}' deploys to a bucket but has no \`root\` directory to upload.`);
+      }
+      const serverOnly = [];
+      if (site.start)
+        serverOnly.push("start");
+      if (typeof site.port === "number")
+        serverOnly.push("port");
+      if (site.preStart && site.preStart.length > 0)
+        serverOnly.push("preStart");
+      if (serverOnly.length > 0) {
+        warnings.push(`Site '${name}' deploys to a bucket but sets server-only field(s): ${serverOnly.join(", ")}. These are ignored. Set deploy:'server' to use them.`);
+      }
+    }
+  }
+  return { errors, warnings };
+}
+
+// src/drivers/shared/rpx-gateway.ts
+var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
+var DEFAULT_ACME_WEBROOT = "/var/www/acme-challenge";
+function normalizeSiteRedirect(input) {
+  if (typeof input === "string")
+    return { to: input };
+  const out = { to: input.to };
+  if (input.status != null)
+    out.status = input.status;
+  if (input.preservePath != null)
+    out.preservePath = input.preservePath;
+  return out;
+}
+function resolveRouteAuth(site) {
+  const auth = site.auth;
+  if (!auth || auth.enabled === false || !auth.password)
+    return;
+  return {
+    username: auth.username || "admin",
+    password: auth.password,
+    ...auth.realm ? { realm: auth.realm } : {}
+  };
+}
+function normalizeRoutePath(path) {
+  if (!path || path === "/")
+    return;
+  let p = `/${path}`.replace(/\/+/g, "/").replace(/\/+$/, "");
+  if (!p.startsWith("/"))
+    p = `/${p}`;
+  return p === "" || p === "/" ? undefined : p;
+}
+function deriveRouteId(to, path) {
+  const base = path ? `${to}${path}` : to;
+  const cleaned = base.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128);
+  return cleaned.length > 0 ? cleaned : "rpx";
+}
+function resolveServerAppFrom(port, appBoxes) {
+  if (!appBoxes || appBoxes.length === 0)
+    return `localhost:${port}`;
+  return appBoxes.map((box) => `${box.privateIp ?? box.publicIp}:${port}`);
+}
+function buildRpxConfigInternal(sites, options, appBoxes) {
+  const wwwRoot = (options.wwwRoot ?? "/var/www").replace(/\/+$/, "");
+  const certsDir = options.proxy.certsDir ?? DEFAULT_RPX_CERTS_DIR;
+  const loadBalancer = options.proxy.loadBalancer;
+  const proxies = [];
+  const domains = new Set;
+  for (const [name, site] of Object.entries(sites)) {
+    if (!site || !site.domain)
+      continue;
+    const kind = resolveSiteKind(site);
+    if (kind === "bucket")
+      continue;
+    const path = normalizeRoutePath(site.path);
+    const id = deriveRouteId(site.domain, path);
+    const auth = resolveRouteAuth(site);
+    if (kind === "redirect") {
+      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
+      domains.add(site.domain);
+      continue;
+    }
+    if (kind === "server-app") {
+      if (typeof site.port !== "number")
+        continue;
+      const from = resolveServerAppFrom(site.port, appBoxes);
+      proxies.push({
+        to: site.domain,
+        path,
+        from,
+        id,
+        ...auth ? { auth } : {},
+        ...Array.isArray(from) && loadBalancer ? { loadBalancer } : {}
+      });
+    } else {
+      proxies.push({
+        to: site.domain,
+        path,
+        static: `${wwwRoot}/${name}/current`,
+        cleanUrls: site.pathRewriteStyle !== "flat",
+        spa: site.spa ?? false,
+        ...auth ? { auth } : {},
+        id
+      });
+    }
+    domains.add(site.domain);
+  }
+  if (options.proxy.autoWww !== false) {
+    for (const domain of [...domains]) {
+      if (domain.split(".").length !== 2)
+        continue;
+      const wwwDomain = `www.${domain}`;
+      if (domains.has(wwwDomain))
+        continue;
+      proxies.push({ to: wwwDomain, redirect: { to: `https://${domain}` }, id: deriveRouteId(wwwDomain) });
+      domains.add(wwwDomain);
+    }
+  }
+  proxies.sort((a, b) => {
+    if (a.to !== b.to)
+      return a.to.localeCompare(b.to);
+    return (b.path?.length ?? 0) - (a.path?.length ?? 0);
+  });
+  const config = {
+    proxies,
+    productionCerts: { certsDir },
+    https: true,
+    hostsManagement: false,
+    cleanup: { hosts: false, certs: false }
+  };
+  if (options.proxy.onDemandTls && domains.size > 0) {
+    config.onDemandTls = {
+      enabled: true,
+      allowedSuffixes: [...domains],
+      email: options.proxy.onDemandTlsEmail,
+      certsDir
+    };
+  }
+  if (options.proxy.onDemandTls) {
+    config.acmeChallengeWebroot = options.proxy.acmeWebroot ?? DEFAULT_ACME_WEBROOT;
+  }
+  const cdn = options.proxy.cdn;
+  if (cdn?.secret && cdn.frontedHosts.length > 0) {
+    config.originGuard = {
+      header: cdn.secretHeader ?? "X-Origin-Verify",
+      value: cdn.secret,
+      hosts: cdn.frontedHosts
+    };
+  }
+  return config;
+}
+function buildRpxConfig(sites, options) {
+  return buildRpxConfigInternal(sites, options);
+}
+function buildRpxLbConfig(sites, appBoxes, options) {
+  return buildRpxConfigInternal(sites, options, appBoxes);
+}
+function renderRpxLauncher(config) {
+  const json = JSON.stringify(config, null, 2);
+  return `// Generated by ts-cloud — rpx reverse-proxy gateway.
+// Routes are derived from the \`sites\` model on every \`buddy deploy\`.
+import { startProxies } from '@stacksjs/rpx'
+
+const config = ${json} as const
+
+await startProxies(config as any)
+`;
+}
+var RPX_DIR = "/etc/rpx";
+var RPX_INSTALL_DIR = "/opt/rpx-gateway";
+var RPX_LAUNCHER_PATH = "/etc/rpx/gateway.ts";
+var RPX_SERVICE_NAME = "rpx-gateway.service";
+var RPX_SITES_DIR = "/etc/rpx/sites.d";
+function renderRpxAssembler(sitesDir = RPX_SITES_DIR, defaultCertsDir = DEFAULT_RPX_CERTS_DIR) {
+  return `// Generated by ts-cloud — rpx gateway assembler.
+// Merges every app's fragment in ${sitesDir} so independent deploys compose
+// without clobbering each other. Each deploy writes only its own <slug>.json.
+import { startProxies } from '@stacksjs/rpx'
+import { readdirSync, readFileSync } from 'node:fs'
+
+const dir = ${JSON.stringify(sitesDir)}
+const proxies = []
+const seen = new Set()
+const suffixes = new Set()
+const guardHosts = new Set()
+let email
+let certsDir = ${JSON.stringify(defaultCertsDir)}
+let acmeChallengeWebroot
+let guard
+let files = []
+try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
+for (const f of files) {
+  let frag
+  try { frag = JSON.parse(readFileSync(dir + '/' + f, 'utf8')) } catch { continue }
+  for (const p of frag.proxies ?? []) {
+    const key = p.id || (p.to + (p.path ?? ''))
+    if (seen.has(key)) continue
+    seen.add(key)
+    proxies.push(p)
+  }
+  for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
+  email ??= frag.onDemandTls?.email
+  if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
+  acmeChallengeWebroot ??= frag.acmeChallengeWebroot
+  if (frag.originGuard) {
+    guard ??= { header: frag.originGuard.header, value: frag.originGuard.value }
+    for (const h of frag.originGuard.hosts ?? []) guardHosts.add(h)
+  }
+}
+const config = {
+  proxies,
+  productionCerts: { certsDir },
+  https: true,
+  hostsManagement: false,
+  cleanup: { hosts: false, certs: false },
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
+  ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
+  ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
+}
+
+await startProxies(config)
+`;
+}
+function writeFileHeredoc(path, content, delimiter) {
+  return [
+    `cat > ${path} <<'${delimiter}'`,
+    content,
+    delimiter
+  ];
+}
+function certDomainsForConfig(config) {
+  const seen = new Set;
+  for (const r of config.proxies) {
+    const host = r.to;
+    if (!host || host.startsWith("*") || host.includes(":") || !host.includes("."))
+      continue;
+    seen.add(host);
+  }
+  return [...seen];
+}
+function buildCertManagementCommands(options) {
+  const { config, proxy } = options;
+  const webroot = config.acmeChallengeWebroot;
+  const domains = certDomainsForConfig(config);
+  if (!proxy.onDemandTls || !webroot || domains.length === 0)
+    return [];
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version = proxy.version ?? "latest";
+  const certsDir = config.productionCerts.certsDir;
+  const email = proxy.onDemandTlsEmail ?? `webmaster@${domains[0]}`;
+  const tlsxCli = `${bunBin} ${RPX_INSTALL_DIR}/node_modules/@stacksjs/tlsx/dist/bin/cli.js`;
+  const csv = domains.join(",");
+  const spaced = domains.join(" ");
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const renewScriptPath = `${RPX_DIR}/renew-certs-${slug}.sh`;
+  const renewServiceName = `rpx-cert-renew-${slug}.service`;
+  const renewTimerName = `rpx-cert-renew-${slug}.timer`;
+  const renewScript = [
+    "#!/bin/sh",
+    "# Generated by ts-cloud — issue/renew rpx gateway TLS certs via tlsx http-01.",
+    "# The running gateway serves the challenge from $WEBROOT on :80, so this needs",
+    "# no downtime and no DNS credentials. Reloads the gateway only if a cert changed.",
+    "set -u",
+    `CERTS='${certsDir}'`,
+    `WEBROOT='${webroot}'`,
+    `EMAIL='${email}'`,
+    `TLSX="${tlsxCli}"`,
+    `DOMAINS='${csv}'`,
+    'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `for d in ${spaced}; do`,
+    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    "done",
+    '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
+    'rm -f "$CERTS"/*.chain.crt',
+    'after=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
+    `[ "$before" = "$after" ] || systemctl restart ${RPX_SERVICE_NAME}`
+  ].join(`
+`);
+  const renewService = [
+    "[Unit]",
+    `Description=Issue/renew rpx gateway TLS certs for ${slug} (tlsx http-01)`,
+    `After=network-online.target ${RPX_SERVICE_NAME}`,
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    `ExecStart=${renewScriptPath}`
+  ].join(`
+`);
+  const renewTimer = [
+    "[Unit]",
+    `Description=Daily rpx gateway TLS cert issuance/renewal for ${slug}`,
+    "",
+    "[Timer]",
+    "OnCalendar=*-*-* 03:30:00",
+    "RandomizedDelaySec=1h",
+    "Persistent=true",
+    "",
+    "[Install]",
+    "WantedBy=timers.target"
+  ].join(`
+`);
+  return [
+    `mkdir -p ${webroot}`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/tlsx@${version}) || true`,
+    ...writeFileHeredoc(renewScriptPath, renewScript, "TS_CLOUD_RENEW_EOF"),
+    `chmod +x ${renewScriptPath}`,
+    ...writeFileHeredoc(`/etc/systemd/system/${renewServiceName}`, renewService, "TS_CLOUD_RENEW_SVC_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${renewTimerName}`, renewTimer, "TS_CLOUD_RENEW_TIMER_EOF"),
+    "systemctl daemon-reload",
+    `systemctl enable --now ${renewTimerName} || true`,
+    `${renewScriptPath} || true`
+  ];
+}
+function buildRpxProvisionScript(options) {
+  const { config, proxy } = options;
+  const bunBin = options.bunBin ?? "/usr/local/bin/bun";
+  const version = proxy.version ?? "latest";
+  const certsDir = config.productionCerts.certsDir;
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const fragment = JSON.stringify({ slug, ...config }, null, 2);
+  const assembler = renderRpxAssembler(RPX_SITES_DIR, certsDir);
+  const upstreamTimeout = proxy.upstreamTimeout ?? 60;
+  const poolEnv = [`Environment=RPX_UPSTREAM_TIMEOUT=${upstreamTimeout}`];
+  if (typeof proxy.maxUpstreamConns === "number")
+    poolEnv.push(`Environment=RPX_MAX_UPSTREAM_CONNS=${proxy.maxUpstreamConns}`);
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${RPX_DIR} ${RPX_SITES_DIR} ${certsDir} ${RPX_INSTALL_DIR}`,
+    `rm -rf ${RPX_INSTALL_DIR}/node_modules ${RPX_INSTALL_DIR}/bun.lock ${RPX_INSTALL_DIR}/package.json`,
+    `(cd ${RPX_INSTALL_DIR} && ${bunBin} add @stacksjs/rpx@${version})`,
+    `ln -sfn ${RPX_INSTALL_DIR}/node_modules ${RPX_DIR}/node_modules`,
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF"),
+    ...writeFileHeredoc(RPX_LAUNCHER_PATH, assembler, "TS_CLOUD_RPX_EOF"),
+    ...writeFileHeredoc(`/etc/systemd/system/${RPX_SERVICE_NAME}`, [
+      "[Unit]",
+      "Description=rpx reverse-proxy gateway (managed by ts-cloud)",
+      "After=network.target network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      "Type=simple",
+      `ExecStart=${bunBin} ${RPX_LAUNCHER_PATH}`,
+      `WorkingDirectory=${RPX_INSTALL_DIR}`,
+      `Environment=BUN_INSTALL=/root/.bun`,
+      ...poolEnv,
+      "Restart=always",
+      "RestartSec=5",
+      "LimitNOFILE=1048576",
+      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target"
+    ].join(`
+`), "TS_CLOUD_RPX_UNIT_EOF"),
+    "systemctl daemon-reload",
+    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
+    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
+    `systemctl enable ${RPX_SERVICE_NAME}`,
+    `systemctl restart ${RPX_SERVICE_NAME}`,
+    ...buildCertManagementCommands(options)
+  ];
+}
+
+// src/drivers/shared/fleet.ts
+function resolveFleetTopology(compute = {}) {
+  const appServers = Math.max(1, compute.appServers ?? compute.instances ?? 1);
+  const dedicatedServices = !!compute.servicesServer || appServers > 1;
+  const loadBalancer = appServers > 1 || !!compute.server?.loadBalancer;
+  return {
+    appServers,
+    loadBalancer,
+    dedicatedServices,
+    servicesOnApp: !dedicatedServices
+  };
+}
+function buildFleetServicesEnv(servicesPrivateIp, database) {
+  const env = {
+    REDIS_HOST: servicesPrivateIp,
+    MEILISEARCH_HOST: `http://${servicesPrivateIp}:7700`
+  };
+  if (database?.name) {
+    env.DB_CONNECTION = database.engine === "postgres" ? "pgsql" : "mysql";
+    env.DB_HOST = servicesPrivateIp;
+    env.DB_PORT = String(database.port ?? (database.engine === "postgres" ? 5432 : 3306));
+    env.DB_DATABASE = database.name;
+    if (database.username)
+      env.DB_USERNAME = database.username;
+    if (database.password)
+      env.DB_PASSWORD = database.password;
+  }
+  return env;
+}
+
+// src/drivers/hetzner/firewall-rules.ts
+function buildHetznerFirewallRules(config) {
+  const openPorts = new Set([80, 443, ...config.sitePorts]);
+  if (config.allowSsh) {
+    openPorts.add(22);
+  }
+  return [...openPorts].map((port) => {
+    return {
+      direction: "in",
+      protocol: "tcp",
+      port: String(port),
+      source_ips: ["0.0.0.0/0", "::/0"],
+      description: `ts-cloud port ${port}`
+    };
+  });
+}
+
+// src/drivers/hetzner/instance-sizes.ts
+var HETZNER_INSTANCE_TYPES = {
+  micro: "cpx11",
+  small: "cx23",
+  medium: "cx33",
+  large: "cx43",
+  xlarge: "cx53",
+  "2xlarge": "ccx33"
+};
+function resolveHetznerServerType(size) {
+  if (!size)
+    return HETZNER_INSTANCE_TYPES.micro;
+  if (size in HETZNER_INSTANCE_TYPES) {
+    return HETZNER_INSTANCE_TYPES[size];
+  }
+  return size;
+}
+var TS_CLOUD_LABEL_PREFIX = "ts-cloud";
+function tsCloudLabels(slug, environment, role = "app") {
+  return {
+    [`${TS_CLOUD_LABEL_PREFIX}/project`]: slug,
+    [`${TS_CLOUD_LABEL_PREFIX}/environment`]: environment,
+    [`${TS_CLOUD_LABEL_PREFIX}/role`]: role,
+    [`${TS_CLOUD_LABEL_PREFIX}/managed-by`]: "ts-cloud"
+  };
+}
+function matchesTsCloudLabels(labels, slug, environment, role = "app") {
+  if (!labels)
+    return false;
+  return labels[`${TS_CLOUD_LABEL_PREFIX}/project`] === slug && labels[`${TS_CLOUD_LABEL_PREFIX}/environment`] === environment && labels[`${TS_CLOUD_LABEL_PREFIX}/role`] === role;
+}
+
+// src/drivers/hetzner/state.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var STATE_DIR = ".ts-cloud/state";
+function driverStatePath(stackName) {
+  return join2(process.cwd(), STATE_DIR, `${stackName}.json`);
+}
+async function readDriverState(stackName) {
+  try {
+    const raw = await readFile(driverStatePath(stackName), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function writeDriverState(stackName, state) {
+  const path = driverStatePath(stackName);
+  await mkdir(join2(process.cwd(), STATE_DIR), { recursive: true });
+  await writeFile(path, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+}
+
+// src/drivers/hetzner/driver.ts
+var SSH_MAX_BUFFER = 1024 * 1024 * 256;
+function expandHome(path) {
+  return path.startsWith("~/") ? join3(homedir(), path.slice(2)) : path;
+}
+
+class HetznerDriver {
+  name = "hetzner";
+  usesCloudFormation = false;
+  client;
+  sshPrivateKeyPath;
+  sshPublicKeyPath;
+  sshUser;
+  location;
+  waitForBoot;
+  bootWait;
+  constructor(options = {}) {
+    this.client = options.client ?? new HetznerClient({
+      apiToken: resolveHetznerApiToken(options.apiToken)
+    });
+    this.sshPrivateKeyPath = expandHome(options.sshPrivateKeyPath || process.env.HCLOUD_SSH_KEY || "~/.ssh/id_ed25519");
+    this.sshPublicKeyPath = expandHome(options.sshPublicKeyPath || process.env.HCLOUD_SSH_PUBLIC_KEY || `${this.sshPrivateKeyPath}.pub`);
+    this.sshUser = options.sshUser || process.env.HCLOUD_SSH_USER || "root";
+    this.location = options.location || process.env.HCLOUD_LOCATION || "fsn1";
+    this.waitForBoot = options.waitForBoot ?? true;
+    this.bootWait = {
+      sshIntervalMs: options.bootWait?.sshIntervalMs ?? 5000,
+      sshTimeoutMs: options.bootWait?.sshTimeoutMs ?? 300000,
+      cloudInitIntervalMs: options.bootWait?.cloudInitIntervalMs ?? 5000,
+      cloudInitTimeoutMs: options.bootWait?.cloudInitTimeoutMs ?? 600000
+    };
+  }
+  async provisionComputeInfrastructure(options) {
+    const { config, environment } = options;
+    const slug = config.project.slug;
+    const compute = config.infrastructure?.compute;
+    if (!compute) {
+      throw new Error("infrastructure.compute is required to provision Hetzner compute");
+    }
+    const stackName = resolveProjectStackName(config, environment);
+    const serverName = `${slug}-${environment}-app`;
+    const phpBox = compute.runtime === "php" || !!compute.php;
+    const topology = resolveFleetTopology(compute);
+    if (topology.dedicatedServices || topology.appServers > 1) {
+      return phpBox ? this.provisionFleet(options, topology) : this.provisionBunFleet(options, topology);
+    }
+    const existing = await readDriverState(stackName);
+    if (existing?.serverId) {
+      const server2 = await this.tryGetServer(existing.serverId);
+      if (server2 && server2.status !== "off") {
+        return this.outputsFromState(existing, server2);
+      }
+    }
+    const labels = tsCloudLabels(slug, environment, "app");
+    const alreadyRunning = await this.findExistingServer(slug, environment, serverName);
+    if (alreadyRunning && alreadyRunning.status !== "off") {
+      const rehydrated = {
+        provider: "hetzner",
+        stackName,
+        serverId: alreadyRunning.id,
+        serverName: alreadyRunning.name,
+        publicIp: alreadyRunning.public_net.ipv4?.ip,
+        deployStoragePath: "/var/ts-cloud/staging",
+        sshUser: this.sshUser
+      };
+      await writeDriverState(stackName, rehydrated);
+      return this.outputsFromState(rehydrated, alreadyRunning);
+    }
+    const sites = config.sites || {};
+    const sitePorts = this.collectUpstreamPorts(sites);
+    const rpxProvision = compute.proxy?.engine === "rpx" ? buildRpxProvisionScript({
+      proxy: compute.proxy,
+      config: buildRpxConfig(sites, { proxy: compute.proxy }),
+      slug: config.project.slug,
+      bunBin: compute.runtime === "node" || compute.runtime === "deno" ? undefined : "/usr/local/bin/bun"
+    }) : undefined;
+    const provision = buildComputeProvisionScripts(config);
+    const baked = compute.bakedImage === true;
+    const bootstrap = buildUbuntuBootstrapScript({
+      runtime: provision.runtime,
+      runtimeVersion: provision.runtimeVersion,
+      systemPackages: compute.systemPackages,
+      database: config.infrastructure?.database,
+      phpProvision: provision.phpProvision,
+      servicesProvision: provision.servicesProvision,
+      rpxProvision,
+      baked
+    });
+    const userData = wrapCloudInitUserData(bootstrap);
+    const serverType = resolveHetznerServerType(compute.size);
+    const image = compute.image || config.hetzner?.image || "ubuntu-24.04";
+    const firewallName = `${slug}-${environment}-app-fw`;
+    const { firewall } = await this.ensureFirewall(firewallName, labels, buildHetznerFirewallRules({
+      allowSsh: compute.allowSsh !== false,
+      sitePorts
+    }));
+    const sshKeyId = await this.ensureSshKey(slug, environment, labels);
+    const { server, action } = await this.client.createServer({
+      name: serverName,
+      serverType,
+      image,
+      location: config.hetzner?.location || this.location,
+      userData,
+      labels,
+      sshKeys: sshKeyId ? [sshKeyId] : undefined,
+      firewalls: [{ firewall: firewall.id }]
+    });
+    await this.client.waitForAction(action.id);
+    const running = await this.client.waitForServerRunning(server.id);
+    const state = {
+      provider: "hetzner",
+      stackName,
+      serverId: running.id,
+      serverName: running.name,
+      firewallId: firewall.id,
+      publicIp: running.public_net.ipv4?.ip,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+    await writeDriverState(stackName, state);
+    const ip = running.public_net.ipv4?.ip;
+    if (ip && this.waitForBoot) {
+      await this.waitForSshReady(ip);
+      await this.waitForCloudInit(ip);
+    }
+    return this.outputsFromState(state, running);
+  }
+  async provisionFleet(options, topology) {
+    const { config, environment } = options;
+    const slug = config.project.slug;
+    const compute = config.infrastructure.compute;
+    const stackName = resolveProjectStackName(config, environment);
+    const serverType = resolveHetznerServerType(compute.size);
+    const image = compute.image || config.hetzner?.image || "ubuntu-24.04";
+    const location = config.hetzner?.location || this.location;
+    const baked = compute.bakedImage === true;
+    const existingState = await readDriverState(stackName);
+    if (existingState?.loadBalancerId) {
+      const lbs = await this.client.listLoadBalancers().catch(() => []);
+      const lb = lbs.find((l) => l.id === existingState.loadBalancerId);
+      if (lb) {
+        return {
+          appPublicIp: lb.public_net?.ipv4?.ip,
+          loadBalancerIp: lb.public_net?.ipv4?.ip,
+          servicesPrivateIp: existingState.servicesPrivateIp,
+          deployStoragePath: "/var/ts-cloud/staging",
+          sshUser: this.sshUser
+        };
+      }
+    }
+    const sshKeyId = await this.ensureSshKey(slug, environment, tsCloudLabels(slug, environment, "app"));
+    const netName = `${slug}-${environment}-net`;
+    const networks = await this.client.listNetworks().catch(() => []);
+    const network = networks.find((n) => n.name === netName) ?? await this.client.createNetwork({ name: netName, labels: tsCloudLabels(slug, environment, "app") });
+    const { firewall: appFw } = await this.ensureFirewall(`${slug}-${environment}-app-fw`, tsCloudLabels(slug, environment, "app"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [] }));
+    const { firewall: svcFw } = await this.ensureFirewall(`${slug}-${environment}-services-fw`, tsCloudLabels(slug, environment, "services"), [
+      { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
+      { direction: "in", protocol: "tcp", port: "3306", source_ips: [network.ip_range] },
+      { direction: "in", protocol: "tcp", port: "5432", source_ips: [network.ip_range] },
+      { direction: "in", protocol: "tcp", port: "6379", source_ips: [network.ip_range] },
+      { direction: "in", protocol: "tcp", port: "7700", source_ips: [network.ip_range] }
+    ]);
+    const servicesProvision = [
+      ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
+      ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices ?? { mysql: true }),
+      ...buildAutoUpdatesScript(true),
+      ...buildMonitoringScript(true),
+      ...buildAuthorizedKeysScript(compute.sshKeys)
+    ];
+    const servicesUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", servicesProvision, baked }));
+    const all = await this.client.listServers().catch(() => []);
+    const newServerIds = [];
+    let svcServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "services"));
+    if (!svcServer) {
+      const { server, action } = await this.client.createServer({
+        name: `${slug}-${environment}-services`,
+        serverType: resolveHetznerServerType(typeof compute.servicesServer === "object" ? compute.servicesServer.size : compute.size),
+        image,
+        location,
+        userData: servicesUserData,
+        labels: tsCloudLabels(slug, environment, "services"),
+        sshKeys: sshKeyId ? [sshKeyId] : undefined,
+        firewalls: [{ firewall: svcFw.id }],
+        networks: [network.id]
+      });
+      await this.client.waitForAction(action.id);
+      svcServer = await this.client.waitForServerRunning(server.id);
+      newServerIds.push(server.id);
+    }
+    const servicesServerId = svcServer.id;
+    const servicesPrivateIp = svcServer.private_net?.[0]?.ip ?? (await this.client.getServer(servicesServerId)).private_net?.[0]?.ip;
+    const appProvision = [
+      ...buildAutoUpdatesScript(true),
+      ...buildMonitoringScript(true),
+      ...buildAuthorizedKeysScript(compute.sshKeys),
+      ...buildNotifierScript(config.notifications)
+    ];
+    const appPhp = buildPhpProvisionScript({
+      versions: compute.php?.versions,
+      default: compute.php?.default,
+      extensions: compute.php?.extensions,
+      installNginx: compute.webServer !== "rpx",
+      optimizeForProduction: compute.php?.optimizeForProduction,
+      ini: compute.php?.ini
+    });
+    const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", phpProvision: appPhp, servicesProvision: appProvision, baked }));
+    const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
+    const appServerIds = existingApp.map((s) => s.id);
+    if (existingApp.length > topology.appServers) {
+      for (const extra of existingApp.slice(topology.appServers)) {
+        await this.client.deleteServer(extra.id).catch(() => {});
+        appServerIds.splice(appServerIds.indexOf(extra.id), 1);
+      }
+    }
+    for (let i = existingApp.length;i < topology.appServers; i++) {
+      const { server, action } = await this.client.createServer({
+        name: `${slug}-${environment}-app-${i + 1}`,
+        serverType,
+        image,
+        location,
+        userData: appUserData,
+        labels: tsCloudLabels(slug, environment, "app"),
+        sshKeys: sshKeyId ? [sshKeyId] : undefined,
+        firewalls: [{ firewall: appFw.id }],
+        networks: [network.id]
+      });
+      await this.client.waitForAction(action.id);
+      appServerIds.push(server.id);
+      newServerIds.push(server.id);
+    }
+    if (this.waitForBoot && newServerIds.length > 0) {
+      await Promise.all(newServerIds.map(async (id) => {
+        const running = await this.client.waitForServerRunning(id);
+        const ip = running.public_net.ipv4?.ip;
+        if (ip) {
+          await this.waitForSshReady(ip);
+          await this.waitForCloudInit(ip);
+        }
+      }));
+    }
+    const lbName = `${slug}-${environment}-lb`;
+    let lbIp;
+    let lbId;
+    if (topology.loadBalancer) {
+      const lbs = await this.client.listLoadBalancers().catch(() => []);
+      const lb = lbs.find((l) => l.name === lbName) ?? await this.client.createLoadBalancer({
+        name: lbName,
+        location,
+        network: network.id,
+        labels: tsCloudLabels(slug, environment, "lb"),
+        labelSelector: `ts-cloud/project=${slug},ts-cloud/environment=${environment},ts-cloud/role=app`,
+        services: [
+          { listenPort: 80, destinationPort: 80 },
+          { listenPort: 443, destinationPort: 443 }
+        ]
+      });
+      lbId = lb.id;
+      lbIp = lb.public_net?.ipv4?.ip;
+    }
+    const appPublicIp = lbIp ?? (await this.client.getServer(appServerIds[0]).catch(() => {
+      return;
+    }))?.public_net.ipv4?.ip;
+    const state = {
+      provider: "hetzner",
+      stackName,
+      networkId: network.id,
+      loadBalancerId: lbId,
+      servicesServerId,
+      servicesPrivateIp,
+      publicIp: appPublicIp,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+    await writeDriverState(stackName, state);
+    return {
+      appPublicIp,
+      loadBalancerIp: lbIp,
+      servicesPrivateIp,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+  }
+  async provisionBunFleet(options, topology) {
+    const { config, environment } = options;
+    const slug = config.project.slug;
+    const compute = config.infrastructure.compute;
+    const stackName = resolveProjectStackName(config, environment);
+    const serverType = resolveHetznerServerType(compute.size);
+    const image = compute.image || config.hetzner?.image || "ubuntu-24.04";
+    const location = config.hetzner?.location || this.location;
+    const baked = compute.bakedImage === true;
+    const sites = config.sites || {};
+    const existingState = await readDriverState(stackName);
+    if (existingState?.lbServerId) {
+      const lb = await this.tryGetServer(existingState.lbServerId);
+      if (lb && lb.status !== "off") {
+        return {
+          appPublicIp: lb.public_net.ipv4?.ip ?? existingState.publicIp,
+          loadBalancerIp: lb.public_net.ipv4?.ip ?? existingState.publicIp,
+          servicesPrivateIp: existingState.servicesPrivateIp,
+          deployStoragePath: "/var/ts-cloud/staging",
+          sshUser: this.sshUser
+        };
+      }
+    }
+    const sshKeyId = await this.ensureSshKey(slug, environment, tsCloudLabels(slug, environment, "app"));
+    const netName = `${slug}-${environment}-net`;
+    const networks = await this.client.listNetworks().catch(() => []);
+    const network = networks.find((n) => n.name === netName) ?? await this.client.createNetwork({ name: netName, labels: tsCloudLabels(slug, environment, "app") });
+    const sitePorts = this.collectUpstreamPorts(sites);
+    const { firewall: appFw } = await this.ensureFirewall(`${slug}-${environment}-app-fw`, tsCloudLabels(slug, environment, "app"), [
+      { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
+      ...sitePorts.map((port) => ({
+        direction: "in",
+        protocol: "tcp",
+        port: String(port),
+        source_ips: [network.ip_range],
+        description: `ts-cloud port ${port} (private, LB-only)`
+      }))
+    ]);
+    const { firewall: lbFw } = await this.ensureFirewall(`${slug}-${environment}-lb-fw`, tsCloudLabels(slug, environment, "lb"), buildHetznerFirewallRules({ allowSsh: true, sitePorts: [] }));
+    const all = await this.client.listServers().catch(() => []);
+    const newServerIds = [];
+    let servicesServerId;
+    let servicesPrivateIp;
+    const wantsServicesBox = !!compute.servicesServer || !!compute.managedServices;
+    if (topology.dedicatedServices && wantsServicesBox) {
+      const { firewall: svcFw } = await this.ensureFirewall(`${slug}-${environment}-services-fw`, tsCloudLabels(slug, environment, "services"), [
+        { direction: "in", protocol: "tcp", port: "22", source_ips: ["0.0.0.0/0", "::/0"] },
+        { direction: "in", protocol: "tcp", port: "3306", source_ips: [network.ip_range] },
+        { direction: "in", protocol: "tcp", port: "5432", source_ips: [network.ip_range] },
+        { direction: "in", protocol: "tcp", port: "6379", source_ips: [network.ip_range] },
+        { direction: "in", protocol: "tcp", port: "7700", source_ips: [network.ip_range] }
+      ]);
+      const servicesProvision = [
+        ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
+        ...buildDatabaseSetupScript(config.infrastructure?.appDatabase, compute.managedServices ?? { mysql: true }),
+        ...buildAutoUpdatesScript(true),
+        ...buildMonitoringScript(true),
+        ...buildAuthorizedKeysScript(compute.sshKeys)
+      ];
+      const servicesUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "bun", servicesProvision, baked }));
+      let svcServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "services"));
+      if (!svcServer) {
+        const { server, action } = await this.client.createServer({
+          name: `${slug}-${environment}-services`,
+          serverType: resolveHetznerServerType(typeof compute.servicesServer === "object" ? compute.servicesServer.size : compute.size),
+          image,
+          location,
+          userData: servicesUserData,
+          labels: tsCloudLabels(slug, environment, "services"),
+          sshKeys: sshKeyId ? [sshKeyId] : undefined,
+          firewalls: [{ firewall: svcFw.id }],
+          networks: [network.id]
+        });
+        await this.client.waitForAction(action.id);
+        svcServer = await this.client.waitForServerRunning(server.id);
+        newServerIds.push(server.id);
+      }
+      servicesServerId = svcServer.id;
+      servicesPrivateIp = svcServer.private_net?.[0]?.ip ?? (await this.client.getServer(servicesServerId)).private_net?.[0]?.ip;
+    }
+    const appProvisionScripts = buildComputeProvisionScripts(config);
+    const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({
+      runtime: appProvisionScripts.runtime,
+      runtimeVersion: appProvisionScripts.runtimeVersion,
+      systemPackages: compute.systemPackages,
+      database: config.infrastructure?.database,
+      servicesProvision: appProvisionScripts.servicesProvision,
+      baked
+    }));
+    const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
+    const appServerIds = existingApp.map((s) => s.id);
+    if (existingApp.length > topology.appServers) {
+      for (const extra of existingApp.slice(topology.appServers)) {
+        await this.client.deleteServer(extra.id).catch(() => {});
+        appServerIds.splice(appServerIds.indexOf(extra.id), 1);
+      }
+    }
+    for (let i = existingApp.length;i < topology.appServers; i++) {
+      const { server, action } = await this.client.createServer({
+        name: `${slug}-${environment}-app-${i + 1}`,
+        serverType,
+        image,
+        location,
+        userData: appUserData,
+        labels: tsCloudLabels(slug, environment, "app"),
+        sshKeys: sshKeyId ? [sshKeyId] : undefined,
+        firewalls: [{ firewall: appFw.id }],
+        networks: [network.id]
+      });
+      await this.client.waitForAction(action.id);
+      appServerIds.push(server.id);
+      newServerIds.push(server.id);
+    }
+    if (this.waitForBoot && newServerIds.length > 0) {
+      await Promise.all(newServerIds.map(async (id) => {
+        const running = await this.client.waitForServerRunning(id);
+        const ip = running.public_net.ipv4?.ip;
+        if (ip) {
+          await this.waitForSshReady(ip);
+          await this.waitForCloudInit(ip);
+        }
+      }));
+    }
+    const appBoxes = [];
+    for (const id of appServerIds) {
+      let server = all.find((s) => s.id === id);
+      if (!server || !server.private_net?.[0]?.ip)
+        server = await this.client.getServer(id).catch(() => server);
+      appBoxes.push({ privateIp: server?.private_net?.[0]?.ip, publicIp: server?.public_net.ipv4?.ip });
+    }
+    const lbName = `${slug}-${environment}-lb`;
+    let lbId;
+    let lbIp;
+    if (topology.loadBalancer) {
+      let lbServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "lb"));
+      if (!lbServer) {
+        const rpxProxy = compute.proxy?.engine === "rpx" ? compute.proxy : { engine: "rpx" };
+        const lbRpxProvision = buildRpxProvisionScript({
+          proxy: rpxProxy,
+          config: buildRpxLbConfig(sites, appBoxes, { proxy: rpxProxy }),
+          slug,
+          bunBin: appProvisionScripts.runtime === "node" || appProvisionScripts.runtime === "deno" ? undefined : "/usr/local/bin/bun"
+        });
+        const lbUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({
+          runtime: "bun",
+          rpxProvision: lbRpxProvision,
+          baked: false
+        }));
+        const lbSize = typeof compute.loadBalancer === "object" ? compute.loadBalancer.size : undefined;
+        const { server, action } = await this.client.createServer({
+          name: lbName,
+          serverType: resolveHetznerServerType(lbSize ?? "micro"),
+          image,
+          location,
+          userData: lbUserData,
+          labels: tsCloudLabels(slug, environment, "lb"),
+          sshKeys: sshKeyId ? [sshKeyId] : undefined,
+          firewalls: [{ firewall: lbFw.id }],
+          networks: [network.id]
+        });
+        await this.client.waitForAction(action.id);
+        lbServer = await this.client.waitForServerRunning(server.id);
+        if (this.waitForBoot) {
+          const ip = lbServer.public_net.ipv4?.ip;
+          if (ip) {
+            await this.waitForSshReady(ip);
+            await this.waitForCloudInit(ip);
+          }
+        }
+      }
+      lbId = lbServer.id;
+      lbIp = lbServer.public_net.ipv4?.ip;
+    }
+    const appPublicIp = lbIp ?? (await this.client.getServer(appServerIds[0]).catch(() => {
+      return;
+    }))?.public_net.ipv4?.ip;
+    const state = {
+      provider: "hetzner",
+      stackName,
+      networkId: network.id,
+      lbServerId: lbId,
+      appServerIds,
+      servicesServerId,
+      servicesPrivateIp,
+      publicIp: appPublicIp,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+    await writeDriverState(stackName, state);
+    return {
+      appPublicIp,
+      loadBalancerIp: lbIp,
+      servicesPrivateIp,
+      deployStoragePath: "/var/ts-cloud/staging",
+      sshUser: this.sshUser
+    };
+  }
+  async destroyCompute(options) {
+    const { config, environment } = options;
+    const slug = config.project.slug;
+    const stackName = resolveProjectStackName(config, environment);
+    const state = await readDriverState(stackName);
+    const destroyed = [];
+    const lbName = `${slug}-${environment}-lb`;
+    const lbs = await this.client.listLoadBalancers().catch(() => []);
+    const lb = lbs.find((l) => l.name === lbName);
+    if (lb) {
+      try {
+        await this.client.deleteLoadBalancer(lb.id);
+        destroyed.push(`load balancer ${lbName}`);
+      } catch {}
+    }
+    const allServers = await this.client.listServers().catch(() => []);
+    const serverIds = new Set;
+    for (const s of allServers) {
+      if (matchesTsCloudLabels(s.labels, slug, environment, "app") || matchesTsCloudLabels(s.labels, slug, environment, "services") || matchesTsCloudLabels(s.labels, slug, environment, "lb"))
+        serverIds.add(s.id);
+    }
+    if (state?.serverId)
+      serverIds.add(state.serverId);
+    if (state?.servicesServerId)
+      serverIds.add(state.servicesServerId);
+    if (state?.lbServerId)
+      serverIds.add(state.lbServerId);
+    for (const id of state?.appServerIds ?? [])
+      serverIds.add(id);
+    for (const id of serverIds) {
+      try {
+        await this.client.deleteServer(id);
+        destroyed.push(`server ${id}`);
+      } catch {}
+    }
+    const firewalls = await this.client.listFirewalls().catch(() => []);
+    for (const name of [`${slug}-${environment}-app-fw`, `${slug}-${environment}-services-fw`, `${slug}-${environment}-lb-fw`]) {
+      const fw = firewalls.find((f) => f.name === name);
+      if (!fw)
+        continue;
+      for (let i = 0;i < 12; i++) {
+        try {
+          await this.client.deleteFirewall(fw.id);
+          destroyed.push(`firewall ${name}`);
+          break;
+        } catch {
+          await this.sleep(3000);
+        }
+      }
+    }
+    const netName = `${slug}-${environment}-net`;
+    const networks = await this.client.listNetworks().catch(() => []);
+    const net = networks.find((n) => n.name === netName);
+    if (net) {
+      for (let i = 0;i < 12; i++) {
+        try {
+          await this.client.deleteNetwork(net.id);
+          destroyed.push(`network ${netName}`);
+          break;
+        } catch {
+          await this.sleep(3000);
+        }
+      }
+    }
+    await writeDriverState(stackName, { provider: "hetzner", stackName }).catch(() => {});
+    return { destroyed };
+  }
+  async getComputeOutputs(options) {
+    const stackName = resolveProjectStackName(options.config, options.environment);
+    const state = await readDriverState(stackName);
+    if (state?.serverId) {
+      const server = await this.client.getServer(state.serverId);
+      return this.outputsFromState(state, server);
+    }
+    if (state?.lbServerId) {
+      const lb = await this.tryGetServer(state.lbServerId);
+      const lbIp = lb?.public_net.ipv4?.ip ?? state.publicIp;
+      return {
+        ...this.outputsFromState(state),
+        appPublicIp: lbIp,
+        loadBalancerIp: lbIp
+      };
+    }
+    if (state?.loadBalancerId || state?.servicesPrivateIp) {
+      return this.outputsFromState(state);
+    }
+    const targets = await this.findComputeTargets({
+      slug: options.config.project.slug,
+      environment: options.environment,
+      role: "app",
+      stackName: resolveProjectStackName(options.config, options.environment)
+    });
+    const first = targets[0];
+    return {
+      deployStoragePath: "/var/ts-cloud/staging",
+      appInstanceId: first?.id,
+      appPublicIp: first?.publicIp,
+      sshUser: this.sshUser
+    };
+  }
+  async uploadRelease(options) {
+    const targets = options.targets?.length ? options.targets : await this.findComputeTargets({
+      slug: options.config.project.slug,
+      environment: options.environment,
+      role: "app",
+      stackName: resolveProjectStackName(options.config, options.environment)
+    });
+    if (targets.length === 0) {
+      throw new Error("No Hetzner compute targets found for release upload");
+    }
+    const stagingName = options.remoteKey.replace(/^releases\//, "").replace(/\//g, "-");
+    const remotePath = `/var/ts-cloud/staging/${stagingName}`;
+    for (const target of targets) {
+      if (!target.publicIp) {
+        throw new Error(`Target ${target.id} has no public IP for SCP upload`);
+      }
+      this.scpToHost(target.publicIp, options.localPath, remotePath);
+    }
+    return { artifactRef: remotePath };
+  }
+  async findComputeTargets(options) {
+    const servers = await this.client.listServers();
+    const role = options.role || "app";
+    const toTarget = (server) => ({
+      id: String(server.id),
+      name: server.name,
+      publicIp: server.public_net.ipv4?.ip,
+      privateIp: server.private_net?.[0]?.ip,
+      status: server.status
+    });
+    const exact = servers.filter((server) => matchesTsCloudLabels(server.labels, options.slug, options.environment, role));
+    if (exact.length > 0)
+      return exact.map(toTarget);
+    if (role === "app") {
+      const state = await readDriverState(options.stackName ?? `${options.slug}-${options.environment}`);
+      const pinnedIds = [state?.serverId, ...state?.appServerIds ?? []].filter((id) => typeof id === "number");
+      if (pinnedIds.length > 0) {
+        const pinned = [];
+        for (const id of pinnedIds) {
+          const server = servers.find((candidate) => candidate.id === id) ?? await this.tryGetServer(id);
+          if (server && server.status !== "off")
+            pinned.push(server);
+        }
+        if (pinned.length > 0)
+          return pinned.map(toTarget);
+      }
+    }
+    if (role === "app") {
+      const candidates = servers.filter((server) => server.status !== "off" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/managed-by`] === "ts-cloud" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/environment`] === options.environment && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/role`] === "app");
+      if (candidates.length === 1)
+        return candidates.map(toTarget);
+    }
+    return [];
+  }
+  async runRemoteDeploy(options) {
+    if (options.targets.length === 0) {
+      return { success: false, instanceCount: 0, perInstance: [], error: "No targets provided" };
+    }
+    const script = options.commands.join(`
+`);
+    const perInstance = [];
+    for (const target of options.targets) {
+      if (!target.publicIp) {
+        perInstance.push({
+          instanceId: target.id,
+          status: "Failed",
+          error: "Missing public IP"
+        });
+        continue;
+      }
+      try {
+        const output = this.sshExec(target.publicIp, script);
+        perInstance.push({
+          instanceId: target.id,
+          status: "Success",
+          output
+        });
+      } catch (err) {
+        perInstance.push({
+          instanceId: target.id,
+          status: "Failed",
+          error: err.message
+        });
+      }
+    }
+    const success = perInstance.every((r) => r.status === "Success");
+    return {
+      success,
+      instanceCount: options.targets.length,
+      perInstance,
+      error: success ? undefined : "One or more SSH deploy commands failed"
+    };
+  }
+  async ensureSshKey(slug, environment, labels) {
+    if (!existsSync(this.sshPublicKeyPath)) {
+      throw new Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. ` + `Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);
+    }
+    const publicKey = readFileSync2(this.sshPublicKeyPath, "utf8").trim();
+    const normalized = normalizeSshPublicKey(publicKey);
+    const existing = await this.client.listSshKeys();
+    const match = existing.find((key) => normalizeSshPublicKey(key.public_key) === normalized);
+    if (match)
+      return match.id;
+    const created = await this.client.createSshKey({
+      name: `${slug}-${environment}-deploy`,
+      publicKey,
+      labels
+    });
+    return created.id;
+  }
+  async tryGetServer(id) {
+    try {
+      return await this.client.getServer(id);
+    } catch {
+      return null;
+    }
+  }
+  async findExistingServer(slug, environment, serverName) {
+    const servers = await this.client.listServers();
+    const exact = servers.find((server) => matchesTsCloudLabels(server.labels, slug, environment, "app") || server.name === serverName);
+    if (exact)
+      return exact;
+    const candidates = servers.filter((server) => server.status !== "off" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/managed-by`] === "ts-cloud" && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/environment`] === environment && server.labels?.[`${TS_CLOUD_LABEL_PREFIX}/role`] === "app");
+    if (candidates.length === 1) {
+      const adopted = candidates[0];
+      const adoptedProject = adopted.labels?.[`${TS_CLOUD_LABEL_PREFIX}/project`] ?? "unknown";
+      console.warn(`[ts-cloud] No server named '${serverName}' found; adopting existing ts-cloud app server ` + `'${adopted.name}' (project label '${adoptedProject}') for project '${slug}' — ` + `updating it in place instead of provisioning a new server.`);
+      return adopted;
+    }
+    return;
+  }
+  async ensureFirewall(name, labels, rules) {
+    const existing = await this.client.listFirewalls();
+    const match = existing.find((fw) => fw.name === name);
+    if (match) {
+      await this.client.setFirewallRules(match.id, rules);
+      return { firewall: match };
+    }
+    const { firewall } = await this.client.createFirewall({ name, labels, rules });
+    return { firewall };
+  }
+  collectUpstreamPorts(sites) {
+    const ports = new Set;
+    for (const site of Object.values(sites)) {
+      if (typeof site.port === "number")
+        ports.add(site.port);
+    }
+    return [...ports].filter((port) => ![80, 443].includes(port));
+  }
+  async sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  async waitForSshReady(host) {
+    const { sshIntervalMs, sshTimeoutMs } = this.bootWait;
+    const start = Date.now();
+    let lastErr;
+    while (Date.now() - start < sshTimeoutMs) {
+      try {
+        execSync(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} true`, {
+          stdio: "pipe",
+          maxBuffer: SSH_MAX_BUFFER
+        });
+        return;
+      } catch (err) {
+        lastErr = err;
+        await this.sleep(sshIntervalMs);
+      }
+    }
+    throw new Error(`Timed out waiting for SSH on ${host} after ${sshTimeoutMs}ms: ${lastErr?.message ?? "unknown error"}`);
+  }
+  async waitForCloudInit(host) {
+    const { cloudInitIntervalMs, cloudInitTimeoutMs } = this.bootWait;
+    const start = Date.now();
+    while (Date.now() - start < cloudInitTimeoutMs) {
+      try {
+        const out = this.sshExec(host, "cloud-init status --long 2>/dev/null || cloud-init status 2>/dev/null || echo status:\\ done");
+        if (/status:\s*done/.test(out))
+          return;
+        if (/status:\s*error/.test(out))
+          throw new Error(`cloud-init reported an error on ${host}:
+${out}`);
+      } catch (err) {
+        if (err instanceof Error && /cloud-init reported an error/.test(err.message))
+          throw err;
+      }
+      await this.sleep(cloudInitIntervalMs);
+    }
+    throw new Error(`Timed out waiting for cloud-init to finish on ${host} after ${cloudInitTimeoutMs}ms`);
+  }
+  outputsFromState(state, server) {
+    return {
+      deployStoragePath: state.deployStoragePath || "/var/ts-cloud/staging",
+      appInstanceId: state.serverId ? String(state.serverId) : undefined,
+      appPublicIp: server?.public_net.ipv4?.ip || state.publicIp,
+      sshUser: state.sshUser || this.sshUser,
+      servicesPrivateIp: state.servicesPrivateIp
+    };
+  }
+  static SSH_HOST_KEY_OPTS = [
+    "-o",
+    "StrictHostKeyChecking=no",
+    "-o",
+    "UserKnownHostsFile=/dev/null",
+    "-o",
+    "LogLevel=ERROR"
+  ];
+  sshBaseArgs(host, extra = []) {
+    return [
+      "-i",
+      this.sshPrivateKeyPath,
+      ...HetznerDriver.SSH_HOST_KEY_OPTS,
+      "-o",
+      "BatchMode=yes",
+      ...extra,
+      `${this.sshUser}@${host}`
+    ];
+  }
+  scpToHost(host, localPath, remotePath) {
+    execSync([
+      "scp",
+      "-i",
+      this.sshPrivateKeyPath,
+      ...HetznerDriver.SSH_HOST_KEY_OPTS,
+      "-o",
+      "BatchMode=yes",
+      localPath,
+      `${this.sshUser}@${host}:${remotePath}`
+    ].map((arg) => `"${arg.replace(/"/g, "\\\"")}"`).join(" "), { stdio: "pipe", maxBuffer: SSH_MAX_BUFFER });
+  }
+  sshExec(host, script) {
+    const escaped = script.replace(/'/g, `'\\''`);
+    return execSync(`ssh ${this.sshBaseArgs(host).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} '${escaped}'`, {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: SSH_MAX_BUFFER
+    });
+  }
+}
+
+// src/drivers/local-box/driver.ts
+class LocalBoxDriver {
+  name = "hetzner";
+  usesCloudFormation = false;
+  async getComputeOutputs() {
+    return { appPublicIp: "127.0.0.1", sshUser: "root" };
+  }
+  async uploadRelease(options) {
+    return { artifactRef: options.localPath };
+  }
+  async findComputeTargets(_options) {
+    return [{ id: "localhost", name: "localhost", publicIp: "127.0.0.1", status: "running" }];
+  }
+  async runRemoteDeploy(options) {
+    const script = options.commands.join(`
+`);
+    try {
+      const proc = Bun.spawn(["bash", "-c", script], { stdout: "pipe", stderr: "pipe", env: process.env });
+      const [output, error, exitCode] = await Promise.all([
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+        proc.exited
+      ]);
+      return {
+        success: exitCode === 0,
+        instanceCount: 1,
+        perInstance: [{ instanceId: "localhost", status: exitCode === 0 ? "Success" : "Failed", output, error }]
+      };
+    } catch (err) {
+      return {
+        success: false,
+        instanceCount: 1,
+        perInstance: [{ instanceId: "localhost", status: "Failed", error: err?.message ?? String(err) }],
+        error: err?.message ?? String(err)
+      };
+    }
+  }
+}
+function isBoxMode() {
+  const v = process.env.TS_CLOUD_DASHBOARD_BOX;
+  return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+}
+
+// src/drivers/factory.ts
+function createCloudDriver(options) {
+  if (isBoxMode())
+    return new LocalBoxDriver;
+  const provider = options.provider ?? resolveCloudProvider(options.config);
+  switch (provider) {
+    case "aws":
+      return new AwsDriver({ region: options.config.project.region });
+    case "hetzner":
+      return new HetznerDriver({
+        apiToken: options.config.hetzner?.apiToken,
+        sshPrivateKeyPath: options.config.hetzner?.sshPrivateKeyPath,
+        sshUser: options.config.hetzner?.sshUser,
+        location: options.config.hetzner?.location
+      });
+    default:
+      throw new Error(`Unknown cloud provider: ${options.provider ?? resolveCloudProvider(options.config)}`);
+  }
+}
+
+class CloudDriverFactory {
+  drivers = new Map;
+  getDriver(config, provider) {
+    const name = provider ?? resolveCloudProvider(config);
+    const cacheKey = `${name}:${config.project.slug}:${config.project.region || "default"}`;
+    const cached = this.drivers.get(cacheKey);
+    if (cached)
+      return cached;
+    const driver = createCloudDriver({ config, provider: name });
+    this.drivers.set(cacheKey, driver);
+    return driver;
+  }
+}
+var cloudDrivers = new CloudDriverFactory;
+// src/drivers/hetzner/provision.ts
+async function ensureSshKey(client, options) {
+  const body = normalizeSshPublicKey(options.publicKey);
+  const existing = (await client.listSshKeys()).find((k) => normalizeSshPublicKey(k.public_key) === body);
+  if (existing)
+    return { id: existing.id, name: existing.name, created: false };
+  const created = await client.createSshKey({ name: options.name, publicKey: options.publicKey.trim(), labels: options.labels });
+  return { id: created.id, name: created.name, created: true };
+}
+async function ensureFirewall(client, options) {
+  const existing = (await client.listFirewalls()).find((f) => f.name === options.name);
+  if (existing) {
+    await client.setFirewallRules(existing.id, options.rules);
+    return { id: existing.id, name: existing.name, created: false };
+  }
+  const { firewall } = await client.createFirewall({ name: options.name, rules: options.rules, labels: options.labels });
+  return { id: firewall.id, name: firewall.name, created: true };
+}
+async function ensureServer(client, options) {
+  const { waitForRunning = true, ...createOptions } = options;
+  let server = (await client.listServers()).find((s) => s.name === options.name);
+  const created = !server;
+  if (!server)
+    server = (await client.createServer(createOptions)).server;
+  if (waitForRunning)
+    server = await client.waitForServerRunning(server.id);
+  return { server, created };
+}
+function serverPublicIpv4(server) {
+  const ip = server.public_net.ipv4?.ip;
+  if (!ip)
+    throw new Error(`Hetzner server "${server.name}" (#${server.id}) has no public IPv4`);
+  return ip;
+}
+// src/drivers/shared/remote-exec.ts
+function buildSshArgs(options = {}) {
+  const args = [];
+  if (options.identityFile)
+    args.push("-i", options.identityFile);
+  args.push("-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null", "-o", "LogLevel=ERROR", "-o", `ConnectTimeout=${options.connectTimeoutSec ?? 10}`);
+  return args;
+}
+async function sshExec(host, command, options = {}) {
+  const proc = Bun.spawn(["ssh", ...buildSshArgs(options), `${options.user ?? "root"}@${host}`, command], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  const code = await proc.exited;
+  return { code, stdout, stderr };
+}
+async function sshExecOrThrow(host, command, options = {}) {
+  const result = await sshExec(host, command, options);
+  if (result.code !== 0)
+    throw new Error(`ssh \`${command}\` on ${host} failed (${result.code}): ${result.stderr.trim() || result.stdout.trim()}`);
+  return result.stdout;
+}
+async function scpUpload(host, localPaths, remoteDir, options = {}) {
+  const proc = Bun.spawn(["scp", ...buildSshArgs(options), ...localPaths, `${options.user ?? "root"}@${host}:${remoteDir}`], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const code = await proc.exited;
+  if (code !== 0) {
+    const stderr = await new Response(proc.stderr).text();
+    throw new Error(`scp to ${host}:${remoteDir} failed (${code}): ${stderr.trim()}`);
+  }
+}
+async function waitForSsh(host, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 180000;
+  const pollIntervalMs = options.pollIntervalMs ?? 5000;
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const r = await sshExec(host, "echo ready", options);
+    if (r.code === 0 && r.stdout.includes("ready"))
+      return;
+    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+  }
+  throw new Error(`SSH not ready on ${host} after ${timeoutMs}ms`);
+}
+async function waitForCloudInit(host, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 300000;
+  const pollIntervalMs = options.pollIntervalMs ?? 5000;
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const r = await sshExec(host, "cloud-init status 2>/dev/null || echo unknown", options);
+    if (r.stdout.includes("status: done"))
+      return;
+    if (r.stdout.includes("status: error"))
+      throw new Error(`cloud-init reported an error on ${host}; check /var/log/cloud-init-output.log`);
+    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+  }
+  throw new Error(`cloud-init did not finish on ${host} after ${timeoutMs}ms`);
+}
+// src/drivers/shared/env-file.ts
+function formatEnvFile(env) {
+  return Object.entries(env).map(([k, v]) => `${k}=${quoteEnvValue(String(v))}`).join(`
+`);
+}
+function quoteEnvValue(value) {
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  return `"${escaped}"`;
+}
+
+// src/drivers/shared/releases.ts
+var DEFAULT_SHARED_PATHS = ["storage", ".env"];
+var DEFAULT_KEEP_RELEASES = 4;
+var DEFAULT_KEEP_DEPLOY_LOGS = 20;
+function deployMetaDir(base) {
+  return `${base.replace(/\/+$/, "")}/.ts-cloud`;
+}
+function deployHistoryPath(base) {
+  return `${deployMetaDir(base)}/deploy-history.log`;
+}
+function deployLogPath(base, releaseId) {
+  return `${deployMetaDir(base)}/deploys/${releaseId}.log`;
+}
+function releasePaths(base, releaseId) {
+  const root = base.replace(/\/+$/, "");
+  return {
+    base: root,
+    releases: `${root}/releases`,
+    shared: `${root}/shared`,
+    current: `${root}/current`,
+    release: `${root}/releases/${releaseId}`
+  };
+}
+function isFileSharedPath(p) {
+  const name = p.split("/").pop() || p;
+  return name.startsWith(".") || /\.[a-z0-9]+$/i.test(name);
+}
+function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
+  const lines = [
+    `mkdir -p ${paths.releases} ${paths.shared}`
+  ];
+  for (const p of sharedPaths) {
+    if (isFileSharedPath(p)) {
+      lines.push(`mkdir -p "$(dirname ${paths.shared}/${p})"`, `touch ${paths.shared}/${p}`);
+    } else if (p === "storage") {
+      lines.push(`mkdir -p ${paths.shared}/storage/app/public`, `mkdir -p ${paths.shared}/storage/framework/cache/data`, `mkdir -p ${paths.shared}/storage/framework/sessions`, `mkdir -p ${paths.shared}/storage/framework/testing`, `mkdir -p ${paths.shared}/storage/framework/views`, `mkdir -p ${paths.shared}/storage/logs`);
+    } else {
+      lines.push(`mkdir -p ${paths.shared}/${p}`);
+    }
+  }
+  return lines;
+}
+function buildLinkSharedPaths(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
+  const lines = [];
+  for (const p of sharedPaths) {
+    const target = `${paths.shared}/${p}`;
+    const link = `${paths.release}/${p}`;
+    lines.push(`rm -rf ${link}`, `mkdir -p "$(dirname ${link})"`, `ln -sfn ${target} ${link}`);
+  }
+  return lines;
+}
+function buildActivateRelease(paths) {
+  return [
+    `ln -sfn ${paths.release} ${paths.current}.tmp`,
+    `mv -Tf ${paths.current}.tmp ${paths.current}`
+  ];
+}
+function buildRollbackScript(paths, options = {}) {
+  if (options.to) {
+    const target = `${paths.releases}/${options.to}`;
+    return [
+      `[ -d ${target} ] || { echo "rollback target ${target} not found" >&2; exit 1; }`,
+      `ln -sfn ${target} ${paths.current}.tmp`,
+      `mv -Tf ${paths.current}.tmp ${paths.current}`
+    ];
+  }
+  return [
+    `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
+    `TS_CLOUD_PREV=$(ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do ` + '[ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)',
+    '[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',
+    `ln -sfn "$TS_CLOUD_PREV" ${paths.current}.tmp`,
+    `mv -Tf ${paths.current}.tmp ${paths.current}`,
+    'echo "rolled back to $TS_CLOUD_PREV"'
+  ];
+}
+function buildPruneReleases(paths, keep = DEFAULT_KEEP_RELEASES) {
+  const n = Math.max(1, keep);
+  return [
+    `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
+    `ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | tail -n +${n + 1} | while read -r TS_CLOUD_OLD; do`,
+    '  [ "$(readlink -f "$TS_CLOUD_OLD")" = "$TS_CLOUD_CURRENT" ] || rm -rf "$TS_CLOUD_OLD"',
+    "done"
+  ];
+}
+function buildDeployHistoryHeader(base, options) {
+  const meta = deployMetaDir(base);
+  const log = deployLogPath(base, options.releaseId);
+  const history = deployHistoryPath(base);
+  const keepLogs = Math.max(1, options.keepLogs ?? DEFAULT_KEEP_DEPLOY_LOGS);
+  const commit = options.commit || "";
+  const branch = options.branch || "";
+  return [
+    `mkdir -p ${meta}/deploys`,
+    `exec > >(tee -a ${log}) 2>&1`,
+    `echo "[ts-cloud] deploy ${options.releaseId} commit=${commit} branch=${branch} starting $(date -u +%Y-%m-%dT%H:%M:%SZ)"`,
+    "ts_cloud_record_deploy() {",
+    "  TS_CLOUD_RC=$?",
+    '  if [ "$TS_CLOUD_RC" -eq 0 ]; then TS_CLOUD_ST=success; else TS_CLOUD_ST=failed; fi',
+    `  printf '%s\\t%s\\t%s\\t%s\\trc=%s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${options.releaseId}" "${commit}" "$TS_CLOUD_ST" "$TS_CLOUD_RC" >> ${history}`,
+    "}",
+    "trap ts_cloud_record_deploy EXIT",
+    `ls -1t ${meta}/deploys/*.log 2>/dev/null | tail -n +${keepLogs + 1} | while read -r TS_CLOUD_OLDLOG; do rm -f "$TS_CLOUD_OLDLOG"; done`
+  ];
+}
+
+// src/drivers/shared/deploy-script.ts
+function resolveExecStart(start, runtime) {
+  const bin = runtime === "bun" ? "/usr/local/bin/bun" : runtime === "deno" ? "/usr/local/bin/deno" : "/usr/local/bin/node";
+  const args = start.replace(/^(bun|node|deno)\s+/, "");
+  return `${bin} ${args}`;
+}
+function buildSiteDeployScript(options) {
+  const {
+    siteName,
+    slug,
+    artifactFetch,
+    releaseId,
+    execStart,
+    envEntries,
+    port,
+    keepReleases = DEFAULT_KEEP_RELEASES,
+    preStartCommands = []
+  } = options;
+  const base = options.appDir ?? `/var/www/${siteName}`;
+  const paths = releasePaths(base, releaseId);
+  const serviceName = `${slug}-${siteName}.service`;
+  const sharedPaths = [".env"];
+  const envFile = formatEnvFile(envEntries);
+  const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
+  return [
+    "set -euo pipefail",
+    ...artifactFetch,
+    ...buildEnsureReleaseLayout(paths, sharedPaths),
+    `rm -rf ${paths.release}`,
+    `mkdir -p ${paths.release}`,
+    `tar xzf /tmp/${siteName}-release.tar.gz -C ${paths.release}`,
+    `cat > ${paths.shared}/.env <<'TS_CLOUD_ENV_EOF'`,
+    envFile,
+    "TS_CLOUD_ENV_EOF",
+    `chmod 600 ${paths.shared}/.env`,
+    ...buildLinkSharedPaths(paths, sharedPaths),
+    ...preStart,
+    `cat > /etc/systemd/system/${serviceName} <<'TS_CLOUD_UNIT_EOF'`,
+    "[Unit]",
+    `Description=${siteName} (managed by ts-cloud)`,
+    "After=network.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `WorkingDirectory=${paths.current}`,
+    `ExecStart=${execStart}`,
+    "Restart=always",
+    "RestartSec=5",
+    `EnvironmentFile=${paths.current}/.env`,
+    ...port ? [`Environment=PORT=${port}`] : [],
+    "",
+    "[Install]",
+    "WantedBy=multi-user.target",
+    "TS_CLOUD_UNIT_EOF",
+    "systemctl daemon-reload",
+    `systemctl enable ${serviceName}`,
+    ...buildActivateRelease(paths),
+    `systemctl restart ${serviceName}`,
+    `systemctl is-active ${serviceName}`,
+    ...buildPruneReleases(paths, keepReleases)
+  ];
+}
+function buildStaticSiteDeployScript(options) {
+  const { siteName, artifactFetch, releaseId, keepReleases = DEFAULT_KEEP_RELEASES, preStartCommands = [] } = options;
+  const base = options.appDir ?? `/var/www/${siteName}`;
+  const paths = releasePaths(base, releaseId);
+  const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
+  return [
+    "set -euo pipefail",
+    ...artifactFetch,
+    ...buildEnsureReleaseLayout(paths, []),
+    `rm -rf ${paths.release}`,
+    `mkdir -p ${paths.release}`,
+    `tar xzf /tmp/${siteName}-release.tar.gz -C ${paths.release}`,
+    ...preStart,
+    ...buildActivateRelease(paths),
+    ...buildPruneReleases(paths, keepReleases)
+  ];
+}
+function buildAwsArtifactFetch(bucket, key, region, siteName) {
+  return [
+    `aws s3 cp "s3://${bucket}/${key}" /tmp/${siteName}-release.tar.gz --region ${region}`
+  ];
+}
+function buildLocalArtifactFetch(localPath, siteName) {
+  return [
+    `cp "${localPath}" /tmp/${siteName}-release.tar.gz`
+  ];
+}
+// src/deploy/management-dashboard.ts
+import { execSync as execSync2 } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+var MANAGEMENT_DASHBOARD_SITE = "dashboard";
+var DASHBOARD_CREDENTIALS_FILE = join4(".ts-cloud", "dashboard-credentials.json");
+function generatePassword() {
+  return randomBytes(24).toString("base64url");
+}
+function resolveDashboardAuth(cwd, username, logger) {
+  const explicit = process.env.TS_CLOUD_UI_PASSWORD?.trim();
+  if (explicit)
+    return { password: explicit, source: "env" };
+  if (truthy(process.env.TS_CLOUD_UI_PUBLIC))
+    return { password: undefined, source: "public" };
+  const file = join4(cwd, DASHBOARD_CREDENTIALS_FILE);
+  try {
+    if (existsSync2(file)) {
+      const saved = JSON.parse(readFileSync3(file, "utf8"));
+      if (saved?.password)
+        return { password: saved.password, source: "generated" };
+    }
+  } catch {}
+  const password = generatePassword();
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, `${JSON.stringify({ username, password, generatedAt: new Date().toISOString() }, null, 2)}
+`);
+    chmodSync(file, 384);
+    logger.info(`Management dashboard: generated a password and saved it to ${DASHBOARD_CREDENTIALS_FILE} (user: ${username}, pass: ${password}). Set TS_CLOUD_UI_PASSWORD to pin your own, or TS_CLOUD_UI_PUBLIC=1 to serve without auth.`);
+  } catch (error) {
+    logger.warn(`Management dashboard: could not persist the generated password (${error?.message ?? error}). Using it for this deploy only — pass: ${password}`);
+  }
+  return { password, source: "generated" };
+}
+var noopLogger = { info: () => {}, warn: () => {} };
+function truthy(v) {
+  return v != null && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+}
+function resolveUiSource(cwd) {
+  if (existsSync2(join4(cwd, "packages", "ui", "pages")) || existsSync2(join4(cwd, "packages", "ui", "package.json"))) {
+    return { uiRoot: "packages/ui/dist", build: "cd packages/ui && bun install && bun run build" };
+  }
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join4(here, "ui"),
+    join4(here, "..", "ui"),
+    join4(here, "..", "..", "ui"),
+    join4(here, "..", "dist", "ui")
+  ];
+  for (const dir of candidates) {
+    if (existsSync2(join4(dir, "index.html")) || existsSync2(join4(dir, "serverless.html")))
+      return { uiRoot: dir, build: false };
+  }
+  return null;
+}
+function ensureManagementDashboard(config, options = {}) {
+  const logger = options.logger ?? noopLogger;
+  const cwd = options.cwd ?? process.cwd();
+  if (truthy(process.env.TS_CLOUD_UI_DISABLE)) {
+    logger.info("Management dashboard: skipped (TS_CLOUD_UI_DISABLE set).");
+    return config;
+  }
+  if (hasManagementDashboardSite(config))
+    return config;
+  const ui = resolveUiSource(cwd);
+  if (!ui) {
+    logger.info("Management dashboard: UI not found (no local ui/ or packaged dist/ui) — skipping auto-deploy.");
+    return config;
+  }
+  const username = process.env.TS_CLOUD_UI_USERNAME?.trim() || "admin";
+  const auth = resolveDashboardAuth(cwd, username, logger);
+  const environment = config.environments && Object.keys(config.environments)[0];
+  const live = truthy(process.env.TS_CLOUD_UI_LIVE);
+  const port = Number(process.env.TS_CLOUD_UI_PORT) || undefined;
+  const resolved = resolveManagementDashboardSite(config, environment ?? "production", {
+    uiRoot: ui.uiRoot,
+    build: ui.build,
+    domain: process.env.TS_CLOUD_UI_DOMAIN?.trim() || undefined,
+    username,
+    password: auth.password,
+    realm: process.env.TS_CLOUD_UI_REALM?.trim() || undefined,
+    live,
+    port
+  });
+  if (!resolved) {
+    logger.info("Management dashboard: no domain resolved (set TS_CLOUD_UI_DOMAIN or configure a site domain) — skipping.");
+    return config;
+  }
+  config.sites = { ...config.sites ?? {}, [resolved.name]: resolved.site };
+  const authNote = auth.source === "public" ? "NO AUTH — TS_CLOUD_UI_PUBLIC is set (dashboard is publicly reachable)" : auth.source === "env" ? "htpasswd-protected (TS_CLOUD_UI_PASSWORD)" : `htpasswd-protected (auto-generated — see ${DASHBOARD_CREDENTIALS_FILE})`;
+  logger.info(`Management dashboard → https://${resolved.site.domain} (${authNote})`);
+  return config;
+}
+function buildManagementDashboardArtifact(site, options) {
+  if (!site?.root)
+    return null;
+  const cwd = options.cwd ?? process.cwd();
+  const logger = options.logger ?? noopLogger;
+  try {
+    if (typeof site.build === "string" && site.build.trim()) {
+      logger.info(`Management dashboard: building UI (${site.build})`);
+      execSync2(site.build, { cwd, stdio: "inherit" });
+    }
+    const root = isAbsolute(site.root) ? site.root : join4(cwd, site.root);
+    if (!existsSync2(root)) {
+      logger.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
+      return null;
+    }
+    const tarball = join4(tmpdir(), `${options.slug}-${MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
+    execSync2(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
+    return tarball;
+  } catch (error) {
+    logger.warn(`Management dashboard: failed to build artifact — ${error?.message ?? error}. Skipping dashboard deploy.`);
+    return null;
+  }
+}
+
+// src/drivers/shared/certbot.ts
+function resolveSslProvider(site) {
+  if (site.ssl?.provider)
+    return site.ssl.provider;
+  return site.domain ? "letsencrypt" : "none";
+}
+var DNS_PLUGINS = {
+  cloudflare: { pkg: "python3-certbot-dns-cloudflare", plugin: "dns-cloudflare" },
+  route53: { pkg: "python3-certbot-dns-route53", plugin: "dns-route53" },
+  digitalocean: { pkg: "python3-certbot-dns-digitalocean", plugin: "dns-digitalocean" },
+  google: { pkg: "python3-certbot-dns-google", plugin: "dns-google" }
+};
+function dnsCredentialsPath(provider) {
+  return `/etc/letsencrypt/ts-cloud-${provider}.ini`;
+}
+function buildCertbotInstallScript(dns) {
+  const plugin = dns ? DNS_PLUGINS[dns.provider] : undefined;
+  const pkgs = ["certbot", "python3-certbot-nginx", ...plugin ? [plugin.pkg] : []].join(" ");
+  const installLine = plugin ? `apt-get update -y && apt-get install -y ${pkgs}` : `command -v certbot >/dev/null 2>&1 || { apt-get update -y && apt-get install -y ${pkgs}; }`;
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    installLine,
+    "mkdir -p /etc/letsencrypt/renewal-hooks/deploy",
+    "cat > /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh <<'TS_CLOUD_HOOK_EOF'",
+    "#!/bin/sh",
+    "systemctl reload nginx",
+    "TS_CLOUD_HOOK_EOF",
+    "chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh",
+    "systemctl enable certbot.timer 2>/dev/null || true",
+    "systemctl start certbot.timer 2>/dev/null || true"
+  ];
+}
+function buildDnsCredentialsScript(dns) {
+  if (!dns.credentials || Object.keys(dns.credentials).length === 0)
+    return [];
+  const file = dnsCredentialsPath(dns.provider);
+  const lines = Object.entries(dns.credentials).map(([k, v]) => `${k} = ${v}`).join(`
+`);
+  return [
+    `cat > ${file} <<'TS_CLOUD_DNSCREDS_EOF'`,
+    lines,
+    "TS_CLOUD_DNSCREDS_EOF",
+    `chmod 600 ${file}`
+  ];
+}
+function buildCertbotIssueScript(options) {
+  const dns = options.dns;
+  const domains = options.wildcard ? [`*.${options.domain}`, options.domain] : [options.domain, ...options.aliases || []].filter(Boolean);
+  const args = ["certbot", "--non-interactive", "--agree-tos", "--keep-until-expiring"];
+  if (dns) {
+    const plugin = DNS_PLUGINS[dns.provider].plugin;
+    args.push(`--${plugin}`);
+    if (dns.provider !== "route53" && dns.credentials)
+      args.push(`--${plugin}-credentials ${dnsCredentialsPath(dns.provider)}`);
+    if (typeof dns.propagationSeconds === "number" && dns.provider !== "route53")
+      args.push(`--${plugin}-propagation-seconds ${dns.propagationSeconds}`);
+    args.push("certonly");
+  } else {
+    args.push("--nginx", options.redirect === false ? "--no-redirect" : "--redirect");
+  }
+  if (options.email)
+    args.push(`-m ${options.email}`);
+  else
+    args.push("--register-unsafely-without-email");
+  for (const d of domains)
+    args.push(`-d ${d}`);
+  return [args.join(" ")];
+}
+function buildSslScript(site) {
+  if (resolveSslProvider(site) !== "letsencrypt" || !site.domain)
+    return [];
+  const ssl = site.ssl;
+  const dns = ssl?.dns;
+  const wildcard = ssl?.wildcard === true;
+  if (wildcard && !dns)
+    return [];
+  return [
+    ...buildCertbotInstallScript(dns),
+    ...dns ? buildDnsCredentialsScript(dns) : [],
+    ...buildCertbotIssueScript({
+      domain: site.domain,
+      aliases: site.aliases,
+      email: ssl?.email,
+      wildcard,
+      dns
+    })
+  ];
+}
+
+// src/drivers/shared/git-deploy.ts
+var DEFAULT_DEPLOY_BRANCH = "main";
+var DEFAULT_TAG_PATTERN = "v*";
+function buildGitCheckoutScript(options) {
+  const { repository, releaseDir, commit } = options;
+  const branch = repository.branch || DEFAULT_DEPLOY_BRANCH;
+  const url = repository.url;
+  const lines = [
+    `rm -rf ${releaseDir}`,
+    `mkdir -p ${releaseDir}`
+  ];
+  if (repository.strategy === "tag") {
+    if (repository.tag) {
+      lines.push(`git clone -q --depth 1 --branch ${repository.tag} ${url} ${releaseDir}`);
+      lines.push(`printf '%s' ${shellQuote(repository.tag)} > ${releaseDir}/.ts-cloud-tag`);
+    } else {
+      const pattern = repository.tagPattern || DEFAULT_TAG_PATTERN;
+      lines.push(`TS_CLOUD_TAG="$(git ls-remote --tags --refs --sort=-v:refname ${url} ${shellQuote(`refs/tags/${pattern}`)} | head -n1 | sed 's#.*refs/tags/##')"`, `test -n "$TS_CLOUD_TAG" || { echo "no tags matching ${pattern} found in ${url}" >&2; exit 1; }`, `git clone -q --depth 1 --branch "$TS_CLOUD_TAG" ${url} ${releaseDir}`, `printf '%s' "$TS_CLOUD_TAG" > ${releaseDir}/.ts-cloud-tag`);
+    }
+  } else if (commit) {
+    lines.push(`git -C ${releaseDir} init -q`, `git -C ${releaseDir} remote add origin ${url}`, `git -C ${releaseDir} fetch -q --depth 1 origin ${commit}`, `git -C ${releaseDir} checkout -q FETCH_HEAD`);
+  } else {
+    lines.push(`git clone -q --depth 1 --branch ${branch} ${url} ${releaseDir}`);
+  }
+  lines.push(`git -C ${releaseDir} rev-parse HEAD > ${releaseDir}/.ts-cloud-sha`);
+  return lines;
+}
+function shellQuote(value) {
+  const escaped = value.split("'").join("'\\''");
+  return `'${escaped}'`;
+}
+
+// src/drivers/shared/laravel-deploy.ts
+var MACRO_CREATE_RELEASE = "$CREATE_RELEASE";
+var MACRO_ACTIVATE_RELEASE = "$ACTIVATE_RELEASE";
+var MACRO_RESTART_QUEUES = "$RESTART_QUEUES";
+var COMPOSER_INSTALL = "composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev";
+var LARAVEL_ARTISAN_STEPS = [
+  "php artisan migrate --force",
+  "php artisan config:cache",
+  "php artisan route:cache",
+  "php artisan view:cache",
+  "php artisan event:cache",
+  "php artisan storage:link"
+];
+function defaultDeployScriptFor(type) {
+  switch (type) {
+    case "laravel":
+    case "statamic":
+      return [
+        MACRO_CREATE_RELEASE,
+        COMPOSER_INSTALL,
+        ...LARAVEL_ARTISAN_STEPS,
+        MACRO_ACTIVATE_RELEASE,
+        MACRO_RESTART_QUEUES
+      ];
+    case "php":
+    case "wordpress":
+      return [
+        MACRO_CREATE_RELEASE,
+        `${COMPOSER_INSTALL} || true`,
+        MACRO_ACTIVATE_RELEASE
+      ];
+    case "static":
+    case "spa":
+      return [
+        MACRO_CREATE_RELEASE,
+        MACRO_ACTIVATE_RELEASE
+      ];
+  }
+}
+function substituteBins(line, phpBin) {
+  return line.replace(/^php\s+/, `${phpBin} `).replace(/(\s)php\s+artisan\s+/g, `$1${phpBin} artisan `);
+}
+function writeSharedEnv(sharedEnvPath, env) {
+  const body = formatEnvFile(env);
+  return [
+    `cat > ${sharedEnvPath} <<'TS_CLOUD_ENV_EOF'`,
+    body,
+    "TS_CLOUD_ENV_EOF",
+    `chmod 600 ${sharedEnvPath}`
+  ];
+}
+function writeFileHeredoc2(path, body, marker) {
+  return [`cat > ${path} <<'${marker}'`, body.replace(/\n$/, ""), marker, `chmod 600 ${path}`];
+}
+function buildCredentialFiles(releaseDir, creds) {
+  if (!creds)
+    return [];
+  const out = [];
+  if (creds.composerAuth) {
+    const json = typeof creds.composerAuth === "string" ? creds.composerAuth : JSON.stringify(creds.composerAuth, null, 2);
+    out.push(...writeFileHeredoc2(`${releaseDir}/auth.json`, json, "TS_CLOUD_AUTHJSON_EOF"));
+  }
+  if (creds.npmrc)
+    out.push(...writeFileHeredoc2(`${releaseDir}/.npmrc`, creds.npmrc, "TS_CLOUD_NPMRC_EOF"));
+  return out;
+}
+function buildHealthCheckScript(site) {
+  const path = site.healthCheck?.path;
+  if (!path || !site.domain)
+    return [];
+  const p = path.startsWith("/") ? path : `/${path}`;
+  const url = `http://127.0.0.1${p}`;
+  return [
+    `echo "[ts-cloud] health check ${url} (Host: ${site.domain})"`,
+    "TS_CLOUD_HC_OK=0",
+    `for i in $(seq 1 10); do TS_CLOUD_HC=$(curl -s -o /dev/null -w "%{http_code}" -H "Host: ${site.domain}" -m 10 "${url}" 2>/dev/null || echo 000); case "$TS_CLOUD_HC" in 2*|3*) TS_CLOUD_HC_OK=1; break ;; esac; sleep 3; done`,
+    '[ "$TS_CLOUD_HC_OK" = 1 ] && echo "health check passed ($TS_CLOUD_HC)" || { echo "health check FAILED (last=$TS_CLOUD_HC)" >&2; exit 1; }'
+  ];
+}
+function buildLaravelDeployScript(options) {
+  const { siteName, site, releaseId, commit } = options;
+  if (!site.repository?.url)
+    throw new Error(`Site '${siteName}' is a PHP/git site but has no repository.url to clone`);
+  const base = options.appBase ?? `/var/www/${siteName}`;
+  const phpBin = "php";
+  const paths = releasePaths(base, releaseId);
+  const sharedPaths = site.sharedPaths ?? DEFAULT_SHARED_PATHS;
+  const keepReleases = site.keepReleases ?? DEFAULT_KEEP_RELEASES;
+  const template = site.deployScript?.length ? site.deployScript : defaultDeployScriptFor(site.type ?? "laravel");
+  const out = [
+    "set -euo pipefail",
+    'export HOME="${HOME:-/root}"',
+    'export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',
+    "export COMPOSER_ALLOW_SUPERUSER=1",
+    pantryEnvActivation()
+  ];
+  out.push(...buildDeployHistoryHeader(base, {
+    releaseId,
+    commit,
+    branch: site.repository.branch,
+    keepLogs: keepReleases
+  }));
+  out.push(...buildEnsureReleaseLayout(paths, sharedPaths));
+  if (site.env && Object.keys(site.env).length > 0)
+    out.push(...writeSharedEnv(`${paths.shared}/.env`, site.env));
+  for (const raw of template) {
+    const line = raw.trim();
+    if (line === MACRO_CREATE_RELEASE) {
+      out.push(...buildGitCheckoutScript({ repository: site.repository, releaseDir: paths.release, commit }));
+      out.push(...buildLinkSharedPaths(paths, sharedPaths));
+      out.push(`cd ${paths.release}`);
+      out.push(...buildCredentialFiles(paths.release, site.credentials));
+      out.push(`chown -R www-data:www-data ${paths.shared}/storage 2>/dev/null || true`, `[ -d ${paths.release}/bootstrap/cache ] && chown -R www-data:www-data ${paths.release}/bootstrap/cache 2>/dev/null || true`, `chmod -R ug+rwX ${paths.shared}/storage 2>/dev/null || true`);
+    } else if (line === MACRO_ACTIVATE_RELEASE) {
+      out.push(...buildActivateRelease(paths));
+      out.push(...buildPruneReleases(paths, keepReleases));
+      out.push(`(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`);
+    } else if (line === MACRO_RESTART_QUEUES) {
+      out.push(`${phpBin} artisan queue:restart || true`);
+    } else {
+      out.push(substituteBins(raw, phpBin));
+    }
+  }
+  return out;
+}
+
+// src/drivers/shared/app-frameworks.ts
+var PHP_SITE_TYPES2 = new Set(["laravel", "php", "statamic", "wordpress"]);
+function resolveSiteFramework(site) {
+  if (site.framework)
+    return site.framework;
+  if (site.type && PHP_SITE_TYPES2.has(site.type))
+    return "laravel";
+  return "stacks";
+}
+var PANTRY_ENV_EVAL = `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
+var BUN_BIN = "/usr/local/bin/bun";
+var STACKS_CLI = "storage/framework/core/buddy/src/cli.ts";
+var stacksDriver = {
+  id: "stacks",
+  wrapExec: (command) => command,
+  execEnv: { PATH: "/usr/local/bin:/usr/bin:/bin", BUN_INSTALL: "/root/.bun" },
+  schedulerMode: "daemon",
+  schedulerCommand: () => `${BUN_BIN} ${STACKS_CLI} schedule:run`,
+  queueWorkerCommand: (worker, { current }) => {
+    const flags = [
+      `--queue=${worker.queue || "default"}`,
+      `--sleep=${worker.sleep ?? 3}`,
+      `--tries=${worker.tries ?? 3}`,
+      `--timeout=${worker.timeout ?? 60}`
+    ];
+    return `${BUN_BIN} ${current}/${STACKS_CLI} queue:work ${flags.join(" ")}`;
+  }
+};
+var laravelDriver = {
+  id: "laravel",
+  wrapExec: (command) => `/bin/sh -lc '${PANTRY_ENV_EVAL}; exec ${command}'`,
+  schedulerMode: "cron",
+  schedulerCommand: ({ current }) => `cd ${current} && ${PANTRY_ENV_EVAL} && php artisan schedule:run`,
+  queueWorkerCommand: (worker, { current }) => {
+    const artisan = `${current}/artisan`;
+    if (worker.horizon)
+      return `php ${artisan} horizon`;
+    const flags = [
+      worker.connection || "default",
+      `--queue=${worker.queue || "default"}`,
+      `--sleep=${worker.sleep ?? 3}`,
+      `--tries=${worker.tries ?? 3}`,
+      `--timeout=${worker.timeout ?? 60}`,
+      `--memory=${worker.memory ?? 128}`
+    ];
+    if (worker.maxJobs)
+      flags.push(`--max-jobs=${worker.maxJobs}`);
+    if (worker.maxTime)
+      flags.push(`--max-time=${worker.maxTime}`);
+    return `php ${artisan} queue:work ${flags.join(" ")}`;
+  }
+};
+var DRIVERS = {
+  stacks: stacksDriver,
+  laravel: laravelDriver
+};
+function getAppFrameworkDriver(framework) {
+  return DRIVERS[framework] ?? stacksDriver;
+}
+
+// src/drivers/shared/app-services.ts
+function reEscape(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function cronQuote(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unnamed";
+}
+function queueUnitName(slug, siteName, index) {
+  return `${slug}-${siteName}-queue-${index}`;
+}
+function daemonUnitName(slug, siteName, daemon, index) {
+  return `${slug}-${siteName}-daemon-${daemon.name ? slugify(daemon.name) : slugify(daemon.command).slice(0, 32) || String(index)}`;
+}
+function systemdUnit(opts) {
+  const lines = [
+    "[Unit]",
+    `Description=${opts.description}`,
+    "After=network.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `WorkingDirectory=${opts.workingDir}`,
+    ...Object.entries(opts.environment ?? {}).map(([k, v]) => `Environment="${k}=${v}"`),
+    `ExecStart=${opts.execStart}`,
+    `Restart=${opts.restart || "always"}`,
+    "RestartSec=5"
+  ];
+  if (opts.user)
+    lines.push(`User=${opts.user}`);
+  if (typeof opts.stopWaitSecs === "number")
+    lines.push(`TimeoutStopSec=${opts.stopWaitSecs}`);
+  lines.push("", "[Install]", "WantedBy=multi-user.target");
+  return `${lines.join(`
+`)}
+`;
+}
+function writeUnitScript(name, body) {
+  return [
+    `cat > /etc/systemd/system/${name}.service <<'TS_CLOUD_UNIT_EOF'`,
+    body.replace(/\n$/, ""),
+    "TS_CLOUD_UNIT_EOF"
+  ];
+}
+function schedulerCronPath(slug, siteName) {
+  return `/etc/cron.d/${slug}-${siteName}-scheduler`;
+}
+function buildSiteServicesScript(options) {
+  const { slug, siteName, site } = options;
+  const base = options.appBase ?? `/var/www/${siteName}`;
+  const current = `${base}/current`;
+  const driver = getAppFrameworkDriver(resolveSiteFramework(site));
+  const ctx = { current };
+  const out = [];
+  const desiredUnits = [];
+  const queues = site.queues || [];
+  queues.forEach((worker, qIndex) => {
+    const processes = Math.max(1, worker.processes ?? 1);
+    for (let p = 0;p < processes; p++) {
+      const name = queueUnitName(slug, siteName, desiredUnits.length);
+      desiredUnits.push(name);
+      out.push(...writeUnitScript(name, systemdUnit({
+        description: `${siteName} queue worker ${qIndex}.${p} (managed by ts-cloud)`,
+        workingDir: current,
+        execStart: driver.wrapExec(driver.queueWorkerCommand(worker, ctx)),
+        environment: driver.execEnv,
+        stopWaitSecs: worker.stopWaitSecs ?? 90
+      })));
+    }
+  });
+  const daemons = site.daemons || [];
+  daemons.forEach((daemon, dIndex) => {
+    const processes = Math.max(1, daemon.processes ?? 1);
+    for (let p = 0;p < processes; p++) {
+      const name = `${daemonUnitName(slug, siteName, daemon, dIndex)}-${p}`;
+      desiredUnits.push(name);
+      out.push(...writeUnitScript(name, systemdUnit({
+        description: `${siteName} daemon ${daemon.name || daemon.command} (managed by ts-cloud)`,
+        workingDir: daemon.directory || current,
+        execStart: driver.wrapExec(daemon.command),
+        environment: driver.execEnv,
+        restart: daemon.restart,
+        user: daemon.user
+      })));
+    }
+  });
+  const scheduler = site.scheduler;
+  const schedulerEnabled = scheduler === true || typeof scheduler === "object" && scheduler !== null;
+  const schedulerUnit = `${slug}-${siteName}-scheduler`;
+  if (schedulerEnabled && driver.schedulerMode === "daemon") {
+    desiredUnits.push(schedulerUnit);
+    out.push(...writeUnitScript(schedulerUnit, systemdUnit({
+      description: `${siteName} scheduler (managed by ts-cloud)`,
+      workingDir: current,
+      execStart: driver.wrapExec(driver.schedulerCommand(ctx)),
+      environment: driver.execEnv
+    })));
+  }
+  const desiredList = desiredUnits.map((n) => `${n}.service`).join(" ");
+  out.push("systemctl daemon-reload", `TS_CLOUD_DESIRED="${desiredList}"`, `for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${reEscape(slug)}-${reEscape(siteName)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`, '  case " $TS_CLOUD_DESIRED " in', '    *" $unit "*) ;;', '    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;', "  esac", "done", "systemctl daemon-reload");
+  for (const name of desiredUnits) {
+    out.push(`systemctl enable ${name}.service`, `systemctl restart ${name}.service`);
+  }
+  const cronPath = schedulerCronPath(slug, siteName);
+  if (schedulerEnabled && driver.schedulerMode === "cron") {
+    const heartbeat = typeof scheduler === "object" && scheduler !== null ? scheduler : undefined;
+    let command = `${driver.schedulerCommand(ctx)} >> /dev/null 2>&1`;
+    if (heartbeat?.heartbeatUrl) {
+      const method = heartbeat.heartbeatMethod || "GET";
+      const methodFlag = method === "GET" ? "" : `-X ${method} `;
+      command += ` && curl -fsS -m 10 ${methodFlag}${cronQuote(heartbeat.heartbeatUrl)} >/dev/null 2>&1`;
+    }
+    const cron = `* * * * * root ${command}
+`.replace(/%/g, "\\%");
+    out.push(`cat > ${cronPath} <<'TS_CLOUD_CRON_EOF'`, cron.replace(/\n$/, ""), "TS_CLOUD_CRON_EOF", `chmod 644 ${cronPath}`);
+  } else {
+    out.push(`rm -f ${cronPath}`);
+  }
+  return out;
+}
+function siteHasServices(site) {
+  return !!(site.queues?.length || site.daemons?.length || site.scheduler);
+}
+
+// src/drivers/shared/php-fpm-pool.ts
+var PHP_FPM_POOL_DIR = "/var/lib/pantry/php-fpm/pool.d";
+var POOL_PORT_BASE = 9100;
+var POOL_PORT_SPAN = 400;
+function siteToken(siteName) {
+  const base = siteName.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return (base || "site").slice(0, 28);
+}
+function siteUser(siteName) {
+  return `web_${siteToken(siteName)}`;
+}
+function phpFpmPoolPort(siteName) {
+  const token = siteToken(siteName);
+  let h = 0;
+  for (let i = 0;i < token.length; i++)
+    h = h * 31 + token.charCodeAt(i) >>> 0;
+  return POOL_PORT_BASE + h % POOL_PORT_SPAN;
+}
+function phpFpmPoolListen(siteName) {
+  return `127.0.0.1:${phpFpmPoolPort(siteName)}`;
+}
+function buildPhpFpmPoolConf(options) {
+  const pool = siteToken(options.siteName);
+  const user = siteUser(options.siteName);
+  const maxChildren = options.maxChildren ?? 10;
+  return [
+    `; ts-cloud-managed pool for ${options.siteName} (site isolation)`,
+    `[${pool}]`,
+    `user = ${user}`,
+    `group = ${user}`,
+    `listen = ${phpFpmPoolListen(options.siteName)}`,
+    "pm = dynamic",
+    `pm.max_children = ${maxChildren}`,
+    "pm.start_servers = 2",
+    "pm.min_spare_servers = 1",
+    "pm.max_spare_servers = 3",
+    "pm.max_requests = 500",
+    "catch_workers_output = yes",
+    `php_admin_value[open_basedir] = ${options.appBase}:/tmp`,
+    ""
+  ].join(`
+`);
+}
+function buildPhpFpmPoolScript(options) {
+  const user = siteUser(options.siteName);
+  const pool = siteToken(options.siteName);
+  const conf = `${PHP_FPM_POOL_DIR}/${pool}.conf`;
+  return [
+    `getent group ${user} >/dev/null || groupadd --system ${user}`,
+    `id -u ${user} >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin -g ${user} ${user}`,
+    `usermod -aG ${user} www-data 2>/dev/null || true`,
+    `chown -R ${user}:${user} ${options.appBase} || true`,
+    `chmod -R g+rX ${options.appBase} || true`,
+    `chmod 600 ${options.appBase}/shared/.env 2>/dev/null || true`,
+    `mkdir -p ${PHP_FPM_POOL_DIR}`,
+    `cat > ${conf} <<'TS_CLOUD_FPMPOOL_EOF'`,
+    buildPhpFpmPoolConf(options).replace(/\n$/, ""),
+    "TS_CLOUD_FPMPOOL_EOF",
+    `(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`
+  ];
+}
+
+// src/drivers/shared/compute-deploy.ts
+var noopLogger2 = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  step: () => {},
+  success: () => {}
+};
+async function deploySiteRelease(driver, options, logger = noopLogger2) {
+  const {
+    config,
+    environment,
+    siteName,
+    site,
+    slug,
+    sha,
+    runtime,
+    localTarballPath
+  } = options;
+  const remoteKey = `releases/${siteName}/${sha}.tar.gz`;
+  const stackName = resolveProjectStackName(config, environment);
+  const outputs = await driver.getComputeOutputs({ config, environment });
+  const targets = await driver.findComputeTargets({
+    slug,
+    environment,
+    role: "app",
+    stackName
+  });
+  if (targets.length === 0) {
+    const hint = driver.name === "aws" ? `Stack '${stackName}' has no EC2 instances tagged Project=${slug} Environment=${environment} Role=app, and .ts-cloud/state/${stackName}.json pins no live instance. For a shared box, record its instanceId there.` : `No Hetzner servers labeled ts-cloud/project=${slug} ts-cloud/environment=${environment} ts-cloud/role=app, and .ts-cloud/state/${stackName}.json pins no live server. For a shared box, record its serverId there.`;
+    return { success: false, error: hint };
+  }
+  if (isPhpSite(site)) {
+    const compute2 = config.infrastructure?.compute;
+    const phpVersion = site.phpVersion ?? compute2?.php?.default ?? compute2?.php?.versions?.[0];
+    const appBase = `/var/www/${siteName}`;
+    const dbEnv = outputs.servicesPrivateIp ? buildFleetServicesEnv(outputs.servicesPrivateIp, config.infrastructure?.appDatabase) : buildManagedDbEnv(config.infrastructure?.appDatabase);
+    const siteWithEnv = Object.keys(dbEnv).length > 0 ? { ...site, env: { ...dbEnv, ...site.env || {} } } : site;
+    const deployScript = buildLaravelDeployScript({
+      siteName,
+      site: siteWithEnv,
+      releaseId: sha,
+      appBase,
+      defaultPhpVersion: phpVersion
+    });
+    const useNginx = compute2?.webServer !== "rpx";
+    const sslProvider = resolveSslProvider(site);
+    const customCert = sslProvider === "custom" && site.ssl?.certPath && site.ssl?.keyPath ? { certPath: site.ssl.certPath, keyPath: site.ssl.keyPath } : undefined;
+    const poolScript = site.isolation ? buildPhpFpmPoolScript({ siteName, appBase }) : [];
+    const vhostScript = useNginx ? buildNginxVhostScript({
+      siteName,
+      domain: site.domain || siteName,
+      aliases: site.aliases,
+      type: site.type,
+      appDir: `${appBase}/current`,
+      webDirectory: site.webDirectory,
+      phpVersion,
+      fastcgiPass: site.isolation ? phpFpmPoolListen(siteName) : undefined,
+      redirects: site.redirects,
+      ssl: customCert,
+      auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
+      serverSnippet: resolveNginxSnippet(site.nginx, compute2?.nginxTemplates),
+      clientMaxBodySize: site.nginx?.clientMaxBodySize,
+      hsts: site.ssl?.hsts,
+      tlsProtocols: site.ssl?.tlsProtocols,
+      security: site.security
+    }) : [];
+    const sslScript = useNginx ? buildSslScript(site) : [];
+    const servicesScript2 = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, phpVersion, appBase }) : [];
+    const healthCheckScript = useNginx ? buildHealthCheckScript(site) : [];
+    logger.step(`Deploying PHP site '${siteName}' to ${targets.length} target(s)...`);
+    const phpResult = await driver.runRemoteDeploy({
+      targets,
+      commands: [...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
+      comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
+      tags: { Project: slug, Environment: environment, Role: "app" }
+    });
+    const notifications = resolveNotifications(config.notifications, site.notifications);
+    if (!phpResult.success) {
+      await sendNotifications(notifications, "deploy-failed", `❌ Deploy of ${slug}/${siteName}@${sha} failed: ${phpResult.error || "unknown error"}`);
+      return {
+        success: false,
+        error: phpResult.error || "Remote PHP deploy failed",
+        instanceCount: phpResult.instanceCount,
+        perInstance: phpResult.perInstance
+      };
+    }
+    const deployedUrl = site.domain ? ` → https://${site.domain}` : "";
+    await sendNotifications(notifications, "deploy", `✅ Deployed ${slug}/${siteName}@${sha}${deployedUrl}`);
+    return {
+      success: true,
+      instanceCount: phpResult.instanceCount,
+      perInstance: phpResult.perInstance
+    };
+  }
+  if (!localTarballPath)
+    return { success: false, error: `Site '${siteName}' requires a release tarball but none was provided` };
+  const uploadResult = await driver.uploadRelease({
+    config,
+    environment,
+    localPath: localTarballPath,
+    remoteKey,
+    targets
+  });
+  const artifactFetch = driver.name === "aws" ? buildAwsArtifactFetch(outputs.deployBucketName, remoteKey, config.project.region || "us-east-1", siteName) : buildLocalArtifactFetch(uploadResult.artifactRef, siteName);
+  const kind = resolveSiteKind(site);
+  const baseScript = kind === "server-static" ? buildStaticSiteDeployScript({
+    siteName,
+    artifactFetch,
+    releaseId: sha,
+    preStartCommands: site.preStart
+  }) : buildSiteDeployScript({
+    siteName,
+    slug,
+    artifactFetch,
+    releaseId: sha,
+    execStart: resolveExecStart(site.start, runtime),
+    envEntries: site.env || {},
+    port: site.port,
+    preStartCommands: site.preStart
+  });
+  const compute = config.infrastructure?.compute;
+  const wantsNginxStatic = kind === "server-static" && compute?.webServer !== "rpx" && !!site.domain;
+  const staticVhost = wantsNginxStatic ? buildNginxVhostScript({
+    siteName,
+    domain: site.domain,
+    aliases: site.aliases,
+    type: site.type === "spa" ? "spa" : "static",
+    appDir: `/var/www/${siteName}/current`,
+    webDirectory: "",
+    redirects: site.redirects,
+    auth: site.auth && site.auth.enabled !== false && site.auth.password ? { username: site.auth.username || "admin", password: site.auth.password, realm: site.auth.realm } : undefined,
+    serverSnippet: resolveNginxSnippet(site.nginx, compute?.nginxTemplates),
+    clientMaxBodySize: site.nginx?.clientMaxBodySize,
+    hsts: site.ssl?.hsts,
+    tlsProtocols: site.ssl?.tlsProtocols,
+    security: site.security
+  }) : [];
+  const staticSsl = wantsNginxStatic ? buildSslScript(site) : [];
+  const servicesScript = siteHasServices(site) ? buildSiteServicesScript({ slug, siteName, site, appBase: `/var/www/${siteName}` }) : [];
+  const remoteScript = [
+    ...buildDeployHistoryHeader(`/var/www/${siteName}`, {
+      releaseId: sha,
+      commit: sha,
+      branch: site.branch ?? "main"
+    }),
+    ...baseScript,
+    ...staticVhost,
+    ...staticSsl,
+    ...servicesScript
+  ];
+  logger.step(`Deploying to ${targets.length} target(s)...`);
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands: remoteScript,
+    comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
+    tags: {
+      Project: slug,
+      Environment: environment,
+      Role: "app"
+    }
+  });
+  if (!result.success) {
+    return {
+      success: false,
+      error: result.error || "Remote deploy failed",
+      instanceCount: result.instanceCount,
+      perInstance: result.perInstance
+    };
+  }
+  return {
+    success: true,
+    instanceCount: result.instanceCount,
+    perInstance: result.perInstance
+  };
+}
+async function deployAllComputeSites(options) {
+  const { config, environment, driver, sha, runtime, tarballForSite, logger = noopLogger2 } = options;
+  const slug = config.project.slug;
+  const cwd = options.cwd ?? process.cwd();
+  const hadDashboard = hasManagementDashboardSite(config);
+  ensureManagementDashboard(config, { cwd, logger: { info: logger.info, warn: logger.warn } });
+  const injectedDashboard = !hadDashboard && hasManagementDashboardSite(config);
+  if (options.rpxConfig && options.rpxConfig !== config && !hasManagementDashboardSite(options.rpxConfig))
+    ensureManagementDashboard(options.rpxConfig, { cwd, logger: { info: () => {}, warn: () => {} } });
+  let dashboardTarball = null;
+  if (injectedDashboard) {
+    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[MANAGEMENT_DASHBOARD_SITE], { cwd, slug, sha, logger: { info: logger.info, warn: logger.warn } });
+    if (!dashboardTarball) {
+      logger.warn("Management dashboard: no artifact available — skipping dashboard site for this deploy.");
+      if (config.sites)
+        delete config.sites[MANAGEMENT_DASHBOARD_SITE];
+    }
+  }
+  const sites = config.sites || {};
+  const deployable = Object.entries(sites).filter(([name, site]) => {
+    if (!site)
+      return false;
+    const kind = resolveSiteKind(site);
+    if (kind === "bucket") {
+      logger.warn(`Site '${name}' targets a bucket — skipping (handled by the static-site path, not compute).`);
+      return false;
+    }
+    if (kind === "redirect")
+      return false;
+    return true;
+  });
+  if (deployable.length === 0)
+    return true;
+  const tarballFor = (siteName) => siteName === MANAGEMENT_DASHBOARD_SITE && dashboardTarball ? dashboardTarball : tarballForSite(siteName);
+  for (const [siteName, site] of deployable) {
+    logger.step(`Deploying site: ${siteName}`);
+    const localTarballPath = isPhpSite(site) ? undefined : tarballFor(siteName);
+    const result = await deploySiteRelease(driver, {
+      config,
+      environment,
+      siteName,
+      site,
+      slug,
+      sha,
+      runtime,
+      localTarballPath
+    }, logger);
+    if (!result.success) {
+      logger.error(`Deploy of '${siteName}' failed: ${result.error || "unknown error"}`);
+      if (result.perInstance) {
+        for (const inst of result.perInstance) {
+          logger.error(`  ${inst.instanceId}: ${inst.status}${inst.error ? ` — ${inst.error}` : ""}`);
+        }
+      }
+      return false;
+    }
+    logger.success(`Deployed ${slug}/${siteName}@${sha} to ${result.instanceCount} target(s)`);
+    if (result.perInstance) {
+      for (const inst of result.perInstance) {
+        logger.info(`  ✓ ${inst.instanceId}: ${inst.status}`);
+      }
+    }
+  }
+  const reloaded = await reloadRpxGateway(options);
+  if (!reloaded)
+    return false;
+  return true;
+}
+async function reloadRpxGateway(options) {
+  const { config, environment, driver, logger = noopLogger2 } = options;
+  const routeSource = options.rpxConfig ?? config;
+  const proxy = routeSource.infrastructure?.compute?.proxy ?? config.infrastructure?.compute?.proxy;
+  if (proxy?.engine !== "rpx")
+    return true;
+  const sites = routeSource.sites || {};
+  const rpxConfig = buildRpxConfig(sites, { proxy });
+  if (rpxConfig.proxies.length === 0) {
+    logger.warn("rpx gateway: no server sites with a domain to route — skipping gateway reload.");
+    return true;
+  }
+  const targets = await driver.findComputeTargets({
+    slug: config.project.slug,
+    environment,
+    role: "app",
+    stackName: resolveProjectStackName(config, environment)
+  });
+  if (targets.length === 0) {
+    logger.warn("rpx gateway: no compute targets found — skipping gateway reload.");
+    return true;
+  }
+  logger.step(`Reloading rpx gateway with ${rpxConfig.proxies.length} route(s)...`);
+  const script = buildRpxProvisionScript({ proxy, config: rpxConfig, slug: config.project.slug });
+  const result = await driver.runRemoteDeploy({
+    targets,
+    commands: script,
+    comment: `ts-cloud rpx gateway reload ${config.project.slug}`,
+    tags: {
+      Project: config.project.slug,
+      Environment: environment,
+      Role: "app"
+    }
+  });
+  if (!result.success) {
+    logger.error(`rpx gateway reload failed: ${result.error || "unknown error"}`);
+    return false;
+  }
+  logger.success(`rpx gateway reloaded on ${result.instanceCount} target(s)`);
+  return true;
+}
+// src/drivers/shared/cloudfront-origin.ts
+var MANAGED_CACHE_POLICY_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
+var MANAGED_CACHE_POLICY_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
+var MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER = "216adef6-5c7f-47e4-b989-5492eafa07d3";
+var ORIGIN_ID = "origin";
+function cacheBehavior(pathPattern, kind) {
+  const base = {
+    TargetOriginId: ORIGIN_ID,
+    ViewerProtocolPolicy: "redirect-to-https",
+    Compress: true,
+    CachePolicyId: kind === "dynamic" ? MANAGED_CACHE_POLICY_DISABLED : MANAGED_CACHE_POLICY_OPTIMIZED,
+    OriginRequestPolicyId: MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER,
+    SmoothStreaming: false,
+    FieldLevelEncryptionId: "",
+    TrustedSigners: { Enabled: false, Quantity: 0 },
+    TrustedKeyGroups: { Enabled: false, Quantity: 0 },
+    LambdaFunctionAssociations: { Quantity: 0 },
+    FunctionAssociations: { Quantity: 0 },
+    AllowedMethods: kind === "dynamic" ? { Quantity: 7, Items: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"], CachedMethods: { Quantity: 2, Items: ["GET", "HEAD"] } } : { Quantity: 3, Items: ["GET", "HEAD", "OPTIONS"], CachedMethods: { Quantity: 2, Items: ["GET", "HEAD"] } }
+  };
+  if (pathPattern !== null)
+    base.PathPattern = pathPattern;
+  return base;
+}
+function buildCloudFrontOriginConfig(options) {
+  const aliases = options.aliases;
+  if (aliases.length === 0)
+    throw new Error("buildCloudFrontOriginConfig: at least one alias is required");
+  if (aliases.includes(options.originDomain))
+    throw new Error(`buildCloudFrontOriginConfig: originDomain ${options.originDomain} must not be one of the aliases (it would loop)`);
+  const header = options.originSecretHeader ?? "X-Origin-Verify";
+  const customHeaders = options.originSecret ? { Quantity: 1, Items: [{ HeaderName: header, HeaderValue: options.originSecret }] } : { Quantity: 0 };
+  const behaviors = [...options.behaviors ?? []].sort((a, b) => b.pathPattern.length - a.pathPattern.length);
+  return {
+    CallerReference: options.callerReference ?? options.originDomain,
+    Comment: options.comment ?? `Origin-fronted distribution for ${aliases[0]} → ${options.originDomain}`,
+    Enabled: true,
+    Aliases: { Quantity: aliases.length, Items: aliases },
+    DefaultRootObject: "",
+    Origins: {
+      Quantity: 1,
+      Items: [{
+        Id: ORIGIN_ID,
+        DomainName: options.originDomain,
+        OriginPath: "",
+        CustomHeaders: customHeaders,
+        CustomOriginConfig: {
+          HTTPPort: 80,
+          HTTPSPort: 443,
+          OriginProtocolPolicy: "https-only",
+          OriginSslProtocols: { Quantity: 1, Items: ["TLSv1.2"] },
+          OriginReadTimeout: 30,
+          OriginKeepaliveTimeout: 5
+        },
+        ConnectionAttempts: 3,
+        ConnectionTimeout: 10,
+        OriginShield: { Enabled: false },
+        OriginAccessControlId: ""
+      }]
+    },
+    OriginGroups: { Quantity: 0 },
+    DefaultCacheBehavior: cacheBehavior(null, "static"),
+    CacheBehaviors: { Quantity: behaviors.length, Items: behaviors.map((b) => cacheBehavior(b.pathPattern, b.kind)) },
+    ViewerCertificate: {
+      CloudFrontDefaultCertificate: false,
+      ACMCertificateArn: options.viewerCertificateArn,
+      Certificate: options.viewerCertificateArn,
+      CertificateSource: "acm",
+      SSLSupportMethod: "sni-only",
+      MinimumProtocolVersion: "TLSv1.2_2021"
+    },
+    PriceClass: options.priceClass ?? "PriceClass_All",
+    HttpVersion: "http2and3",
+    IsIPV6Enabled: true,
+    Restrictions: { GeoRestriction: { RestrictionType: "none", Quantity: 0 } },
+    Logging: { Enabled: false, IncludeCookies: false, Bucket: "", Prefix: "" },
+    WebACLId: "",
+    CustomErrorResponses: { Quantity: 0 }
+  };
+}
+export { isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, HetznerClient, resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, buildAwsArtifactFetch, buildLocalArtifactFetch, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };