@stacksjs/ts-cloud 0.7.55 → 0.7.57

package/dist/{chunk-d5vqwj8s.js → chunk-9m6b4m74.js}

@@ -6,17 +6,17 @@ import {
   resolveCloudProvider,
   resolveManagementDashboardSites,
   resolveProjectStackName
-} from "./chunk-r16e02bc.js";
+} from "./chunk-vdk53yyq.js";
 import {
   EC2Client,
   SSMClient
-} from "./chunk-93hjhs78.js";
+} from "./chunk-703nkybg.js";
 import {
   CloudFormationClient
-} from "./chunk-qpj3edwz.js";
+} from "./chunk-4cjrg98a.js";
 import {
   S3Client
-} from "./chunk-vd87cpvn.js";
+} from "./chunk-wj3s95p9.js";
 import {
   __require
 } from "./chunk-v0bahtg2.js";
@@ -124,10 +124,7 @@ function buildServicesProvisionScript(services = {}, _options = {}) {
   const plan = planServices(services);
   if (plan.packages.length === 0)
     return [];
-  return [
-    ...buildPantryInstallScript(plan.packages),
-    ...buildPantryServiceScript(plan.services)
-  ];
+  return [...buildPantryInstallScript(plan.packages), ...buildPantryServiceScript(plan.services)];
 }
 function buildDatabaseSetupScript(database, services = {}) {
   if (!database?.name)
@@ -226,6 +223,233 @@ function buildManagedDbEnv(database) {
   return env;
 }
 
+// src/drivers/shared/backups.ts
+var BACKUP_OUTPUT_DIR = "/var/backups/ts-cloud";
+var BACKUP_CONFIG_PATH = "/etc/ts-cloud/backups.config.ts";
+var BACKUP_CRON_PATH = "/etc/cron.d/ts-cloud-backups";
+var BACKUP_RUNNER_PATH = "/usr/local/bin/ts-cloud-backup.sh";
+function backupEntryFor(database) {
+  if (!database.name)
+    return null;
+  const host = database.host || "127.0.0.1";
+  const isPostgres = database.engine === "postgres";
+  const type = isPostgres ? "postgresql" : "mysql";
+  const port = database.port ?? (isPostgres ? 5432 : 3306);
+  const ts = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+  return [
+    "  {",
+    `    type: '${type}',`,
+    `    name: '${ts(database.name)}',`,
+    "    connection: {",
+    `      hostname: '${ts(host)}',`,
+    `      port: ${port},`,
+    `      database: '${ts(database.name)}',`,
+    `      username: '${ts(database.username || database.name)}',`,
+    `      password: '${ts(database.password || "")}',`,
+    "      ssl: false,",
+    "    },",
+    "    includeSchema: true,",
+    "    includeData: true,",
+    "  },"
+  ].join(`
+`);
+}
+function buildBackupsConfigTs(database, backups) {
+  const entry = database ? backupEntryFor(database) : null;
+  const destinations = backups.bucket ? [
+    "  destinations: [",
+    "    {",
+    "      type: 's3',",
+    `      bucket: '${backups.bucket}',`,
+    "      prefix: 'db-backups',",
+    ...backups.endpoint ? [`      endpoint: '${backups.endpoint}',`] : [],
+    "      optional: false,",
+    "    },",
+    "  ],"
+  ] : [];
+  return [
+    "import type { BackupConfig } from 'ts-backups'",
+    "",
+    "const config: BackupConfig = {",
+    "  verbose: true,",
+    `  outputPath: '${BACKUP_OUTPUT_DIR}',`,
+    "  retention: {",
+    `    count: ${backups.retentionCount ?? 5},`,
+    `    maxAge: ${backups.retentionDays ?? 30},`,
+    "  },",
+    "  databases: [",
+    ...entry ? [entry] : [],
+    "  ],",
+    ...destinations,
+    "}",
+    "",
+    "export default config",
+    ""
+  ].join(`
+`);
+}
+function buildBackupProvisionScript(options) {
+  const { database, backups } = options;
+  if (!backups.enabled)
+    return [];
+  const schedule = backups.schedule || "0 2 * * *";
+  const configTs = buildBackupsConfigTs(database, backups);
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    `mkdir -p /etc/ts-cloud ${BACKUP_OUTPUT_DIR}`,
+    "command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)",
+    "bun add -g ts-backups || true",
+    `cat > ${BACKUP_CONFIG_PATH} <<'TS_CLOUD_BACKUP_CFG_EOF'`,
+    configTs.replace(/\n$/, ""),
+    "TS_CLOUD_BACKUP_CFG_EOF",
+    `cat > ${BACKUP_RUNNER_PATH} <<'TS_CLOUD_BACKUP_RUN_EOF'`,
+    "#!/bin/bash",
+    "set -uo pipefail",
+    'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"',
+    'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',
+    "cd /etc/ts-cloud",
+    'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',
+    "TS_CLOUD_BACKUP_RUN_EOF",
+    `chmod +x ${BACKUP_RUNNER_PATH}`,
+    `cat > ${BACKUP_CRON_PATH} <<'TS_CLOUD_BACKUP_CRON_EOF'`,
+    `${schedule} root ${BACKUP_RUNNER_PATH} >> /var/log/ts-cloud-backup.log 2>&1`,
+    "TS_CLOUD_BACKUP_CRON_EOF",
+    `chmod 644 ${BACKUP_CRON_PATH}`
+  ];
+}
+function engineSocket(engine) {
+  return engine === "mariadb" ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
+}
+function buildBackupRestoreScript(database, options = {}) {
+  if (!database?.name)
+    return [];
+  const name = database.name;
+  const isPg = database.engine === "postgres";
+  const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
+  const client = isPg ? `${pgAdminCommand(database)} -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
+  return [
+    "set -uo pipefail",
+    'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
+    locate,
+    '[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }',
+    'echo "[ts-cloud] restoring ' + name + ' from $TS_CLOUD_DUMP"',
+    `case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${client}`,
+    'echo "restore complete"'
+  ];
+}
+
+// src/drivers/shared/maintenance.ts
+function buildAutoUpdatesScript(enabled2 = true) {
+  if (!enabled2)
+    return [];
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "apt-get install -y unattended-upgrades",
+    "cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",
+    'APT::Periodic::Update-Package-Lists "1";',
+    'APT::Periodic::Unattended-Upgrade "1";',
+    'APT::Periodic::Download-Upgradeable-Packages "1";',
+    'APT::Periodic::AutocleanInterval "7";',
+    "TS_CLOUD_AUTOUPD_EOF",
+    "systemctl enable unattended-upgrades 2>/dev/null || true",
+    "systemctl restart unattended-upgrades 2>/dev/null || true"
+  ];
+}
+
+// src/drivers/shared/monitoring.ts
+var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
+var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
+var DEFAULT_CPU_LOAD_PER_CORE = 2;
+var DEFAULT_MEM_PERCENT = 90;
+var DEFAULT_DISK_PERCENT = 90;
+var SERVICE_PROBES = [
+  ["nginx", 80],
+  ["phpFpm", 9074],
+  ["mysql", 3306],
+  ["postgres", 5432],
+  ["redis", 6379],
+  ["meilisearch", 7700]
+];
+function resolveMonitoring(monitoring = true) {
+  const obj = typeof monitoring === "object" ? monitoring : {};
+  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
+  return {
+    enabled: enabled2,
+    cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
+    memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
+    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
+  };
+}
+function buildMonitoringScript(monitoring = true) {
+  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
+  if (!enabled2)
+    return [];
+  const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
+  const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
+  return [
+    "mkdir -p /var/lib/ts-cloud",
+    "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
+    "#!/bin/bash",
+    "set -uo pipefail",
+    "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
+    "CPUS=$(nproc)",
+    "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
+    "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
+    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
+    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
+    `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
+    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
+    `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
+    `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
+    "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
+    ...probeLines,
+    "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
+    "SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}",
+    "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
+    "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
+    `cat > ${METRICS_PATH}.tmp <<JSON`,
+    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
+    "JSON",
+    `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
+    'ALERTS=""',
+    `if awk -v l="$LOAD" -v c="$CPUS" -v t=${cpuLoadPerCore} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${cpuLoadPerCore}xCPU"; fi`,
+    `if [ "\${MEM_PCT:-0}" -ge ${memPercent} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,
+    `if [ "\${DISK_PCT:-0}" -ge ${diskPercent} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,
+    `PREV=$(cat ${ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
+    'if [ -n "$ALERTS" ]; then',
+    '  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',
+    `  echo alert > ${ALERT_STATE_PATH}`,
+    "else",
+    '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
+    `  echo ok > ${ALERT_STATE_PATH}`,
+    "fi",
+    "TS_CLOUD_METRICS_EOF",
+    "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
+    "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
+    "[Unit]",
+    "Description=ts-cloud metrics collector",
+    "",
+    "[Service]",
+    "Type=oneshot",
+    "ExecStart=/usr/local/bin/ts-cloud-metrics.sh",
+    "TS_CLOUD_METRICS_SVC_EOF",
+    "cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'",
+    "[Unit]",
+    "Description=Run ts-cloud metrics collector every minute",
+    "",
+    "[Timer]",
+    "OnBootSec=60",
+    "OnUnitActiveSec=60",
+    "",
+    "[Install]",
+    "WantedBy=timers.target",
+    "TS_CLOUD_METRICS_TMR_EOF",
+    "systemctl daemon-reload",
+    "systemctl enable ts-cloud-metrics.timer",
+    "systemctl start ts-cloud-metrics.timer"
+  ];
+}
+
 // src/drivers/shared/php-provision.ts
 var PRODUCTION_PHP_INI = {
   "opcache.enable": "1",
@@ -435,14 +659,7 @@ function buildNginxVhost(options) {
 `)}
 `;
   }
-  const lines = [
-    "server {",
-    "    listen 80;",
-    "    listen [::]:80;",
-    `    server_name ${serverNames};`,
-    ...body,
-    "}"
-  ];
+  const lines = ["server {", "    listen 80;", "    listen [::]:80;", `    server_name ${serverNames};`, ...body, "}"];
   return `${lines.join(`
 `)}
 `;
@@ -565,6 +782,93 @@ function buildNginxServiceScript(projectDir = "/opt/pantry") {
   ];
 }
 
+// src/drivers/shared/notifications.ts
+function wantsEvent(config, event) {
+  return !config.events || config.events.includes(event);
+}
+async function sendNotifications(config, event, message, options = {}) {
+  if (!config)
+    return [];
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const attempted = [];
+  const tasks = [];
+  const post = (url, body) => fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }).catch(() => {
+    return;
+  });
+  if (config.slack?.webhookUrl && wantsEvent(config, event)) {
+    attempted.push("slack");
+    tasks.push(post(config.slack.webhookUrl, { text: message }));
+  }
+  if (config.discord?.webhookUrl && wantsEvent(config, event)) {
+    attempted.push("discord");
+    tasks.push(post(config.discord.webhookUrl, { content: message }));
+  }
+  if (config.telegram?.botToken && config.telegram.chatId && wantsEvent(config, event)) {
+    attempted.push("telegram");
+    const url = `https://api.telegram.org/bot${config.telegram.botToken}/sendMessage`;
+    tasks.push(post(url, { chat_id: config.telegram.chatId, text: message }));
+  }
+  if (config.webhook?.url && wantsEvent(config, event)) {
+    attempted.push("webhook");
+    if ((config.webhook.method || "POST") === "GET") {
+      const sep = config.webhook.url.includes("?") ? "&" : "?";
+      const url = `${config.webhook.url}${sep}event=${encodeURIComponent(event)}&message=${encodeURIComponent(message)}`;
+      tasks.push(fetchImpl(url, { method: "GET" }).catch(() => {
+        return;
+      }));
+    } else {
+      tasks.push(post(config.webhook.url, { event, message }));
+    }
+  }
+  if (config.email?.to && wantsEvent(config, event)) {
+    attempted.push("email");
+    tasks.push(sendEmailNotification(config.email, event, message));
+  }
+  await Promise.all(tasks);
+  return attempted;
+}
+async function sendEmailNotification(email, event, message) {
+  try {
+    const mod = await import("./chunk-k114qwg9.js");
+    await mod.email.send({
+      to: email.to,
+      from: email.from,
+      subject: `[ts-cloud] ${event}`,
+      text: message
+    });
+  } catch {}
+}
+function resolveNotifications(project, site) {
+  return site ?? project;
+}
+function buildNotifierScript(config) {
+  if (!config)
+    return [];
+  const curls = [];
+  if (config.slack?.webhookUrl)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${config.slack.webhookUrl} || true`);
+  if (config.discord?.webhookUrl)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${config.discord.webhookUrl} || true`);
+  if (config.telegram?.botToken && config.telegram.chatId)
+    curls.push(`curl -fsS -X POST "https://api.telegram.org/bot${config.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${config.telegram.chatId}" --data-urlencode "text=$MSG" || true`);
+  if (config.webhook?.url)
+    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${config.webhook.url} || true`);
+  if (curls.length === 0)
+    return [];
+  return [
+    "cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'",
+    "#!/bin/bash",
+    'MSG="$1"',
+    ...curls,
+    "TS_CLOUD_NOTIFY_EOF",
+    "chmod +x /usr/local/bin/ts-cloud-notify"
+  ];
+}
+
 // src/deploy/site-target.ts
 function siteInstallBase(slug, siteName) {
   return `/var/www/${slug}-${siteName}`;
@@ -681,6 +985,10 @@ function validateDeploymentConfig(config) {
   }
   return { errors, warnings };
 }
+function shipsARelease(site) {
+  const kind = resolveSiteKind(site);
+  return kind !== "bucket" && kind !== "redirect";
+}
 
 // src/drivers/shared/rpx-gateway.ts
 var DEFAULT_RPX_CERTS_DIR = "/etc/rpx/certs";
@@ -740,7 +1048,13 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
     const id = deriveRouteId(site.domain, path);
     const auth = resolveRouteAuth(site);
     if (kind === "redirect") {
-      proxies.push({ to: site.domain, path, redirect: normalizeSiteRedirect(site.redirect), id, ...auth ? { auth } : {} });
+      proxies.push({
+        to: site.domain,
+        path,
+        redirect: normalizeSiteRedirect(site.redirect),
+        id,
+        ...auth ? { auth } : {}
+      });
       domains.add(site.domain);
       continue;
     }
@@ -800,7 +1114,8 @@ function buildRpxConfigInternal(sites, options, appBoxes) {
       enabled: true,
       allowedSuffixes: [...domains],
       email: options.proxy.onDemandTlsEmail,
-      certsDir
+      certsDir,
+      staging: options.proxy.onDemandTlsStaging ?? false
     };
   }
   if (options.proxy.onDemandTls) {
@@ -859,6 +1174,7 @@ let email
 let certsDir = ${JSON.stringify(defaultCertsDir)}
 let acmeChallengeWebroot
 let guard
+let anyProduction = false
 let files = []
 try { files = readdirSync(dir).filter(n => n.endsWith('.json')).sort() } catch {}
 for (const f of files) {
@@ -878,6 +1194,11 @@ for (const f of files) {
   }
   for (const s of frag.onDemandTls?.allowedSuffixes ?? []) suffixes.add(s)
   email ??= frag.onDemandTls?.email
+  // One gateway, one ACME directory: production wins any disagreement between
+  // co-tenants, and a fragment predating the flag counts as production. A
+  // staging cert chains to an untrusted root, so defaulting the other way
+  // breaks every client of every tenant that wanted a real cert.
+  if (frag.onDemandTls && frag.onDemandTls.staging !== true) anyProduction = true
   if (frag.productionCerts?.certsDir) certsDir = frag.productionCerts.certsDir
   acmeChallengeWebroot ??= frag.acmeChallengeWebroot
   if (frag.originGuard) {
@@ -897,7 +1218,7 @@ const config = {
   // journal and a production TLS failure looks like "nothing happens". Silence
   // it by setting RPX_VERBOSE=false on the systemd unit.
   verbose: process.env.RPX_VERBOSE !== 'false',
-  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir } } : {}),
+  ...(suffixes.size > 0 ? { onDemandTls: { enabled: true, allowedSuffixes: [...suffixes], email, certsDir, staging: !anyProduction } } : {}),
   ...(acmeChallengeWebroot ? { acmeChallengeWebroot } : {}),
   ...(guard ? { originGuard: { header: guard.header, value: guard.value, hosts: [...guardHosts] } } : {}),
 }
@@ -1042,165 +1363,34 @@ function buildRpxProvisionScript(options) {
       `Environment=BUN_INSTALL=/root/.bun`,
       ...poolEnv,
       "MemoryAccounting=true",
-      `MemoryHigh=${memoryHigh}`,
-      `MemoryMax=${memoryMax}`,
-      "OOMPolicy=stop",
-      "Restart=always",
-      "RestartSec=5",
-      "LimitNOFILE=1048576",
-      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
-      "",
-      "[Install]",
-      "WantedBy=multi-user.target"
-    ].join(`
-`), "TS_CLOUD_RPX_UNIT_EOF"),
-    "systemctl daemon-reload",
-    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
-    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
-    `systemctl enable ${RPX_SERVICE_NAME}`,
-    `systemctl restart ${RPX_SERVICE_NAME}`,
-    ...buildCertManagementCommands(options)
-  ];
-}
-function buildRpxFragmentRefreshScript(options) {
-  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
-  const fragment = JSON.stringify({ slug, ...options.config }, null, 2);
-  return [
-    "set -euo pipefail",
-    `mkdir -p ${RPX_SITES_DIR}`,
-    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
-    `systemctl restart ${RPX_SERVICE_NAME}`
-  ];
-}
-
-// src/drivers/shared/ufw.ts
-var UFW_BASE_PORTS = [80, 443];
-function buildUfwScript(firewall = {}) {
-  if (firewall.enabled === false)
-    return [];
-  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => Number.isInteger(p) && p >= 1 && p <= 65535).sort((a, b) => a - b);
-  const lines = [
-    "export DEBIAN_FRONTEND=noninteractive",
-    "apt-get install -y ufw",
-    "ufw default deny incoming",
-    "ufw default allow outgoing",
-    "ufw allow OpenSSH"
-  ];
-  for (const port of ports)
-    lines.push(`ufw allow ${port}/tcp`);
-  lines.push("ufw --force enable");
-  return lines;
-}
-
-// src/drivers/shared/maintenance.ts
-function buildAutoUpdatesScript(enabled2 = true) {
-  if (!enabled2)
-    return [];
-  return [
-    "export DEBIAN_FRONTEND=noninteractive",
-    "apt-get install -y unattended-upgrades",
-    "cat > /etc/apt/apt.conf.d/20auto-upgrades <<'TS_CLOUD_AUTOUPD_EOF'",
-    'APT::Periodic::Update-Package-Lists "1";',
-    'APT::Periodic::Unattended-Upgrade "1";',
-    'APT::Periodic::Download-Upgradeable-Packages "1";',
-    'APT::Periodic::AutocleanInterval "7";',
-    "TS_CLOUD_AUTOUPD_EOF",
-    "systemctl enable unattended-upgrades 2>/dev/null || true",
-    "systemctl restart unattended-upgrades 2>/dev/null || true"
-  ];
-}
-
-// src/drivers/shared/monitoring.ts
-var METRICS_PATH = "/var/lib/ts-cloud/metrics.json";
-var ALERT_STATE_PATH = "/var/lib/ts-cloud/alert-state";
-var DEFAULT_CPU_LOAD_PER_CORE = 2;
-var DEFAULT_MEM_PERCENT = 90;
-var DEFAULT_DISK_PERCENT = 90;
-var SERVICE_PROBES = [
-  ["nginx", 80],
-  ["phpFpm", 9074],
-  ["mysql", 3306],
-  ["postgres", 5432],
-  ["redis", 6379],
-  ["meilisearch", 7700]
-];
-function resolveMonitoring(monitoring = true) {
-  const obj = typeof monitoring === "object" ? monitoring : {};
-  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
-  return {
-    enabled: enabled2,
-    cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
-    memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
-    diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
-  };
-}
-function buildMonitoringScript(monitoring = true) {
-  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
-  if (!enabled2)
-    return [];
-  const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
-  const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
-  return [
-    "mkdir -p /var/lib/ts-cloud",
-    "cat > /usr/local/bin/ts-cloud-metrics.sh <<'TS_CLOUD_METRICS_EOF'",
-    "#!/bin/bash",
-    "set -uo pipefail",
-    "LOAD=$(cut -d' ' -f1 /proc/loadavg)",
-    "CPUS=$(nproc)",
-    "MEM_TOTAL=$(free -m | awk '/^Mem:/{print $2}')",
-    "MEM_USED=$(free -m | awk '/^Mem:/{print $3}')",
-    "SWAP_TOTAL=$(free -m | awk '/^Swap:/{print $2}')",
-    "SWAP_USED=$(free -m | awk '/^Swap:/{print $3}')",
-    `DISK_PCT=$(df -P / | awk 'NR==2{gsub("%","",$5); print $5}')`,
-    "UPTIME_SEC=$(cut -d' ' -f1 /proc/uptime | cut -d. -f1)",
-    `RX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{rx+=$3} END{print rx+0}' /proc/net/dev)`,
-    `TX_BYTES=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{tx+=$11} END{print tx+0}' /proc/net/dev)`,
-    "probe(){ (exec 3<>/dev/tcp/127.0.0.1/$1) 2>/dev/null && echo up || echo down; }",
-    ...probeLines,
-    "LOAD=${LOAD:-0}; CPUS=${CPUS:-1}; MEM_TOTAL=${MEM_TOTAL:-0}; MEM_USED=${MEM_USED:-0}",
-    "SWAP_TOTAL=${SWAP_TOTAL:-0}; SWAP_USED=${SWAP_USED:-0}; DISK_PCT=${DISK_PCT:-0}",
-    "UPTIME_SEC=${UPTIME_SEC:-0}; RX_BYTES=${RX_BYTES:-0}; TX_BYTES=${TX_BYTES:-0}",
-    "MEM_PCT=$(( MEM_TOTAL > 0 ? MEM_USED * 100 / MEM_TOTAL : 0 ))",
-    `cat > ${METRICS_PATH}.tmp <<JSON`,
-    '{"load":$LOAD,"cpus":$CPUS,"memTotalMb":$MEM_TOTAL,"memUsedMb":$MEM_USED,"memUsedPct":$MEM_PCT,"swapTotalMb":$SWAP_TOTAL,"swapUsedMb":$SWAP_USED,"diskUsedPct":$DISK_PCT,"uptimeSec":$UPTIME_SEC,"network":{"rxBytes":$RX_BYTES,"txBytes":$TX_BYTES},"services":{' + servicesJson + "}}",
-    "JSON",
-    `mv -f ${METRICS_PATH}.tmp ${METRICS_PATH}`,
-    'ALERTS=""',
-    `if awk -v l="$LOAD" -v c="$CPUS" -v t=${cpuLoadPerCore} 'BEGIN{exit !(c>0 && l/c > t)}'; then ALERTS="$ALERTS load=$LOAD/${cpuLoadPerCore}xCPU"; fi`,
-    `if [ "\${MEM_PCT:-0}" -ge ${memPercent} ]; then ALERTS="$ALERTS mem=\${MEM_PCT}%"; fi`,
-    `if [ "\${DISK_PCT:-0}" -ge ${diskPercent} ]; then ALERTS="$ALERTS disk=\${DISK_PCT}%"; fi`,
-    `PREV=$(cat ${ALERT_STATE_PATH} 2>/dev/null || echo ok)`,
-    'if [ -n "$ALERTS" ]; then',
-    '  if [ "$PREV" != alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "⚠️ $(hostname): resource alert —$ALERTS" || true; fi',
-    `  echo alert > ${ALERT_STATE_PATH}`,
-    "else",
-    '  if [ "$PREV" = alert ] && [ -x /usr/local/bin/ts-cloud-notify ]; then /usr/local/bin/ts-cloud-notify "✅ $(hostname): resource usage back to normal" || true; fi',
-    `  echo ok > ${ALERT_STATE_PATH}`,
-    "fi",
-    "TS_CLOUD_METRICS_EOF",
-    "chmod +x /usr/local/bin/ts-cloud-metrics.sh",
-    "cat > /etc/systemd/system/ts-cloud-metrics.service <<'TS_CLOUD_METRICS_SVC_EOF'",
-    "[Unit]",
-    "Description=ts-cloud metrics collector",
-    "",
-    "[Service]",
-    "Type=oneshot",
-    "ExecStart=/usr/local/bin/ts-cloud-metrics.sh",
-    "TS_CLOUD_METRICS_SVC_EOF",
-    "cat > /etc/systemd/system/ts-cloud-metrics.timer <<'TS_CLOUD_METRICS_TMR_EOF'",
-    "[Unit]",
-    "Description=Run ts-cloud metrics collector every minute",
-    "",
-    "[Timer]",
-    "OnBootSec=60",
-    "OnUnitActiveSec=60",
-    "",
-    "[Install]",
-    "WantedBy=timers.target",
-    "TS_CLOUD_METRICS_TMR_EOF",
+      `MemoryHigh=${memoryHigh}`,
+      `MemoryMax=${memoryMax}`,
+      "OOMPolicy=stop",
+      "Restart=always",
+      "RestartSec=5",
+      "LimitNOFILE=1048576",
+      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target"
+    ].join(`
+`), "TS_CLOUD_RPX_UNIT_EOF"),
     "systemctl daemon-reload",
-    "systemctl enable ts-cloud-metrics.timer",
-    "systemctl start ts-cloud-metrics.timer"
+    "systemctl disable --now bun-gateway.service 2>/dev/null || true",
+    "systemctl disable --now ts-cloud-nginx.service 2>/dev/null || true",
+    `systemctl enable ${RPX_SERVICE_NAME}`,
+    `systemctl restart ${RPX_SERVICE_NAME}`,
+    ...buildCertManagementCommands(options)
+  ];
+}
+function buildRpxFragmentRefreshScript(options) {
+  const slug = (options.slug || "app").replace(/[^a-z0-9._-]+/gi, "-");
+  const fragment = JSON.stringify({ slug, ...options.config }, null, 2);
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${RPX_SITES_DIR}`,
+    ...writeFileHeredoc(`${RPX_SITES_DIR}/${slug}.json`, fragment, "TS_CLOUD_RPX_FRAGMENT_EOF", "0600"),
+    `systemctl restart ${RPX_SERVICE_NAME}`
   ];
 }
 
@@ -1217,11 +1407,7 @@ function buildAuthorizedKeysScript(keys = [], options = {}) {
     `sed -i '/^${escapeSed(BLOCK_BEGIN)}$/,/^${escapeSed(BLOCK_END)}$/d' ${path}`
   ];
   if (keys.length > 0) {
-    const block = [
-      BLOCK_BEGIN,
-      ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`),
-      BLOCK_END
-    ].join(`
+    const block = [BLOCK_BEGIN, ...keys.map((k) => `${k.publicKey.trim()} ${k.name}`), BLOCK_END].join(`
 `);
     lines.push(`cat >> ${path} <<'TS_CLOUD_KEYS_EOF'`, block, "TS_CLOUD_KEYS_EOF", `chmod 600 ${path}`);
   }
@@ -1231,202 +1417,23 @@ function escapeSed(value) {
   return value.replace(/[.*[\]\\/^$]/g, "\\$&");
 }
 
-// src/drivers/shared/notifications.ts
-function wantsEvent(config, event) {
-  return !config.events || config.events.includes(event);
-}
-async function sendNotifications(config, event, message, options = {}) {
-  if (!config)
-    return [];
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  const attempted = [];
-  const tasks = [];
-  const post = (url, body) => fetchImpl(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }).catch(() => {
-    return;
-  });
-  if (config.slack?.webhookUrl && wantsEvent(config, event)) {
-    attempted.push("slack");
-    tasks.push(post(config.slack.webhookUrl, { text: message }));
-  }
-  if (config.discord?.webhookUrl && wantsEvent(config, event)) {
-    attempted.push("discord");
-    tasks.push(post(config.discord.webhookUrl, { content: message }));
-  }
-  if (config.telegram?.botToken && config.telegram.chatId && wantsEvent(config, event)) {
-    attempted.push("telegram");
-    const url = `https://api.telegram.org/bot${config.telegram.botToken}/sendMessage`;
-    tasks.push(post(url, { chat_id: config.telegram.chatId, text: message }));
-  }
-  if (config.webhook?.url && wantsEvent(config, event)) {
-    attempted.push("webhook");
-    if ((config.webhook.method || "POST") === "GET") {
-      const sep = config.webhook.url.includes("?") ? "&" : "?";
-      const url = `${config.webhook.url}${sep}event=${encodeURIComponent(event)}&message=${encodeURIComponent(message)}`;
-      tasks.push(fetchImpl(url, { method: "GET" }).catch(() => {
-        return;
-      }));
-    } else {
-      tasks.push(post(config.webhook.url, { event, message }));
-    }
-  }
-  if (config.email?.to && wantsEvent(config, event)) {
-    attempted.push("email");
-    tasks.push(sendEmailNotification(config.email, event, message));
-  }
-  await Promise.all(tasks);
-  return attempted;
-}
-async function sendEmailNotification(email, event, message) {
-  try {
-    const mod = await import("./chunk-pqfzdg68.js");
-    await mod.email.send({
-      to: email.to,
-      from: email.from,
-      subject: `[ts-cloud] ${event}`,
-      text: message
-    });
-  } catch {}
-}
-function resolveNotifications(project, site) {
-  return site ?? project;
-}
-function buildNotifierScript(config) {
-  if (!config)
-    return [];
-  const curls = [];
-  if (config.slack?.webhookUrl)
-    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"text\\":\\"$MSG\\"}" ${config.slack.webhookUrl} || true`);
-  if (config.discord?.webhookUrl)
-    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"content\\":\\"$MSG\\"}" ${config.discord.webhookUrl} || true`);
-  if (config.telegram?.botToken && config.telegram.chatId)
-    curls.push(`curl -fsS -X POST "https://api.telegram.org/bot${config.telegram.botToken}/sendMessage" --data-urlencode "chat_id=${config.telegram.chatId}" --data-urlencode "text=$MSG" || true`);
-  if (config.webhook?.url)
-    curls.push(`curl -fsS -X POST -H 'Content-Type: application/json' -d "{\\"message\\":\\"$MSG\\"}" ${config.webhook.url} || true`);
-  if (curls.length === 0)
-    return [];
-  return [
-    "cat > /usr/local/bin/ts-cloud-notify <<'TS_CLOUD_NOTIFY_EOF'",
-    "#!/bin/bash",
-    'MSG="$1"',
-    ...curls,
-    "TS_CLOUD_NOTIFY_EOF",
-    "chmod +x /usr/local/bin/ts-cloud-notify"
-  ];
-}
-
-// src/drivers/shared/backups.ts
-var BACKUP_OUTPUT_DIR = "/var/backups/ts-cloud";
-var BACKUP_CONFIG_PATH = "/etc/ts-cloud/backups.config.ts";
-var BACKUP_CRON_PATH = "/etc/cron.d/ts-cloud-backups";
-var BACKUP_RUNNER_PATH = "/usr/local/bin/ts-cloud-backup.sh";
-function backupEntryFor(database) {
-  if (!database.name)
-    return null;
-  const host = database.host || "127.0.0.1";
-  const isPostgres = database.engine === "postgres";
-  const type = isPostgres ? "postgresql" : "mysql";
-  const port = database.port ?? (isPostgres ? 5432 : 3306);
-  const ts = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-  return [
-    "  {",
-    `    type: '${type}',`,
-    `    name: '${ts(database.name)}',`,
-    "    connection: {",
-    `      hostname: '${ts(host)}',`,
-    `      port: ${port},`,
-    `      database: '${ts(database.name)}',`,
-    `      username: '${ts(database.username || database.name)}',`,
-    `      password: '${ts(database.password || "")}',`,
-    "      ssl: false,",
-    "    },",
-    "    includeSchema: true,",
-    "    includeData: true,",
-    "  },"
-  ].join(`
-`);
-}
-function buildBackupsConfigTs(database, backups) {
-  const entry = database ? backupEntryFor(database) : null;
-  const destinations = backups.bucket ? [
-    "  destinations: [",
-    "    {",
-    "      type: 's3',",
-    `      bucket: '${backups.bucket}',`,
-    "      prefix: 'db-backups',",
-    ...backups.endpoint ? [`      endpoint: '${backups.endpoint}',`] : [],
-    "      optional: false,",
-    "    },",
-    "  ],"
-  ] : [];
-  return [
-    "import type { BackupConfig } from 'ts-backups'",
-    "",
-    "const config: BackupConfig = {",
-    "  verbose: true,",
-    `  outputPath: '${BACKUP_OUTPUT_DIR}',`,
-    "  retention: {",
-    `    count: ${backups.retentionCount ?? 5},`,
-    `    maxAge: ${backups.retentionDays ?? 30},`,
-    "  },",
-    "  databases: [",
-    ...entry ? [entry] : [],
-    "  ],",
-    ...destinations,
-    "}",
-    "",
-    "export default config",
-    ""
-  ].join(`
-`);
-}
-function buildBackupProvisionScript(options) {
-  const { database, backups } = options;
-  if (!backups.enabled)
+// src/drivers/shared/ufw.ts
+var UFW_BASE_PORTS = [80, 443];
+function buildUfwScript(firewall = {}) {
+  if (firewall.enabled === false)
     return [];
-  const schedule = backups.schedule || "0 2 * * *";
-  const configTs = buildBackupsConfigTs(database, backups);
-  return [
+  const ports = [...new Set([...UFW_BASE_PORTS, ...firewall.allowedPorts || []])].filter((p) => Number.isInteger(p) && p >= 1 && p <= 65535).sort((a, b) => a - b);
+  const lines = [
     "export DEBIAN_FRONTEND=noninteractive",
-    `mkdir -p /etc/ts-cloud ${BACKUP_OUTPUT_DIR}`,
-    "command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)",
-    "bun add -g ts-backups || true",
-    `cat > ${BACKUP_CONFIG_PATH} <<'TS_CLOUD_BACKUP_CFG_EOF'`,
-    configTs.replace(/\n$/, ""),
-    "TS_CLOUD_BACKUP_CFG_EOF",
-    `cat > ${BACKUP_RUNNER_PATH} <<'TS_CLOUD_BACKUP_RUN_EOF'`,
-    "#!/bin/bash",
-    "set -uo pipefail",
-    'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"',
-    'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',
-    "cd /etc/ts-cloud",
-    'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',
-    "TS_CLOUD_BACKUP_RUN_EOF",
-    `chmod +x ${BACKUP_RUNNER_PATH}`,
-    `cat > ${BACKUP_CRON_PATH} <<'TS_CLOUD_BACKUP_CRON_EOF'`,
-    `${schedule} root ${BACKUP_RUNNER_PATH} >> /var/log/ts-cloud-backup.log 2>&1`,
-    "TS_CLOUD_BACKUP_CRON_EOF",
-    `chmod 644 ${BACKUP_CRON_PATH}`
-  ];
-}
-function engineSocket(engine) {
-  return engine === "mariadb" ? "/var/lib/pantry/mariadb/mariadbd.sock" : "/var/lib/pantry/mysql/mysqld.sock";
-}
-function buildBackupRestoreScript(database, options = {}) {
-  if (!database?.name)
-    return [];
-  const name = database.name;
-  const isPg = database.engine === "postgres";
-  const locate = options.from ? `TS_CLOUD_DUMP="${options.from}"` : `TS_CLOUD_DUMP="$(find ${BACKUP_OUTPUT_DIR} -type f -name '*${name}*.sql' -o -type f -name '*${name}*.sql.gz' 2>/dev/null | xargs -r ls -1t 2>/dev/null | head -1)"`;
-  const client = isPg ? `${pgAdminCommand(database)} -d "${name}"` : `mysql --socket=${engineSocket(database.engine)} -u root "${name}"`;
-  return [
-    "set -uo pipefail",
-    'eval "$(cd /opt/pantry && pantry env 2>/dev/null)" || true',
-    locate,
-    '[ -n "$TS_CLOUD_DUMP" ] && [ -f "$TS_CLOUD_DUMP" ] || { echo "no backup dump found to restore" >&2; exit 1; }',
-    'echo "[ts-cloud] restoring ' + name + ' from $TS_CLOUD_DUMP"',
-    `case "$TS_CLOUD_DUMP" in *.gz) gunzip -c "$TS_CLOUD_DUMP" ;; *) cat "$TS_CLOUD_DUMP" ;; esac | ${client}`,
-    'echo "restore complete"'
+    "apt-get install -y ufw",
+    "ufw default deny incoming",
+    "ufw default allow outgoing",
+    "ufw allow OpenSSH"
   ];
+  for (const port of ports)
+    lines.push(`ufw allow ${port}/tcp`);
+  lines.push("ufw --force enable");
+  return lines;
 }
 
 // src/drivers/shared/compute-provision.ts
@@ -1720,7 +1727,12 @@ class AwsDriver {
     const existing = await this.findComputeTargets({ slug, environment, role: "app" });
     if (existing.length > 0) {
       const first = existing[0];
-      return { appInstanceId: first.id, appPublicIp: first.publicIp, sshUser: "ubuntu", deployStoragePath: "/var/ts-cloud/staging" };
+      return {
+        appInstanceId: first.id,
+        appPublicIp: first.publicIp,
+        sshUser: "ubuntu",
+        deployStoragePath: "/var/ts-cloud/staging"
+      };
     }
     let imageId = resolveAwsImageId(config);
     if (!imageId) {
@@ -1740,16 +1752,30 @@ class AwsDriver {
     if (!subnet?.MapPublicIpOnLaunch)
       console.warn("ts-cloud: no public subnet found; the instance may not get a public IP (deploys/SSL need one).");
     const sgName = `${slug}-${environment}-app-sg`;
-    const found = await ec2.describeSecurityGroups({ Filters: [{ Name: "group-name", Values: [sgName] }, { Name: "vpc-id", Values: [vpc.VpcId] }] });
+    const found = await ec2.describeSecurityGroups({
+      Filters: [
+        { Name: "group-name", Values: [sgName] },
+        { Name: "vpc-id", Values: [vpc.VpcId] }
+      ]
+    });
     let groupId = found.SecurityGroups?.[0]?.GroupId;
     if (!groupId) {
-      const created = await ec2.createSecurityGroup({ GroupName: sgName, Description: `ts-cloud ${slug}/${environment} app`, VpcId: vpc.VpcId });
+      const created = await ec2.createSecurityGroup({
+        GroupName: sgName,
+        Description: `ts-cloud ${slug}/${environment} app`,
+        VpcId: vpc.VpcId
+      });
       groupId = created.GroupId;
     }
     const rules = awsComputeIngressRules(config);
     await ec2.authorizeSecurityGroupIngress({
       GroupId: groupId,
-      IpPermissions: rules.map((r) => ({ IpProtocol: r.protocol, FromPort: r.port, ToPort: r.port, IpRanges: [{ CidrIp: r.cidr }] }))
+      IpPermissions: rules.map((r) => ({
+        IpProtocol: r.protocol,
+        FromPort: r.port,
+        ToPort: r.port,
+        IpRanges: [{ CidrIp: r.cidr }]
+      }))
     }).catch((e) => {
       if (!/InvalidPermission\.Duplicate/.test(e instanceof Error ? e.message : ""))
         throw e;
@@ -1765,15 +1791,17 @@ class AwsDriver {
       SubnetId: subnetId,
       UserData: userData,
       IamInstanceProfile: compute.server?.iamInstanceProfile ? { Name: compute.server.iamInstanceProfile } : undefined,
-      TagSpecifications: [{
-        ResourceType: "instance",
-        Tags: [
-          { Key: "Name", Value: `${slug}-${environment}-app` },
-          { Key: "Project", Value: slug },
-          { Key: "Environment", Value: environment },
-          { Key: "Role", Value: "app" }
-        ]
-      }]
+      TagSpecifications: [
+        {
+          ResourceType: "instance",
+          Tags: [
+            { Key: "Name", Value: `${slug}-${environment}-app` },
+            { Key: "Project", Value: slug },
+            { Key: "Environment", Value: environment },
+            { Key: "Role", Value: "app" }
+          ]
+        }
+      ]
     });
     const instanceId = run.Instances?.[0]?.InstanceId;
     if (!instanceId)
@@ -1989,10 +2017,53 @@ class AwsDriver {
     };
   }
 }
-
-// src/drivers/hetzner/driver.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { execSync } from "node:child_process";
+
+// src/drivers/hetzner/driver.ts
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+
+// src/drivers/shared/fleet.ts
+function resolveFleetTopology(compute = {}) {
+  const appServers = Math.max(1, compute.appServers ?? compute.instances ?? 1);
+  const dedicatedServices = !!compute.servicesServer || appServers > 1;
+  const loadBalancer = appServers > 1 || !!compute.server?.loadBalancer;
+  return {
+    appServers,
+    loadBalancer,
+    dedicatedServices,
+    servicesOnApp: !dedicatedServices
+  };
+}
+function buildFleetServicesEnv(servicesPrivateIp, database) {
+  const env = {
+    REDIS_HOST: servicesPrivateIp,
+    MEILISEARCH_HOST: `http://${servicesPrivateIp}:7700`
+  };
+  if (database?.name) {
+    env.DB_CONNECTION = database.engine === "postgres" ? "pgsql" : "mysql";
+    env.DB_HOST = servicesPrivateIp;
+    env.DB_PORT = String(database.port ?? (database.engine === "postgres" ? 5432 : 3306));
+    env.DB_DATABASE = database.name;
+    if (database.username)
+      env.DB_USERNAME = database.username;
+    if (database.password)
+      env.DB_PASSWORD = database.password;
+  }
+  return env;
+}
+function buildFleetServicesBoxProvision(config) {
+  const compute = config.infrastructure?.compute ?? {};
+  const appDatabase = resolveAppDatabase(config);
+  return [
+    ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
+    ...buildDatabaseSetupScript(appDatabase, compute.managedServices ?? { mysql: true }),
+    ...buildAutoUpdatesScript(true),
+    ...buildMonitoringScript(true),
+    ...buildAuthorizedKeysScript(compute.sshKeys),
+    ...buildNotifierScript(config.notifications),
+    ...compute.backups?.enabled ? [...buildBackupProvisionScript({ database: appDatabase, backups: compute.backups })] : []
+  ];
+}
 
 // src/drivers/hetzner/config.ts
 import { homedir } from "node:os";
@@ -2159,7 +2230,13 @@ class HetznerClient {
       network_zone: options.network ? undefined : options.networkZone ?? "eu-central",
       network: options.network,
       labels: options.labels,
-      targets: [{ type: "label_selector", label_selector: { selector: options.labelSelector }, use_private_ip: !!options.network }],
+      targets: [
+        {
+          type: "label_selector",
+          label_selector: { selector: options.labelSelector },
+          use_private_ip: !!options.network
+        }
+      ],
       services: options.services.map((s) => ({
         protocol: s.protocol ?? "tcp",
         listen_port: s.listenPort,
@@ -2279,49 +2356,6 @@ runcmd:
 `;
 }
 
-// src/drivers/shared/fleet.ts
-function resolveFleetTopology(compute = {}) {
-  const appServers = Math.max(1, compute.appServers ?? compute.instances ?? 1);
-  const dedicatedServices = !!compute.servicesServer || appServers > 1;
-  const loadBalancer = appServers > 1 || !!compute.server?.loadBalancer;
-  return {
-    appServers,
-    loadBalancer,
-    dedicatedServices,
-    servicesOnApp: !dedicatedServices
-  };
-}
-function buildFleetServicesEnv(servicesPrivateIp, database) {
-  const env2 = {
-    REDIS_HOST: servicesPrivateIp,
-    MEILISEARCH_HOST: `http://${servicesPrivateIp}:7700`
-  };
-  if (database?.name) {
-    env2.DB_CONNECTION = database.engine === "postgres" ? "pgsql" : "mysql";
-    env2.DB_HOST = servicesPrivateIp;
-    env2.DB_PORT = String(database.port ?? (database.engine === "postgres" ? 5432 : 3306));
-    env2.DB_DATABASE = database.name;
-    if (database.username)
-      env2.DB_USERNAME = database.username;
-    if (database.password)
-      env2.DB_PASSWORD = database.password;
-  }
-  return env2;
-}
-function buildFleetServicesBoxProvision(config) {
-  const compute = config.infrastructure?.compute ?? {};
-  const appDatabase = resolveAppDatabase(config);
-  return [
-    ...buildServicesProvisionScript(compute.managedServices ?? { mysql: true, redis: true }, { bindPrivate: true }),
-    ...buildDatabaseSetupScript(appDatabase, compute.managedServices ?? { mysql: true }),
-    ...buildAutoUpdatesScript(true),
-    ...buildMonitoringScript(true),
-    ...buildAuthorizedKeysScript(compute.sshKeys),
-    ...buildNotifierScript(config.notifications),
-    ...compute.backups?.enabled ? [...buildBackupProvisionScript({ database: appDatabase, backups: compute.backups })] : []
-  ];
-}
-
 // src/drivers/hetzner/firewall-rules.ts
 function buildHetznerFirewallRules(config) {
   const openPorts = new Set([80, 443, ...config.sitePorts, ...config.allowedPorts ?? []]);
@@ -2616,7 +2650,13 @@ class HetznerDriver {
       optimizeForProduction: compute.php?.optimizeForProduction,
       ini: compute.php?.ini
     });
-    const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", phpProvision: appPhp, servicesProvision: appProvision, baked, swapGb: compute.swapGb }));
+    const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({
+      runtime: "php",
+      phpProvision: appPhp,
+      servicesProvision: appProvision,
+      baked,
+      swapGb: compute.swapGb
+    }));
     const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
     const appServerIds = existingApp.map((s) => s.id);
     if (existingApp.length > topology.appServers) {
@@ -2931,7 +2971,11 @@ class HetznerDriver {
       } catch {}
     }
     const firewalls = await this.client.listFirewalls().catch(() => []);
-    for (const name of [`${slug}-${environment}-app-fw`, `${slug}-${environment}-services-fw`, `${slug}-${environment}-lb-fw`]) {
+    for (const name of [
+      `${slug}-${environment}-app-fw`,
+      `${slug}-${environment}-services-fw`,
+      `${slug}-${environment}-lb-fw`
+    ]) {
       const fw = firewalls.find((f) => f.name === name);
       if (!fw)
         continue;
@@ -3031,7 +3075,9 @@ class HetznerDriver {
       return exact.map(toTarget);
     if (role === "app" || role === "lb" || role === "services") {
       const state = await readDriverState(options.stackName ?? `${options.slug}-${options.environment}`);
-      const pinnedIds = [...new Set(role === "app" ? [state?.serverId, ...state?.appServerIds ?? []] : role === "lb" ? [state?.lbServerId] : [state?.servicesServerId])].filter((id) => typeof id === "number");
+      const pinnedIds = [
+        ...new Set(role === "app" ? [state?.serverId, ...state?.appServerIds ?? []] : role === "lb" ? [state?.lbServerId] : [state?.servicesServerId])
+      ].filter((id) => typeof id === "number");
       if (pinnedIds.length > 0) {
         const pinned = [];
         for (const id of pinnedIds) {
@@ -3197,7 +3243,7 @@ class HetznerDriver {
     let lastErr;
     while (Date.now() - start < sshTimeoutMs) {
       try {
-        execSync(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} true`, {
+        execSync(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `'${a.replace(/'/g, "\\\"")}"`).join(" ")} true`, {
           stdio: "pipe",
           maxBuffer: SSH_MAX_BUFFER
         });
@@ -3388,7 +3434,11 @@ async function ensureSshKey(client, options) {
   const existing = (await client.listSshKeys()).find((k) => normalizeSshPublicKey(k.public_key) === body);
   if (existing)
     return { id: existing.id, name: existing.name, created: false };
-  const created = await client.createSshKey({ name: options.name, publicKey: options.publicKey.trim(), labels: options.labels });
+  const created = await client.createSshKey({
+    name: options.name,
+    publicKey: options.publicKey.trim(),
+    labels: options.labels
+  });
   return { id: created.id, name: created.name, created: true };
 }
 async function ensureFirewall(client, options) {
@@ -3429,10 +3479,7 @@ async function sshExec(host, command, options = {}) {
     stdout: "pipe",
     stderr: "pipe"
   });
-  const [stdout, stderr] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
+  const [stdout, stderr] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text()]);
   const code = await proc.exited;
   return { code, stdout, stderr };
 }
@@ -3483,12 +3530,7 @@ async function waitForCloudInit(host, options = {}) {
 var UBUNTU_2404_AMI_PARAM = "/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id";
 function buildBoxUserData(spec) {
   const key = spec.sshPublicKey.trim();
-  const lines = [
-    "#cloud-config",
-    "disable_root: false",
-    "ssh_authorized_keys:",
-    `  - ${key}`
-  ];
+  const lines = ["#cloud-config", "disable_root: false", "ssh_authorized_keys:", `  - ${key}`];
   if (spec.bootstrapScript) {
     const path = "/var/lib/cloud/box-bootstrap.sh";
     const indented = spec.bootstrapScript.split(`
@@ -3537,7 +3579,13 @@ class HetznerBoxProvisioner {
       userData: buildBoxUserData(spec),
       labels: spec.labels
     });
-    return { provider: "hetzner", id: String(server.id), name: server.name, publicIp: serverPublicIpv4(server), created };
+    return {
+      provider: "hetzner",
+      id: String(server.id),
+      name: server.name,
+      publicIp: serverPublicIpv4(server),
+      created
+    };
   }
   async destroyBox(name) {
     const destroyed = [];
@@ -3634,12 +3682,15 @@ class AwsBoxProvisioner {
     const existing = await this.findInstance(spec.name, ["pending", "running"]);
     if (existing?.InstanceId) {
       const instance2 = await this.waitForPublicIp(existing.InstanceId);
-      return { provider: "aws", id: instance2.InstanceId, name: spec.name, publicIp: instance2.PublicIpAddress, created: false };
+      return {
+        provider: "aws",
+        id: instance2.InstanceId,
+        name: spec.name,
+        publicIp: instance2.PublicIpAddress,
+        created: false
+      };
     }
-    const [groupId, imageId] = await Promise.all([
-      this.ensureSecurityGroup(spec),
-      this.resolveImage(spec)
-    ]);
+    const [groupId, imageId] = await Promise.all([this.ensureSecurityGroup(spec), this.resolveImage(spec)]);
     const tags = [
       { Key: "Name", Value: spec.name },
       ...Object.entries(spec.labels ?? {}).map(([Key, Value]) => ({ Key, Value }))
@@ -3743,9 +3794,7 @@ function isFileSharedPath(p) {
   return /\.[a-z0-9]+$/i.test(name);
 }
 function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
-  const lines = [
-    `mkdir -p ${paths.releases} ${paths.shared}`
-  ];
+  const lines = [`mkdir -p ${paths.releases} ${paths.shared}`];
   for (const p of sharedPaths) {
     if (isFileSharedPath(p)) {
       lines.push(`mkdir -p "$(dirname ${paths.shared}/${p})"`, `touch ${paths.shared}/${p}`);
@@ -3767,10 +3816,7 @@ function buildLinkSharedPaths(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
   return lines;
 }
 function buildActivateRelease(paths) {
-  return [
-    `ln -sfn ${paths.release} ${paths.current}.tmp`,
-    `mv -Tf ${paths.current}.tmp ${paths.current}`
-  ];
+  return [`ln -sfn ${paths.release} ${paths.current}.tmp`, `mv -Tf ${paths.current}.tmp ${paths.current}`];
 }
 function buildRollbackScript(paths, options = {}) {
   const flip = options.to ? [
@@ -3978,9 +4024,7 @@ function releaseTarballTmpPath(slug, siteName, releaseId) {
   return `/tmp/${parts}-release.tar.gz`;
 }
 function buildAwsArtifactFetch(bucket, key, region, destPath) {
-  return [
-    `aws s3 cp "s3://${bucket}/${key}" ${destPath} --region ${region}`
-  ];
+  return [`aws s3 cp "s3://${bucket}/${key}" ${destPath} --region ${region}`];
 }
 function buildLocalArtifactFetch(localPath, destPath) {
   return [
@@ -4224,18 +4268,204 @@ function buildManagementDashboardArtifact(site, options) {
       logger.info(`Management dashboard: building UI (${site.build})`);
       execSync2(site.build, { cwd, stdio: "inherit" });
     }
-    const root = isAbsolute(site.root) ? site.root : join4(cwd, site.root);
-    if (!existsSync2(root)) {
-      logger.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
-      return null;
+    const root = isAbsolute(site.root) ? site.root : join4(cwd, site.root);
+    if (!existsSync2(root)) {
+      logger.warn(`Management dashboard: build output not found at ${root} — skipping dashboard artifact.`);
+      return null;
+    }
+    const tarball = join4(tmpdir(), `${options.slug}-${options.siteName ?? MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
+    execSync2(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
+    return tarball;
+  } catch (error) {
+    logger.warn(`Management dashboard: failed to build artifact — ${error?.message ?? error}. Skipping dashboard deploy.`);
+    return null;
+  }
+}
+
+// src/drivers/shared/app-frameworks.ts
+var PHP_SITE_TYPES2 = new Set(["laravel", "php", "statamic", "wordpress"]);
+function resolveSiteFramework(site) {
+  if (site.framework)
+    return site.framework;
+  if (site.type && PHP_SITE_TYPES2.has(site.type))
+    return "laravel";
+  return "stacks";
+}
+var PANTRY_ENV_EVAL = `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
+var BUN_BIN = "/usr/local/bin/bun";
+var STACKS_CLI = "storage/framework/core/buddy/src/cli.ts";
+var stacksDriver = {
+  id: "stacks",
+  wrapExec: (command) => command,
+  execEnv: { PATH: "/usr/local/bin:/usr/bin:/bin", BUN_INSTALL: "/root/.bun" },
+  schedulerMode: "daemon",
+  schedulerCommand: () => `${BUN_BIN} ${STACKS_CLI} schedule:run`,
+  queueWorkerCommand: (worker, { current }) => {
+    const flags = [
+      `--queue=${worker.queue || "default"}`,
+      `--sleep=${worker.sleep ?? 3}`,
+      `--tries=${worker.tries ?? 3}`,
+      `--timeout=${worker.timeout ?? 60}`
+    ];
+    return `${BUN_BIN} ${current}/${STACKS_CLI} queue:work ${flags.join(" ")}`;
+  }
+};
+var laravelDriver = {
+  id: "laravel",
+  wrapExec: (command) => `/bin/sh -lc '${PANTRY_ENV_EVAL}; exec ${command}'`,
+  schedulerMode: "cron",
+  schedulerCommand: ({ current }) => `cd ${current} && ${PANTRY_ENV_EVAL} && php artisan schedule:run`,
+  queueWorkerCommand: (worker, { current }) => {
+    const artisan = `${current}/artisan`;
+    if (worker.horizon)
+      return `php ${artisan} horizon`;
+    const flags = [
+      worker.connection || "default",
+      `--queue=${worker.queue || "default"}`,
+      `--sleep=${worker.sleep ?? 3}`,
+      `--tries=${worker.tries ?? 3}`,
+      `--timeout=${worker.timeout ?? 60}`,
+      `--memory=${worker.memory ?? 128}`
+    ];
+    if (worker.maxJobs)
+      flags.push(`--max-jobs=${worker.maxJobs}`);
+    if (worker.maxTime)
+      flags.push(`--max-time=${worker.maxTime}`);
+    return `php ${artisan} queue:work ${flags.join(" ")}`;
+  }
+};
+var DRIVERS = {
+  stacks: stacksDriver,
+  laravel: laravelDriver
+};
+function getAppFrameworkDriver(framework) {
+  return DRIVERS[framework] ?? stacksDriver;
+}
+
+// src/drivers/shared/app-services.ts
+function reEscape(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function cronQuote(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unnamed";
+}
+function queueUnitName(slug, siteName, index) {
+  return `${slug}-${siteName}-queue-${index}`;
+}
+function daemonUnitName(slug, siteName, daemon, index) {
+  return `${slug}-${siteName}-daemon-${daemon.name ? slugify(daemon.name) : slugify(daemon.command).slice(0, 32) || String(index)}`;
+}
+function systemdUnit(opts) {
+  const lines = [
+    "[Unit]",
+    `Description=${opts.description}`,
+    "After=network.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `WorkingDirectory=${opts.workingDir}`,
+    ...Object.entries(opts.environment ?? {}).map(([k, v]) => `Environment="${k}=${v}"`),
+    `ExecStart=${opts.execStart}`,
+    `Restart=${opts.restart || "always"}`,
+    "RestartSec=5"
+  ];
+  if (opts.user)
+    lines.push(`User=${opts.user}`);
+  if (typeof opts.stopWaitSecs === "number")
+    lines.push(`TimeoutStopSec=${opts.stopWaitSecs}`);
+  lines.push("", "[Install]", "WantedBy=multi-user.target");
+  return `${lines.join(`
+`)}
+`;
+}
+function writeUnitScript(name, body) {
+  return [
+    `cat > /etc/systemd/system/${name}.service <<'TS_CLOUD_UNIT_EOF'`,
+    body.replace(/\n$/, ""),
+    "TS_CLOUD_UNIT_EOF"
+  ];
+}
+function schedulerCronPath(slug, siteName) {
+  return `/etc/cron.d/${slug}-${siteName}-scheduler`;
+}
+function buildSiteServicesScript(options) {
+  const { slug, siteName, site } = options;
+  const base = options.appBase ?? `/var/www/${siteName}`;
+  const current = `${base}/current`;
+  const driver = getAppFrameworkDriver(resolveSiteFramework(site));
+  const ctx = { current };
+  const out = [];
+  const desiredUnits = [];
+  const queues = site.queues || [];
+  queues.forEach((worker, qIndex) => {
+    const processes = Math.max(1, worker.processes ?? 1);
+    for (let p = 0;p < processes; p++) {
+      const name = queueUnitName(slug, siteName, desiredUnits.length);
+      desiredUnits.push(name);
+      out.push(...writeUnitScript(name, systemdUnit({
+        description: `${siteName} queue worker ${qIndex}.${p} (managed by ts-cloud)`,
+        workingDir: current,
+        execStart: driver.wrapExec(driver.queueWorkerCommand(worker, ctx)),
+        environment: driver.execEnv,
+        stopWaitSecs: worker.stopWaitSecs ?? 90
+      })));
+    }
+  });
+  const daemons = site.daemons || [];
+  daemons.forEach((daemon, dIndex) => {
+    const processes = Math.max(1, daemon.processes ?? 1);
+    for (let p = 0;p < processes; p++) {
+      const name = `${daemonUnitName(slug, siteName, daemon, dIndex)}-${p}`;
+      desiredUnits.push(name);
+      out.push(...writeUnitScript(name, systemdUnit({
+        description: `${siteName} daemon ${daemon.name || daemon.command} (managed by ts-cloud)`,
+        workingDir: daemon.directory || current,
+        execStart: driver.wrapExec(daemon.command),
+        environment: driver.execEnv,
+        restart: daemon.restart,
+        user: daemon.user
+      })));
+    }
+  });
+  const scheduler = site.scheduler;
+  const schedulerEnabled = scheduler === true || typeof scheduler === "object" && scheduler !== null;
+  const schedulerUnit = `${slug}-${siteName}-scheduler`;
+  if (schedulerEnabled && driver.schedulerMode === "daemon") {
+    desiredUnits.push(schedulerUnit);
+    out.push(...writeUnitScript(schedulerUnit, systemdUnit({
+      description: `${siteName} scheduler (managed by ts-cloud)`,
+      workingDir: current,
+      execStart: driver.wrapExec(driver.schedulerCommand(ctx)),
+      environment: driver.execEnv
+    })));
+  }
+  const desiredList = desiredUnits.map((n) => `${n}.service`).join(" ");
+  out.push("systemctl daemon-reload", `TS_CLOUD_DESIRED="${desiredList}"`, `for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${reEscape(slug)}-${reEscape(siteName)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`, '  case " $TS_CLOUD_DESIRED " in', '    *" $unit "*) ;;', '    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;', "  esac", "done", "systemctl daemon-reload");
+  for (const name of desiredUnits) {
+    out.push(`systemctl enable ${name}.service`, `systemctl restart ${name}.service`);
+  }
+  const cronPath = schedulerCronPath(slug, siteName);
+  if (schedulerEnabled && driver.schedulerMode === "cron") {
+    const heartbeat = typeof scheduler === "object" && scheduler !== null ? scheduler : undefined;
+    let command = `${driver.schedulerCommand(ctx)} >> /dev/null 2>&1`;
+    if (heartbeat?.heartbeatUrl) {
+      const method = heartbeat.heartbeatMethod || "GET";
+      const methodFlag = method === "GET" ? "" : `-X ${method} `;
+      command += ` && curl -fsS -m 10 ${methodFlag}${cronQuote(heartbeat.heartbeatUrl)} >/dev/null 2>&1`;
     }
-    const tarball = join4(tmpdir(), `${options.slug}-${options.siteName ?? MANAGEMENT_DASHBOARD_SITE}-${options.sha}.tar.gz`);
-    execSync2(`tar czf "${tarball}" -C "${root}" .`, { stdio: "inherit" });
-    return tarball;
-  } catch (error) {
-    logger.warn(`Management dashboard: failed to build artifact — ${error?.message ?? error}. Skipping dashboard deploy.`);
-    return null;
+    const cron = `* * * * * root ${command}
+`.replace(/%/g, "\\%");
+    out.push(`cat > ${cronPath} <<'TS_CLOUD_CRON_EOF'`, cron.replace(/\n$/, ""), "TS_CLOUD_CRON_EOF", `chmod 644 ${cronPath}`);
+  } else {
+    out.push(`rm -f ${cronPath}`);
   }
+  return out;
+}
+function siteHasServices(site) {
+  return !!(site.queues?.length || site.daemons?.length || site.scheduler);
 }
 
 // src/drivers/shared/certbot.ts
@@ -4276,12 +4506,7 @@ function buildDnsCredentialsScript(dns) {
   const file = dnsCredentialsPath(dns.provider);
   const lines = Object.entries(dns.credentials).map(([k, v]) => `${k} = ${v}`).join(`
 `);
-  return [
-    `cat > ${file} <<'TS_CLOUD_DNSCREDS_EOF'`,
-    lines,
-    "TS_CLOUD_DNSCREDS_EOF",
-    `chmod 600 ${file}`
-  ];
+  return [`cat > ${file} <<'TS_CLOUD_DNSCREDS_EOF'`, lines, "TS_CLOUD_DNSCREDS_EOF", `chmod 600 ${file}`];
 }
 function buildCertbotIssueScript(options) {
   const dns = options.dns;
@@ -4334,10 +4559,7 @@ function buildGitCheckoutScript(options) {
   const { repository, releaseDir, commit } = options;
   const branch = repository.branch || DEFAULT_DEPLOY_BRANCH;
   const url = repository.url;
-  const lines = [
-    `rm -rf ${releaseDir}`,
-    `mkdir -p ${releaseDir}`
-  ];
+  const lines = [`rm -rf ${releaseDir}`, `mkdir -p ${releaseDir}`];
   if (repository.strategy === "tag") {
     if (repository.tag) {
       lines.push(`git clone -q --depth 1 --branch ${shellQuote(repository.tag)} ${shellQuote(url)} ${releaseDir}`);
@@ -4385,17 +4607,10 @@ function defaultDeployScriptFor(type) {
       ];
     case "php":
     case "wordpress":
-      return [
-        MACRO_CREATE_RELEASE,
-        `${COMPOSER_INSTALL} || true`,
-        MACRO_ACTIVATE_RELEASE
-      ];
+      return [MACRO_CREATE_RELEASE, `${COMPOSER_INSTALL} || true`, MACRO_ACTIVATE_RELEASE];
     case "static":
     case "spa":
-      return [
-        MACRO_CREATE_RELEASE,
-        MACRO_ACTIVATE_RELEASE
-      ];
+      return [MACRO_CREATE_RELEASE, MACRO_ACTIVATE_RELEASE];
   }
 }
 function substituteBins(line, phpBin) {
@@ -4403,12 +4618,7 @@ function substituteBins(line, phpBin) {
 }
 function writeSharedEnv(sharedEnvPath, env2) {
   const body = formatEnvFile(env2);
-  return [
-    `cat > ${sharedEnvPath} <<'TS_CLOUD_ENV_EOF'`,
-    body,
-    "TS_CLOUD_ENV_EOF",
-    `chmod 600 ${sharedEnvPath}`
-  ];
+  return [`cat > ${sharedEnvPath} <<'TS_CLOUD_ENV_EOF'`, body, "TS_CLOUD_ENV_EOF", `chmod 600 ${sharedEnvPath}`];
 }
 function writeFileHeredoc2(path, body, marker) {
   return [`cat > ${path} <<'${marker}'`, body.replace(/\n$/, ""), marker, `chmod 600 ${path}`];
@@ -4485,192 +4695,6 @@ function buildLaravelDeployScript(options) {
   return out;
 }
 
-// src/drivers/shared/app-frameworks.ts
-var PHP_SITE_TYPES2 = new Set(["laravel", "php", "statamic", "wordpress"]);
-function resolveSiteFramework(site) {
-  if (site.framework)
-    return site.framework;
-  if (site.type && PHP_SITE_TYPES2.has(site.type))
-    return "laravel";
-  return "stacks";
-}
-var PANTRY_ENV_EVAL = `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
-var BUN_BIN = "/usr/local/bin/bun";
-var STACKS_CLI = "storage/framework/core/buddy/src/cli.ts";
-var stacksDriver = {
-  id: "stacks",
-  wrapExec: (command) => command,
-  execEnv: { PATH: "/usr/local/bin:/usr/bin:/bin", BUN_INSTALL: "/root/.bun" },
-  schedulerMode: "daemon",
-  schedulerCommand: () => `${BUN_BIN} ${STACKS_CLI} schedule:run`,
-  queueWorkerCommand: (worker, { current }) => {
-    const flags = [
-      `--queue=${worker.queue || "default"}`,
-      `--sleep=${worker.sleep ?? 3}`,
-      `--tries=${worker.tries ?? 3}`,
-      `--timeout=${worker.timeout ?? 60}`
-    ];
-    return `${BUN_BIN} ${current}/${STACKS_CLI} queue:work ${flags.join(" ")}`;
-  }
-};
-var laravelDriver = {
-  id: "laravel",
-  wrapExec: (command) => `/bin/sh -lc '${PANTRY_ENV_EVAL}; exec ${command}'`,
-  schedulerMode: "cron",
-  schedulerCommand: ({ current }) => `cd ${current} && ${PANTRY_ENV_EVAL} && php artisan schedule:run`,
-  queueWorkerCommand: (worker, { current }) => {
-    const artisan = `${current}/artisan`;
-    if (worker.horizon)
-      return `php ${artisan} horizon`;
-    const flags = [
-      worker.connection || "default",
-      `--queue=${worker.queue || "default"}`,
-      `--sleep=${worker.sleep ?? 3}`,
-      `--tries=${worker.tries ?? 3}`,
-      `--timeout=${worker.timeout ?? 60}`,
-      `--memory=${worker.memory ?? 128}`
-    ];
-    if (worker.maxJobs)
-      flags.push(`--max-jobs=${worker.maxJobs}`);
-    if (worker.maxTime)
-      flags.push(`--max-time=${worker.maxTime}`);
-    return `php ${artisan} queue:work ${flags.join(" ")}`;
-  }
-};
-var DRIVERS = {
-  stacks: stacksDriver,
-  laravel: laravelDriver
-};
-function getAppFrameworkDriver(framework) {
-  return DRIVERS[framework] ?? stacksDriver;
-}
-
-// src/drivers/shared/app-services.ts
-function reEscape(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function cronQuote(value) {
-  return `'${value.split("'").join("'\\''")}'`;
-}
-function slugify(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unnamed";
-}
-function queueUnitName(slug, siteName, index) {
-  return `${slug}-${siteName}-queue-${index}`;
-}
-function daemonUnitName(slug, siteName, daemon, index) {
-  return `${slug}-${siteName}-daemon-${daemon.name ? slugify(daemon.name) : slugify(daemon.command).slice(0, 32) || String(index)}`;
-}
-function systemdUnit(opts) {
-  const lines = [
-    "[Unit]",
-    `Description=${opts.description}`,
-    "After=network.target",
-    "",
-    "[Service]",
-    "Type=simple",
-    `WorkingDirectory=${opts.workingDir}`,
-    ...Object.entries(opts.environment ?? {}).map(([k, v]) => `Environment="${k}=${v}"`),
-    `ExecStart=${opts.execStart}`,
-    `Restart=${opts.restart || "always"}`,
-    "RestartSec=5"
-  ];
-  if (opts.user)
-    lines.push(`User=${opts.user}`);
-  if (typeof opts.stopWaitSecs === "number")
-    lines.push(`TimeoutStopSec=${opts.stopWaitSecs}`);
-  lines.push("", "[Install]", "WantedBy=multi-user.target");
-  return `${lines.join(`
-`)}
-`;
-}
-function writeUnitScript(name, body) {
-  return [
-    `cat > /etc/systemd/system/${name}.service <<'TS_CLOUD_UNIT_EOF'`,
-    body.replace(/\n$/, ""),
-    "TS_CLOUD_UNIT_EOF"
-  ];
-}
-function schedulerCronPath(slug, siteName) {
-  return `/etc/cron.d/${slug}-${siteName}-scheduler`;
-}
-function buildSiteServicesScript(options) {
-  const { slug, siteName, site } = options;
-  const base = options.appBase ?? `/var/www/${siteName}`;
-  const current = `${base}/current`;
-  const driver = getAppFrameworkDriver(resolveSiteFramework(site));
-  const ctx = { current };
-  const out = [];
-  const desiredUnits = [];
-  const queues = site.queues || [];
-  queues.forEach((worker, qIndex) => {
-    const processes = Math.max(1, worker.processes ?? 1);
-    for (let p = 0;p < processes; p++) {
-      const name = queueUnitName(slug, siteName, desiredUnits.length);
-      desiredUnits.push(name);
-      out.push(...writeUnitScript(name, systemdUnit({
-        description: `${siteName} queue worker ${qIndex}.${p} (managed by ts-cloud)`,
-        workingDir: current,
-        execStart: driver.wrapExec(driver.queueWorkerCommand(worker, ctx)),
-        environment: driver.execEnv,
-        stopWaitSecs: worker.stopWaitSecs ?? 90
-      })));
-    }
-  });
-  const daemons = site.daemons || [];
-  daemons.forEach((daemon, dIndex) => {
-    const processes = Math.max(1, daemon.processes ?? 1);
-    for (let p = 0;p < processes; p++) {
-      const name = `${daemonUnitName(slug, siteName, daemon, dIndex)}-${p}`;
-      desiredUnits.push(name);
-      out.push(...writeUnitScript(name, systemdUnit({
-        description: `${siteName} daemon ${daemon.name || daemon.command} (managed by ts-cloud)`,
-        workingDir: daemon.directory || current,
-        execStart: driver.wrapExec(daemon.command),
-        environment: driver.execEnv,
-        restart: daemon.restart,
-        user: daemon.user
-      })));
-    }
-  });
-  const scheduler = site.scheduler;
-  const schedulerEnabled = scheduler === true || typeof scheduler === "object" && scheduler !== null;
-  const schedulerUnit = `${slug}-${siteName}-scheduler`;
-  if (schedulerEnabled && driver.schedulerMode === "daemon") {
-    desiredUnits.push(schedulerUnit);
-    out.push(...writeUnitScript(schedulerUnit, systemdUnit({
-      description: `${siteName} scheduler (managed by ts-cloud)`,
-      workingDir: current,
-      execStart: driver.wrapExec(driver.schedulerCommand(ctx)),
-      environment: driver.execEnv
-    })));
-  }
-  const desiredList = desiredUnits.map((n) => `${n}.service`).join(" ");
-  out.push("systemctl daemon-reload", `TS_CLOUD_DESIRED="${desiredList}"`, `for unit in $(ls /etc/systemd/system/ 2>/dev/null | grep -E '^${reEscape(slug)}-${reEscape(siteName)}-((queue|daemon)-.*|scheduler)\\.service$' || true); do`, '  case " $TS_CLOUD_DESIRED " in', '    *" $unit "*) ;;', '    *) systemctl stop "$unit" 2>/dev/null || true; systemctl disable "$unit" 2>/dev/null || true; rm -f "/etc/systemd/system/$unit" ;;', "  esac", "done", "systemctl daemon-reload");
-  for (const name of desiredUnits) {
-    out.push(`systemctl enable ${name}.service`, `systemctl restart ${name}.service`);
-  }
-  const cronPath = schedulerCronPath(slug, siteName);
-  if (schedulerEnabled && driver.schedulerMode === "cron") {
-    const heartbeat = typeof scheduler === "object" && scheduler !== null ? scheduler : undefined;
-    let command = `${driver.schedulerCommand(ctx)} >> /dev/null 2>&1`;
-    if (heartbeat?.heartbeatUrl) {
-      const method = heartbeat.heartbeatMethod || "GET";
-      const methodFlag = method === "GET" ? "" : `-X ${method} `;
-      command += ` && curl -fsS -m 10 ${methodFlag}${cronQuote(heartbeat.heartbeatUrl)} >/dev/null 2>&1`;
-    }
-    const cron = `* * * * * root ${command}
-`.replace(/%/g, "\\%");
-    out.push(`cat > ${cronPath} <<'TS_CLOUD_CRON_EOF'`, cron.replace(/\n$/, ""), "TS_CLOUD_CRON_EOF", `chmod 644 ${cronPath}`);
-  } else {
-    out.push(`rm -f ${cronPath}`);
-  }
-  return out;
-}
-function siteHasServices(site) {
-  return !!(site.queues?.length || site.daemons?.length || site.scheduler);
-}
-
 // src/drivers/shared/php-fpm-pool.ts
 var PHP_FPM_POOL_DIR = "/var/lib/pantry/php-fpm/pool.d";
 var POOL_PORT_BASE = 9100;
@@ -4742,16 +4766,7 @@ var noopLogger2 = {
   success: () => {}
 };
 async function deploySiteRelease(driver, options, logger = noopLogger2) {
-  const {
-    config,
-    environment,
-    siteName,
-    site,
-    slug,
-    sha,
-    runtime,
-    localTarballPath
-  } = options;
+  const { config, environment, siteName, site, slug, sha, runtime, localTarballPath } = options;
   const remoteKey = `releases/${siteName}/${sha}.tar.gz`;
   const stackName = resolveProjectStackName(config, environment);
   const outputs = await driver.getComputeOutputs({ config, environment });
@@ -4807,7 +4822,15 @@ async function deploySiteRelease(driver, options, logger = noopLogger2) {
     logger.step(`Deploying PHP site '${siteName}' to ${targets.length} target(s)...`);
     const phpResult = await driver.runRemoteDeploy({
       targets,
-      commands: [...buildSiteOwnerGuard(appBase2, slug), ...deployScript, ...poolScript, ...vhostScript, ...sslScript, ...servicesScript2, ...healthCheckScript],
+      commands: [
+        ...buildSiteOwnerGuard(appBase2, slug),
+        ...deployScript,
+        ...poolScript,
+        ...vhostScript,
+        ...sslScript,
+        ...servicesScript2,
+        ...healthCheckScript
+      ],
       comment: `ts-cloud deploy ${slug}/${siteName}@${sha}`,
       tags: { Project: slug, Environment: environment, Role: "app" }
     });
@@ -4970,7 +4993,13 @@ async function deployAllComputeSites(options) {
   let dashboardTarball = null;
   const dashboardTarballBySite = new Map;
   if (injectedDashboardSites.length > 0) {
-    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], { cwd, slug, sha, siteName: injectedDashboardSites[0], logger: { info: logger.info, warn: logger.warn } });
+    dashboardTarball = buildManagementDashboardArtifact(config.sites?.[injectedDashboardSites[0]], {
+      cwd,
+      slug,
+      sha,
+      siteName: injectedDashboardSites[0],
+      logger: { info: logger.info, warn: logger.warn }
+    });
     if (!dashboardTarball) {
       logger.warn("Management dashboard: no artifact available — skipping dashboard site(s) for this deploy.");
       for (const name of injectedDashboardSites) {
@@ -5182,7 +5211,11 @@ function cacheBehavior(pathPattern, kind) {
     TrustedKeyGroups: { Enabled: false, Quantity: 0 },
     LambdaFunctionAssociations: { Quantity: 0 },
     FunctionAssociations: { Quantity: 0 },
-    AllowedMethods: kind === "dynamic" ? { Quantity: 7, Items: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"], CachedMethods: { Quantity: 2, Items: ["GET", "HEAD"] } } : { Quantity: 3, Items: ["GET", "HEAD", "OPTIONS"], CachedMethods: { Quantity: 2, Items: ["GET", "HEAD"] } }
+    AllowedMethods: kind === "dynamic" ? {
+      Quantity: 7,
+      Items: ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"],
+      CachedMethods: { Quantity: 2, Items: ["GET", "HEAD"] }
+    } : { Quantity: 3, Items: ["GET", "HEAD", "OPTIONS"], CachedMethods: { Quantity: 2, Items: ["GET", "HEAD"] } }
   };
   if (pathPattern !== null)
     base.PathPattern = pathPattern;
@@ -5207,24 +5240,26 @@ function buildCloudFrontOriginConfig(options) {
     DefaultRootObject: "",
     Origins: {
       Quantity: 1,
-      Items: [{
-        Id: ORIGIN_ID,
-        DomainName: options.originDomain,
-        OriginPath: "",
-        CustomHeaders: customHeaders,
-        CustomOriginConfig: {
-          HTTPPort: 80,
-          HTTPSPort: 443,
-          OriginProtocolPolicy: "https-only",
-          OriginSslProtocols: { Quantity: 1, Items: ["TLSv1.2"] },
-          OriginReadTimeout: 30,
-          OriginKeepaliveTimeout: 5
-        },
-        ConnectionAttempts: 3,
-        ConnectionTimeout: 10,
-        OriginShield: options.originShield ? { Enabled: true, OriginShieldRegion: options.originShieldRegion } : { Enabled: false },
-        OriginAccessControlId: ""
-      }]
+      Items: [
+        {
+          Id: ORIGIN_ID,
+          DomainName: options.originDomain,
+          OriginPath: "",
+          CustomHeaders: customHeaders,
+          CustomOriginConfig: {
+            HTTPPort: 80,
+            HTTPSPort: 443,
+            OriginProtocolPolicy: "https-only",
+            OriginSslProtocols: { Quantity: 1, Items: ["TLSv1.2"] },
+            OriginReadTimeout: 30,
+            OriginKeepaliveTimeout: 5
+          },
+          ConnectionAttempts: 3,
+          ConnectionTimeout: 10,
+          OriginShield: options.originShield ? { Enabled: true, OriginShieldRegion: options.originShieldRegion } : { Enabled: false },
+          OriginAccessControlId: ""
+        }
+      ]
     },
     OriginGroups: { Quantity: 0 },
     DefaultCacheBehavior: cacheBehavior(null, "static"),
@@ -5246,4 +5281,4 @@ function buildCloudFrontOriginConfig(options) {
     CustomErrorResponses: { Quantity: 0 }
   };
 }
-export { siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, PANTRY_PROJECT_DIR, pgAdminCommand, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, BACKUP_RUNNER_PATH, buildBackupRestoreScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };
+export { PANTRY_PROJECT_DIR, pgAdminCommand, BACKUP_RUNNER_PATH, buildBackupRestoreScript, siteInstallBase, isPhpSite, resolveSiteDeployTarget, resolveSiteKind, validateDeploymentConfig, shipsARelease, DEFAULT_RPX_CERTS_DIR, normalizeRoutePath, deriveRouteId, buildRpxConfig, buildRpxLbConfig, renderRpxLauncher, RPX_DIR, RPX_LAUNCHER_PATH, RPX_SERVICE_NAME, buildRpxProvisionScript, buildRpxFragmentRefreshScript, buildUbuntuBootstrapScript, AwsDriver, resolveHetznerLocation, HetznerClient, resolveHetznerApiToken2 as resolveHetznerApiToken, normalizeSshPublicKey, wrapCloudInitUserData, HetznerDriver, LocalBoxDriver, isBoxMode, createCloudDriver, CloudDriverFactory, cloudDrivers, ensureSshKey, ensureFirewall, ensureServer, serverPublicIpv4, buildSshArgs, sshExec, sshExecOrThrow, scpUpload, waitForSsh, waitForCloudInit, UBUNTU_2404_AMI_PARAM, buildBoxUserData, HetznerBoxProvisioner, AwsBoxProvisioner, createBoxProvisioner, releasePaths, buildRollbackScript, resolveExecStart, buildSiteDeployScript, buildStaticSiteDeployScript, releaseTarballTmpPath, buildAwsArtifactFetch, buildLocalArtifactFetch, buildHostCleanupScript, MANAGEMENT_DASHBOARD_SITE, DASHBOARD_CREDENTIALS_FILE, resolveDashboardAuth, resolveUiSource, ensureManagementDashboard, buildManagementDashboardArtifact, resolveSiteFramework, deploySiteRelease, deployAllComputeSites, reloadRpxGateway, renewRpxCertificates, MANAGED_CACHE_POLICY_OPTIMIZED, MANAGED_CACHE_POLICY_DISABLED, MANAGED_ORIGIN_REQUEST_POLICY_ALL_VIEWER, buildCloudFrontOriginConfig };