home-hosted 0.8.2 → 0.9.0

package/dist/cli.js

@@ -709,7 +709,22 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restoreSkipSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
+/**
+* The ids that appear more than once, so a write can refuse them.
+*
+* A schema-level check is not available here (see above), and this is the one shape that has to
+* be told apart from a plain validation error: the list is valid, but its identity is not.
+*/
+function duplicateWebhookIds(targets) {
+	const seen = /* @__PURE__ */ new Set();
+	const duplicates = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		if (seen.has(target.id)) duplicates.add(target.id);
+		seen.add(target.id);
+	}
+	return [...duplicates];
+}
+var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, notificationPolicyShape, notificationDefaultsSchema, useOwnSettingsSchema, telegramDestinationSchema, webhookTargetSchema, notificationTargetSchema, destinationListSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupScheduleSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, notificationPolicyPatchShape, destinationPatchSchema, notificationsPatchSchema, hostPatchSchema, backupSchedulePatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, entryStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, notificationPolicyStatusShape, destinationStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyActorSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restoreSkipSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, destinationIdParamSchema, destinationTestSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	workspaceIdSchema = type("/^[a-z0-9][a-z0-9_-]*$/");
@@ -735,6 +750,10 @@ var init_contracts = __esmMin((() => {
 		resetAfterMs: "number >= 0 = 60000"
 	}).onUndeclaredKey("reject");
 	httpCheckSchema = type({
+		/** `https` is for a backend that serves TLS itself; pair it with `allowInvalidCert` when it is self-signed. */
+		scheme: "\"http\" | \"https\" = \"http\"",
+		/** Accept any certificate. A self-signed pair is the normal case here, and the probe is local. */
+		allowInvalidCert: "boolean = false",
 		/** Path on the server's own port, e.g. `/healthz`. */
 		path: "string = \"/\"",
 		method: "\"GET\" | \"HEAD\" = \"GET\"",
@@ -831,9 +850,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		maxLoginAttempts: "number.integer >= 1 = 5",
 		lockoutMs: "number >= 1000 = 60000"
 	}).onUndeclaredKey("reject");
-	telegramSchema = type({
-		enabled: "boolean = false",
-		chatId: "string = \"\"",
+	notificationPolicyShape = {
 		onCrash: "boolean = true",
 		onUnhealthy: "boolean = true",
 		onForcedRestart: "boolean = true",
@@ -844,8 +861,44 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onDdns: "boolean = true",
 		/** Per server *and* reason, so a flapping server cannot spam the chat. */
 		cooldownMs: "number >= 0 = 120000"
+	};
+	notificationDefaultsSchema = type({ ...notificationPolicyShape }).onUndeclaredKey("reject");
+	useOwnSettingsSchema = "boolean = true";
+	telegramDestinationSchema = type({
+		kind: "\"telegram\"",
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		/** Off until configured: a bare `enabled: true` with no chat would fail every send. */
+		enabled: "boolean = false",
+		chatId: "string = \"\"",
+		useOwnSettings: useOwnSettingsSchema,
+		...notificationPolicyShape
+	}).onUndeclaredKey("reject");
+	webhookTargetSchema = type({
+		kind: "\"webhook\"",
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		/** Empty only while the target is a draft; the page will not save one without it. */
+		url: "string = \"\"",
+		enabled: "boolean = true",
+		method: "\"POST\" | \"PUT\" = \"POST\"",
+		/** Payload format: `json` sends the event as JSON, `text` sends the plain message. */
+		format: "\"json\" | \"text\" = \"json\"",
+		/**
+		* Extra headers, `Name: value` per line. The one field that lets this transport talk to
+		* ntfy (`Title`, `Priority`), a bearer-token endpoint (`Authorization`) or anything else
+		* with a header-shaped contract.
+		*/
+		headers: "string = \"\"",
+		useOwnSettings: useOwnSettingsSchema,
+		...notificationPolicyShape
+	}).onUndeclaredKey("reject");
+	notificationTargetSchema = telegramDestinationSchema.or(webhookTargetSchema);
+	destinationListSchema = notificationTargetSchema.array();
+	notificationsSchema = type({
+		/** What every destination inherits unless it carries its own settings. */
+		defaults: notificationDefaultsSchema.default(() => ({})),
+		/** Replaced by a patch, the same way `ddns.accounts` is: a merge cannot express removing one. */
+		destinations: destinationListSchema.default(() => [])
 	}).onUndeclaredKey("reject");
-	notificationsSchema = type({ telegram: telegramSchema.default(() => ({})) }).onUndeclaredKey("reject");
 	logsSchema = type({
 		persist: "boolean = true",
 		/** Per server, before rotating to `.1`, `.2`, ... */
@@ -970,12 +1023,20 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		accounts: ddnsAccountSchema.array().optional(),
 		domains: ddnsDomainSchema.array().optional()
 	}).onUndeclaredKey("reject");
+	backupScheduleSchema = type({
+		/** 0 turns the schedule off; otherwise the gap between automatic archives. */
+		intervalMs: "number.integer >= 0 = 0",
+		/** How many automatic archives to keep. Manual ones are never pruned by it. */
+		keep: "number.integer >= 1 = 7"
+	}).onUndeclaredKey("reject");
 	backupsSchema = type({
 		enabled: "boolean = true",
 		dir: "string = \".backups\"",
+		/** How many archives to keep in total, newest first. */
 		keep: "number.integer >= 1 = 5",
 		/** Extra paths in every backup, in addition to each server's `backupPaths`. */
-		includePaths: type("string[]").default(() => [])
+		includePaths: type("string[]").default(() => []),
+		schedule: backupScheduleSchema.default(() => ({}))
 	}).onUndeclaredKey("reject");
 	controlSchema = type({
 		/** What the panel calls itself; the stock UI shows it in the sidebar. */
@@ -1006,6 +1067,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		resetAfterMs: "number >= 0?"
 	}).onUndeclaredKey("reject");
 	httpCheckPatchSchema = type({
+		scheme: "\"http\" | \"https\"?",
+		allowInvalidCert: "boolean?",
 		path: "string?",
 		method: "\"GET\" | \"HEAD\"?",
 		expectStatus: "number.integer | null?",
@@ -1037,9 +1100,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		maxLoginAttempts: "number.integer >= 1?",
 		lockoutMs: "number >= 1000?"
 	}).onUndeclaredKey("reject");
-	telegramPatchSchema = type({
-		enabled: "boolean?",
-		chatId: "string?",
+	notificationPolicyPatchShape = {
 		onCrash: "boolean?",
 		onUnhealthy: "boolean?",
 		onForcedRestart: "boolean?",
@@ -1047,8 +1108,36 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onHost: "boolean?",
 		onDdns: "boolean?",
 		cooldownMs: "number >= 0?"
+	};
+	destinationPatchSchema = type({
+		kind: "\"telegram\" | \"webhook\"",
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		enabled: "boolean?",
+		useOwnSettings: "boolean?",
+		/** Telegram only. */
+		chatId: "string?",
+		/** Webhook only. */
+		url: "string?",
+		method: "\"POST\" | \"PUT\"?",
+		format: "\"json\" | \"text\"?",
+		headers: "string?",
+		...notificationPolicyPatchShape
+	}).onUndeclaredKey("reject");
+	notificationsPatchSchema = type({
+		/** Merged key by key, like the other nested groups. */
+		/**
+		* A merge key-by-key, and **every field optional** — `notificationPolicyPatchShape`, not a
+		* `.partial()` of the defaults schema.
+		*
+		* ArkType's `.partial()` leaves a field's `= false` / `= 120000` default in place, so a body of
+		* `{ onHost: false }` validated into all seven keys and one toggle overwrote the rest. A patch
+		* schema here carries no defaults (the rule for every patch), and the store merges it over the
+		* stored block.
+		*/
+		defaults: type({ ...notificationPolicyPatchShape }).onUndeclaredKey("reject").optional(),
+		/** Replaced whole, so a removed destination stays removed. */
+		destinations: destinationPatchSchema.array().optional()
 	}).onUndeclaredKey("reject");
-	notificationsPatchSchema = type({ telegram: telegramPatchSchema.optional() }).onUndeclaredKey("reject");
 	hostPatchSchema = type({
 		enabled: "boolean?",
 		intervalMs: "number >= 5000?",
@@ -1059,11 +1148,16 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		loadPerCpu: "number >= 0?",
 		tempCelsius: "number >= 0?"
 	}).onUndeclaredKey("reject");
+	backupSchedulePatchSchema = type({
+		intervalMs: "number.integer >= 0?",
+		keep: "number.integer >= 1?"
+	}).onUndeclaredKey("reject");
 	backupsPatchSchema = type({
 		enabled: "boolean?",
 		dir: "string?",
 		keep: "number.integer >= 1?",
-		includePaths: type("string[]").optional()
+		includePaths: type("string[]").optional(),
+		schedule: backupSchedulePatchSchema.optional()
 	}).onUndeclaredKey("reject");
 	logsPatchSchema = type({
 		persist: "boolean?",
@@ -1154,6 +1248,19 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"heartbeatAt": "number",
 		"lastExit?": nannyExitSchema
 	}).onUndeclaredKey("reject");
+	entryStateSchema = type({
+		/** Attempts spent on the current crash sequence; reset once the process stays up. */
+		"restarts": "number.integer >= 0",
+		/** The `runOnce` bootstrap already ran for this entry. */
+		"bootstrapDone": "boolean",
+		/**
+		* The last child this panel spawned for a non-persistent entry. A detached child
+		* outlives the panel, so this is the only way a later boot recognizes its own
+		* survivor instead of spawning a second copy beside it.
+		*/
+		"lastPid?": "number | null",
+		"lastStartedAt?": "number | null"
+	});
 	settingsPatchSchema = type({
 		control: controlPatchSchema.optional(),
 		host: hostPatchSchema.optional(),
@@ -1371,10 +1478,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		privateKey: "string >= 1"
 	}).onUndeclaredKey("reject");
 	proxyEngineInstallSchema = type({ version: "string = \"\"" }).onUndeclaredKey("reject");
-	telegramStatusSchema = type({
-		enabled: "boolean",
-		tokenSet: "boolean",
-		chatId: "string",
+	notificationPolicyStatusShape = {
 		onCrash: "boolean",
 		onUnhealthy: "boolean",
 		onForcedRestart: "boolean",
@@ -1383,8 +1487,24 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onHost: "boolean",
 		/** Dynamic DNS, when this panel knows about it (optional for an older panel). */
 		onDdns: "boolean?",
-		cooldownMs: "number",
-		/** Last delivery outcome, for the settings page. */
+		cooldownMs: "number"
+	};
+	destinationStatusSchema = type({
+		id: "string",
+		kind: "\"telegram\" | \"webhook\"",
+		enabled: "boolean",
+		useOwnSettings: "boolean",
+		...notificationPolicyStatusShape,
+		/** Telegram only, null on a webhook. */
+		chatId: "string | null",
+		/** Telegram only: whether a bot token is stored for this destination. */
+		tokenSet: "boolean",
+		/** Webhook only, null on a Telegram destination. */
+		url: "string | null",
+		method: "\"POST\" | \"PUT\" | null",
+		format: "\"json\" | \"text\" | null",
+		headers: "string | null",
+		/** Last delivery outcome, for the page. */
 		lastResult: "string | null",
 		lastResultAt: "number | null"
 	});
@@ -1392,7 +1512,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		id: "string | number",
 		title: "string"
 	}).array() });
-	notificationViewSchema = type({ telegram: telegramStatusSchema });
+	notificationViewSchema = type({
+		/** The general block: what a destination inherits unless it overrides it. Optional for an older panel. */
+		"defaults?": notificationDefaultsSchema,
+		/** Every destination, in config order. Optional for an older panel. */
+		"destinations?": destinationStatusSchema.array()
+	});
 	sessionViewSchema = type({
 		authenticated: "boolean",
 		authRequired: "boolean",
@@ -1419,13 +1544,16 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		stream: logStreamSchema,
 		text: "string"
 	});
+	historyActorSchema = type.enumerated("policy", "user", "agent", "boot");
 	historyEventSchema = type({
-		serverId: "string",
-		ts: "number",
-		type: "\"start\" | \"exit\" | \"crash\" | \"forced-restart\" | \"unhealthy\" | \"recovered\"",
-		detail: "string",
+		"serverId": "string",
+		"ts": "number",
+		"type": "\"start\" | \"exit\" | \"crash\" | \"forced-restart\" | \"unhealthy\" | \"recovered\"",
+		"detail": "string",
 		/** How long the process had been up, recorded on exit and crash. */
-		runtimeMs: "number?"
+		"runtimeMs": "number?",
+		/** Who caused it; absent on events from before this field existed. */
+		"actor?": historyActorSchema
 	});
 	serverHistorySchema = type({
 		windowMs: "number",
@@ -1497,6 +1625,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 			"labelParams?": "Record<string, string>",
 			/** `settings`/`servers`/`secrets` for a workspace, `data` for a declared path. */
 			"kind": "\"settings\" | \"servers\" | \"secrets\" | \"data\"",
+			/** Which secret a `secrets` leaf carries (`password`, `apiToken`, `telegram`, `ddns`, …). */
+			"secret?": "string",
 			"path?": "string",
 			/** Who declared a data path: `global`, `<serverId>:backupPaths` or `<serverId>:<ENV>`. */
 			"origin?": "string",
@@ -1508,14 +1638,24 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		}).array()
 	});
 	backupsViewSchema = type({
-		enabled: "boolean",
-		dir: "string",
-		keep: "number",
+		"enabled": "boolean",
+		"dir": "string",
+		"keep": "number",
+		/**
+		* The scheduled half, so the page can show and edit it.
+		*
+		* Optional because the panel and the UI upgrade separately: an older panel does not send it,
+		* and a required field would blank the settings page for that panel. The page reads it as
+		* "off, keep 7" when absent — the schema defaults — so nothing changes for it.
+		*/
+		"schedule?": backupScheduleSchema,
+		/** When the last automatic archive was written; null until one has run. Optional for the same reason. */
+		"lastAutomaticAt?": "number | null",
 		/** Extra paths from the global config, in addition to each server's own. */
-		includePaths: type("string[]"),
+		"includePaths": type("string[]"),
 		/** Every selectable entry, global first, then each workspace. */
-		entries: backupEntrySchema.array(),
-		files: backupFileSchema.array()
+		"entries": backupEntrySchema.array(),
+		"files": backupFileSchema.array()
 	});
 	restoreItemSchema = type({
 		/** A backup entry or leaf id (`workspace:<id>:servers`, `data:<path>`, ...). */
@@ -1546,6 +1686,14 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"encrypted": "boolean",
 		/** The archive needs a password (none or a wrong one was supplied). */
 		"needsPassword": "boolean",
+		/**
+		* Where the archive says it came from. Optional: an archive written before this
+		* stamp existed carries neither field, and an older panel never sends the row.
+		*/
+		"archive?": type({
+			"writtenBy?": "string",
+			"schema?": "number"
+		}),
 		"items": restoreItemSchema.array(),
 		"applied": type("string[]"),
 		/**
@@ -1636,11 +1784,11 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"files?": "number.integer >= 1",
 		/** `owner/name` of the UI's own repository, for `ui-update`. */
 		"repo?": "string",
-		/** The release tag this build came from, e.g. `v0.6.0`. */
+		/** The release tag this build came from, e.g. `v0.6.0`. Stamped by the build, never committed. */
 		"tag?": "string",
 		/** The release asset name, e.g. `home-hosted-ui-noc-console`. */
 		"asset?": "string",
-		/** When the UI was built, in unix epoch seconds. */
+		/** When the UI was built, in unix epoch seconds. Stamped by the build, never committed. */
 		"unix?": "number.integer >= 0"
 	});
 	uiStatusSchema = type({
@@ -1740,10 +1888,19 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		lines: logLineSchema.array()
 	});
 	notificationActionSchema = type({
-		/** Optional override, so the token can be tested before it is saved. */
+		/** Optional override, so the token can be tried before it is saved. */
 		botToken: "string?",
 		chatId: "string?"
 	}).onUndeclaredKey("reject");
+	destinationIdParamSchema = type({ id: "/^[a-z0-9][a-z0-9_-]*$/" });
+	destinationTestSchema = type({
+		target: webhookTargetSchema.omit("kind", "id").and(type({
+			id: "string?",
+			kind: "\"webhook\"?"
+		})),
+		/** Echoed so the result is recorded against the right row; absent for a draft. */
+		id: "string?"
+	}).onUndeclaredKey("reject");
 	telegramTokenSchema = type({ botToken: "string >= 1" }).onUndeclaredKey("reject");
 	apiErrorSchema = type({
 		"message": "string",
@@ -1941,6 +2098,20 @@ function isPlainDdns(value) {
 	return "plain" in value;
 }
 /**
+* The bot tokens by destination id.
+*
+* Two shapes read: the map this release writes, and the single `{ botToken }` written before a
+* workspace could have more than one Telegram destination. The old one arrives under the id the
+* config migration gave the destination it came from, so an upgrade keeps a working Telegram.
+*/
+function readTelegramTokens(value) {
+	if (!isRecord(value)) return {};
+	if (typeof value.botToken === "string") return value.botToken.trim().length > 0 ? { [LEGACY_TELEGRAM_ID$1]: value.botToken.trim() } : {};
+	const tokens = {};
+	for (const [id, token] of Object.entries(value)) if (typeof token === "string" && token.trim().length > 0) tokens[id] = token.trim();
+	return tokens;
+}
+/**
 * Sealed on disk, or `{ provider, values }` waiting for the sealing write. A bare
 * field map — written before the provider was recorded — no longer reads, because
 * there is nothing to say which provider those fields belong to.
@@ -2022,7 +2193,7 @@ function openDdns(accountId, sealed, key) {
 		return null;
 	}
 }
-var COST, KEYLEN, SALT_BYTES, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_SEALED_ALGO, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
+var COST, KEYLEN, SALT_BYTES, LEGACY_TELEGRAM_ID$1, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_SEALED_ALGO, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
 var init_secrets = __esmMin((() => {
 	init_atomic();
 	init_logger();
@@ -2035,6 +2206,7 @@ var init_secrets = __esmMin((() => {
 	};
 	KEYLEN = 64;
 	SALT_BYTES = 16;
+	LEGACY_TELEGRAM_ID$1 = "telegram";
 	DDNS_KEYLEN = 32;
 	DDNS_IV_BYTES = 12;
 	DDNS_AAD_PREFIX = "hh-ddns-v1:";
@@ -2112,11 +2284,17 @@ var init_secrets = __esmMin((() => {
 		get apiTokenHint() {
 			return this.apiToken?.hint ?? null;
 		}
-		get telegramToken() {
-			return this.load().telegram?.botToken ?? null;
+		/** The bot token for one destination, or null when it has none. */
+		telegramToken(id) {
+			const token = this.load().telegram[id] ?? "";
+			return token.length > 0 ? token : null;
+		}
+		telegramTokenSet(id) {
+			return this.telegramToken(id) !== null;
 		}
-		get telegramTokenSet() {
-			return (this.telegramToken ?? "").length > 0;
+		/** Every destination id a token is stored for — including one the config no longer declares. */
+		get telegramTokenIds() {
+			return Object.keys(this.load().telegram).sort();
 		}
 		setPassword(password, options = {}) {
 			const record = hashPassword(password, options);
@@ -2151,11 +2329,24 @@ var init_secrets = __esmMin((() => {
 				apiToken: null
 			});
 		}
-		setTelegramToken(token) {
+		setTelegramToken(id, token) {
 			const trimmed = token?.trim() ?? "";
+			const current = { ...this.load().telegram };
+			if (trimmed.length > 0) current[id] = trimmed;
+			else delete current[id];
 			this.save({
 				...this.load(),
-				telegram: trimmed.length > 0 ? { botToken: trimmed } : null
+				telegram: current
+			});
+		}
+		/** Drops every token whose destination is gone, so a deleted target leaves nothing behind. */
+		forgetTelegramTokens(keep) {
+			const allowed = new Set(keep);
+			const current = this.load().telegram;
+			const next = Object.fromEntries(Object.entries(current).filter(([id]) => allowed.has(id)));
+			if (Object.keys(next).length !== Object.keys(current).length) this.save({
+				...this.load(),
+				telegram: next
 			});
 		}
 		/** Ids that have something stored, whether or not a config still declares them. */
@@ -2260,7 +2451,7 @@ var init_secrets = __esmMin((() => {
 			const empty = {
 				password: null,
 				apiToken: null,
-				telegram: null,
+				telegram: {},
 				ddns: {},
 				ddnsKdf: null
 			};
@@ -2277,7 +2468,7 @@ var init_secrets = __esmMin((() => {
 				return this.inScope({
 					password: parsed?.password ?? null,
 					apiToken: parsed?.apiToken?.hash ? parsed.apiToken : null,
-					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null,
+					telegram: readTelegramTokens(parsed?.telegram),
 					ddns: readStoredDdns(parsed?.ddns),
 					ddnsKdf: readDdnsKdf(parsed?.ddnsKdf)
 				});
@@ -2290,7 +2481,7 @@ var init_secrets = __esmMin((() => {
 		inScope(contents) {
 			if (this.scope === "global") return {
 				...contents,
-				telegram: null,
+				telegram: {},
 				ddns: {},
 				ddnsKdf: null
 			};
@@ -2635,6 +2826,14 @@ function createAuthGuard(deps) {
 		await next();
 	};
 }
+/**
+* Who is behind a request, as a history event names them: a cookie is a person at
+* the panel, a bearer token is a script or an agent. Anonymous callers can only be
+* loopback requests while auth is unarmed, which is the browser's own origin.
+*/
+function requestActor(c, auth) {
+	return requestIdentity(c, auth).method === "token" ? "agent" : "user";
+}
 var PUBLIC_PATHS, AUTH_REQUIRED_CODE;
 var init_auth = __esmMin((() => {
 	init_loopback();
@@ -3087,7 +3286,10 @@ function buildWorkspaceView(source) {
 		logsDir: source.logsDir,
 		defaults: source.store.defaults,
 		logs: source.store.logs,
-		notifications: { telegram: source.notifications.status() },
+		notifications: {
+			defaults: source.notifications.defaults(),
+			destinations: source.notifications.destinations()
+		},
 		ddns: source.ddns.view,
 		serverCount: servers.length,
 		runningCount: servers.filter((server) => server.status === "running").length,
@@ -3643,7 +3845,7 @@ function createControlRoute(deps) {
 		}
 	}), validate("query", workspaceQuerySchema), async (c) => {
 		assertLocalCall(c, "start or stop a server");
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.param("id"));
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.param("id"), { actor: "user" });
 		return c.json(result, statusForAction(result));
 	}).post("/servers/:id/stop", describeRoute({
 		tags: ["panel"],
@@ -3667,7 +3869,7 @@ function createControlRoute(deps) {
 		}
 	}), validate("query", workspaceQuerySchema), async (c) => {
 		assertLocalCall(c, "restart a server");
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.param("id"));
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.param("id"), { actor: "user" });
 		return c.json(result, statusForAction(result));
 	});
 }
@@ -3683,9 +3885,55 @@ var init_control = __esmMin((() => {
 }));
 //#endregion
 //#region src/config/migrations.ts
+/**
+* Schema 1 → 2: `notifications.{telegram, webhooks}` → `notifications.{defaults, destinations}`.
+*
+* The old singleton becomes one `telegram` destination, and each webhook keeps its id, so a
+* destination's cooldown, last-result record and Telegram token all still point at the same thing.
+* `useOwnSettings` is set **true** on every migrated destination: before this schema each one
+* carried its own toggles, and reading one as "inherit" would silently change what it delivers.
+* The old webhook `enabled` default (true) and the Telegram one (false) are preserved as they were.
+*/
+function notificationsToDestinations(config) {
+	const notifications = config.notifications;
+	if (notifications === null || typeof notifications !== "object" || Array.isArray(notifications)) return config;
+	const group = notifications;
+	if (group.destinations !== void 0 || group.telegram === void 0 && group.webhooks === void 0) return config;
+	const destinations = [];
+	const telegram = group.telegram;
+	if (telegram !== null && typeof telegram === "object") {
+		const { enabled, chatId, ...policy } = telegram;
+		destinations.push({
+			kind: "telegram",
+			id: LEGACY_TELEGRAM_ID,
+			enabled: enabled ?? false,
+			chatId: chatId ?? "",
+			useOwnSettings: true,
+			...policy
+		});
+	}
+	if (Array.isArray(group.webhooks)) for (const entry of group.webhooks) {
+		if (entry === null || typeof entry !== "object") continue;
+		destinations.push({
+			kind: "webhook",
+			useOwnSettings: true,
+			...entry
+		});
+	}
+	const next = {
+		...group,
+		destinations
+	};
+	delete next.telegram;
+	delete next.webhooks;
+	return {
+		...config,
+		notifications: next
+	};
+}
 /** What would have to run to bring `from` up to `to`. */
 function planConfigMigrations(from, options = {}) {
-	const to = options.to ?? 1;
+	const to = options.to ?? 2;
 	const steps = (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to);
 	return {
 		from,
@@ -3695,19 +3943,42 @@ function planConfigMigrations(from, options = {}) {
 		reached: steps.at(-1)?.to ?? from
 	};
 }
-/** Applies the plan in order; the caller owns writing the result. */
+/**
+* Applies the plan in order; the caller owns writing the result.
+*
+* The result carries `meta.schema` set to the schema the steps reached, so it is readable by this
+* release's own parser — which refuses a file whose stamp still says an older schema. Without that,
+* `migrate` validated its own output as "needs 1 migration" and refused every config it exists to
+* lift.
+*/
 function applyConfigMigrations(config, from, options = {}) {
-	const { steps } = planConfigMigrations(from, options);
+	const plan = planConfigMigrations(from, options);
 	let current = config;
-	for (const step of steps) current = step.apply(current);
-	return {
+	for (const step of plan.steps) current = step.apply(current);
+	if (plan.steps.length === 0) return {
 		config: current,
-		applied: steps
+		applied: plan.steps
+	};
+	const meta = current.meta !== null && typeof current.meta === "object" && !Array.isArray(current.meta) ? current.meta : {};
+	return {
+		config: {
+			...current,
+			meta: {
+				...meta,
+				schema: plan.reached
+			}
+		},
+		applied: plan.steps
 	};
 }
-var configMigrations;
+var LEGACY_TELEGRAM_ID, configMigrations;
 var init_migrations = __esmMin((() => {
-	configMigrations = [];
+	LEGACY_TELEGRAM_ID = "telegram";
+	configMigrations = [{
+		to: 2,
+		describe: "notifications: fold the Telegram singleton and the webhook list into one `destinations` list, with a shared `defaults` block",
+		apply: notificationsToDestinations
+	}];
 }));
 //#endregion
 //#region src/config/parse.ts
@@ -3771,10 +4042,10 @@ function readStamp(raw, options) {
 	const meta = isRecord(raw.meta) ? raw.meta : null;
 	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
 	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
-	if (schemaVersion > 1) return {
+	if (schemaVersion > 2) return {
 		schemaVersion,
 		writtenBy,
-		error: `written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`
+		error: `written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 2`
 	};
 	const { steps } = planConfigMigrations(schemaVersion, options);
 	if (steps.length > 0) return {
@@ -3931,6 +4202,7 @@ function validateCrossField(servers) {
 	for (const server of servers) {
 		const { health } = server;
 		if (health.mode === "http" && health.http.method === "HEAD" && health.http.expectBody.length > 0) errors.push(`"${server.id}" requires a response body with method HEAD, which has none — the body check is ignored`);
+		if (health.mode === "http" && health.http.scheme === "http" && health.http.allowInvalidCert) errors.push(`"${server.id}" sets allowInvalidCert on an http probe, where there is no certificate to check`);
 		for (const dependency of server.dependsOn) if (dependency === server.id) errors.push(`"${server.id}" depends on itself`);
 		else if (!ids.has(dependency)) errors.push(`"${server.id}" depends on unknown server "${dependency}"`);
 	}
@@ -3958,7 +4230,7 @@ function stampConfig(draft) {
 		...$schema === void 0 ? {} : { $schema },
 		meta: {
 			writtenBy: appVersion(),
-			schema: 1
+			schema: 2
 		},
 		...rest
 	};
@@ -4009,7 +4281,7 @@ function mergeGroup(target, patch) {
 	}
 	return merged;
 }
-var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, PROXY_MERGE_KEYS, EMPTY_MERGE_KEYS;
+var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, PROXY_MERGE_KEYS, BACKUP_MERGE_KEYS, EMPTY_MERGE_KEYS;
 var init_patch = __esmMin((() => {
 	init_shape();
 	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
@@ -4018,9 +4290,10 @@ var init_patch = __esmMin((() => {
 		"stop"
 	]);
 	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
-	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
+	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["defaults"]);
 	DDNS_MERGE_KEYS = /* @__PURE__ */ new Set(["ipv4", "ipv6"]);
 	PROXY_MERGE_KEYS = /* @__PURE__ */ new Set(["dns01"]);
+	BACKUP_MERGE_KEYS = /* @__PURE__ */ new Set(["schedule"]);
 	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
 }));
 //#endregion
@@ -4210,7 +4483,7 @@ var init_settings$1 = __esmMin((() => {
 		updateBackups(patch) {
 			const draft = structuredClone(this.raw);
 			draft.backups = { ...draft.backups ?? {} };
-			applyPatch(draft.backups, patch, EMPTY_MERGE_KEYS);
+			applyPatch(draft.backups, patch, BACKUP_MERGE_KEYS);
 			const backups = this.parseGroup(backupsSchema, draft.backups, "backups");
 			this.commit(draft);
 			return backups;
@@ -5772,6 +6045,171 @@ var init_ddns$2 = __esmMin((() => {
 	BY_ID$1 = new Map(DDNS_PROVIDERS.map((provider) => [provider.id, provider]));
 }));
 //#endregion
+//#region src/helpers/env-file.ts
+/** `KEY=value` files, with optional `export `, `#` comments and quoted values. */
+function parseEnvFile(text) {
+	const env = {};
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (line.length === 0 || line.startsWith("#")) continue;
+		const assignment = line.startsWith("export ") ? line.slice(7) : line;
+		const separator = assignment.indexOf("=");
+		if (separator <= 0) continue;
+		const key = assignment.slice(0, separator).trim();
+		let value = assignment.slice(separator + 1).trim();
+		if (value.length > 1 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+		env[key] = value;
+	}
+	return env;
+}
+/** Missing files are not an error: an env file is an optional override layer. */
+function loadEnvFile(file) {
+	try {
+		return {
+			env: parseEnvFile(fs.readFileSync(file, "utf8")),
+			path: file,
+			error: null
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			env: {},
+			path: file,
+			error: null
+		};
+		return {
+			env: {},
+			path: file,
+			error: errorMessage(error)
+		};
+	}
+}
+/** Expands `${VAR}` from the given vars; unknown references are left visible. */
+function expandEnv(value, vars) {
+	return value.replace(VARIABLE, (match, name) => vars[name] ?? match);
+}
+function expandEnvRecord(record, vars) {
+	return Object.fromEntries(Object.entries(record).map(([key, value]) => [key, expandEnv(value, vars)]));
+}
+function expandEnvList(values, vars) {
+	return values.map((value) => expandEnv(value, vars));
+}
+function resolveEnvFilePath(file, cwd) {
+	if (path.isAbsolute(file)) return file;
+	return path.resolve(cwd, file);
+}
+var VARIABLE;
+var init_env_file = __esmMin((() => {
+	init_error_message();
+	VARIABLE = /\$\{([A-Z_]\w*)\}/gi;
+}));
+//#endregion
+//#region src/providers/webhook.ts
+/** The JSON body for one event. Exported so a test can pin the shape without a round trip. */
+function webhookPayload(event, now = Date.now()) {
+	const text = `${event.title}\n${event.message}`;
+	return {
+		text,
+		content: text,
+		title: event.title,
+		message: event.message,
+		reason: event.reason,
+		server: event.serverId.length > 0 ? event.serverId : null,
+		label: event.label.length > 0 ? event.label : null,
+		at: now
+	};
+}
+/**
+* `Name: value` lines into a header map.
+*
+* The format is line-based rather than a JSON object because it is edited in a textarea, and
+* a value with a colon in it (`Authorization: Bearer a:b`) must survive: only the **first**
+* colon separates the two.
+*
+* `vars` expands `${ENV}` in the values, so a credential does not have to be written into the
+* config file. A name the panel's environment does not define is left as written, the same rule
+* `expandEnv` follows everywhere else.
+*/
+function parseHeaders(text, vars = process.env) {
+	const headers = {};
+	const errors = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+		const at = trimmed.indexOf(":");
+		if (at <= 0) {
+			errors.push(`"${trimmed}" is not a "Name: value" header`);
+			continue;
+		}
+		headers[trimmed.slice(0, at).trim()] = expandEnv(trimmed.slice(at + 1).trim(), vars);
+	}
+	return {
+		headers,
+		errors
+	};
+}
+/** Why a target cannot be sent to, or null when it can. Also used to validate a save. */
+function targetProblem(target, options = {}) {
+	const url = target.url.trim();
+	if (url.length === 0) return options.requireUrl === false ? null : "no URL configured";
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return "the URL is not valid";
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return `the URL must be http or https, not ${parsed.protocol}`;
+	const { errors } = parseHeaders(target.headers);
+	return errors.length > 0 ? errors.join("; ") : null;
+}
+async function sendWebhook(target, event, fetchImpl) {
+	const problem = targetProblem(target);
+	if (problem !== null) return {
+		ok: false,
+		error: problem
+	};
+	const { headers, errors } = parseHeaders(target.headers);
+	if (errors.length > 0) return {
+		ok: false,
+		error: errors.join("; ")
+	};
+	const payload = webhookPayload(event);
+	const asText = target.format === "text";
+	const body = asText ? payload.message : JSON.stringify(payload);
+	const url = expandEnv(target.url.trim(), process.env);
+	if (url.includes("${")) return {
+		ok: false,
+		error: `the URL still holds an unexpanded placeholder: ${url}`
+	};
+	try {
+		const response = await (fetchImpl ?? fetch)(url, {
+			method: target.method,
+			headers: {
+				"content-type": asText ? "text/plain; charset=utf-8" : "application/json",
+				...headers
+			},
+			body,
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!response.ok) {
+			const trimmed = (await response.text().catch(() => "")).trim().slice(0, 200);
+			return {
+				ok: false,
+				error: `answered ${response.status}${trimmed.length > 0 ? `: ${trimmed}` : ""}`
+			};
+		}
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: errorMessage(error)
+		};
+	}
+}
+var init_webhook = __esmMin((() => {
+	init_env_file();
+	init_error_message();
+}));
+//#endregion
 //#region src/config/store.ts
 function readFile(file) {
 	let text;
@@ -5817,6 +6255,8 @@ var init_store = __esmMin((() => {
 	init_settings$1();
 	init_atomic();
 	init_ddns$2();
+	init_webhook();
+	init_contracts();
 	WorkspaceStore = class {
 		workspaceId;
 		settingsFile;
@@ -6036,6 +6476,13 @@ var init_store = __esmMin((() => {
 			draft.notifications = { ...draft.notifications ?? {} };
 			applyPatch(draft.notifications, patch, NOTIFICATION_MERGE_KEYS);
 			const notifications = this.parseGroup(notificationsSchema, draft.notifications, "notifications");
+			const duplicates = duplicateWebhookIds(notifications.destinations);
+			if (duplicates.length > 0) throw new ConfigError(`notifications: duplicate webhook id ${duplicates.map((id) => `"${id}"`).join(", ")}`);
+			for (const target of notifications.destinations) {
+				if (target.kind !== "webhook") continue;
+				const problem = targetProblem(target, { requireUrl: true });
+				if (problem !== null) throw new ConfigError(`notifications: webhook "${target.id}" ${problem}`);
+			}
 			this.commitSettings(draft);
 			return notifications;
 		}
@@ -6423,8 +6870,8 @@ var init_events = __esmMin((() => {
 /**
 * Liveness for external monitors. Mounted outside `/api`, so it answers without a
 * session: it reports whether the panel itself is serving, and 503 when an
-* autostart server has crashed. Server details are only included for an
-* authenticated caller.
+* autostart server has crashed, or a running one is failing its own health check.
+* Server details are only included for an authenticated caller.
 */
 function createHealthRoute(deps) {
 	return appFactory.createApp().get("/healthz", describeRoute({
@@ -6435,12 +6882,12 @@ function createHealthRoute(deps) {
 				description: "Serving",
 				content: jsonBody(healthResponseSchema)
 			},
-			503: { description: "An autostart server has crashed" }
+			503: { description: "An autostart server has crashed, or a running one is unhealthy" }
 		}
 	}), (c) => {
 		const state = deps.panel.getState();
 		const servers = state.workspaces.flatMap((workspace) => workspace.servers);
-		const broken = servers.filter((server) => server.config.autostart && server.status === "crashed");
+		const broken = servers.filter((server) => server.config.autostart && server.status === "crashed" || server.status === "running" && server.health === "unhealthy");
 		const authenticated = requestIdentity(c, deps.auth).authenticated;
 		return c.json({
 			status: broken.length > 0 ? "degraded" : "ok",
@@ -6735,58 +7182,77 @@ var init_telegram = __esmMin((() => {
 //#endregion
 //#region src/api/notifications.ts
 /**
-* The bot token is written straight to a workspace's secrets file and never into a
+* A destination's credential is written straight to a workspace's secrets file and never into a
 * servers config, so notification *policy* and the *credential* stay separate.
 *
-* Notifications belong to a workspace: each one keeps its own token and chat.
+* Notifications belong to a workspace, and every route is scoped to one. The token is keyed by the
+* **destination id**, which is what lets a workspace point at more than one Telegram chat.
 */
 function createNotificationsRoute(deps) {
-	return appFactory.createApp().put("/notifications/token", describeRoute({
+	const runtimeFor = (workspace) => requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), workspace);
+	return appFactory.createApp().put("/notifications/destinations/:id/token", describeRoute({
 		tags: ["notifications"],
-		summary: "Store the Telegram bot token (verified first)",
+		summary: "Store a Telegram destination's bot token (verified first)",
 		responses: {
 			200: { description: "Stored" },
 			400: ERROR_RESPONSES[400]
 		}
-	}), validate("query", workspaceQuerySchema), validate("json", telegramTokenSchema), async (c) => {
-		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), validate("json", telegramTokenSchema), async (c) => {
+		const runtime = runtimeFor(c.req.valid("query").workspace);
+		const id = c.req.valid("param").id;
 		const { botToken } = c.req.valid("json");
 		const verified = await runtime.notifications.verifyToken(botToken);
 		if (!verified.ok) throw new DetailedError(`telegram rejected the token: ${verified.error ?? "unknown error"}`, {
 			statusCode: 400,
 			code: "TELEGRAM_TOKEN_REJECTED"
 		});
-		runtime.secrets.setTelegramToken(botToken);
+		runtime.secrets.setTelegramToken(id, botToken);
 		forgetBots();
 		return c.json({
 			ok: true,
 			username: verified.username ?? null
 		});
-	}).delete("/notifications/token", describeRoute({
+	}).delete("/notifications/destinations/:id/token", describeRoute({
 		tags: ["notifications"],
-		summary: "Forget the Telegram bot token",
+		summary: "Forget a Telegram destination's bot token",
 		responses: { 200: { description: "Removed" } }
-	}), validate("query", workspaceQuerySchema), (c) => {
-		requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).secrets.setTelegramToken(null);
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), (c) => {
+		runtimeFor(c.req.valid("query").workspace).secrets.setTelegramToken(c.req.valid("param").id, null);
 		forgetBots();
 		return c.json({ ok: true });
-	}).post("/notifications/test", describeRoute({
+	}).post("/notifications/destinations/:id/test", describeRoute({
 		tags: ["notifications"],
-		summary: "Send a test message",
+		summary: "Send a test message to one destination",
 		responses: {
 			200: { description: "Sent or refused" },
 			400: ERROR_RESPONSES[400]
 		}
-	}), validate("query", workspaceQuerySchema), validate("json", notificationActionSchema), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).notifications.sendTest(c.req.valid("json"));
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), validate("json", notificationActionSchema), async (c) => {
+		const result = await runtimeFor(c.req.valid("query").workspace).notifications.sendTest(c.req.valid("param").id, c.req.valid("json"));
 		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
 			statusCode: 400,
 			code: "TELEGRAM_SEND_FAILED"
 		});
 		return c.json(result);
-	}).post("/notifications/detect-chats", describeRoute({
+	}).post("/notifications/test-webhook", describeRoute({
+		tags: ["notifications"],
+		summary: "Send a test to one webhook destination",
+		responses: {
+			200: { description: "Sent or refused" },
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("query", workspaceQuerySchema), validate("json", destinationTestSchema), async (c) => {
+		const runtime = runtimeFor(c.req.valid("query").workspace);
+		const { target, id } = c.req.valid("json");
+		const result = await runtime.notifications.testWebhook(target, id);
+		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
+			statusCode: 400,
+			code: "WEBHOOK_SEND_FAILED"
+		});
+		return c.json(result);
+	}).post("/notifications/destinations/:id/detect-chats", describeRoute({
 		tags: ["notifications"],
-		summary: "List the chats the bot can see",
+		summary: "List the chats a Telegram destination's bot can see",
 		responses: {
 			200: {
 				description: "Chats",
@@ -6794,8 +7260,8 @@ function createNotificationsRoute(deps) {
 			},
 			400: ERROR_RESPONSES[400]
 		}
-	}), validate("query", workspaceQuerySchema), validate("json", notificationActionSchema), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).notifications.detectChats(c.req.valid("json"));
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), validate("json", notificationActionSchema), async (c) => {
+		const result = await runtimeFor(c.req.valid("query").workspace).notifications.detectChats(c.req.valid("param").id, c.req.valid("json"));
 		if (!result.ok) throw new DetailedError(result.error ?? "could not list chats", {
 			statusCode: 400,
 			code: "TELEGRAM_LIST_FAILED"
@@ -10361,7 +10827,7 @@ function createServersRoute(deps) {
 			404: ERROR_RESPONSES[404]
 		}
 	}), validate("query", workspaceQuerySchema), validate("param", idParam$1), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.valid("param").id);
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.start(c.req.valid("param").id, { actor: requestActor(c, deps.auth) });
 		return c.json(result, statusForAction(result));
 	}).post("/:id/stop", describeRoute({
 		tags: ["servers"],
@@ -10381,7 +10847,7 @@ function createServersRoute(deps) {
 			404: ERROR_RESPONSES[404]
 		}
 	}), validate("query", workspaceQuerySchema), validate("param", idParam$1), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.valid("param").id);
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.valid("param").id, { actor: requestActor(c, deps.auth) });
 		return c.json(result, statusForAction(result));
 	}).post("/:id/clear-logs", describeRoute({
 		tags: ["servers"],
@@ -10469,6 +10935,7 @@ var init_$_routes$1 = __esmMin((() => {
 	init_openapi$1();
 	init_validator();
 	init_workspace();
+	init_auth();
 	init_events$1();
 	init_contracts();
 	idParam$1 = type({ id: "string >= 1" });
@@ -10496,7 +10963,10 @@ function buildWorkspaceSettings(runtime) {
 		configError: runtime.store.configError,
 		defaults: runtime.store.defaults,
 		logs: runtime.store.logs,
-		notifications: { telegram: runtime.notifications.status() }
+		notifications: {
+			defaults: runtime.notifications.defaults(),
+			destinations: runtime.notifications.destinations()
+		}
 	};
 }
 function createSettingsRoute(deps) {
@@ -10688,7 +11158,10 @@ function createSettingsRoute(deps) {
 		try {
 			if (patch.defaults !== void 0) runtime.store.updateDefaults(patch.defaults);
 			if (patch.logs !== void 0) runtime.store.updateLogs(patch.logs);
-			if (patch.notifications !== void 0) runtime.store.updateNotifications(patch.notifications);
+			if (patch.notifications !== void 0) {
+				const saved = runtime.store.updateNotifications(patch.notifications);
+				runtime.secrets.forgetTelegramTokens(saved.destinations.map((destination) => destination.id));
+			}
 		} catch (error) {
 			if (error instanceof ConfigError) throw new DetailedError(error.message, {
 				statusCode: 400,
@@ -11427,62 +11900,88 @@ var init_acme_challenge = __esmMin((() => {
 	};
 }));
 //#endregion
-//#region src/helpers/env-file.ts
-/** `KEY=value` files, with optional `export `, `#` comments and quoted values. */
-function parseEnvFile(text) {
-	const env = {};
-	for (const raw of text.split("\n")) {
-		const line = raw.trim();
-		if (line.length === 0 || line.startsWith("#")) continue;
-		const assignment = line.startsWith("export ") ? line.slice(7) : line;
-		const separator = assignment.indexOf("=");
-		if (separator <= 0) continue;
-		const key = assignment.slice(0, separator).trim();
-		let value = assignment.slice(separator + 1).trim();
-		if (value.length > 1 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
-		env[key] = value;
+//#region src/config/secret-parts.ts
+/**
+* The parts of one scope, in a stable order: the known parts first in the fixed order
+* password, apiToken (global) / telegram, ddns (workspace) — then any other top-level
+* key present in `present`, sorted, as its own part with `fields: [key]`.
+*
+* An unknown key is taken as belonging to the scope being asked about, because the file
+* it was read from is the only evidence of where it lives: this release does not know the
+* key, so classifying it by name would drop a future *global* secret on the floor.
+*/
+function secretParts(scope, present) {
+	const keys = new Set(present);
+	const known = KNOWN[scope];
+	const parts = known.filter((key) => keys.has(key)).map((key) => ({
+		key,
+		fields: EXTRA_FIELDS[key] ?? [key],
+		scope
+	}));
+	const consumed = new Set(parts.flatMap((part) => part.fields));
+	const rest = [...keys].filter((key) => KNOWN_SCOPES[key] === void 0 && !known.includes(key) && !consumed.has(key)).sort();
+	return [...parts, ...rest.map((key) => ({
+		key,
+		fields: [key],
+		scope
+	}))];
+}
+/** The top-level keys of a raw secrets document that hold a non-null value. */
+function presentSecretKeys(source) {
+	return Object.entries(source).filter(([, value]) => value !== null && value !== void 0).map(([key]) => key);
+}
+/**
+* A JSON string carrying only `fields`, taken from `source`. Returns null when `source`
+* carries none of them. Always includes a field whose value is `null` ONLY if it is
+* present as a key and non-null; a null/absent field is omitted.
+*/
+function pickSecrets(source, fields) {
+	const picked = {};
+	for (const field of fields) {
+		const value = source[field];
+		if (value !== null && value !== void 0) picked[field] = value;
 	}
-	return env;
+	return Object.keys(picked).length === 0 ? null : JSON.stringify(picked);
 }
-/** Missing files are not an error: an env file is an optional override layer. */
-function loadEnvFile(file) {
+/** Parses a secrets document, tolerating anything: not-an-object, or broken JSON returns {}. */
+function parseSecrets(text) {
 	try {
-		return {
-			env: parseEnvFile(fs.readFileSync(file, "utf8")),
-			path: file,
-			error: null
-		};
-	} catch (error) {
-		if (error.code === "ENOENT") return {
-			env: {},
-			path: file,
-			error: null
-		};
-		return {
-			env: {},
-			path: file,
-			error: errorMessage(error)
-		};
+		const parsed = JSON.parse(text);
+		return isRecord(parsed) ? parsed : {};
+	} catch {
+		return {};
 	}
 }
-/** Expands `${VAR}` from the given vars; unknown references are left visible. */
-function expandEnv(value, vars) {
-	return value.replace(VARIABLE, (match, name) => vars[name] ?? match);
-}
-function expandEnvRecord(record, vars) {
-	return Object.fromEntries(Object.entries(record).map(([key, value]) => [key, expandEnv(value, vars)]));
-}
-function expandEnvList(values, vars) {
-	return values.map((value) => expandEnv(value, vars));
-}
-function resolveEnvFilePath(file, cwd) {
-	if (path.isAbsolute(file)) return file;
-	return path.resolve(cwd, file);
+/**
+* Merges `piece` into `current`, changing ONLY the fields in `fields` — every other key
+* of `current` is preserved (this is what stops restoring the Telegram token from wiping
+* the DDNS credentials). A field that is absent from `piece` is also DELETED from the
+* result, so restoring an older archive that predates a secret clears it rather than
+* leaving a stale value. Returns a new object; does not mutate its arguments.
+*/
+function mergeSecrets(current, piece, fields) {
+	const merged = { ...current };
+	for (const field of fields) {
+		const value = piece[field];
+		if (value === null || value === void 0) delete merged[field];
+		else merged[field] = value;
+	}
+	return merged;
 }
-var VARIABLE;
-var init_env_file = __esmMin((() => {
-	init_error_message();
-	VARIABLE = /\$\{([A-Z_]\w*)\}/gi;
+var KNOWN, KNOWN_SCOPES, EXTRA_FIELDS;
+var init_secret_parts = __esmMin((() => {
+	init_shape();
+	KNOWN = {
+		global: ["password", "apiToken"],
+		workspace: ["telegram", "ddns"]
+	};
+	KNOWN_SCOPES = {
+		password: "global",
+		apiToken: "global",
+		telegram: "workspace",
+		ddns: "workspace"
+	};
+	EXTRA_FIELDS = { ddns: ["ddns", "ddnsKdf"] };
 }));
 //#endregion
 //#region src/providers/archive.ts
@@ -11684,6 +12183,41 @@ function computeBackoff(attempt, options) {
 }
 var init_backoff = __esmMin((() => {}));
 //#endregion
+//#region src/providers/entry-state.ts
+/**
+* The small slice of a server's runtime the panel has to remember across its own
+* restarts: how much of the retry budget is spent, and whether a `runOnce` bootstrap
+* already ran.
+*
+* Both lived only in memory, so a panel restart — a `restart`, a crash, a reboot —
+* handed a crash-looping server a fresh `maxRetries` and re-ran its bootstrap. The
+* retry counter has to outlive the process that increments it to bound anything.
+*/
+/** One JSON file per entry, beside the nanny's own state. */
+function entryStatePath(dir, id) {
+	return path.join(dir, `${id}.run.json`);
+}
+function readEntryState(file) {
+	try {
+		const parsed = entryStateSchema(JSON.parse(fs.readFileSync(file, "utf8")));
+		return parsed instanceof type.errors ? null : parsed;
+	} catch {
+		return null;
+	}
+}
+function writeEntryState(file, state) {
+	try {
+		writeFileAtomic(file, `${JSON.stringify(state)}\n`);
+	} catch {}
+}
+function clearEntryState(file) {
+	fs.rmSync(file, { force: true });
+}
+var init_entry_state = __esmMin((() => {
+	init_atomic();
+	init_contracts();
+}));
+//#endregion
 //#region src/providers/health-check.ts
 /** TCP connect timing, used for the default `port` mode and readiness. */
 async function probeTcp(host, port, timeoutMs) {
@@ -11696,18 +12230,99 @@ async function probeTcp(host, port, timeoutMs) {
 	};
 }
 /**
+* One request/response, capped at `timeoutMs` and `MAX_BODY_BYTES`.
+*
+* Node's `fetch` cannot be told to accept a certificate it does not trust, which is the normal
+* case for a backend on a home network: its own self-signed pair, or one from the engine's local
+* CA. So this speaks http/https directly, the same way `helpers/daemon.ts` reaches a panel with an
+* uploaded pair. A `HEAD` gets no body, which the caller already accounts for.
+*/
+function request(url, method, allowInvalidCert, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		const secure = url.protocol === "https:";
+		let req;
+		let settled = false;
+		let deadline;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(deadline);
+			resolve(value);
+		};
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(deadline);
+			reject(error instanceof Error ? error : new Error(String(error)));
+		};
+		/**
+		* The whole exchange, not just the socket.
+		*
+		* `timeout` on the request is an **idle** timeout, so a server dripping one byte every half
+		* second keeps resetting it and the probe never returns — which hangs the supervisor's tick,
+		* since the probe is awaited. The old `fetch` path had `AbortSignal.timeout`, an absolute
+		* cap; this restores that guarantee.
+		*/
+		deadline = setTimeout(() => {
+			fail(/* @__PURE__ */ new Error(`no complete response within ${timeoutMs}ms`));
+			req.destroy();
+		}, timeoutMs);
+		deadline.unref();
+		req = (secure ? https : http).request({
+			hostname: url.hostname,
+			port: url.port,
+			path: `${url.pathname}${url.search}`,
+			method,
+			...secure && allowInvalidCert ? { rejectUnauthorized: false } : {},
+			timeout: timeoutMs
+		}, (response) => {
+			let body = "";
+			let bytes = 0;
+			let truncated = false;
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => {
+				if (truncated) return;
+				bytes += Buffer$1.byteLength(chunk);
+				if (bytes > MAX_BODY_BYTES) {
+					truncated = true;
+					body += chunk.slice(0, Math.max(0, MAX_BODY_BYTES - (bytes - Buffer$1.byteLength(chunk))));
+					response.destroy();
+					finish({
+						status: response.statusCode ?? 0,
+						body,
+						truncated
+					});
+					return;
+				}
+				body += chunk;
+			});
+			response.once("end", () => {
+				if (!truncated) finish({
+					status: response.statusCode ?? 0,
+					body,
+					truncated
+				});
+			});
+			response.once("error", (error) => {
+				if (!truncated) fail(error);
+			});
+		});
+		req.once("error", (error) => fail(error));
+		req.once("timeout", () => {
+			fail(/* @__PURE__ */ new Error(`no response within ${timeoutMs}ms`));
+			req.destroy();
+		});
+		req.end();
+	});
+}
+/**
 * Fetches the configured path and asserts the response, so "listening" is not
 * mistaken for "working".
 */
 async function probeHttp(host, port, options) {
-	const url = `http://${host}:${port}${options.path.startsWith("/") ? options.path : `/${options.path}`}`;
 	const started = Date.now();
 	try {
-		const response = await fetch(url, {
-			method: options.method,
-			redirect: "manual",
-			signal: AbortSignal.timeout(options.timeoutMs)
-		});
+		const response = await request(new URL(`${options.scheme}://${host}:${port}${options.path.startsWith("/") ? options.path : `/${options.path}`}`), options.method, options.allowInvalidCert, options.timeoutMs);
 		const ms = Date.now() - started;
 		const expected = options.expectStatus ?? null;
 		if (expected !== null && response.status !== expected) return {
@@ -11722,11 +12337,14 @@ async function probeHttp(host, port, options) {
 		};
 		const bodySkipped = options.expectBody.length > 0 && options.method === "HEAD";
 		if (options.expectBody.length > 0 && !bodySkipped) {
-			if (!(await response.text()).includes(options.expectBody)) return {
-				healthy: false,
-				ms,
-				detail: `body does not contain ${JSON.stringify(options.expectBody)}`
-			};
+			if (!response.body.includes(options.expectBody)) {
+				const scope = response.truncated ? ` (only the first ${MAX_BODY_BYTES} bytes were read)` : "";
+				return {
+					healthy: false,
+					ms,
+					detail: `body does not contain ${JSON.stringify(options.expectBody)}${scope}`
+				};
+			}
 		}
 		if (bodySkipped) return {
 			healthy: true,
@@ -11762,9 +12380,11 @@ async function probeHealth(options) {
 	}
 	return last;
 }
+var MAX_BODY_BYTES;
 var init_health_check = __esmMin((() => {
 	init_port();
 	init_error_message();
+	MAX_BODY_BYTES = 1e6;
 }));
 //#endregion
 //#region src/providers/process.ts
@@ -12304,6 +12924,7 @@ var init_supervisor = __esmMin((() => {
 	init_paths();
 	init_runtime();
 	init_template();
+	init_entry_state();
 	init_health_check();
 	init_identity();
 	init_nanny$2();
@@ -12371,7 +12992,7 @@ var init_supervisor = __esmMin((() => {
 				}
 			}
 			const targets = [...this.entries.values()].filter((entry) => !options.autostartOnly || entry.config.autostart).map((entry) => entry.config);
-			for (const config of orderByDependencies(targets)) await this.start(config.id);
+			for (const config of orderByDependencies(targets)) await this.start(config.id, { actor: "boot" });
 		}
 		/**
 		* Stops every entry this command owns. A persistent entry is deliberately not among
@@ -12402,11 +13023,13 @@ var init_supervisor = __esmMin((() => {
 				error: `server "${id}" is stopping`
 			};
 			entry.starting = true;
+			entry.actor = options.retry ? "policy" : options.actor ?? "policy";
 			this.clearRetry(entry);
 			if (!options.retry) {
 				entry.restarts = 0;
 				entry.healthFailures = 0;
 				entry.unhealthySince = null;
+				this.persistEntryState(entry);
 			}
 			try {
 				await this.startDependencies(entry);
@@ -12419,6 +13042,14 @@ var init_supervisor = __esmMin((() => {
 				entry.health = entry.config.health.enabled ? "unknown" : "disabled";
 				this.publishServer(entry);
 				if (entry.config.persistent && await this.resumePersistent(entry)) return { ok: true };
+				if (!entry.config.persistent) {
+					const recorded = await this.resolveRecordedChild(entry);
+					if (recorded.kind === "blocked") return {
+						ok: false,
+						error: recorded.error
+					};
+					if (recorded.kind === "adopt") return this.adoptEntry(entry, recorded.pid, "the child this panel started before it died is still running");
+				}
 				await this.runBootstrap(entry);
 				if (entry.stopping) return {
 					ok: false,
@@ -12433,7 +13064,7 @@ var init_supervisor = __esmMin((() => {
 					ok: false,
 					error: conflict.error
 				};
-				if (conflict.kind === "adopt") return this.adoptEntry(entry, conflict.pid);
+				if (conflict.kind === "adopt") return this.adoptEntry(entry, conflict.pid, `a detached restart of this entry is already serving port ${entry.config.port}`);
 				return this.spawnEntry(entry);
 			} finally {
 				entry.starting = false;
@@ -12444,9 +13075,9 @@ var init_supervisor = __esmMin((() => {
 			if (!entry) return missingServer(id);
 			return this.stopEntry(entry);
 		}
-		async restart(id) {
+		async restart(id, options = {}) {
 			await this.stop(id);
-			return this.start(id);
+			return this.start(id, options);
 		}
 		/**
 		* Frees the port this entry wants, by asking whatever listens on it to leave.
@@ -12678,6 +13309,10 @@ var init_supervisor = __esmMin((() => {
 			entry.pid = null;
 			entry.adopted = false;
 			entry.nannyExit = null;
+			if (entry.lastChild !== null && !isProcessAlive(entry.lastChild.pid)) {
+				entry.lastChild = null;
+				this.persistEntryState(entry);
+			}
 			entry.status = survivor === null ? "stopped" : "conflict";
 			if (survivor !== null) entry.lastError = `pid ${survivor} survived the stop`;
 			this.log(entry, "system", survivor === null ? "stopped" : entry.lastError);
@@ -12688,6 +13323,8 @@ var init_supervisor = __esmMin((() => {
 			};
 		}
 		createEntry(config) {
+			const persisted = readEntryState(entryStatePath(this.options.nannyDir, config.id));
+			const lastPid = persisted?.lastPid ?? null;
 			return {
 				config,
 				status: "stopped",
@@ -12696,9 +13333,13 @@ var init_supervisor = __esmMin((() => {
 				child: null,
 				pid: null,
 				startedAt: null,
+				lastChild: !config.persistent && lastPid !== null ? {
+					pid: lastPid,
+					startedAt: persisted?.lastStartedAt ?? 0
+				} : null,
 				exitCode: null,
 				exitSignal: null,
-				restarts: 0,
+				restarts: persisted?.restarts ?? 0,
 				lastError: null,
 				nextRetryAt: null,
 				retryTimer: null,
@@ -12711,8 +13352,9 @@ var init_supervisor = __esmMin((() => {
 				nannyExit: null,
 				starting: false,
 				stopping: false,
+				actor: "policy",
 				removed: false,
-				bootstrapDone: !config.bootstrap,
+				bootstrapDone: persisted?.bootstrapDone ?? !config.bootstrap,
 				logs: new LogBuffer(config.logBufferLines),
 				echoed: /* @__PURE__ */ new Set(),
 				responseMs: null,
@@ -12730,6 +13372,7 @@ var init_supervisor = __esmMin((() => {
 					this.relay.unfollow(id);
 					this.options.logFiles.clear(id);
 					this.options.history.forget(id);
+					clearEntryState(entryStatePath(this.options.nannyDir, id));
 					entry.removed = true;
 					this.stopEntry(entry).catch((error) => {
 						logger.error(`could not stop the removed server ${id}`, error);
@@ -12853,16 +13496,6 @@ var init_supervisor = __esmMin((() => {
 			return { kind: "free" };
 		}
 		/**
-		* Takes over a detached successor: no spawn, no duplicate. The pid is supervised
-		* from here on (liveness, health probe, resources, stop), while its output stays
-		* wherever it was redirected.
-		*
-		* For a persistent entry that output is not a mystery: its nanny is still writing
-		* the entry's log file, so the relay is started here too. Without this, adopting a
-		* persistent entry whose state file was lost would show its history but never
-		* another live line.
-		*/
-		/**
 		* Stops the listed port holders and reports whether the port came free.
 		*
 		* `kill` and `reclaim` are the same sequence over a different pid list — the foreign
@@ -12887,7 +13520,21 @@ var init_supervisor = __esmMin((() => {
 				error: entry.lastError
 			};
 		}
-		adoptEntry(entry, pid) {
+		/**
+		* Takes over a detached successor: no spawn, no duplicate. The pid is supervised
+		* from here on (liveness, health probe, resources, stop), while its output stays
+		* wherever it was redirected.
+		*
+		* For a persistent entry that output is not a mystery: its nanny is still writing
+		* the entry's log file, so the relay is started here too. Without this, adopting a
+		* persistent entry whose state file was lost would show its history but never
+		* another live line.
+		*
+		* `reason` is the caller's sentence for *why* this pid is ours: a port holder and a
+		* recorded child that survived a hard panel death are the same adoption, said
+		* differently, and the log line is the only place a person sees which happened.
+		*/
+		adoptEntry(entry, pid, reason) {
 			entry.adopted = true;
 			entry.pid = pid;
 			entry.child = null;
@@ -12896,12 +13543,60 @@ var init_supervisor = __esmMin((() => {
 			entry.startedAt = Date.now();
 			entry.lastError = null;
 			if (entry.config.persistent) this.followPersistent(entry, true);
-			this.log(entry, "system", `adopted pid ${pid}: a detached restart of this entry is already serving port ${entry.config.port}`);
+			this.log(entry, "system", `adopted pid ${pid}: ${reason}`);
 			this.publishServer(entry);
 			return { ok: true };
 		}
+		/**
+		* The child this entry's state file recorded, when it is still that same process.
+		*
+		* A non-persistent child is spawned detached, so it survives a panel killed hard while
+		* nothing else remembers it — `preflight` cannot help a portless entry, which is how a
+		* portless worker got a second copy beside the running one. A pid is recycled, so
+		* liveness alone proves nothing: the birth time and the marker decide, and a pid this
+		* platform cannot place is never adopted on a guess.
+		*
+		* The record is cleared only once its process is known to be gone or to be somebody
+		* else, so a stale pid is never chased and a live one is never forgotten into a twin.
+		*/
+		async resolveRecordedChild(entry) {
+			const recorded = entry.lastChild;
+			if (recorded === null) return { kind: "none" };
+			if (recorded.pid === process.pid) {
+				entry.lastChild = null;
+				this.persistEntryState(entry);
+				return { kind: "none" };
+			}
+			const liveness = recorded.startedAt > 0 ? await processLiveness(recorded.pid, recorded.startedAt) : isProcessAlive(recorded.pid) ? "unknown" : "gone";
+			if (liveness === "gone" || liveness === "recycled") {
+				entry.lastChild = null;
+				this.persistEntryState(entry);
+				return { kind: "none" };
+			}
+			if (await processCarriesServerId(recorded.pid, entry.config.id)) return {
+				kind: "adopt",
+				pid: recorded.pid
+			};
+			if (entry.config.port !== null) return { kind: "none" };
+			const error = `pid ${recorded.pid} may be a child this panel started for "${entry.config.id}" before it died, and this platform cannot confirm whose it is — not starting a second copy, stop pid ${recorded.pid} to clear it`;
+			entry.status = "conflict";
+			entry.lastError = error;
+			this.log(entry, "system", error);
+			this.publishServer(entry);
+			return {
+				kind: "blocked",
+				error
+			};
+		}
+		/** Clears the durable record of the last child, once that pid is known to be gone. */
+		forgetRecordedChild(entry, pid) {
+			if (pid === null || entry.lastChild === null || entry.lastChild.pid !== pid) return;
+			entry.lastChild = null;
+			this.persistEntryState(entry);
+		}
 		/** An adopted successor disappeared: fall back to the normal lifecycle. */
 		handleAdoptedExit(entry) {
+			const adoptedPid = entry.pid;
 			if (entry.pid !== null) this.sampler.forget(entry.pid);
 			if (entry.config.persistent) this.consumeNannyExit(entry);
 			const ranForMs = entry.nannyExit?.runtimeMs ?? (entry.startedAt === null ? 0 : Date.now() - entry.startedAt);
@@ -12909,6 +13604,7 @@ var init_supervisor = __esmMin((() => {
 			entry.nannyExit = null;
 			entry.adopted = false;
 			entry.pid = null;
+			this.forgetRecordedChild(entry, adoptedPid);
 			entry.resources = null;
 			entry.responseMs = null;
 			entry.exitCode = null;
@@ -12949,6 +13645,7 @@ var init_supervisor = __esmMin((() => {
 			} catch (error) {
 				this.log(entry, "system", `bootstrap could not start: ${error.message} — continuing anyway`);
 				entry.bootstrapDone = true;
+				this.persistEntryState(entry);
 				return;
 			}
 			child.stdout?.on("data", (chunk) => splitter.push("stdout", chunk));
@@ -12971,6 +13668,7 @@ var init_supervisor = __esmMin((() => {
 				});
 			});
 			entry.bootstrapDone = true;
+			this.persistEntryState(entry);
 			if (code === 0) this.log(entry, "system", "bootstrap finished");
 			else if (code !== null) this.log(entry, "system", `bootstrap exited with code ${code} — continuing anyway`);
 		}
@@ -13112,9 +13810,17 @@ var init_supervisor = __esmMin((() => {
 			entry.child = child;
 			entry.pid = child.pid ?? null;
 			entry.startedAt = Date.now();
+			if (!entry.config.persistent && child.pid !== void 0) {
+				entry.lastChild = {
+					pid: child.pid,
+					startedAt: entry.startedAt
+				};
+				this.persistEntryState(entry);
+			}
 			this.options.history.record(entry.config.id, {
 				type: "start",
-				detail
+				detail,
+				actor: entry.actor
 			});
 			entry.exitCode = null;
 			entry.exitSignal = null;
@@ -13304,6 +14010,7 @@ var init_supervisor = __esmMin((() => {
 			entry.responseMs = null;
 			entry.exitCode = code;
 			entry.exitSignal = signal;
+			this.forgetRecordedChild(entry, child.pid ?? null);
 			const neverStarted = nannyExit !== null ? nannyExit.code === null && nannyExit.signal === null : code === null && signal === null && entry.lastError !== null;
 			const detail = neverStarted ? entry.lastError ?? "the entry could not start" : nannyExit !== null ? describeNannyExit(nannyExit) : describeNannyExit({
 				code,
@@ -13332,10 +14039,12 @@ var init_supervisor = __esmMin((() => {
 			}
 			const restart = entry.config.restart;
 			if (ranForMs >= restart.resetAfterMs) entry.restarts = 0;
+			this.persistEntryState(entry);
 			this.log(entry, "system", neverStarted ? `did not start: ${detail}` : `exited with ${detail} after ${ranFor}`);
 			entry.lastError = neverStarted ? detail : `exited with ${detail}`;
 			if (restart.enabled && entry.restarts < restart.maxRetries) {
 				entry.restarts += 1;
+				this.persistEntryState(entry);
 				const backoffMs = computeBackoff(entry.restarts, restart);
 				entry.status = "backoff";
 				entry.nextRetryAt = Date.now() + backoffMs;
@@ -13471,6 +14180,16 @@ var init_supervisor = __esmMin((() => {
 				entry.retryTimer = null;
 			}
 		}
+		/** The decisions that have to survive this panel, and nothing else. */
+		persistEntryState(entry) {
+			if (entry.removed) return;
+			writeEntryState(entryStatePath(this.options.nannyDir, entry.config.id), {
+				restarts: entry.restarts,
+				bootstrapDone: entry.bootstrapDone,
+				lastPid: entry.config.persistent ? null : entry.lastChild?.pid ?? null,
+				lastStartedAt: entry.config.persistent ? null : entry.lastChild?.startedAt ?? null
+			});
+		}
 		buildVars(entry) {
 			return serverTemplateVars(entry.config);
 		}
@@ -13749,11 +14468,37 @@ function readText(file) {
 		return null;
 	}
 }
+/** Whether an archive came from the schedule rather than from a person. */
+function isAutomatic(file) {
+	return file.name.startsWith(`${AUTO_PREFIX}-`);
+}
 /** The label of one item, for `applied`; items are built before actions run. */
 function labelOf(plan, id) {
 	return plan.items.find((item) => item.id === id)?.label ?? id;
 }
 /**
+* Restores only `fields` from an archived secrets document into a live one.
+*
+* The archive may predate a secret the live file holds, and the live file may hold one
+* the archive never carried: merging by field is what makes restoring the Telegram token
+* leave the DDNS credentials alone, and what clears a secret the archive does not carry
+* rather than leaving the newer value behind as if it had been restored.
+*/
+function mergeIntoFile(target, archived, fields) {
+	const merged = mergeSecrets(parseSecrets(readText(target) ?? ""), parseSecrets(archived), fields);
+	writeFileAtomic(target, `${JSON.stringify(merged, null, 2)}\n`, { mode: 384 });
+}
+/**
+* What an archive says about where it came from. Both fields are absent on an archive
+* written before they existed, so a UI shows the row only when there is something to show.
+*/
+function manifestInfo(manifest) {
+	return {
+		...manifest.writtenBy === void 0 ? {} : { writtenBy: manifest.writtenBy },
+		...manifest.schema === void 0 ? {} : { schema: manifest.schema }
+	};
+}
+/**
 * `servers.config.json` is only a readability gate here: the store applies the
 * workspace's own defaults on the next load, and an archive from another machine
 * need not match this one's default shapes exactly.
@@ -13774,13 +14519,17 @@ function readableWorkspaceSettings(text) {
 		return false;
 	}
 }
-var MANIFEST, ALLOWED_ROOTS, SUFFIX, RELOADABLE, BackupService;
+var MANIFEST, ALLOWED_ROOTS, SUFFIX, AUTO_PREFIX, RELOADABLE, SECRET_LABELS, BackupService;
 var init_backups = __esmMin((() => {
+	init_migrations();
 	init_parse();
+	init_secret_parts();
 	init_atomic();
 	init_env_file();
+	init_logger();
 	init_paths();
 	init_template();
+	init_version();
 	init_archive();
 	init_supervisor();
 	init_error_message();
@@ -13793,7 +14542,26 @@ var init_backups = __esmMin((() => {
 		"data"
 	]);
 	SUFFIX = ".zip";
+	AUTO_PREFIX = "auto";
 	RELOADABLE = /^global:settings$|^workspace:[^:]+:(?:settings|servers)$/;
+	SECRET_LABELS = {
+		password: {
+			en: "Password",
+			key: "settings.backup.secretPassword"
+		},
+		apiToken: {
+			en: "API token",
+			key: "settings.backup.secretApiToken"
+		},
+		telegram: {
+			en: "Telegram bot token",
+			key: "settings.backup.secretTelegram"
+		},
+		ddns: {
+			en: "DDNS credentials",
+			key: "settings.backup.secretDdns"
+		}
+	};
 	BackupService = class {
 		options;
 		/**
@@ -13803,6 +14571,17 @@ var init_backups = __esmMin((() => {
 		*/
 		flags = /* @__PURE__ */ new Map();
 		refreshing = null;
+		/** One scheduled pass at a time: a slow archive must not stack up behind itself. */
+		running = false;
+		disposed = false;
+		/**
+		* When this instance last attempted an automatic pass, whatever it wrote.
+		*
+		* The archive's own mtime is the durable record across a restart, but it cannot bound a
+		* failed pass: nothing is written, so every panel tick would retry — once a second, for as
+		* long as the failure lasts. This is the in-memory backstop for that case.
+		*/
+		lastAttemptAt = null;
 		constructor(options) {
 			this.options = options;
 		}
@@ -13810,6 +14589,9 @@ var init_backups = __esmMin((() => {
 		async warm() {
 			await this.refresh();
 		}
+		dispose() {
+			this.disposed = true;
+		}
 		get directory() {
 			return this.resolveDir();
 		}
@@ -13821,6 +14603,8 @@ var init_backups = __esmMin((() => {
 				enabled: config.enabled,
 				dir: this.directory,
 				keep: config.keep,
+				schedule: { ...config.schedule },
+				lastAutomaticAt: this.lastAutomatic(),
 				includePaths: [...sources.includePaths],
 				entries: this.entries(sources),
 				files: this.list()
@@ -13846,7 +14630,13 @@ var init_backups = __esmMin((() => {
 			const file = path.join(this.resolveDir(), name);
 			return fs.existsSync(file) ? file : null;
 		}
-		/** `password` encrypts the archive; it is never stored anywhere. */
+		/**
+		* `password` encrypts the archive; it is never stored anywhere.
+		*
+		* `automatic` marks an archive the schedule wrote, which is what keeps the two retention
+		* counts apart: an automatic pass must never prune the backup a person took by hand, and a
+		* manual one must not silently eat the history the schedule is keeping.
+		*/
 		async create(options = {}) {
 			if (!this.options.getConfig().enabled) return {
 				ok: false,
@@ -13856,11 +14646,21 @@ var init_backups = __esmMin((() => {
 			const wanted = options.include === void 0 ? null : new Set(options.include);
 			const capturesGlobal = (id) => wanted === null || wanted.has(id);
 			const capturesWorkspace = (id, suffix) => wanted === null || wanted.has(`workspace:${id}`) || wanted.has(`workspace:${id}:${suffix}`);
+			/**
+			* The secrets of one scope the request asked for; `null` means "every one of them".
+			* `workspaceId` is how a bare `workspace:<id>` selection covers all of its leaves.
+			*/
+			const selectedSecretFields = (entryId, path, scope, workspaceId) => {
+				const parts = secretParts(scope, presentSecretKeys(parseSecrets(readText(path) ?? "")));
+				const coversEntry = wanted === null || wanted.has(entryId) || workspaceId !== void 0 && wanted.has(`workspace:${workspaceId}`);
+				const picked = parts.filter((part) => coversEntry || wanted.has(`${entryId}:${part.key}`) || part.fields.some((field) => wanted.has(`${entryId}:${field}`)));
+				return picked.length === parts.length ? null : picked.flatMap((part) => part.fields);
+			};
 			const dir = this.resolveDir();
 			const sources = this.options.getSources();
 			const staging = path.join(dir, `.staging-${Date.now()}`);
 			const createdAt = Date.now();
-			const name = `backup-${new Date(createdAt).toISOString().replace(/[:T]/g, "-").replace(/\.\d+Z$/, "")}-${createdAt % 1e3}${SUFFIX}`;
+			const name = `${options.automatic === true ? AUTO_PREFIX : "backup"}-${new Date(createdAt).toISOString().replace(/[:T]/g, "-").replace(/\.\d+Z$/, "")}-${createdAt % 1e3}${SUFFIX}`;
 			const destination = path.join(dir, name);
 			try {
 				fs.mkdirSync(staging, { recursive: true });
@@ -13868,15 +14668,41 @@ var init_backups = __esmMin((() => {
 				const copy = (relative, source, ignoreGenerated = false) => {
 					if (this.copyInto(staging, relative, source, ignoreGenerated)) captured++;
 				};
+				/**
+				* Captures one secrets file, narrowed to the picked secrets. Copying the whole file
+				* would capture the ones that were *not* picked, so a per-secret selection writes a
+				* staged document holding only those — and the restore side merges by field, which
+				* is what keeps a restore from wiping a secret the archive never carried.
+				*/
+				const copySecrets = (relative, source, entryId, scope, workspaceId) => {
+					const text = readText(source);
+					if (text === null) return;
+					const fields = selectedSecretFields(entryId, source, scope, workspaceId);
+					if (fields === null) {
+						copy(relative, source);
+						return;
+					}
+					const chosen = pickSecrets(parseSecrets(text), fields);
+					if (chosen === null) return;
+					const target = path.join(staging, relative);
+					fs.mkdirSync(path.dirname(target), { recursive: true });
+					fs.writeFileSync(target, `${chosen}\n`);
+					captured++;
+				};
+				/**
+				* True when the request touches a secrets entry at all: the entry itself, one of its
+				* leaves, or — for a workspace — the workspace id, which names every leaf it has.
+				*/
+				const capturesSecrets = (entryId, workspaceId) => wanted === null || wanted.has(entryId) || workspaceId !== void 0 && wanted.has(`workspace:${workspaceId}`) || [...wanted].some((id) => id.startsWith(`${entryId}:`));
 				if (capturesGlobal("global:settings")) copy("global/settings.json", sources.globalSettingsPath);
-				if (capturesGlobal("global:secrets")) copy("global/secrets.json", sources.globalSecretsPath);
+				if (capturesSecrets("global:secrets")) copySecrets("global/secrets.json", sources.globalSecretsPath, "global:secrets", "global");
 				if (capturesGlobal("global:tls")) copy("global/tls", sources.tlsDir);
 				const data = [];
 				for (const workspace of sources.workspaces) {
 					const root = `workspaces/${workspace.id}`;
 					if (capturesWorkspace(workspace.id, "settings")) copy(`${root}/settings.json`, workspace.settingsPath);
 					if (capturesWorkspace(workspace.id, "servers")) copy(`${root}/servers.config.json`, workspace.serversPath);
-					if (capturesWorkspace(workspace.id, "secrets")) copy(`${root}/secrets.json`, workspace.secretsPath);
+					if (capturesSecrets(`workspace:${workspace.id}:secrets`, workspace.id)) copySecrets(`${root}/secrets.json`, workspace.secretsPath, `workspace:${workspace.id}:secrets`, "workspace", workspace.id);
 					for (const declared of this.declaredData(workspace.servers, sources.includePaths)) {
 						if (!declared.included) continue;
 						if (!capturesWorkspace(workspace.id, `data:${declared.path}`)) continue;
@@ -13907,6 +14733,8 @@ var init_backups = __esmMin((() => {
 					version: 1,
 					createdAt,
 					hostname: os.hostname(),
+					writtenBy: appVersion(),
+					schema: 2,
 					data
 				};
 				fs.writeFileSync(path.join(staging, MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`);
@@ -14021,6 +14849,11 @@ var init_backups = __esmMin((() => {
 					error: "the archive has no manifest"
 				};
 				const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+				plan.archive = manifestInfo(manifest);
+				if (manifest.schema !== void 0 && manifest.schema > 2) return {
+					...plan,
+					error: `written by home-hosted ${manifest.writtenBy ?? "a newer release"} (config schema ${manifest.schema}); this release understands schema 2`
+				};
 				const sources = this.options.getSources();
 				const selectedIds = options.include === void 0 ? null : new Set(options.include);
 				const actions = /* @__PURE__ */ new Map();
@@ -14077,16 +14910,32 @@ var init_backups = __esmMin((() => {
 					writeFileAtomic(sources.globalSettingsPath, settingsText);
 				}, ["config"]);
 				const globalSecrets = readText(path.join(staging, "global", "secrets.json"));
-				if (globalSecrets !== null) addItem({
-					id: "global:secrets",
-					label: "Global secrets (password, API token)",
-					labelKey: "settings.backup.entryGlobalSecrets",
-					kind: "secrets",
-					restorable: true,
-					note: null
-				}, () => {
-					writeFileAtomic(sources.globalSecretsPath, globalSecrets, { mode: 384 });
-				}, ["secrets"]);
+				if (globalSecrets !== null) {
+					addItem({
+						id: "global:secrets",
+						label: "Global secrets (password, API token)",
+						labelKey: "settings.backup.entryGlobalSecrets",
+						kind: "secrets",
+						restorable: true,
+						note: null
+					}, () => {
+						writeFileAtomic(sources.globalSecretsPath, globalSecrets, { mode: 384 });
+					}, ["secrets"]);
+					for (const part of secretParts("global", presentSecretKeys(parseSecrets(globalSecrets)))) addItem({
+						id: `global:secrets:${part.key}`,
+						label: `Global secrets: ${SECRET_LABELS[part.key]?.en ?? part.key}`,
+						labelKey: "settings.backup.restoreItemLabel",
+						labelParams: {
+							workspace: "global",
+							item: part.key
+						},
+						kind: "secrets",
+						restorable: true,
+						note: null
+					}, () => {
+						mergeIntoFile(sources.globalSecretsPath, globalSecrets, part.fields);
+					});
+				}
 				const tlsInArchive = path.join(staging, "global", "tls");
 				if (fs.existsSync(tlsInArchive)) {
 					const files = fs.readdirSync(tlsInArchive).filter((file) => fs.statSync(path.join(tlsInArchive, file)).isFile());
@@ -14214,21 +15063,38 @@ var init_backups = __esmMin((() => {
 							});
 						}
 					}
-					if (secrets !== null) addItem({
-						id: `workspace:${id}:secrets`,
-						label: `${workspace.label}: Secrets`,
-						labelKey: "settings.backup.restoreItemLabel",
-						labelParams: {
-							workspace: workspace.label,
-							item: "secrets"
-						},
-						kind: "secrets",
-						workspaceId: id,
-						restorable: true,
-						note: null
-					}, () => {
-						writeFileAtomic(workspace.secretsPath, secrets, { mode: 384 });
-					});
+					if (secrets !== null) {
+						addItem({
+							id: `workspace:${id}:secrets`,
+							label: `${workspace.label}: Secrets`,
+							labelKey: "settings.backup.restoreItemLabel",
+							labelParams: {
+								workspace: workspace.label,
+								item: "secrets"
+							},
+							kind: "secrets",
+							workspaceId: id,
+							restorable: true,
+							note: null
+						}, () => {
+							writeFileAtomic(workspace.secretsPath, secrets, { mode: 384 });
+						});
+						for (const part of secretParts("workspace", presentSecretKeys(parseSecrets(secrets)))) addItem({
+							id: `workspace:${id}:secrets:${part.key}`,
+							label: `${workspace.label}: ${SECRET_LABELS[part.key]?.en ?? part.key}`,
+							labelKey: "settings.backup.restoreItemLabel",
+							labelParams: {
+								workspace: workspace.label,
+								item: part.key
+							},
+							kind: "secrets",
+							workspaceId: id,
+							restorable: true,
+							note: null
+						}, () => {
+							mergeIntoFile(workspace.secretsPath, secrets, part.fields);
+						});
+					}
 				}
 				const instanceTargets = [];
 				for (const workspace of sources.workspaces) for (const declared of this.declaredData(workspace.servers, sources.includePaths)) {
@@ -14381,7 +15247,7 @@ var init_backups = __esmMin((() => {
 					labelKey: "settings.backup.entryGlobalSecrets",
 					kind: "secrets",
 					...missing(sources.globalSecretsPath, "settings.backup.noteMissing"),
-					items: []
+					items: this.secretItems("global", "global:secrets", sources.globalSecretsPath)
 				},
 				{
 					id: "global:tls",
@@ -14402,6 +15268,27 @@ var init_backups = __esmMin((() => {
 			});
 			return entries;
 		}
+		/**
+		* One leaf per secret the file actually holds, so a restore can bring back the
+		* password without the API token, or the Telegram token without the DDNS credentials.
+		*
+		* The set comes from the file's own top-level keys rather than a list here, so a
+		* secret added later appears on its own — the failure mode of a second list is a
+		* secret that can be captured but never restored individually.
+		*/
+		secretItems(scope, entryId, path) {
+			const present = presentSecretKeys(parseSecrets(readText(path) ?? ""));
+			if (present.length === 0) return [];
+			return secretParts(scope, present).map((part) => ({
+				id: `${entryId}:${part.key}`,
+				label: SECRET_LABELS[part.key]?.en ?? part.key,
+				...SECRET_LABELS[part.key] === void 0 ? {} : { labelKey: SECRET_LABELS[part.key].key },
+				kind: "secrets",
+				secret: part.key,
+				included: true,
+				note: null
+			}));
+		}
 		workspaceItems(workspace, includePaths) {
 			const id = workspace.id;
 			const note = (path) => {
@@ -14435,7 +15322,8 @@ var init_backups = __esmMin((() => {
 					kind: "secrets",
 					included: true,
 					...note(workspace.secretsPath)
-				}
+				},
+				...this.secretItems("workspace", `workspace:${id}:secrets`, workspace.secretsPath)
 			];
 			for (const declared of this.declaredData(workspace.servers, includePaths)) items.push({
 				id: `workspace:${id}:data:${declared.path}`,
@@ -14550,9 +15438,46 @@ var init_backups = __esmMin((() => {
 			});
 			return true;
 		}
+		/**
+		* Drops the oldest archives past their own limit.
+		*
+		* Two budgets, because the two sources are not the same thing: `keep` is what a person
+		* agreed to store, and pruning a hand-taken archive to make room for a scheduled one would
+		* lose the copy they deliberately made. The scheduled pair keeps `schedule.keep` automatic
+		* archives; the rest keeps `keep`.
+		*/
 		prune() {
-			const { keep } = this.options.getConfig();
-			for (const file of this.list().slice(keep)) this.remove(file.name);
+			const config = this.options.getConfig();
+			const files = this.list();
+			const automatic = files.filter(isAutomatic);
+			const manual = files.filter((file) => !isAutomatic(file));
+			for (const file of automatic.slice(config.schedule.keep)) this.remove(file.name);
+			for (const file of manual.slice(config.keep)) this.remove(file.name);
+		}
+		/** When the newest automatic archive was written, or null when there is none. */
+		lastAutomatic() {
+			return this.list().find(isAutomatic)?.createdAt ?? null;
+		}
+		/**
+		* Runs one scheduled pass when it is due. Modelled on the DDNS pass: cheap to call on every
+		* panel tick, never blocking, and never two at once.
+		*/
+		tick(now = Date.now()) {
+			if (this.disposed || this.running) return;
+			const config = this.options.getConfig();
+			if (!config.enabled || config.schedule.intervalMs <= 0) return;
+			const last = this.lastAutomatic();
+			const latest = last === null ? this.lastAttemptAt : Math.max(last, this.lastAttemptAt ?? 0);
+			if (latest !== null && now - latest < config.schedule.intervalMs) return;
+			this.running = true;
+			this.lastAttemptAt = now;
+			this.create({ automatic: true }).then((result) => {
+				if (!result.ok) logger.warn("the scheduled backup failed", result.error);
+			}).catch((error) => {
+				logger.error("the scheduled backup failed", error);
+			}).finally(() => {
+				this.running = false;
+			});
 		}
 		resolveDir() {
 			const configured = this.options.getConfig().dir;
@@ -15800,10 +16725,11 @@ var init_log_files = __esmMin((() => {
 }));
 //#endregion
 //#region src/services/notifications.ts
-var REASON_LABEL, TITLE, NotificationService;
+var REASON_LABEL, TITLE, COVERS, NotificationService;
 var init_notifications = __esmMin((() => {
 	init_logger();
 	init_telegram();
+	init_webhook();
 	init_error_message();
 	REASON_LABEL = {
 		"crash": "gave up restarting",
@@ -15827,122 +16753,230 @@ var init_notifications = __esmMin((() => {
 		"ddns": "🌐 DNS updated",
 		"ddns-error": "🌐 DNS update failed"
 	};
+	COVERS = {
+		"crash": (policy) => policy.onCrash,
+		"rss": (policy) => policy.onCrash,
+		"unhealthy": (policy) => policy.onUnhealthy,
+		"forced-restart": (policy) => policy.onForcedRestart,
+		"recovered": (policy) => policy.onRecovered,
+		"host": (policy) => policy.onHost,
+		"host-recovered": (policy) => policy.onHost,
+		"ddns": (policy) => policy.onDdns,
+		"ddns-error": (policy) => policy.onDdns
+	};
 	NotificationService = class {
 		secrets;
 		getConfig;
 		cooldowns = /* @__PURE__ */ new Map();
-		lastResult = null;
-		lastResultAt = null;
+		results = /* @__PURE__ */ new Map();
 		constructor(secrets, getConfig) {
 			this.secrets = secrets;
 			this.getConfig = getConfig;
 		}
-		get telegramTokenSet() {
-			return this.secrets.telegramTokenSet;
+		/** The general block, as the page edits it. */
+		defaults() {
+			return { ...this.getConfig().defaults };
 		}
-		status() {
-			const telegram = this.getConfig().telegram;
-			return {
-				enabled: telegram.enabled,
-				tokenSet: this.secrets.telegramTokenSet,
-				chatId: telegram.chatId,
-				onCrash: telegram.onCrash,
-				onUnhealthy: telegram.onUnhealthy,
-				onForcedRestart: telegram.onForcedRestart,
-				onRecovered: telegram.onRecovered,
-				onHost: telegram.onHost,
-				onDdns: telegram.onDdns,
-				cooldownMs: telegram.cooldownMs,
-				lastResult: this.lastResult,
-				lastResultAt: this.lastResultAt
+		/**
+		* Every destination as a row: its own fields, the policy it will actually use, and its last result.
+		*
+		* The page shows this rather than the raw config, so an inheriting destination displays the
+		* inherited toggles — the values a send will use, not the stale ones on disk.
+		*/
+		destinations() {
+			return this.getConfig().destinations.map((target) => {
+				const result = this.results.get(target.id) ?? {
+					lastResult: null,
+					lastResultAt: null
+				};
+				const common = {
+					id: target.id,
+					kind: target.kind,
+					enabled: target.enabled,
+					useOwnSettings: target.useOwnSettings,
+					...this.effectivePolicy(target),
+					lastResult: result.lastResult,
+					lastResultAt: result.lastResultAt
+				};
+				if (target.kind === "telegram") return {
+					...common,
+					chatId: target.chatId,
+					tokenSet: this.secrets.telegramTokenSet(target.id),
+					url: null,
+					method: null,
+					format: null,
+					headers: null
+				};
+				return {
+					...common,
+					chatId: null,
+					tokenSet: false,
+					url: target.url,
+					method: target.method,
+					format: target.format,
+					headers: target.headers
+				};
+			});
+		}
+		/** The policy a destination actually uses: its own, or the general block's. */
+		effectivePolicy(target) {
+			if (target.useOwnSettings) return {
+				onCrash: target.onCrash,
+				onUnhealthy: target.onUnhealthy,
+				onForcedRestart: target.onForcedRestart,
+				onRecovered: target.onRecovered,
+				onHost: target.onHost,
+				onDdns: target.onDdns,
+				cooldownMs: target.cooldownMs
 			};
+			return { ...this.getConfig().defaults };
 		}
-		/** Enabled for this reason *and* outside its cooldown window. */
+		/**
+		* The destinations that would deliver this event right now.
+		*
+		* Per destination rather than one boolean for the service: a single answer would either send a
+		* host warning somewhere switched off for it, or silence a crash because another destination's
+		* cooldown was still running.
+		*/
+		targetsFor(event, now = Date.now()) {
+			return this.getConfig().destinations.filter((target) => {
+				if (!target.enabled) return false;
+				const policy = this.effectivePolicy(target);
+				if (!COVERS[event.reason](policy)) return false;
+				const until = this.cooldowns.get(this.cooldownKey(target, event)) ?? 0;
+				return !(policy.cooldownMs > 0 && until > now);
+			});
+		}
+		/** Whether *any* destination would deliver this event. */
 		shouldNotify(event, now = Date.now()) {
-			const telegram = this.getConfig().telegram;
-			if (!telegram.enabled) return false;
-			if (!{
-				"crash": telegram.onCrash,
-				"unhealthy": telegram.onUnhealthy,
-				"forced-restart": telegram.onForcedRestart,
-				"recovered": telegram.onRecovered,
-				"rss": telegram.onCrash,
-				"host": telegram.onHost,
-				"host-recovered": telegram.onHost,
-				"ddns": telegram.onDdns,
-				"ddns-error": telegram.onDdns
-			}[event.reason]) return false;
-			const until = this.cooldowns.get(`${event.serverId}:${event.reason}`) ?? 0;
-			return !(telegram.cooldownMs > 0 && until > now);
-		}
-		/** Starts the cooldown window for this event, so a flapping server stays quiet. */
+			return this.targetsFor(event, now).length > 0;
+		}
+		/** Starts the cooldown window for every destination about to be asked to send. */
 		markSent(event, now = Date.now()) {
-			this.cooldowns.set(`${event.serverId}:${event.reason}`, now + this.getConfig().telegram.cooldownMs);
+			for (const target of this.targetsFor(event, now)) this.cooldowns.set(this.cooldownKey(target, event), now + this.effectivePolicy(target).cooldownMs);
 		}
-		/** Fire-and-forget by design: supervision must never wait on a chat API. */
+		/** Fire-and-forget by design: supervision must never wait on a chat or webhook API. */
 		notify(event) {
 			this.dispatch(event).catch((error) => {
 				logger.warn(`notification failed: ${errorMessage(error)}`);
 			});
 		}
 		async dispatch(event) {
-			if (!this.shouldNotify(event)) return false;
+			const targets = this.targetsFor(event);
+			if (targets.length === 0) return false;
 			this.markSent(event);
-			return this.sendTelegram(formatTelegramMessage(TITLE[event.reason], [`${event.label} (${event.serverId}) ${REASON_LABEL[event.reason]}`, event.detail]));
+			const title = TITLE[event.reason];
+			const message = `${event.label} (${event.serverId}) ${REASON_LABEL[event.reason]}\n${event.detail}`;
+			return (await Promise.all(targets.map((target) => this.deliver(target, title, message, event)))).includes(true);
 		}
-		/** Used by the "send test" button in settings. */
-		async sendTest(overrides = {}) {
-			const chatId = overrides.chatId ?? this.getConfig().telegram.chatId;
-			if (chatId.length === 0) return {
+		/** One destination, one event. A throw is recorded against it and nothing else. */
+		async deliver(target, title, message, event) {
+			try {
+				const result = target.kind === "telegram" ? await this.sendTelegram(target, title, message) : await sendWebhook(target, {
+					title,
+					message,
+					reason: event.reason,
+					serverId: event.serverId,
+					label: event.label
+				});
+				this.remember(target.id, result.ok ? "sent" : result.error ?? "send failed");
+				return result.ok;
+			} catch (error) {
+				this.remember(target.id, errorMessage(error));
+				return false;
+			}
+		}
+		/** A probe for one destination. */
+		async sendTest(id, overrides = {}) {
+			const target = this.getConfig().destinations.find((entry) => entry.id === id);
+			if (target === void 0) return {
+				ok: false,
+				error: "no such destination"
+			};
+			const result = target.kind === "telegram" ? await this.testTelegram(id, target.chatId, overrides.chatId, overrides.botToken) : await this.testWebhook(target, id);
+			this.remember(id, result.ok ? "test message sent" : result.error ?? "test failed");
+			return result;
+		}
+		/**
+		* A Telegram destination's own token, with the chat id and the token both overridable.
+		*
+		* The override is what lets a token be tried before it is saved — the route advertises it and
+		* `detect-chats` honours it, so ignoring it here made "send a test" fail on a token the page was
+		* still holding.
+		*/
+		async testTelegram(id, chatId, overrideChatId, overrideToken) {
+			const chat = (overrideChatId ?? chatId).trim();
+			if (chat.length === 0) return {
 				ok: false,
 				error: "no chat id configured"
 			};
-			const token = this.resolveToken(overrides.botToken);
+			const token = overrideToken !== void 0 && overrideToken.length > 0 ? overrideToken : this.secrets.telegramToken(id);
 			if (token === null) return {
 				ok: false,
-				error: "no bot token configured"
+				error: "no bot token configured for this destination"
 			};
-			const result = await sendTelegramMessage(token, chatId, formatTelegramMessage("✅ home-hosted test", ["notifications are wired up correctly"]));
-			this.remember(result.ok ? "test message sent" : result.error ?? "test failed");
+			return sendTelegramMessage(token, chat, formatTelegramMessage("✅ home-hosted test", ["notifications are wired up correctly"]));
+		}
+		/**
+		* A webhook probe, for a saved destination or for a draft the page has not saved.
+		*
+		* A draft is passed whole, so a URL and its headers can be tried before they are stored — and so
+		* a destination's own "test" tests *that* destination, not whichever one comes first.
+		*/
+		async testWebhook(target, id) {
+			const problem = targetProblem(target, { requireUrl: true });
+			if (problem !== null) return {
+				ok: false,
+				error: problem
+			};
+			const result = await sendWebhook(target, {
+				title: "home-hosted test",
+				message: "notifications are wired up correctly",
+				reason: "test",
+				serverId: "",
+				label: ""
+			});
+			if (id !== void 0) this.remember(id, result.ok ? "test message sent" : result.error ?? "test failed");
 			return result;
 		}
-		async detectChats(overrides = {}) {
-			const token = this.resolveToken(overrides.botToken);
-			if (token === null) return {
+		/** Lists the chats a destination's bot can see, so its chat id can be picked. */
+		async detectChats(id, overrides = {}) {
+			const token = (overrides.botToken ?? this.secrets.telegramToken(id) ?? "").trim();
+			if (token.length === 0) return {
 				ok: false,
 				chats: [],
-				error: "no bot token configured"
+				error: "no bot token configured for this destination"
 			};
 			const result = await listTelegramChats(token);
-			this.remember(result.ok ? `${result.chats.length} chat(s) found` : result.error ?? "detect failed");
+			this.remember(id, result.ok ? `${result.chats.length} chat(s) found` : result.error ?? "detect failed");
 			return result;
 		}
-		/** Verifies a token without sending anything. */
+		/** Verifies a token without storing or sending anything. */
 		async verifyToken(token) {
 			return verifyTelegramToken(token);
 		}
-		resolveToken(tokenOverride) {
-			const token = tokenOverride?.trim() ?? this.secrets.telegramToken ?? "";
-			return token.length > 0 ? token : null;
+		cooldownKey(target, event) {
+			return `${target.id}:${event.serverId}:${event.reason}`;
 		}
-		async sendTelegram(html) {
-			const telegram = this.getConfig().telegram;
-			if (telegram.chatId.length === 0) {
-				this.remember("no chat id configured");
-				return false;
-			}
-			const token = this.resolveToken();
-			if (token === null) {
-				this.remember("no bot token configured");
-				return false;
-			}
-			const result = await sendTelegramMessage(token, telegram.chatId, html);
-			this.remember(result.ok ? "sent" : result.error ?? "send failed");
-			return result.ok;
-		}
-		remember(message) {
-			this.lastResult = message;
-			this.lastResultAt = Date.now();
+		async sendTelegram(target, title, message) {
+			if (target.chatId.length === 0) return {
+				ok: false,
+				error: "no chat id configured"
+			};
+			const token = this.secrets.telegramToken(target.id);
+			if (token === null) return {
+				ok: false,
+				error: "no bot token configured for this destination"
+			};
+			const body = message.split("\n").filter((line) => line.length > 0);
+			return sendTelegramMessage(token, target.chatId, formatTelegramMessage(title, body));
+		}
+		/** Records one destination's outcome, keyed by its id. */
+		remember(id, message) {
+			this.results.set(id, {
+				lastResult: message,
+				lastResultAt: Date.now()
+			});
 		}
 	};
 }));
@@ -15981,8 +17015,7 @@ function stateSignature(state) {
 				workspace.ddns.ipv6,
 				...workspace.ddns.records.map((record) => `${record.host}:${record.type}:${record.state}:${record.ip}`)
 			].join(":"),
-			workspace.notifications.telegram.enabled,
-			workspace.notifications.telegram.tokenSet,
+			...(workspace.notifications.destinations ?? []).map((destination) => `${destination.id}:${destination.kind}:${destination.enabled}:${destination.tokenSet}:${destination.lastResult ?? ""}`),
 			...workspace.servers.map((server) => [
 				server.id,
 				server.status,
@@ -16213,6 +17246,7 @@ var init_panel = __esmMin((() => {
 		async dispose() {
 			this.disposed = true;
 			clearInterval(this.timer);
+			this.options.backups.dispose();
 			await Promise.all(this.workspaces().map((runtime) => runtime.supervisor.dispose()));
 			for (const runtime of this.workspaces()) this.disposeRuntime(runtime);
 		}
@@ -16326,6 +17360,7 @@ var init_panel = __esmMin((() => {
 			if (this.disposed) return;
 			const now = Date.now();
 			await this.options.hostMonitor.tick(now);
+			this.options.backups.tick(now);
 			for (const runtime of this.workspaces()) runtime.ddns.tick(now);
 			const proxy = this.options.proxy();
 			if (proxy !== null) await proxy.sync().catch((error) => {
@@ -18168,7 +19203,10 @@ function targets(configOverride) {
 			validate: (raw) => {
 				let defaults = {};
 				try {
-					defaults = parseWorkspaceSettings(JSON.parse(fs.readFileSync(workspaceSettingsPath(workspace.id), "utf8"))).config?.defaults ?? {};
+					const settingsRaw = JSON.parse(fs.readFileSync(workspaceSettingsPath(workspace.id), "utf8"));
+					const meta = typeof settingsRaw.meta === "object" && settingsRaw.meta !== null ? settingsRaw.meta : {};
+					const from = typeof meta.schema === "number" ? meta.schema : 1;
+					defaults = (planConfigMigrations(from).steps.length > 0 ? applyConfigMigrations(settingsRaw, from).config : settingsRaw)?.defaults ?? {};
 				} catch {}
 				return parseServersFile(raw, defaults).errors[0] ?? null;
 			}
@@ -18192,7 +19230,18 @@ async function runMigrate(config, dryRun, yes) {
 		const from = typeof meta.schema === "number" ? meta.schema : 1;
 		const plan = planConfigMigrations(from);
 		if (plan.tooNew) fail(`${target.file} was written by home-hosted ${meta.writtenBy ?? "a newer release"} (config schema ${from});\n  this release understands schema ${plan.to}. Install that version, or edit the file yourself.`);
-		const problem = target.validate(raw);
+		/**
+		* Validate what this release will actually read: the file as-is when it needs no migration,
+		* otherwise the result the steps produce.
+		*
+		* The parsed check cannot be run on the raw file when a migration is pending — the reader
+		* refuses an older schema by design (`readStamp`), which would make `migrate` refuse every
+		* config it exists to lift. `checkShape` below catches a file that is not even JSON-shaped
+		* before the steps touch it.
+		*/
+		const migrated = plan.steps.length === 0 ? raw : applyConfigMigrations(raw, from).config;
+		if (plan.steps.length > 0 && !isRecord(migrated)) fail(`${target.file} did not produce an object when migrated — refusing to write it`);
+		const problem = target.validate(migrated);
 		if (problem !== null) fail(`${target.file} is not a config this release can read: ${problem}`);
 		if (plan.reached !== plan.to) fail(`${target.file} is schema ${from} and this release can only lift it to schema ${plan.reached} — the migration chain in configMigrations has a gap to schema ${plan.to}.
   That is a bug in this release: report it rather than editing the file.`);
@@ -18213,7 +19262,6 @@ async function runMigrate(config, dryRun, yes) {
 				return;
 			}
 		}
-		const { config: migrated } = applyConfigMigrations(raw, from);
 		const migratedProblem = target.validate(migrated);
 		if (migratedProblem !== null) fail(`the migration produced a config this release cannot read:\n  ${migratedProblem}`);
 		fs.copyFileSync(target.file, `${target.file}.bak`);
@@ -18238,6 +19286,7 @@ var init_migrate = __esmMin((() => {
 	init_paths();
 	init_version();
 	init_error_message();
+	init_shape();
 	migrateArgs = {
 		config: {
 			type: "string",