home-hosted 0.8.3 → 0.9.0

package/dist/cli.js

@@ -709,7 +709,22 @@ function parseBind(value) {
 	const parsed = bindSchema(value);
 	return parsed instanceof type.errors ? null : parsed;
 }
-var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, telegramSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, telegramPatchSchema, notificationsPatchSchema, hostPatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, entryStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, telegramStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyActorSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restoreSkipSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
+/**
+* The ids that appear more than once, so a write can refuse them.
+*
+* A schema-level check is not available here (see above), and this is the one shape that has to
+* be told apart from a plain validation error: the list is valid, but its identity is not.
+*/
+function duplicateWebhookIds(targets) {
+	const seen = /* @__PURE__ */ new Set();
+	const duplicates = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		if (seen.has(target.id)) duplicates.add(target.id);
+		seen.add(target.id);
+	}
+	return [...duplicates];
+}
+var bindSchema, workspaceIdSchema, workspaceSchema, workspaceCreateSchema, workspaceRenameSchema, portSchema, onPortConflictSchema, onPortConflictDefaultSchema, restartSchema, httpCheckSchema, resourcesSchema, healthSchema, stopSchema, bootstrapSchema, bootstrapOrNullSchema, labelOrNullSchema, logBufferLinesSchema, serverSchema, authSchema, notificationPolicyShape, notificationDefaultsSchema, useOwnSettingsSchema, telegramDestinationSchema, webhookTargetSchema, notificationTargetSchema, destinationListSchema, notificationsSchema, logsSchema, tlsSchema, hostSchema, ddnsRecordTypeSchema, ddnsAccountSchema, ddnsDomainSchema, ddnsIpv4Schema, ddnsIpv6Schema, ddnsConfigSchema, ddnsRecordStateSchema, ddnsRecordViewSchema, ddnsStatusSchema, ddnsProviderFieldSchema, ddnsProviderInfoSchema, ddnsViewSchema, ddnsCredentialsSchema, backupScheduleSchema, backupsSchema, controlSchema, defaultsSchema, restartPatchSchema, httpCheckPatchSchema, resourcesPatchSchema, healthPatchSchema, stopPatchSchema, authPatchSchema, notificationPolicyPatchShape, destinationPatchSchema, notificationsPatchSchema, hostPatchSchema, backupSchedulePatchSchema, backupsPatchSchema, logsPatchSchema, tlsPatchSchema, controlPatchSchema, defaultsPatchSchema, editableFields, serverPatchSchema, serverCreateSchema, nannySpecSchema, nannyExitSchema, nannyStateSchema, entryStateSchema, settingsPatchSchema, workspaceSettingsPatchSchema, authStatusSchema, tlsStatusSchema, proxyEngineSchema, proxyTargetSchema, proxyTlsModeSchema, proxyRouteSchema, proxyCertificateSchema, proxyCertificateStateSchema, proxyDns01Schema, proxyConfigSchema, proxyEngineSourceSchema, proxyEngineStatusSchema, proxyEngineInfoSchema, proxyRouteStatusSchema, proxyRouteViewSchema, proxyRunStateSchema, proxyStatusSchema, proxyCertificateViewSchema, proxyDnsAccountViewSchema, proxyViewSchema, proxyRoutePatchSchema, proxyPatchSchema, proxyCertificateUploadSchema, proxyEngineInstallSchema, notificationPolicyStatusShape, destinationStatusSchema, telegramChatsSchema, notificationViewSchema, sessionViewSchema, loginSchema, passwordValueSchema, passwordSchema, serverStatusSchema, healthStateSchema, portStateSchema, logStreamSchema, logLineSchema, historyActorSchema, historyEventSchema, serverHistorySchema, processResourcesSchema, hostDiskSchema, hostViewSchema, backupFileSchema, backupEntrySchema, backupsViewSchema, restoreItemSchema, restoreSkipSchema, restorePlanSchema, backupCreateSchema, restoreRequestSchema, serverViewSchema, healthResponseSchema, controlViewSchema, uiMetaSchema, uiStatusSchema, workspaceViewSchema, appStateSchema, logQuerySchema, freePortResultSchema, logHistoryQuerySchema, logFileInfoSchema, logServerViewSchema, logServersViewSchema, notificationActionSchema, destinationIdParamSchema, destinationTestSchema, telegramTokenSchema, apiErrorSchema, tlsUploadSchema, settingsViewSchema, settingsSavedSchema, workspaceSettingsViewSchema, workspaceSettingsSavedSchema;
 var init_contracts = __esmMin((() => {
 	bindSchema = type("\"local\" | \"lan\" | /^\\d{1,3}(?:\\.\\d{1,3}){3}$/");
 	workspaceIdSchema = type("/^[a-z0-9][a-z0-9_-]*$/");
@@ -735,6 +750,10 @@ var init_contracts = __esmMin((() => {
 		resetAfterMs: "number >= 0 = 60000"
 	}).onUndeclaredKey("reject");
 	httpCheckSchema = type({
+		/** `https` is for a backend that serves TLS itself; pair it with `allowInvalidCert` when it is self-signed. */
+		scheme: "\"http\" | \"https\" = \"http\"",
+		/** Accept any certificate. A self-signed pair is the normal case here, and the probe is local. */
+		allowInvalidCert: "boolean = false",
 		/** Path on the server's own port, e.g. `/healthz`. */
 		path: "string = \"/\"",
 		method: "\"GET\" | \"HEAD\" = \"GET\"",
@@ -831,9 +850,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		maxLoginAttempts: "number.integer >= 1 = 5",
 		lockoutMs: "number >= 1000 = 60000"
 	}).onUndeclaredKey("reject");
-	telegramSchema = type({
-		enabled: "boolean = false",
-		chatId: "string = \"\"",
+	notificationPolicyShape = {
 		onCrash: "boolean = true",
 		onUnhealthy: "boolean = true",
 		onForcedRestart: "boolean = true",
@@ -844,8 +861,44 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onDdns: "boolean = true",
 		/** Per server *and* reason, so a flapping server cannot spam the chat. */
 		cooldownMs: "number >= 0 = 120000"
+	};
+	notificationDefaultsSchema = type({ ...notificationPolicyShape }).onUndeclaredKey("reject");
+	useOwnSettingsSchema = "boolean = true";
+	telegramDestinationSchema = type({
+		kind: "\"telegram\"",
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		/** Off until configured: a bare `enabled: true` with no chat would fail every send. */
+		enabled: "boolean = false",
+		chatId: "string = \"\"",
+		useOwnSettings: useOwnSettingsSchema,
+		...notificationPolicyShape
+	}).onUndeclaredKey("reject");
+	webhookTargetSchema = type({
+		kind: "\"webhook\"",
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		/** Empty only while the target is a draft; the page will not save one without it. */
+		url: "string = \"\"",
+		enabled: "boolean = true",
+		method: "\"POST\" | \"PUT\" = \"POST\"",
+		/** Payload format: `json` sends the event as JSON, `text` sends the plain message. */
+		format: "\"json\" | \"text\" = \"json\"",
+		/**
+		* Extra headers, `Name: value` per line. The one field that lets this transport talk to
+		* ntfy (`Title`, `Priority`), a bearer-token endpoint (`Authorization`) or anything else
+		* with a header-shaped contract.
+		*/
+		headers: "string = \"\"",
+		useOwnSettings: useOwnSettingsSchema,
+		...notificationPolicyShape
+	}).onUndeclaredKey("reject");
+	notificationTargetSchema = telegramDestinationSchema.or(webhookTargetSchema);
+	destinationListSchema = notificationTargetSchema.array();
+	notificationsSchema = type({
+		/** What every destination inherits unless it carries its own settings. */
+		defaults: notificationDefaultsSchema.default(() => ({})),
+		/** Replaced by a patch, the same way `ddns.accounts` is: a merge cannot express removing one. */
+		destinations: destinationListSchema.default(() => [])
 	}).onUndeclaredKey("reject");
-	notificationsSchema = type({ telegram: telegramSchema.default(() => ({})) }).onUndeclaredKey("reject");
 	logsSchema = type({
 		persist: "boolean = true",
 		/** Per server, before rotating to `.1`, `.2`, ... */
@@ -970,12 +1023,20 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		accounts: ddnsAccountSchema.array().optional(),
 		domains: ddnsDomainSchema.array().optional()
 	}).onUndeclaredKey("reject");
+	backupScheduleSchema = type({
+		/** 0 turns the schedule off; otherwise the gap between automatic archives. */
+		intervalMs: "number.integer >= 0 = 0",
+		/** How many automatic archives to keep. Manual ones are never pruned by it. */
+		keep: "number.integer >= 1 = 7"
+	}).onUndeclaredKey("reject");
 	backupsSchema = type({
 		enabled: "boolean = true",
 		dir: "string = \".backups\"",
+		/** How many archives to keep in total, newest first. */
 		keep: "number.integer >= 1 = 5",
 		/** Extra paths in every backup, in addition to each server's `backupPaths`. */
-		includePaths: type("string[]").default(() => [])
+		includePaths: type("string[]").default(() => []),
+		schedule: backupScheduleSchema.default(() => ({}))
 	}).onUndeclaredKey("reject");
 	controlSchema = type({
 		/** What the panel calls itself; the stock UI shows it in the sidebar. */
@@ -1006,6 +1067,8 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		resetAfterMs: "number >= 0?"
 	}).onUndeclaredKey("reject");
 	httpCheckPatchSchema = type({
+		scheme: "\"http\" | \"https\"?",
+		allowInvalidCert: "boolean?",
 		path: "string?",
 		method: "\"GET\" | \"HEAD\"?",
 		expectStatus: "number.integer | null?",
@@ -1037,9 +1100,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		maxLoginAttempts: "number.integer >= 1?",
 		lockoutMs: "number >= 1000?"
 	}).onUndeclaredKey("reject");
-	telegramPatchSchema = type({
-		enabled: "boolean?",
-		chatId: "string?",
+	notificationPolicyPatchShape = {
 		onCrash: "boolean?",
 		onUnhealthy: "boolean?",
 		onForcedRestart: "boolean?",
@@ -1047,8 +1108,36 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onHost: "boolean?",
 		onDdns: "boolean?",
 		cooldownMs: "number >= 0?"
+	};
+	destinationPatchSchema = type({
+		kind: "\"telegram\" | \"webhook\"",
+		id: "/^[a-z0-9][a-z0-9_-]*$/",
+		enabled: "boolean?",
+		useOwnSettings: "boolean?",
+		/** Telegram only. */
+		chatId: "string?",
+		/** Webhook only. */
+		url: "string?",
+		method: "\"POST\" | \"PUT\"?",
+		format: "\"json\" | \"text\"?",
+		headers: "string?",
+		...notificationPolicyPatchShape
+	}).onUndeclaredKey("reject");
+	notificationsPatchSchema = type({
+		/** Merged key by key, like the other nested groups. */
+		/**
+		* A merge key-by-key, and **every field optional** — `notificationPolicyPatchShape`, not a
+		* `.partial()` of the defaults schema.
+		*
+		* ArkType's `.partial()` leaves a field's `= false` / `= 120000` default in place, so a body of
+		* `{ onHost: false }` validated into all seven keys and one toggle overwrote the rest. A patch
+		* schema here carries no defaults (the rule for every patch), and the store merges it over the
+		* stored block.
+		*/
+		defaults: type({ ...notificationPolicyPatchShape }).onUndeclaredKey("reject").optional(),
+		/** Replaced whole, so a removed destination stays removed. */
+		destinations: destinationPatchSchema.array().optional()
 	}).onUndeclaredKey("reject");
-	notificationsPatchSchema = type({ telegram: telegramPatchSchema.optional() }).onUndeclaredKey("reject");
 	hostPatchSchema = type({
 		enabled: "boolean?",
 		intervalMs: "number >= 5000?",
@@ -1059,11 +1148,16 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		loadPerCpu: "number >= 0?",
 		tempCelsius: "number >= 0?"
 	}).onUndeclaredKey("reject");
+	backupSchedulePatchSchema = type({
+		intervalMs: "number.integer >= 0?",
+		keep: "number.integer >= 1?"
+	}).onUndeclaredKey("reject");
 	backupsPatchSchema = type({
 		enabled: "boolean?",
 		dir: "string?",
 		keep: "number.integer >= 1?",
-		includePaths: type("string[]").optional()
+		includePaths: type("string[]").optional(),
+		schedule: backupSchedulePatchSchema.optional()
 	}).onUndeclaredKey("reject");
 	logsPatchSchema = type({
 		persist: "boolean?",
@@ -1384,10 +1478,7 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		privateKey: "string >= 1"
 	}).onUndeclaredKey("reject");
 	proxyEngineInstallSchema = type({ version: "string = \"\"" }).onUndeclaredKey("reject");
-	telegramStatusSchema = type({
-		enabled: "boolean",
-		tokenSet: "boolean",
-		chatId: "string",
+	notificationPolicyStatusShape = {
 		onCrash: "boolean",
 		onUnhealthy: "boolean",
 		onForcedRestart: "boolean",
@@ -1396,8 +1487,24 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		onHost: "boolean",
 		/** Dynamic DNS, when this panel knows about it (optional for an older panel). */
 		onDdns: "boolean?",
-		cooldownMs: "number",
-		/** Last delivery outcome, for the settings page. */
+		cooldownMs: "number"
+	};
+	destinationStatusSchema = type({
+		id: "string",
+		kind: "\"telegram\" | \"webhook\"",
+		enabled: "boolean",
+		useOwnSettings: "boolean",
+		...notificationPolicyStatusShape,
+		/** Telegram only, null on a webhook. */
+		chatId: "string | null",
+		/** Telegram only: whether a bot token is stored for this destination. */
+		tokenSet: "boolean",
+		/** Webhook only, null on a Telegram destination. */
+		url: "string | null",
+		method: "\"POST\" | \"PUT\" | null",
+		format: "\"json\" | \"text\" | null",
+		headers: "string | null",
+		/** Last delivery outcome, for the page. */
 		lastResult: "string | null",
 		lastResultAt: "number | null"
 	});
@@ -1405,7 +1512,12 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		id: "string | number",
 		title: "string"
 	}).array() });
-	notificationViewSchema = type({ telegram: telegramStatusSchema });
+	notificationViewSchema = type({
+		/** The general block: what a destination inherits unless it overrides it. Optional for an older panel. */
+		"defaults?": notificationDefaultsSchema,
+		/** Every destination, in config order. Optional for an older panel. */
+		"destinations?": destinationStatusSchema.array()
+	});
 	sessionViewSchema = type({
 		authenticated: "boolean",
 		authRequired: "boolean",
@@ -1526,14 +1638,24 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		}).array()
 	});
 	backupsViewSchema = type({
-		enabled: "boolean",
-		dir: "string",
-		keep: "number",
+		"enabled": "boolean",
+		"dir": "string",
+		"keep": "number",
+		/**
+		* The scheduled half, so the page can show and edit it.
+		*
+		* Optional because the panel and the UI upgrade separately: an older panel does not send it,
+		* and a required field would blank the settings page for that panel. The page reads it as
+		* "off, keep 7" when absent — the schema defaults — so nothing changes for it.
+		*/
+		"schedule?": backupScheduleSchema,
+		/** When the last automatic archive was written; null until one has run. Optional for the same reason. */
+		"lastAutomaticAt?": "number | null",
 		/** Extra paths from the global config, in addition to each server's own. */
-		includePaths: type("string[]"),
+		"includePaths": type("string[]"),
 		/** Every selectable entry, global first, then each workspace. */
-		entries: backupEntrySchema.array(),
-		files: backupFileSchema.array()
+		"entries": backupEntrySchema.array(),
+		"files": backupFileSchema.array()
 	});
 	restoreItemSchema = type({
 		/** A backup entry or leaf id (`workspace:<id>:servers`, `data:<path>`, ...). */
@@ -1662,11 +1784,11 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		"files?": "number.integer >= 1",
 		/** `owner/name` of the UI's own repository, for `ui-update`. */
 		"repo?": "string",
-		/** The release tag this build came from, e.g. `v0.6.0`. */
+		/** The release tag this build came from, e.g. `v0.6.0`. Stamped by the build, never committed. */
 		"tag?": "string",
 		/** The release asset name, e.g. `home-hosted-ui-noc-console`. */
 		"asset?": "string",
-		/** When the UI was built, in unix epoch seconds. */
+		/** When the UI was built, in unix epoch seconds. Stamped by the build, never committed. */
 		"unix?": "number.integer >= 0"
 	});
 	uiStatusSchema = type({
@@ -1766,10 +1888,19 @@ maxRssBytes: "number.integer >= 0 = 0" }).onUndeclaredKey("reject");
 		lines: logLineSchema.array()
 	});
 	notificationActionSchema = type({
-		/** Optional override, so the token can be tested before it is saved. */
+		/** Optional override, so the token can be tried before it is saved. */
 		botToken: "string?",
 		chatId: "string?"
 	}).onUndeclaredKey("reject");
+	destinationIdParamSchema = type({ id: "/^[a-z0-9][a-z0-9_-]*$/" });
+	destinationTestSchema = type({
+		target: webhookTargetSchema.omit("kind", "id").and(type({
+			id: "string?",
+			kind: "\"webhook\"?"
+		})),
+		/** Echoed so the result is recorded against the right row; absent for a draft. */
+		id: "string?"
+	}).onUndeclaredKey("reject");
 	telegramTokenSchema = type({ botToken: "string >= 1" }).onUndeclaredKey("reject");
 	apiErrorSchema = type({
 		"message": "string",
@@ -1967,6 +2098,20 @@ function isPlainDdns(value) {
 	return "plain" in value;
 }
 /**
+* The bot tokens by destination id.
+*
+* Two shapes read: the map this release writes, and the single `{ botToken }` written before a
+* workspace could have more than one Telegram destination. The old one arrives under the id the
+* config migration gave the destination it came from, so an upgrade keeps a working Telegram.
+*/
+function readTelegramTokens(value) {
+	if (!isRecord(value)) return {};
+	if (typeof value.botToken === "string") return value.botToken.trim().length > 0 ? { [LEGACY_TELEGRAM_ID$1]: value.botToken.trim() } : {};
+	const tokens = {};
+	for (const [id, token] of Object.entries(value)) if (typeof token === "string" && token.trim().length > 0) tokens[id] = token.trim();
+	return tokens;
+}
+/**
 * Sealed on disk, or `{ provider, values }` waiting for the sealing write. A bare
 * field map — written before the provider was recorded — no longer reads, because
 * there is nothing to say which provider those fields belong to.
@@ -2048,7 +2193,7 @@ function openDdns(accountId, sealed, key) {
 		return null;
 	}
 }
-var COST, KEYLEN, SALT_BYTES, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_SEALED_ALGO, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
+var COST, KEYLEN, SALT_BYTES, LEGACY_TELEGRAM_ID$1, DDNS_KEYLEN, DDNS_IV_BYTES, DDNS_AAD_PREFIX, DDNS_SEALED_ALGO, API_TOKEN_BYTES, API_TOKEN_HINT_CHARS, SecretsStore;
 var init_secrets = __esmMin((() => {
 	init_atomic();
 	init_logger();
@@ -2061,6 +2206,7 @@ var init_secrets = __esmMin((() => {
 	};
 	KEYLEN = 64;
 	SALT_BYTES = 16;
+	LEGACY_TELEGRAM_ID$1 = "telegram";
 	DDNS_KEYLEN = 32;
 	DDNS_IV_BYTES = 12;
 	DDNS_AAD_PREFIX = "hh-ddns-v1:";
@@ -2138,11 +2284,17 @@ var init_secrets = __esmMin((() => {
 		get apiTokenHint() {
 			return this.apiToken?.hint ?? null;
 		}
-		get telegramToken() {
-			return this.load().telegram?.botToken ?? null;
+		/** The bot token for one destination, or null when it has none. */
+		telegramToken(id) {
+			const token = this.load().telegram[id] ?? "";
+			return token.length > 0 ? token : null;
+		}
+		telegramTokenSet(id) {
+			return this.telegramToken(id) !== null;
 		}
-		get telegramTokenSet() {
-			return (this.telegramToken ?? "").length > 0;
+		/** Every destination id a token is stored for — including one the config no longer declares. */
+		get telegramTokenIds() {
+			return Object.keys(this.load().telegram).sort();
 		}
 		setPassword(password, options = {}) {
 			const record = hashPassword(password, options);
@@ -2177,11 +2329,24 @@ var init_secrets = __esmMin((() => {
 				apiToken: null
 			});
 		}
-		setTelegramToken(token) {
+		setTelegramToken(id, token) {
 			const trimmed = token?.trim() ?? "";
+			const current = { ...this.load().telegram };
+			if (trimmed.length > 0) current[id] = trimmed;
+			else delete current[id];
 			this.save({
 				...this.load(),
-				telegram: trimmed.length > 0 ? { botToken: trimmed } : null
+				telegram: current
+			});
+		}
+		/** Drops every token whose destination is gone, so a deleted target leaves nothing behind. */
+		forgetTelegramTokens(keep) {
+			const allowed = new Set(keep);
+			const current = this.load().telegram;
+			const next = Object.fromEntries(Object.entries(current).filter(([id]) => allowed.has(id)));
+			if (Object.keys(next).length !== Object.keys(current).length) this.save({
+				...this.load(),
+				telegram: next
 			});
 		}
 		/** Ids that have something stored, whether or not a config still declares them. */
@@ -2286,7 +2451,7 @@ var init_secrets = __esmMin((() => {
 			const empty = {
 				password: null,
 				apiToken: null,
-				telegram: null,
+				telegram: {},
 				ddns: {},
 				ddnsKdf: null
 			};
@@ -2303,7 +2468,7 @@ var init_secrets = __esmMin((() => {
 				return this.inScope({
 					password: parsed?.password ?? null,
 					apiToken: parsed?.apiToken?.hash ? parsed.apiToken : null,
-					telegram: parsed?.telegram?.botToken ? { botToken: parsed.telegram.botToken } : null,
+					telegram: readTelegramTokens(parsed?.telegram),
 					ddns: readStoredDdns(parsed?.ddns),
 					ddnsKdf: readDdnsKdf(parsed?.ddnsKdf)
 				});
@@ -2316,7 +2481,7 @@ var init_secrets = __esmMin((() => {
 		inScope(contents) {
 			if (this.scope === "global") return {
 				...contents,
-				telegram: null,
+				telegram: {},
 				ddns: {},
 				ddnsKdf: null
 			};
@@ -3121,7 +3286,10 @@ function buildWorkspaceView(source) {
 		logsDir: source.logsDir,
 		defaults: source.store.defaults,
 		logs: source.store.logs,
-		notifications: { telegram: source.notifications.status() },
+		notifications: {
+			defaults: source.notifications.defaults(),
+			destinations: source.notifications.destinations()
+		},
 		ddns: source.ddns.view,
 		serverCount: servers.length,
 		runningCount: servers.filter((server) => server.status === "running").length,
@@ -3717,9 +3885,55 @@ var init_control = __esmMin((() => {
 }));
 //#endregion
 //#region src/config/migrations.ts
+/**
+* Schema 1 → 2: `notifications.{telegram, webhooks}` → `notifications.{defaults, destinations}`.
+*
+* The old singleton becomes one `telegram` destination, and each webhook keeps its id, so a
+* destination's cooldown, last-result record and Telegram token all still point at the same thing.
+* `useOwnSettings` is set **true** on every migrated destination: before this schema each one
+* carried its own toggles, and reading one as "inherit" would silently change what it delivers.
+* The old webhook `enabled` default (true) and the Telegram one (false) are preserved as they were.
+*/
+function notificationsToDestinations(config) {
+	const notifications = config.notifications;
+	if (notifications === null || typeof notifications !== "object" || Array.isArray(notifications)) return config;
+	const group = notifications;
+	if (group.destinations !== void 0 || group.telegram === void 0 && group.webhooks === void 0) return config;
+	const destinations = [];
+	const telegram = group.telegram;
+	if (telegram !== null && typeof telegram === "object") {
+		const { enabled, chatId, ...policy } = telegram;
+		destinations.push({
+			kind: "telegram",
+			id: LEGACY_TELEGRAM_ID,
+			enabled: enabled ?? false,
+			chatId: chatId ?? "",
+			useOwnSettings: true,
+			...policy
+		});
+	}
+	if (Array.isArray(group.webhooks)) for (const entry of group.webhooks) {
+		if (entry === null || typeof entry !== "object") continue;
+		destinations.push({
+			kind: "webhook",
+			useOwnSettings: true,
+			...entry
+		});
+	}
+	const next = {
+		...group,
+		destinations
+	};
+	delete next.telegram;
+	delete next.webhooks;
+	return {
+		...config,
+		notifications: next
+	};
+}
 /** What would have to run to bring `from` up to `to`. */
 function planConfigMigrations(from, options = {}) {
-	const to = options.to ?? 1;
+	const to = options.to ?? 2;
 	const steps = (options.migrations ?? configMigrations).filter((migration) => migration.to > from && migration.to <= to).sort((a, b) => a.to - b.to);
 	return {
 		from,
@@ -3729,19 +3943,42 @@ function planConfigMigrations(from, options = {}) {
 		reached: steps.at(-1)?.to ?? from
 	};
 }
-/** Applies the plan in order; the caller owns writing the result. */
+/**
+* Applies the plan in order; the caller owns writing the result.
+*
+* The result carries `meta.schema` set to the schema the steps reached, so it is readable by this
+* release's own parser — which refuses a file whose stamp still says an older schema. Without that,
+* `migrate` validated its own output as "needs 1 migration" and refused every config it exists to
+* lift.
+*/
 function applyConfigMigrations(config, from, options = {}) {
-	const { steps } = planConfigMigrations(from, options);
+	const plan = planConfigMigrations(from, options);
 	let current = config;
-	for (const step of steps) current = step.apply(current);
-	return {
+	for (const step of plan.steps) current = step.apply(current);
+	if (plan.steps.length === 0) return {
 		config: current,
-		applied: steps
+		applied: plan.steps
+	};
+	const meta = current.meta !== null && typeof current.meta === "object" && !Array.isArray(current.meta) ? current.meta : {};
+	return {
+		config: {
+			...current,
+			meta: {
+				...meta,
+				schema: plan.reached
+			}
+		},
+		applied: plan.steps
 	};
 }
-var configMigrations;
+var LEGACY_TELEGRAM_ID, configMigrations;
 var init_migrations = __esmMin((() => {
-	configMigrations = [];
+	LEGACY_TELEGRAM_ID = "telegram";
+	configMigrations = [{
+		to: 2,
+		describe: "notifications: fold the Telegram singleton and the webhook list into one `destinations` list, with a shared `defaults` block",
+		apply: notificationsToDestinations
+	}];
 }));
 //#endregion
 //#region src/config/parse.ts
@@ -3805,10 +4042,10 @@ function readStamp(raw, options) {
 	const meta = isRecord(raw.meta) ? raw.meta : null;
 	const schemaVersion = typeof meta?.schema === "number" ? meta.schema : 1;
 	const writtenBy = typeof meta?.writtenBy === "string" && meta.writtenBy.length > 0 ? meta.writtenBy : null;
-	if (schemaVersion > 1) return {
+	if (schemaVersion > 2) return {
 		schemaVersion,
 		writtenBy,
-		error: `written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 1`
+		error: `written by home-hosted ${writtenBy ?? "a newer release"} (config schema ${schemaVersion}); this release understands schema 2`
 	};
 	const { steps } = planConfigMigrations(schemaVersion, options);
 	if (steps.length > 0) return {
@@ -3965,6 +4202,7 @@ function validateCrossField(servers) {
 	for (const server of servers) {
 		const { health } = server;
 		if (health.mode === "http" && health.http.method === "HEAD" && health.http.expectBody.length > 0) errors.push(`"${server.id}" requires a response body with method HEAD, which has none — the body check is ignored`);
+		if (health.mode === "http" && health.http.scheme === "http" && health.http.allowInvalidCert) errors.push(`"${server.id}" sets allowInvalidCert on an http probe, where there is no certificate to check`);
 		for (const dependency of server.dependsOn) if (dependency === server.id) errors.push(`"${server.id}" depends on itself`);
 		else if (!ids.has(dependency)) errors.push(`"${server.id}" depends on unknown server "${dependency}"`);
 	}
@@ -3992,7 +4230,7 @@ function stampConfig(draft) {
 		...$schema === void 0 ? {} : { $schema },
 		meta: {
 			writtenBy: appVersion(),
-			schema: 1
+			schema: 2
 		},
 		...rest
 	};
@@ -4043,7 +4281,7 @@ function mergeGroup(target, patch) {
 	}
 	return merged;
 }
-var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, PROXY_MERGE_KEYS, EMPTY_MERGE_KEYS;
+var SERVER_MERGE_KEYS, CONTROL_MERGE_KEYS, NOTIFICATION_MERGE_KEYS, DDNS_MERGE_KEYS, PROXY_MERGE_KEYS, BACKUP_MERGE_KEYS, EMPTY_MERGE_KEYS;
 var init_patch = __esmMin((() => {
 	init_shape();
 	SERVER_MERGE_KEYS = /* @__PURE__ */ new Set([
@@ -4052,9 +4290,10 @@ var init_patch = __esmMin((() => {
 		"stop"
 	]);
 	CONTROL_MERGE_KEYS = /* @__PURE__ */ new Set(["auth", "tls"]);
-	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["telegram"]);
+	NOTIFICATION_MERGE_KEYS = /* @__PURE__ */ new Set(["defaults"]);
 	DDNS_MERGE_KEYS = /* @__PURE__ */ new Set(["ipv4", "ipv6"]);
 	PROXY_MERGE_KEYS = /* @__PURE__ */ new Set(["dns01"]);
+	BACKUP_MERGE_KEYS = /* @__PURE__ */ new Set(["schedule"]);
 	EMPTY_MERGE_KEYS = /* @__PURE__ */ new Set();
 }));
 //#endregion
@@ -4244,7 +4483,7 @@ var init_settings$1 = __esmMin((() => {
 		updateBackups(patch) {
 			const draft = structuredClone(this.raw);
 			draft.backups = { ...draft.backups ?? {} };
-			applyPatch(draft.backups, patch, EMPTY_MERGE_KEYS);
+			applyPatch(draft.backups, patch, BACKUP_MERGE_KEYS);
 			const backups = this.parseGroup(backupsSchema, draft.backups, "backups");
 			this.commit(draft);
 			return backups;
@@ -5806,6 +6045,171 @@ var init_ddns$2 = __esmMin((() => {
 	BY_ID$1 = new Map(DDNS_PROVIDERS.map((provider) => [provider.id, provider]));
 }));
 //#endregion
+//#region src/helpers/env-file.ts
+/** `KEY=value` files, with optional `export `, `#` comments and quoted values. */
+function parseEnvFile(text) {
+	const env = {};
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (line.length === 0 || line.startsWith("#")) continue;
+		const assignment = line.startsWith("export ") ? line.slice(7) : line;
+		const separator = assignment.indexOf("=");
+		if (separator <= 0) continue;
+		const key = assignment.slice(0, separator).trim();
+		let value = assignment.slice(separator + 1).trim();
+		if (value.length > 1 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+		env[key] = value;
+	}
+	return env;
+}
+/** Missing files are not an error: an env file is an optional override layer. */
+function loadEnvFile(file) {
+	try {
+		return {
+			env: parseEnvFile(fs.readFileSync(file, "utf8")),
+			path: file,
+			error: null
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			env: {},
+			path: file,
+			error: null
+		};
+		return {
+			env: {},
+			path: file,
+			error: errorMessage(error)
+		};
+	}
+}
+/** Expands `${VAR}` from the given vars; unknown references are left visible. */
+function expandEnv(value, vars) {
+	return value.replace(VARIABLE, (match, name) => vars[name] ?? match);
+}
+function expandEnvRecord(record, vars) {
+	return Object.fromEntries(Object.entries(record).map(([key, value]) => [key, expandEnv(value, vars)]));
+}
+function expandEnvList(values, vars) {
+	return values.map((value) => expandEnv(value, vars));
+}
+function resolveEnvFilePath(file, cwd) {
+	if (path.isAbsolute(file)) return file;
+	return path.resolve(cwd, file);
+}
+var VARIABLE;
+var init_env_file = __esmMin((() => {
+	init_error_message();
+	VARIABLE = /\$\{([A-Z_]\w*)\}/gi;
+}));
+//#endregion
+//#region src/providers/webhook.ts
+/** The JSON body for one event. Exported so a test can pin the shape without a round trip. */
+function webhookPayload(event, now = Date.now()) {
+	const text = `${event.title}\n${event.message}`;
+	return {
+		text,
+		content: text,
+		title: event.title,
+		message: event.message,
+		reason: event.reason,
+		server: event.serverId.length > 0 ? event.serverId : null,
+		label: event.label.length > 0 ? event.label : null,
+		at: now
+	};
+}
+/**
+* `Name: value` lines into a header map.
+*
+* The format is line-based rather than a JSON object because it is edited in a textarea, and
+* a value with a colon in it (`Authorization: Bearer a:b`) must survive: only the **first**
+* colon separates the two.
+*
+* `vars` expands `${ENV}` in the values, so a credential does not have to be written into the
+* config file. A name the panel's environment does not define is left as written, the same rule
+* `expandEnv` follows everywhere else.
+*/
+function parseHeaders(text, vars = process.env) {
+	const headers = {};
+	const errors = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+		const at = trimmed.indexOf(":");
+		if (at <= 0) {
+			errors.push(`"${trimmed}" is not a "Name: value" header`);
+			continue;
+		}
+		headers[trimmed.slice(0, at).trim()] = expandEnv(trimmed.slice(at + 1).trim(), vars);
+	}
+	return {
+		headers,
+		errors
+	};
+}
+/** Why a target cannot be sent to, or null when it can. Also used to validate a save. */
+function targetProblem(target, options = {}) {
+	const url = target.url.trim();
+	if (url.length === 0) return options.requireUrl === false ? null : "no URL configured";
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return "the URL is not valid";
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return `the URL must be http or https, not ${parsed.protocol}`;
+	const { errors } = parseHeaders(target.headers);
+	return errors.length > 0 ? errors.join("; ") : null;
+}
+async function sendWebhook(target, event, fetchImpl) {
+	const problem = targetProblem(target);
+	if (problem !== null) return {
+		ok: false,
+		error: problem
+	};
+	const { headers, errors } = parseHeaders(target.headers);
+	if (errors.length > 0) return {
+		ok: false,
+		error: errors.join("; ")
+	};
+	const payload = webhookPayload(event);
+	const asText = target.format === "text";
+	const body = asText ? payload.message : JSON.stringify(payload);
+	const url = expandEnv(target.url.trim(), process.env);
+	if (url.includes("${")) return {
+		ok: false,
+		error: `the URL still holds an unexpanded placeholder: ${url}`
+	};
+	try {
+		const response = await (fetchImpl ?? fetch)(url, {
+			method: target.method,
+			headers: {
+				"content-type": asText ? "text/plain; charset=utf-8" : "application/json",
+				...headers
+			},
+			body,
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!response.ok) {
+			const trimmed = (await response.text().catch(() => "")).trim().slice(0, 200);
+			return {
+				ok: false,
+				error: `answered ${response.status}${trimmed.length > 0 ? `: ${trimmed}` : ""}`
+			};
+		}
+		return { ok: true };
+	} catch (error) {
+		return {
+			ok: false,
+			error: errorMessage(error)
+		};
+	}
+}
+var init_webhook = __esmMin((() => {
+	init_env_file();
+	init_error_message();
+}));
+//#endregion
 //#region src/config/store.ts
 function readFile(file) {
 	let text;
@@ -5851,6 +6255,8 @@ var init_store = __esmMin((() => {
 	init_settings$1();
 	init_atomic();
 	init_ddns$2();
+	init_webhook();
+	init_contracts();
 	WorkspaceStore = class {
 		workspaceId;
 		settingsFile;
@@ -6070,6 +6476,13 @@ var init_store = __esmMin((() => {
 			draft.notifications = { ...draft.notifications ?? {} };
 			applyPatch(draft.notifications, patch, NOTIFICATION_MERGE_KEYS);
 			const notifications = this.parseGroup(notificationsSchema, draft.notifications, "notifications");
+			const duplicates = duplicateWebhookIds(notifications.destinations);
+			if (duplicates.length > 0) throw new ConfigError(`notifications: duplicate webhook id ${duplicates.map((id) => `"${id}"`).join(", ")}`);
+			for (const target of notifications.destinations) {
+				if (target.kind !== "webhook") continue;
+				const problem = targetProblem(target, { requireUrl: true });
+				if (problem !== null) throw new ConfigError(`notifications: webhook "${target.id}" ${problem}`);
+			}
 			this.commitSettings(draft);
 			return notifications;
 		}
@@ -6769,58 +7182,77 @@ var init_telegram = __esmMin((() => {
 //#endregion
 //#region src/api/notifications.ts
 /**
-* The bot token is written straight to a workspace's secrets file and never into a
+* A destination's credential is written straight to a workspace's secrets file and never into a
 * servers config, so notification *policy* and the *credential* stay separate.
 *
-* Notifications belong to a workspace: each one keeps its own token and chat.
+* Notifications belong to a workspace, and every route is scoped to one. The token is keyed by the
+* **destination id**, which is what lets a workspace point at more than one Telegram chat.
 */
 function createNotificationsRoute(deps) {
-	return appFactory.createApp().put("/notifications/token", describeRoute({
+	const runtimeFor = (workspace) => requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), workspace);
+	return appFactory.createApp().put("/notifications/destinations/:id/token", describeRoute({
 		tags: ["notifications"],
-		summary: "Store the Telegram bot token (verified first)",
+		summary: "Store a Telegram destination's bot token (verified first)",
 		responses: {
 			200: { description: "Stored" },
 			400: ERROR_RESPONSES[400]
 		}
-	}), validate("query", workspaceQuerySchema), validate("json", telegramTokenSchema), async (c) => {
-		const runtime = requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace);
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), validate("json", telegramTokenSchema), async (c) => {
+		const runtime = runtimeFor(c.req.valid("query").workspace);
+		const id = c.req.valid("param").id;
 		const { botToken } = c.req.valid("json");
 		const verified = await runtime.notifications.verifyToken(botToken);
 		if (!verified.ok) throw new DetailedError(`telegram rejected the token: ${verified.error ?? "unknown error"}`, {
 			statusCode: 400,
 			code: "TELEGRAM_TOKEN_REJECTED"
 		});
-		runtime.secrets.setTelegramToken(botToken);
+		runtime.secrets.setTelegramToken(id, botToken);
 		forgetBots();
 		return c.json({
 			ok: true,
 			username: verified.username ?? null
 		});
-	}).delete("/notifications/token", describeRoute({
+	}).delete("/notifications/destinations/:id/token", describeRoute({
 		tags: ["notifications"],
-		summary: "Forget the Telegram bot token",
+		summary: "Forget a Telegram destination's bot token",
 		responses: { 200: { description: "Removed" } }
-	}), validate("query", workspaceQuerySchema), (c) => {
-		requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).secrets.setTelegramToken(null);
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), (c) => {
+		runtimeFor(c.req.valid("query").workspace).secrets.setTelegramToken(c.req.valid("param").id, null);
 		forgetBots();
 		return c.json({ ok: true });
-	}).post("/notifications/test", describeRoute({
+	}).post("/notifications/destinations/:id/test", describeRoute({
 		tags: ["notifications"],
-		summary: "Send a test message",
+		summary: "Send a test message to one destination",
 		responses: {
 			200: { description: "Sent or refused" },
 			400: ERROR_RESPONSES[400]
 		}
-	}), validate("query", workspaceQuerySchema), validate("json", notificationActionSchema), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).notifications.sendTest(c.req.valid("json"));
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), validate("json", notificationActionSchema), async (c) => {
+		const result = await runtimeFor(c.req.valid("query").workspace).notifications.sendTest(c.req.valid("param").id, c.req.valid("json"));
 		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
 			statusCode: 400,
 			code: "TELEGRAM_SEND_FAILED"
 		});
 		return c.json(result);
-	}).post("/notifications/detect-chats", describeRoute({
+	}).post("/notifications/test-webhook", describeRoute({
+		tags: ["notifications"],
+		summary: "Send a test to one webhook destination",
+		responses: {
+			200: { description: "Sent or refused" },
+			400: ERROR_RESPONSES[400]
+		}
+	}), validate("query", workspaceQuerySchema), validate("json", destinationTestSchema), async (c) => {
+		const runtime = runtimeFor(c.req.valid("query").workspace);
+		const { target, id } = c.req.valid("json");
+		const result = await runtime.notifications.testWebhook(target, id);
+		if (!result.ok) throw new DetailedError(result.error ?? "the test message failed", {
+			statusCode: 400,
+			code: "WEBHOOK_SEND_FAILED"
+		});
+		return c.json(result);
+	}).post("/notifications/destinations/:id/detect-chats", describeRoute({
 		tags: ["notifications"],
-		summary: "List the chats the bot can see",
+		summary: "List the chats a Telegram destination's bot can see",
 		responses: {
 			200: {
 				description: "Chats",
@@ -6828,8 +7260,8 @@ function createNotificationsRoute(deps) {
 			},
 			400: ERROR_RESPONSES[400]
 		}
-	}), validate("query", workspaceQuerySchema), validate("json", notificationActionSchema), async (c) => {
-		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).notifications.detectChats(c.req.valid("json"));
+	}), validate("query", workspaceQuerySchema), validate("param", destinationIdParamSchema), validate("json", notificationActionSchema), async (c) => {
+		const result = await runtimeFor(c.req.valid("query").workspace).notifications.detectChats(c.req.valid("param").id, c.req.valid("json"));
 		if (!result.ok) throw new DetailedError(result.error ?? "could not list chats", {
 			statusCode: 400,
 			code: "TELEGRAM_LIST_FAILED"
@@ -10531,7 +10963,10 @@ function buildWorkspaceSettings(runtime) {
 		configError: runtime.store.configError,
 		defaults: runtime.store.defaults,
 		logs: runtime.store.logs,
-		notifications: { telegram: runtime.notifications.status() }
+		notifications: {
+			defaults: runtime.notifications.defaults(),
+			destinations: runtime.notifications.destinations()
+		}
 	};
 }
 function createSettingsRoute(deps) {
@@ -10723,7 +11158,10 @@ function createSettingsRoute(deps) {
 		try {
 			if (patch.defaults !== void 0) runtime.store.updateDefaults(patch.defaults);
 			if (patch.logs !== void 0) runtime.store.updateLogs(patch.logs);
-			if (patch.notifications !== void 0) runtime.store.updateNotifications(patch.notifications);
+			if (patch.notifications !== void 0) {
+				const saved = runtime.store.updateNotifications(patch.notifications);
+				runtime.secrets.forgetTelegramTokens(saved.destinations.map((destination) => destination.id));
+			}
 		} catch (error) {
 			if (error instanceof ConfigError) throw new DetailedError(error.message, {
 				statusCode: 400,
@@ -11546,64 +11984,6 @@ var init_secret_parts = __esmMin((() => {
 	EXTRA_FIELDS = { ddns: ["ddns", "ddnsKdf"] };
 }));
 //#endregion
-//#region src/helpers/env-file.ts
-/** `KEY=value` files, with optional `export `, `#` comments and quoted values. */
-function parseEnvFile(text) {
-	const env = {};
-	for (const raw of text.split("\n")) {
-		const line = raw.trim();
-		if (line.length === 0 || line.startsWith("#")) continue;
-		const assignment = line.startsWith("export ") ? line.slice(7) : line;
-		const separator = assignment.indexOf("=");
-		if (separator <= 0) continue;
-		const key = assignment.slice(0, separator).trim();
-		let value = assignment.slice(separator + 1).trim();
-		if (value.length > 1 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
-		env[key] = value;
-	}
-	return env;
-}
-/** Missing files are not an error: an env file is an optional override layer. */
-function loadEnvFile(file) {
-	try {
-		return {
-			env: parseEnvFile(fs.readFileSync(file, "utf8")),
-			path: file,
-			error: null
-		};
-	} catch (error) {
-		if (error.code === "ENOENT") return {
-			env: {},
-			path: file,
-			error: null
-		};
-		return {
-			env: {},
-			path: file,
-			error: errorMessage(error)
-		};
-	}
-}
-/** Expands `${VAR}` from the given vars; unknown references are left visible. */
-function expandEnv(value, vars) {
-	return value.replace(VARIABLE, (match, name) => vars[name] ?? match);
-}
-function expandEnvRecord(record, vars) {
-	return Object.fromEntries(Object.entries(record).map(([key, value]) => [key, expandEnv(value, vars)]));
-}
-function expandEnvList(values, vars) {
-	return values.map((value) => expandEnv(value, vars));
-}
-function resolveEnvFilePath(file, cwd) {
-	if (path.isAbsolute(file)) return file;
-	return path.resolve(cwd, file);
-}
-var VARIABLE;
-var init_env_file = __esmMin((() => {
-	init_error_message();
-	VARIABLE = /\$\{([A-Z_]\w*)\}/gi;
-}));
-//#endregion
 //#region src/providers/archive.ts
 /** Recognised by content, never by the file's name. */
 function isZipArchive(file) {
@@ -11850,18 +12230,99 @@ async function probeTcp(host, port, timeoutMs) {
 	};
 }
 /**
+* One request/response, capped at `timeoutMs` and `MAX_BODY_BYTES`.
+*
+* Node's `fetch` cannot be told to accept a certificate it does not trust, which is the normal
+* case for a backend on a home network: its own self-signed pair, or one from the engine's local
+* CA. So this speaks http/https directly, the same way `helpers/daemon.ts` reaches a panel with an
+* uploaded pair. A `HEAD` gets no body, which the caller already accounts for.
+*/
+function request(url, method, allowInvalidCert, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		const secure = url.protocol === "https:";
+		let req;
+		let settled = false;
+		let deadline;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(deadline);
+			resolve(value);
+		};
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(deadline);
+			reject(error instanceof Error ? error : new Error(String(error)));
+		};
+		/**
+		* The whole exchange, not just the socket.
+		*
+		* `timeout` on the request is an **idle** timeout, so a server dripping one byte every half
+		* second keeps resetting it and the probe never returns — which hangs the supervisor's tick,
+		* since the probe is awaited. The old `fetch` path had `AbortSignal.timeout`, an absolute
+		* cap; this restores that guarantee.
+		*/
+		deadline = setTimeout(() => {
+			fail(/* @__PURE__ */ new Error(`no complete response within ${timeoutMs}ms`));
+			req.destroy();
+		}, timeoutMs);
+		deadline.unref();
+		req = (secure ? https : http).request({
+			hostname: url.hostname,
+			port: url.port,
+			path: `${url.pathname}${url.search}`,
+			method,
+			...secure && allowInvalidCert ? { rejectUnauthorized: false } : {},
+			timeout: timeoutMs
+		}, (response) => {
+			let body = "";
+			let bytes = 0;
+			let truncated = false;
+			response.setEncoding("utf8");
+			response.on("data", (chunk) => {
+				if (truncated) return;
+				bytes += Buffer$1.byteLength(chunk);
+				if (bytes > MAX_BODY_BYTES) {
+					truncated = true;
+					body += chunk.slice(0, Math.max(0, MAX_BODY_BYTES - (bytes - Buffer$1.byteLength(chunk))));
+					response.destroy();
+					finish({
+						status: response.statusCode ?? 0,
+						body,
+						truncated
+					});
+					return;
+				}
+				body += chunk;
+			});
+			response.once("end", () => {
+				if (!truncated) finish({
+					status: response.statusCode ?? 0,
+					body,
+					truncated
+				});
+			});
+			response.once("error", (error) => {
+				if (!truncated) fail(error);
+			});
+		});
+		req.once("error", (error) => fail(error));
+		req.once("timeout", () => {
+			fail(/* @__PURE__ */ new Error(`no response within ${timeoutMs}ms`));
+			req.destroy();
+		});
+		req.end();
+	});
+}
+/**
 * Fetches the configured path and asserts the response, so "listening" is not
 * mistaken for "working".
 */
 async function probeHttp(host, port, options) {
-	const url = `http://${host}:${port}${options.path.startsWith("/") ? options.path : `/${options.path}`}`;
 	const started = Date.now();
 	try {
-		const response = await fetch(url, {
-			method: options.method,
-			redirect: "manual",
-			signal: AbortSignal.timeout(options.timeoutMs)
-		});
+		const response = await request(new URL(`${options.scheme}://${host}:${port}${options.path.startsWith("/") ? options.path : `/${options.path}`}`), options.method, options.allowInvalidCert, options.timeoutMs);
 		const ms = Date.now() - started;
 		const expected = options.expectStatus ?? null;
 		if (expected !== null && response.status !== expected) return {
@@ -11876,11 +12337,14 @@ async function probeHttp(host, port, options) {
 		};
 		const bodySkipped = options.expectBody.length > 0 && options.method === "HEAD";
 		if (options.expectBody.length > 0 && !bodySkipped) {
-			if (!(await response.text()).includes(options.expectBody)) return {
-				healthy: false,
-				ms,
-				detail: `body does not contain ${JSON.stringify(options.expectBody)}`
-			};
+			if (!response.body.includes(options.expectBody)) {
+				const scope = response.truncated ? ` (only the first ${MAX_BODY_BYTES} bytes were read)` : "";
+				return {
+					healthy: false,
+					ms,
+					detail: `body does not contain ${JSON.stringify(options.expectBody)}${scope}`
+				};
+			}
 		}
 		if (bodySkipped) return {
 			healthy: true,
@@ -11916,9 +12380,11 @@ async function probeHealth(options) {
 	}
 	return last;
 }
+var MAX_BODY_BYTES;
 var init_health_check = __esmMin((() => {
 	init_port();
 	init_error_message();
+	MAX_BODY_BYTES = 1e6;
 }));
 //#endregion
 //#region src/providers/process.ts
@@ -13716,6 +14182,7 @@ var init_supervisor = __esmMin((() => {
 		}
 		/** The decisions that have to survive this panel, and nothing else. */
 		persistEntryState(entry) {
+			if (entry.removed) return;
 			writeEntryState(entryStatePath(this.options.nannyDir, entry.config.id), {
 				restarts: entry.restarts,
 				bootstrapDone: entry.bootstrapDone,
@@ -14001,6 +14468,10 @@ function readText(file) {
 		return null;
 	}
 }
+/** Whether an archive came from the schedule rather than from a person. */
+function isAutomatic(file) {
+	return file.name.startsWith(`${AUTO_PREFIX}-`);
+}
 /** The label of one item, for `applied`; items are built before actions run. */
 function labelOf(plan, id) {
 	return plan.items.find((item) => item.id === id)?.label ?? id;
@@ -14048,13 +14519,14 @@ function readableWorkspaceSettings(text) {
 		return false;
 	}
 }
-var MANIFEST, ALLOWED_ROOTS, SUFFIX, RELOADABLE, SECRET_LABELS, BackupService;
+var MANIFEST, ALLOWED_ROOTS, SUFFIX, AUTO_PREFIX, RELOADABLE, SECRET_LABELS, BackupService;
 var init_backups = __esmMin((() => {
 	init_migrations();
 	init_parse();
 	init_secret_parts();
 	init_atomic();
 	init_env_file();
+	init_logger();
 	init_paths();
 	init_template();
 	init_version();
@@ -14070,6 +14542,7 @@ var init_backups = __esmMin((() => {
 		"data"
 	]);
 	SUFFIX = ".zip";
+	AUTO_PREFIX = "auto";
 	RELOADABLE = /^global:settings$|^workspace:[^:]+:(?:settings|servers)$/;
 	SECRET_LABELS = {
 		password: {
@@ -14098,6 +14571,17 @@ var init_backups = __esmMin((() => {
 		*/
 		flags = /* @__PURE__ */ new Map();
 		refreshing = null;
+		/** One scheduled pass at a time: a slow archive must not stack up behind itself. */
+		running = false;
+		disposed = false;
+		/**
+		* When this instance last attempted an automatic pass, whatever it wrote.
+		*
+		* The archive's own mtime is the durable record across a restart, but it cannot bound a
+		* failed pass: nothing is written, so every panel tick would retry — once a second, for as
+		* long as the failure lasts. This is the in-memory backstop for that case.
+		*/
+		lastAttemptAt = null;
 		constructor(options) {
 			this.options = options;
 		}
@@ -14105,6 +14589,9 @@ var init_backups = __esmMin((() => {
 		async warm() {
 			await this.refresh();
 		}
+		dispose() {
+			this.disposed = true;
+		}
 		get directory() {
 			return this.resolveDir();
 		}
@@ -14116,6 +14603,8 @@ var init_backups = __esmMin((() => {
 				enabled: config.enabled,
 				dir: this.directory,
 				keep: config.keep,
+				schedule: { ...config.schedule },
+				lastAutomaticAt: this.lastAutomatic(),
 				includePaths: [...sources.includePaths],
 				entries: this.entries(sources),
 				files: this.list()
@@ -14141,7 +14630,13 @@ var init_backups = __esmMin((() => {
 			const file = path.join(this.resolveDir(), name);
 			return fs.existsSync(file) ? file : null;
 		}
-		/** `password` encrypts the archive; it is never stored anywhere. */
+		/**
+		* `password` encrypts the archive; it is never stored anywhere.
+		*
+		* `automatic` marks an archive the schedule wrote, which is what keeps the two retention
+		* counts apart: an automatic pass must never prune the backup a person took by hand, and a
+		* manual one must not silently eat the history the schedule is keeping.
+		*/
 		async create(options = {}) {
 			if (!this.options.getConfig().enabled) return {
 				ok: false,
@@ -14165,7 +14660,7 @@ var init_backups = __esmMin((() => {
 			const sources = this.options.getSources();
 			const staging = path.join(dir, `.staging-${Date.now()}`);
 			const createdAt = Date.now();
-			const name = `backup-${new Date(createdAt).toISOString().replace(/[:T]/g, "-").replace(/\.\d+Z$/, "")}-${createdAt % 1e3}${SUFFIX}`;
+			const name = `${options.automatic === true ? AUTO_PREFIX : "backup"}-${new Date(createdAt).toISOString().replace(/[:T]/g, "-").replace(/\.\d+Z$/, "")}-${createdAt % 1e3}${SUFFIX}`;
 			const destination = path.join(dir, name);
 			try {
 				fs.mkdirSync(staging, { recursive: true });
@@ -14239,7 +14734,7 @@ var init_backups = __esmMin((() => {
 					createdAt,
 					hostname: os.hostname(),
 					writtenBy: appVersion(),
-					schema: 1,
+					schema: 2,
 					data
 				};
 				fs.writeFileSync(path.join(staging, MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`);
@@ -14355,9 +14850,9 @@ var init_backups = __esmMin((() => {
 				};
 				const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
 				plan.archive = manifestInfo(manifest);
-				if (manifest.schema !== void 0 && manifest.schema > 1) return {
+				if (manifest.schema !== void 0 && manifest.schema > 2) return {
 					...plan,
-					error: `written by home-hosted ${manifest.writtenBy ?? "a newer release"} (config schema ${manifest.schema}); this release understands schema 1`
+					error: `written by home-hosted ${manifest.writtenBy ?? "a newer release"} (config schema ${manifest.schema}); this release understands schema 2`
 				};
 				const sources = this.options.getSources();
 				const selectedIds = options.include === void 0 ? null : new Set(options.include);
@@ -14943,9 +15438,46 @@ var init_backups = __esmMin((() => {
 			});
 			return true;
 		}
+		/**
+		* Drops the oldest archives past their own limit.
+		*
+		* Two budgets, because the two sources are not the same thing: `keep` is what a person
+		* agreed to store, and pruning a hand-taken archive to make room for a scheduled one would
+		* lose the copy they deliberately made. The scheduled pair keeps `schedule.keep` automatic
+		* archives; the rest keeps `keep`.
+		*/
 		prune() {
-			const { keep } = this.options.getConfig();
-			for (const file of this.list().slice(keep)) this.remove(file.name);
+			const config = this.options.getConfig();
+			const files = this.list();
+			const automatic = files.filter(isAutomatic);
+			const manual = files.filter((file) => !isAutomatic(file));
+			for (const file of automatic.slice(config.schedule.keep)) this.remove(file.name);
+			for (const file of manual.slice(config.keep)) this.remove(file.name);
+		}
+		/** When the newest automatic archive was written, or null when there is none. */
+		lastAutomatic() {
+			return this.list().find(isAutomatic)?.createdAt ?? null;
+		}
+		/**
+		* Runs one scheduled pass when it is due. Modelled on the DDNS pass: cheap to call on every
+		* panel tick, never blocking, and never two at once.
+		*/
+		tick(now = Date.now()) {
+			if (this.disposed || this.running) return;
+			const config = this.options.getConfig();
+			if (!config.enabled || config.schedule.intervalMs <= 0) return;
+			const last = this.lastAutomatic();
+			const latest = last === null ? this.lastAttemptAt : Math.max(last, this.lastAttemptAt ?? 0);
+			if (latest !== null && now - latest < config.schedule.intervalMs) return;
+			this.running = true;
+			this.lastAttemptAt = now;
+			this.create({ automatic: true }).then((result) => {
+				if (!result.ok) logger.warn("the scheduled backup failed", result.error);
+			}).catch((error) => {
+				logger.error("the scheduled backup failed", error);
+			}).finally(() => {
+				this.running = false;
+			});
 		}
 		resolveDir() {
 			const configured = this.options.getConfig().dir;
@@ -16193,10 +16725,11 @@ var init_log_files = __esmMin((() => {
 }));
 //#endregion
 //#region src/services/notifications.ts
-var REASON_LABEL, TITLE, NotificationService;
+var REASON_LABEL, TITLE, COVERS, NotificationService;
 var init_notifications = __esmMin((() => {
 	init_logger();
 	init_telegram();
+	init_webhook();
 	init_error_message();
 	REASON_LABEL = {
 		"crash": "gave up restarting",
@@ -16220,122 +16753,230 @@ var init_notifications = __esmMin((() => {
 		"ddns": "🌐 DNS updated",
 		"ddns-error": "🌐 DNS update failed"
 	};
+	COVERS = {
+		"crash": (policy) => policy.onCrash,
+		"rss": (policy) => policy.onCrash,
+		"unhealthy": (policy) => policy.onUnhealthy,
+		"forced-restart": (policy) => policy.onForcedRestart,
+		"recovered": (policy) => policy.onRecovered,
+		"host": (policy) => policy.onHost,
+		"host-recovered": (policy) => policy.onHost,
+		"ddns": (policy) => policy.onDdns,
+		"ddns-error": (policy) => policy.onDdns
+	};
 	NotificationService = class {
 		secrets;
 		getConfig;
 		cooldowns = /* @__PURE__ */ new Map();
-		lastResult = null;
-		lastResultAt = null;
+		results = /* @__PURE__ */ new Map();
 		constructor(secrets, getConfig) {
 			this.secrets = secrets;
 			this.getConfig = getConfig;
 		}
-		get telegramTokenSet() {
-			return this.secrets.telegramTokenSet;
+		/** The general block, as the page edits it. */
+		defaults() {
+			return { ...this.getConfig().defaults };
 		}
-		status() {
-			const telegram = this.getConfig().telegram;
-			return {
-				enabled: telegram.enabled,
-				tokenSet: this.secrets.telegramTokenSet,
-				chatId: telegram.chatId,
-				onCrash: telegram.onCrash,
-				onUnhealthy: telegram.onUnhealthy,
-				onForcedRestart: telegram.onForcedRestart,
-				onRecovered: telegram.onRecovered,
-				onHost: telegram.onHost,
-				onDdns: telegram.onDdns,
-				cooldownMs: telegram.cooldownMs,
-				lastResult: this.lastResult,
-				lastResultAt: this.lastResultAt
+		/**
+		* Every destination as a row: its own fields, the policy it will actually use, and its last result.
+		*
+		* The page shows this rather than the raw config, so an inheriting destination displays the
+		* inherited toggles — the values a send will use, not the stale ones on disk.
+		*/
+		destinations() {
+			return this.getConfig().destinations.map((target) => {
+				const result = this.results.get(target.id) ?? {
+					lastResult: null,
+					lastResultAt: null
+				};
+				const common = {
+					id: target.id,
+					kind: target.kind,
+					enabled: target.enabled,
+					useOwnSettings: target.useOwnSettings,
+					...this.effectivePolicy(target),
+					lastResult: result.lastResult,
+					lastResultAt: result.lastResultAt
+				};
+				if (target.kind === "telegram") return {
+					...common,
+					chatId: target.chatId,
+					tokenSet: this.secrets.telegramTokenSet(target.id),
+					url: null,
+					method: null,
+					format: null,
+					headers: null
+				};
+				return {
+					...common,
+					chatId: null,
+					tokenSet: false,
+					url: target.url,
+					method: target.method,
+					format: target.format,
+					headers: target.headers
+				};
+			});
+		}
+		/** The policy a destination actually uses: its own, or the general block's. */
+		effectivePolicy(target) {
+			if (target.useOwnSettings) return {
+				onCrash: target.onCrash,
+				onUnhealthy: target.onUnhealthy,
+				onForcedRestart: target.onForcedRestart,
+				onRecovered: target.onRecovered,
+				onHost: target.onHost,
+				onDdns: target.onDdns,
+				cooldownMs: target.cooldownMs
 			};
+			return { ...this.getConfig().defaults };
+		}
+		/**
+		* The destinations that would deliver this event right now.
+		*
+		* Per destination rather than one boolean for the service: a single answer would either send a
+		* host warning somewhere switched off for it, or silence a crash because another destination's
+		* cooldown was still running.
+		*/
+		targetsFor(event, now = Date.now()) {
+			return this.getConfig().destinations.filter((target) => {
+				if (!target.enabled) return false;
+				const policy = this.effectivePolicy(target);
+				if (!COVERS[event.reason](policy)) return false;
+				const until = this.cooldowns.get(this.cooldownKey(target, event)) ?? 0;
+				return !(policy.cooldownMs > 0 && until > now);
+			});
 		}
-		/** Enabled for this reason *and* outside its cooldown window. */
+		/** Whether *any* destination would deliver this event. */
 		shouldNotify(event, now = Date.now()) {
-			const telegram = this.getConfig().telegram;
-			if (!telegram.enabled) return false;
-			if (!{
-				"crash": telegram.onCrash,
-				"unhealthy": telegram.onUnhealthy,
-				"forced-restart": telegram.onForcedRestart,
-				"recovered": telegram.onRecovered,
-				"rss": telegram.onCrash,
-				"host": telegram.onHost,
-				"host-recovered": telegram.onHost,
-				"ddns": telegram.onDdns,
-				"ddns-error": telegram.onDdns
-			}[event.reason]) return false;
-			const until = this.cooldowns.get(`${event.serverId}:${event.reason}`) ?? 0;
-			return !(telegram.cooldownMs > 0 && until > now);
-		}
-		/** Starts the cooldown window for this event, so a flapping server stays quiet. */
+			return this.targetsFor(event, now).length > 0;
+		}
+		/** Starts the cooldown window for every destination about to be asked to send. */
 		markSent(event, now = Date.now()) {
-			this.cooldowns.set(`${event.serverId}:${event.reason}`, now + this.getConfig().telegram.cooldownMs);
+			for (const target of this.targetsFor(event, now)) this.cooldowns.set(this.cooldownKey(target, event), now + this.effectivePolicy(target).cooldownMs);
 		}
-		/** Fire-and-forget by design: supervision must never wait on a chat API. */
+		/** Fire-and-forget by design: supervision must never wait on a chat or webhook API. */
 		notify(event) {
 			this.dispatch(event).catch((error) => {
 				logger.warn(`notification failed: ${errorMessage(error)}`);
 			});
 		}
 		async dispatch(event) {
-			if (!this.shouldNotify(event)) return false;
+			const targets = this.targetsFor(event);
+			if (targets.length === 0) return false;
 			this.markSent(event);
-			return this.sendTelegram(formatTelegramMessage(TITLE[event.reason], [`${event.label} (${event.serverId}) ${REASON_LABEL[event.reason]}`, event.detail]));
+			const title = TITLE[event.reason];
+			const message = `${event.label} (${event.serverId}) ${REASON_LABEL[event.reason]}\n${event.detail}`;
+			return (await Promise.all(targets.map((target) => this.deliver(target, title, message, event)))).includes(true);
+		}
+		/** One destination, one event. A throw is recorded against it and nothing else. */
+		async deliver(target, title, message, event) {
+			try {
+				const result = target.kind === "telegram" ? await this.sendTelegram(target, title, message) : await sendWebhook(target, {
+					title,
+					message,
+					reason: event.reason,
+					serverId: event.serverId,
+					label: event.label
+				});
+				this.remember(target.id, result.ok ? "sent" : result.error ?? "send failed");
+				return result.ok;
+			} catch (error) {
+				this.remember(target.id, errorMessage(error));
+				return false;
+			}
+		}
+		/** A probe for one destination. */
+		async sendTest(id, overrides = {}) {
+			const target = this.getConfig().destinations.find((entry) => entry.id === id);
+			if (target === void 0) return {
+				ok: false,
+				error: "no such destination"
+			};
+			const result = target.kind === "telegram" ? await this.testTelegram(id, target.chatId, overrides.chatId, overrides.botToken) : await this.testWebhook(target, id);
+			this.remember(id, result.ok ? "test message sent" : result.error ?? "test failed");
+			return result;
 		}
-		/** Used by the "send test" button in settings. */
-		async sendTest(overrides = {}) {
-			const chatId = overrides.chatId ?? this.getConfig().telegram.chatId;
-			if (chatId.length === 0) return {
+		/**
+		* A Telegram destination's own token, with the chat id and the token both overridable.
+		*
+		* The override is what lets a token be tried before it is saved — the route advertises it and
+		* `detect-chats` honours it, so ignoring it here made "send a test" fail on a token the page was
+		* still holding.
+		*/
+		async testTelegram(id, chatId, overrideChatId, overrideToken) {
+			const chat = (overrideChatId ?? chatId).trim();
+			if (chat.length === 0) return {
 				ok: false,
 				error: "no chat id configured"
 			};
-			const token = this.resolveToken(overrides.botToken);
+			const token = overrideToken !== void 0 && overrideToken.length > 0 ? overrideToken : this.secrets.telegramToken(id);
 			if (token === null) return {
 				ok: false,
-				error: "no bot token configured"
+				error: "no bot token configured for this destination"
+			};
+			return sendTelegramMessage(token, chat, formatTelegramMessage("✅ home-hosted test", ["notifications are wired up correctly"]));
+		}
+		/**
+		* A webhook probe, for a saved destination or for a draft the page has not saved.
+		*
+		* A draft is passed whole, so a URL and its headers can be tried before they are stored — and so
+		* a destination's own "test" tests *that* destination, not whichever one comes first.
+		*/
+		async testWebhook(target, id) {
+			const problem = targetProblem(target, { requireUrl: true });
+			if (problem !== null) return {
+				ok: false,
+				error: problem
 			};
-			const result = await sendTelegramMessage(token, chatId, formatTelegramMessage("✅ home-hosted test", ["notifications are wired up correctly"]));
-			this.remember(result.ok ? "test message sent" : result.error ?? "test failed");
+			const result = await sendWebhook(target, {
+				title: "home-hosted test",
+				message: "notifications are wired up correctly",
+				reason: "test",
+				serverId: "",
+				label: ""
+			});
+			if (id !== void 0) this.remember(id, result.ok ? "test message sent" : result.error ?? "test failed");
 			return result;
 		}
-		async detectChats(overrides = {}) {
-			const token = this.resolveToken(overrides.botToken);
-			if (token === null) return {
+		/** Lists the chats a destination's bot can see, so its chat id can be picked. */
+		async detectChats(id, overrides = {}) {
+			const token = (overrides.botToken ?? this.secrets.telegramToken(id) ?? "").trim();
+			if (token.length === 0) return {
 				ok: false,
 				chats: [],
-				error: "no bot token configured"
+				error: "no bot token configured for this destination"
 			};
 			const result = await listTelegramChats(token);
-			this.remember(result.ok ? `${result.chats.length} chat(s) found` : result.error ?? "detect failed");
+			this.remember(id, result.ok ? `${result.chats.length} chat(s) found` : result.error ?? "detect failed");
 			return result;
 		}
-		/** Verifies a token without sending anything. */
+		/** Verifies a token without storing or sending anything. */
 		async verifyToken(token) {
 			return verifyTelegramToken(token);
 		}
-		resolveToken(tokenOverride) {
-			const token = tokenOverride?.trim() ?? this.secrets.telegramToken ?? "";
-			return token.length > 0 ? token : null;
-		}
-		async sendTelegram(html) {
-			const telegram = this.getConfig().telegram;
-			if (telegram.chatId.length === 0) {
-				this.remember("no chat id configured");
-				return false;
-			}
-			const token = this.resolveToken();
-			if (token === null) {
-				this.remember("no bot token configured");
-				return false;
-			}
-			const result = await sendTelegramMessage(token, telegram.chatId, html);
-			this.remember(result.ok ? "sent" : result.error ?? "send failed");
-			return result.ok;
+		cooldownKey(target, event) {
+			return `${target.id}:${event.serverId}:${event.reason}`;
 		}
-		remember(message) {
-			this.lastResult = message;
-			this.lastResultAt = Date.now();
+		async sendTelegram(target, title, message) {
+			if (target.chatId.length === 0) return {
+				ok: false,
+				error: "no chat id configured"
+			};
+			const token = this.secrets.telegramToken(target.id);
+			if (token === null) return {
+				ok: false,
+				error: "no bot token configured for this destination"
+			};
+			const body = message.split("\n").filter((line) => line.length > 0);
+			return sendTelegramMessage(token, target.chatId, formatTelegramMessage(title, body));
+		}
+		/** Records one destination's outcome, keyed by its id. */
+		remember(id, message) {
+			this.results.set(id, {
+				lastResult: message,
+				lastResultAt: Date.now()
+			});
 		}
 	};
 }));
@@ -16374,8 +17015,7 @@ function stateSignature(state) {
 				workspace.ddns.ipv6,
 				...workspace.ddns.records.map((record) => `${record.host}:${record.type}:${record.state}:${record.ip}`)
 			].join(":"),
-			workspace.notifications.telegram.enabled,
-			workspace.notifications.telegram.tokenSet,
+			...(workspace.notifications.destinations ?? []).map((destination) => `${destination.id}:${destination.kind}:${destination.enabled}:${destination.tokenSet}:${destination.lastResult ?? ""}`),
 			...workspace.servers.map((server) => [
 				server.id,
 				server.status,
@@ -16606,6 +17246,7 @@ var init_panel = __esmMin((() => {
 		async dispose() {
 			this.disposed = true;
 			clearInterval(this.timer);
+			this.options.backups.dispose();
 			await Promise.all(this.workspaces().map((runtime) => runtime.supervisor.dispose()));
 			for (const runtime of this.workspaces()) this.disposeRuntime(runtime);
 		}
@@ -16719,6 +17360,7 @@ var init_panel = __esmMin((() => {
 			if (this.disposed) return;
 			const now = Date.now();
 			await this.options.hostMonitor.tick(now);
+			this.options.backups.tick(now);
 			for (const runtime of this.workspaces()) runtime.ddns.tick(now);
 			const proxy = this.options.proxy();
 			if (proxy !== null) await proxy.sync().catch((error) => {
@@ -18561,7 +19203,10 @@ function targets(configOverride) {
 			validate: (raw) => {
 				let defaults = {};
 				try {
-					defaults = parseWorkspaceSettings(JSON.parse(fs.readFileSync(workspaceSettingsPath(workspace.id), "utf8"))).config?.defaults ?? {};
+					const settingsRaw = JSON.parse(fs.readFileSync(workspaceSettingsPath(workspace.id), "utf8"));
+					const meta = typeof settingsRaw.meta === "object" && settingsRaw.meta !== null ? settingsRaw.meta : {};
+					const from = typeof meta.schema === "number" ? meta.schema : 1;
+					defaults = (planConfigMigrations(from).steps.length > 0 ? applyConfigMigrations(settingsRaw, from).config : settingsRaw)?.defaults ?? {};
 				} catch {}
 				return parseServersFile(raw, defaults).errors[0] ?? null;
 			}
@@ -18585,7 +19230,18 @@ async function runMigrate(config, dryRun, yes) {
 		const from = typeof meta.schema === "number" ? meta.schema : 1;
 		const plan = planConfigMigrations(from);
 		if (plan.tooNew) fail(`${target.file} was written by home-hosted ${meta.writtenBy ?? "a newer release"} (config schema ${from});\n  this release understands schema ${plan.to}. Install that version, or edit the file yourself.`);
-		const problem = target.validate(raw);
+		/**
+		* Validate what this release will actually read: the file as-is when it needs no migration,
+		* otherwise the result the steps produce.
+		*
+		* The parsed check cannot be run on the raw file when a migration is pending — the reader
+		* refuses an older schema by design (`readStamp`), which would make `migrate` refuse every
+		* config it exists to lift. `checkShape` below catches a file that is not even JSON-shaped
+		* before the steps touch it.
+		*/
+		const migrated = plan.steps.length === 0 ? raw : applyConfigMigrations(raw, from).config;
+		if (plan.steps.length > 0 && !isRecord(migrated)) fail(`${target.file} did not produce an object when migrated — refusing to write it`);
+		const problem = target.validate(migrated);
 		if (problem !== null) fail(`${target.file} is not a config this release can read: ${problem}`);
 		if (plan.reached !== plan.to) fail(`${target.file} is schema ${from} and this release can only lift it to schema ${plan.reached} — the migration chain in configMigrations has a gap to schema ${plan.to}.
   That is a bug in this release: report it rather than editing the file.`);
@@ -18606,7 +19262,6 @@ async function runMigrate(config, dryRun, yes) {
 				return;
 			}
 		}
-		const { config: migrated } = applyConfigMigrations(raw, from);
 		const migratedProblem = target.validate(migrated);
 		if (migratedProblem !== null) fail(`the migration produced a config this release cannot read:\n  ${migratedProblem}`);
 		fs.copyFileSync(target.file, `${target.file}.bak`);
@@ -18631,6 +19286,7 @@ var init_migrate = __esmMin((() => {
 	init_paths();
 	init_version();
 	init_error_message();
+	init_shape();
 	migrateArgs = {
 		config: {
 			type: "string",