From 2efa81b48ed2519d2e561c43511b29e47d901bb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:19:41 +0200
Subject: [PATCH 01/13] Make sure turbo.json does not get generated when
 disabled

---
 nix/stackpanel/modules/turbo/module.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nix/stackpanel/modules/turbo/module.nix b/nix/stackpanel/modules/turbo/module.nix
index 7186929e..48e41601 100644
--- a/nix/stackpanel/modules/turbo/module.nix
+++ b/nix/stackpanel/modules/turbo/module.nix
@@ -402,8 +402,8 @@ in {
       stackpanel.appModules = [taskAppModule];
     }
 
-    # When stackpanel is enabled and has tasks, generate outputs
-    (lib.mkIf (cfg.enable && hasTasks) {
+    # When stackpanel is enabled, turbo is enabled, and has tasks, generate outputs
+    (lib.mkIf (cfg.enable && cfg.turbo.enable && hasTasks) {
       # Expose computed values
       stackpanel.turbo.config = turboConfig;
       stackpanel.turbo.scripts = taskScripts;
@@ -493,7 +493,7 @@ in {
             // (mkAppFileEntries appsWithTasks appTaskScripts appTurboConfigs appName appsWithTasks.${appName})
         ) {} (lib.attrNames appsWithTasks);
       in
-        lib.mkIf (cfg.enable && hasAppsWithTasks) {
+        lib.mkIf (cfg.enable && cfg.turbo.enable && hasAppsWithTasks) {
           stackpanel.files.entries = appFileEntries;
         }
     )

From 177c0e158b99e968b572990227bf2bc9be5908a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:24:12 +0200
Subject: [PATCH 02/13] Add missing gitignore entries

---
 nix/stackpanel/modules/entrypoints/module.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nix/stackpanel/modules/entrypoints/module.nix b/nix/stackpanel/modules/entrypoints/module.nix
index e7f36e5a..60853396 100644
--- a/nix/stackpanel/modules/entrypoints/module.nix
+++ b/nix/stackpanel/modules/entrypoints/module.nix
@@ -262,6 +262,8 @@ in
           }) appsWithEntrypoints
         );
 
+        stackpanel.gitignore.entries = [ "packages/scripts/entrypoints/" ];
+
         # Also create as Nix derivations for flake outputs
         stackpanel.outputs = lib.mapAttrs' (name: app: {
           name = "${name}-entrypoint";

From 999e716f7df5415831a2b0e7bfe101a97b324867 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:25:24 +0200
Subject: [PATCH 03/13] Update gitignore

---
 .gitignore | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 06e0ae40..fc322cb1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -75,6 +75,7 @@ tmp
 .idea
 .stack/.token
 .stack/bin
+.stack/bin/
 .stack/config.local.nix
 .stack/gen/
 .stack/keys/
@@ -83,7 +84,6 @@ tmp
 .stack/secrets/state/
 .stack/secrets/vars/.sops.yaml
 .stack/state/
-.stackpanel/bin/
 .tasks
 .turbo
 .vscode/settings.json
@@ -96,9 +96,12 @@ apps/stackpanel-go/.stack/keys/
 build
 devenv.local.nix
 devenv.local.yaml
+devshell
 dist
 logs
 node_modules
+packages/infra/
+packages/scripts/entrypoints/
 process-compose.yaml
 temp
 tmp

From 4b7db6385df4fdc4a429cc9f0605c12af382f885 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:25:54 +0200
Subject: [PATCH 04/13] Update flake.lock

---
 flake.lock | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/flake.lock b/flake.lock
index d6c93aa5..16aa0da6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -581,6 +581,27 @@
         "type": "github"
       }
     },
+    "microvm": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum"
+      },
+      "locked": {
+        "lastModified": 1774448302,
+        "narHash": "sha256-Z7QLau4WR38/pMPNVH3MEGeMybBTaAzn+PUCErMngFw=",
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "rev": "da28962a2ba84718895b7325f600686c3b4ee099",
+        "type": "github"
+      },
+      "original": {
+        "owner": "astro",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
     "namaka": {
       "inputs": {
         "haumea": "haumea",
@@ -804,6 +825,7 @@
         "flake-utils": "flake-utils_2",
         "git-hooks": "git-hooks_2",
         "gomod2nix": "gomod2nix",
+        "microvm": "microvm",
         "namaka": "namaka",
         "nix2container": "nix2container",
         "nixpkgs": "nixpkgs",
@@ -812,6 +834,22 @@
         "treefmt-nix": "treefmt-nix_4"
       }
     },
+    "spectrum": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1772189877,
+        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
+        "ref": "refs/heads/main",
+        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
+        "revCount": 1255,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
     "stable": {
       "locked": {
         "lastModified": 1750133334,

From 8e2e49a733b86a348c6411045efecbc91fcb3676 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:28:31 +0200
Subject: [PATCH 05/13] Fix devshell gitignored file

---
 nix/stackpanel/devshell/clean.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/stackpanel/devshell/clean.nix b/nix/stackpanel/devshell/clean.nix
index 0b07025f..d467e0d4 100644
--- a/nix/stackpanel/devshell/clean.nix
+++ b/nix/stackpanel/devshell/clean.nix
@@ -213,7 +213,7 @@ in
       };
 
       # Gitignore the generated devshell script
-      stackpanel.gitignore.entries = [ "devshell" ];
+      stackpanel.gitignore.entries = [ "/devshell" ];
 
       # Export marker for clean environment detection
       stackpanel.devshell.env.__STACKPANEL_CLEAN_ENV = lib.mkDefault "";

From 0ed04ebc8834db79895ec45054cf377a8c2f4112 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:29:54 +0200
Subject: [PATCH 06/13] Update .gitignore

---
 .gitignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index fc322cb1..eb92515e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -91,12 +91,12 @@ tmp
 /.devenv*
 /.devenv-root
 /.stack/state
+/devshell
 /result
 apps/stackpanel-go/.stack/keys/
 build
 devenv.local.nix
 devenv.local.yaml
-devshell
 dist
 logs
 node_modules

From 4cb92175607af6738bdb15ad1715202c215b1b5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:30:19 +0200
Subject: [PATCH 07/13] Remove gitignored files from repo

---
 .claude/commands/opsx/apply.md                |  152 ---
 .claude/commands/opsx/archive.md              |  157 ---
 .claude/commands/opsx/explore.md              |  173 ---
 .claude/commands/opsx/propose.md              |  106 --
 .claude/skills/neon-postgres/SKILL.md         |  186 ---
 .claude/skills/openspec-apply-change/SKILL.md |  156 ---
 .../skills/openspec-archive-change/SKILL.md   |  114 --
 .claude/skills/openspec-explore/SKILL.md      |  288 -----
 .claude/skills/openspec-propose/SKILL.md      |  110 --
 devshell                                      |  127 --
 packages/infra/.gitkeep                       |    0
 packages/infra/.stack/keys/local.pub          |    1 -
 packages/infra/README.md                      |  100 --
 packages/infra/alchemy.run.ts                 |   59 -
 packages/infra/deployment-check.run.ts        |   15 -
 packages/infra/deployment-scope-check.run.ts  |   15 -
 packages/infra/fly/web/fly.toml               |   33 -
 .../infra/modules/aws-ec2-app.helpers.test.ts |  104 --
 packages/infra/modules/aws-ec2-app.helpers.ts |   95 --
 packages/infra/modules/aws-ec2-app.ts         | 1051 -----------------
 packages/infra/modules/aws-ec2-deploy.ts      |  497 --------
 packages/infra/modules/aws-secrets.ts         |  249 ----
 packages/infra/modules/aws-secrets/index.ts   |   85 --
 .../infra/modules/aws-secrets/policies.ts     |  147 ---
 packages/infra/modules/database.ts            |  229 ----
 packages/infra/modules/deployment-plan.ts     |  107 --
 .../infra/modules/deployment/artifact.test.ts |   50 -
 packages/infra/modules/deployment/artifact.ts |   50 -
 .../modules/deployment/aws-ec2-deploy.test.ts |   48 -
 .../modules/deployment/aws-ec2-deploy.ts      |  349 ------
 .../modules/deployment/aws-ec2-userdata.ts    |  160 ---
 packages/infra/modules/deployment/index.ts    |  471 --------
 .../infra/modules/deployment/plan.test.ts     |   43 -
 packages/infra/modules/deployment/plan.ts     |  134 ---
 packages/infra/modules/machines.ts            |  192 ---
 packages/infra/package.json                   |   41 -
 packages/infra/package.json.backup            |   41 -
 packages/infra/src/alchemy.ts                 |  471 --------
 packages/infra/src/index.test.ts              |   84 --
 packages/infra/src/index.ts                   |  352 ------
 .../infra/src/resources/ec2-instance.test.ts  |  180 ---
 packages/infra/src/resources/ec2-instance.ts  |  238 ----
 packages/infra/src/resources/ec2-lifecycle.ts |  246 ----
 .../src/resources/iam-instance-profile.ts     |  199 ----
 packages/infra/src/resources/iam-role.ts      |  152 ---
 packages/infra/src/resources/key-pair.ts      |  104 --
 .../infra/src/resources/security-group.ts     |  181 ---
 packages/infra/src/stacks/env.ts              |   32 -
 packages/infra/src/stacks/repo.run.ts         |  144 ---
 packages/infra/src/types.ts                   |  556 ---------
 packages/infra/sst.config.ts                  |  211 ----
 packages/infra/tsconfig.json                  |   26 -
 packages/scripts/entrypoints/.gitkeep         |    1 -
 packages/scripts/entrypoints/docs.sh          |  117 --
 packages/scripts/entrypoints/server.sh        |  117 --
 packages/scripts/entrypoints/stackpanel-go.sh |  117 --
 packages/scripts/entrypoints/web.sh           |  117 --
 57 files changed, 9580 deletions(-)
 delete mode 100644 .claude/commands/opsx/apply.md
 delete mode 100644 .claude/commands/opsx/archive.md
 delete mode 100644 .claude/commands/opsx/explore.md
 delete mode 100644 .claude/commands/opsx/propose.md
 delete mode 100644 .claude/skills/neon-postgres/SKILL.md
 delete mode 100644 .claude/skills/openspec-apply-change/SKILL.md
 delete mode 100644 .claude/skills/openspec-archive-change/SKILL.md
 delete mode 100644 .claude/skills/openspec-explore/SKILL.md
 delete mode 100644 .claude/skills/openspec-propose/SKILL.md
 delete mode 100755 devshell
 delete mode 100644 packages/infra/.gitkeep
 delete mode 100644 packages/infra/.stack/keys/local.pub
 delete mode 100644 packages/infra/README.md
 delete mode 100644 packages/infra/alchemy.run.ts
 delete mode 100644 packages/infra/deployment-check.run.ts
 delete mode 100644 packages/infra/deployment-scope-check.run.ts
 delete mode 100644 packages/infra/fly/web/fly.toml
 delete mode 100644 packages/infra/modules/aws-ec2-app.helpers.test.ts
 delete mode 100644 packages/infra/modules/aws-ec2-app.helpers.ts
 delete mode 100644 packages/infra/modules/aws-ec2-app.ts
 delete mode 100644 packages/infra/modules/aws-ec2-deploy.ts
 delete mode 100644 packages/infra/modules/aws-secrets.ts
 delete mode 100644 packages/infra/modules/aws-secrets/index.ts
 delete mode 100644 packages/infra/modules/aws-secrets/policies.ts
 delete mode 100644 packages/infra/modules/database.ts
 delete mode 100644 packages/infra/modules/deployment-plan.ts
 delete mode 100644 packages/infra/modules/deployment/artifact.test.ts
 delete mode 100644 packages/infra/modules/deployment/artifact.ts
 delete mode 100644 packages/infra/modules/deployment/aws-ec2-deploy.test.ts
 delete mode 100644 packages/infra/modules/deployment/aws-ec2-deploy.ts
 delete mode 100644 packages/infra/modules/deployment/aws-ec2-userdata.ts
 delete mode 100644 packages/infra/modules/deployment/index.ts
 delete mode 100644 packages/infra/modules/deployment/plan.test.ts
 delete mode 100644 packages/infra/modules/deployment/plan.ts
 delete mode 100644 packages/infra/modules/machines.ts
 delete mode 100644 packages/infra/package.json
 delete mode 100644 packages/infra/package.json.backup
 delete mode 100644 packages/infra/src/alchemy.ts
 delete mode 100644 packages/infra/src/index.test.ts
 delete mode 100644 packages/infra/src/index.ts
 delete mode 100644 packages/infra/src/resources/ec2-instance.test.ts
 delete mode 100644 packages/infra/src/resources/ec2-instance.ts
 delete mode 100644 packages/infra/src/resources/ec2-lifecycle.ts
 delete mode 100644 packages/infra/src/resources/iam-instance-profile.ts
 delete mode 100644 packages/infra/src/resources/iam-role.ts
 delete mode 100644 packages/infra/src/resources/key-pair.ts
 delete mode 100644 packages/infra/src/resources/security-group.ts
 delete mode 100644 packages/infra/src/stacks/env.ts
 delete mode 100644 packages/infra/src/stacks/repo.run.ts
 delete mode 100644 packages/infra/src/types.ts
 delete mode 100644 packages/infra/sst.config.ts
 delete mode 100644 packages/infra/tsconfig.json
 delete mode 100644 packages/scripts/entrypoints/.gitkeep
 delete mode 100755 packages/scripts/entrypoints/docs.sh
 delete mode 100755 packages/scripts/entrypoints/server.sh
 delete mode 100755 packages/scripts/entrypoints/stackpanel-go.sh
 delete mode 100755 packages/scripts/entrypoints/web.sh

diff --git a/.claude/commands/opsx/apply.md b/.claude/commands/opsx/apply.md
deleted file mode 100644
index bf23721d..00000000
--- a/.claude/commands/opsx/apply.md
+++ /dev/null
@@ -1,152 +0,0 @@
----
-name: "OPSX: Apply"
-description: Implement tasks from an OpenSpec change (Experimental)
-category: Workflow
-tags: [workflow, artifacts, experimental]
----
-
-Implement tasks from an OpenSpec change.
-
-**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **Select the change**
-
-   If a name is provided, use it. Otherwise:
-   - Infer from conversation context if the user mentioned a change
-   - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
-
-   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
-
-2. **Check status to understand the schema**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used (e.g., "spec-driven")
-   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
-
-3. **Get apply instructions**
-
-   ```bash
-   openspec instructions apply --change "<name>" --json
-   ```
-
-   This returns:
-   - Context file paths (varies by schema)
-   - Progress (total, complete, remaining)
-   - Task list with status
-   - Dynamic instruction based on current state
-
-   **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
-   - If `state: "all_done"`: congratulate, suggest archive
-   - Otherwise: proceed to implementation
-
-4. **Read context files**
-
-   Read the files listed in `contextFiles` from the apply instructions output.
-   The files depend on the schema being used:
-   - **spec-driven**: proposal, specs, design, tasks
-   - Other schemas: follow the contextFiles from CLI output
-
-5. **Show current progress**
-
-   Display:
-   - Schema being used
-   - Progress: "N/M tasks complete"
-   - Remaining tasks overview
-   - Dynamic instruction from CLI
-
-6. **Implement tasks (loop until done or blocked)**
-
-   For each pending task:
-   - Show which task is being worked on
-   - Make the code changes required
-   - Keep changes minimal and focused
-   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
-   - Continue to next task
-
-   **Pause if:**
-   - Task is unclear → ask for clarification
-   - Implementation reveals a design issue → suggest updating artifacts
-   - Error or blocker encountered → report and wait for guidance
-   - User interrupts
-
-7. **On completion or pause, show status**
-
-   Display:
-   - Tasks completed this session
-   - Overall progress: "N/M tasks complete"
-   - If all done: suggest archive
-   - If paused: explain why and wait for guidance
-
-**Output During Implementation**
-
-```
-## Implementing: <change-name> (schema: <schema-name>)
-
-Working on task 3/7: <task description>
-[...implementation happening...]
-✓ Task complete
-
-Working on task 4/7: <task description>
-[...implementation happening...]
-✓ Task complete
-```
-
-**Output On Completion**
-
-```
-## Implementation Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 7/7 tasks complete ✓
-
-### Completed This Session
-- [x] Task 1
-- [x] Task 2
-...
-
-All tasks complete! You can archive this change with `/opsx:archive`.
-```
-
-**Output On Pause (Issue Encountered)**
-
-```
-## Implementation Paused
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 4/7 tasks complete
-
-### Issue Encountered
-<description of the issue>
-
-**Options:**
-1. <option 1>
-2. <option 2>
-3. Other approach
-
-What would you like to do?
-```
-
-**Guardrails**
-- Keep going through tasks until done or blocked
-- Always read context files before starting (from the apply instructions output)
-- If task is ambiguous, pause and ask before implementing
-- If implementation reveals issues, pause and suggest artifact updates
-- Keep code changes minimal and scoped to each task
-- Update task checkbox immediately after completing each task
-- Pause on errors, blockers, or unclear requirements - don't guess
-- Use contextFiles from CLI output, don't assume specific file names
-
-**Fluid Workflow Integration**
-
-This skill supports the "actions on a change" model:
-
-- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
-- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.claude/commands/opsx/archive.md b/.claude/commands/opsx/archive.md
deleted file mode 100644
index 5e916083..00000000
--- a/.claude/commands/opsx/archive.md
+++ /dev/null
@@ -1,157 +0,0 @@
----
-name: "OPSX: Archive"
-description: Archive a completed change in the experimental workflow
-category: Workflow
-tags: [workflow, archive, experimental]
----
-
-Archive a completed change in the experimental workflow.
-
-**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show only active changes (not already archived).
-   Include the schema used for each change if available.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check artifact completion status**
-
-   Run `openspec status --change "<name>" --json` to check artifact completion.
-
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used
-   - `artifacts`: List of artifacts with their status (`done` or other)
-
-   **If any artifacts are not `done`:**
-   - Display warning listing incomplete artifacts
-   - Prompt user for confirmation to continue
-   - Proceed if user confirms
-
-3. **Check task completion status**
-
-   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
-
-   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
-
-   **If incomplete tasks found:**
-   - Display warning showing count of incomplete tasks
-   - Prompt user for confirmation to continue
-   - Proceed if user confirms
-
-   **If no tasks file exists:** Proceed without task-related warning.
-
-4. **Assess delta spec sync state**
-
-   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
-
-   **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
-   - Determine what changes would be applied (adds, modifications, removals, renames)
-   - Show a combined summary before prompting
-
-   **Prompt options:**
-   - If changes needed: "Sync now (recommended)", "Archive without syncing"
-   - If already synced: "Archive now", "Sync anyway", "Cancel"
-
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
-
-5. **Perform the archive**
-
-   Create the archive directory if it doesn't exist:
-   ```bash
-   mkdir -p openspec/changes/archive
-   ```
-
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
-
-   **Check if target already exists:**
-   - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move the change directory to archive
-
-   ```bash
-   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
-   ```
-
-6. **Display summary**
-
-   Show archive completion summary including:
-   - Change name
-   - Schema that was used
-   - Archive location
-   - Spec sync status (synced / sync skipped / no delta specs)
-   - Note about any warnings (incomplete artifacts/tasks)
-
-**Output On Success**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs
-
-All artifacts complete. All tasks complete.
-```
-
-**Output On Success (No Delta Specs)**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** No delta specs
-
-All artifacts complete. All tasks complete.
-```
-
-**Output On Success With Warnings**
-
-```
-## Archive Complete (with warnings)
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** Sync skipped (user chose to skip)
-
-**Warnings:**
-- Archived with 2 incomplete artifacts
-- Archived with 3 incomplete tasks
-- Delta spec sync was skipped (user chose to skip)
-
-Review the archive if this was not intentional.
-```
-
-**Output On Error (Archive Exists)**
-
-```
-## Archive Failed
-
-**Change:** <change-name>
-**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
-
-Target archive directory already exists.
-
-**Options:**
-1. Rename the existing archive
-2. Delete the existing archive if it's a duplicate
-3. Wait until a different date to archive
-```
-
-**Guardrails**
-- Always prompt for change selection if not provided
-- Use artifact graph (openspec status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
-- Preserve .openspec.yaml when moving to archive (it moves with the directory)
-- Show clear summary of what happened
-- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
-- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.claude/commands/opsx/explore.md b/.claude/commands/opsx/explore.md
deleted file mode 100644
index 30d9c57a..00000000
--- a/.claude/commands/opsx/explore.md
+++ /dev/null
@@ -1,173 +0,0 @@
----
-name: "OPSX: Explore"
-description: "Enter explore mode - think through ideas, investigate problems, clarify requirements"
-category: Workflow
-tags: [workflow, explore, experimental, thinking]
----
-
-Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
-
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
-
-**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
-
-**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
-- A vague idea: "real-time collaboration"
-- A specific problem: "the auth system is getting unwieldy"
-- A change name: "add-dark-mode" (to explore in context of that change)
-- A comparison: "postgres vs sqlite for this"
-- Nothing (just enter explore mode)
-
----
-
-## The Stance
-
-- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
-- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
-- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
-- **Adaptive** - Follow interesting threads, pivot when new information emerges
-- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
-- **Grounded** - Explore the actual codebase when relevant, don't just theorize
-
----
-
-## What You Might Do
-
-Depending on what the user brings, you might:
-
-**Explore the problem space**
-- Ask clarifying questions that emerge from what they said
-- Challenge assumptions
-- Reframe the problem
-- Find analogies
-
-**Investigate the codebase**
-- Map existing architecture relevant to the discussion
-- Find integration points
-- Identify patterns already in use
-- Surface hidden complexity
-
-**Compare options**
-- Brainstorm multiple approaches
-- Build comparison tables
-- Sketch tradeoffs
-- Recommend a path (if asked)
-
-**Visualize**
-```
-┌─────────────────────────────────────────┐
-│     Use ASCII diagrams liberally        │
-├─────────────────────────────────────────┤
-│                                         │
-│   ┌────────┐         ┌────────┐        │
-│   │ State  │────────▶│ State  │        │
-│   │   A    │         │   B    │        │
-│   └────────┘         └────────┘        │
-│                                         │
-│   System diagrams, state machines,      │
-│   data flows, architecture sketches,    │
-│   dependency graphs, comparison tables  │
-│                                         │
-└─────────────────────────────────────────┘
-```
-
-**Surface risks and unknowns**
-- Identify what could go wrong
-- Find gaps in understanding
-- Suggest spikes or investigations
-
----
-
-## OpenSpec Awareness
-
-You have full context of the OpenSpec system. Use it naturally, don't force it.
-
-### Check for context
-
-At the start, quickly check what exists:
-```bash
-openspec list --json
-```
-
-This tells you:
-- If there are active changes
-- Their names, schemas, and status
-- What the user might be working on
-
-If the user mentioned a specific change name, read its artifacts for context.
-
-### When no change exists
-
-Think freely. When insights crystallize, you might offer:
-
-- "This feels solid enough to start a change. Want me to create a proposal?"
-- Or keep exploring - no pressure to formalize
-
-### When a change exists
-
-If the user mentions a change or you detect one is relevant:
-
-1. **Read existing artifacts for context**
-   - `openspec/changes/<name>/proposal.md`
-   - `openspec/changes/<name>/design.md`
-   - `openspec/changes/<name>/tasks.md`
-   - etc.
-
-2. **Reference them naturally in conversation**
-   - "Your design mentions using Redis, but we just realized SQLite fits better..."
-   - "The proposal scopes this to premium users, but we're now thinking everyone..."
-
-3. **Offer to capture when decisions are made**
-
-   | Insight Type | Where to Capture |
-   |--------------|------------------|
-   | New requirement discovered | `specs/<capability>/spec.md` |
-   | Requirement changed | `specs/<capability>/spec.md` |
-   | Design decision made | `design.md` |
-   | Scope changed | `proposal.md` |
-   | New work identified | `tasks.md` |
-   | Assumption invalidated | Relevant artifact |
-
-   Example offers:
-   - "That's a design decision. Capture it in design.md?"
-   - "This is a new requirement. Add it to specs?"
-   - "This changes scope. Update the proposal?"
-
-4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
-
----
-
-## What You Don't Have To Do
-
-- Follow a script
-- Ask the same questions every time
-- Produce a specific artifact
-- Reach a conclusion
-- Stay on topic if a tangent is valuable
-- Be brief (this is thinking time)
-
----
-
-## Ending Discovery
-
-There's no required ending. Discovery might:
-
-- **Flow into a proposal**: "Ready to start? I can create a change proposal."
-- **Result in artifact updates**: "Updated design.md with these decisions"
-- **Just provide clarity**: User has what they need, moves on
-- **Continue later**: "We can pick this up anytime"
-
-When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
-
----
-
-## Guardrails
-
-- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
-- **Don't fake understanding** - If something is unclear, dig deeper
-- **Don't rush** - Discovery is thinking time, not task time
-- **Don't force structure** - Let patterns emerge naturally
-- **Don't auto-capture** - Offer to save insights, don't just do it
-- **Do visualize** - A good diagram is worth many paragraphs
-- **Do explore the codebase** - Ground discussions in reality
-- **Do question assumptions** - Including the user's and your own
diff --git a/.claude/commands/opsx/propose.md b/.claude/commands/opsx/propose.md
deleted file mode 100644
index 05276f4d..00000000
--- a/.claude/commands/opsx/propose.md
+++ /dev/null
@@ -1,106 +0,0 @@
----
-name: "OPSX: Propose"
-description: Propose a new change - create it and generate all artifacts in one step
-category: Workflow
-tags: [workflow, artifacts, experimental]
----
-
-Propose a new change - create the change and generate all artifacts in one step.
-
-I'll create a change with artifacts:
-- proposal.md (what & why)
-- design.md (how)
-- tasks.md (implementation steps)
-
-When ready to implement, run /opsx:apply
-
----
-
-**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
-
-**Steps**
-
-1. **If no input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
-
-3. **Get the artifact build order**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to get:
-   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
-
-4. **Create artifacts in sequence until apply-ready**
-
-   Use the **TodoWrite tool** to track progress through the artifacts.
-
-   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
-
-   a. **For each artifact that is `ready` (dependencies satisfied)**:
-      - Get instructions:
-        ```bash
-        openspec instructions <artifact-id> --change "<name>" --json
-        ```
-      - The instructions JSON includes:
-        - `context`: Project background (constraints for you - do NOT include in output)
-        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-        - `template`: The structure to use for your output file
-        - `instruction`: Schema-specific guidance for this artifact type
-        - `outputPath`: Where to write the artifact
-        - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure
-      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
-      - Show brief progress: "Created <artifact-id>"
-
-   b. **Continue until all `applyRequires` artifacts are complete**
-      - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
-
-   c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
-      - Then continue with creation
-
-5. **Show final status**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After completing all artifacts, summarize:
-- Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
-- Prompt: "Run `/opsx:apply` to start implementing."
-
-**Artifact Creation Guidelines**
-
-- Follow the `instruction` field from `openspec instructions` for each artifact type
-- The schema defines what each artifact should contain - follow it
-- Read dependency artifacts for context before creating new ones
-- Use `template` as the structure for your output file - fill in its sections
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
-
-**Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
-- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
-- If a change with that name already exists, ask if user wants to continue it or create a new one
-- Verify each artifact file exists after writing before proceeding to next
diff --git a/.claude/skills/neon-postgres/SKILL.md b/.claude/skills/neon-postgres/SKILL.md
deleted file mode 100644
index 73c4b0fe..00000000
--- a/.claude/skills/neon-postgres/SKILL.md
+++ /dev/null
@@ -1,186 +0,0 @@
----
-name: neon-postgres
-description: Guides and best practices for working with Neon Serverless Postgres. Covers getting started, local development with Neon, choosing a connection method, Neon features, authentication (@neondatabase/auth), PostgREST-style data API (@neondatabase/neon-js), Neon CLI, and Neon's Platform API/SDKs. Use for any Neon-related questions.
----
-
-# Neon Serverless Postgres
-
-Neon is a serverless Postgres platform that separates compute and storage to offer autoscaling, branching, instant restore, and scale-to-zero. It's fully compatible with Postgres and works with any language, framework, or ORM that supports Postgres.
-
-## Neon Documentation
-
-The Neon documentation is the source of truth for all Neon-related information. Always verify claims against the official docs before responding. Neon features and APIs evolve, so prefer fetching current docs over relying on training data.
-
-### Fetching Docs as Markdown
-
-Any Neon doc page can be fetched as markdown in two ways:
-
-1. **Append `.md` to the URL** (simplest): https://neon.com/docs/introduction/branching.md
-2. **Request `text/markdown`** on the standard URL: `curl -H "Accept: text/markdown" https://neon.com/docs/introduction/branching`
-
-Both return the same markdown content. Use whichever method your tools support.
-
-### Finding the Right Page
-
-The docs index lists every available page with its URL and a short description:
-
-```
-https://neon.com/docs/llms.txt
-```
-
-Common doc URLs are organized in the topic links below. If you need a page not listed here, search the docs index: https://neon.com/docs/llms.txt — don't guess URLs.
-
-## What Is Neon
-
-Use this for architecture explanations and terminology (organizations, projects, branches, endpoints) before giving implementation advice.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/what-is-neon.md
-
-## Getting Started
-
-Use this for first-time setup: org/project selection, connection strings, driver installation, optional auth, and initial schema setup.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/getting-started.md
-
-## Connection Methods & Drivers
-
-Use this when you need to pick the correct transport and driver based on runtime constraints (TCP, HTTP, WebSocket, edge, serverless, long-running).
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/connection-methods.md
-
-### Serverless Driver
-
-Use this for `@neondatabase/serverless` patterns, including HTTP queries, WebSocket transactions, and runtime-specific optimizations.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-serverless.md
-
-### Neon JS SDK
-
-Use this for combined Neon Auth + Data API workflows with PostgREST-style querying and typed client setup.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-js.md
-
-## Developer Tools
-
-Use this for local development enablement with `npx neonctl@latest init`, VSCode extension setup, and Neon MCP server configuration.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/devtools.md
-
-### Neon CLI
-
-Use this for terminal-first workflows, scripts, and CI/CD automation with `neonctl`.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-cli.md
-
-## Neon Admin API
-
-The Neon Admin API can be used to manage Neon resources programmatically. It is used behind the scenes by the Neon CLI and MCP server, but can also be used directly for more complex automation workflows or when embedding Neon in other applications.
-
-### Neon REST API
-
-Use this for direct HTTP automation, endpoint-level control, API key auth, rate-limit handling, and operation polling.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-rest-api.md
-
-### Neon TypeScript SDK
-
-Use this when implementing typed programmatic control of Neon resources in TypeScript via `@neondatabase/api-client`.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-typescript-sdk.md
-
-### Neon Python SDK
-
-Use this when implementing programmatic Neon management in Python with the `neon-api` package.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-python-sdk.md
-
-## Neon Auth
-
-Use this for managed user authentication setup, UI components, auth methods, and Neon Auth integration pitfalls in Next.js and React apps.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/neon-auth.md
-
-Neon Auth is also embedded in the Neon JS SDK - so depending on your use case, you may want to use the Neon JS SDK instead of Neon Auth. See https://neon.com/docs/ai/skills/neon-postgres/references/connection-methods.md for more details.
-
-## Branching
-
-Use this when the user is planning isolated environments, schema migration testing, preview deployments, or branch lifecycle automation.
-
-Key points:
-
-- Branches are instant, copy-on-write clones (no full data copy).
-- Each branch has its own compute endpoint.
-- Use the neonctl CLI or MCP server to create, inspect, and compare branches.
-
-Link: https://neon.com/docs/ai/skills/neon-postgres/references/branching.md
-
-## Autoscaling
-
-Use this when the user needs compute to scale automatically with workload and wants guidance on CU sizing and runtime behavior.
-
-Link: https://neon.com/docs/introduction/autoscaling.md
-
-## Scale to Zero
-
-Use this when optimizing idle costs and discussing suspend/resume behavior, including cold-start trade-offs.
-
-Key points:
-
-- Idle computes suspend automatically (default 5 minutes, configurable) (unless disabled - launch & scale plan only)
-- First query after suspend typically has a cold-start penalty (around hundreds of ms)
-- Storage remains active while compute is suspended.
-
-Link: https://neon.com/docs/introduction/scale-to-zero.md
-
-## Instant Restore
-
-Use this when the user needs point-in-time recovery or wants to restore data state without traditional backup restore workflows.
-
-Key points:
-
-- Restore windows depend on plan limits.
-- Users can create branches from historical points-in-time.
-- Time Travel queries can be used for historical inspection workflows.
-
-Link: https://neon.com/docs/introduction/branch-restore.md
-
-## Read Replicas
-
-Use this for read-heavy workloads where the user needs dedicated read-only compute without duplicating storage.
-
-Key points:
-
-- Replicas are read-only compute endpoints sharing the same storage.
-- Creation is fast and scaling is independent from primary compute.
-- Typical use cases: analytics, reporting, and read-heavy APIs.
-
-Link: https://neon.com/docs/introduction/read-replicas.md
-
-## Connection Pooling
-
-Use this when the user is in serverless or high-concurrency environments and needs safe, scalable Postgres connection management.
-
-Key points:
-
-- Neon pooling uses PgBouncer.
-- Add `-pooler` to endpoint hostnames to use pooled connections.
-- Pooling is especially important in serverless runtimes with bursty concurrency.
-
-Link: https://neon.com/docs/connect/connection-pooling.md
-
-## IP Allow Lists
-
-Use this when the user needs to restrict database access by trusted networks, IPs, or CIDR ranges.
-
-Link: https://neon.com/docs/introduction/ip-allow.md
-
-## Logical Replication
-
-Use this when integrating CDC pipelines, external Postgres sync, or replication-based data movement.
-
-Key points:
-
-- Neon supports native logical replication workflows.
-- Useful for replicating to/from external Postgres systems.
-
-Link: https://neon.com/docs/guides/logical-replication-guide.md
diff --git a/.claude/skills/openspec-apply-change/SKILL.md b/.claude/skills/openspec-apply-change/SKILL.md
deleted file mode 100644
index d474dc13..00000000
--- a/.claude/skills/openspec-apply-change/SKILL.md
+++ /dev/null
@@ -1,156 +0,0 @@
----
-name: openspec-apply-change
-description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Implement tasks from an OpenSpec change.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **Select the change**
-
-   If a name is provided, use it. Otherwise:
-   - Infer from conversation context if the user mentioned a change
-   - Auto-select if only one active change exists
-   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
-
-   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
-
-2. **Check status to understand the schema**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used (e.g., "spec-driven")
-   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
-
-3. **Get apply instructions**
-
-   ```bash
-   openspec instructions apply --change "<name>" --json
-   ```
-
-   This returns:
-   - Context file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
-   - Progress (total, complete, remaining)
-   - Task list with status
-   - Dynamic instruction based on current state
-
-   **Handle states:**
-   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
-   - If `state: "all_done"`: congratulate, suggest archive
-   - Otherwise: proceed to implementation
-
-4. **Read context files**
-
-   Read the files listed in `contextFiles` from the apply instructions output.
-   The files depend on the schema being used:
-   - **spec-driven**: proposal, specs, design, tasks
-   - Other schemas: follow the contextFiles from CLI output
-
-5. **Show current progress**
-
-   Display:
-   - Schema being used
-   - Progress: "N/M tasks complete"
-   - Remaining tasks overview
-   - Dynamic instruction from CLI
-
-6. **Implement tasks (loop until done or blocked)**
-
-   For each pending task:
-   - Show which task is being worked on
-   - Make the code changes required
-   - Keep changes minimal and focused
-   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
-   - Continue to next task
-
-   **Pause if:**
-   - Task is unclear → ask for clarification
-   - Implementation reveals a design issue → suggest updating artifacts
-   - Error or blocker encountered → report and wait for guidance
-   - User interrupts
-
-7. **On completion or pause, show status**
-
-   Display:
-   - Tasks completed this session
-   - Overall progress: "N/M tasks complete"
-   - If all done: suggest archive
-   - If paused: explain why and wait for guidance
-
-**Output During Implementation**
-
-```
-## Implementing: <change-name> (schema: <schema-name>)
-
-Working on task 3/7: <task description>
-[...implementation happening...]
-✓ Task complete
-
-Working on task 4/7: <task description>
-[...implementation happening...]
-✓ Task complete
-```
-
-**Output On Completion**
-
-```
-## Implementation Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 7/7 tasks complete ✓
-
-### Completed This Session
-- [x] Task 1
-- [x] Task 2
-...
-
-All tasks complete! Ready to archive this change.
-```
-
-**Output On Pause (Issue Encountered)**
-
-```
-## Implementation Paused
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Progress:** 4/7 tasks complete
-
-### Issue Encountered
-<description of the issue>
-
-**Options:**
-1. <option 1>
-2. <option 2>
-3. Other approach
-
-What would you like to do?
-```
-
-**Guardrails**
-- Keep going through tasks until done or blocked
-- Always read context files before starting (from the apply instructions output)
-- If task is ambiguous, pause and ask before implementing
-- If implementation reveals issues, pause and suggest artifact updates
-- Keep code changes minimal and scoped to each task
-- Update task checkbox immediately after completing each task
-- Pause on errors, blockers, or unclear requirements - don't guess
-- Use contextFiles from CLI output, don't assume specific file names
-
-**Fluid Workflow Integration**
-
-This skill supports the "actions on a change" model:
-
-- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
-- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.claude/skills/openspec-archive-change/SKILL.md b/.claude/skills/openspec-archive-change/SKILL.md
deleted file mode 100644
index 9b1f851a..00000000
--- a/.claude/skills/openspec-archive-change/SKILL.md
+++ /dev/null
@@ -1,114 +0,0 @@
----
-name: openspec-archive-change
-description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Archive a completed change in the experimental workflow.
-
-**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
-
-**Steps**
-
-1. **If no change name provided, prompt for selection**
-
-   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
-
-   Show only active changes (not already archived).
-   Include the schema used for each change if available.
-
-   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
-
-2. **Check artifact completion status**
-
-   Run `openspec status --change "<name>" --json` to check artifact completion.
-
-   Parse the JSON to understand:
-   - `schemaName`: The workflow being used
-   - `artifacts`: List of artifacts with their status (`done` or other)
-
-   **If any artifacts are not `done`:**
-   - Display warning listing incomplete artifacts
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-3. **Check task completion status**
-
-   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
-
-   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
-
-   **If incomplete tasks found:**
-   - Display warning showing count of incomplete tasks
-   - Use **AskUserQuestion tool** to confirm user wants to proceed
-   - Proceed if user confirms
-
-   **If no tasks file exists:** Proceed without task-related warning.
-
-4. **Assess delta spec sync state**
-
-   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
-
-   **If delta specs exist:**
-   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
-   - Determine what changes would be applied (adds, modifications, removals, renames)
-   - Show a combined summary before prompting
-
-   **Prompt options:**
-   - If changes needed: "Sync now (recommended)", "Archive without syncing"
-   - If already synced: "Archive now", "Sync anyway", "Cancel"
-
-   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
-
-5. **Perform the archive**
-
-   Create the archive directory if it doesn't exist:
-   ```bash
-   mkdir -p openspec/changes/archive
-   ```
-
-   Generate target name using current date: `YYYY-MM-DD-<change-name>`
-
-   **Check if target already exists:**
-   - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move the change directory to archive
-
-   ```bash
-   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
-   ```
-
-6. **Display summary**
-
-   Show archive completion summary including:
-   - Change name
-   - Schema that was used
-   - Archive location
-   - Whether specs were synced (if applicable)
-   - Note about any warnings (incomplete artifacts/tasks)
-
-**Output On Success**
-
-```
-## Archive Complete
-
-**Change:** <change-name>
-**Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
-**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
-
-All artifacts complete. All tasks complete.
-```
-
-**Guardrails**
-- Always prompt for change selection if not provided
-- Use artifact graph (openspec status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
-- Preserve .openspec.yaml when moving to archive (it moves with the directory)
-- Show clear summary of what happened
-- If sync is requested, use openspec-sync-specs approach (agent-driven)
-- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.claude/skills/openspec-explore/SKILL.md b/.claude/skills/openspec-explore/SKILL.md
deleted file mode 100644
index ffa10cad..00000000
--- a/.claude/skills/openspec-explore/SKILL.md
+++ /dev/null
@@ -1,288 +0,0 @@
----
-name: openspec-explore
-description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
-
-**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
-
-**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
-
----
-
-## The Stance
-
-- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
-- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
-- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
-- **Adaptive** - Follow interesting threads, pivot when new information emerges
-- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
-- **Grounded** - Explore the actual codebase when relevant, don't just theorize
-
----
-
-## What You Might Do
-
-Depending on what the user brings, you might:
-
-**Explore the problem space**
-- Ask clarifying questions that emerge from what they said
-- Challenge assumptions
-- Reframe the problem
-- Find analogies
-
-**Investigate the codebase**
-- Map existing architecture relevant to the discussion
-- Find integration points
-- Identify patterns already in use
-- Surface hidden complexity
-
-**Compare options**
-- Brainstorm multiple approaches
-- Build comparison tables
-- Sketch tradeoffs
-- Recommend a path (if asked)
-
-**Visualize**
-```
-┌─────────────────────────────────────────┐
-│     Use ASCII diagrams liberally        │
-├─────────────────────────────────────────┤
-│                                         │
-│   ┌────────┐         ┌────────┐        │
-│   │ State  │────────▶│ State  │        │
-│   │   A    │         │   B    │        │
-│   └────────┘         └────────┘        │
-│                                         │
-│   System diagrams, state machines,      │
-│   data flows, architecture sketches,    │
-│   dependency graphs, comparison tables  │
-│                                         │
-└─────────────────────────────────────────┘
-```
-
-**Surface risks and unknowns**
-- Identify what could go wrong
-- Find gaps in understanding
-- Suggest spikes or investigations
-
----
-
-## OpenSpec Awareness
-
-You have full context of the OpenSpec system. Use it naturally, don't force it.
-
-### Check for context
-
-At the start, quickly check what exists:
-```bash
-openspec list --json
-```
-
-This tells you:
-- If there are active changes
-- Their names, schemas, and status
-- What the user might be working on
-
-### When no change exists
-
-Think freely. When insights crystallize, you might offer:
-
-- "This feels solid enough to start a change. Want me to create a proposal?"
-- Or keep exploring - no pressure to formalize
-
-### When a change exists
-
-If the user mentions a change or you detect one is relevant:
-
-1. **Read existing artifacts for context**
-   - `openspec/changes/<name>/proposal.md`
-   - `openspec/changes/<name>/design.md`
-   - `openspec/changes/<name>/tasks.md`
-   - etc.
-
-2. **Reference them naturally in conversation**
-   - "Your design mentions using Redis, but we just realized SQLite fits better..."
-   - "The proposal scopes this to premium users, but we're now thinking everyone..."
-
-3. **Offer to capture when decisions are made**
-
-   | Insight Type | Where to Capture |
-   |--------------|------------------|
-   | New requirement discovered | `specs/<capability>/spec.md` |
-   | Requirement changed | `specs/<capability>/spec.md` |
-   | Design decision made | `design.md` |
-   | Scope changed | `proposal.md` |
-   | New work identified | `tasks.md` |
-   | Assumption invalidated | Relevant artifact |
-
-   Example offers:
-   - "That's a design decision. Capture it in design.md?"
-   - "This is a new requirement. Add it to specs?"
-   - "This changes scope. Update the proposal?"
-
-4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
-
----
-
-## What You Don't Have To Do
-
-- Follow a script
-- Ask the same questions every time
-- Produce a specific artifact
-- Reach a conclusion
-- Stay on topic if a tangent is valuable
-- Be brief (this is thinking time)
-
----
-
-## Handling Different Entry Points
-
-**User brings a vague idea:**
-```
-User: I'm thinking about adding real-time collaboration
-
-You: Real-time collab is a big space. Let me think about this...
-
-      COLLABORATION SPECTRUM
-      ════════════════════════════════════════════
-
-      Awareness          Coordination         Sync
-          │                   │                 │
-          ▼                   ▼                 ▼
-      ┌────────┐         ┌────────┐        ┌────────┐
-      │Presence│         │Cursors │        │  CRDT  │
-      │  "3    │         │ Multi  │        │Conflict│
-      │online" │         │ select │        │  free  │
-      └────────┘         └────────┘        └────────┘
-          │                   │                 │
-       trivial            moderate           complex
-
-      Where's your head at?
-```
-
-**User brings a specific problem:**
-```
-User: The auth system is a mess
-
-You: [reads codebase]
-
-     ┌─────────────────────────────────────────────┐
-     │              CURRENT AUTH FLOW              │
-     └─────────────────────────────────────────────┘
-                        │
-          ┌─────────────┼─────────────┐
-          ▼             ▼             ▼
-     ┌─────────┐  ┌─────────┐  ┌─────────┐
-     │ Google  │  │  GitHub │  │  Email  │
-     │  OAuth  │  │  OAuth  │  │  Magic  │
-     └────┬────┘  └────┬────┘  └────┬────┘
-          │             │             │
-          └─────────────┼─────────────┘
-                        ▼
-                  ┌───────────┐
-                  │  Session  │
-                  └─────┬─────┘
-                        │
-                        ▼
-                  ┌───────────┐
-                  │   Perms   │
-                  └───────────┘
-
-     I see three tangles. Which one's burning?
-```
-
-**User is stuck mid-implementation:**
-```
-User: /opsx:explore add-auth-system
-      The OAuth integration is more complex than expected
-
-You: [reads change artifacts]
-
-     You're on task 4: "Implement OAuth flow"
-
-     Let me trace what's involved...
-
-     [draws diagram, explores options, suggests paths]
-
-     Want to update the design to reflect this?
-     Or add a spike task to investigate?
-```
-
-**User wants to compare options:**
-```
-User: Should we use Postgres or SQLite?
-
-You: Generic answer is boring. What's the context?
-
-User: A CLI tool that tracks local dev environments
-
-You: That changes everything.
-
-     ┌─────────────────────────────────────────────────┐
-     │         CLI TOOL DATA STORAGE                  │
-     └─────────────────────────────────────────────────┘
-
-     Key constraints:
-     • No daemon running
-     • Must work offline
-     • Single user
-
-                  SQLite          Postgres
-     Deployment   embedded ✓      needs server ✗
-     Offline      yes ✓           no ✗
-     Single file  yes ✓           no ✗
-
-     SQLite. Not even close.
-
-     Unless... is there a sync component?
-```
-
----
-
-## Ending Discovery
-
-There's no required ending. Discovery might:
-
-- **Flow into a proposal**: "Ready to start? I can create a change proposal."
-- **Result in artifact updates**: "Updated design.md with these decisions"
-- **Just provide clarity**: User has what they need, moves on
-- **Continue later**: "We can pick this up anytime"
-
-When it feels like things are crystallizing, you might summarize:
-
-```
-## What We Figured Out
-
-**The problem**: [crystallized understanding]
-
-**The approach**: [if one emerged]
-
-**Open questions**: [if any remain]
-
-**Next steps** (if ready):
-- Create a change proposal
-- Keep exploring: just keep talking
-```
-
-But this summary is optional. Sometimes the thinking IS the value.
-
----
-
-## Guardrails
-
-- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
-- **Don't fake understanding** - If something is unclear, dig deeper
-- **Don't rush** - Discovery is thinking time, not task time
-- **Don't force structure** - Let patterns emerge naturally
-- **Don't auto-capture** - Offer to save insights, don't just do it
-- **Do visualize** - A good diagram is worth many paragraphs
-- **Do explore the codebase** - Ground discussions in reality
-- **Do question assumptions** - Including the user's and your own
diff --git a/.claude/skills/openspec-propose/SKILL.md b/.claude/skills/openspec-propose/SKILL.md
deleted file mode 100644
index d27bc531..00000000
--- a/.claude/skills/openspec-propose/SKILL.md
+++ /dev/null
@@ -1,110 +0,0 @@
----
-name: openspec-propose
-description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
-license: MIT
-compatibility: Requires openspec CLI.
-metadata:
-  author: openspec
-  version: "1.0"
-  generatedBy: "1.2.0"
----
-
-Propose a new change - create the change and generate all artifacts in one step.
-
-I'll create a change with artifacts:
-- proposal.md (what & why)
-- design.md (how)
-- tasks.md (implementation steps)
-
-When ready to implement, run /opsx:apply
-
----
-
-**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
-
-**Steps**
-
-1. **If no clear input provided, ask what they want to build**
-
-   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
-   > "What change do you want to work on? Describe what you want to build or fix."
-
-   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
-
-   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
-
-2. **Create the change directory**
-   ```bash
-   openspec new change "<name>"
-   ```
-   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
-
-3. **Get the artifact build order**
-   ```bash
-   openspec status --change "<name>" --json
-   ```
-   Parse the JSON to get:
-   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
-   - `artifacts`: list of all artifacts with their status and dependencies
-
-4. **Create artifacts in sequence until apply-ready**
-
-   Use the **TodoWrite tool** to track progress through the artifacts.
-
-   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
-
-   a. **For each artifact that is `ready` (dependencies satisfied)**:
-      - Get instructions:
-        ```bash
-        openspec instructions <artifact-id> --change "<name>" --json
-        ```
-      - The instructions JSON includes:
-        - `context`: Project background (constraints for you - do NOT include in output)
-        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
-        - `template`: The structure to use for your output file
-        - `instruction`: Schema-specific guidance for this artifact type
-        - `outputPath`: Where to write the artifact
-        - `dependencies`: Completed artifacts to read for context
-      - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure
-      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
-      - Show brief progress: "Created <artifact-id>"
-
-   b. **Continue until all `applyRequires` artifacts are complete**
-      - After creating each artifact, re-run `openspec status --change "<name>" --json`
-      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
-      - Stop when all `applyRequires` artifacts are done
-
-   c. **If an artifact requires user input** (unclear context):
-      - Use **AskUserQuestion tool** to clarify
-      - Then continue with creation
-
-5. **Show final status**
-   ```bash
-   openspec status --change "<name>"
-   ```
-
-**Output**
-
-After completing all artifacts, summarize:
-- Change name and location
-- List of artifacts created with brief descriptions
-- What's ready: "All artifacts created! Ready for implementation."
-- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
-
-**Artifact Creation Guidelines**
-
-- Follow the `instruction` field from `openspec instructions` for each artifact type
-- The schema defines what each artifact should contain - follow it
-- Read dependency artifacts for context before creating new ones
-- Use `template` as the structure for your output file - fill in its sections
-- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
-  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
-  - These guide what you write, but should never appear in the output
-
-**Guardrails**
-- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
-- Always read dependency artifacts before creating a new one
-- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
-- If a change with that name already exists, ask if user wants to continue it or create a new one
-- Verify each artifact file exists after writing before proceeding to next
diff --git a/devshell b/devshell
deleted file mode 100755
index 396f8edc..00000000
--- a/devshell
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-# devshell - Enter a clean development environment
-#
-# This script enters the Nix devshell with a clean environment,
-# ignoring host shell aliases and most environment variables.
-#
-# Generated by stackpanel. Regenerate with: nix develop -c devshell-regen
-#
-# Usage:
-#   ./devshell              # Enter clean devshell (interactive)
-#   ./devshell --dirty      # Enter normal devshell (inherit host env)
-#   ./devshell --logs       # View shell hook logs (useful after direnv)
-#   ./devshell -- <cmd>     # Run a one-off command in the devshell
-#
-set -euo pipefail
-
-cd "$(dirname "$0")"
-
-if [[ "${1:-}" == "--logs" ]]; then
-  LOG_FILE="$(dirname "$0")/.stack/profile/shell.log"
-  if [[ -f "$LOG_FILE" ]]; then
-    ${PAGER:-less} "$LOG_FILE"
-  else
-    echo "No shell logs found at $LOG_FILE" >&2
-    echo "Logs are created when you run: ./devshell or nix develop" >&2
-    exit 1
-  fi
-  exit
-fi
-
-if [[ "${1:-}" == "--direnv" ]]; then
-  shift
-  # Use nix print-dev-env which outputs environment setup without running shellHook
-  # This avoids mixing hook output with environment variables that breaks direnv
-  nix print-dev-env  "$@"
-
-  # Show hint about shell logs (to stderr so it doesn't interfere with eval)
-  LOG_FILE="$(dirname "$0")/.stack/profile/shell.log"
-  if [[ -f "$LOG_FILE" ]]; then
-    # Calculate how long ago the log was created
-    # Try GNU stat first (-c), fall back to BSD stat (-f) if it fails
-    LOG_TIME=$(stat -c %Y "$LOG_FILE" 2>/dev/null || stat -f %m "$LOG_FILE" 2>/dev/null || echo 0)
-    NOW=$(date +%s)
-    AGE_SECS=$((NOW - LOG_TIME))
-    if [[ $AGE_SECS -lt 60 ]]; then
-      AGE_STR="${AGE_SECS}s ago"
-    elif [[ $AGE_SECS -lt 3600 ]]; then
-      AGE_STR="$((AGE_SECS / 60))m ago"
-    elif [[ $AGE_SECS -lt 86400 ]]; then
-      AGE_STR="$((AGE_SECS / 3600))h ago"
-    else
-      AGE_STR="$((AGE_SECS / 86400))d ago"
-    fi
-    echo "" >&2
-    echo "💡 Shell logs ($AGE_STR): ./devshell --logs" >&2
-    echo "   Rebuild shell: ./devshell --dirty" >&2
-  fi
-  exit
-fi
-
-if [[ "${1:-}" == "--dirty" ]]; then
-  shift
-  echo "🔧 Entering devshell (inheriting host environment)..."
-  exec nix develop  "$@"
-fi
-
-# Check for -- separator (run one-off command)
-if [[ "${1:-}" == "--" ]]; then
-  shift
-  if [[ $# -eq 0 ]]; then
-    echo "Error: No command specified after --" >&2
-    echo "Usage: ./devshell -- <command> [args...]" >&2
-    exit 1
-  fi
-  exec nix develop \
-    --ignore-environment \
-     \
-    --keep HOME \
-  --keep USER \
-  --keep LOGNAME \
-  --keep SHELL \
-  --keep TMPDIR \
-  --keep TERM \
-  --keep COLORTERM \
-  --keep TERM_PROGRAM \
-  --keep TERM_PROGRAM_VERSION \
-  --keep LANG \
-  --keep LC_ALL \
-  --keep LC_CTYPE \
-  --keep SSH_AUTH_SOCK \
-  --keep SSH_SOCKET_DIR \
-  --keep GPG_AGENT_INFO \
-  --keep GNUPGHOME \
-  --keep EDITOR \
-  --keep VISUAL \
-  --keep PAGER \
-  --keep __CF_USER_TEXT_ENCODING \
-  --keep COMMAND_MODE \
-    --command "$@"
-fi
-
-echo "🧹 Entering clean devshell..."
-exec nix develop \
-  --ignore-environment \
-   \
-  --keep HOME \
-  --keep USER \
-  --keep LOGNAME \
-  --keep SHELL \
-  --keep TMPDIR \
-  --keep TERM \
-  --keep COLORTERM \
-  --keep TERM_PROGRAM \
-  --keep TERM_PROGRAM_VERSION \
-  --keep LANG \
-  --keep LC_ALL \
-  --keep LC_CTYPE \
-  --keep SSH_AUTH_SOCK \
-  --keep SSH_SOCKET_DIR \
-  --keep GPG_AGENT_INFO \
-  --keep GNUPGHOME \
-  --keep EDITOR \
-  --keep VISUAL \
-  --keep PAGER \
-  --keep __CF_USER_TEXT_ENCODING \
-  --keep COMMAND_MODE \
-  "$@"
diff --git a/packages/infra/.gitkeep b/packages/infra/.gitkeep
deleted file mode 100644
index e69de29b..00000000
diff --git a/packages/infra/.stack/keys/local.pub b/packages/infra/.stack/keys/local.pub
deleted file mode 100644
index aba0cb6e..00000000
--- a/packages/infra/.stack/keys/local.pub
+++ /dev/null
@@ -1 +0,0 @@
-age1yegftjs39p42j5r0n32crc8hc6dz6mq2rlj96va62rlph9zmt5qs7k5j0r
diff --git a/packages/infra/README.md b/packages/infra/README.md
deleted file mode 100644
index 284e1ec0..00000000
--- a/packages/infra/README.md
+++ /dev/null
@@ -1,100 +0,0 @@
-# @stackpanel/infra
-
-> Auto-generated by Stackpanel — do not edit manually.
-> Regenerate with `write-files` or restart devshell.
-
-Infrastructure-as-code package for **stackpanel**, powered by [Alchemy](https://github.com/sam-goodwin/alchemy).
-
-## Modules (5)
-
-### AWS EC2 Apps (`aws-ec2-app`)
-
-Provision EC2 instances for apps and emit machine inventory
-
-Dependencies: `@aws-sdk/client-ec2`, `@aws-sdk/client-ecr`, `@aws-sdk/client-elastic-load-balancing-v2`, `@aws-sdk/client-iam`, `@aws-sdk/client-ssm`, `@aws-sdk/client-sts`
-
-**Outputs:**
-  - `albOutputs` — ALB outputs per app (JSON) *(synced)*
-  - `ecrOutputs` — ECR outputs per app (JSON) *(synced)*
-  - `instanceIds` — Instance IDs (JSON) *(synced)*
-  - `machines` — Machine inventory (JSON) *(synced)*
-  - `privateIps` — Instance private IPs (JSON) *(synced)*
-  - `publicDns` — Instance public DNS (JSON) *(synced)*
-  - `publicIps` — Instance public IPs (JSON) *(synced)*
-  - `ssmOutputs` — SSM outputs per app (JSON) *(synced)*
-
-### AWS Secrets Infrastructure (`aws-secrets`)
-
-OIDC provider, IAM role, and KMS key for secrets management
-
-Dependencies: `@aws-sdk/client-iam`, `@aws-sdk/client-kms`, `@aws-sdk/client-ssm`, `@aws-sdk/client-sts`
-
-**Outputs:**
-  - `kmsAliasName` — KMS key alias name *(synced)*
-  - `kmsKeyArn` — KMS key ARN for secrets encryption *(synced)*
-  - `kmsKeyId` — KMS key ID *(synced)*
-  - `oidcProviderArn` — OIDC provider ARN *(synced)*
-  - `roleArn` — IAM role ARN for OIDC authentication *(synced)*
-  - `roleName` — IAM role name *(synced)*
-
-### Database (`database`)
-
-Postgres database provisioning (Neon / devenv / Docker)
-
-Dependencies: `alchemy`
-
-**Outputs:**
-  - `databaseUrl` — PostgreSQL connection URL *(synced)*
-  - `provider` — Active database provider (neon, devenv, docker) *(synced)*
-
-### App Deployment (`deployment`)
-
-Deploys apps to their configured hosts (cloudflare, aws)
-
-Dependencies: `@aws-sdk/client-ssm`
-
-**Outputs:**
-  - `docsUrl` — Deployed URL for docs *(synced)*
-  - `webUrl` — Deployed URL for web *(synced)*
-
-### Machine Inventory (`machines`)
-
-Machine inventory provider for Colmena deployments
-
-Dependencies: `@aws-sdk/client-ec2`
-
-**Outputs:**
-  - `machines` — Machine inventory (JSON) *(synced)*
-
-
-## Usage
-
-```bash
-# Deploy all infra modules
-cd packages/infra && bun run alchemy.run.ts
-
-# Destroy all resources
-cd packages/infra && bun run alchemy.run.ts --destroy
-```
-
-## Storage Backend
-
-SOPS (encrypted YAML file)
-
-## Architecture
-
-```
-packages/infra/
-├── alchemy.run.ts          # Orchestrator (imports all modules, syncs outputs)
-├── package.json
-├── tsconfig.json
-├── src/
-│   ├── index.ts            # Infra class (input resolution, output sync)
-│   └── types.ts            # Per-module TypeScript interfaces
-└── modules/
-    ├── aws-ec2-app.ts
-    ├── aws-secrets.ts
-    ├── database.ts
-    ├── deployment.ts
-    ├── machines.ts
-```
diff --git a/packages/infra/alchemy.run.ts b/packages/infra/alchemy.run.ts
deleted file mode 100644
index 3cef5326..00000000
--- a/packages/infra/alchemy.run.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-// Generated by stackpanel — do not edit manually.
-import alchemy from "alchemy";
-import { CloudflareStateStore } from "alchemy/state";
-import Infra from "./src/index.ts";
-// Register legacy custom-resource providers so pending deletions from
-// earlier generated stacks can still be finalized after migrations.
-import "./src/resources/ec2-instance.ts";
-import "./src/resources/iam-instance-profile.ts";
-import "./src/resources/iam-role.ts";
-import "./src/resources/key-pair.ts";
-import "./src/resources/security-group.ts";
-
-
-const app = await alchemy("stackpanel-infra", {
-  stateStore: process.env.CLOUDFLARE_API_TOKEN
-    ? (scope) =>
-        new CloudflareStateStore(scope, {
-          apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN!),
-        })
-    : undefined,
-});
-
-// Import and run infra modules
-const aws_ec2_appOutputs = (await import("./modules/aws-ec2-app.ts")).default;
-
-const aws_secretsOutputs = (await import("./modules/aws-secrets/index.ts")).default;
-
-const databaseOutputs = (await import("./modules/database.ts")).default;
-
-const deploymentOutputs = (await import("./modules/deployment/index.ts")).default;
-
-const machinesOutputs = (await import("./modules/machines.ts")).default;
-
-
-// Sync declared outputs to storage backend
-await Infra.syncAll({
-"aws-ec2-app": {
-  outputs: aws_ec2_appOutputs,
-  syncKeys: ["albOutputs","ecrOutputs","instanceIds","machines","privateIps","publicDns","publicIps","ssmOutputs"],
-},
-"aws-secrets": {
-  outputs: aws_secretsOutputs,
-  syncKeys: ["kmsAliasName","kmsKeyArn","kmsKeyId","oidcProviderArn","roleArn","roleName"],
-},
-"database": {
-  outputs: databaseOutputs,
-  syncKeys: ["databaseUrl","provider"],
-},
-"deployment": {
-  outputs: deploymentOutputs,
-  syncKeys: ["docsUrl","webUrl"],
-},
-"machines": {
-  outputs: machinesOutputs,
-  syncKeys: ["machines"],
-},
-});
-
-await app.finalize();
diff --git a/packages/infra/deployment-check.run.ts b/packages/infra/deployment-check.run.ts
deleted file mode 100644
index 19111667..00000000
--- a/packages/infra/deployment-check.run.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import alchemy from "alchemy";
-
-process.chdir(
-  path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", ".."),
-);
-
-const app = await alchemy("stackpanel-deployment-check-v10");
-
-const outputs = (await import("./modules/deployment.ts")).default;
-
-console.log(outputs);
-
-await app.finalize();
diff --git a/packages/infra/deployment-scope-check.run.ts b/packages/infra/deployment-scope-check.run.ts
deleted file mode 100644
index 47a99321..00000000
--- a/packages/infra/deployment-scope-check.run.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import alchemy from "alchemy";
-
-process.chdir(
-  path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", ".."),
-);
-
-const app = await alchemy("stackpanel-deployment-scope-check");
-
-const outputs = (await import("./modules/deployment.ts")).default;
-
-console.log(outputs);
-
-await app.finalize();
diff --git a/packages/infra/fly/web/fly.toml b/packages/infra/fly/web/fly.toml
deleted file mode 100644
index 572ae7e2..00000000
--- a/packages/infra/fly/web/fly.toml
+++ /dev/null
@@ -1,33 +0,0 @@
-# Generated by stackpanel - do not edit manually
-# Regenerate by entering the devshell: nix develop --impure
-#
-# Deploy workflow (uses nix2container/dockerTools):
-#   1. Build app:        bun run build (in app directory)
-#   2. Build container:  container-build web
-#   3. Push container:   container-copy web docker://registry.fly.io/
-#   4. Deploy:           flyctl deploy --config packages/infra/fly/web/fly.toml --image registry.fly.io/stackpanel-web:latest
-#
-# Or use turbo workflow:
-#   turbo run ship:web
-
-app = "stackpanel-web"
-org = "darkmatter"
-
-# Build section removed - we use pre-built container images
-# Container is built with nix2container/dockerTools and pushed via skopeo
-
-[env]
-PORT = '3000'
-
-[http_service]
-internal_port = 3000
-force_https = true
-auto_stop_machines = "suspend"
-auto_start_machines = true
-min_machines_running = 0
-processes = ["app"]
-
-[[vm]]
-memory = "512mb"
-cpu_kind = "shared"
-cpus = 1
diff --git a/packages/infra/modules/aws-ec2-app.helpers.test.ts b/packages/infra/modules/aws-ec2-app.helpers.test.ts
deleted file mode 100644
index ec47d425..00000000
--- a/packages/infra/modules/aws-ec2-app.helpers.test.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-// @ts-nocheck
-import { describe, expect, test } from "bun:test";
-import {
-  buildAlbTargets,
-  buildSecurityGroupEgressResources,
-  buildSecurityGroupIngressResources,
-  sanitizeAwsName,
-  toAwsTags,
-} from "./aws-ec2-app.helpers";
-
-describe("aws-ec2-app native helpers", () => {
-  test("toAwsTags returns undefined for empty tags", () => {
-    expect(toAwsTags(undefined)).toBeUndefined();
-    expect(toAwsTags({})).toBeUndefined();
-  });
-
-  test("toAwsTags converts records into AWS tag objects", () => {
-    expect(
-      toAwsTags({
-        Name: "stackpanel-staging",
-        ManagedBy: "stackpanel-infra",
-      }),
-    ).toEqual([
-      { Key: "Name", Value: "stackpanel-staging" },
-      { Key: "ManagedBy", Value: "stackpanel-infra" },
-    ]);
-  });
-
-  test("sanitizeAwsName normalizes invalid characters and truncates", () => {
-    expect(sanitizeAwsName("stackpanel/staging_alb", 32)).toBe("stackpanel-staging-alb");
-    expect(sanitizeAwsName("this-name-is-way-too-long-for-an-elb-resource", 32)).toBe(
-      "this-name-is-way-too-long-for-an",
-    );
-  });
-
-  test("buildAlbTargets emits instance target descriptions", () => {
-    expect(buildAlbTargets(["i-abc", "i-def"], 8080)).toEqual([
-      { Id: "i-abc", Port: 8080 },
-      { Id: "i-def", Port: 8080 },
-    ]);
-  });
-
-  test("buildSecurityGroupIngressResources expands ipv4, ipv6, and source groups", () => {
-    expect(
-      buildSecurityGroupIngressResources("sg-123", [
-        {
-          fromPort: 80,
-          toPort: 80,
-          protocol: "tcp",
-          cidrBlocks: ["0.0.0.0/0"],
-          ipv6CidrBlocks: ["::/0"],
-          securityGroupIds: ["sg-source"],
-          description: "web",
-        },
-      ]),
-    ).toEqual([
-      {
-        GroupId: "sg-123",
-        IpProtocol: "tcp",
-        FromPort: 80,
-        ToPort: 80,
-        Description: "web",
-        CidrIp: "0.0.0.0/0",
-      },
-      {
-        GroupId: "sg-123",
-        IpProtocol: "tcp",
-        FromPort: 80,
-        ToPort: 80,
-        Description: "web",
-        CidrIpv6: "::/0",
-      },
-      {
-        GroupId: "sg-123",
-        IpProtocol: "tcp",
-        FromPort: 80,
-        ToPort: 80,
-        Description: "web",
-        SourceSecurityGroupId: "sg-source",
-      },
-    ]);
-  });
-
-  test("buildSecurityGroupEgressResources expands destination group rules", () => {
-    expect(
-      buildSecurityGroupEgressResources("sg-123", [
-        {
-          fromPort: 0,
-          toPort: 0,
-          protocol: "-1",
-          securityGroupIds: ["sg-dest"],
-        },
-      ]),
-    ).toEqual([
-      {
-        GroupId: "sg-123",
-        IpProtocol: "-1",
-        FromPort: 0,
-        ToPort: 0,
-        DestinationSecurityGroupId: "sg-dest",
-      },
-    ]);
-  });
-});
diff --git a/packages/infra/modules/aws-ec2-app.helpers.ts b/packages/infra/modules/aws-ec2-app.helpers.ts
deleted file mode 100644
index 3467c360..00000000
--- a/packages/infra/modules/aws-ec2-app.helpers.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-export interface RuleConfigLike {
-  fromPort: number;
-  toPort: number;
-  protocol?: string;
-  cidrBlocks?: string[];
-  ipv6CidrBlocks?: string[];
-  securityGroupIds?: string[];
-  description?: string | null;
-}
-
-export function toAwsTags(tags?: Record<string, string>) {
-  if (!tags || Object.keys(tags).length === 0) {
-    return undefined;
-  }
-
-  return Object.entries(tags).map(([Key, Value]) => ({
-    Key,
-    Value,
-  }));
-}
-
-export function sanitizeAwsName(name: string, maxLength = 32) {
-  return name.replace(/[^a-zA-Z0-9-]/g, "-").slice(0, maxLength);
-}
-
-export function buildAlbTargets(instanceIds: string[], port?: number) {
-  return instanceIds.map((Id) => ({
-    Id,
-    ...(port === undefined ? {} : { Port: port }),
-  }));
-}
-
-export function buildSecurityGroupIngressResources(
-  groupId: string | undefined,
-  rules: RuleConfigLike[],
-) {
-  return rules.flatMap((rule) => [
-    ...(rule.cidrBlocks ?? []).map((cidr) => ({
-      ...(groupId ? { GroupId: groupId } : {}),
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIp: cidr,
-    })),
-    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
-      ...(groupId ? { GroupId: groupId } : {}),
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIpv6: cidr,
-    })),
-    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
-      ...(groupId ? { GroupId: groupId } : {}),
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      SourceSecurityGroupId: securityGroupId,
-    })),
-  ]);
-}
-
-export function buildSecurityGroupEgressResources(
-  groupId: string | undefined,
-  rules: RuleConfigLike[],
-) {
-  return rules.flatMap((rule) => [
-    ...(rule.cidrBlocks ?? []).map((cidr) => ({
-      ...(groupId ? { GroupId: groupId } : {}),
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIp: cidr,
-    })),
-    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
-      ...(groupId ? { GroupId: groupId } : {}),
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIpv6: cidr,
-    })),
-    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
-      ...(groupId ? { GroupId: groupId } : {}),
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      DestinationSecurityGroupId: securityGroupId,
-    })),
-  ]);
-}
diff --git a/packages/infra/modules/aws-ec2-app.ts b/packages/infra/modules/aws-ec2-app.ts
deleted file mode 100644
index fdb03c91..00000000
--- a/packages/infra/modules/aws-ec2-app.ts
+++ /dev/null
@@ -1,1051 +0,0 @@
-// ==============================================================================
-// AWS EC2 Apps Module
-//
-// High-level app-centric EC2 provisioning with optional:
-//   - Security group creation
-//   - Key pair import
-//   - IAM role + instance profile
-//   - ALB + target group + listeners + host-based routing
-//   - ECR repository + GitHub OIDC push role
-//   - SSM parameter wiring (env file generation)
-//   - Machine inventory for Colmena
-// ==============================================================================
-import AWS from "alchemy/aws/control";
-import Infra from "@stackpanel/infra";
-import { Ec2Instance } from "@stackpanel/infra/resources/ec2-instance";
-import { IamInstanceProfile } from "@stackpanel/infra/resources/iam-instance-profile";
-import { IamRole } from "@stackpanel/infra/resources/iam-role";
-import { KeyPair } from "@stackpanel/infra/resources/key-pair";
-import { SecurityGroup } from "@stackpanel/infra/resources/security-group";
-
-// =============================================================================
-// Types
-// =============================================================================
-
-interface SshConfig {
-  user?: string;
-  port?: number;
-  keyPath?: string | null;
-}
-
-interface MachineMeta {
-  tags?: string[];
-  roles?: string[];
-  targetEnv?: string | null;
-  arch?: string | null;
-  ssh?: SshConfig;
-}
-
-interface RuleConfig {
-  fromPort: number;
-  toPort: number;
-  protocol?: string;
-  cidrBlocks?: string[];
-  ipv6CidrBlocks?: string[];
-  securityGroupIds?: string[];
-  description?: string | null;
-}
-
-interface SecurityGroupConfig {
-  create?: boolean;
-  name?: string | null;
-  description?: string | null;
-  ingress?: RuleConfig[];
-  egress?: RuleConfig[];
-  tags?: Record<string, string>;
-}
-
-interface KeyPairConfig {
-  create?: boolean;
-  name?: string | null;
-  publicKey?: string | null;
-  tags?: Record<string, string>;
-  destroyOnDelete?: boolean;
-}
-
-interface InlinePolicy {
-  name: string;
-  document: Record<string, unknown>;
-}
-
-interface IamConfig {
-  enable?: boolean;
-  roleName?: string | null;
-  assumeRolePolicy?: Record<string, unknown> | null;
-  managedPolicyArns?: string[];
-  inlinePolicies?: InlinePolicy[];
-  tags?: Record<string, string>;
-  instanceProfileName?: string | null;
-  instanceProfileTags?: Record<string, string>;
-}
-
-interface NixosConfig {
-  amiId?: string | null;
-  flakeUrl?: string | null;
-  hostConfig?: string | null;
-  flakeVersion?: string;
-}
-
-interface AlbHealthCheck {
-  enabled?: boolean;
-  path?: string;
-  protocol?: "HTTP" | "HTTPS" | "TCP";
-  port?: string | null;
-  interval?: number;
-  timeout?: number;
-  healthyThreshold?: number;
-  unhealthyThreshold?: number;
-  matcher?: string;
-}
-
-interface AlbTargetGroupConfig {
-  port?: number;
-  protocol?: "HTTP" | "HTTPS" | "TCP";
-  healthCheck?: AlbHealthCheck;
-}
-
-interface AlbConfig {
-  enable?: boolean;
-  create?: boolean;
-  name?: string | null;
-  scheme?: "internet-facing" | "internal";
-  ipAddressType?: "ipv4" | "dualstack";
-  subnetIds?: string[];
-  securityGroupIds?: string[];
-  http?: boolean;
-  https?: boolean;
-  certificateArn?: string | null;
-  sslPolicy?: string;
-  existingListenerHttpArn?: string | null;
-  existingListenerHttpsArn?: string | null;
-  hostnames?: string[];
-  hostRulePriority?: number;
-  targetGroup?: AlbTargetGroupConfig;
-}
-
-interface GithubOidcConfig {
-  enable?: boolean;
-  repoOwner?: string | null;
-  repoName?: string | null;
-  allowedBranches?: string[];
-  allowedWorkflows?: string[];
-  allowTags?: boolean;
-  roleName?: string | null;
-  oidcProviderArn?: string | null;
-  createOidcProvider?: boolean;
-}
-
-interface EcrConfig {
-  enable?: boolean;
-  create?: boolean;
-  repoName?: string | null;
-  imageTagMutability?: "MUTABLE" | "IMMUTABLE";
-  scanOnPush?: boolean;
-  lifecyclePolicy?: string | null;
-  github?: GithubOidcConfig;
-}
-
-interface SsmConfig {
-  enable?: boolean;
-  region?: string | null;
-  pathPrefix?: string | null;
-  parameters?: Record<string, string>;
-  secureParameters?: Record<string, string>;
-  envFilePath?: string | null;
-  refreshScriptPath?: string | null;
-  installCli?: boolean;
-  useChamber?: boolean;
-}
-
-interface InstanceOverride {
-  name?: string | null;
-  ami?: string | null;
-  osType?: "ubuntu" | "nixos";
-  nixos?: NixosConfig;
-  instanceType?: string | null;
-  subnetId?: string | null;
-  securityGroupIds?: string[];
-  keyName?: string | null;
-  iamInstanceProfile?: string | null;
-  userData?: string | null;
-  rootVolumeSize?: number | null;
-  associatePublicIp?: boolean;
-  tags?: Record<string, string>;
-  machine?: MachineMeta;
-}
-
-interface AppConfig {
-  instanceCount?: number;
-  instances?: InstanceOverride[];
-  ami?: string | null;
-  osType?: "ubuntu" | "nixos";
-  nixos?: NixosConfig;
-  instanceType?: string | null;
-  vpcId?: string | null;
-  subnetIds?: string[];
-  securityGroupIds?: string[];
-  securityGroup?: SecurityGroupConfig;
-  keyName?: string | null;
-  keyPair?: KeyPairConfig;
-  iam?: IamConfig;
-  iamInstanceProfile?: string | null;
-  userData?: string | null;
-  rootVolumeSize?: number | null;
-  associatePublicIp?: boolean;
-  tags?: Record<string, string>;
-  alb?: AlbConfig;
-  ecr?: EcrConfig;
-  ssm?: SsmConfig;
-  machine?: MachineMeta;
-}
-
-interface AwsEc2AppInputs {
-  defaults?: AppConfig;
-  apps: Record<string, AppConfig>;
-}
-
-// =============================================================================
-// Init
-// =============================================================================
-
-const infra = new Infra("aws-ec2-app");
-const inputs = infra.inputs<AwsEc2AppInputs>(
-  process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES,
-);
-
-const defaults = inputs.defaults ?? {};
-
-const { EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeImagesCommand } =
-  await import("@aws-sdk/client-ec2");
-
-const awsRegion = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
-const ec2Client = new EC2Client(awsRegion ? { region: awsRegion } : {});
-
-// =============================================================================
-// Helpers
-// =============================================================================
-
-async function resolveDefaultNetwork(): Promise<{ vpcId: string; subnetIds: string[] }> {
-  const vpcs = await ec2Client.send(
-    new DescribeVpcsCommand({
-      Filters: [{ Name: "isDefault", Values: ["true"] }],
-    }),
-  );
-  const vpcId = vpcs.Vpcs?.[0]?.VpcId;
-  if (!vpcId) {
-    throw new Error("aws-ec2-app: unable to resolve default VPC");
-  }
-  const subnets = await ec2Client.send(
-    new DescribeSubnetsCommand({
-      Filters: [{ Name: "vpc-id", Values: [vpcId] }],
-    }),
-  );
-  const subnetIds = (subnets.Subnets ?? [])
-    .map((subnet) => subnet.SubnetId)
-    .filter((id): id is string => Boolean(id));
-  if (subnetIds.length === 0) {
-    throw new Error("aws-ec2-app: unable to resolve default subnets");
-  }
-  return { vpcId, subnetIds };
-}
-
-function pickList<T>(...lists: Array<T[] | undefined | null>): T[] {
-  for (const list of lists) {
-    if (list && list.length > 0) return list;
-  }
-  return [];
-}
-
-function mergeTags(...sources: Array<Record<string, string> | undefined>): Record<string, string> {
-  const merged: Record<string, string> = {};
-  for (const source of sources) {
-    if (!source) continue;
-    Object.assign(merged, source);
-  }
-  return merged;
-}
-
-function mergeMachineMeta(...sources: Array<MachineMeta | undefined>): MachineMeta {
-  const result: MachineMeta = {};
-  const tags = new Set<string>();
-  const roles = new Set<string>();
-
-  for (const source of sources) {
-    if (!source) continue;
-    (source.tags ?? []).forEach((tag) => tags.add(tag));
-    (source.roles ?? []).forEach((role) => roles.add(role));
-    if (source.targetEnv) result.targetEnv = source.targetEnv;
-    if (source.arch) result.arch = source.arch;
-    if (source.ssh) {
-      result.ssh = {
-        ...(result.ssh ?? {}),
-        ...source.ssh,
-      };
-    }
-  }
-
-  if (tags.size > 0) result.tags = Array.from(tags);
-  if (roles.size > 0) result.roles = Array.from(roles);
-  return result;
-}
-
-function toAwsTags(tags?: Record<string, string>) {
-  if (!tags || Object.keys(tags).length === 0) {
-    return undefined;
-  }
-
-  return Object.entries(tags).map(([Key, Value]) => ({
-    Key,
-    Value,
-  }));
-}
-
-function sanitizeAwsName(name: string, maxLength = 32) {
-  return name.replace(/[^a-zA-Z0-9-]/g, "-").slice(0, maxLength);
-}
-
-function buildAlbTargets(instanceIds: string[], port?: number) {
-  return instanceIds.map((Id) => ({
-    Id,
-    ...(port === undefined ? {} : { Port: port }),
-  }));
-}
-
-function buildSecurityGroupIngressResources(
-  groupId: string,
-  rules: RuleConfig[],
-) {
-  return rules.flatMap((rule) => [
-    ...(rule.cidrBlocks ?? []).map((cidr) => ({
-      GroupId: groupId,
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIp: cidr,
-    })),
-    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
-      GroupId: groupId,
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIpv6: cidr,
-    })),
-    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
-      GroupId: groupId,
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      SourceSecurityGroupId: securityGroupId,
-    })),
-  ]);
-}
-
-function buildSecurityGroupEgressResources(
-  groupId: string,
-  rules: RuleConfig[],
-) {
-  return rules.flatMap((rule) => [
-    ...(rule.cidrBlocks ?? []).map((cidr) => ({
-      GroupId: groupId,
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIp: cidr,
-    })),
-    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
-      GroupId: groupId,
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      CidrIpv6: cidr,
-    })),
-    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
-      GroupId: groupId,
-      IpProtocol: rule.protocol ?? "tcp",
-      FromPort: rule.fromPort,
-      ToPort: rule.toPort,
-      Description: rule.description ?? undefined,
-      DestinationSecurityGroupId: securityGroupId,
-    })),
-  ]);
-}
-
-async function resolveAmi(
-  explicitAmi: string | null | undefined,
-  osType: "ubuntu" | "nixos",
-  nixos?: NixosConfig,
-): Promise<string> {
-  if (explicitAmi) return explicitAmi;
-
-  if (osType === "nixos") {
-    if (nixos?.amiId) return nixos.amiId;
-    const images = await ec2Client.send(
-      new DescribeImagesCommand({
-        Owners: ["535002876703"],
-        Filters: [
-          { Name: "name", Values: ["determinate/nixos/epoch-1/*"] },
-          { Name: "architecture", Values: ["x86_64"] },
-          { Name: "state", Values: ["available"] },
-        ],
-      }),
-    );
-    const sorted = (images.Images ?? []).sort((a, b) =>
-      (b.CreationDate ?? "").localeCompare(a.CreationDate ?? ""),
-    );
-    const imageId = sorted[0]?.ImageId;
-    if (!imageId) throw new Error("aws-ec2-app: no NixOS AMI found");
-    return imageId;
-  }
-
-  const images = await ec2Client.send(
-    new DescribeImagesCommand({
-      Owners: ["099720109477"],
-      Filters: [
-        {
-          Name: "name",
-          Values: ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"],
-        },
-        { Name: "state", Values: ["available"] },
-      ],
-    }),
-  );
-  const sorted = (images.Images ?? []).sort((a, b) =>
-    (b.CreationDate ?? "").localeCompare(a.CreationDate ?? ""),
-  );
-  const imageId = sorted[0]?.ImageId;
-  if (!imageId) throw new Error("aws-ec2-app: no Ubuntu AMI found");
-  return imageId;
-}
-
-function buildNixosUserData(nixos?: NixosConfig): string | null {
-  if (!nixos?.flakeUrl || !nixos?.hostConfig) return null;
-  const flakeVersion = nixos.flakeVersion ?? "*";
-  return `#!/usr/bin/env bash
-set -euo pipefail
-exec >> /var/log/user-data.log 2>&1
-
-echo "[+] Authenticating with FlakeHub using AWS STS..."
-determinate-nixd login aws
-
-echo "[+] Applying NixOS configuration: ${nixos.flakeUrl}/${flakeVersion}#nixosConfigurations.${nixos.hostConfig}"
-fh apply nixos "${nixos.flakeUrl}/${flakeVersion}#nixosConfigurations.${nixos.hostConfig}"
-
-echo "[+] NixOS configuration applied successfully"
-`;
-}
-
-async function getAccountId(): Promise<string> {
-  const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
-  const client = new STSClient(awsRegion ? { region: awsRegion } : {});
-  const identity = await client.send(new GetCallerIdentityCommand({}));
-  return identity.Account!;
-}
-
-// =============================================================================
-// Resolve network
-// =============================================================================
-
-const defaultNetwork = await resolveDefaultNetwork();
-
-// =============================================================================
-// Outputs
-// =============================================================================
-
-const instanceIds: Record<string, string> = {};
-const publicIps: Record<string, string> = {};
-const privateIps: Record<string, string> = {};
-const publicDns: Record<string, string> = {};
-const machines: Record<string, Record<string, unknown>> = {};
-const albOutputs: Record<string, Record<string, unknown>> = {};
-const ecrOutputs: Record<string, Record<string, unknown>> = {};
-const ssmOutputs: Record<string, Record<string, unknown>> = {};
-
-// =============================================================================
-// Per-app loop
-// =============================================================================
-
-for (const [appName, appConfig] of Object.entries(inputs.apps ?? {})) {
-  const appSecurityGroup = { ...defaults.securityGroup, ...appConfig.securityGroup };
-  const appKeyPair = { ...defaults.keyPair, ...appConfig.keyPair };
-  const appIam = { ...defaults.iam, ...appConfig.iam };
-  const appAlb = { ...defaults.alb, ...appConfig.alb };
-  const appEcr = { ...defaults.ecr, ...appConfig.ecr };
-  const appSsm = { ...defaults.ssm, ...appConfig.ssm };
-
-  const vpcId = appConfig.vpcId ?? defaults.vpcId ?? defaultNetwork.vpcId;
-  const subnetIds = pickList(appConfig.subnetIds, defaults.subnetIds, defaultNetwork.subnetIds);
-  if (subnetIds.length === 0) {
-    throw new Error(`aws-ec2-app: no subnet IDs available for ${appName}`);
-  }
-
-  // ---------------------------------------------------------------------------
-  // Security group
-  // ---------------------------------------------------------------------------
-  let securityGroupIds = pickList(appConfig.securityGroupIds, defaults.securityGroupIds);
-  if (appSecurityGroup?.create) {
-    const sgName = appSecurityGroup.name ?? `${appName}-sg`;
-    const ingressRules = appSecurityGroup.ingress ?? [];
-    const egressRules =
-      (appSecurityGroup.egress ?? []).length > 0
-        ? appSecurityGroup.egress
-        : [
-            {
-              fromPort: 0,
-              toPort: 0,
-              protocol: "-1",
-              cidrBlocks: ["0.0.0.0/0"],
-              ipv6CidrBlocks: ["::/0"],
-            },
-          ];
-    const sg = await SecurityGroup(infra.id(`${appName}-sg`), {
-      name: sgName,
-      description: appSecurityGroup.description ?? sgName,
-      vpcId,
-      ingress: ingressRules,
-      egress: egressRules ?? [],
-      tags: mergeTags(defaults.tags, appConfig.tags, appSecurityGroup.tags),
-    });
-    securityGroupIds = [sg.groupId];
-  }
-
-  // ---------------------------------------------------------------------------
-  // Key pair
-  // ---------------------------------------------------------------------------
-  let keyName = appConfig.keyName ?? defaults.keyName ?? null;
-  if (appKeyPair?.create) {
-    if (!appKeyPair.name || !appKeyPair.publicKey) {
-      throw new Error(`aws-ec2-app: key pair name and public key required for ${appName}`);
-    }
-    const keyPair = await KeyPair(infra.id(`${appName}-key`), {
-      keyName: appKeyPair.name,
-      publicKey: appKeyPair.publicKey,
-      tags: appKeyPair.tags,
-    });
-    keyName = keyPair.keyName;
-  }
-
-  // ---------------------------------------------------------------------------
-  // IAM role + instance profile
-  // ---------------------------------------------------------------------------
-  let iamInstanceProfile = appConfig.iamInstanceProfile ?? defaults.iamInstanceProfile ?? null;
-  if (appIam?.enable) {
-    const roleName = appIam.roleName ?? `${appName}-role`;
-    const role = await IamRole(infra.id(`${appName}-role`), {
-      roleName,
-      assumeRolePolicy: appIam.assumeRolePolicy ?? {
-        Version: "2012-10-17",
-        Statement: [
-          {
-            Effect: "Allow",
-            Principal: { Service: "ec2.amazonaws.com" },
-            Action: "sts:AssumeRole",
-          },
-        ],
-      },
-      description: `EC2 role for ${appName}`,
-      tags: appIam.tags,
-      managedPolicyArns: appIam.managedPolicyArns,
-      policies: (appIam.inlinePolicies ?? []).map((policy) => ({
-        policyName: policy.name,
-        policyDocument: policy.document,
-      })),
-    });
-    const profileName = appIam.instanceProfileName ?? `${roleName}-profile`;
-    await IamInstanceProfile(infra.id(`${appName}-profile`), {
-      name: profileName,
-      roleName: role.roleName,
-      tags: appIam.tags,
-    });
-    iamInstanceProfile = profileName;
-  }
-
-  // ---------------------------------------------------------------------------
-  // SSM parameters
-  // ---------------------------------------------------------------------------
-  if (appSsm?.enable) {
-    const prefix = appSsm.pathPrefix ?? `/${appName}`;
-    const allParams = {
-      ...(appSsm.parameters ?? {}),
-      ...(appSsm.secureParameters ?? {}),
-    };
-    const secureKeys = new Set(Object.keys(appSsm.secureParameters ?? {}));
-
-    for (const [key, value] of Object.entries(allParams)) {
-      const paramName = `${prefix}/${key}`;
-      await AWS.SSM.Parameter(infra.id(`${appName}-ssm-${key.toLowerCase()}`), {
-        Name: paramName,
-        Value: value,
-        Type: secureKeys.has(key) ? "SecureString" : "String",
-        adopt: true,
-      });
-    }
-
-    ssmOutputs[appName] = {
-      pathPrefix: prefix,
-      parameterCount: Object.keys(allParams).length,
-      envFilePath: appSsm.envFilePath ?? `/etc/default/${appName}.env`,
-    };
-  }
-
-  // ---------------------------------------------------------------------------
-  // ECR repository
-  // ---------------------------------------------------------------------------
-  if (appEcr?.enable) {
-    const repoName = appEcr.repoName ?? appName;
-    if (appEcr.create !== false) {
-      const defaultLifecyclePolicy = JSON.stringify({
-        rules: [
-          {
-            rulePriority: 1,
-            description: "Keep last 50 images",
-            selection: {
-              tagStatus: "any",
-              countType: "imageCountMoreThan",
-              countNumber: 50,
-            },
-            action: { type: "expire" },
-          },
-        ],
-      });
-      const repo = await AWS.ECR.Repository(infra.id(`${appName}-ecr`), {
-        RepositoryName: repoName,
-        ImageTagMutability: appEcr.imageTagMutability,
-        ImageScanningConfiguration: {
-          ScanOnPush: appEcr.scanOnPush ?? true,
-        },
-        LifecyclePolicy: {
-          LifecyclePolicyText: appEcr.lifecyclePolicy ?? defaultLifecyclePolicy,
-        },
-        EmptyOnDelete: true,
-        Tags: toAwsTags(mergeTags(defaults.tags, appConfig.tags)),
-        adopt: true,
-      });
-      ecrOutputs[appName] = {
-        repositoryUrl: repo.RepositoryUri,
-        repositoryArn: repo.Arn,
-        repositoryName: repo.RepositoryName ?? repoName,
-      };
-    }
-
-    // GitHub OIDC role for ECR push
-    const github = appEcr.github;
-    if (github?.enable) {
-      const accountId = await getAccountId();
-      let oidcProviderArn = github.oidcProviderArn ?? null;
-
-      if (!oidcProviderArn && github.createOidcProvider) {
-        const { GitHubOIDCProvider } = await import("alchemy/aws/oidc");
-        const oidc = await GitHubOIDCProvider(infra.id(`${appName}-oidc`), {});
-        oidcProviderArn = oidc.arn;
-      }
-
-      if (oidcProviderArn && github.repoOwner && github.repoName) {
-        const branchSubjects = (github.allowedBranches ?? []).map(
-          (b) => `repo:${github.repoOwner}/${github.repoName}:ref:refs/heads/${b}`,
-        );
-        const tagSubjects = github.allowTags
-          ? [`repo:${github.repoOwner}/${github.repoName}:ref:refs/tags/*`]
-          : [];
-        const workflowSubjects = (github.allowedWorkflows ?? []).map(
-          (w) => `repo:${github.repoOwner}/${github.repoName}:workflow:${w}`,
-        );
-        const allSubjects = [...branchSubjects, ...tagSubjects, ...workflowSubjects];
-        if (allSubjects.length === 0) {
-          allSubjects.push(`repo:${github.repoOwner}/${github.repoName}:*`);
-        }
-
-        const ghaRoleName = github.roleName ?? `${appName}-gha-ecr-push`;
-        const ecrRepoArn = `arn:aws:ecr:${awsRegion ?? "us-east-1"}:${accountId}:repository/${appEcr.repoName ?? appName}`;
-
-        const ssmPrefix = appSsm?.pathPrefix ?? `/${appName}`;
-
-        await IamRole(infra.id(`${appName}-gha-role`), {
-          roleName: ghaRoleName,
-          assumeRolePolicy: {
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Sid: "GitHubActionsFederatedOIDC",
-                Effect: "Allow",
-                Principal: { Federated: oidcProviderArn },
-                Action: "sts:AssumeRoleWithWebIdentity",
-                Condition: {
-                  StringLike: {
-                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-                    "token.actions.githubusercontent.com:sub": allSubjects,
-                  },
-                },
-              },
-              {
-                Sid: "AllowRoot",
-                Effect: "Allow",
-                Principal: { AWS: `arn:aws:iam::${accountId}:root` },
-                Action: "sts:AssumeRole",
-              },
-            ],
-          },
-          description: `GitHub Actions role for ${appName} ECR push`,
-          tags: mergeTags(defaults.tags, appConfig.tags),
-          policies: [
-            {
-              policyName: `${ghaRoleName}-ecr`,
-              policyDocument: {
-                Version: "2012-10-17",
-                Statement: [
-                  {
-                    Sid: "ECRAuth",
-                    Effect: "Allow",
-                    Action: ["ecr:GetAuthorizationToken"],
-                    Resource: "*",
-                  },
-                  {
-                    Sid: "ECRPushPull",
-                    Effect: "Allow",
-                    Action: [
-                      "ecr:BatchCheckLayerAvailability",
-                      "ecr:BatchGetImage",
-                      "ecr:CompleteLayerUpload",
-                      "ecr:InitiateLayerUpload",
-                      "ecr:PutImage",
-                      "ecr:UploadLayerPart",
-                      "ecr:DescribeImages",
-                      "ecr:GetDownloadUrlForLayer",
-                      "ecr:ListImages",
-                    ],
-                    Resource: [ecrRepoArn],
-                  },
-                  {
-                    Sid: "SSMAccess",
-                    Effect: "Allow",
-                    Action: [
-                      "ssm:GetParameter",
-                      "ssm:GetParameters",
-                      "ssm:GetParametersByPath",
-                      "ssm:PutParameter",
-                      "ssm:DeleteParameter",
-                      "ssm:DescribeParameters",
-                    ],
-                    Resource: [
-                      `arn:aws:ssm:${awsRegion ?? "*"}:${accountId}:parameter${ssmPrefix}/*`,
-                    ],
-                  },
-                  {
-                    Sid: "SSMSendCommand",
-                    Effect: "Allow",
-                    Action: [
-                      "ssm:SendCommand",
-                      "ssm:ListCommandInvocations",
-                      "ssm:GetCommandInvocation",
-                    ],
-                    Resource: [
-                      `arn:aws:ssm:*:*:document/AWS-RunShellScript`,
-                      `arn:aws:ec2:*:${accountId}:instance/*`,
-                    ],
-                  },
-                  {
-                    Sid: "ECRCreateRepo",
-                    Effect: "Allow",
-                    Action: [
-                      "ecr:CreateRepository",
-                      "ecr:DescribeRepositories",
-                    ],
-                    Resource: "*",
-                  },
-                ],
-              },
-            },
-          ],
-        });
-
-        ecrOutputs[appName] = {
-          ...(ecrOutputs[appName] ?? {}),
-          ghaRoleName,
-        };
-      }
-    }
-  }
-
-  // ---------------------------------------------------------------------------
-  // EC2 instances
-  // ---------------------------------------------------------------------------
-  const instanceList =
-    (appConfig.instances ?? []).length > 0
-      ? appConfig.instances ?? []
-      : Array.from({ length: appConfig.instanceCount ?? 1 }, () => ({} as InstanceOverride));
-
-  const appInstanceIds: string[] = [];
-
-  let index = 0;
-  for (const instance of instanceList) {
-    const instanceName = instance.name ?? `${appName}-${index + 1}`;
-    const osType = instance.osType ?? appConfig.osType ?? defaults.osType ?? "ubuntu";
-    const nixosConfig = { ...defaults.nixos, ...appConfig.nixos, ...instance.nixos };
-
-    const ami = await resolveAmi(
-      instance.ami ?? appConfig.ami ?? defaults.ami,
-      osType,
-      nixosConfig,
-    );
-
-    const subnetId = instance.subnetId ?? subnetIds[index % subnetIds.length];
-    const securityGroups = pickList(instance.securityGroupIds, securityGroupIds);
-
-    const userData =
-      instance.userData ??
-      appConfig.userData ??
-      defaults.userData ??
-      (osType === "nixos" ? buildNixosUserData(nixosConfig) : null);
-    const associatePublicIp =
-      instance.associatePublicIp ??
-      appConfig.associatePublicIp ??
-      defaults.associatePublicIp ??
-      true;
-
-    const instanceTags = mergeTags(defaults.tags, appConfig.tags, instance.tags, {
-      Name: instanceName,
-      Service: appName,
-      OSType: osType,
-    });
-    if (osType === "nixos" && nixosConfig.hostConfig) {
-      instanceTags.NixOSHostConfig = nixosConfig.hostConfig;
-    }
-    if (osType === "nixos" && nixosConfig.flakeUrl) {
-      instanceTags.NixOSFlakeURL = nixosConfig.flakeUrl;
-    }
-
-    const resource = await Ec2Instance(infra.id(instanceName), {
-      name: instanceName,
-      ami,
-      instanceType:
-        instance.instanceType ?? appConfig.instanceType ?? defaults.instanceType ?? "t3.micro",
-      subnetId,
-      securityGroupIds: securityGroups,
-      keyName: instance.keyName ?? appConfig.keyName ?? keyName ?? undefined,
-      iamInstanceProfile: instance.iamInstanceProfile ?? iamInstanceProfile ?? undefined,
-      userData: userData ?? undefined,
-      rootVolumeSize:
-        instance.rootVolumeSize ??
-        appConfig.rootVolumeSize ??
-        defaults.rootVolumeSize ??
-        undefined,
-      associatePublicIp,
-      tags: instanceTags,
-    });
-
-    appInstanceIds.push(resource.instanceId);
-    instanceIds[instanceName] = resource.instanceId;
-    if (resource.publicIp) publicIps[instanceName] = resource.publicIp;
-    if (resource.privateIp) privateIps[instanceName] = resource.privateIp;
-    if (resource.publicDns) publicDns[instanceName] = resource.publicDns;
-
-    const machineMeta = mergeMachineMeta(defaults.machine, appConfig.machine, instance.machine);
-    const host = resource.publicDns ?? resource.publicIp ?? resource.privateIp ?? null;
-
-    machines[instanceName] = {
-      id: resource.instanceId,
-      name: instanceName,
-      host,
-      ssh: {
-        user: machineMeta.ssh?.user ?? "root",
-        port: machineMeta.ssh?.port ?? 22,
-        keyPath: machineMeta.ssh?.keyPath ?? null,
-      },
-      tags: machineMeta.tags ?? [],
-      roles: machineMeta.roles ?? [],
-      targetEnv: machineMeta.targetEnv ?? null,
-      arch: machineMeta.arch ?? null,
-      provider: "aws-ec2",
-      publicIp: resource.PublicIp ?? null,
-      privateIp: resource.PrivateIp ?? null,
-      labels: instanceTags,
-      metadata: {
-        subnetId,
-        instanceType:
-          instance.instanceType ?? appConfig.instanceType ?? defaults.instanceType ?? "t3.micro",
-      },
-    };
-
-    index += 1;
-  }
-
-  // ---------------------------------------------------------------------------
-  // ALB + target group + listeners + host rules
-  // ---------------------------------------------------------------------------
-  if (appAlb?.enable && appInstanceIds.length > 0) {
-    const tgPort = appAlb.targetGroup?.port ?? 80;
-    const tgProtocol = appAlb.targetGroup?.protocol ?? "HTTP";
-    const tgHealthCheck = appAlb.targetGroup?.healthCheck ?? {};
-
-    const tgName = sanitizeAwsName(`${appName}-tg`);
-    const tg = await AWS.ElasticLoadBalancingV2.TargetGroup(infra.id(`${appName}-tg`), {
-      Name: tgName,
-      Port: tgPort,
-      Protocol: tgProtocol,
-      VpcId: vpcId,
-      HealthCheckEnabled: tgHealthCheck.enabled ?? true,
-      HealthCheckProtocol: tgHealthCheck.protocol ?? "HTTP",
-      HealthCheckPort: tgHealthCheck.port ?? undefined,
-      HealthCheckPath: tgHealthCheck.path ?? "/",
-      HealthCheckIntervalSeconds: tgHealthCheck.interval ?? 30,
-      HealthCheckTimeoutSeconds: tgHealthCheck.timeout ?? 10,
-      HealthyThresholdCount: tgHealthCheck.healthyThreshold ?? 2,
-      UnhealthyThresholdCount: tgHealthCheck.unhealthyThreshold ?? 3,
-      Matcher: tgHealthCheck.matcher ? { HttpCode: tgHealthCheck.matcher } : undefined,
-      Targets: buildAlbTargets(appInstanceIds, tgPort),
-      Tags: toAwsTags(mergeTags(defaults.tags, appConfig.tags)),
-      adopt: true,
-    });
-
-    let httpListenerArn: string | undefined;
-    let httpsListenerArn: string | undefined;
-
-    if (appAlb.create !== false) {
-      // Create ALB + ALB SG
-      const albSgName = appAlb.name
-        ? `${appAlb.name}-alb-sg`
-        : `${appName}-alb-sg`;
-      const albIngressRules: RuleConfig[] = [
-        {
-          fromPort: 80,
-          toPort: 80,
-          protocol: "tcp",
-          cidrBlocks: ["0.0.0.0/0"],
-          ipv6CidrBlocks: ["::/0"],
-          description: "HTTP",
-        },
-        {
-          fromPort: 443,
-          toPort: 443,
-          protocol: "tcp",
-          cidrBlocks: ["0.0.0.0/0"],
-          ipv6CidrBlocks: ["::/0"],
-          description: "HTTPS",
-        },
-      ];
-      const albEgressRules: RuleConfig[] = [
-        {
-          fromPort: 0,
-          toPort: 0,
-          protocol: "-1",
-          cidrBlocks: ["0.0.0.0/0"],
-          ipv6CidrBlocks: ["::/0"],
-        },
-      ];
-      const albSg = await SecurityGroup(infra.id(`${appName}-alb-sg`), {
-        name: albSgName,
-        description: `ALB security group for ${appName}`,
-        vpcId,
-        ingress: albIngressRules,
-        egress: albEgressRules,
-        tags: mergeTags(defaults.tags, appConfig.tags, { Name: albSgName }),
-      });
-
-      const albName = sanitizeAwsName(appAlb.name ?? `${appName}-alb`);
-      const alb = await AWS.ElasticLoadBalancingV2.LoadBalancer(infra.id(`${appName}-alb`), {
-        Name: albName,
-        Subnets: pickList(appAlb.subnetIds, subnetIds),
-        SecurityGroups: pickList(appAlb.securityGroupIds, [albSg.groupId]),
-        Scheme: appAlb.scheme ?? "internet-facing",
-        IpAddressType: appAlb.ipAddressType ?? "ipv4",
-        Type: "application",
-        Tags: toAwsTags(mergeTags(defaults.tags, appConfig.tags)),
-        adopt: true,
-      });
-
-      if (appAlb.http !== false) {
-        const httpListener = await AWS.ElasticLoadBalancingV2.Listener(
-          infra.id(`${appName}-http`),
-          {
-            LoadBalancerArn: alb.LoadBalancerArn,
-            Port: 80,
-            Protocol: "HTTP",
-            DefaultActions: [{ Type: "forward", TargetGroupArn: tg.TargetGroupArn }],
-            adopt: true,
-          },
-        );
-        httpListenerArn = httpListener.ListenerArn;
-      }
-
-      if (appAlb.https && appAlb.certificateArn) {
-        const httpsListener = await AWS.ElasticLoadBalancingV2.Listener(
-          infra.id(`${appName}-https`),
-          {
-            LoadBalancerArn: alb.LoadBalancerArn,
-            Port: 443,
-            Protocol: "HTTPS",
-            SslPolicy: appAlb.sslPolicy ?? "ELBSecurityPolicy-TLS13-1-2-2021-06",
-            Certificates: [{ CertificateArn: appAlb.certificateArn }],
-            DefaultActions: [{ Type: "forward", TargetGroupArn: tg.TargetGroupArn }],
-            adopt: true,
-          },
-        );
-        httpsListenerArn = httpsListener.ListenerArn;
-      }
-
-      albOutputs[appName] = {
-        albArn: alb.LoadBalancerArn,
-        albDnsName: alb.DNSName,
-        albZoneId: alb.CanonicalHostedZoneID,
-        targetGroupArn: tg.TargetGroupArn,
-        httpListenerArn: httpListenerArn ?? null,
-        httpsListenerArn: httpsListenerArn ?? null,
-      };
-    } else {
-      // Use existing shared listeners
-      httpListenerArn = appAlb.existingListenerHttpArn ?? undefined;
-      httpsListenerArn = appAlb.existingListenerHttpsArn ?? undefined;
-
-      albOutputs[appName] = {
-        targetGroupArn: tg.TargetGroupArn,
-        httpListenerArn: httpListenerArn ?? null,
-        httpsListenerArn: httpsListenerArn ?? null,
-      };
-    }
-
-    // Host-based routing rules
-    const hostnames = appAlb.hostnames ?? [];
-    if (hostnames.length > 0) {
-      const listenerArn = httpsListenerArn ?? httpListenerArn;
-      if (listenerArn) {
-        const priority = appAlb.hostRulePriority ?? 100;
-        await AWS.ElasticLoadBalancingV2.ListenerRule(
-          infra.id(`${appName}-host-rule`),
-          {
-            ListenerArn: listenerArn,
-            Priority: priority,
-            Conditions: [
-              {
-                Field: "host-header",
-                HostHeaderConfig: {
-                  Values: hostnames,
-                },
-              },
-            ],
-            Actions: [{ Type: "forward", TargetGroupArn: tg.TargetGroupArn }],
-            adopt: true,
-          },
-        );
-      }
-    }
-  }
-}
-
-// =============================================================================
-// Export
-// =============================================================================
-
-export default {
-  instanceIds: JSON.stringify(instanceIds),
-  publicIps: JSON.stringify(publicIps),
-  privateIps: JSON.stringify(privateIps),
-  publicDns: JSON.stringify(publicDns),
-  machines: JSON.stringify(machines),
-  albOutputs: JSON.stringify(albOutputs),
-  ecrOutputs: JSON.stringify(ecrOutputs),
-  ssmOutputs: JSON.stringify(ssmOutputs),
-};
diff --git a/packages/infra/modules/aws-ec2-deploy.ts b/packages/infra/modules/aws-ec2-deploy.ts
deleted file mode 100644
index 3bfdcfb8..00000000
--- a/packages/infra/modules/aws-ec2-deploy.ts
+++ /dev/null
@@ -1,497 +0,0 @@
-import { isSecret, type Secret } from "alchemy";
-import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-import {
-  InternetGateway,
-  InternetGatewayAttachment,
-  Role,
-  Route,
-  RouteTable,
-  RouteTableAssociation,
-  SecurityGroup,
-  SecurityGroupRule,
-  SSMParameter,
-  Subnet,
-  Vpc,
-} from "alchemy/aws";
-import AWS from "alchemy/aws/control";
-
-const DEFAULT_IMAGE_ID =
-  "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}";
-
-type EnvironmentValue = string | Secret<string>;
-
-export interface Ec2ServerProps {
-  appName: string;
-  parameterPath: string;
-  artifactBucket: string;
-  artifactKey: string;
-  artifactVersion?: string;
-  environment: Record<string, EnvironmentValue>;
-  region?: string;
-  availabilityZone?: string | null;
-  imageId?: string | null;
-  instanceType?: string | null;
-  keyName?: string | null;
-  port?: number | null;
-  httpCidrBlocks?: string[];
-  sshCidrBlocks?: string[];
-  vpcCidrBlock?: string | null;
-  subnetCidrBlock?: string | null;
-  rootVolumeSize?: number | null;
-  tags?: Record<string, string>;
-}
-
-export interface Ec2Server extends Ec2ServerProps {
-  instanceId: string;
-  publicIp: string;
-  publicDnsName: string;
-  url: string;
-  vpcId: string;
-  subnetId: string;
-  securityGroupId: string;
-  roleArn: string;
-  instanceProfileArn: string;
-}
-
-export interface RuntimeLayout {
-  slug: string;
-  serviceName: string;
-  appRoot: string;
-  releaseRoot: string;
-  envFile: string;
-  archivePath: string;
-}
-
-export function deriveRuntimeLayout(appName: string): RuntimeLayout {
-  const slug = sanitizeName(appName);
-  const baseName = `stackpanel-${slug}`;
-
-  return {
-    slug,
-    serviceName: `${baseName}.service`,
-    appRoot: `/opt/${baseName}`,
-    releaseRoot: `/opt/${baseName}/release`,
-    envFile: `/etc/${baseName}.env`,
-    archivePath: `/tmp/${baseName}-release.tar.gz`,
-  };
-}
-
-export async function Ec2Server(
-  id: string,
-  props: Ec2ServerProps,
-): Promise<Ec2Server> {
-  const region = props.region ?? "us-west-2";
-  const availabilityZone = props.availabilityZone ?? `${region}a`;
-  const imageId = await resolveImageId(props.imageId ?? DEFAULT_IMAGE_ID, region);
-  const instanceType = props.instanceType ?? "t3.small";
-  const port = props.port ?? 80;
-  const httpCidrBlocks = props.httpCidrBlocks ?? ["0.0.0.0/0"];
-  const sshCidrBlocks = props.sshCidrBlocks ?? [];
-  const vpcCidrBlock = props.vpcCidrBlock ?? "10.42.0.0/16";
-  const subnetCidrBlock = props.subnetCidrBlock ?? "10.42.1.0/24";
-  const rootVolumeSize = props.rootVolumeSize ?? 20;
-  const namePrefix = props.tags?.Stage ? `${id}-${props.tags.Stage}` : id;
-  const layout = deriveRuntimeLayout(props.appName);
-  const tags = {
-    Name: id,
-    ManagedBy: "alchemy",
-    Service: props.appName,
-    ...props.tags,
-  };
-
-  const role = await Role(`${id}-instance-role`, {
-    roleName: `${namePrefix}-instance-role`,
-    assumeRolePolicy: {
-      Version: "2012-10-17",
-      Statement: [
-        {
-          Effect: "Allow",
-          Principal: {
-            Service: "ec2.amazonaws.com",
-          },
-          Action: "sts:AssumeRole",
-        },
-      ],
-    },
-    description: `Allows the EC2 instance for ${props.appName} to read boot-time config and artifacts.`,
-    managedPolicyArns: [
-      "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
-    ],
-    policies: [
-      {
-        policyName: `${id}-read-config`,
-        policyDocument: {
-          Version: "2012-10-17",
-          Statement: [
-            {
-              Effect: "Allow",
-              Action: [
-                "ssm:GetParameter",
-                "ssm:GetParameters",
-                "ssm:GetParametersByPath",
-              ],
-              Resource: [
-                `arn:aws:ssm:${region}:*:parameter${props.parameterPath}`,
-                `arn:aws:ssm:${region}:*:parameter${props.parameterPath}/*`,
-              ],
-            },
-            {
-              Effect: "Allow",
-              Action: ["s3:GetBucketLocation", "s3:ListBucket"],
-              Resource: [`arn:aws:s3:::${props.artifactBucket}`],
-              Condition: {
-                StringLike: {
-                  "s3:prefix": [props.artifactKey],
-                },
-              },
-            },
-            {
-              Effect: "Allow",
-              Action: ["s3:GetObject"],
-              Resource: [
-                `arn:aws:s3:::${props.artifactBucket}/${props.artifactKey}`,
-              ],
-            },
-            {
-              Effect: "Allow",
-              Action: ["kms:Decrypt"],
-              Resource: "*",
-            },
-          ],
-        },
-      },
-    ],
-    tags,
-  });
-
-  const instanceProfileName = `${namePrefix}-instance-profile`;
-  const instanceProfile = await AWS.IAM.InstanceProfile(
-    `${id}-instance-profile`,
-    {
-      InstanceProfileName: instanceProfileName,
-      Roles: [role.roleName],
-    },
-  );
-
-  await Promise.all(
-    Object.entries(props.environment).map(([key, value]) => {
-      const name = `${trimTrailingSlash(props.parameterPath)}/${key}`;
-
-      if (isSecret(value)) {
-        return SSMParameter(`${id}-env-${key.toLowerCase()}`, {
-          name,
-          description: `Runtime configuration for ${props.appName}: ${key}`,
-          type: "SecureString",
-          value,
-          tags,
-        });
-      }
-
-      return SSMParameter(`${id}-env-${key.toLowerCase()}`, {
-        name,
-        description: `Runtime configuration for ${props.appName}: ${key}`,
-        value,
-        tags,
-      });
-    }),
-  );
-
-  const vpc = await Vpc(`${id}-vpc`, {
-    cidrBlock: vpcCidrBlock,
-    enableDnsSupport: true,
-    enableDnsHostnames: true,
-    region,
-    tags,
-  });
-
-  const internetGateway = await InternetGateway(`${id}-igw`, {
-    region,
-    tags,
-  });
-
-  await InternetGatewayAttachment(`${id}-igw-attachment`, {
-    internetGateway,
-    vpc,
-    region,
-  });
-
-  const routeTable = await RouteTable(`${id}-public-rt`, {
-    vpc,
-    region,
-    tags,
-  });
-
-  await Route(`${id}-default-route`, {
-    routeTable,
-    region,
-    destinationCidrBlock: "0.0.0.0/0",
-    target: {
-      internetGateway,
-    },
-  });
-
-  const subnet = await Subnet(`${id}-public-subnet`, {
-    vpc,
-    region,
-    cidrBlock: subnetCidrBlock,
-    availabilityZone,
-    mapPublicIpOnLaunch: true,
-    tags,
-  });
-
-  await RouteTableAssociation(`${id}-public-association`, {
-    routeTable,
-    subnet,
-  });
-
-  const securityGroup = await SecurityGroup(`${id}-sg`, {
-    vpc,
-    region,
-    description: `Ingress rules for ${props.appName}`,
-    tags,
-  });
-
-  await Promise.all(
-    httpCidrBlocks.map((cidr, index) =>
-      SecurityGroupRule(`${id}-http-${index}`, {
-        securityGroup,
-        type: "ingress",
-        protocol: "tcp",
-        fromPort: port,
-        toPort: port,
-        cidrBlocks: [cidr],
-        description: `Allow HTTP traffic on port ${port}`,
-      }),
-    ),
-  );
-
-  if (props.keyName && sshCidrBlocks.length > 0) {
-    await Promise.all(
-      sshCidrBlocks.map((cidr, index) =>
-        SecurityGroupRule(`${id}-ssh-${index}`, {
-          securityGroup,
-          type: "ingress",
-          protocol: "tcp",
-          fromPort: 22,
-          toPort: 22,
-          cidrBlocks: [cidr],
-          description: "Allow SSH access",
-        }),
-      ),
-    );
-  }
-
-  const instance = await AWS.EC2.Instance(id, {
-    AvailabilityZone: availabilityZone,
-    IamInstanceProfile: instanceProfileName,
-    ImageId: imageId,
-    InstanceType: instanceType,
-    KeyName: props.keyName ?? undefined,
-    MetadataOptions: {
-      HttpEndpoint: "enabled",
-      HttpTokens: "required",
-    },
-    PropagateTagsToVolumeOnCreation: true,
-    SecurityGroupIds: [securityGroup.groupId],
-    SubnetId: subnet.subnetId,
-    Tags: toAwsTags(tags),
-    UserData: Buffer.from(
-      buildUserData({
-        appName: props.appName,
-        artifactBucket: props.artifactBucket,
-        artifactKey: props.artifactKey,
-        artifactVersion: props.artifactVersion,
-        layout,
-        parameterPath: props.parameterPath,
-        port,
-        region,
-      }),
-      "utf8",
-    ).toString("base64"),
-    BlockDeviceMappings: [
-      {
-        DeviceName: "/dev/xvda",
-        Ebs: {
-          DeleteOnTermination: true,
-          VolumeSize: rootVolumeSize,
-          VolumeType: "gp3",
-        },
-      },
-    ],
-  });
-
-  const host = instance.PublicDnsName || instance.PublicIp;
-  const url = `http://${host}${port === 80 ? "" : `:${port}`}`;
-
-  return {
-    ...props,
-    availabilityZone,
-    imageId,
-    instanceType,
-    port,
-    rootVolumeSize,
-    publicIp: instance.PublicIp,
-    instanceId: instance.InstanceId,
-    publicDnsName: instance.PublicDnsName,
-    url,
-    vpcId: vpc.vpcId,
-    subnetId: subnet.subnetId,
-    securityGroupId: securityGroup.groupId,
-    roleArn: role.arn,
-    instanceProfileArn: instanceProfile.Arn,
-  };
-}
-
-export function buildUserData({
-  appName,
-  artifactBucket,
-  artifactKey,
-  artifactVersion,
-  layout = deriveRuntimeLayout(appName),
-  parameterPath,
-  port,
-  region,
-}: {
-  appName: string;
-  artifactBucket: string;
-  artifactKey: string;
-  artifactVersion?: string;
-  layout?: RuntimeLayout;
-  parameterPath: string;
-  port: number;
-  region: string;
-  rootVolumeSize?: number | null;
-}) {
-  return `#!/bin/bash
-set -euxo pipefail
-
-export HOME=/root
-export PATH=/usr/local/bin:/usr/bin:/bin
-
-dnf update -y
-dnf install -y jq unzip nodejs
-
-curl -fsSL https://bun.sh/install | bash
-export BUN_INSTALL=/root/.bun
-export PATH=$BUN_INSTALL/bin:$PATH
-
-cat >/usr/local/bin/${layout.slug}-bootstrap <<'EOF'
-#!/bin/bash
-set -euo pipefail
-
-export HOME=/root
-export PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
-export AWS_REGION=${shellString(region)}
-
-ARTIFACT_BUCKET=${shellString(artifactBucket)}
-ARTIFACT_KEY=${shellString(artifactKey)}
-ARTIFACT_VERSION=${shellString(artifactVersion ?? "unknown")}
-PARAMETER_PATH=${shellString(trimTrailingSlash(parameterPath))}
-APP_ROOT=${shellString(layout.appRoot)}
-RELEASE_ROOT=${shellString(layout.releaseRoot)}
-ENV_FILE=${shellString(layout.envFile)}
-ARCHIVE_PATH=${shellString(layout.archivePath)}
-
-rm -rf "$RELEASE_ROOT"
-mkdir -p "$RELEASE_ROOT"
-
-aws s3 cp "s3://$ARTIFACT_BUCKET/$ARTIFACT_KEY" "$ARCHIVE_PATH" --region "$AWS_REGION"
-tar -xzf "$ARCHIVE_PATH" -C "$RELEASE_ROOT"
-
-cat >"$ENV_FILE" <<ENVEOF
-NODE_ENV=production
-HOST=0.0.0.0
-PORT=${port}
-ARTIFACT_BUCKET=$ARTIFACT_BUCKET
-ARTIFACT_KEY=$ARTIFACT_KEY
-ARTIFACT_VERSION=$ARTIFACT_VERSION
-ENVEOF
-
-aws ssm get-parameters-by-path \\
-  --path "$PARAMETER_PATH" \\
-  --recursive \\
-  --with-decryption \\
-  --output json \\
-  --region "$AWS_REGION" \\
-| jq -r '.Parameters[] | "\\(.Name | split("/")[-1])=\\(.Value)"' >>"$ENV_FILE"
-EOF
-
-chmod +x /usr/local/bin/${layout.slug}-bootstrap
-/usr/local/bin/${layout.slug}-bootstrap
-
-cat >/etc/systemd/system/${layout.serviceName} <<'EOF'
-[Unit]
-Description=stackpanel ${appName}
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=${layout.releaseRoot}
-Environment=PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
-EnvironmentFile=${layout.envFile}
-ExecStart=/usr/bin/node ${layout.releaseRoot}/.output/server/index.mjs
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl daemon-reload
-systemctl enable --now ${layout.serviceName}
-`;
-}
-
-async function resolveImageId(imageId: string, region: string) {
-  if (imageId.startsWith("ami-")) {
-    return imageId;
-  }
-
-  const match = imageId.match(/^\{\{resolve:ssm:([^}:]+)(?::\d+)?\}\}$/);
-  if (!match) {
-    return imageId;
-  }
-
-  const parameterName = match[1];
-  const client = new SSMClient({ region });
-  const response = await client.send(
-    new GetParameterCommand({
-      Name: parameterName,
-    }),
-  );
-  const resolvedImageId = response.Parameter?.Value;
-
-  if (!resolvedImageId?.startsWith("ami-")) {
-    throw new Error(
-      `Resolved AMI from SSM parameter ${parameterName} was not a valid EC2 image id.`,
-    );
-  }
-
-  return resolvedImageId;
-}
-
-function toAwsTags(tags: Record<string, string>) {
-  return Object.entries(tags).map(([Key, Value]) => ({
-    Key,
-    Value,
-  }));
-}
-
-function trimTrailingSlash(value: string) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-
-function shellString(value: string) {
-  return JSON.stringify(value);
-}
-
-function sanitizeName(value: string) {
-  const sanitized = value
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-
-  return sanitized || "app";
-}
diff --git a/packages/infra/modules/aws-secrets.ts b/packages/infra/modules/aws-secrets.ts
deleted file mode 100644
index 2f980329..00000000
--- a/packages/infra/modules/aws-secrets.ts
+++ /dev/null
@@ -1,249 +0,0 @@
-// ==============================================================================
-// AWS Secrets Infrastructure Module
-//
-// Provisions:
-//   - GitHub Actions / Fly.io OIDC provider
-//   - IAM role with OIDC trust policy
-//   - KMS key + alias for secrets encryption
-//   - KMS access policy attached to the role
-//
-// This is a stackpanel infra module. It uses the @stackpanel/infra library
-// for input resolution and output collection.
-// ==============================================================================
-import { Role } from "alchemy/aws";
-import AWS from "alchemy/aws/control";
-import { GitHubOIDCProvider } from "alchemy/aws/oidc";
-import { AccountId } from "alchemy/aws";
-import Infra from "@stackpanel/infra";
-
-const infra = new Infra("aws-secrets");
-const inputs = infra.inputs(process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES);
-
-// ============================================================================
-// IAM Role
-// ============================================================================
-
-const accountId = await AccountId();
-const oidcProviderUrl = "token.actions.githubusercontent.com";
-const oidcProviderArn = `arn:aws:iam::${accountId}:oidc-provider/${oidcProviderUrl}`;
-
-// Build assume role policy based on OIDC provider type
-let assumeRolePolicy: any;
-
-switch (inputs.oidc.provider) {
-	case "github-actions": {
-		const { org, repo } = inputs.oidc.githubActions;
-		assumeRolePolicy = {
-			Version: "2012-10-17" as const,
-			Statement: [
-				{
-					Effect: "Allow" as const,
-					Principal: {
-						Federated: oidcProviderArn,
-					},
-					Action: "sts:AssumeRoleWithWebIdentity",
-					Condition: {
-						StringEquals: {
-							[`${oidcProviderUrl}:aud`]: "sts.amazonaws.com",
-						},
-						StringLike: {
-							[`${oidcProviderUrl}:sub`]: `repo:${org}/${repo}:*`,
-						},
-					},
-				},
-			],
-		};
-		break;
-	}
-
-	case "flyio": {
-		const { orgId, appName } = inputs.oidc.flyio;
-		const flyOidcUrl = `oidc.fly.io/${orgId}`;
-		assumeRolePolicy = {
-			Version: "2012-10-17" as const,
-			Statement: [
-				{
-					Effect: "Allow" as const,
-					Principal: {
-						Federated: `arn:aws:iam::${accountId}:oidc-provider/${flyOidcUrl}`,
-					},
-					Action: "sts:AssumeRoleWithWebIdentity",
-					Condition: {
-						StringEquals: {
-							[`${flyOidcUrl}:aud`]: "sts.amazonaws.com",
-						},
-						StringLike: {
-							[`${flyOidcUrl}:sub`]: `${orgId}:${appName}:*`,
-						},
-					},
-				},
-			],
-		};
-		break;
-	}
-
-	case "roles-anywhere": {
-		assumeRolePolicy = {
-			Version: "2012-10-17" as const,
-			Statement: [
-				{
-					Effect: "Allow" as const,
-					Principal: {
-						Service: "rolesanywhere.amazonaws.com",
-					},
-					Action: [
-						"sts:AssumeRole",
-						"sts:TagSession",
-						"sts:SetSourceIdentity",
-					],
-					Condition: {
-						ArnEquals: {
-							"aws:SourceArn":
-								inputs.oidc.rolesAnywhere.trustAnchorArn,
-						},
-					},
-				},
-			],
-		};
-		break;
-	}
-
-	default: {
-		// No OIDC — basic role with no trust policy
-		assumeRolePolicy = {
-			Version: "2012-10-17" as const,
-			Statement: [],
-		};
-	}
-}
-
-const role = await Role(infra.id("role"), {
-	roleName: inputs.iam.roleName,
-	assumeRolePolicy,
-	description: `IAM role for ${inputs.projectName} secrets access`,
-	tags: {
-		Project: inputs.projectName,
-		ManagedBy: "stackpanel-infra",
-	},
-	managedPolicyArns: inputs.iam.additionalPolicies ?? [],
-});
-
-// ============================================================================
-// GitHub OIDC Provider (only for github-actions provider)
-// ============================================================================
-let resolvedOidcProviderArn = oidcProviderArn;
-
-if (inputs.oidc.provider === "github-actions") {
-	const oidcProvider = await GitHubOIDCProvider(infra.id("oidc"), {
-		owner: inputs.oidc.githubActions.org,
-		repository: inputs.oidc.githubActions.repo,
-		roleArn: role.arn,
-	});
-	resolvedOidcProviderArn = oidcProvider.providerArn;
-}
-
-// ============================================================================
-// KMS Key + Alias
-// ============================================================================
-
-const kmsKeyPolicy = JSON.stringify({
-	Version: "2012-10-17",
-	Statement: [
-		// Root account gets full access
-		{
-			Effect: "Allow",
-			Principal: {
-				AWS: `arn:aws:iam::${accountId}:root`,
-			},
-			Action: "kms:*",
-			Resource: "*",
-		},
-		// The secrets role gets encrypt/decrypt
-		{
-			Effect: "Allow",
-			Principal: {
-				AWS: role.arn,
-			},
-			Action: [
-				"kms:Decrypt",
-				"kms:Encrypt",
-				"kms:GenerateDataKey*",
-				"kms:DescribeKey",
-			],
-			Resource: "*",
-		},
-	],
-});
-
-const kmsKey = await AWS.KMS.Key(infra.id("kms-key"), {
-	Description: `KMS key for encrypting ${inputs.projectName} secrets`,
-	EnableKeyRotation: true,
-	PendingWindowInDays: inputs.kms.deletionWindowDays,
-	KeyPolicy: JSON.parse(kmsKeyPolicy),
-	Tags: Object.entries({
-		Name: inputs.kms.alias,
-		Project: inputs.projectName,
-		ManagedBy: "stackpanel-infra",
-	}).map(([Key, Value]) => ({ Key, Value })),
-	adopt: true,
-});
-
-const kmsAlias = await AWS.KMS.Alias(infra.id("kms-alias"), {
-	AliasName: `alias/${inputs.kms.alias}`,
-	TargetKeyId: kmsKey.KeyId,
-	adopt: true,
-});
-
-// Grant the role KMS permissions via inline policy
-await Role(infra.id("role"), {
-	roleName: inputs.iam.roleName,
-	assumeRolePolicy,
-	description: `IAM role for ${inputs.projectName} secrets access`,
-	tags: {
-		Project: inputs.projectName,
-		ManagedBy: "stackpanel-infra",
-	},
-	managedPolicyArns: inputs.iam.additionalPolicies ?? [],
-	policies: [
-		{
-			policyName: `${inputs.iam.roleName}-kms-policy`,
-			policyDocument: {
-				Version: "2012-10-17",
-				Statement: [
-					{
-						Effect: "Allow",
-						Action: [
-							"kms:Decrypt",
-							"kms:Encrypt",
-							"kms:GenerateDataKey*",
-							"kms:DescribeKey",
-						],
-						Resource: kmsKey.Arn,
-					},
-					{
-						Effect: "Allow",
-						Action: ["kms:Decrypt"],
-						Resource: "*",
-						Condition: {
-							StringLike: {
-								"kms:RequestAlias": `alias/${inputs.kms.alias}`,
-							},
-						},
-					},
-				],
-			},
-		},
-	],
-});
-
-// ============================================================================
-// Outputs
-// ============================================================================
-export default {
-	roleArn: role.arn,
-	roleName: role.roleName,
-	kmsKeyArn: kmsKey.Arn,
-	kmsKeyId: kmsKey.KeyId,
-	kmsAliasName: kmsAlias.AliasName,
-	oidcProviderArn: resolvedOidcProviderArn,
-};
diff --git a/packages/infra/modules/aws-secrets/index.ts b/packages/infra/modules/aws-secrets/index.ts
deleted file mode 100644
index 33519bf7..00000000
--- a/packages/infra/modules/aws-secrets/index.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { AccountId } from "alchemy/aws";
-import AWS from "alchemy/aws/control";
-import { GitHubOIDCProvider } from "alchemy/aws/oidc";
-import Infra from "@stackpanel/infra";
-import { IamRole } from "@stackpanel/infra/resources/iam-role";
-import {
-  buildAssumeRolePolicy,
-  buildKmsKeyPolicy,
-  buildRoleKmsInlinePolicy,
-  githubActionsProviderArn,
-} from "./policies";
-
-const infra = new Infra("aws-secrets");
-const inputs = infra.inputs(process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES);
-
-const accountId = await AccountId();
-const assumeRolePolicy = buildAssumeRolePolicy(inputs.oidc, accountId) as any;
-
-const roleTags = {
-  Project: inputs.projectName,
-  ManagedBy: "stackpanel-infra",
-};
-
-const rolePolicyName = `${inputs.iam.roleName}-kms-policy`;
-
-const role = await IamRole(infra.id("role"), {
-  roleName: inputs.iam.roleName,
-  assumeRolePolicy,
-  description: `IAM role for ${inputs.projectName} secrets access`,
-  tags: roleTags,
-  managedPolicyArns: inputs.iam.additionalPolicies ?? [],
-});
-
-let resolvedOidcProviderArn = githubActionsProviderArn(accountId);
-
-if (inputs.oidc.provider === "github-actions") {
-  const oidcProvider = await GitHubOIDCProvider(infra.id("oidc"), {
-    adopt: true,
-    owner: inputs.oidc.githubActions.org,
-    repository: inputs.oidc.githubActions.repo,
-    roleArn: role.arn,
-  } as any);
-  resolvedOidcProviderArn = oidcProvider.providerArn;
-}
-
-const kmsKey = await AWS.KMS.Key(infra.id("kms-key"), {
-  Description: `KMS key for encrypting ${inputs.projectName} secrets`,
-  EnableKeyRotation: true,
-  PendingWindowInDays: inputs.kms.deletionWindowDays,
-  KeyPolicy: JSON.parse(buildKmsKeyPolicy(accountId, role.arn)),
-  Tags: Object.entries({
-    Name: inputs.kms.alias,
-    ...roleTags,
-  }).map(([Key, Value]) => ({ Key, Value })),
-  adopt: true,
-});
-
-const kmsAlias = await AWS.KMS.Alias(infra.id("kms-alias"), {
-  AliasName: `alias/${inputs.kms.alias}`,
-  TargetKeyId: kmsKey.KeyId,
-  adopt: true,
-});
-
-await IamRole(infra.id("role"), {
-  roleName: inputs.iam.roleName,
-  assumeRolePolicy,
-  description: `IAM role for ${inputs.projectName} secrets access`,
-  tags: roleTags,
-  managedPolicyArns: inputs.iam.additionalPolicies ?? [],
-  policies: [
-    {
-      policyName: rolePolicyName,
-      ...buildRoleKmsInlinePolicy(inputs.kms.alias, kmsKey.Arn),
-    },
-  ],
-});
-
-export default {
-  roleArn: role.arn,
-  roleName: role.roleName,
-  kmsKeyArn: kmsKey.Arn,
-  kmsKeyId: kmsKey.KeyId,
-  kmsAliasName: kmsAlias.AliasName,
-  oidcProviderArn: resolvedOidcProviderArn,
-};
diff --git a/packages/infra/modules/aws-secrets/policies.ts b/packages/infra/modules/aws-secrets/policies.ts
deleted file mode 100644
index bc0a2091..00000000
--- a/packages/infra/modules/aws-secrets/policies.ts
+++ /dev/null
@@ -1,147 +0,0 @@
-const OIDC_PROVIDER_URL = "token.actions.githubusercontent.com";
-
-type OidcInputs = {
-  provider: "github-actions" | "flyio" | "roles-anywhere" | string;
-  githubActions: {
-    org: string;
-    repo: string;
-  };
-  flyio: {
-    orgId: string;
-    appName: string;
-  };
-  rolesAnywhere: {
-    trustAnchorArn: string;
-  };
-};
-
-export function githubActionsProviderArn(accountId: string): string {
-  return `arn:aws:iam::${accountId}:oidc-provider/${OIDC_PROVIDER_URL}`;
-}
-
-export function buildAssumeRolePolicy(inputs: OidcInputs, accountId: string): unknown {
-  switch (inputs.provider) {
-    case "github-actions": {
-      const { org, repo } = inputs.githubActions;
-      return {
-        Version: "2012-10-17" as const,
-        Statement: [
-          {
-            Effect: "Allow" as const,
-            Principal: {
-              Federated: githubActionsProviderArn(accountId),
-            },
-            Action: "sts:AssumeRoleWithWebIdentity",
-            Condition: {
-              StringEquals: {
-                [`${OIDC_PROVIDER_URL}:aud`]: "sts.amazonaws.com",
-              },
-              StringLike: {
-                [`${OIDC_PROVIDER_URL}:sub`]: `repo:${org}/${repo}:*`,
-              },
-            },
-          },
-        ],
-      };
-    }
-
-    case "flyio": {
-      const { orgId, appName } = inputs.flyio;
-      const flyOidcUrl = `oidc.fly.io/${orgId}`;
-      return {
-        Version: "2012-10-17" as const,
-        Statement: [
-          {
-            Effect: "Allow" as const,
-            Principal: {
-              Federated: `arn:aws:iam::${accountId}:oidc-provider/${flyOidcUrl}`,
-            },
-            Action: "sts:AssumeRoleWithWebIdentity",
-            Condition: {
-              StringEquals: {
-                [`${flyOidcUrl}:aud`]: "sts.amazonaws.com",
-              },
-              StringLike: {
-                [`${flyOidcUrl}:sub`]: `${orgId}:${appName}:*`,
-              },
-            },
-          },
-        ],
-      };
-    }
-
-    case "roles-anywhere":
-      return {
-        Version: "2012-10-17" as const,
-        Statement: [
-          {
-            Effect: "Allow" as const,
-            Principal: {
-              Service: "rolesanywhere.amazonaws.com",
-            },
-            Action: ["sts:AssumeRole", "sts:TagSession", "sts:SetSourceIdentity"],
-            Condition: {
-              ArnEquals: {
-                "aws:SourceArn": inputs.rolesAnywhere.trustAnchorArn,
-              },
-            },
-          },
-        ],
-      };
-
-    default:
-      return {
-        Version: "2012-10-17" as const,
-        Statement: [],
-      };
-  }
-}
-
-export function buildKmsKeyPolicy(accountId: string, roleArn: string): string {
-  return JSON.stringify({
-    Version: "2012-10-17",
-    Statement: [
-      {
-        Effect: "Allow",
-        Principal: {
-          AWS: `arn:aws:iam::${accountId}:root`,
-        },
-        Action: "kms:*",
-        Resource: "*",
-      },
-      {
-        Effect: "Allow",
-        Principal: {
-          AWS: roleArn,
-        },
-        Action: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey*", "kms:DescribeKey"],
-        Resource: "*",
-      },
-    ],
-  });
-}
-
-export function buildRoleKmsInlinePolicy(alias: string, keyArn: string): { policyDocument: unknown } {
-  return {
-    policyDocument: {
-      Version: "2012-10-17",
-      Statement: [
-        {
-          Effect: "Allow",
-          Action: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey*", "kms:DescribeKey"],
-          Resource: keyArn,
-        },
-        {
-          Effect: "Allow",
-          Action: ["kms:Decrypt"],
-          Resource: "*",
-          Condition: {
-            StringLike: {
-              "kms:RequestAlias": `alias/${alias}`,
-            },
-          },
-        },
-      ],
-    },
-  };
-}
diff --git a/packages/infra/modules/database.ts b/packages/infra/modules/database.ts
deleted file mode 100644
index 48a30614..00000000
--- a/packages/infra/modules/database.ts
+++ /dev/null
@@ -1,229 +0,0 @@
-// ==============================================================================
-// Database Infrastructure Module
-//
-// Provisions the appropriate database backend based on environment:
-//   - Neon Postgres (production / CI)
-//   - Devenv Postgres (local development with Nix)
-//   - Docker Postgres (local development fallback)
-//
-// Inputs (from Nix via infra-inputs.json):
-//   projectName: string
-//   name: string (database name)
-//   provider: "auto" | "neon" | "devenv" | "docker"
-//   neon: { region, pgVersion, apiKeySsmPath, enable-branching }
-//   devenv: { database, user, password, host, port }
-//   docker: { image, tag, user, password, port, network }
-//   ssm: { enable, pathPrefix }
-//
-// Outputs:
-//   { databaseUrl: string, provider: string }
-// ==============================================================================
-import alchemy, { Resource } from "alchemy";
-import type { Context } from "alchemy";
-import { SSMParameter } from "alchemy/aws";
-import { NeonBranch, NeonProject } from "alchemy/neon";
-import * as docker from "alchemy/docker";
-import Infra from "@stackpanel/infra";
-
-// Try to import helpers from @gen/alchemy, fall back to inline
-let getSSMSecret: (name: string) => Promise<string>;
-try {
-  const helpers = await import("@gen/alchemy/helpers");
-  getSSMSecret = helpers.getSSMSecret;
-} catch {
-  // Fallback: inline SSM helper
-  getSSMSecret = async (name: string): Promise<string> => {
-    const { SSMClient, GetParameterCommand } = await import(
-      "@aws-sdk/client-ssm"
-    );
-    const client = new SSMClient({});
-    const response = await client.send(
-      new GetParameterCommand({ Name: name, WithDecryption: true }),
-    );
-    if (!response.Parameter?.Value) {
-      throw new Error(`SSM Parameter ${name} not found or empty`);
-    }
-    return response.Parameter.Value;
-  };
-}
-
-// ============================================================================
-// Custom Resource: Devenv Postgres (read-only reference to devenv service)
-// ============================================================================
-interface DevenvPostgresProps {
-  database: string;
-  user: string;
-  password: string;
-  port?: number;
-  host?: string;
-}
-
-interface DevenvPostgres extends DevenvPostgresProps {
-  connectionUrl: string;
-}
-
-const DevenvPostgres = Resource(
-  "devenv::Postgres",
-  async function (
-    this: Context<DevenvPostgres>,
-    _id: string,
-    props: DevenvPostgresProps,
-  ): Promise<DevenvPostgres> {
-    if (this.phase === "delete") {
-      return this.destroy();
-    }
-    const host = props.host ?? "localhost";
-    const port = props.port ?? 5432;
-    const connectionUrl = `postgresql://${props.user}:${props.password}@${host}:${port}/${props.database}`;
-    return { ...props, host, port, connectionUrl };
-  },
-);
-
-// ============================================================================
-// Module setup
-// ============================================================================
-const infra = new Infra("database");
-const inputs = infra.inputs(process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES);
-
-const USE_DEVENV =
-  process.env.IN_NIX_SHELL === "impure" ||
-  process.env.DEVENV_ROOT !== undefined;
-const USE_DOCKER = !USE_DEVENV && process.env.USE_DOCKER === "true";
-const STAGE = process.env.STAGE || "dev";
-const IS_PREVIEW = STAGE !== "prod" && STAGE !== "dev";
-
-// Resolve provider
-let provider: string;
-if (inputs.provider === "auto") {
-  if (USE_DEVENV) provider = "devenv";
-  else if (USE_DOCKER) provider = "docker";
-  else provider = "neon";
-} else {
-  provider = inputs.provider;
-}
-
-// ============================================================================
-// Provision database based on resolved provider
-// ============================================================================
-let databaseUrl: string;
-
-switch (provider) {
-  case "devenv": {
-    const pg = await DevenvPostgres(infra.id("devenv-postgres"), {
-      database: inputs.devenv.database,
-      user: inputs.devenv.user,
-      password: inputs.devenv.password,
-      port: inputs.devenv.port,
-      host: inputs.devenv.host,
-    });
-    databaseUrl = pg.connectionUrl;
-    console.log(`[database] Using Devenv Postgres: ${databaseUrl}`);
-    break;
-  }
-
-  case "docker": {
-    const network = await docker.Network(infra.id("network"), {
-      name: inputs.docker.network,
-    });
-
-    const volume = await docker.Volume(infra.id("postgres-data"), {
-      name: `${inputs.name}_postgres_data`,
-      labels: [
-        { name: "app", value: inputs.projectName },
-        { name: "service", value: "postgres" },
-      ],
-    });
-
-    const image = await docker.RemoteImage(infra.id("postgres-image"), {
-      name: inputs.docker.image,
-      tag: inputs.docker.tag,
-    });
-
-    await docker.Container(infra.id("postgres-container"), {
-      name: `${inputs.projectName}-postgres`,
-      image: image.imageRef,
-      networks: [{ name: network.name }],
-      volumes: [
-        {
-          hostPath: volume.name,
-          containerPath: "/var/lib/postgresql/data",
-        },
-      ],
-      environment: {
-        POSTGRES_USER: inputs.docker.user,
-        POSTGRES_PASSWORD: inputs.docker.password,
-        POSTGRES_DB: inputs.name,
-      },
-      ports: [
-        {
-          internal: 5432,
-          external: inputs.docker.port,
-        },
-      ],
-      start: true,
-    });
-
-    databaseUrl = `postgresql://${inputs.docker.user}:${inputs.docker.password}@localhost:${inputs.docker.port}/${inputs.name}`;
-    console.log(`[database] Using Docker Postgres: ${databaseUrl}`);
-    break;
-  }
-
-  case "neon":
-  default: {
-    const neonApiKey = await getSSMSecret(inputs.neon.apiKeySsmPath);
-
-    const neonProject = await NeonProject(infra.id("neon-project"), {
-      name: inputs.name,
-      apiKey: alchemy.secret(neonApiKey),
-      region_id: inputs.neon.region,
-      pg_version: inputs.neon.pgVersion,
-    });
-
-    if (IS_PREVIEW && inputs.neon["enable-branching"]) {
-      // Create a separate branch for preview environments
-      const previewBranch = await NeonBranch(infra.id(`neon-branch-${STAGE}`), {
-        project: neonProject,
-        name: STAGE,
-        apiKey: alchemy.secret(neonApiKey),
-        endpoints: [{ type: "read_write" }],
-      });
-      const connUri = previewBranch.connectionUris[0];
-      if (!connUri) {
-        throw new Error(`No connection URI available for branch ${STAGE}`);
-      }
-      databaseUrl = connUri.connection_uri.unencrypted;
-      console.log(
-        `[database] Using Neon Preview Branch: ${previewBranch.name}`,
-      );
-    } else {
-      databaseUrl =
-        neonProject.connection_uris[0].connection_uri.unencrypted;
-      console.log(
-        `[database] Using Neon: ${neonProject.name} (branch: ${neonProject.branch.name})`,
-      );
-    }
-
-    // Optionally write to SSM
-    if (inputs.ssm.enable) {
-      await SSMParameter(infra.id("database-url-ssm"), {
-        name: `${inputs.ssm.pathPrefix}/${STAGE}/database-url`,
-        type: "SecureString",
-        value: alchemy.secret(databaseUrl),
-        description: `Database connection URL for ${inputs.projectName} ${STAGE}`,
-        tags: {
-          app: inputs.projectName,
-          stage: STAGE,
-        },
-      });
-    }
-    break;
-  }
-}
-
-// ============================================================================
-// Outputs
-// ============================================================================
-export default {
-  databaseUrl,
-  provider,
-};
diff --git a/packages/infra/modules/deployment-plan.ts b/packages/infra/modules/deployment-plan.ts
deleted file mode 100644
index af1dbc54..00000000
--- a/packages/infra/modules/deployment-plan.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-export interface AppInput {
-  framework: string;
-  host: string;
-  path: string;
-  bindings: string[];
-  secrets: string[];
-  aws?: {
-    region?: string | null;
-    availabilityZone?: string | null;
-    imageId?: string | null;
-    instanceType?: string | null;
-    keyName?: string | null;
-    port?: number | null;
-    parameterPath?: string | null;
-    httpCidrBlocks?: string[];
-    sshCidrBlocks?: string[];
-    rootVolumeSize?: number | null;
-    vpcCidrBlock?: string | null;
-    subnetCidrBlock?: string | null;
-    tags?: Record<string, string>;
-  };
-  cloudflare?: {
-    workerName?: string;
-    route?: string | null;
-    compatibility?: "node" | "browser";
-  };
-  ssr?: boolean;
-  assetsDir?: string;
-  entrypoint?: string;
-  output?: string;
-}
-
-export interface DeploymentInputs {
-  apps: Record<string, AppInput>;
-  aws?: {
-    region?: string | null;
-    instanceType?: string | null;
-    port?: number | null;
-    artifact?: {
-      bucket?: string | null;
-      keyPrefix?: string | null;
-    };
-  };
-  cloudflare?: {
-    compatibilityDate?: string | null;
-    defaultRoute?: string | null;
-  };
-}
-
-export type DeploymentPlan =
-  | {
-      kind: "cloudflare-nextjs-app";
-      appScopeName: string;
-      cwd: string;
-      resourceName: "website";
-    }
-  | {
-      kind: "cloudflare-app";
-      appScopeName: string;
-      cwd: string;
-      framework: string;
-      resourceName: string;
-    }
-  | {
-      kind: "aws-ec2-app";
-      appScopeName: string;
-      cwd: string;
-      resourceName: string;
-    };
-
-export function buildDeploymentPlan(
-  appName: string,
-  app: AppInput,
-): DeploymentPlan {
-  switch (app.host) {
-    case "cloudflare":
-      if (app.framework === "nextjs") {
-        return {
-          kind: "cloudflare-nextjs-app",
-          appScopeName: appName,
-          cwd: app.path,
-          resourceName: "website",
-        };
-      }
-
-      return {
-        kind: "cloudflare-app",
-        appScopeName: appName,
-        cwd: app.path,
-        framework: app.framework,
-        resourceName: appName,
-      };
-
-    case "aws":
-      return {
-        kind: "aws-ec2-app",
-        appScopeName: appName,
-        cwd: app.path,
-        resourceName: appName,
-      };
-
-    default:
-      throw new Error(
-        `Unsupported host "${app.host}" in deployment plan builder`,
-      );
-  }
-}
diff --git a/packages/infra/modules/deployment/artifact.test.ts b/packages/infra/modules/deployment/artifact.test.ts
deleted file mode 100644
index 4b932aeb..00000000
--- a/packages/infra/modules/deployment/artifact.test.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { resolveEc2ArtifactConfig } from "./artifact";
-
-describe("resolveEc2ArtifactConfig", () => {
-  test("does not require an artifact for nixos deploys", () => {
-    expect(
-      resolveEc2ArtifactConfig({
-        osType: "nixos",
-        stage: "staging",
-        env: {},
-        globalArtifact: {},
-      }),
-    ).toBeNull();
-  });
-
-  test("derives the artifact location for amazon-linux deploys", () => {
-    expect(
-      resolveEc2ArtifactConfig({
-        osType: "amazon-linux",
-        stage: "staging",
-        env: {
-          EC2_ARTIFACT_VERSION: "abc123",
-        },
-        globalArtifact: {
-          bucket: "stackpanel-artifacts",
-          keyPrefix: "web",
-        },
-      }),
-    ).toEqual({
-      artifactBucket: "stackpanel-artifacts",
-      artifactKey: "web/staging/abc123/release.tar.gz",
-      artifactVersion: "abc123",
-    });
-  });
-
-  test("still requires an artifact bucket for amazon-linux deploys", () => {
-    expect(() =>
-      resolveEc2ArtifactConfig({
-        osType: "amazon-linux",
-        stage: "staging",
-        env: {
-          EC2_ARTIFACT_VERSION: "abc123",
-        },
-        globalArtifact: {},
-      }),
-    ).toThrow(
-      "EC2_ARTIFACT_BUCKET is required unless stackpanel.deployment.aws.artifact.bucket is configured",
-    );
-  });
-});
diff --git a/packages/infra/modules/deployment/artifact.ts b/packages/infra/modules/deployment/artifact.ts
deleted file mode 100644
index f993fb80..00000000
--- a/packages/infra/modules/deployment/artifact.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-export interface Ec2ArtifactConfig {
-  artifactBucket: string;
-  artifactKey: string;
-  artifactVersion?: string;
-}
-
-export interface ResolveEc2ArtifactConfigInput {
-  osType: "amazon-linux" | "nixos";
-  stage: string;
-  env: Record<string, string | undefined>;
-  globalArtifact: {
-    bucket?: string | null;
-    keyPrefix?: string | null;
-  };
-}
-
-export function resolveEc2ArtifactConfig(
-  input: ResolveEc2ArtifactConfigInput,
-): Ec2ArtifactConfig | null {
-  if (input.osType === "nixos") {
-    return null;
-  }
-
-  const artifactVersion = input.env.EC2_ARTIFACT_VERSION;
-  const artifactBucket = input.env.EC2_ARTIFACT_BUCKET ?? input.globalArtifact.bucket;
-  const artifactKey = input.env.EC2_ARTIFACT_KEY
-    ?? (
-      artifactVersion
-        ? `${input.globalArtifact.keyPrefix ?? "web"}/${input.stage}/${artifactVersion}/release.tar.gz`
-        : undefined
-    );
-
-  if (!artifactBucket) {
-    throw new Error(
-      "EC2_ARTIFACT_BUCKET is required unless stackpanel.deployment.aws.artifact.bucket is configured",
-    );
-  }
-
-  if (!artifactKey) {
-    throw new Error(
-      "EC2_ARTIFACT_KEY is required unless EC2_ARTIFACT_VERSION and stackpanel.deployment.aws.artifact.keyPrefix are available",
-    );
-  }
-
-  return {
-    artifactBucket,
-    artifactKey,
-    artifactVersion,
-  };
-}
diff --git a/packages/infra/modules/deployment/aws-ec2-deploy.test.ts b/packages/infra/modules/deployment/aws-ec2-deploy.test.ts
deleted file mode 100644
index 1f3ad471..00000000
--- a/packages/infra/modules/deployment/aws-ec2-deploy.test.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import {
-  buildUserData,
-  deriveRuntimeLayout,
-} from "./aws-ec2-deploy";
-
-describe("deriveRuntimeLayout", () => {
-  test("derives runtime paths and service names from app name", () => {
-    expect(deriveRuntimeLayout("web")).toEqual({
-      appRoot: "/opt/stackpanel-web",
-      archivePath: "/tmp/stackpanel-web-release.tar.gz",
-      envFile: "/etc/stackpanel-web.env",
-      releaseRoot: "/opt/stackpanel-web/release",
-      serviceName: "stackpanel-web.service",
-      slug: "web",
-    });
-
-    expect(deriveRuntimeLayout("docs_site")).toEqual({
-      appRoot: "/opt/stackpanel-docs-site",
-      archivePath: "/tmp/stackpanel-docs-site-release.tar.gz",
-      envFile: "/etc/stackpanel-docs-site.env",
-      releaseRoot: "/opt/stackpanel-docs-site/release",
-      serviceName: "stackpanel-docs-site.service",
-      slug: "docs-site",
-    });
-  });
-});
-
-describe("buildUserData", () => {
-  test("uses the derived runtime layout instead of hard-coded web paths", () => {
-    const script = buildUserData({
-      appName: "docs_site",
-      artifactBucket: "bucket-name",
-      artifactKey: "docs/staging/release.tar.gz",
-      parameterPath: "/stackpanel/staging/docs-runtime",
-      port: 8080,
-      region: "us-west-2",
-      rootVolumeSize: 30,
-    });
-
-    expect(script).toContain('APP_ROOT="/opt/stackpanel-docs-site"');
-    expect(script).toContain('ENV_FILE="/etc/stackpanel-docs-site.env"');
-    expect(script).toContain('ARCHIVE_PATH="/tmp/stackpanel-docs-site-release.tar.gz"');
-    expect(script).toContain("/etc/systemd/system/stackpanel-docs-site.service");
-    expect(script).toContain("ExecStart=/usr/bin/node /opt/stackpanel-docs-site/release/.output/server/index.mjs");
-    expect(script).toContain("PORT=8080");
-  });
-});
diff --git a/packages/infra/modules/deployment/aws-ec2-deploy.ts b/packages/infra/modules/deployment/aws-ec2-deploy.ts
deleted file mode 100644
index 82cdb203..00000000
--- a/packages/infra/modules/deployment/aws-ec2-deploy.ts
+++ /dev/null
@@ -1,349 +0,0 @@
-// =============================================================================
-// aws-ec2-deploy.ts — Provision a self-contained EC2 app environment
-//
-// Creates a complete VPC-based deployment for a single app:
-//   VPC -> Subnet -> IGW -> Route -> Security Group -> IAM Role -> EC2 Instance
-//
-// The instance's user-data is generated by aws-ec2-userdata.ts, which
-// supports both Amazon Linux (tarball + node) and NixOS (static boot
-// for Colmena-based deploys).
-//
-// Runtime secrets are stored in SSM Parameter Store. The instance's IAM
-// role grants read access to the parameter path and the S3 artifact bucket.
-// =============================================================================
-import { isSecret, type Secret } from "alchemy";
-import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-import {
-  InternetGateway,
-  InternetGatewayAttachment,
-  Route,
-  RouteTable,
-  RouteTableAssociation,
-  SecurityGroup,
-  SecurityGroupRule,
-  SSMParameter,
-  Subnet,
-  Vpc,
-} from "alchemy/aws";
-import { Ec2Instance } from "@stackpanel/infra/resources/ec2-instance";
-import { IamInstanceProfile } from "@stackpanel/infra/resources/iam-instance-profile";
-import { IamRole } from "@stackpanel/infra/resources/iam-role";
-import { buildUserData, buildNixosUserData } from "./aws-ec2-userdata";
-
-// ---- Default AMI (Amazon Linux 2023, resolved at deploy time via SSM) -------
-const DEFAULT_IMAGE_ID =
-  "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}";
-
-// ---- Types ------------------------------------------------------------------
-
-type EnvironmentValue = string | Secret<string>;
-
-export interface Ec2ServerProps {
-  appName: string;
-  parameterPath: string;
-  artifactBucket: string;
-  artifactKey: string;
-  artifactVersion?: string;
-  environment: Record<string, EnvironmentValue>;
-  region?: string;
-  availabilityZone?: string | null;
-  imageId?: string | null;
-  instanceType?: string | null;
-  keyName?: string | null;
-  port?: number | null;
-  httpCidrBlocks?: string[];
-  sshCidrBlocks?: string[];
-  vpcCidrBlock?: string | null;
-  subnetCidrBlock?: string | null;
-  rootVolumeSize?: number | null;
-  tags?: Record<string, string>;
-  osType?: "amazon-linux" | "nixos";
-}
-
-export interface Ec2Server extends Ec2ServerProps {
-  instanceId: string;
-  publicIp: string;
-  publicDnsName: string;
-  url: string;
-  vpcId: string;
-  subnetId: string;
-  securityGroupId: string;
-  roleArn: string;
-  instanceProfileArn: string;
-}
-
-export interface RuntimeLayout {
-  slug: string;
-  serviceName: string;
-  appRoot: string;
-  releaseRoot: string;
-  envFile: string;
-  archivePath: string;
-}
-
-// ---- Layout derivation ------------------------------------------------------
-
-/** Standard filesystem layout for a deployed app on an EC2 instance. */
-export function deriveRuntimeLayout(appName: string): RuntimeLayout {
-  const slug = sanitizeName(appName);
-  const baseName = `stackpanel-${slug}`;
-
-  return {
-    slug,
-    serviceName: `${baseName}.service`,
-    appRoot: `/opt/${baseName}`,
-    releaseRoot: `/opt/${baseName}/release`,
-    envFile: `/etc/${baseName}.env`,
-    archivePath: `/tmp/${baseName}-release.tar.gz`,
-  };
-}
-
-// ---- Main provisioning function ---------------------------------------------
-
-export async function Ec2Server(
-  id: string,
-  props: Ec2ServerProps,
-): Promise<Ec2Server> {
-  const region = props.region ?? "us-west-2";
-  const availabilityZone = props.availabilityZone ?? `${region}a`;
-  const defaultImageId =
-    props.osType === "nixos"
-      ? await resolveNixosAmi(region)
-      : DEFAULT_IMAGE_ID;
-  const imageId = await resolveImageId(props.imageId ?? defaultImageId, region);
-  const instanceType = props.instanceType ?? "t3.small";
-  const port = props.port ?? 80;
-  const httpCidrBlocks = props.httpCidrBlocks ?? ["0.0.0.0/0"];
-  const sshCidrBlocks = props.sshCidrBlocks ?? [];
-  const vpcCidrBlock = props.vpcCidrBlock ?? "10.42.0.0/16";
-  const subnetCidrBlock = props.subnetCidrBlock ?? "10.42.1.0/24";
-  const rootVolumeSize = props.rootVolumeSize ?? 20;
-  const namePrefix = props.tags?.Stage ? `${id}-${props.tags.Stage}` : id;
-  const layout = deriveRuntimeLayout(props.appName);
-  const tags = {
-    Name: id,
-    ManagedBy: "alchemy",
-    Service: props.appName,
-    ...props.tags,
-  };
-
-  // -- IAM: role + instance profile -------------------------------------------
-
-  const role = await IamRole(`${id}-instance-role`, {
-    roleName: `${namePrefix}-instance-role`,
-    assumeRolePolicy: {
-      Version: "2012-10-17",
-      Statement: [{
-        Effect: "Allow",
-        Principal: { Service: "ec2.amazonaws.com" },
-        Action: "sts:AssumeRole",
-      }],
-    },
-    description: `Allows the EC2 instance for ${props.appName} to read boot-time config and artifacts.`,
-    managedPolicyArns: [
-      "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
-    ],
-    policies: [{
-      policyName: `${id}-read-config`,
-      policyDocument: {
-        Version: "2012-10-17",
-        Statement: [
-          {
-            Effect: "Allow",
-            Action: ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
-            Resource: [
-              `arn:aws:ssm:${region}:*:parameter${props.parameterPath}`,
-              `arn:aws:ssm:${region}:*:parameter${props.parameterPath}/*`,
-            ],
-          },
-          {
-            Effect: "Allow",
-            Action: ["s3:GetBucketLocation", "s3:ListBucket"],
-            Resource: [`arn:aws:s3:::${props.artifactBucket}`],
-            Condition: { StringLike: { "s3:prefix": [props.artifactKey] } },
-          },
-          {
-            Effect: "Allow",
-            Action: ["s3:GetObject"],
-            Resource: [`arn:aws:s3:::${props.artifactBucket}/${props.artifactKey}`],
-          },
-          {
-            Effect: "Allow",
-            Action: ["kms:Decrypt"],
-            Resource: "*",
-          },
-        ],
-      },
-    }],
-    tags,
-  });
-
-  const instanceProfileName = `${namePrefix}-instance-profile`;
-  const instanceProfile = await IamInstanceProfile(`${id}-instance-profile`, {
-    name: instanceProfileName,
-    roleName: role.roleName,
-    tags,
-  });
-
-  // -- SSM parameters (runtime environment) -----------------------------------
-
-  await Promise.all(
-    Object.entries(props.environment).map(([key, value]) => {
-      const name = `${trimTrailingSlash(props.parameterPath)}/${key}`;
-      return SSMParameter(`${id}-env-${key.toLowerCase()}`, {
-        name,
-        description: `Runtime configuration for ${props.appName}: ${key}`,
-        ...(isSecret(value) ? { type: "SecureString", value } : { value }),
-        tags,
-      });
-    }),
-  );
-
-  // -- VPC + networking -------------------------------------------------------
-
-  const vpc = await Vpc(`${id}-vpc`, {
-    cidrBlock: vpcCidrBlock, enableDnsSupport: true, enableDnsHostnames: true, region, tags,
-  });
-
-  const internetGateway = await InternetGateway(`${id}-igw`, { region, tags });
-
-  await InternetGatewayAttachment(`${id}-igw-attachment`, {
-    internetGateway, vpc, region,
-  });
-
-  const routeTable = await RouteTable(`${id}-public-rt`, { vpc, region, tags });
-
-  await Route(`${id}-default-route`, {
-    routeTable, region, destinationCidrBlock: "0.0.0.0/0",
-    target: { internetGateway },
-  });
-
-  const subnet = await Subnet(`${id}-public-subnet`, {
-    vpc, region, cidrBlock: subnetCidrBlock, availabilityZone,
-    mapPublicIpOnLaunch: true, tags,
-  });
-
-  await RouteTableAssociation(`${id}-public-association`, { routeTable, subnet });
-
-  // -- Security group + rules -------------------------------------------------
-
-  const securityGroup = await SecurityGroup(`${id}-sg`, {
-    vpc, region, description: `Ingress rules for ${props.appName}`, tags,
-  });
-
-  await Promise.all(
-    httpCidrBlocks.map((cidr, index) =>
-      SecurityGroupRule(`${id}-http-${index}`, {
-        securityGroup, type: "ingress", protocol: "tcp",
-        fromPort: port, toPort: port, cidrBlocks: [cidr],
-        description: `Allow HTTP traffic on port ${port}`,
-      }),
-    ),
-  );
-
-  if (props.keyName && sshCidrBlocks.length > 0) {
-    await Promise.all(
-      sshCidrBlocks.map((cidr, index) =>
-        SecurityGroupRule(`${id}-ssh-${index}`, {
-          securityGroup, type: "ingress", protocol: "tcp",
-          fromPort: 22, toPort: 22, cidrBlocks: [cidr],
-          description: "Allow SSH access",
-        }),
-      ),
-    );
-  }
-
-  // -- EC2 instance -----------------------------------------------------------
-
-  const userData =
-    props.osType === "nixos"
-      ? buildNixosUserData({ region, parameterPath: props.parameterPath })
-      : buildUserData({
-          appName: props.appName,
-          artifactBucket: props.artifactBucket,
-          artifactKey: props.artifactKey,
-          artifactVersion: props.artifactVersion,
-          layout,
-          parameterPath: props.parameterPath,
-          port,
-          region,
-        });
-
-  const instance = await Ec2Instance(id, {
-    name: id, ami: imageId, instanceType,
-    subnetId: subnet.subnetId, securityGroupIds: [securityGroup.groupId],
-    keyName: props.keyName ?? undefined, iamInstanceProfile: instanceProfileName,
-    userData, rootVolumeSize, associatePublicIp: true, tags,
-  });
-
-  const host = instance.publicDns || instance.publicIp;
-  const url = `http://${host}${port === 80 ? "" : `:${port}`}`;
-
-  return {
-    ...props, availabilityZone, imageId, instanceType, port, rootVolumeSize,
-    publicIp: instance.publicIp ?? "",
-    instanceId: instance.instanceId,
-    publicDnsName: instance.publicDns ?? "",
-    url,
-    vpcId: vpc.vpcId,
-    subnetId: subnet.subnetId,
-    securityGroupId: securityGroup.groupId,
-    roleArn: role.arn,
-    instanceProfileArn: instanceProfile.Arn,
-  };
-}
-
-// ---- AMI resolution ---------------------------------------------------------
-
-/** Resolve SSM-parameter-style AMI references ({{resolve:ssm:...}}) to real AMI IDs. */
-async function resolveImageId(imageId: string, region: string) {
-  if (imageId.startsWith("ami-")) return imageId;
-
-  const match = imageId.match(/^\{\{resolve:ssm:([^}:]+)(?::\d+)?\}\}$/);
-  if (!match) return imageId;
-
-  const client = new SSMClient({ region });
-  const response = await client.send(new GetParameterCommand({ Name: match[1] }));
-  const resolvedImageId = response.Parameter?.Value;
-
-  if (!resolvedImageId?.startsWith("ami-")) {
-    throw new Error(`Resolved AMI from SSM parameter ${match[1]} was not a valid EC2 image id.`);
-  }
-  return resolvedImageId;
-}
-
-/** Find the latest Determinate Systems NixOS AMI in the given region. */
-async function resolveNixosAmi(region: string): Promise<string> {
-  const { EC2Client, DescribeImagesCommand } = await import("@aws-sdk/client-ec2");
-  const client = new EC2Client({ region });
-  const images = await client.send(
-    new DescribeImagesCommand({
-      Owners: ["535002876703"],
-      Filters: [
-        { Name: "name", Values: ["determinate/nixos/epoch-1/*"] },
-        { Name: "architecture", Values: ["x86_64"] },
-        { Name: "state", Values: ["available"] },
-      ],
-    }),
-  );
-  const sorted = (images.Images ?? []).sort((a, b) =>
-    (b.CreationDate ?? "").localeCompare(a.CreationDate ?? ""),
-  );
-  const imageId = sorted[0]?.ImageId;
-  if (!imageId) throw new Error("No Determinate NixOS AMI found in " + region);
-  return imageId;
-}
-
-// ---- String helpers ---------------------------------------------------------
-
-function toAwsTags(tags: Record<string, string>) {
-  return Object.entries(tags).map(([Key, Value]) => ({ Key, Value }));
-}
-
-function trimTrailingSlash(value: string) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-
-function sanitizeName(value: string) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "app";
-}
diff --git a/packages/infra/modules/deployment/aws-ec2-userdata.ts b/packages/infra/modules/deployment/aws-ec2-userdata.ts
deleted file mode 100644
index a9145ad2..00000000
--- a/packages/infra/modules/deployment/aws-ec2-userdata.ts
+++ /dev/null
@@ -1,160 +0,0 @@
-// =============================================================================
-// aws-ec2-userdata.ts — User-data script generators for EC2 instances
-//
-// Two boot strategies:
-//
-//   amazon-linux (default):
-//     Installs Node/Bun via dnf, pulls a tarball artifact from S3,
-//     loads runtime env from SSM, writes a systemd unit that runs
-//     `node .output/server/index.mjs`.
-//
-//   nixos:
-//     Minimal boot script. The real configuration comes later via
-//     Colmena (nixos-rebuild switch) which pulls the pre-built
-//     closure from Cachix. UserData is static so the instance is
-//     never replaced on deploy — only the NixOS system config changes.
-//
-// These are pure string-returning functions with no AWS SDK calls.
-// =============================================================================
-
-import type { RuntimeLayout } from "./aws-ec2-deploy";
-
-// ---- Amazon Linux 2023 user-data --------------------------------------------
-
-export function buildUserData({
-  appName,
-  artifactBucket,
-  artifactKey,
-  artifactVersion,
-  layout,
-  parameterPath,
-  port,
-  region,
-}: {
-  appName: string;
-  artifactBucket: string;
-  artifactKey: string;
-  artifactVersion?: string;
-  layout: RuntimeLayout;
-  parameterPath: string;
-  port: number;
-  region: string;
-}) {
-  return `#!/bin/bash
-set -euxo pipefail
-
-export HOME=/root
-export PATH=/usr/local/bin:/usr/bin:/bin
-
-dnf update -y
-dnf install -y jq unzip nodejs
-
-curl -fsSL https://bun.sh/install | bash
-export BUN_INSTALL=/root/.bun
-export PATH=$BUN_INSTALL/bin:$PATH
-
-cat >/usr/local/bin/${layout.slug}-bootstrap <<'EOF'
-#!/bin/bash
-set -euo pipefail
-
-export HOME=/root
-export PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
-export AWS_REGION=${shellString(region)}
-
-ARTIFACT_BUCKET=${shellString(artifactBucket)}
-ARTIFACT_KEY=${shellString(artifactKey)}
-ARTIFACT_VERSION=${shellString(artifactVersion ?? "unknown")}
-PARAMETER_PATH=${shellString(trimTrailingSlash(parameterPath))}
-APP_ROOT=${shellString(layout.appRoot)}
-RELEASE_ROOT=${shellString(layout.releaseRoot)}
-ENV_FILE=${shellString(layout.envFile)}
-ARCHIVE_PATH=${shellString(layout.archivePath)}
-
-rm -rf "$RELEASE_ROOT"
-mkdir -p "$RELEASE_ROOT"
-
-aws s3 cp "s3://$ARTIFACT_BUCKET/$ARTIFACT_KEY" "$ARCHIVE_PATH" --region "$AWS_REGION"
-tar -xzf "$ARCHIVE_PATH" -C "$RELEASE_ROOT"
-
-cat >"$ENV_FILE" <<ENVEOF
-NODE_ENV=production
-HOST=0.0.0.0
-PORT=${port}
-ARTIFACT_BUCKET=$ARTIFACT_BUCKET
-ARTIFACT_KEY=$ARTIFACT_KEY
-ARTIFACT_VERSION=$ARTIFACT_VERSION
-ENVEOF
-
-aws ssm get-parameters-by-path \\
-  --path "$PARAMETER_PATH" \\
-  --recursive \\
-  --with-decryption \\
-  --output json \\
-  --region "$AWS_REGION" \\
-| jq -r '.Parameters[] | "\\(.Name | split("/")[-1])=\\(.Value)"' >>"$ENV_FILE"
-EOF
-
-chmod +x /usr/local/bin/${layout.slug}-bootstrap
-/usr/local/bin/${layout.slug}-bootstrap
-
-cat >/etc/systemd/system/${layout.serviceName} <<'EOF'
-[Unit]
-Description=stackpanel ${appName}
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=${layout.releaseRoot}
-Environment=PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
-EnvironmentFile=${layout.envFile}
-ExecStart=/usr/bin/node ${layout.releaseRoot}/.output/server/index.mjs
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl daemon-reload
-systemctl enable --now ${layout.serviceName}
-`;
-}
-
-// ---- NixOS user-data --------------------------------------------------------
-
-/**
- * NixOS instances get a static boot script that only logs metadata.
- * The actual system configuration is applied later by Colmena, which
- * pulls the pre-built closure from Cachix. Because this script never
- * changes between deploys, the Ec2Instance resource won't trigger
- * a replacement on each deploy.
- */
-export function buildNixosUserData({
-  region,
-  parameterPath,
-}: {
-  region: string;
-  parameterPath: string;
-}) {
-  return `#!/usr/bin/env bash
-set -euo pipefail
-exec >> /var/log/user-data.log 2>&1
-
-echo "[+] NixOS instance booted"
-echo "[+] SSM parameter path: ${shellString(trimTrailingSlash(parameterPath))}"
-echo "[+] Region: ${shellString(region)}"
-echo "[+] Instance ready for Colmena deployment"
-`;
-}
-
-// ---- String helpers ---------------------------------------------------------
-
-function trimTrailingSlash(value: string) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-
-function shellString(value: string) {
-  return JSON.stringify(value);
-}
diff --git a/packages/infra/modules/deployment/index.ts b/packages/infra/modules/deployment/index.ts
deleted file mode 100644
index bb9b94fd..00000000
--- a/packages/infra/modules/deployment/index.ts
+++ /dev/null
@@ -1,471 +0,0 @@
-// ==============================================================================
-// Deployment Infra Module — Orchestrator
-//
-// Top-level entry point for `just deploy`. Reads the Nix-generated
-// infra-inputs.json, builds a deployment plan for each app, and dispatches
-// to the appropriate host handler (Cloudflare or AWS EC2).
-//
-// Each app gets its own Alchemy app scope so `alchemy deploy --app <name>`
-// follows Alchemy's documented monorepo workflow.
-//
-// Flow:
-//   infra-inputs.json -> plan.ts (build plan) -> deploy{Cloudflare,Aws}App
-//     -> Cloudflare: TanStackStart / Worker / Vite / etc.
-//     -> AWS:        aws-ec2-deploy.ts (VPC + IAM + EC2 + SSM)
-// ==============================================================================
-import alchemy, { type Secret } from "alchemy";
-import { execFileSync } from "node:child_process";
-import { readdirSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { TanStackStart } from "alchemy/cloudflare";
-import * as cloudflare from "alchemy/cloudflare";
-import { CloudflareStateStore } from "alchemy/state";
-import Infra from "@stackpanel/infra";
-import {
-  buildDeploymentPlan,
-  type AppInput,
-  type DeploymentInputs,
-} from "./plan";
-import { Ec2Server } from "./aws-ec2-deploy";
-
-// ---- Alchemy app factory (uses generated config if available) ----------------
-
-type CreateApp = (name?: string) => Promise<{ finalize(): Promise<void> }>;
-
-let createApp: CreateApp;
-try {
-  const mod = await import("@gen/alchemy");
-  createApp = mod.createApp;
-} catch {
-  createApp = async (name?: string) =>
-    alchemy(name ?? "stackpanel-infra", {
-      stage: process.env.STAGE ?? undefined,
-      stateStore: process.env.CLOUDFLARE_API_TOKEN
-        ? (scope) =>
-            new CloudflareStateStore(scope, {
-              apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN!),
-            })
-        : undefined,
-    });
-}
-
-// ---- Load inputs from Nix ---------------------------------------------------
-
-const infra = new Infra("deployment");
-const inputs = infra.inputs<DeploymentInputs>(
-  process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES,
-);
-
-const STAGE = process.env.STAGE ?? "dev";
-const DEPLOYMENT_APP_FILTER = process.env.STACKPANEL_DEPLOYMENT_APP ?? null;
-
-// ---- Binding resolution (env vars + secrets) --------------------------------
-
-const STAGE_URL_DEFAULTS: Record<string, (stage: string) => string> = {
-  CORS_ORIGIN: (stage) =>
-    stage === "prod"
-      ? "https://stackpanel.com"
-      : `https://${stage}.stackpanel.com`,
-  BETTER_AUTH_URL: (stage) =>
-    stage === "prod"
-      ? "https://stackpanel.com"
-      : `https://${stage}.stackpanel.com`,
-  POLAR_SUCCESS_URL: (stage) =>
-    stage === "prod"
-      ? "https://stackpanel.com"
-      : `https://${stage}.stackpanel.com`,
-};
-
-function resolveBindings(
-  bindingNames: string[],
-  secretNames: string[],
-): Record<string, unknown> {
-  const secretSet = new Set(secretNames);
-  const resolved: Record<string, unknown> = {};
-
-  for (const key of bindingNames) {
-    const envValue = process.env[key];
-    const defaultFn = STAGE_URL_DEFAULTS[key];
-    const value = envValue ?? (defaultFn ? defaultFn(STAGE) : undefined);
-    resolved[key] = secretSet.has(key) ? alchemy.secret(value ?? "") : value;
-  }
-
-  return resolved;
-}
-
-function resolveAwsEnvironment(
-  bindingNames: string[],
-  secretNames: string[],
-): Record<string, string | Secret<string>> {
-  const secretSet = new Set(secretNames);
-  const resolved: Record<string, string | Secret<string>> = {};
-
-  for (const key of bindingNames) {
-    const envValue = process.env[key];
-    const defaultFn = STAGE_URL_DEFAULTS[key];
-    const value = envValue ?? (defaultFn ? defaultFn(STAGE) : "");
-    if (secretSet.has(key)) {
-      if (!value && STAGE === "prod") {
-        throw new Error(`Missing required secret binding "${key}" for AWS deployment`);
-      }
-      resolved[key] = alchemy.secret(value || "PLACEHOLDER");
-      continue;
-    }
-    resolved[key] = value;
-  }
-
-  return resolved;
-}
-
-function requireEnv(name: string) {
-  const value = process.env[name];
-  if (!value) {
-    throw new Error(`${name} environment variable is required`);
-  }
-  return value;
-}
-
-function resolveArtifactLocation() {
-  const artifactVersion = process.env.EC2_ARTIFACT_VERSION;
-  const artifactBucket = process.env.EC2_ARTIFACT_BUCKET ?? inputs.aws?.artifact?.bucket;
-  const artifactKey = process.env.EC2_ARTIFACT_KEY
-    ?? (
-      artifactVersion
-        ? `${inputs.aws?.artifact?.keyPrefix ?? "web"}/${STAGE}/${artifactVersion}/release.tar.gz`
-        : undefined
-    );
-
-  if (!artifactBucket) {
-    throw new Error(
-      "EC2_ARTIFACT_BUCKET is required unless stackpanel.deployment.aws.artifact.bucket is configured",
-    );
-  }
-
-  if (!artifactKey) {
-    throw new Error(
-      "EC2_ARTIFACT_KEY is required unless EC2_ARTIFACT_VERSION and stackpanel.deployment.aws.artifact.keyPrefix are available",
-    );
-  }
-
-  return {
-    artifactBucket,
-    artifactKey,
-    artifactVersion,
-  };
-}
-
-// ---- Cloudflare helpers -----------------------------------------------------
-
-function cloudflareProps(name: string, app: AppInput) {
-  const route = app.cloudflare?.route ?? inputs.cloudflare?.defaultRoute ?? null;
-
-  return {
-    adopt: true,
-    cwd: app.path,
-    name: app.cloudflare?.workerName ?? name,
-    url: true,
-    compatibility: app.cloudflare?.compatibility,
-    compatibilityDate: inputs.cloudflare?.compatibilityDate ?? undefined,
-    routes: route ? [route] : undefined,
-  };
-}
-
-const OPENNEXT_RUNTIME_PATCH = [
-  'const runtimeProcess = globalThis.process ?? process ?? {};',
-  'globalThis.process = runtimeProcess;',
-  'runtimeProcess.version ??= "v22.14.0";',
-  'runtimeProcess.versions ??= {};',
-  'Object.assign(runtimeProcess.versions, { node: "22.14.0", ...runtimeProcess.versions });',
-].join("\n");
-
-const OPENNEXT_RUNTIME_REGEX =
-  /(\s*)Object\.assign\(process, \{ version: process\.version \|\| "v22\.14\.0" \}\);\n\1Object\.assign\(process\.versions, \{ node: "22\.14\.0", \.\.\.process\.versions \}\);/;
-
-const OPENNEXT_DEBUG_FETCH_FROM = `async fetch(request, env, ctx) {
-        return runWithCloudflareRequestContext(request, env, ctx, async () => {`;
-
-const OPENNEXT_DEBUG_FETCH_TO = `async fetch(request, env, ctx) {
-        try {
-            return runWithCloudflareRequestContext(request, env, ctx, async () => {`;
-
-const OPENNEXT_DEBUG_FETCH_END_FROM = `        });
-    },`;
-
-const OPENNEXT_DEBUG_FETCH_END_TO = `        });
-        } catch (error) {
-            if (request.headers.get("x-stackpanel-debug") === "1") {
-                const stack = error instanceof Error ? \`${"${error.message}"}\n${"${error.stack ?? \"\"}"}\` : String(error);
-                return new Response(stack, {
-                    status: 500,
-                    headers: { "content-type": "text/plain; charset=UTF-8" }
-                });
-            }
-            throw error;
-        }
-    },`;
-
-function buildNextjsWorker(app: AppInput) {
-  const appPath = path.resolve(app.path);
-
-  execFileSync("bunx", ["opennextjs-cloudflare", "build"], {
-    cwd: appPath,
-    stdio: "inherit",
-  });
-
-  const initPath = path.join(appPath, ".open-next", "cloudflare", "init.js");
-  const initSource = readFileSync(initPath, "utf8");
-
-  if (!initSource.includes(OPENNEXT_RUNTIME_PATCH) && !OPENNEXT_RUNTIME_REGEX.test(initSource)) {
-    throw new Error(
-      `OpenNext runtime patch target not found in ${initPath}`,
-    );
-  }
-
-  if (!initSource.includes(OPENNEXT_RUNTIME_PATCH)) {
-    writeFileSync(
-      initPath,
-      initSource.replace(
-        OPENNEXT_RUNTIME_REGEX,
-        (_match, indent: string) =>
-          OPENNEXT_RUNTIME_PATCH.split("\n")
-            .map((line) => `${indent}${line}`)
-            .join("\n"),
-      ),
-    );
-  }
-
-  const pending = [path.join(appPath, ".open-next")];
-  while (pending.length > 0) {
-    const currentPath = pending.pop()!;
-    for (const entry of readdirSync(currentPath, { withFileTypes: true })) {
-      const entryPath = path.join(currentPath, entry.name);
-
-      if (entry.isDirectory()) {
-        pending.push(entryPath);
-        continue;
-      }
-
-      if (!entry.isFile() || (!entry.name.endsWith(".js") && !entry.name.endsWith(".mjs"))) {
-        continue;
-      }
-
-      const source = readFileSync(entryPath, "utf8");
-      if (source.includes("Object.entries(env)")) {
-        writeFileSync(
-          entryPath,
-          source.replaceAll(
-            "Object.entries(env)",
-            "Object.entries(env ?? {})",
-          ),
-        );
-      }
-    }
-  }
-
-  if (process.env.STACKPANEL_DEPLOYMENT_DEBUG_RESPONSE === "1") {
-    const workerPath = path.join(appPath, ".open-next", "worker.js");
-    const workerSource = readFileSync(workerPath, "utf8");
-
-    if (
-      workerSource.includes(OPENNEXT_DEBUG_FETCH_FROM) &&
-      workerSource.includes(OPENNEXT_DEBUG_FETCH_END_FROM)
-    ) {
-      writeFileSync(
-        workerPath,
-        workerSource
-          .replace(OPENNEXT_DEBUG_FETCH_FROM, OPENNEXT_DEBUG_FETCH_TO)
-          .replace(OPENNEXT_DEBUG_FETCH_END_FROM, OPENNEXT_DEBUG_FETCH_END_TO),
-      );
-    }
-  }
-}
-
-async function withAppScope<T>(
-  appScopeName: string,
-  run: () => Promise<T>,
-): Promise<T> {
-  const app = await createApp(appScopeName);
-
-  try {
-    const result = await run();
-    await app.finalize();
-    return result;
-  } catch (error) {
-    await app.finalize();
-    throw error;
-  }
-}
-
-// ---- Host-specific deploy functions -----------------------------------------
-
-async function deployCloudflareApp(
-  appName: string,
-  app: AppInput,
-): Promise<{ url: string }> {
-  const bindings = resolveBindings(app.bindings, app.secrets);
-  const plan = buildDeploymentPlan(appName, app);
-
-  return withAppScope(plan.appScopeName, async () => {
-    switch (plan.kind) {
-      case "cloudflare-nextjs-app":
-        buildNextjsWorker(app);
-
-        return cloudflare.Worker(plan.resourceName, {
-          ...cloudflareProps(appName, app),
-          assets: {
-            html_handling: "auto-trailing-slash",
-            not_found_handling: "none",
-            run_worker_first: false,
-          },
-          bindings: {
-            ...bindings,
-            ASSETS: {
-              path: path.join(app.path, ".open-next", "assets"),
-              type: "assets",
-            },
-          },
-          entrypoint: ".open-next/worker.js",
-          noBundle: true,
-          rules: [
-            {
-              globs: [
-                "**/*.js",
-                "**/*.mjs",
-                "**/*.wasm",
-                ".build/**/*.js",
-                ".build/**/*.mjs",
-              ],
-            },
-          ],
-        });
-
-      case "cloudflare-app":
-        switch (plan.framework) {
-          case "tanstack-start":
-            return TanStackStart(plan.resourceName, {
-              ...cloudflareProps(appName, app),
-              bindings,
-            });
-
-          case "astro":
-            return (await import("alchemy/cloudflare")).Astro(plan.resourceName, {
-              ...cloudflareProps(appName, app),
-              bindings,
-            });
-
-          case "remix":
-            return (await import("alchemy/cloudflare")).Remix(plan.resourceName, {
-              ...cloudflareProps(appName, app),
-              bindings,
-            });
-
-          case "nuxt":
-            return (await import("alchemy/cloudflare")).Nuxt(plan.resourceName, {
-              ...cloudflareProps(appName, app),
-              bindings,
-            });
-
-          case "vite":
-            return cloudflare.Vite(plan.resourceName, {
-              ...cloudflareProps(appName, app),
-              assets: app.assetsDir ?? "dist",
-              bindings,
-              dev: { command: "bun run dev" },
-            });
-
-          case "hono":
-            return cloudflare.Worker(plan.resourceName, {
-              ...cloudflareProps(appName, app),
-              entrypoint: app.entrypoint ?? "src/index.ts",
-              bindings,
-            });
-
-          default:
-            throw new Error(
-              `Unsupported framework "${plan.framework}" for host "cloudflare"`,
-            );
-        }
-    }
-  });
-}
-
-async function deployAwsApp(
-  appName: string,
-  app: AppInput,
-): Promise<{ url: string }> {
-  const environment = resolveAwsEnvironment(app.bindings, app.secrets);
-  const plan = buildDeploymentPlan(appName, app);
-
-  if (plan.kind !== "aws-ec2-app") {
-    throw new Error(
-      `Unsupported AWS deployment plan "${plan.kind}" for ${appName}`,
-    );
-  }
-
-  const { artifactBucket, artifactKey, artifactVersion } = resolveArtifactLocation();
-  const region = app.aws?.region ?? inputs.aws?.region ?? "us-west-2";
-
-  const osType = (app.aws?.osType as "amazon-linux" | "nixos") ?? "amazon-linux";
-
-  return withAppScope(plan.appScopeName, async () =>
-    Ec2Server(plan.resourceName, {
-      appName,
-      artifactBucket,
-      artifactKey,
-      artifactVersion,
-      environment,
-      region,
-      availabilityZone: app.aws?.availabilityZone ?? undefined,
-      imageId: app.aws?.imageId ?? undefined,
-      instanceType: app.aws?.instanceType ?? inputs.aws?.instanceType ?? undefined,
-      keyName: app.aws?.keyName ?? undefined,
-      parameterPath:
-        app.aws?.parameterPath ?? `/stackpanel/${STAGE}/${appName}-runtime`,
-      port: app.aws?.port ?? inputs.aws?.port ?? 80,
-      httpCidrBlocks:
-        app.aws?.httpCidrBlocks?.length ? app.aws.httpCidrBlocks : undefined,
-      sshCidrBlocks:
-        app.aws?.sshCidrBlocks?.length ? app.aws.sshCidrBlocks : undefined,
-      rootVolumeSize: app.aws?.rootVolumeSize ?? undefined,
-      vpcCidrBlock: app.aws?.vpcCidrBlock ?? undefined,
-      subnetCidrBlock: app.aws?.subnetCidrBlock ?? undefined,
-      osType,
-      tags: {
-        App: "stackpanel",
-        Stage: STAGE,
-        ...(app.aws?.tags ?? {}),
-      },
-    }),
-  );
-}
-
-// ---- Main dispatch loop -----------------------------------------------------
-
-const outputs: Record<string, string> = {};
-const deployableApps = Object.entries(inputs.apps ?? {}).filter(
-  ([appName]) => DEPLOYMENT_APP_FILTER === null || appName === DEPLOYMENT_APP_FILTER,
-);
-
-for (const [appName, app] of deployableApps) {
-  let resource: { url: string };
-
-  switch (app.host) {
-    case "cloudflare":
-      resource = await deployCloudflareApp(appName, app);
-      break;
-
-    case "aws":
-      resource = await deployAwsApp(appName, app);
-      break;
-
-    default:
-      throw new Error(
-        `Unsupported host "${app.host}" in infra deployment module`,
-      );
-  }
-
-  outputs[`${appName}Url`] = resource.url;
-  console.log(`[${STAGE}] ${appName} -> ${resource.url}`);
-}
-
-export default outputs;
diff --git a/packages/infra/modules/deployment/plan.test.ts b/packages/infra/modules/deployment/plan.test.ts
deleted file mode 100644
index 908fdfe3..00000000
--- a/packages/infra/modules/deployment/plan.test.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { buildDeploymentPlan } from "./plan";
-
-describe("buildDeploymentPlan", () => {
-  test("uses app-scoped Alchemy plan for Cloudflare Next.js apps", () => {
-    const plan = buildDeploymentPlan("docs", {
-      bindings: ["ASSET_HOST"],
-      framework: "nextjs",
-      host: "cloudflare",
-      path: "apps/docs",
-      secrets: [],
-      cloudflare: {
-        compatibility: "node",
-        workerName: "stackpanel-docs",
-      },
-    });
-
-    expect(plan.kind).toBe("cloudflare-nextjs-app");
-    expect(plan.appScopeName).toBe("docs");
-    expect(plan.resourceName).toBe("website");
-    expect(plan.cwd).toBe("apps/docs");
-  });
-
-  test("uses aws ec2 plan for AWS-hosted apps", () => {
-    const plan = buildDeploymentPlan("web", {
-      bindings: ["DATABASE_URL", "BETTER_AUTH_SECRET"],
-      framework: "tanstack-start",
-      host: "aws",
-      path: "apps/web",
-      secrets: ["DATABASE_URL", "BETTER_AUTH_SECRET"],
-      aws: {
-        instanceType: "t3.small",
-        port: 80,
-        region: "us-west-2",
-      },
-    });
-
-    expect(plan.kind).toBe("aws-ec2-app");
-    expect(plan.appScopeName).toBe("web");
-    expect(plan.resourceName).toBe("web");
-    expect(plan.cwd).toBe("apps/web");
-  });
-});
diff --git a/packages/infra/modules/deployment/plan.ts b/packages/infra/modules/deployment/plan.ts
deleted file mode 100644
index c138733f..00000000
--- a/packages/infra/modules/deployment/plan.ts
+++ /dev/null
@@ -1,134 +0,0 @@
-// =============================================================================
-// plan.ts — Deployment plan types and builder
-//
-// Translates the Nix-provided per-app config (framework + host) into a
-// concrete DeploymentPlan that the orchestrator (index.ts) dispatches on.
-//
-// The plan is a discriminated union on `kind` so the orchestrator gets
-// type-safe access to host-specific fields.
-// =============================================================================
-
-/** Per-app config as serialized from Nix via infra-inputs.json. */
-export interface AppInput {
-  framework: string;
-  host: string;
-  path: string;
-  /** Environment variable names to bind (both plaintext and secrets). */
-  bindings: string[];
-  /** Subset of bindings that should be stored as SecureString in SSM. */
-  secrets: string[];
-
-  /** AWS-specific config (only present when host === "aws"). */
-  aws?: {
-    region?: string | null;
-    availabilityZone?: string | null;
-    imageId?: string | null;
-    instanceType?: string | null;
-    keyName?: string | null;
-    port?: number | null;
-    parameterPath?: string | null;
-    httpCidrBlocks?: string[];
-    sshCidrBlocks?: string[];
-    rootVolumeSize?: number | null;
-    vpcCidrBlock?: string | null;
-    subnetCidrBlock?: string | null;
-    tags?: Record<string, string>;
-    /** "amazon-linux" uses tarball + UserData bootstrap; "nixos" uses static boot + Colmena. */
-    osType?: "amazon-linux" | "nixos";
-  };
-
-  /** Cloudflare-specific config (only present when host === "cloudflare"). */
-  cloudflare?: {
-    workerName?: string;
-    route?: string | null;
-    compatibility?: "node" | "browser";
-  };
-
-  /** Framework-specific overrides (present regardless of host). */
-  ssr?: boolean;
-  assetsDir?: string;
-  entrypoint?: string;
-  output?: string;
-}
-
-/** Global deployment config from stackpanel.deployment.* in Nix. */
-export interface DeploymentInputs {
-  apps: Record<string, AppInput>;
-  aws?: {
-    region?: string | null;
-    instanceType?: string | null;
-    port?: number | null;
-    artifact?: {
-      bucket?: string | null;
-      keyPrefix?: string | null;
-    };
-  };
-  cloudflare?: {
-    compatibilityDate?: string | null;
-    defaultRoute?: string | null;
-  };
-}
-
-/**
- * Discriminated union describing how to deploy a single app.
- * The orchestrator switches on `kind` to call the right deploy function.
- */
-export type DeploymentPlan =
-  | {
-      kind: "cloudflare-nextjs-app";
-      appScopeName: string;
-      cwd: string;
-      resourceName: "website";
-    }
-  | {
-      kind: "cloudflare-app";
-      appScopeName: string;
-      cwd: string;
-      framework: string;
-      resourceName: string;
-    }
-  | {
-      kind: "aws-ec2-app";
-      appScopeName: string;
-      cwd: string;
-      resourceName: string;
-    };
-
-/** Map (framework, host) -> DeploymentPlan for a single app. */
-export function buildDeploymentPlan(
-  appName: string,
-  app: AppInput,
-): DeploymentPlan {
-  switch (app.host) {
-    case "cloudflare":
-      if (app.framework === "nextjs") {
-        return {
-          kind: "cloudflare-nextjs-app",
-          appScopeName: appName,
-          cwd: app.path,
-          resourceName: "website",
-        };
-      }
-
-      return {
-        kind: "cloudflare-app",
-        appScopeName: appName,
-        cwd: app.path,
-        framework: app.framework,
-        resourceName: appName,
-      };
-
-    case "aws":
-      return {
-        kind: "aws-ec2-app",
-        appScopeName: appName,
-        cwd: app.path,
-        resourceName: appName,
-      };
-
-    default:
-      throw new Error(
-        `Unsupported host "${app.host}" in deployment plan builder`,
-      );
-  }
-}
diff --git a/packages/infra/modules/machines.ts b/packages/infra/modules/machines.ts
deleted file mode 100644
index 26115f84..00000000
--- a/packages/infra/modules/machines.ts
+++ /dev/null
@@ -1,192 +0,0 @@
-// ==============================================================================
-// Machine Inventory Infra Module
-//
-// Accepts machine definitions from Nix and emits a JSON string output.
-// This output is intended to be pulled into stackpanel.infra.outputs.machines
-// and consumed by Colmena.
-// ==============================================================================
-import Infra from "@stackpanel/infra";
-
-interface MachineSshConfig {
-  user?: string;
-  port?: number;
-  keyPath?: string | null;
-}
-
-interface MachineDefinition {
-  id?: string | null;
-  name?: string | null;
-  host?: string | null;
-  ssh?: MachineSshConfig;
-  tags?: string[];
-  roles?: string[];
-  provider?: string | null;
-  arch?: string | null;
-  publicIp?: string | null;
-  privateIp?: string | null;
-  labels?: Record<string, string>;
-  nixosProfile?: string | null;
-  nixosModules?: string[];
-  targetEnv?: string | null;
-  env?: Record<string, string>;
-  metadata?: Record<string, unknown>;
-}
-
-interface MachineInputs {
-  source?: "static" | "aws-ec2";
-  machines: Record<string, MachineDefinition>;
-  aws?: {
-    region?: string | null;
-    instanceIds?: string[];
-    filters?: Array<{ name: string; values: string[] }>;
-    nameTagKeys?: string[];
-    roleTagKeys?: string[];
-    tagKeys?: string[];
-    envTagKeys?: string[];
-    hostPreference?: Array<"publicDns" | "publicIp" | "privateIp">;
-    ssh?: MachineSshConfig;
-  };
-}
-
-const infra = new Infra("machines");
-const inputs = infra.inputs<MachineInputs>(
-  process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES,
-);
-
-const source = inputs.source ?? "static";
-const machines = inputs.machines ?? {};
-
-function tagMap(tags?: Array<{ Key?: string; Value?: string }>): Record<string, string> {
-  const result: Record<string, string> = {};
-  for (const tag of tags ?? []) {
-    if (!tag.Key) continue;
-    result[tag.Key] = tag.Value ?? "";
-  }
-  return result;
-}
-
-function pickTagValue(tags: Record<string, string>, keys: string[]): string | null {
-  for (const key of keys) {
-    const value = tags[key];
-    if (value) return value;
-  }
-  return null;
-}
-
-function collectTagValues(tags: Record<string, string>, keys: string[]): string[] {
-  const values: string[] = [];
-  for (const key of keys) {
-    const value = tags[key];
-    if (value) values.push(value);
-  }
-  return values;
-}
-
-function pickHost(
-  instance: {
-    PublicDnsName?: string;
-    PublicIpAddress?: string;
-    PrivateIpAddress?: string;
-  },
-  preference: Array<"publicDns" | "publicIp" | "privateIp">,
-): string | null {
-  for (const pref of preference) {
-    if (pref === "publicDns" && instance.PublicDnsName) return instance.PublicDnsName;
-    if (pref === "publicIp" && instance.PublicIpAddress) return instance.PublicIpAddress;
-    if (pref === "privateIp" && instance.PrivateIpAddress) return instance.PrivateIpAddress;
-  }
-  return null;
-}
-
-function mapArchitecture(arch?: string | null): string | null {
-  if (!arch) return null;
-  if (arch === "arm64") return "aarch64-linux";
-  if (arch === "x86_64") return "x86_64-linux";
-  return null;
-}
-
-async function loadAwsMachines(awsConfig?: MachineInputs["aws"]): Promise<Record<string, MachineDefinition>> {
-  const config = awsConfig ?? {};
-  const { EC2Client, DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
-
-  const region = config.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
-  const client = new EC2Client(region ? { region } : {});
-
-  const instanceIds = config.instanceIds ?? [];
-  const filters = (config.filters ?? []).map((filter) => ({
-    Name: filter.name,
-    Values: filter.values,
-  }));
-
-  if (instanceIds.length === 0 && filters.length === 0) {
-    console.warn("[machines] No instance IDs or filters provided; inventory will be empty.");
-    return {};
-  }
-
-  const hostPreference = config.hostPreference ?? ["publicDns", "publicIp", "privateIp"];
-  const nameTagKeys = config.nameTagKeys ?? ["Name"];
-  const roleTagKeys = config.roleTagKeys ?? [];
-  const tagKeys = config.tagKeys ?? [];
-  const envTagKeys = config.envTagKeys ?? [];
-  const defaultSsh = config.ssh ?? { user: "root", port: 22, keyPath: null };
-
-  const inventory: Record<string, MachineDefinition> = {};
-  let nextToken: string | undefined;
-
-  do {
-    const response = await client.send(
-      new DescribeInstancesCommand({
-        InstanceIds: instanceIds.length > 0 ? instanceIds : undefined,
-        Filters: filters.length > 0 ? filters : undefined,
-        NextToken: nextToken,
-      }),
-    );
-
-    for (const reservation of response.Reservations ?? []) {
-      for (const instance of reservation.Instances ?? []) {
-        const instanceId = instance.InstanceId ?? "";
-        if (!instanceId) continue;
-
-        const tags = tagMap(instance.Tags);
-        const name = pickTagValue(tags, nameTagKeys) ?? instanceId;
-        const roles = collectTagValues(tags, roleTagKeys);
-        const extraTags = collectTagValues(tags, tagKeys);
-        const targetEnv = pickTagValue(tags, envTagKeys);
-        const host = pickHost(instance, hostPreference);
-
-        inventory[instanceId] = {
-          id: instanceId,
-          name,
-          host,
-          ssh: defaultSsh,
-          roles,
-          tags: extraTags,
-          provider: "aws-ec2",
-          arch: mapArchitecture(instance.Architecture),
-          publicIp: instance.PublicIpAddress ?? null,
-          privateIp: instance.PrivateIpAddress ?? null,
-          labels: tags,
-          targetEnv,
-          metadata: {
-            availabilityZone: instance.Placement?.AvailabilityZone,
-            instanceType: instance.InstanceType,
-            state: instance.State?.Name,
-          },
-        };
-      }
-    }
-
-    nextToken = response.NextToken;
-  } while (nextToken);
-
-  return inventory;
-}
-
-const resolvedMachines =
-  source === "aws-ec2"
-    ? await loadAwsMachines(inputs.aws)
-    : machines;
-
-export default {
-  machines: JSON.stringify(resolvedMachines),
-};
diff --git a/packages/infra/package.json b/packages/infra/package.json
deleted file mode 100644
index c9b595b6..00000000
--- a/packages/infra/package.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "dependencies": {
-    "@aws-sdk/client-ec2": "^3.953.0",
-    "@aws-sdk/client-ecr": "^3.953.0",
-    "@aws-sdk/client-elastic-load-balancing-v2": "^3.953.0",
-    "@aws-sdk/client-iam": "^3.953.0",
-    "@aws-sdk/client-kms": "^3.953.0",
-    "@aws-sdk/client-ssm": "^3.953.0",
-    "@aws-sdk/client-sts": "^3.953.0",
-    "@pulumi/aws": "^7.15.0",
-    "alchemy": "^0.81.2",
-    "sst": "^3.17.25"
-  },
-  "devDependencies": {
-    "bun2nix": "latest"
-  },
-  "exports": {
-    ".": {
-      "default": "./src/index.ts"
-    },
-    "./*": {
-      "default": "./src/*.ts"
-    }
-  },
-  "name": "@stackpanel/infra",
-  "private": true,
-  "scripts": {
-    "alchemy:deploy": "alchemy deploy",
-    "alchemy:destroy": "alchemy destroy",
-    "alchemy:dev": "alchemy dev",
-    "container:build:web": "cd ../.. \u0026\u0026 nix build --impure .#packages.x86_64-linux.container-web",
-    "container:push:web": "cd ../.. \u0026\u0026 nix run --impure .#copy-container-web -- docker://registry.fly.io/ --dest-creds x:$(flyctl auth token)",
-    "deploy:web": "cd ../.. \u0026\u0026 (flyctl status -a stackpanel-web \u003e /dev/null 2\u003e\u00261 || flyctl apps create stackpanel-web --org darkmatter) \u0026\u0026 flyctl deploy --config apps/web/fly.toml --image registry.fly.io/stackpanel-web:latest",
-    "postinstall": "test -f bun.lock \u0026\u0026 bun2nix -o bun.nix || true",
-    "ship:web": "turbo run deploy:web",
-    "sst:deploy": "bunx sst deploy",
-    "sst:dev": "bunx sst dev",
-    "sst:remove": "bunx sst remove"
-  },
-  "type": "module"
-}
diff --git a/packages/infra/package.json.backup b/packages/infra/package.json.backup
deleted file mode 100644
index 4d41fc79..00000000
--- a/packages/infra/package.json.backup
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "dependencies": {
-    "@aws-sdk/client-ec2": "^3.953.0",
-    "@aws-sdk/client-ecr": "^3.953.0",
-    "@aws-sdk/client-elastic-load-balancing-v2": "^3.953.0",
-    "@aws-sdk/client-iam": "^3.953.0",
-    "@aws-sdk/client-kms": "^3.953.0",
-    "@aws-sdk/client-ssm": "^3.953.0",
-    "@aws-sdk/client-sts": "^3.953.0",
-    "@pulumi/aws": "^7.15.0",
-    "alchemy": "^0.81.2",
-    "sst": "^3.17.25"
-  },
-  "devDependencies": {
-    "bun2nix": "latest"
-  },
-  "exports": {
-    ".": {
-      "default": "./src/index.ts"
-    },
-    "./*": {
-      "default": "./src/*.ts"
-    }
-  },
-  "name": "@stackpanel/infra",
-  "private": true,
-  "scripts": {
-    "alchemy:deploy": "alchemy deploy",
-    "alchemy:destroy": "alchemy destroy",
-    "alchemy:dev": "alchemy dev",
-    "container:build:web": "cd ../.. && nix build --impure .#packages.x86_64-linux.container-web",
-    "container:push:web": "cd ../.. && nix run --impure .#copy-container-web -- docker://registry.fly.io/ --dest-creds x:$(flyctl auth token)",
-    "deploy:web": "cd ../.. && (flyctl status -a stackpanel-web > /dev/null 2>&1 || flyctl apps create stackpanel-web --org darkmatter) && flyctl deploy --config apps/web/fly.toml --image registry.fly.io/stackpanel-web:latest",
-    "postinstall": "test -f bun.lock && bun2nix -o bun.nix || true",
-    "ship:web": "turbo run deploy:web",
-    "sst:deploy": "bunx sst deploy",
-    "sst:dev": "bunx sst dev",
-    "sst:remove": "bunx sst remove"
-  },
-  "type": "module"
-}
diff --git a/packages/infra/src/alchemy.ts b/packages/infra/src/alchemy.ts
deleted file mode 100644
index f0c572e5..00000000
--- a/packages/infra/src/alchemy.ts
+++ /dev/null
@@ -1,471 +0,0 @@
-import * as crypto from "node:crypto";
-import type { Context } from "alchemy";
-import alchemy, { Resource } from "alchemy";
-import { SSMParameter } from "alchemy/aws";
-import * as cloudflare from "alchemy/cloudflare";
-import * as docker from "alchemy/docker";
-import { NeonBranch, NeonProject } from "alchemy/neon";
-import { UpstashRedis } from "alchemy/upstash";
-import { config } from "dotenv";
-
-config({ path: "./.env" });
-config({ path: "./apps/web/.env" });
-config({ path: "./apps/server/.env" });
-
-const app = await alchemy("stackpanel");
-
-// ----------------------------------------------------------------------------
-// Configuration
-// ----------------------------------------------------------------------------
-const USE_DEVENV =
-	process.env.IN_NIX_SHELL === "impure" ||
-	process.env.DEVENV_ROOT !== undefined;
-const USE_DOCKER = !USE_DEVENV && process.env.USE_DOCKER === "true";
-const STAGE = process.env.STAGE || "dev";
-const IS_PREVIEW = STAGE !== "prod" && STAGE !== "dev";
-
-// ----------------------------------------------------------------------------
-// Helper: Compute stable port from project name (mirrors Nix mkProjectPort)
-// ----------------------------------------------------------------------------
-function computeProjectPort(
-	name: string,
-	minPort = 3000,
-	portRange = 7000,
-): number {
-	const hash = crypto.createHash("md5").update(name).digest("hex");
-	const portOffset = Number.parseInt(hash.substring(0, 4), 16);
-	return minPort + (portOffset % portRange);
-}
-
-// ----------------------------------------------------------------------------
-// Custom Resource: Devenv Postgres (read-only reference to devenv service)
-// ----------------------------------------------------------------------------
-interface DevenvPostgresProps {
-	/** Database name */
-	database: string;
-	/** Username */
-	user: string;
-	/** Password */
-	password: string;
-	/** Port (defaults to 5432) */
-	port?: number;
-	/** Host (defaults to localhost) */
-	host?: string;
-}
-
-export interface DevenvPostgres extends DevenvPostgresProps {
-	/** Connection URL */
-	connectionUrl: string;
-}
-
-export const DevenvPostgres = Resource(
-	"devenv::Postgres",
-	async function (
-		this: Context<DevenvPostgres>,
-		_id: string,
-		props: DevenvPostgresProps,
-	): Promise<DevenvPostgres> {
-		// This is a read-only reference - no create/update/delete needed
-		if (this.phase === "delete") {
-			return this.destroy();
-		}
-
-		const host = props.host ?? "localhost";
-		const port = props.port ?? 5432;
-		const connectionUrl = `postgresql://${props.user}:${props.password}@${host}:${port}/${props.database}`;
-
-		return {
-			...props,
-			host,
-			port,
-			connectionUrl,
-		};
-	},
-);
-
-// ----------------------------------------------------------------------------
-// Custom Resource: Devenv Redis (read-only reference to devenv service)
-// ----------------------------------------------------------------------------
-export interface DevenvRedisProps {
-	/** Port (defaults to 6379) */
-	port?: number;
-	/** Host (defaults to localhost) */
-	host?: string;
-}
-
-export interface DevenvRedis extends DevenvRedisProps {
-	/** Connection URL */
-	connectionUrl: string;
-}
-
-export const DevenvRedis = Resource(
-	"devenv::Redis",
-	async function (
-		this: Context<DevenvRedis>,
-		_id: string,
-		props: DevenvRedisProps,
-	): Promise<DevenvRedis> {
-		// This is a read-only reference - no create/update/delete needed
-		if (this.phase === "delete") {
-			return this.destroy();
-		}
-
-		const host = props.host ?? "localhost";
-		const port = props.port ?? 6379;
-		const connectionUrl = `redis://${host}:${port}`;
-
-		return {
-			...props,
-			host,
-			port,
-			connectionUrl,
-		};
-	},
-);
-
-// ----------------------------------------------------------------------------
-// Custom Resource: Devenv Caddy (read-only reference to devenv Caddy service)
-// ----------------------------------------------------------------------------
-export interface DevenvCaddyProps {
-	/** Project name for computing stable port */
-	projectName: string;
-	/** Override the computed port */
-	port?: number;
-	/** Virtual host domain */
-	domain?: string;
-}
-
-export interface DevenvCaddy extends DevenvCaddyProps {
-	/** Computed stable port */
-	projectPort: number;
-	/** URL to access the service */
-	url: string;
-}
-
-const DevenvCaddy = Resource(
-	"devenv::Caddy",
-	async function (
-		this: Context<DevenvCaddy>,
-		_id: string,
-		props: DevenvCaddyProps,
-	): Promise<DevenvCaddy> {
-		if (this.phase === "delete") {
-			return this.destroy();
-		}
-
-		const projectPort = props.port ?? computeProjectPort(props.projectName);
-		const domain = props.domain ?? `${props.projectName}.localhost`;
-		const url = `http://${domain}`;
-
-		return {
-			...props,
-			projectPort,
-			url,
-		};
-	},
-);
-
-// ----------------------------------------------------------------------------
-// Helper: Read secrets from SSM (for API keys that are pre-populated)
-// ----------------------------------------------------------------------------
-export async function getSSMSecret(name: string): Promise<string> {
-	// biome-ignore lint: Alchemy provides @aws-sdk/client-ssm as a peer dependency
-	// @ts-ignore - peer dependency
-	const { SSMClient, GetParameterCommand } = await import(
-		"@aws-sdk/client-ssm"
-	);
-	const client = new SSMClient({});
-	const response = await client.send(
-		new GetParameterCommand({
-			Name: name,
-			WithDecryption: true,
-		}),
-	);
-	if (!response.Parameter?.Value) {
-		throw new Error(`SSM Parameter ${name} not found or empty`);
-	}
-	return response.Parameter.Value;
-}
-
-// ============================================================================
-// Database: Devenv Postgres (Local) or Neon (Production) or Docker (Fallback)
-// ============================================================================
-let databaseUrl: string;
-let neonProject: Awaited<ReturnType<typeof NeonProject>> | undefined;
-
-if (USE_DEVENV) {
-	// Use devenv-managed Postgres (matches services.nix configuration)
-	const devenvPostgres = await DevenvPostgres("devenv_postgres", {
-		database: "stackpanel",
-		user: "pguser",
-		password: "password",
-		port: 5432,
-	});
-
-	databaseUrl = devenvPostgres.connectionUrl;
-	console.log("Using Devenv Postgres:", databaseUrl);
-} else if (USE_DOCKER) {
-	// Docker Postgres for local development (fallback when not in devenv)
-	const network = await docker.Network("stackpanel_network", {
-		name: "stackpanel_network",
-	});
-
-	const postgresVolume = await docker.Volume("postgres_data", {
-		name: "postgres_data",
-		labels: [
-			{ name: "app", value: "stackpanel" },
-			{ name: "service", value: "postgres" },
-		],
-	});
-
-	const postgresImage = await docker.RemoteImage("postgres_image", {
-		name: "postgres",
-		tag: "16-alpine",
-	});
-
-	await docker.Container("postgres_container", {
-		name: "stackpanel-postgres",
-		image: postgresImage.imageRef,
-		networks: [{ name: network.name }],
-		volumes: [
-			{
-				hostPath: postgresVolume.name,
-				containerPath: "/var/lib/postgresql/data",
-			},
-		],
-		environment: {
-			POSTGRES_USER: "stackpanel",
-			POSTGRES_PASSWORD: "stackpanel",
-			POSTGRES_DB: "stackpanel",
-		},
-		ports: [
-			{
-				internal: 5432,
-				external: 5432,
-			},
-		],
-		start: true,
-	});
-
-	databaseUrl = "postgresql://stackpanel:stackpanel@localhost:5432/stackpanel";
-	console.log("Using Docker Postgres:", databaseUrl);
-} else {
-	// Read Neon API key from SSM (pre-populated)
-	const neonApiKey = await getSSMSecret("/common/neon-api-key");
-
-	// Create Neon project (or adopt existing)
-	neonProject = await NeonProject("stackpanel_neon_project", {
-		name: "stackpanel",
-		apiKey: alchemy.secret(neonApiKey),
-		region_id: "aws-us-east-1",
-		pg_version: 16,
-	});
-
-	// For preview branches, create a separate Neon branch
-	if (IS_PREVIEW) {
-		const previewBranch = await NeonBranch(`neon_branch_${STAGE}`, {
-			project: neonProject,
-			name: STAGE,
-			apiKey: alchemy.secret(neonApiKey),
-			endpoints: [{ type: "read_write" }],
-		});
-		const connUri = previewBranch.connectionUris[0];
-		if (!connUri) {
-			throw new Error(`No connection URI available for branch ${STAGE}`);
-		}
-		databaseUrl = connUri.connection_uri.unencrypted;
-		console.log("Using Neon Preview Branch:", previewBranch.name);
-	} else {
-		// Use main branch for dev/prod
-		databaseUrl = neonProject.connection_uris[0].connection_uri.unencrypted;
-		console.log(
-			"Using Neon Database:",
-			neonProject.name,
-			"Branch:",
-			neonProject.branch.name,
-		);
-	}
-
-	// Write database URL to SSM so other services can read it
-	await SSMParameter("database_url", {
-		name: `/stackpanel/${STAGE}/database-url`,
-		type: "SecureString",
-		value: alchemy.secret(databaseUrl),
-		description: `Database connection URL for stackpanel ${STAGE}`,
-		tags: {
-			app: "stackpanel",
-			stage: STAGE,
-		},
-	});
-}
-
-// ============================================================================
-// Cache: Devenv Redis (Local) or Upstash Redis (Production) or Docker (Fallback)
-// ============================================================================
-let redisUrl: string;
-let redisToken: string | undefined;
-
-if (USE_DEVENV) {
-	// Use devenv-managed Redis (matches services.nix configuration)
-	const devenvRedis = await DevenvRedis("devenv_redis", {
-		port: 6379, // devenv default
-	});
-
-	redisUrl = devenvRedis.connectionUrl;
-	console.log("Using Devenv Redis:", redisUrl);
-} else if (USE_DOCKER) {
-	// Docker Valkey for local development (fallback when not in devenv)
-	const network = await docker.Network("stackpanel_network", {
-		name: "stackpanel_network",
-	});
-
-	const redisVolume = await docker.Volume("redis_data", {
-		name: "redis_data",
-		labels: [
-			{ name: "app", value: "stackpanel" },
-			{ name: "service", value: "redis" },
-		],
-	});
-
-	const redisImage = await docker.RemoteImage("redis_image", {
-		name: "valkey/valkey",
-		tag: "latest",
-	});
-
-	await docker.Container("redis_container", {
-		name: "stackpanel-redis",
-		image: redisImage.imageRef,
-		networks: [{ name: network.name }],
-		volumes: [
-			{
-				hostPath: redisVolume.name,
-				containerPath: "/data",
-			},
-		],
-		ports: [
-			{
-				internal: 6379,
-				external: 6379,
-			},
-		],
-		start: true,
-	});
-
-	redisUrl = "redis://localhost:6379";
-	console.log("Using Docker Valkey:", redisUrl);
-} else {
-	// Read Upstash credentials from SSM (pre-populated)
-	const upstashApiKey = await getSSMSecret("/common/upstash-api-key");
-	const upstashEmail = await getSSMSecret("/common/upstash-email");
-
-	// Create Upstash Redis (unique per stage for preview branches)
-	const upstashRedis = await UpstashRedis(`stackpanel_redis_${STAGE}`, {
-		name: `stackpanel-${STAGE}`,
-		primaryRegion: "us-east-1",
-		apiKey: alchemy.secret(upstashApiKey),
-		email: upstashEmail,
-	});
-
-	redisUrl = upstashRedis.endpoint;
-	redisToken = upstashRedis.restToken.unencrypted;
-	console.log("Using Upstash Redis:", upstashRedis.name, "Endpoint:", redisUrl);
-
-	// Write Redis connection info to SSM
-	await SSMParameter("redis_url", {
-		name: `/stackpanel/${STAGE}/redis-url`,
-		type: "String",
-		value: redisUrl,
-		description: `Redis URL for stackpanel ${STAGE}`,
-		tags: {
-			app: "stackpanel",
-			stage: STAGE,
-		},
-	});
-
-	await SSMParameter("redis_token", {
-		name: `/stackpanel/${STAGE}/redis-token`,
-		type: "SecureString",
-		value: alchemy.secret(redisToken),
-		description: `Redis REST token for stackpanel ${STAGE}`,
-		tags: {
-			app: "stackpanel",
-			stage: STAGE,
-		},
-	});
-}
-
-// ============================================================================
-// Caddy: Devenv-managed reverse proxy with stable port
-// ============================================================================
-let caddyConfig: Awaited<ReturnType<typeof DevenvCaddy>> | undefined;
-let devServerPort = 3000; // default port
-
-if (USE_DEVENV) {
-	// Use devenv-managed Caddy with computed stable port
-	caddyConfig = await DevenvCaddy("devenv_caddy", {
-		projectName: "stackpanel",
-		domain: "stackpanel.localhost",
-	});
-
-	// The dev server should run on the port that Caddy proxies to (3001 per services.nix)
-	devServerPort = 3001;
-	console.log(
-		`Using Devenv Caddy: ${caddyConfig.url} (project port: ${caddyConfig.projectPort})`,
-	);
-}
-
-// ============================================================================
-// Cloudflare Workers
-// ============================================================================
-export const web = await cloudflare.Vite("web", {
-	cwd: "apps/web",
-	assets: "dist",
-	bindings: {
-		VITE_SERVER_URL: process.env.VITE_SERVER_URL || "",
-	},
-	dev: {
-		command: "bun run dev",
-	},
-});
-
-export const server = await cloudflare.Worker("server", {
-	cwd: "apps/server",
-	entrypoint: "src/index.ts",
-	compatibility: "node",
-	bindings: {
-		// Database (Devenv, Neon, or Docker Postgres)
-		DATABASE_URL: alchemy.secret(databaseUrl),
-
-		// Cache (Devenv, Upstash, or Docker Valkey)
-		REDIS_URL: redisUrl,
-		...(redisToken
-			? { UPSTASH_REDIS_REST_TOKEN: alchemy.secret(redisToken) }
-			: {}),
-
-		// Auth & API
-		CORS_ORIGIN: process.env.CORS_ORIGIN || "",
-		BETTER_AUTH_SECRET: alchemy.secret(process.env.BETTER_AUTH_SECRET),
-		BETTER_AUTH_URL: process.env.BETTER_AUTH_URL || "",
-		GOOGLE_GENERATIVE_AI_API_KEY: alchemy.secret(
-			process.env.GOOGLE_GENERATIVE_AI_API_KEY,
-		),
-		POLAR_ACCESS_TOKEN: alchemy.secret(process.env.POLAR_ACCESS_TOKEN),
-		POLAR_SUCCESS_URL: process.env.POLAR_SUCCESS_URL || "",
-	},
-	dev: {
-		port: devServerPort,
-	},
-});
-
-// ============================================================================
-// Exports
-// ============================================================================
-export { databaseUrl, redisUrl, redisToken, caddyConfig };
-
-console.log(`Web    -> ${web.url}`);
-console.log(`Server -> ${server.url}`);
-if (caddyConfig) {
-	console.log(`Caddy  -> ${caddyConfig.url}`);
-}
-
-await app.finalize();
diff --git a/packages/infra/src/index.test.ts b/packages/infra/src/index.test.ts
deleted file mode 100644
index 96063c7e..00000000
--- a/packages/infra/src/index.test.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-// @ts-nocheck
-import { afterEach, describe, expect, test } from "bun:test";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import Infra from "./index.ts";
-
-const ORIGINAL_ENV = { ...process.env };
-
-afterEach(() => {
-  process.env = { ...ORIGINAL_ENV };
-});
-
-describe("Infra.inputs", () => {
-  test("preserves app ids while normalizing structured input keys", () => {
-    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "stackpanel-infra-"));
-    const inputsPath = path.join(tempDir, "infra-inputs.json");
-
-    fs.writeFileSync(
-      inputsPath,
-      JSON.stringify({
-        "aws-ec2-app": {
-          apps: {
-            "stackpanel-staging": {
-              "instance-count": 2,
-              "instance-type": "t2.micro",
-              iam: {
-                "role-name": "stackpanel-staging-ec2-role",
-                "instance-profile-name": "stackpanel-staging-ec2-role-profile",
-              },
-              tags: {
-                "managed-by": "stackpanel-infra",
-              },
-              ssm: {
-                parameters: {
-                  "API-TOKEN": "secret",
-                },
-              },
-            },
-          },
-        },
-      }),
-    );
-
-    process.env.STACKPANEL_ROOT = tempDir;
-    process.env.STACKPANEL_INFRA_INPUTS = inputsPath;
-
-    const infra = new Infra("aws-ec2-app");
-    const inputs = infra.inputs<{
-      apps: Record<
-        string,
-        {
-          instanceCount?: number;
-          instanceType?: string;
-          iam?: {
-            roleName?: string;
-            instanceProfileName?: string;
-          };
-          tags?: Record<string, string>;
-          ssm?: {
-            parameters?: Record<string, string>;
-          };
-        }
-      >;
-    }>();
-
-    expect(inputs.apps["stackpanel-staging"]).toBeDefined();
-    expect(inputs.apps.stackpanelStaging).toBeUndefined();
-    expect(inputs.apps["stackpanel-staging"]?.instanceCount).toBe(2);
-    expect(inputs.apps["stackpanel-staging"]?.instanceType).toBe("t2.micro");
-    expect(inputs.apps["stackpanel-staging"]?.iam?.roleName).toBe(
-      "stackpanel-staging-ec2-role",
-    );
-    expect(inputs.apps["stackpanel-staging"]?.iam?.instanceProfileName).toBe(
-      "stackpanel-staging-ec2-role-profile",
-    );
-    expect(inputs.apps["stackpanel-staging"]?.tags?.["managed-by"]).toBe(
-      "stackpanel-infra",
-    );
-    expect(inputs.apps["stackpanel-staging"]?.ssm?.parameters?.["API-TOKEN"]).toBe(
-      "secret",
-    );
-  });
-});
diff --git a/packages/infra/src/index.ts b/packages/infra/src/index.ts
deleted file mode 100644
index 73de2f40..00000000
--- a/packages/infra/src/index.ts
+++ /dev/null
@@ -1,352 +0,0 @@
-// Generated by stackpanel — do not edit manually.
-// @stackpanel/infra — Infrastructure module library
-import { execSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-// Embedded project config
-// @ts-ignore
-const PROJECT_CONFIG = {"keyFormat":"$module-$key","projectName":"stackpanel","storageBackend":{"filePath":".stack/secrets/vars/dev.sops.yaml","group":"dev","type":"sops"}} as const;
-
-/**
- * Resolve the project root directory.
- */
-function getRoot(): string {
-  return (
-    PROJECT_CONFIG.root ||
-    process.env.STACKPANEL_ROOT ||
-    execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim() ||
-    process.cwd()
-  );
-}
-
-let _root: string | undefined;
-function ROOT(): string {
-  if (!_root) _root = getRoot();
-  return _root;
-}
-
-const PRESERVED_MAP_KEYS = new Set([
-  "apps",
-  "parameters",
-  "secureParameters",
-  "tags",
-]);
-
-function toCamelCaseKey(key: string): string {
-  return key.replace(/-([a-zA-Z0-9])/g, (_match, char: string) =>
-    char.toUpperCase(),
-  );
-}
-
-function normalizeInputKeys<T>(value: T, parentKey?: string): T {
-  if (Array.isArray(value)) {
-    return value.map((item) => normalizeInputKeys(item)) as T;
-  }
-
-  if (value !== null && typeof value === "object") {
-    const preserveChildKeys = parentKey ? PRESERVED_MAP_KEYS.has(parentKey) : false;
-    const result: Record<string, unknown> = {};
-    for (const [key, entry] of Object.entries(value)) {
-      const normalizedKey = preserveChildKeys ? key : toCamelCaseKey(key);
-      result[normalizedKey] = normalizeInputKeys(entry, normalizedKey);
-    }
-    return result as T;
-  }
-
-  return value;
-}
-
-/**
- * Read and parse the infra inputs JSON file.
- * Resolution order:
- *   1. STACKPANEL_INFRA_INPUTS env var (path to JSON file)
- *   2. .stack/state/infra-inputs.json (default location)
- */
-function loadAllInputs(): Record<string, any> {
-  const relPath =
-    process.env.STACKPANEL_INFRA_INPUTS ??
-    ".stack/state/infra-inputs.json";
-  const inputsPath = path.resolve(ROOT(), relPath);
-
-  try {
-    const raw = fs.readFileSync(inputsPath, "utf-8");
-    const parsed = JSON.parse(raw) as Record<string, unknown>;
-    return Object.fromEntries(
-      Object.entries(parsed).map(([key, value]) => [key, normalizeInputKeys(value)]),
-    );
-  } catch {
-    console.warn(
-      `[infra] Could not read inputs from ${inputsPath}, using empty inputs`,
-    );
-    return {};
-  }
-}
-
-/**
- * Decrypt AGE-encrypted values in an object tree.
- * Values matching ENC[age,...] are decrypted using STACKPANEL_AGE_KEY.
- */
-function decryptValues<T>(obj: T): T {
-  if (typeof obj === "string" && obj.startsWith("ENC[age,")) {
-    const ageKey = process.env.STACKPANEL_AGE_KEY;
-    if (!ageKey) {
-      console.warn(
-        "[infra] Found AGE-encrypted value but STACKPANEL_AGE_KEY is not set",
-      );
-      return obj;
-    }
-    try {
-      const encrypted = obj.slice(8, -1); // Remove ENC[age,...] wrapper
-      const result = execSync(
-        `echo "${encrypted}" | base64 -d | age -d -i <(echo "${ageKey}")`,
-        {
-          encoding: "utf-8",
-          shell: "/bin/bash",
-          stdio: ["pipe", "pipe", "pipe"],
-        },
-      ).trim();
-      return result as unknown as T;
-    } catch (err) {
-      console.warn("[infra] Failed to decrypt AGE value:", err);
-      return obj;
-    }
-  }
-
-  if (Array.isArray(obj)) {
-    return obj.map(decryptValues) as unknown as T;
-  }
-
-  if (obj !== null && typeof obj === "object") {
-    const result: any = {};
-    for (const [key, value] of Object.entries(obj)) {
-      result[key] = decryptValues(value);
-    }
-    return result as T;
-  }
-
-  return obj;
-}
-
-/**
- * Deep merge two objects (overrides win).
- */
-function deepMerge(base: any, overrides: any): any {
-  if (overrides === undefined || overrides === null) return base;
-  if (typeof base !== "object" || typeof overrides !== "object")
-    return overrides;
-  if (Array.isArray(base) || Array.isArray(overrides)) return overrides;
-
-  const result = { ...base };
-  for (const [key, value] of Object.entries(overrides)) {
-    result[key] = deepMerge(result[key], value);
-  }
-  return result;
-}
-
-/**
- * Format an output key using the project key format template.
- */
-function formatKey(moduleId: string, key: string): string {
-  return PROJECT_CONFIG.keyFormat
-    .replace(/\$module/g, moduleId)
-    .replace(/\$key/g, key);
-}
-
-// =========================================================================
-// Infra class
-// =========================================================================
-
-export default class Infra {
-  private moduleId: string;
-
-  constructor(moduleId: string) {
-    this.moduleId = moduleId;
-  }
-
-  /**
-   * Resolve inputs for this module.
-   *
-   * @param overrides - Optional overrides (JSON string or object).
-   *   Use process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES for CI tweaks.
-   * @returns The module's input configuration with AGE values decrypted.
-   */
-  inputs<T = Record<string, any>>(overrides?: string | Record<string, any>): T {
-    const allInputs = loadAllInputs();
-    let moduleInputs = allInputs[this.moduleId] ?? {};
-
-    // Apply overrides
-    if (overrides) {
-      const overrideObj =
-        typeof overrides === "string" ? JSON.parse(overrides) : overrides;
-      moduleInputs = deepMerge(moduleInputs, overrideObj);
-    }
-
-    // Decrypt any AGE-encrypted values
-    return decryptValues(moduleInputs) as T;
-  }
-
-  /**
-   * Scoped alchemy resource identifier.
-   * Prevents collisions between modules.
-   *
-   * @example
-   * infra.id("role") // → "aws-secrets-role"
-   */
-  id(resourceName: string): string {
-    return `${this.moduleId}-${resourceName}`;
-  }
-
-  /**
-   * Sync all module outputs to the configured storage backend.
-   *
-   * @param modules - Map of module ID → { outputs, syncKeys }
-   */
-  static async syncAll(
-    modules: Record<
-      string,
-      {
-        outputs: Record<string, string>;
-        syncKeys: string[];
-      }
-    >,
-  ): Promise<void> {
-    const backend = PROJECT_CONFIG.storageBackend;
-    if (backend.type === "none") {
-      console.log("[infra] Storage backend is 'none', skipping output sync");
-      return;
-    }
-
-    // Collect all entries to sync
-    const entries: Array<{ formattedKey: string; value: string }> = [];
-    for (const [moduleId, mod] of Object.entries(modules)) {
-      for (const syncKey of mod.syncKeys) {
-        const value = mod.outputs[syncKey];
-        if (value !== undefined && value !== null) {
-          entries.push({
-            formattedKey: formatKey(moduleId, syncKey),
-            value: String(value),
-          });
-        }
-      }
-    }
-
-    if (entries.length === 0) {
-      console.log("[infra] No outputs to sync");
-      return;
-    }
-
-    console.log(
-      `[infra] Syncing ${entries.length} outputs to ${backend.type}...`,
-    );
-
-    switch (backend.type) {
-      case "chamber": {
-        const service = (backend as any).service;
-        for (const { formattedKey, value } of entries) {
-          try {
-            execSync(
-              `printf '%s' ${JSON.stringify(value)} | chamber write ${service} ${formattedKey}`,
-              { stdio: "pipe" },
-            );
-            console.log(`  ✓ chamber write ${service} ${formattedKey}`);
-          } catch (err) {
-            console.error(
-              `  ✗ Failed to write ${formattedKey} to chamber:`,
-              err,
-            );
-          }
-        }
-        break;
-      }
-
-      case "sops": {
-        const filePath = (backend as any).filePath;
-        const dir = path.dirname(filePath);
-
-        if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-
-        // Create the SOPS file if it doesn't exist yet
-        if (!fs.existsSync(filePath)) {
-          const initYaml = `_init: true\n`;
-          const tmpPath = `${filePath}.tmp`;
-          fs.writeFileSync(tmpPath, initYaml);
-          try {
-            execSync(`sops --encrypt --in-place "${tmpPath}"`, {
-              stdio: "pipe",
-            });
-            fs.renameSync(tmpPath, filePath);
-            console.log(`  Created new SOPS file: ${filePath}`);
-          } catch (err) {
-            console.error(`  ✗ Failed to create SOPS file:`, err);
-            if (fs.existsSync(tmpPath)) fs.unlinkSync(tmpPath);
-            break;
-          }
-        }
-
-        // Use `sops set` for each key — non-destructive, preserves existing secrets
-        for (const { formattedKey, value } of entries) {
-          try {
-            const jsonPath = JSON.stringify([formattedKey]);
-            const jsonValue = JSON.stringify(value);
-            execSync(`sops set ${JSON.stringify(filePath)} ${JSON.stringify(jsonPath)} ${JSON.stringify(jsonValue)}`, {
-              stdio: "pipe",
-              cwd: ROOT(),
-            });
-            console.log(`  ✓ sops set ${formattedKey} in ${filePath}`);
-          } catch (err) {
-            console.error(
-              `  ✗ Failed to set ${formattedKey} in ${filePath}:`,
-              err,
-            );
-          }
-        }
-
-        // Clean up _init placeholder if it exists
-        try {
-          const decrypted = execSync(`sops decrypt ${JSON.stringify(filePath)}`, {
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"],
-          });
-          if (decrypted.includes("_init:")) {
-            const tmpPath = `${filePath}.tmp`;
-            // Remove _init key via yq, re-encrypt
-            execSync(
-              `sops decrypt ${JSON.stringify(filePath)} | yq 'del(._init)' > "${tmpPath}" && sops --encrypt --in-place "${tmpPath}" && mv "${tmpPath}" ${JSON.stringify(filePath)}`,
-              { stdio: "pipe" },
-            );
-          }
-        } catch {
-          // Non-fatal: _init cleanup is best-effort
-        }
-        break;
-      }
-
-      case "ssm": {
-        const prefix = (backend as any).prefix;
-        const { SSMParameter } = await import("alchemy/aws");
-        const alchemy = await import("alchemy");
-        for (const { formattedKey, value } of entries) {
-          try {
-            await SSMParameter(`infra-output-${formattedKey}`, {
-              name: `${prefix}/${formattedKey}`,
-              value: alchemy.default.secret(value),
-              type: "SecureString",
-              description: `Infrastructure output: ${formattedKey}`,
-              tags: {
-                "managed-by": "stackpanel-infra",
-                module: formattedKey.split("-")[0] ?? "unknown",
-              },
-            });
-            console.log(`  ✓ SSM ${prefix}/${formattedKey}`);
-          } catch (err) {
-            console.error(`  ✗ Failed to write ${formattedKey} to SSM:`, err);
-          }
-        }
-        break;
-      }
-    }
-
-    console.log("[infra] Output sync complete");
-  }
-}
diff --git a/packages/infra/src/resources/ec2-instance.test.ts b/packages/infra/src/resources/ec2-instance.test.ts
deleted file mode 100644
index a72d4a38..00000000
--- a/packages/infra/src/resources/ec2-instance.test.ts
+++ /dev/null
@@ -1,180 +0,0 @@
-// @ts-nocheck
-import { describe, expect, test } from "bun:test";
-import {
-  coerceEc2InstanceState,
-  isEc2InstanceReady,
-  normalizeEc2InstanceProps,
-  requiresEc2InstanceReplacement,
-  shouldReuseEc2InstanceState,
-} from "./ec2-instance";
-
-describe("Ec2Instance replacement planning", () => {
-  test("ignores equivalent props when comparing desired state snapshots", () => {
-    const previous = normalizeEc2InstanceProps({
-      name: "web",
-      ami: "ami-123",
-      instanceType: "t3.small",
-      subnetId: "subnet-123",
-      securityGroupIds: ["sg-123"],
-      iamInstanceProfile: "web-profile",
-      userData: "bootstrap-v1",
-      tags: { Name: "web", Stage: "staging" },
-    });
-
-    const next = normalizeEc2InstanceProps({
-      name: "web",
-      ami: "ami-123",
-      instanceType: "t3.small",
-      subnetId: "subnet-123",
-      securityGroupIds: ["sg-123"],
-      iamInstanceProfile: "web-profile",
-      userData: "bootstrap-v1",
-      tags: { Stage: "staging", Name: "web" },
-    });
-
-    expect(requiresEc2InstanceReplacement(previous, next)).toBe(false);
-  });
-
-  test("replaces when bootstrap user data changes", () => {
-    const previous = normalizeEc2InstanceProps({
-      name: "web",
-      ami: "ami-123",
-      instanceType: "t3.small",
-      subnetId: "subnet-123",
-      securityGroupIds: ["sg-123"],
-      iamInstanceProfile: "web-profile",
-      userData: "bootstrap-v1",
-    });
-
-    const next = normalizeEc2InstanceProps({
-      name: "web",
-      ami: "ami-123",
-      instanceType: "t3.small",
-      subnetId: "subnet-123",
-      securityGroupIds: ["sg-123"],
-      iamInstanceProfile: "web-profile",
-      userData: "bootstrap-v2",
-    });
-
-    expect(requiresEc2InstanceReplacement(previous, next)).toBe(true);
-  });
-
-  test("replaces when network identity changes", () => {
-    const previous = normalizeEc2InstanceProps({
-      name: "web",
-      ami: "ami-123",
-      instanceType: "t3.small",
-      subnetId: "subnet-123",
-      securityGroupIds: ["sg-123"],
-    });
-
-    const next = normalizeEc2InstanceProps({
-      name: "web",
-      ami: "ami-123",
-      instanceType: "t3.small",
-      subnetId: "subnet-123",
-      securityGroupIds: ["sg-456"],
-    });
-
-    expect(requiresEc2InstanceReplacement(previous, next)).toBe(true);
-  });
-
-  test("adopts legacy AWS control output without forcing recreation", () => {
-    const state = coerceEc2InstanceState({
-      id: "i-legacy",
-      PublicIp: "1.2.3.4",
-      PrivateIp: "10.0.0.10",
-      PublicDnsName: "ec2-1-2-3-4.compute.amazonaws.com",
-      desiredState: {
-        ImageId: "ami-123",
-        InstanceType: "t3.small",
-        SubnetId: "subnet-123",
-        SecurityGroupIds: ["sg-123"],
-        IamInstanceProfile: "web-profile",
-        UserData: "bootstrap-v1",
-        BlockDeviceMappings: [
-          {
-            Ebs: {
-              VolumeSize: 20,
-            },
-          },
-        ],
-        Tags: [
-          { Key: "Stage", Value: "staging" },
-          { Key: "Name", Value: "web" },
-        ],
-      },
-    });
-
-    expect(state.instanceId).toBe("i-legacy");
-    expect(state.publicIp).toBe("1.2.3.4");
-    expect(state.publicDns).toBe("ec2-1-2-3-4.compute.amazonaws.com");
-    expect(state.propsSnapshot).toEqual(
-      normalizeEc2InstanceProps({
-        name: "legacy",
-        ami: "ami-123",
-        instanceType: "t3.small",
-        subnetId: "subnet-123",
-        securityGroupIds: ["sg-123"],
-        iamInstanceProfile: "web-profile",
-        userData: "bootstrap-v1",
-        rootVolumeSize: 20,
-        tags: {
-          Name: "web",
-          Stage: "staging",
-        },
-      }),
-    );
-  });
-
-  test("waits for public endpoint details when a public instance is expected", () => {
-    expect(
-      isEc2InstanceReady(
-        {
-          State: { Name: "running" },
-          PublicIpAddress: "1.2.3.4",
-          PublicDnsName: "ec2-1-2-3-4.compute.amazonaws.com",
-        },
-        true,
-      ),
-    ).toBe(true);
-
-    expect(
-      isEc2InstanceReady(
-        {
-          State: { Name: "running" },
-          PublicIpAddress: "1.2.3.4",
-          PublicDnsName: "",
-        },
-        true,
-      ),
-    ).toBe(true);
-
-    expect(
-      isEc2InstanceReady(
-        {
-          State: { Name: "pending" },
-          PublicIpAddress: "1.2.3.4",
-          PublicDnsName: "ec2-1-2-3-4.compute.amazonaws.com",
-        },
-        true,
-      ),
-    ).toBe(false);
-  });
-
-  test("does not reuse prior output during replacement creates", () => {
-    expect(
-      shouldReuseEc2InstanceState("create", {
-        instanceId: "i-old",
-        state: "terminated",
-      }),
-    ).toBe(false);
-
-    expect(
-      shouldReuseEc2InstanceState("update", {
-        instanceId: "i-old",
-        state: "running",
-      }),
-    ).toBe(true);
-  });
-});
diff --git a/packages/infra/src/resources/ec2-instance.ts b/packages/infra/src/resources/ec2-instance.ts
deleted file mode 100644
index 44410aeb..00000000
--- a/packages/infra/src/resources/ec2-instance.ts
+++ /dev/null
@@ -1,238 +0,0 @@
-// =============================================================================
-// ec2-instance.tpl.ts — Custom Alchemy resource for AWS EC2 instances
-//
-// This is the Alchemy resource definition (create / update / delete / replace).
-// Lifecycle decision logic (should we replace? can we adopt legacy state?)
-// lives in ec2-lifecycle.tpl.ts to keep this file focused on AWS API calls.
-//
-// Generated by stackpanel — static library code.
-// =============================================================================
-import type { Context } from "alchemy";
-import { Resource } from "alchemy";
-import {
-  type Ec2Instance,
-  type Ec2InstanceProps,
-  type NormalizedEc2InstanceProps,
-  coerceEc2InstanceState,
-  isEc2InstanceReady,
-  normalizeEc2InstanceProps,
-  requiresEc2InstanceReplacement,
-  shouldReuseEc2InstanceState,
-} from "./ec2-lifecycle";
-
-// Re-export types and helpers so existing imports from this module still work.
-export {
-  type Ec2Instance,
-  type Ec2InstanceProps,
-  type NormalizedEc2InstanceProps,
-  coerceEc2InstanceState,
-  isEc2InstanceReady,
-  normalizeEc2InstanceProps,
-  requiresEc2InstanceReplacement,
-  shouldReuseEc2InstanceState,
-};
-
-// ---- AWS helpers ------------------------------------------------------------
-
-/** Accept either an ARN or a profile name for the RunInstances API. */
-function formatIamInstanceProfile(
-  iamInstanceProfile: string | null | undefined,
-): { Arn: string } | { Name: string } | undefined {
-  if (!iamInstanceProfile) return undefined;
-  return iamInstanceProfile.startsWith("arn:")
-    ? { Arn: iamInstanceProfile }
-    : { Name: iamInstanceProfile };
-}
-
-/** IAM instance profiles take a few seconds to propagate after creation. */
-function isRetryableIamInstanceProfileError(err: unknown): boolean {
-  if (!err || typeof err !== "object") return false;
-  const name = "name" in err ? String((err as { name?: unknown }).name) : "";
-  const message = "message" in err ? String((err as { message?: unknown }).message) : "";
-  return (
-    name === "InvalidParameterValue" &&
-    /iamInstanceProfile\.(arn|name)/i.test(message) &&
-    /Invalid IAM Instance Profile/i.test(message)
-  );
-}
-
-async function runInstancesWithRetry(
-  client: InstanceType<(typeof import("@aws-sdk/client-ec2"))["EC2Client"]>,
-  command: import("@aws-sdk/client-ec2").RunInstancesCommand,
-  attempts = 10,
-): Promise<import("@aws-sdk/client-ec2").RunInstancesCommandOutput> {
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    try {
-      return await client.send(command);
-    } catch (err) {
-      if (!isRetryableIamInstanceProfileError(err) || attempt === attempts - 1) throw err;
-      await new Promise((resolve) => setTimeout(resolve, 3000));
-    }
-  }
-  throw new Error("Unable to create EC2 instance");
-}
-
-/** Poll DescribeInstances until the instance is running (and public, if applicable). */
-async function waitForEc2InstanceDetails(
-  client: InstanceType<(typeof import("@aws-sdk/client-ec2"))["EC2Client"]>,
-  instanceId: string,
-  requirePublicEndpoint: boolean,
-  attempts = 40,
-) {
-  const { DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
-
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    const described = await client.send(
-      new DescribeInstancesCommand({ InstanceIds: [instanceId] }),
-    );
-    const instance = described.Reservations?.[0]?.Instances?.[0];
-    if (isEc2InstanceReady(instance, requirePublicEndpoint)) return instance;
-    await new Promise((resolve) => setTimeout(resolve, 3000));
-  }
-
-  throw new Error(`Timed out waiting for EC2 instance ${instanceId} to become ready`);
-}
-
-/** Diff-apply tags: remove stale keys, upsert current ones. */
-async function syncInstanceTags(
-  client: InstanceType<(typeof import("@aws-sdk/client-ec2"))["EC2Client"]>,
-  instanceId: string,
-  previous: Record<string, string>,
-  next: Record<string, string>,
-) {
-  const { CreateTagsCommand, DeleteTagsCommand } = await import("@aws-sdk/client-ec2");
-
-  const removedKeys = Object.keys(previous).filter((key) => !(key in next));
-  if (removedKeys.length > 0) {
-    await client.send(
-      new DeleteTagsCommand({
-        Resources: [instanceId],
-        Tags: removedKeys.map((Key) => ({ Key })),
-      }),
-    );
-  }
-
-  if (Object.keys(next).length > 0) {
-    await client.send(
-      new CreateTagsCommand({
-        Resources: [instanceId],
-        Tags: Object.entries(next).map(([Key, Value]) => ({ Key, Value })),
-      }),
-    );
-  }
-}
-
-// ---- Alchemy resource -------------------------------------------------------
-
-export const Ec2Instance = Resource(
-  "stackpanel::Ec2Instance",
-  async function (
-    this: Context<Ec2Instance>,
-    _id: string,
-    props: Ec2InstanceProps,
-  ): Promise<Ec2Instance> {
-    const {
-      EC2Client,
-      RunInstancesCommand,
-      TerminateInstancesCommand,
-    } = await import("@aws-sdk/client-ec2");
-
-    const client = new EC2Client({});
-    const propsSnapshot = normalizeEc2InstanceProps(props);
-
-    // Attempt to read legacy Cloud Control state for migration scenarios.
-    const migratedState = coerceEc2InstanceState(this.output);
-    const reusableState = shouldReuseEc2InstanceState(this.phase, migratedState)
-      ? migratedState
-      : {};
-
-    // -- Delete ---------------------------------------------------------------
-    if (this.phase === "delete") {
-      if (props.destroyOnDelete === false) return this.destroy();
-      if (this.output?.instanceId) {
-        await client.send(
-          new TerminateInstancesCommand({ InstanceIds: [this.output.instanceId] }),
-        );
-      }
-      return this.destroy();
-    }
-
-    // -- Replace check --------------------------------------------------------
-    // Compare our stored snapshot against the new desired props.
-    // Only triggers on actual immutable changes, not on AWS's synthetic fields.
-    const previousSnapshot = this.output?.propsSnapshot ?? reusableState.propsSnapshot;
-    if (
-      this.phase === "update" &&
-      previousSnapshot &&
-      requiresEc2InstanceReplacement(previousSnapshot, propsSnapshot)
-    ) {
-      return this.replace();
-    }
-
-    // -- Create or adopt ------------------------------------------------------
-    let instanceId = shouldReuseEc2InstanceState(this.phase, this.output)
-      ? this.output?.instanceId
-      : reusableState.instanceId;
-
-    if (!instanceId) {
-      const run = await runInstancesWithRetry(
-        client,
-        new RunInstancesCommand({
-          ImageId: props.ami,
-          InstanceType: props.instanceType,
-          SubnetId: props.subnetId,
-          SecurityGroupIds: props.securityGroupIds,
-          KeyName: props.keyName ?? undefined,
-          IamInstanceProfile: formatIamInstanceProfile(props.iamInstanceProfile),
-          UserData: props.userData
-            ? Buffer.from(props.userData).toString("base64")
-            : undefined,
-          MinCount: 1,
-          MaxCount: 1,
-          BlockDeviceMappings: props.rootVolumeSize
-            ? [{ DeviceName: "/dev/xvda", Ebs: { VolumeSize: props.rootVolumeSize, VolumeType: "gp3" } }]
-            : undefined,
-          NetworkInterfaces: props.associatePublicIp === false
-            ? [{ DeviceIndex: 0, SubnetId: props.subnetId, Groups: props.securityGroupIds, AssociatePublicIpAddress: false }]
-            : undefined,
-          TagSpecifications: [{
-            ResourceType: "instance",
-            Tags: Object.entries({
-              Name: props.name,
-              ...props.tags,
-              alchemy_stage: this.stage,
-              alchemy_resource: this.id,
-            }).map(([Key, Value]) => ({ Key, Value })),
-          }],
-        }),
-      );
-      instanceId = run.Instances?.[0]?.InstanceId;
-    }
-
-    if (!instanceId) throw new Error(`Unable to create EC2 instance ${props.name}`);
-
-    // -- Tag sync -------------------------------------------------------------
-    if (this.phase === "update") {
-      await syncInstanceTags(client, instanceId, previousSnapshot?.tags ?? {}, propsSnapshot.tags);
-    } else if (Object.keys(propsSnapshot.tags).length > 0) {
-      await syncInstanceTags(client, instanceId, {}, propsSnapshot.tags);
-    }
-
-    // -- Wait for readiness ---------------------------------------------------
-    const instance = await waitForEc2InstanceDetails(
-      client,
-      instanceId,
-      propsSnapshot.associatePublicIp,
-    );
-
-    return {
-      instanceId,
-      publicIp: instance?.PublicIpAddress ?? null,
-      privateIp: instance?.PrivateIpAddress ?? null,
-      publicDns: instance?.PublicDnsName ?? null,
-      state: instance?.State?.Name ?? null,
-      name: props.name,
-      propsSnapshot,
-    };
-  },
-);
diff --git a/packages/infra/src/resources/ec2-lifecycle.ts b/packages/infra/src/resources/ec2-lifecycle.ts
deleted file mode 100644
index c0d1f910..00000000
--- a/packages/infra/src/resources/ec2-lifecycle.ts
+++ /dev/null
@@ -1,246 +0,0 @@
-// =============================================================================
-// ec2-lifecycle.tpl.ts — EC2 instance lifecycle decision helpers
-//
-// Pure functions (no AWS calls) that determine whether an EC2 instance
-// should be replaced, updated, or adopted from legacy state.
-//
-// Key design decision: Alchemy's Cloud Control EC2 provider compares
-// desired state against the live AWS model, which includes synthetic
-// fields like SecurityGroups (by name). That causes false replacements.
-// Instead, this module stores a normalized snapshot of the desired props
-// in Alchemy state and compares snapshot-to-snapshot, ignoring whatever
-// extra fields AWS returns.
-//
-// Generated by stackpanel — static library code.
-// =============================================================================
-
-// ---- Types ------------------------------------------------------------------
-
-export interface Ec2InstanceProps {
-  name: string;
-  ami: string;
-  instanceType: string;
-  subnetId: string;
-  securityGroupIds: string[];
-  keyName?: string | null;
-  iamInstanceProfile?: string | null;
-  userData?: string | null;
-  rootVolumeSize?: number | null;
-  associatePublicIp?: boolean;
-  tags?: Record<string, string>;
-  destroyOnDelete?: boolean;
-}
-
-/** Deterministic representation of EC2 props, used for diffing across deploys. */
-export interface NormalizedEc2InstanceProps {
-  ami: string;
-  instanceType: string;
-  subnetId: string;
-  securityGroupIds: string[];
-  keyName: string | null;
-  iamInstanceProfile: string | null;
-  userData: string | null;
-  rootVolumeSize: number | null;
-  associatePublicIp: boolean;
-  tags: Record<string, string>;
-}
-
-export interface Ec2Instance {
-  instanceId: string;
-  publicIp?: string | null;
-  privateIp?: string | null;
-  publicDns?: string | null;
-  state?: string | null;
-  name: string;
-  /** Stored snapshot of the props that created/last updated this instance. */
-  propsSnapshot: NormalizedEc2InstanceProps;
-}
-
-// ---- Normalization ----------------------------------------------------------
-
-function sortRecord(value: Record<string, string> | undefined): Record<string, string> {
-  return Object.fromEntries(
-    Object.entries(value ?? {}).sort(([left], [right]) => left.localeCompare(right)),
-  );
-}
-
-/**
- * Convert raw Ec2InstanceProps into a deterministic snapshot.
- * Sorts arrays and records so ordering differences don't trigger replacements.
- */
-export function normalizeEc2InstanceProps(
-  props: Ec2InstanceProps,
-): NormalizedEc2InstanceProps {
-  return {
-    ami: props.ami,
-    instanceType: props.instanceType,
-    subnetId: props.subnetId,
-    securityGroupIds: [...props.securityGroupIds].sort(),
-    keyName: props.keyName ?? null,
-    iamInstanceProfile: props.iamInstanceProfile ?? null,
-    userData: props.userData ?? null,
-    rootVolumeSize: props.rootVolumeSize ?? null,
-    associatePublicIp: props.associatePublicIp ?? true,
-    tags: sortRecord(props.tags),
-  };
-}
-
-// ---- Replacement detection --------------------------------------------------
-
-/**
- * Returns true if any immutable property changed between deploys.
- * Tag changes are NOT immutable — they get synced in-place.
- */
-export function requiresEc2InstanceReplacement(
-  previous: NormalizedEc2InstanceProps,
-  next: NormalizedEc2InstanceProps,
-): boolean {
-  return (
-    previous.ami !== next.ami ||
-    previous.instanceType !== next.instanceType ||
-    previous.subnetId !== next.subnetId ||
-    JSON.stringify(previous.securityGroupIds) !== JSON.stringify(next.securityGroupIds) ||
-    previous.keyName !== next.keyName ||
-    previous.iamInstanceProfile !== next.iamInstanceProfile ||
-    previous.userData !== next.userData ||
-    previous.rootVolumeSize !== next.rootVolumeSize ||
-    previous.associatePublicIp !== next.associatePublicIp
-  );
-}
-
-// ---- Legacy state migration -------------------------------------------------
-//
-// When migrating from AWS Cloud Control's EC2 provider (AWS::EC2::Instance)
-// to this custom resource, the Alchemy state file contains CloudFormation-
-// shaped output (PascalCase fields, desiredState blob). These functions
-// coerce that legacy shape into our Ec2Instance type so the resource can
-// adopt the existing instance without forcing a replacement.
-
-/** Convert AWS CloudFormation Tag array [{Key, Value}] to a plain record. */
-function tagsToRecord(value: unknown): Record<string, string> {
-  if (!Array.isArray(value)) return {};
-
-  return Object.fromEntries(
-    value
-      .flatMap((tag) => {
-        if (!tag || typeof tag !== "object") return [];
-        const record = tag as { Key?: unknown; Value?: unknown };
-        if (typeof record.Key !== "string" || typeof record.Value !== "string") return [];
-        return [[record.Key, record.Value] as const];
-      })
-      .sort(([left], [right]) => left.localeCompare(right)),
-  );
-}
-
-/**
- * Best-effort coercion of legacy Cloud Control output into Ec2Instance shape.
- * Falls back gracefully — any field that can't be read is set to null/undefined.
- */
-export function coerceEc2InstanceState(output: unknown): Partial<Ec2Instance> {
-  if (!output || typeof output !== "object") return {};
-
-  const record = output as Record<string, any>;
-  const desiredState =
-    record.desiredState && typeof record.desiredState === "object"
-      ? (record.desiredState as Record<string, any>)
-      : {};
-
-  // Cloud Control nests networking under NetworkInterfaces[0]
-  const networkInterface =
-    desiredState.NetworkInterfaces?.[0] ?? record.NetworkInterfaces?.[0] ?? {};
-  const securityGroupIds =
-    desiredState.SecurityGroupIds ?? networkInterface.GroupSet ?? record.SecurityGroupIds ?? [];
-  const subnetId =
-    desiredState.SubnetId ?? networkInterface.SubnetId ?? record.SubnetId;
-  const ami = desiredState.ImageId ?? record.ImageId;
-  const instanceType = desiredState.InstanceType ?? record.InstanceType;
-
-  let propsSnapshot: NormalizedEc2InstanceProps | undefined;
-  if (
-    typeof ami === "string" &&
-    typeof instanceType === "string" &&
-    typeof subnetId === "string" &&
-    Array.isArray(securityGroupIds)
-  ) {
-    const desiredMappings = desiredState.BlockDeviceMappings ?? record.BlockDeviceMappings ?? [];
-    const rootVolumeSize = desiredMappings?.[0]?.Ebs?.VolumeSize;
-
-    propsSnapshot = normalizeEc2InstanceProps({
-      name: String(record.name ?? "legacy"),
-      ami,
-      instanceType,
-      subnetId,
-      securityGroupIds: securityGroupIds.filter(
-        (value: unknown): value is string => typeof value === "string",
-      ),
-      keyName:
-        typeof (desiredState.KeyName ?? record.KeyName) === "string"
-          ? (desiredState.KeyName ?? record.KeyName) : null,
-      iamInstanceProfile:
-        typeof (desiredState.IamInstanceProfile ?? record.IamInstanceProfile) === "string"
-          ? (desiredState.IamInstanceProfile ?? record.IamInstanceProfile) : null,
-      userData:
-        typeof (desiredState.UserData ?? record.UserData) === "string"
-          ? (desiredState.UserData ?? record.UserData) : null,
-      rootVolumeSize: typeof rootVolumeSize === "number" ? rootVolumeSize : null,
-      associatePublicIp:
-        typeof networkInterface.AssociatePublicIpAddress === "boolean"
-          ? networkInterface.AssociatePublicIpAddress : true,
-      tags: tagsToRecord(desiredState.Tags ?? record.Tags),
-    });
-  }
-
-  return {
-    instanceId:
-      (typeof record.instanceId === "string" ? record.instanceId : null) ??
-      (typeof record.InstanceId === "string" ? record.InstanceId : null) ??
-      (typeof record.id === "string" ? record.id : null) ??
-      undefined,
-    publicIp:
-      (typeof record.publicIp === "string" ? record.publicIp : null) ??
-      (typeof record.PublicIp === "string" ? record.PublicIp : null) ?? null,
-    privateIp:
-      (typeof record.privateIp === "string" ? record.privateIp : null) ??
-      (typeof record.PrivateIp === "string" ? record.PrivateIp : null) ??
-      (typeof record.PrivateIpAddress === "string" ? record.PrivateIpAddress : null) ?? null,
-    publicDns:
-      (typeof record.publicDns === "string" ? record.publicDns : null) ??
-      (typeof record.PublicDnsName === "string" ? record.PublicDnsName : null) ?? null,
-    state:
-      (typeof record.state === "string" ? record.state : null) ??
-      (typeof record.State?.Name === "string" ? record.State.Name : null) ?? null,
-    name: typeof record.name === "string" ? record.name : "legacy",
-    propsSnapshot,
-  };
-}
-
-// ---- Phase guards -----------------------------------------------------------
-
-/**
- * During Alchemy's replace flow, the resource is called in a create-like
- * phase but still receives the OLD (terminated) output. We must not reuse
- * a terminated instance's ID — only update phases should inherit state.
- */
-export function shouldReuseEc2InstanceState(
-  phase: string,
-  output: Partial<Ec2Instance> | null | undefined,
-): boolean {
-  return phase === "update" && Boolean(output?.instanceId);
-}
-
-/**
- * An instance is "ready" when it's running and, for public instances,
- * has been assigned at least an IP or DNS name.
- */
-export function isEc2InstanceReady(
-  instance: {
-    State?: { Name?: string | null } | null;
-    PublicIpAddress?: string | null;
-    PublicDnsName?: string | null;
-  } | null | undefined,
-  requirePublicEndpoint: boolean,
-): boolean {
-  if (instance?.State?.Name !== "running") return false;
-  if (!requirePublicEndpoint) return true;
-  return Boolean(instance.PublicIpAddress || instance.PublicDnsName);
-}
diff --git a/packages/infra/src/resources/iam-instance-profile.ts b/packages/infra/src/resources/iam-instance-profile.ts
deleted file mode 100644
index a7731270..00000000
--- a/packages/infra/src/resources/iam-instance-profile.ts
+++ /dev/null
@@ -1,199 +0,0 @@
-// Custom alchemy Resource for AWS IAM Instance Profile.
-// Generated by stackpanel — static library code.
-import type { Context } from "alchemy";
-import { Resource } from "alchemy";
-
-export interface IamInstanceProfileProps {
-  name: string;
-  roleName: string;
-  tags?: Record<string, string>;
-  destroyOnDelete?: boolean;
-}
-
-export interface IamInstanceProfile {
-  name: string;
-  arn: string;
-  roleName: string;
-  adopted?: boolean;
-}
-
-function isNoSuchEntityError(err: unknown): boolean {
-  if (!err || typeof err !== "object") return false;
-  const name = "name" in err ? String((err as { name?: unknown }).name) : "";
-  return name === "NoSuchEntity" || name === "NoSuchEntityException";
-}
-
-async function getInstanceProfileWithRetry(
-  client: InstanceType<(typeof import("@aws-sdk/client-iam"))["IAMClient"]>,
-  name: string,
-  attempts = 10,
-): Promise<import("@aws-sdk/client-iam").GetInstanceProfileCommandOutput> {
-  const { GetInstanceProfileCommand } = await import("@aws-sdk/client-iam");
-
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    try {
-      return await client.send(
-        new GetInstanceProfileCommand({ InstanceProfileName: name }),
-      );
-    } catch (err) {
-      if (!isNoSuchEntityError(err) || attempt === attempts - 1) {
-        throw err;
-      }
-      await new Promise((resolve) => setTimeout(resolve, 1000));
-    }
-  }
-
-  throw new Error(`Unable to resolve instance profile ${name}`);
-}
-
-async function addRoleToInstanceProfileWithRetry(
-  client: InstanceType<(typeof import("@aws-sdk/client-iam"))["IAMClient"]>,
-  profileName: string,
-  roleName: string,
-  attempts = 10,
-): Promise<void> {
-  const { AddRoleToInstanceProfileCommand } = await import("@aws-sdk/client-iam");
-
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    try {
-      await client.send(
-        new AddRoleToInstanceProfileCommand({
-          InstanceProfileName: profileName,
-          RoleName: roleName,
-        }),
-      );
-      return;
-    } catch (err) {
-      if (!isNoSuchEntityError(err) || attempt === attempts - 1) {
-        throw err;
-      }
-      await new Promise((resolve) => setTimeout(resolve, 1000));
-    }
-  }
-}
-
-export const IamInstanceProfile = Resource(
-  "stackpanel::IamInstanceProfile",
-  async function (
-    this: Context<IamInstanceProfile>,
-    _id: string,
-    props: IamInstanceProfileProps,
-  ): Promise<IamInstanceProfile> {
-    const {
-      IAMClient,
-      GetInstanceProfileCommand,
-      CreateInstanceProfileCommand,
-      AddRoleToInstanceProfileCommand,
-      RemoveRoleFromInstanceProfileCommand,
-      TagInstanceProfileCommand,
-      DeleteInstanceProfileCommand,
-    } = await import("@aws-sdk/client-iam");
-
-    const client = new IAMClient({});
-
-    if (this.phase === "delete") {
-      if (props.destroyOnDelete === false) {
-        return this.destroy();
-      }
-      try {
-        const existing = await client.send(
-          new GetInstanceProfileCommand({ InstanceProfileName: props.name }),
-        );
-        const roles = existing.InstanceProfile?.Roles ?? [];
-        for (const role of roles) {
-          await client.send(
-            new RemoveRoleFromInstanceProfileCommand({
-              InstanceProfileName: props.name,
-              RoleName: role.RoleName!,
-            }),
-          );
-        }
-        await client.send(
-          new DeleteInstanceProfileCommand({ InstanceProfileName: props.name }),
-        );
-      } catch (err: any) {
-        if (!isNoSuchEntityError(err)) throw err;
-      }
-      return this.destroy();
-    }
-
-    let adopted = this.output?.adopted ?? false;
-    let profile = this.output;
-
-    if (profile) {
-      try {
-        const existing = await getInstanceProfileWithRetry(client, props.name, 1);
-        profile = {
-          name: props.name,
-          arn: existing.InstanceProfile?.Arn ?? profile.arn,
-          roleName: props.roleName,
-        };
-      } catch (err) {
-        if (!isNoSuchEntityError(err)) throw err;
-        profile = undefined;
-        adopted = false;
-      }
-    }
-
-    if (!profile) {
-      try {
-        const existing = await client.send(
-          new GetInstanceProfileCommand({ InstanceProfileName: props.name }),
-        );
-        if (existing.InstanceProfile?.Arn) {
-          adopted = true;
-          profile = {
-            name: props.name,
-            arn: existing.InstanceProfile.Arn,
-            roleName: props.roleName,
-          };
-        }
-      } catch (err: any) {
-        if (!isNoSuchEntityError(err)) throw err;
-      }
-    }
-
-    if (!profile) {
-      const created = await client.send(
-        new CreateInstanceProfileCommand({
-          InstanceProfileName: props.name,
-          Tags: props.tags
-            ? Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value }))
-            : undefined,
-        }),
-      );
-      if (!created.InstanceProfile?.Arn) {
-        throw new Error(`Unable to create instance profile ${props.name}`);
-      }
-      profile = {
-        name: props.name,
-        arn: created.InstanceProfile.Arn,
-        roleName: props.roleName,
-      };
-    }
-
-    if (props.tags && Object.keys(props.tags).length > 0) {
-      await client.send(
-        new TagInstanceProfileCommand({
-          InstanceProfileName: props.name,
-          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
-        }),
-      );
-    }
-
-    const current = await getInstanceProfileWithRetry(client, props.name);
-    const existingRoles = new Set(
-      (current.InstanceProfile?.Roles ?? []).map((role) => role.RoleName),
-    );
-    if (!existingRoles.has(props.roleName)) {
-      await addRoleToInstanceProfileWithRetry(client, props.name, props.roleName);
-    }
-
-    return {
-      name: props.name,
-      arn: current.InstanceProfile?.Arn ?? profile.arn,
-      roleName: props.roleName,
-      adopted,
-    };
-  },
-);
diff --git a/packages/infra/src/resources/iam-role.ts b/packages/infra/src/resources/iam-role.ts
deleted file mode 100644
index 60b68a77..00000000
--- a/packages/infra/src/resources/iam-role.ts
+++ /dev/null
@@ -1,152 +0,0 @@
-import type { Context } from "alchemy";
-import { Resource } from "alchemy";
-
-export interface IamInlinePolicy {
-  policyName: string;
-  policyDocument: unknown;
-}
-
-export interface IamRoleProps {
-  roleName: string;
-  assumeRolePolicy: unknown;
-  description?: string;
-  tags?: Record<string, string>;
-  managedPolicyArns?: string[];
-  policies?: IamInlinePolicy[];
-  destroyOnDelete?: boolean;
-}
-
-export interface IamRole extends IamRoleProps {
-  arn: string;
-  adopted?: boolean;
-}
-
-function asPolicyJson(policy: unknown): string {
-  return typeof policy === "string" ? policy : JSON.stringify(policy);
-}
-
-export const IamRole = Resource(
-  "stackpanel::IamRole",
-  async function (
-    this: Context<IamRole>,
-    _id: string,
-    props: IamRoleProps,
-  ): Promise<IamRole> {
-    const {
-      IAMClient,
-      CreateRoleCommand,
-      GetRoleCommand,
-      UpdateAssumeRolePolicyCommand,
-      UpdateRoleDescriptionCommand,
-      TagRoleCommand,
-      ListAttachedRolePoliciesCommand,
-      AttachRolePolicyCommand,
-      PutRolePolicyCommand,
-    } = await import("@aws-sdk/client-iam");
-
-    const client = new IAMClient({});
-
-    if (this.phase === "delete") {
-      return this.destroy();
-    }
-
-    let adopted = this.output?.adopted ?? false;
-
-    const getExistingRole = async () => {
-      try {
-        const existing = await client.send(new GetRoleCommand({ RoleName: props.roleName }));
-        return existing.Role;
-      } catch (err: any) {
-        if (err.name === "NoSuchEntityException") {
-          return undefined;
-        }
-        throw err;
-      }
-    };
-
-    let role = await getExistingRole();
-
-    if (!role) {
-      const created = await client.send(
-        new CreateRoleCommand({
-          RoleName: props.roleName,
-          AssumeRolePolicyDocument: asPolicyJson(props.assumeRolePolicy),
-          Description: props.description,
-          Tags: Object.entries(props.tags ?? {}).map(([Key, Value]) => ({ Key, Value })),
-        }),
-      );
-      role = created.Role;
-    } else {
-      adopted = true;
-    }
-
-    await client.send(
-      new UpdateAssumeRolePolicyCommand({
-        RoleName: props.roleName,
-        PolicyDocument: asPolicyJson(props.assumeRolePolicy),
-      }),
-    );
-
-    if (props.description) {
-      await client.send(
-        new UpdateRoleDescriptionCommand({
-          RoleName: props.roleName,
-          Description: props.description,
-        }),
-      );
-    }
-
-    if (props.tags && Object.keys(props.tags).length > 0) {
-      await client.send(
-        new TagRoleCommand({
-          RoleName: props.roleName,
-          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
-        }),
-      );
-    }
-
-    const managedPolicyArns = props.managedPolicyArns ?? [];
-    if (managedPolicyArns.length > 0) {
-      const attached = await client.send(
-        new ListAttachedRolePoliciesCommand({
-          RoleName: props.roleName,
-        }),
-      );
-      const attachedArns = new Set((attached.AttachedPolicies ?? []).map((policy) => policy.PolicyArn));
-
-      for (const arn of managedPolicyArns) {
-        if (!attachedArns.has(arn)) {
-          await client.send(
-            new AttachRolePolicyCommand({
-              RoleName: props.roleName,
-              PolicyArn: arn,
-            }),
-          );
-        }
-      }
-    }
-
-    for (const policy of props.policies ?? []) {
-      await client.send(
-        new PutRolePolicyCommand({
-          RoleName: props.roleName,
-          PolicyName: policy.policyName,
-          PolicyDocument: asPolicyJson(policy.policyDocument),
-        }),
-      );
-    }
-
-    const finalRole = await client.send(new GetRoleCommand({ RoleName: props.roleName }));
-    const finalArn = finalRole.Role?.Arn ?? role?.Arn;
-
-    if (!finalArn) {
-      throw new Error(`Unable to resolve ARN for IAM role ${props.roleName}`);
-    }
-
-    return {
-      ...props,
-      arn: finalArn,
-      adopted,
-    };
-  },
-);
diff --git a/packages/infra/src/resources/key-pair.ts b/packages/infra/src/resources/key-pair.ts
deleted file mode 100644
index 6bcf4061..00000000
--- a/packages/infra/src/resources/key-pair.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-// Custom alchemy Resource for AWS Key Pair.
-// Generated by stackpanel — static library code.
-import type { Context } from "alchemy";
-import { Resource } from "alchemy";
-
-export interface KeyPairProps {
-  keyName: string;
-  publicKey: string;
-  tags?: Record<string, string>;
-  destroyOnDelete?: boolean;
-}
-
-export interface KeyPair {
-  keyName: string;
-  keyPairId?: string;
-  adopted?: boolean;
-}
-
-function hasTags(tags: Record<string, string> | undefined): tags is Record<string, string> {
-  return Boolean(tags && Object.keys(tags).length > 0);
-}
-
-export const KeyPair = Resource(
-  "stackpanel::KeyPair",
-  async function (
-    this: Context<KeyPair>,
-    _id: string,
-    props: KeyPairProps,
-  ): Promise<KeyPair> {
-    const {
-      EC2Client,
-      DescribeKeyPairsCommand,
-      ImportKeyPairCommand,
-      CreateTagsCommand,
-      DeleteKeyPairCommand,
-    } = await import("@aws-sdk/client-ec2");
-
-    const client = new EC2Client({});
-
-    if (this.phase === "delete") {
-      if (props.destroyOnDelete === false) {
-        return this.destroy();
-      }
-
-      try {
-        await client.send(new DeleteKeyPairCommand({ KeyName: props.keyName }));
-      } catch (err: any) {
-        if (err.name !== "InvalidKeyPair.NotFound") throw err;
-      }
-
-      return this.destroy();
-    }
-
-    let adopted = this.output?.adopted ?? false;
-    let keyPairId = this.output?.keyPairId;
-
-    try {
-      const existing = await client.send(
-        new DescribeKeyPairsCommand({ KeyNames: [props.keyName] }),
-      );
-      const found = existing.KeyPairs?.[0];
-      if (found?.KeyPairId) {
-        adopted = true;
-        keyPairId = found.KeyPairId;
-      }
-    } catch (err: any) {
-      if (err.name !== "InvalidKeyPair.NotFound") throw err;
-    }
-
-    if (!keyPairId) {
-      const imported = await client.send(
-        new ImportKeyPairCommand({
-          KeyName: props.keyName,
-          PublicKeyMaterial: Buffer.from(props.publicKey),
-          TagSpecifications: hasTags(props.tags)
-            ? [
-                {
-                  ResourceType: "key-pair",
-                  Tags: Object.entries(props.tags).map(([Key, Value]) => ({
-                    Key,
-                    Value,
-                  })),
-                },
-              ]
-            : undefined,
-        }),
-      );
-      keyPairId = imported.KeyPairId;
-    } else if (hasTags(props.tags)) {
-      await client.send(
-        new CreateTagsCommand({
-          Resources: [keyPairId],
-          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
-        }),
-      );
-    }
-
-    return {
-      keyName: props.keyName,
-      keyPairId,
-      adopted,
-    };
-  },
-);
diff --git a/packages/infra/src/resources/security-group.ts b/packages/infra/src/resources/security-group.ts
deleted file mode 100644
index a82581f7..00000000
--- a/packages/infra/src/resources/security-group.ts
+++ /dev/null
@@ -1,181 +0,0 @@
-// Custom alchemy Resource for AWS Security Group.
-// Generated by stackpanel — static library code.
-import type { Context } from "alchemy";
-import { Resource } from "alchemy";
-
-export interface SecurityGroupRule {
-  fromPort: number;
-  toPort: number;
-  protocol: string;
-  cidrBlocks?: string[];
-  ipv6CidrBlocks?: string[];
-  securityGroupIds?: string[];
-  description?: string;
-}
-
-export interface SecurityGroupProps {
-  name: string;
-  description?: string;
-  vpcId: string;
-  ingress?: SecurityGroupRule[];
-  egress?: SecurityGroupRule[];
-  tags?: Record<string, string>;
-  destroyOnDelete?: boolean;
-}
-
-export interface SecurityGroup {
-  groupId: string;
-  name: string;
-  adopted?: boolean;
-}
-
-export const SecurityGroup = Resource(
-  "stackpanel::SecurityGroup",
-  async function (
-    this: Context<SecurityGroup>,
-    _id: string,
-    props: SecurityGroupProps,
-  ): Promise<SecurityGroup> {
-    const {
-      EC2Client,
-      CreateSecurityGroupCommand,
-      DescribeSecurityGroupsCommand,
-      AuthorizeSecurityGroupIngressCommand,
-      AuthorizeSecurityGroupEgressCommand,
-      CreateTagsCommand,
-      DeleteSecurityGroupCommand,
-    } = await import("@aws-sdk/client-ec2");
-
-    const client = new EC2Client({});
-
-    if (this.phase === "delete") {
-      if (props.destroyOnDelete === false) {
-        return this.destroy();
-      }
-
-      if (this.output?.groupId) {
-        try {
-          await client.send(
-            new DeleteSecurityGroupCommand({ GroupId: this.output.groupId }),
-          );
-        } catch (err: any) {
-          if (err.name !== "InvalidGroup.NotFound") throw err;
-        }
-      }
-      return this.destroy();
-    }
-
-    let groupId = this.output?.groupId;
-    let adopted = this.output?.adopted ?? false;
-
-    if (!groupId) {
-      const existing = await client.send(
-        new DescribeSecurityGroupsCommand({
-          Filters: [
-            { Name: "group-name", Values: [props.name] },
-            { Name: "vpc-id", Values: [props.vpcId] },
-          ],
-        }),
-      );
-      const found = existing.SecurityGroups?.[0];
-      if (found?.GroupId) {
-        groupId = found.GroupId;
-        adopted = true;
-      }
-    }
-
-    if (!groupId) {
-      const created = await client.send(
-        new CreateSecurityGroupCommand({
-          GroupName: props.name,
-          Description: props.description ?? props.name,
-          VpcId: props.vpcId,
-        }),
-      );
-      groupId = created.GroupId;
-    }
-
-    if (!groupId) {
-      throw new Error(`Unable to resolve security group id for ${props.name}`);
-    }
-
-    if (props.tags && Object.keys(props.tags).length > 0) {
-      await client.send(
-        new CreateTagsCommand({
-          Resources: [groupId],
-          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
-        }),
-      );
-    }
-
-    const ingressRules = props.ingress ?? [];
-    if (ingressRules.length > 0) {
-      try {
-        await client.send(
-          new AuthorizeSecurityGroupIngressCommand({
-            GroupId: groupId,
-            IpPermissions: ingressRules.map((rule) => ({
-              IpProtocol: rule.protocol,
-              FromPort: rule.fromPort,
-              ToPort: rule.toPort,
-              IpRanges: (rule.cidrBlocks ?? []).map((CidrIp) => ({
-                CidrIp,
-                Description: rule.description,
-              })),
-              Ipv6Ranges: (rule.ipv6CidrBlocks ?? []).map((CidrIpv6) => ({
-                CidrIpv6,
-                Description: rule.description,
-              })),
-              UserIdGroupPairs: (rule.securityGroupIds ?? []).map((GroupId) => ({
-                GroupId,
-                Description: rule.description,
-              })),
-            })),
-          }),
-        );
-      } catch (err: any) {
-        if (err.name !== "InvalidPermission.Duplicate") {
-          throw err;
-        }
-      }
-    }
-
-    const egressRules = props.egress ?? [];
-    if (egressRules.length > 0) {
-      try {
-        await client.send(
-          new AuthorizeSecurityGroupEgressCommand({
-            GroupId: groupId,
-            IpPermissions: egressRules.map((rule) => ({
-              IpProtocol: rule.protocol,
-              FromPort: rule.fromPort,
-              ToPort: rule.toPort,
-              IpRanges: (rule.cidrBlocks ?? []).map((CidrIp) => ({
-                CidrIp,
-                Description: rule.description,
-              })),
-              Ipv6Ranges: (rule.ipv6CidrBlocks ?? []).map((CidrIpv6) => ({
-                CidrIpv6,
-                Description: rule.description,
-              })),
-              UserIdGroupPairs: (rule.securityGroupIds ?? []).map((GroupId) => ({
-                GroupId,
-                Description: rule.description,
-              })),
-            })),
-          }),
-        );
-      } catch (err: any) {
-        if (err.name !== "InvalidPermission.Duplicate") {
-          throw err;
-        }
-      }
-    }
-
-    return {
-      groupId,
-      name: props.name,
-      adopted,
-    };
-  },
-);
diff --git a/packages/infra/src/stacks/env.ts b/packages/infra/src/stacks/env.ts
deleted file mode 100644
index 506dd3fe..00000000
--- a/packages/infra/src/stacks/env.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import type { AlchemyOptions, Phase } from "alchemy";
-import alchemy from "alchemy";
-import { CloudflareStateStore } from "alchemy/state";
-
-export const CLOUDFLARE_EMAIL = alchemy.env.CLOUDFLARE_EMAIL;
-
-export const CLOUDFLARE_ACCOUNT_ID = alchemy.env.CLOUDFLARE_ACCOUNT_ID;
-
-export const CLOUDFLARE_API_KEY = alchemy.secret.env.CLOUDFLARE_API_KEY;
-
-export const STRIPE_API_KEY = alchemy.secret.env.STRIPE_API_KEY;
-
-export const OPENAI_API_KEY = alchemy.secret.env.OPENAI_API_KEY;
-
-export const NEON_API_KEY = alchemy.secret.env.NEON_API_KEY;
-
-export const UPSTASH_API_KEY = alchemy.secret.env.UPSTASH_API_KEY;
-
-export default {
-  stage: process.env.BRANCH_PREFIX || "prod",
-  phase:
-    (process.env.ALCHEMY_PHASE as Phase) ??
-    (process.argv.includes("--destroy")
-      ? "destroy"
-      : process.argv.includes("--read")
-        ? "read"
-        : "up"),
-  // pass the password in (you can get it from anywhere, e.g. stdin)
-  password: process.env.SECRET_PASSPHRASE,
-  quiet: process.argv.includes("--quiet"),
-  stateStore: (scope) => new CloudflareStateStore(scope),
-} satisfies AlchemyOptions;
diff --git a/packages/infra/src/stacks/repo.run.ts b/packages/infra/src/stacks/repo.run.ts
deleted file mode 100644
index 84c3b88f..00000000
--- a/packages/infra/src/stacks/repo.run.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-// ensure providers are registered (for deletion purposes)
-import "alchemy/aws";
-import "alchemy/aws/oidc";
-import "alchemy/cloudflare";
-import "alchemy/os";
-
-import alchemy from "alchemy";
-import { AccountId, Role, SSMParameter } from "alchemy/aws";
-import { GitHubOIDCProvider } from "alchemy/aws/oidc";
-import { AccountApiToken, R2Bucket } from "alchemy/cloudflare";
-import { GitHubSecret, RepositoryEnvironment } from "alchemy/github";
-import env, {
-  CLOUDFLARE_ACCOUNT_ID,
-  CLOUDFLARE_API_KEY,
-  CLOUDFLARE_EMAIL,
-  NEON_API_KEY,
-  OPENAI_API_KEY,
-  STRIPE_API_KEY,
-  UPSTASH_API_KEY,
-} from "./env.ts";
-
-const app = await alchemy("alchemy:repo", env);
-
-const awsAccountId = await AccountId();
-
-const githubRole = await Role("github-oidc-role", {
-  roleName: "alchemy-github-oidc-role",
-  assumeRolePolicy: {
-    Version: "2012-10-17",
-    Statement: [
-      {
-        Sid: "GitHubOIDC",
-        Effect: "Allow",
-        Principal: {
-          Federated: `arn:aws:iam::${awsAccountId}:oidc-provider/token.actions.githubusercontent.com`,
-        },
-        Action: "sts:AssumeRoleWithWebIdentity",
-        Condition: {
-          StringEquals: {
-            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-          },
-          StringLike: {
-            "token.actions.githubusercontent.com:sub":
-              "repo:alchemy-run/alchemy:*",
-          },
-        },
-      },
-    ],
-  },
-  // TODO: probably scope this down
-  managedPolicyArns: ["arn:aws:iam::aws:policy/AdministratorAccess"],
-});
-
-const stateStore = await R2Bucket("state-store", {
-  name: "alchemy-state-store",
-  adopt: true,
-});
-
-const testEnvironment = await RepositoryEnvironment("test environment", {
-  owner: "alchemy-run",
-  repository: "alchemy",
-  name: "test",
-  reviewers: {
-    users: ["alchemy-run"],
-  },
-});
-
-const accountAccessToken = await AccountApiToken("account-access-token", {
-  name: "alchemy-account-access-token",
-  policies: [
-    {
-      effect: "allow",
-      permissionGroups: ["Workers R2 Storage Write"],
-      resources: {
-        "com.cloudflare.api.account": "*",
-      },
-    },
-  ],
-});
-
-const secrets = {
-  AWS_ROLE_ARN: githubRole.arn,
-  CLOUDFLARE_ACCOUNT_ID,
-  CLOUDFLARE_API_KEY,
-  CLOUDFLARE_EMAIL,
-  STRIPE_API_KEY,
-  OPENAI_API_KEY,
-  NEON_API_KEY,
-  CLOUDFLARE_BUCKET_NAME: stateStore.name,
-  R2_ACCESS_KEY_ID: accountAccessToken.accessKeyId,
-  R2_SECRET_ACCESS_KEY: accountAccessToken.secretAccessKey,
-  SECRET_PASSPHRASE: alchemy.secret(process.env.SECRET_PASSPHRASE!),
-  UPSTASH_API_KEY,
-  UPSTASH_EMAIL: "sam@alchemy.run",
-  SENTRY_AUTH_TOKEN: alchemy.secret.env.SENTRY_AUTH_TOKEN,
-  SENTRY_ORG: alchemy.secret.env.SENTRY_ORG,
-  VERCEL_ACCESS_TOKEN: alchemy.secret.env.VERCEL_ACCESS_TOKEN,
-  ALCHEMY_PASSWORD: alchemy.secret.env.ALCHEMY_PASSWORD,
-  NPM_TOKEN: alchemy.secret.env.NPM_TOKEN,
-  ALCHEMY_STATE_TOKEN: alchemy.secret.env.ALCHEMY_STATE_TOKEN,
-  ANTHROPIC_API_KEY: alchemy.secret.env.ANTHROPIC_API_KEY,
-  PLANETSCALE_ORG_ID: alchemy.secret.env.PLANETSCALE_ORG_ID,
-  PLANETSCALE_API_TOKEN: alchemy.secret.env.PLANETSCALE_API_TOKEN,
-  SENTRY_DSN: alchemy.secret.env.SENTRY_DSN,
-};
-
-await Promise.all([
-  GitHubOIDCProvider("github-oidc", {
-    owner: "alchemy-run",
-    repository: "alchemy",
-    roleArn: githubRole.arn,
-  }),
-  SSMParameter("github-ci-secrets", {
-    name: "/alchemy/github-ci-secrets",
-    type: "SecureString",
-    value: alchemy.secret(
-      JSON.stringify(
-        Object.fromEntries(
-          Object.entries(secrets).map(([name, value]) => [
-            name,
-            typeof value === "string" ? value : value.unencrypted,
-          ]),
-        ),
-      ),
-    ),
-  }),
-  ...Object.entries(secrets).flatMap(async ([name, value]) => {
-    const props = {
-      owner: "alchemy-run",
-      repository: "alchemy",
-      name,
-      value: typeof value === "string" ? alchemy.secret(value) : value!,
-    };
-    return [
-      GitHubSecret(`github-secret-${name}`, {
-        ...props,
-        environment: testEnvironment.name,
-      }),
-      GitHubSecret(`github-repo-secret-${name}`, props),
-    ];
-  }),
-]);
-
-await app.finalize();
diff --git a/packages/infra/src/types.ts b/packages/infra/src/types.ts
deleted file mode 100644
index 2ff0f1e4..00000000
--- a/packages/infra/src/types.ts
+++ /dev/null
@@ -1,556 +0,0 @@
-// Generated by stackpanel — do not edit manually.
-// TypeScript interfaces for infra module inputs.
-
-export interface AwsEc2AppInputs {
-  apps: {
-  docs: {
-  alb: {
-  certificateArn: any;
-  create: boolean;
-  enable: boolean;
-  existingListenerHttpArn: any;
-  existingListenerHttpsArn: any;
-  hostRulePriority: number;
-  hostnames: string[];
-  http: boolean;
-  https: boolean;
-  ipAddressType: string;
-  name: any;
-  scheme: string;
-  securityGroupIds: string[];
-  sslPolicy: string;
-  subnetIds: string[];
-  targetGroup: {
-  healthCheck: {
-  enabled: boolean;
-  healthyThreshold: number;
-  interval: number;
-  matcher: string;
-  path: string;
-  port: any;
-  protocol: string;
-  timeout: number;
-  unhealthyThreshold: number;
-};
-  port: number;
-  protocol: string;
-};
-};
-  ami: any;
-  associatePublicIp: boolean;
-  ecr: {
-  create: boolean;
-  enable: boolean;
-  github: {
-  allowTags: boolean;
-  allowedBranches: string[];
-  allowedWorkflows: string[];
-  createOidcProvider: boolean;
-  enable: boolean;
-  oidcProviderArn: any;
-  repoName: any;
-  repoOwner: any;
-  roleName: any;
-};
-  imageTagMutability: string;
-  lifecyclePolicy: any;
-  repoName: any;
-  scanOnPush: boolean;
-};
-  iam: {
-  assumeRolePolicy: any;
-  enable: boolean;
-  inlinePolicies: string[];
-  instanceProfileName: any;
-  instanceProfileTags: {
-
-};
-  managedPolicyArns: string[];
-  roleName: string;
-  tags: {
-
-};
-};
-  iamInstanceProfile: any;
-  instanceCount: number;
-  instanceType: string;
-  instances: string[];
-  keyName: any;
-  keyPair: {
-  create: boolean;
-  destroyOnDelete: boolean;
-  name: any;
-  publicKey: any;
-  tags: {
-
-};
-};
-  machine: {
-  arch: any;
-  roles: string[];
-  ssh: {
-  keyPath: any;
-  port: number;
-  user: string;
-};
-  tags: string[];
-  targetEnv: string;
-};
-  nixos: {
-  amiId: any;
-  flakeUrl: any;
-  flakeVersion: string;
-  hostConfig: any;
-};
-  osType: string;
-  rootVolumeSize: any;
-  securityGroup: {
-  create: boolean;
-  description: any;
-  egress: string[];
-  ingress: string[];
-  name: any;
-  tags: {
-
-};
-};
-  securityGroupIds: string[];
-  ssm: {
-  enable: boolean;
-  envFilePath: any;
-  installCli: boolean;
-  parameters: {
-
-};
-  pathPrefix: any;
-  refreshScriptPath: any;
-  region: any;
-  secureParameters: {
-
-};
-  useChamber: boolean;
-};
-  subnetIds: string[];
-  tags: {
-  managedBy: string;
-  name: string;
-};
-  userData: any;
-  vpcId: any;
-};
-  stackpanelStaging: {
-  alb: {
-  certificateArn: any;
-  create: boolean;
-  enable: boolean;
-  existingListenerHttpArn: any;
-  existingListenerHttpsArn: any;
-  hostRulePriority: number;
-  hostnames: string[];
-  http: boolean;
-  https: boolean;
-  ipAddressType: string;
-  name: any;
-  scheme: string;
-  securityGroupIds: string[];
-  sslPolicy: string;
-  subnetIds: string[];
-  targetGroup: {
-  healthCheck: {
-  enabled: boolean;
-  healthyThreshold: number;
-  interval: number;
-  matcher: string;
-  path: string;
-  port: any;
-  protocol: string;
-  timeout: number;
-  unhealthyThreshold: number;
-};
-  port: number;
-  protocol: string;
-};
-};
-  ami: any;
-  associatePublicIp: boolean;
-  ecr: {
-  create: boolean;
-  enable: boolean;
-  github: {
-  allowTags: boolean;
-  allowedBranches: string[];
-  allowedWorkflows: string[];
-  createOidcProvider: boolean;
-  enable: boolean;
-  oidcProviderArn: any;
-  repoName: any;
-  repoOwner: any;
-  roleName: any;
-};
-  imageTagMutability: string;
-  lifecyclePolicy: any;
-  repoName: any;
-  scanOnPush: boolean;
-};
-  iam: {
-  assumeRolePolicy: any;
-  enable: boolean;
-  inlinePolicies: string[];
-  instanceProfileName: any;
-  instanceProfileTags: {
-
-};
-  managedPolicyArns: string[];
-  roleName: string;
-  tags: {
-
-};
-};
-  iamInstanceProfile: any;
-  instanceCount: number;
-  instanceType: string;
-  instances: string[];
-  keyName: any;
-  keyPair: {
-  create: boolean;
-  destroyOnDelete: boolean;
-  name: string;
-  publicKey: string;
-  tags: {
-
-};
-};
-  machine: {
-  arch: any;
-  roles: string[];
-  ssh: {
-  keyPath: any;
-  port: number;
-  user: string;
-};
-  tags: string[];
-  targetEnv: string;
-};
-  nixos: {
-  amiId: any;
-  flakeUrl: any;
-  flakeVersion: string;
-  hostConfig: any;
-};
-  osType: string;
-  rootVolumeSize: any;
-  securityGroup: {
-  create: boolean;
-  description: any;
-  egress: string[];
-  ingress: string[];
-  name: any;
-  tags: {
-
-};
-};
-  securityGroupIds: string[];
-  ssm: {
-  enable: boolean;
-  envFilePath: any;
-  installCli: boolean;
-  parameters: {
-
-};
-  pathPrefix: any;
-  refreshScriptPath: any;
-  region: any;
-  secureParameters: {
-
-};
-  useChamber: boolean;
-};
-  subnetIds: string[];
-  tags: {
-  managedBy: string;
-  name: string;
-};
-  userData: any;
-  vpcId: any;
-};
-};
-  defaults: {
-  alb: {
-  certificateArn: any;
-  create: boolean;
-  enable: boolean;
-  existingListenerHttpArn: any;
-  existingListenerHttpsArn: any;
-  hostRulePriority: number;
-  hostnames: string[];
-  http: boolean;
-  https: boolean;
-  ipAddressType: string;
-  name: any;
-  scheme: string;
-  securityGroupIds: string[];
-  sslPolicy: string;
-  subnetIds: string[];
-  targetGroup: {
-  healthCheck: {
-  enabled: boolean;
-  healthyThreshold: number;
-  interval: number;
-  matcher: string;
-  path: string;
-  port: any;
-  protocol: string;
-  timeout: number;
-  unhealthyThreshold: number;
-};
-  port: number;
-  protocol: string;
-};
-};
-  ami: any;
-  associatePublicIp: boolean;
-  ecr: {
-  create: boolean;
-  enable: boolean;
-  github: {
-  allowTags: boolean;
-  allowedBranches: string[];
-  allowedWorkflows: string[];
-  createOidcProvider: boolean;
-  enable: boolean;
-  oidcProviderArn: any;
-  repoName: any;
-  repoOwner: any;
-  roleName: any;
-};
-  imageTagMutability: string;
-  lifecyclePolicy: any;
-  repoName: any;
-  scanOnPush: boolean;
-};
-  iam: {
-  assumeRolePolicy: any;
-  enable: boolean;
-  inlinePolicies: string[];
-  instanceProfileName: any;
-  instanceProfileTags: {
-
-};
-  managedPolicyArns: string[];
-  roleName: any;
-  tags: {
-
-};
-};
-  iamInstanceProfile: any;
-  instanceCount: number;
-  instanceType: any;
-  instances: string[];
-  keyName: any;
-  keyPair: {
-  create: boolean;
-  destroyOnDelete: boolean;
-  name: any;
-  publicKey: any;
-  tags: {
-
-};
-};
-  machine: {
-  arch: any;
-  roles: string[];
-  ssh: {
-  keyPath: any;
-  port: number;
-  user: string;
-};
-  tags: string[];
-  targetEnv: any;
-};
-  nixos: {
-  amiId: any;
-  flakeUrl: any;
-  flakeVersion: string;
-  hostConfig: any;
-};
-  osType: string;
-  rootVolumeSize: any;
-  securityGroup: {
-  create: boolean;
-  description: any;
-  egress: string[];
-  ingress: string[];
-  name: any;
-  tags: {
-
-};
-};
-  securityGroupIds: string[];
-  ssm: {
-  enable: boolean;
-  envFilePath: any;
-  installCli: boolean;
-  parameters: {
-
-};
-  pathPrefix: any;
-  refreshScriptPath: any;
-  region: any;
-  secureParameters: {
-
-};
-  useChamber: boolean;
-};
-  subnetIds: string[];
-  tags: {
-
-};
-  userData: any;
-  vpcId: any;
-};
-}
-
-export interface AwsSecretsInputs {
-  accountId: string;
-  iam: {
-  additionalPolicies: string[];
-  roleName: string;
-};
-  kms: {
-  alias: string;
-  deletionWindowDays: number;
-};
-  oidc: {
-  flyio: {
-  appName: string;
-  orgId: string;
-};
-  githubActions: {
-  branch: string;
-  org: string;
-  repo: string;
-};
-  provider: string;
-  rolesAnywhere: {
-  trustAnchorArn: string;
-};
-};
-  projectName: string;
-  region: string;
-  ssm: {
-  additionalPaths: string[];
-  enable: boolean;
-  groupPaths: string[];
-  keyPrefix: string;
-};
-}
-
-export interface DatabaseInputs {
-  devenv: {
-  database: string;
-  host: string;
-  password: string;
-  port: number;
-  user: string;
-};
-  docker: {
-  image: string;
-  network: string;
-  password: string;
-  port: number;
-  tag: string;
-  user: string;
-};
-  name: string;
-  neon: {
-  apiKeySsmPath: string;
-  enableBranching: boolean;
-  pgVersion: number;
-  region: string;
-};
-  projectName: string;
-  provider: string;
-  ssm: {
-  enable: boolean;
-  pathPrefix: string;
-};
-}
-
-export interface DeploymentInputs {
-  apps: {
-  docs: {
-  bindings: string[];
-  cloudflare: {
-  compatibility: string;
-  route: any;
-  workerName: string;
-};
-  framework: string;
-  host: string;
-  output: string;
-  path: string;
-  secrets: string[];
-};
-  web: {
-  aws: {
-  availabilityZone: any;
-  httpCidrBlocks: string[];
-  imageId: any;
-  instanceType: any;
-  keyName: any;
-  osType: string;
-  parameterPath: any;
-  port: any;
-  region: string;
-  rootVolumeSize: any;
-  sshCidrBlocks: string[];
-  subnetCidrBlock: any;
-  tags: {
-
-};
-  vpcCidrBlock: any;
-};
-  bindings: string[];
-  framework: string;
-  host: string;
-  path: string;
-  secrets: string[];
-};
-};
-  aws: {
-  artifact: {
-  bucket: any;
-  keyPrefix: string;
-};
-  instanceType: string;
-  port: number;
-  region: string;
-};
-  cloudflare: {
-  compatibilityDate: string;
-  defaultRoute: any;
-};
-}
-
-export interface MachinesInputs {
-  aws: {
-  envTagKeys: string[];
-  filters: string[];
-  hostPreference: string[];
-  instanceIds: string[];
-  nameTagKeys: string[];
-  region: string;
-  roleTagKeys: string[];
-  ssh: {
-  keyPath: any;
-  port: number;
-  user: string;
-};
-  tagKeys: string[];
-};
-  machines: {
-
-};
-  source: string;
-}
-
diff --git a/packages/infra/sst.config.ts b/packages/infra/sst.config.ts
deleted file mode 100644
index 06cd1d8f..00000000
--- a/packages/infra/sst.config.ts
+++ /dev/null
@@ -1,211 +0,0 @@
-/// <reference path="./.sst/platform/config.d.ts" />
-
-/**
- * SST Configuration for Stackpanel Infrastructure
- *
- * This configures:
- * 1. OIDC provider for GitHub Actions
- * 2. IAM role for secrets access
- * 3. KMS key for secrets encryption/decryption
- *
- * Generated by stackpanel - do not edit manually.
- * Regenerate with: nix run .#generate
- */
-
-// ===========================================================================
-// Interpolated values from Nix configuration
-// ===========================================================================
-const projectName = "stackpanel";
-const awsRegion = "us-west-2";
-
-export default $config({
-  app(input) {
-    return {
-      name: projectName,
-      removal: input?.stage === "production" ? "retain" : "remove",
-      protect: ["production"].includes(input?.stage ?? ""),
-      home: "aws",
-      providers: {
-        aws: {
-          region: awsRegion,
-        },
-      },
-    };
-  },
-
-  async run() {
-// syntax: ts
-// ========================================================================
-// GitHub Actions OIDC Provider
-// ========================================================================
-const githubOrg = "darkmatter";
-const githubRepo = "stackpanel";
-
-// Check if GitHub OIDC provider already exists (it's a singleton per account)
-const existingOidcArn = `arn:aws:iam::950224716579:oidc-provider/token.actions.githubusercontent.com`;
-
-// Use aws.iam.OpenIdConnectProvider.get to adopt existing provider
-// This avoids the "EntityAlreadyExists" error when the provider was created outside SST
-const githubOidcProvider = aws.iam.OpenIdConnectProvider.get("github-oidc", existingOidcArn);
-
-const oidcProviderArn = githubOidcProvider.arn;
-const oidcProviderUrl = "token.actions.githubusercontent.com";
-const oidcConditions = [
-  {
-    test: "StringEquals",
-    variable: `${oidcProviderUrl}:aud`,
-    values: ["sts.amazonaws.com"],
-  },
-  {
-    test: "StringLike",
-    variable: `${oidcProviderUrl}:sub`,
-    values: [`repo:${githubOrg}/${githubRepo}:*`],
-  },
-];
-
-// syntax: ts
-// ========================================================================
-// IAM Role for OIDC Authentication
-// ========================================================================
-const roleName = "stackpanel-secrets-role";
-
-const secretsRole = new aws.iam.Role(roleName, {
-  name: roleName,
-  assumeRolePolicy: aws.iam.getPolicyDocumentOutput({
-    statements: [{
-      effect: "Allow",
-      principals: [{
-        type: "Federated",
-        identifiers: [oidcProviderArn],
-      }],
-      actions: ["sts:AssumeRoleWithWebIdentity"],
-      conditions: oidcConditions,
-    }],
-  }).json,
-  tags: {
-    Name: roleName,
-    Environment: $app.stage,
-    ManagedBy: "sst",
-  },
-});
-
-// syntax: ts
-// ========================================================================
-// KMS Key for Secrets Encryption
-// ========================================================================
-const kmsAlias = "stackpanel-secrets";
-const kmsDeletionDays = 30;
-const awsAccountId = "950224716579";
-
-const secretsKey = new aws.kms.Key(kmsAlias, {
-  description: "KMS key for encrypting stackpanel secrets",
-  enableKeyRotation: true,
-  deletionWindowInDays: kmsDeletionDays,
-  policy: aws.iam.getPolicyDocumentOutput({
-    statements: [
-      // Allow root account full access
-      {
-        effect: "Allow",
-        principals: [{
-          type: "AWS",
-          identifiers: [`arn:aws:iam::${awsAccountId}:root`],
-        }],
-        actions: ["kms:*"],
-        resources: ["*"],
-      },
-      // Allow the secrets role to use the key
-      {
-        effect: "Allow",
-        principals: [{
-          type: "AWS",
-          identifiers: [secretsRole.arn],
-        }],
-        actions: [
-          "kms:Decrypt",
-          "kms:Encrypt",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey",
-        ],
-        resources: ["*"],
-      },
-    ],
-  }).json,
-  tags: {
-    Name: kmsAlias,
-    Environment: $app.stage,
-    ManagedBy: "sst",
-  },
-});
-
-const secretsKeyAlias = new aws.kms.Alias(`${kmsAlias}-alias`, {
-  name: `alias/${kmsAlias}`,
-  targetKeyId: secretsKey.id,
-});
-
-// syntax: ts
-// ========================================================================
-// IAM Policy for KMS Access
-// ========================================================================
-new aws.iam.RolePolicy(`${roleName}-kms`, {
-  name: `${roleName}-kms-policy`,
-  role: secretsRole.id,
-  policy: aws.iam.getPolicyDocumentOutput({
-    statements: [
-      {
-        effect: "Allow",
-        actions: [
-          "kms:Decrypt",
-          "kms:Encrypt",
-          "kms:GenerateDataKey*",
-          "kms:DescribeKey",
-        ],
-        resources: [secretsKey.arn],
-      },
-      {
-        effect: "Allow",
-        actions: ["kms:Decrypt"],
-        resources: ["*"],
-        conditions: [
-          {
-            test: "StringLike",
-            variable: "kms:RequestAlias",
-            values: [`alias/${kmsAlias}`],
-          },
-        ],
-      },
-    ],
-  }).json,
-});
-
-    // ========================================================================
-    // Outputs
-    // ========================================================================
-    const providerType = "github-actions";
-    const providerDisplayName = "GitHub Actions";
-
-    return {
-      roleArn: secretsRole.arn,
-      roleName: secretsRole.name,
-      kmsKeyArn: secretsKey.arn,
-kmsKeyId: secretsKey.id,
-kmsKeyAlias: secretsKeyAlias.name,
-oidcProviderArn: githubOidcProvider.arn,
-provider: providerType,
-      setupInstructions: $interpolate`
-╔════════════════════════════════════════════════════════════════════╗
-║ Stackpanel Infrastructure Setup Complete                           ║
-╚════════════════════════════════════════════════════════════════════╝
-
-Role ARN: ${secretsRole.arn}
-KMS Key Alias: alias/${kmsAlias}
-
-Provider: ${providerDisplayName}
-
-To use this infrastructure:
-1. Configure your secrets with the KMS key
-2. Use the IAM role for decryption in your applications
-`,
-    };
-
-  },
-});
diff --git a/packages/infra/tsconfig.json b/packages/infra/tsconfig.json
deleted file mode 100644
index d40fda1a..00000000
--- a/packages/infra/tsconfig.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "compilerOptions": {
-    "declaration": true,
-    "declarationMap": true,
-    "esModuleInterop": true,
-    "forceConsistentCasingInFileNames": true,
-    "module": "ES2022",
-    "moduleResolution": "bundler",
-    "outDir": "./dist",
-    "resolveJsonModule": true,
-    "rootDir": ".",
-    "skipLibCheck": true,
-    "strict": true,
-    "target": "ES2022"
-  },
-  "exclude": [
-    "node_modules",
-    "dist",
-    ".alchemy"
-  ],
-  "include": [
-    "src/**/*.ts",
-    "modules/**/*.ts",
-    "alchemy.run.ts"
-  ]
-}
diff --git a/packages/scripts/entrypoints/.gitkeep b/packages/scripts/entrypoints/.gitkeep
deleted file mode 100644
index 0b502486..00000000
--- a/packages/scripts/entrypoints/.gitkeep
+++ /dev/null
@@ -1 +0,0 @@
-# Generated entrypoints will be placed here by stackpanel
diff --git a/packages/scripts/entrypoints/docs.sh b/packages/scripts/entrypoints/docs.sh
deleted file mode 100755
index c501a1f0..00000000
--- a/packages/scripts/entrypoints/docs.sh
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-# Auto-generated entrypoint for docs
-# Generated by stackpanel - do not edit manually
-# Regenerate by entering the devshell: nix develop --impure
-#
-# This script ONLY sets up environment variables. It does NOT run commands.
-# Source this script, then run your command:
-#
-#   source packages/scripts/entrypoints/docs.sh --dev
-#   bun run dev
-#
-# Or inline:
-#   source packages/scripts/entrypoints/docs.sh --dev && bun run dev
-# ==============================================================================
-
-# Prevent execution - this script should only be sourced
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  echo "[ERROR] This script should be sourced, not executed directly." >&2
-  echo "Usage: source $0 [--dev] [--env <env>] [--no-secrets]" >&2
-  exit 1
-fi
-
-# Find script directory and source common library
-_ENTRYPOINT_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-_ENTRYPOINT_LIB_DIR="$(dirname "$_ENTRYPOINT_SCRIPT_DIR")/lib"
-
-if [[ -f "$_ENTRYPOINT_LIB_DIR/common.sh" ]]; then
-  source "$_ENTRYPOINT_LIB_DIR/common.sh"
-else
-  echo "[ERROR] Could not find common.sh at $_ENTRYPOINT_LIB_DIR/common.sh" >&2
-  return 1
-fi
-
-# ==============================================================================
-# App Configuration (from Nix)
-# ==============================================================================
-
-export STACKPANEL_APP_NAME="docs"
-export STACKPANEL_APP_PATH="apps/docs"
-export STACKPANEL_VARIABLES_BACKEND="sops"
-
-export STACKPANEL_MASTER_KEYS='{"local":{"age-pub":"","ref":"ref+file://.stack/keys/local.txt","resolve-cmd":null}}'
-
-# ==============================================================================
-# Argument Parsing
-# ==============================================================================
-
-_ENTRYPOINT_DEV_MODE=false
-_ENTRYPOINT_ENVIRONMENT=""
-_ENTRYPOINT_SKIP_SECRETS=false
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --dev)
-      _ENTRYPOINT_DEV_MODE=true
-      shift
-      ;;
-    --env)
-      _ENTRYPOINT_ENVIRONMENT="$2"
-      shift 2
-      ;;
-    --no-secrets)
-      _ENTRYPOINT_SKIP_SECRETS=true
-      shift
-      ;;
-    *)
-      # Ignore unknown args (they're for the command, not for us)
-      shift
-      ;;
-  esac
-done
-
-# Set default environment
-if [[ -z "$_ENTRYPOINT_ENVIRONMENT" ]]; then
-  if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-    _ENTRYPOINT_ENVIRONMENT="dev"
-  else
-    _ENTRYPOINT_ENVIRONMENT="prod"
-  fi
-fi
-
-# Export environment for downstream use
-export STACKPANEL_ENVIRONMENT="$_ENTRYPOINT_ENVIRONMENT"
-export STACKPANEL_DEV_MODE="$_ENTRYPOINT_DEV_MODE"
-
-log_debug "Entrypoint: docs"
-log_debug "Environment: $_ENTRYPOINT_ENVIRONMENT"
-log_debug "Dev mode: $_ENTRYPOINT_DEV_MODE"
-
-# ==============================================================================
-# Environment Setup
-# ==============================================================================
-
-_ENTRYPOINT_PROJECT_ROOT=$(find_project_root) || { log_error "Could not find project root"; return 1; }
-export STACKPANEL_PROJECT_ROOT="$_ENTRYPOINT_PROJECT_ROOT"
-
-# Dev mode: ensure devshell environment
-if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-  ensure_devshell || { log_error "Failed to set up devshell"; return 1; }
-fi
-
-# Load secrets (unless skipped)
-if [[ "$_ENTRYPOINT_SKIP_SECRETS" != "true" ]] && [[ "${STACKPANEL_NO_SECRETS:-}" != "1" ]]; then
-  load_secrets "$STACKPANEL_APP_NAME" "$_ENTRYPOINT_ENVIRONMENT" || log_warn "Secrets loading failed, continuing anyway"
-fi
-
-# ==============================================================================
-# Done - environment is now set up
-# ==============================================================================
-
-log_debug "Entrypoint complete - environment ready for docs"
-
-# Clean up internal variables (keep exported ones)
-unset _ENTRYPOINT_SCRIPT_DIR _ENTRYPOINT_LIB_DIR
-unset _ENTRYPOINT_DEV_MODE _ENTRYPOINT_ENVIRONMENT _ENTRYPOINT_SKIP_SECRETS
-unset _ENTRYPOINT_PROJECT_ROOT
diff --git a/packages/scripts/entrypoints/server.sh b/packages/scripts/entrypoints/server.sh
deleted file mode 100755
index e50355d4..00000000
--- a/packages/scripts/entrypoints/server.sh
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-# Auto-generated entrypoint for server
-# Generated by stackpanel - do not edit manually
-# Regenerate by entering the devshell: nix develop --impure
-#
-# This script ONLY sets up environment variables. It does NOT run commands.
-# Source this script, then run your command:
-#
-#   source packages/scripts/entrypoints/server.sh --dev
-#   bun run dev
-#
-# Or inline:
-#   source packages/scripts/entrypoints/server.sh --dev && bun run dev
-# ==============================================================================
-
-# Prevent execution - this script should only be sourced
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  echo "[ERROR] This script should be sourced, not executed directly." >&2
-  echo "Usage: source $0 [--dev] [--env <env>] [--no-secrets]" >&2
-  exit 1
-fi
-
-# Find script directory and source common library
-_ENTRYPOINT_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-_ENTRYPOINT_LIB_DIR="$(dirname "$_ENTRYPOINT_SCRIPT_DIR")/lib"
-
-if [[ -f "$_ENTRYPOINT_LIB_DIR/common.sh" ]]; then
-  source "$_ENTRYPOINT_LIB_DIR/common.sh"
-else
-  echo "[ERROR] Could not find common.sh at $_ENTRYPOINT_LIB_DIR/common.sh" >&2
-  return 1
-fi
-
-# ==============================================================================
-# App Configuration (from Nix)
-# ==============================================================================
-
-export STACKPANEL_APP_NAME="server"
-export STACKPANEL_APP_PATH="apps/server"
-export STACKPANEL_VARIABLES_BACKEND="chamber"
-export STACKPANEL_CHAMBER_SERVICE_PREFIX="stackpanel"
-export STACKPANEL_MASTER_KEYS='{"local":{"age-pub":"","ref":"ref+file://.stack/keys/local.txt","resolve-cmd":null}}'
-
-# ==============================================================================
-# Argument Parsing
-# ==============================================================================
-
-_ENTRYPOINT_DEV_MODE=false
-_ENTRYPOINT_ENVIRONMENT=""
-_ENTRYPOINT_SKIP_SECRETS=false
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --dev)
-      _ENTRYPOINT_DEV_MODE=true
-      shift
-      ;;
-    --env)
-      _ENTRYPOINT_ENVIRONMENT="$2"
-      shift 2
-      ;;
-    --no-secrets)
-      _ENTRYPOINT_SKIP_SECRETS=true
-      shift
-      ;;
-    *)
-      # Ignore unknown args (they're for the command, not for us)
-      shift
-      ;;
-  esac
-done
-
-# Set default environment
-if [[ -z "$_ENTRYPOINT_ENVIRONMENT" ]]; then
-  if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-    _ENTRYPOINT_ENVIRONMENT="dev"
-  else
-    _ENTRYPOINT_ENVIRONMENT="prod"
-  fi
-fi
-
-# Export environment for downstream use
-export STACKPANEL_ENVIRONMENT="$_ENTRYPOINT_ENVIRONMENT"
-export STACKPANEL_DEV_MODE="$_ENTRYPOINT_DEV_MODE"
-
-log_debug "Entrypoint: server"
-log_debug "Environment: $_ENTRYPOINT_ENVIRONMENT"
-log_debug "Dev mode: $_ENTRYPOINT_DEV_MODE"
-
-# ==============================================================================
-# Environment Setup
-# ==============================================================================
-
-_ENTRYPOINT_PROJECT_ROOT=$(find_project_root) || { log_error "Could not find project root"; return 1; }
-export STACKPANEL_PROJECT_ROOT="$_ENTRYPOINT_PROJECT_ROOT"
-
-# Dev mode: ensure devshell environment
-if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-  ensure_devshell || { log_error "Failed to set up devshell"; return 1; }
-fi
-
-# Load secrets (unless skipped)
-if [[ "$_ENTRYPOINT_SKIP_SECRETS" != "true" ]] && [[ "${STACKPANEL_NO_SECRETS:-}" != "1" ]]; then
-  load_secrets "$STACKPANEL_APP_NAME" "$_ENTRYPOINT_ENVIRONMENT" || log_warn "Secrets loading failed, continuing anyway"
-fi
-
-# ==============================================================================
-# Done - environment is now set up
-# ==============================================================================
-
-log_debug "Entrypoint complete - environment ready for server"
-
-# Clean up internal variables (keep exported ones)
-unset _ENTRYPOINT_SCRIPT_DIR _ENTRYPOINT_LIB_DIR
-unset _ENTRYPOINT_DEV_MODE _ENTRYPOINT_ENVIRONMENT _ENTRYPOINT_SKIP_SECRETS
-unset _ENTRYPOINT_PROJECT_ROOT
diff --git a/packages/scripts/entrypoints/stackpanel-go.sh b/packages/scripts/entrypoints/stackpanel-go.sh
deleted file mode 100755
index 384e984a..00000000
--- a/packages/scripts/entrypoints/stackpanel-go.sh
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-# Auto-generated entrypoint for stackpanel-go
-# Generated by stackpanel - do not edit manually
-# Regenerate by entering the devshell: nix develop --impure
-#
-# This script ONLY sets up environment variables. It does NOT run commands.
-# Source this script, then run your command:
-#
-#   source packages/scripts/entrypoints/stackpanel-go.sh --dev
-#   bun run dev
-#
-# Or inline:
-#   source packages/scripts/entrypoints/stackpanel-go.sh --dev && bun run dev
-# ==============================================================================
-
-# Prevent execution - this script should only be sourced
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  echo "[ERROR] This script should be sourced, not executed directly." >&2
-  echo "Usage: source $0 [--dev] [--env <env>] [--no-secrets]" >&2
-  exit 1
-fi
-
-# Find script directory and source common library
-_ENTRYPOINT_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-_ENTRYPOINT_LIB_DIR="$(dirname "$_ENTRYPOINT_SCRIPT_DIR")/lib"
-
-if [[ -f "$_ENTRYPOINT_LIB_DIR/common.sh" ]]; then
-  source "$_ENTRYPOINT_LIB_DIR/common.sh"
-else
-  echo "[ERROR] Could not find common.sh at $_ENTRYPOINT_LIB_DIR/common.sh" >&2
-  return 1
-fi
-
-# ==============================================================================
-# App Configuration (from Nix)
-# ==============================================================================
-
-export STACKPANEL_APP_NAME="stackpanel-go"
-export STACKPANEL_APP_PATH="apps/stackpanel-go"
-export STACKPANEL_VARIABLES_BACKEND="sops"
-
-export STACKPANEL_MASTER_KEYS='{"local":{"age-pub":"","ref":"ref+file://.stack/keys/local.txt","resolve-cmd":null}}'
-
-# ==============================================================================
-# Argument Parsing
-# ==============================================================================
-
-_ENTRYPOINT_DEV_MODE=false
-_ENTRYPOINT_ENVIRONMENT=""
-_ENTRYPOINT_SKIP_SECRETS=false
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --dev)
-      _ENTRYPOINT_DEV_MODE=true
-      shift
-      ;;
-    --env)
-      _ENTRYPOINT_ENVIRONMENT="$2"
-      shift 2
-      ;;
-    --no-secrets)
-      _ENTRYPOINT_SKIP_SECRETS=true
-      shift
-      ;;
-    *)
-      # Ignore unknown args (they're for the command, not for us)
-      shift
-      ;;
-  esac
-done
-
-# Set default environment
-if [[ -z "$_ENTRYPOINT_ENVIRONMENT" ]]; then
-  if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-    _ENTRYPOINT_ENVIRONMENT="dev"
-  else
-    _ENTRYPOINT_ENVIRONMENT="prod"
-  fi
-fi
-
-# Export environment for downstream use
-export STACKPANEL_ENVIRONMENT="$_ENTRYPOINT_ENVIRONMENT"
-export STACKPANEL_DEV_MODE="$_ENTRYPOINT_DEV_MODE"
-
-log_debug "Entrypoint: stackpanel-go"
-log_debug "Environment: $_ENTRYPOINT_ENVIRONMENT"
-log_debug "Dev mode: $_ENTRYPOINT_DEV_MODE"
-
-# ==============================================================================
-# Environment Setup
-# ==============================================================================
-
-_ENTRYPOINT_PROJECT_ROOT=$(find_project_root) || { log_error "Could not find project root"; return 1; }
-export STACKPANEL_PROJECT_ROOT="$_ENTRYPOINT_PROJECT_ROOT"
-
-# Dev mode: ensure devshell environment
-if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-  ensure_devshell || { log_error "Failed to set up devshell"; return 1; }
-fi
-
-# Load secrets (unless skipped)
-if [[ "$_ENTRYPOINT_SKIP_SECRETS" != "true" ]] && [[ "${STACKPANEL_NO_SECRETS:-}" != "1" ]]; then
-  load_secrets "$STACKPANEL_APP_NAME" "$_ENTRYPOINT_ENVIRONMENT" || log_warn "Secrets loading failed, continuing anyway"
-fi
-
-# ==============================================================================
-# Done - environment is now set up
-# ==============================================================================
-
-log_debug "Entrypoint complete - environment ready for stackpanel-go"
-
-# Clean up internal variables (keep exported ones)
-unset _ENTRYPOINT_SCRIPT_DIR _ENTRYPOINT_LIB_DIR
-unset _ENTRYPOINT_DEV_MODE _ENTRYPOINT_ENVIRONMENT _ENTRYPOINT_SKIP_SECRETS
-unset _ENTRYPOINT_PROJECT_ROOT
diff --git a/packages/scripts/entrypoints/web.sh b/packages/scripts/entrypoints/web.sh
deleted file mode 100755
index 212fcd15..00000000
--- a/packages/scripts/entrypoints/web.sh
+++ /dev/null
@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-# ==============================================================================
-# Auto-generated entrypoint for web
-# Generated by stackpanel - do not edit manually
-# Regenerate by entering the devshell: nix develop --impure
-#
-# This script ONLY sets up environment variables. It does NOT run commands.
-# Source this script, then run your command:
-#
-#   source packages/scripts/entrypoints/web.sh --dev
-#   bun run dev
-#
-# Or inline:
-#   source packages/scripts/entrypoints/web.sh --dev && bun run dev
-# ==============================================================================
-
-# Prevent execution - this script should only be sourced
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  echo "[ERROR] This script should be sourced, not executed directly." >&2
-  echo "Usage: source $0 [--dev] [--env <env>] [--no-secrets]" >&2
-  exit 1
-fi
-
-# Find script directory and source common library
-_ENTRYPOINT_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-_ENTRYPOINT_LIB_DIR="$(dirname "$_ENTRYPOINT_SCRIPT_DIR")/lib"
-
-if [[ -f "$_ENTRYPOINT_LIB_DIR/common.sh" ]]; then
-  source "$_ENTRYPOINT_LIB_DIR/common.sh"
-else
-  echo "[ERROR] Could not find common.sh at $_ENTRYPOINT_LIB_DIR/common.sh" >&2
-  return 1
-fi
-
-# ==============================================================================
-# App Configuration (from Nix)
-# ==============================================================================
-
-export STACKPANEL_APP_NAME="web"
-export STACKPANEL_APP_PATH="apps/web"
-export STACKPANEL_VARIABLES_BACKEND="sops"
-
-export STACKPANEL_MASTER_KEYS='{"local":{"age-pub":"","ref":"ref+file://.stack/keys/local.txt","resolve-cmd":null}}'
-
-# ==============================================================================
-# Argument Parsing
-# ==============================================================================
-
-_ENTRYPOINT_DEV_MODE=false
-_ENTRYPOINT_ENVIRONMENT=""
-_ENTRYPOINT_SKIP_SECRETS=false
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --dev)
-      _ENTRYPOINT_DEV_MODE=true
-      shift
-      ;;
-    --env)
-      _ENTRYPOINT_ENVIRONMENT="$2"
-      shift 2
-      ;;
-    --no-secrets)
-      _ENTRYPOINT_SKIP_SECRETS=true
-      shift
-      ;;
-    *)
-      # Ignore unknown args (they're for the command, not for us)
-      shift
-      ;;
-  esac
-done
-
-# Set default environment
-if [[ -z "$_ENTRYPOINT_ENVIRONMENT" ]]; then
-  if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-    _ENTRYPOINT_ENVIRONMENT="dev"
-  else
-    _ENTRYPOINT_ENVIRONMENT="prod"
-  fi
-fi
-
-# Export environment for downstream use
-export STACKPANEL_ENVIRONMENT="$_ENTRYPOINT_ENVIRONMENT"
-export STACKPANEL_DEV_MODE="$_ENTRYPOINT_DEV_MODE"
-
-log_debug "Entrypoint: web"
-log_debug "Environment: $_ENTRYPOINT_ENVIRONMENT"
-log_debug "Dev mode: $_ENTRYPOINT_DEV_MODE"
-
-# ==============================================================================
-# Environment Setup
-# ==============================================================================
-
-_ENTRYPOINT_PROJECT_ROOT=$(find_project_root) || { log_error "Could not find project root"; return 1; }
-export STACKPANEL_PROJECT_ROOT="$_ENTRYPOINT_PROJECT_ROOT"
-
-# Dev mode: ensure devshell environment
-if [[ "$_ENTRYPOINT_DEV_MODE" == "true" ]]; then
-  ensure_devshell || { log_error "Failed to set up devshell"; return 1; }
-fi
-
-# Load secrets (unless skipped)
-if [[ "$_ENTRYPOINT_SKIP_SECRETS" != "true" ]] && [[ "${STACKPANEL_NO_SECRETS:-}" != "1" ]]; then
-  load_secrets "$STACKPANEL_APP_NAME" "$_ENTRYPOINT_ENVIRONMENT" || log_warn "Secrets loading failed, continuing anyway"
-fi
-
-# ==============================================================================
-# Done - environment is now set up
-# ==============================================================================
-
-log_debug "Entrypoint complete - environment ready for web"
-
-# Clean up internal variables (keep exported ones)
-unset _ENTRYPOINT_SCRIPT_DIR _ENTRYPOINT_LIB_DIR
-unset _ENTRYPOINT_DEV_MODE _ENTRYPOINT_ENVIRONMENT _ENTRYPOINT_SKIP_SECRETS
-unset _ENTRYPOINT_PROJECT_ROOT

From 72d02b02b8b332aba215ae10cedd90d341c8d4ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 20:34:52 +0200
Subject: [PATCH 08/13] Fix package.json would be incorrectly escaped

---
 apps/stackpanel-go/internal/fileops/apply.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/apps/stackpanel-go/internal/fileops/apply.go b/apps/stackpanel-go/internal/fileops/apply.go
index 32e1795c..32a6886e 100644
--- a/apps/stackpanel-go/internal/fileops/apply.go
+++ b/apps/stackpanel-go/internal/fileops/apply.go
@@ -519,12 +519,14 @@ func loadJSONObject(path string) (map[string]any, bool, error) {
 }
 
 func writeCanonicalJSON(path string, doc map[string]any, mode string) (bool, error) {
-	data, err := json.MarshalIndent(doc, "", "  ")
-	if err != nil {
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetIndent("", "  ")
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(doc); err != nil {
 		return false, fmt.Errorf("fileops: marshal %s: %w", path, err)
 	}
-	data = append(data, '\n')
-	return writeBytes(path, data, mode)
+	return writeBytes(path, buf.Bytes(), mode)
 }
 
 // writeBytes writes content to path, returning false if the file already has

From 7ef9c5b05f01414367dc5fac5ae965be72638bba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Mon, 30 Mar 2026 21:53:17 +0200
Subject: [PATCH 09/13] Add colmena and nixos-anywhere to environment when
 deployment

---
 .stack/nix/default.nix                   | 10 +++++-----
 nix/stackpanel/modules/deploy/module.nix | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/.stack/nix/default.nix b/.stack/nix/default.nix
index 095ced74..b0c267d1 100644
--- a/.stack/nix/default.nix
+++ b/.stack/nix/default.nix
@@ -43,11 +43,11 @@ in
       inputs.namaka.packages.${pkgs.system}.default
     ];
 
-    # Runtime dependencies of `stackpanel` CLI.
-    # Declaring them as runtimeInputs has two effects:
-    #   1. nix build .#stackpanel-go → binary is wrapped so it finds these tools
-    #      at their Nix store paths, no PATH setup required.
-    #   2. devshell → tools are in PATH for `go run .` and interactive use.
+    # Wrap the stackpanel-go binary so it finds colmena and nixos-anywhere at
+    # their Nix store paths even outside of a devshell (e.g. nix run / nix build).
+    # The deploy module separately injects these into the devshell of any repo
+    # that configures a NixOS deployment backend, so users don't need to add them
+    # manually in their own .stack/nix/.
     #
     # Use pkgs.colmena (from nixpkgs, binary-cached) for the CLI tool.
     # The flake input's colmena.lib.makeHive is only needed at eval time
diff --git a/nix/stackpanel/modules/deploy/module.nix b/nix/stackpanel/modules/deploy/module.nix
index 13a8d67b..fe198b03 100644
--- a/nix/stackpanel/modules/deploy/module.nix
+++ b/nix/stackpanel/modules/deploy/module.nix
@@ -22,6 +22,7 @@
 {
   lib,
   config,
+  pkgs,
   ...
 }:
 let
@@ -50,6 +51,15 @@ let
     && builtins.elem (app.deployment.backend or "colmena") nixosBackends
     && (app.deployment.targets or []) != []
   ) cfg.apps;
+
+  # Any app with a NixOS backend configured (even without targets yet).
+  # Used to gate devshell package injection so users don't get colmena/
+  # nixos-anywhere unless they actually intend to do NixOS deployments.
+  hasNixosBackend = lib.any (
+    app:
+    (app.deployment.enable or false)
+    && builtins.elem (app.deployment.backend or "colmena") nixosBackends
+  ) (lib.attrValues cfg.apps);
 in
 {
   # ===========================================================================
@@ -263,6 +273,16 @@ in
     };
   };
 
+  # ===========================================================================
+  # Inject colmena + nixos-anywhere into the devshell when any app uses a
+  # NixOS deployment backend.  This ensures `stackpanel deploy` and
+  # `stackpanel provision` work in any repo without manual configuration.
+  # ===========================================================================
+  config.stackpanel.devshell.packages = lib.optionals hasNixosBackend [
+    pkgs.colmena
+    pkgs.nixos-anywhere
+  ];
+
   # ===========================================================================
   # Compute stackpanel.nixosModules from apps with NixOS backends
   # ===========================================================================

From 217c041c6a48145eff8d861eab776f092d3d22b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Tue, 31 Mar 2026 01:41:05 +0200
Subject: [PATCH 10/13] Fix repo root when used outside of stackpanel itself

---
 nix/stackpanel/modules/bun/module.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nix/stackpanel/modules/bun/module.nix b/nix/stackpanel/modules/bun/module.nix
index 75b03273..5d4f1e1f 100644
--- a/nix/stackpanel/modules/bun/module.nix
+++ b/nix/stackpanel/modules/bun/module.nix
@@ -45,6 +45,7 @@
   lib,
   config,
   pkgs,
+  self,
   ...
 }: let
   meta = import ./meta.nix;
@@ -100,7 +101,7 @@
     # repoRoot resolves to the flake's store path at eval time (not the working
     # directory). In a Nix flake, relative paths in .nix files are anchored to
     # the file's location in the store copy of the source tree.
-    repoRoot = ../../../..;
+    repoRoot = self.outPath;
 
     # ---------------------------------------------------------------------------
     # Layout selection: per-app vs. workspace

From 6d59449efa0f278a5b4765c176a982c165f5d3e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Tue, 31 Mar 2026 02:10:09 +0200
Subject: [PATCH 11/13] Adapt more paths

---
 nix/stackpanel/modules/app-commands/module.nix  | 3 ++-
 nix/stackpanel/modules/ci-formatters/module.nix | 3 ++-
 nix/stackpanel/modules/go/module.nix            | 9 +++++----
 nix/stackpanel/services/portless.nix            | 3 ++-
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/nix/stackpanel/modules/app-commands/module.nix b/nix/stackpanel/modules/app-commands/module.nix
index 2d341d0f..7df45528 100644
--- a/nix/stackpanel/modules/app-commands/module.nix
+++ b/nix/stackpanel/modules/app-commands/module.nix
@@ -36,6 +36,7 @@
   lib,
   config,
   pkgs,
+  self,
   ...
 }: let
   meta = import ./meta.nix;
@@ -210,7 +211,7 @@
   # Build a check derivation (runs command and fails if non-zero exit)
   mkCheckDerivation = appName: appCfg: cmdName: cmdCfg: let
     appPath = appCfg.path or ".";
-    repoRoot = ../../../..;
+    repoRoot = self.outPath;
     envExports = lib.concatStringsSep "\n" (
       lib.mapAttrsToList (k: v: "export ${k}=${lib.escapeShellArg v}") (cmdCfg.env or {})
     );
diff --git a/nix/stackpanel/modules/ci-formatters/module.nix b/nix/stackpanel/modules/ci-formatters/module.nix
index 132e1edd..87c283f4 100644
--- a/nix/stackpanel/modules/ci-formatters/module.nix
+++ b/nix/stackpanel/modules/ci-formatters/module.nix
@@ -8,13 +8,14 @@
   lib,
   config,
   pkgs,
+  self,
   ...
 }:
 let
   meta = import ./meta.nix;
   cfg = config.stackpanel;
   appsComputed = cfg.appsComputed or { };
-  repoRoot = ../../../..;
+  repoRoot = self.outPath;
 
   formatters = lib.flatten (
     lib.mapAttrsToList (_: app: app.wrappedTooling.formatters or [ ]) appsComputed
diff --git a/nix/stackpanel/modules/go/module.nix b/nix/stackpanel/modules/go/module.nix
index 5e19aadc..4d2cd685 100644
--- a/nix/stackpanel/modules/go/module.nix
+++ b/nix/stackpanel/modules/go/module.nix
@@ -49,6 +49,7 @@
   lib,
   config,
   pkgs,
+  self,
   ...
 }:
 let
@@ -208,7 +209,7 @@ let
     name: app:
     let
       goCfg = app.go;
-      repoRoot = ../../../..;
+      repoRoot = self.outPath;
       generatedFiles = mkGeneratedFiles name app;
     in
     pkgs.runCommand "${name}-src-with-generated" { } ''
@@ -268,7 +269,7 @@ let
     name: app:
     let
       goCfg = app.go;
-      repoRoot = ../../../..;
+      repoRoot = self.outPath;
       appPath = app.path;
 
       # Check if app has its own go.mod (per-app layout)
@@ -344,7 +345,7 @@ let
     name: app:
     let
       goCfg = app.go;
-      repoRoot = ../../../..;
+      repoRoot = self.outPath;
       appPath = app.path;
 
       # Check if app has its own go.mod (per-app layout)
@@ -369,7 +370,7 @@ let
     name: app:
     let
       goCfg = app.go;
-      repoRoot = ../../../..;
+      repoRoot = self.outPath;
     in
     pkgs.runCommand "${name}-tests"
       {
diff --git a/nix/stackpanel/services/portless.nix b/nix/stackpanel/services/portless.nix
index 4d93afa9..e5358c70 100644
--- a/nix/stackpanel/services/portless.nix
+++ b/nix/stackpanel/services/portless.nix
@@ -35,12 +35,13 @@
   pkgs,
   lib,
   config,
+  self,
   ...
 }:
 let
   cfg = config.stackpanel.portless;
   stepCfg = config.stackpanel.step-ca or { enable = false; };
-  repoRoot = ../../..;
+  repoRoot = self.outPath;
 
   # Import util for debug logging
   util = config.stackpanel.util;

From 2cee46fc809442c63b0902f4ebd10ca8b8d3b78e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Tue, 31 Mar 2026 02:12:20 +0200
Subject: [PATCH 12/13] Reluctantly restore packages/infra

---
 .gitignore                                    |    1 -
 nix/stackpanel/infra/codegen.nix              |    2 -
 packages/infra/.gitkeep                       |    0
 packages/infra/.stack/keys/local.pub          |    1 +
 packages/infra/README.md                      |   99 ++
 packages/infra/alchemy.run.ts                 |   59 +
 packages/infra/deployment-check.run.ts        |   15 +
 packages/infra/deployment-scope-check.run.ts  |   15 +
 packages/infra/fly/web/fly.toml               |   33 +
 .../infra/modules/aws-ec2-app.helpers.test.ts |  104 ++
 packages/infra/modules/aws-ec2-app.helpers.ts |   95 ++
 packages/infra/modules/aws-ec2-app.ts         | 1051 +++++++++++++++++
 packages/infra/modules/aws-ec2-deploy.ts      |  497 ++++++++
 packages/infra/modules/aws-secrets.ts         |  249 ++++
 packages/infra/modules/aws-secrets/index.ts   |   85 ++
 .../infra/modules/aws-secrets/policies.ts     |  147 +++
 packages/infra/modules/database.ts            |  229 ++++
 packages/infra/modules/deployment-plan.ts     |  107 ++
 .../infra/modules/deployment/artifact.test.ts |   50 +
 packages/infra/modules/deployment/artifact.ts |   50 +
 .../modules/deployment/aws-ec2-deploy.test.ts |   48 +
 .../modules/deployment/aws-ec2-deploy.ts      |  349 ++++++
 .../modules/deployment/aws-ec2-userdata.ts    |  160 +++
 packages/infra/modules/deployment/index.ts    |  471 ++++++++
 .../infra/modules/deployment/plan.test.ts     |   43 +
 packages/infra/modules/deployment/plan.ts     |  134 +++
 packages/infra/modules/machines.ts            |  192 +++
 packages/infra/package.json                   |   41 +
 packages/infra/package.json.backup            |   41 +
 packages/infra/src/alchemy.ts                 |  471 ++++++++
 packages/infra/src/index.test.ts              |   84 ++
 packages/infra/src/index.ts                   |  352 ++++++
 .../infra/src/resources/ec2-instance.test.ts  |  180 +++
 packages/infra/src/resources/ec2-instance.ts  |  238 ++++
 packages/infra/src/resources/ec2-lifecycle.ts |  246 ++++
 .../src/resources/iam-instance-profile.ts     |  199 ++++
 packages/infra/src/resources/iam-role.ts      |  152 +++
 packages/infra/src/resources/key-pair.ts      |  104 ++
 .../infra/src/resources/security-group.ts     |  181 +++
 packages/infra/src/stacks/env.ts              |   32 +
 packages/infra/src/stacks/repo.run.ts         |  144 +++
 packages/infra/src/types.ts                   |  543 +++++++++
 packages/infra/sst.config.ts                  |  211 ++++
 packages/infra/tsconfig.json                  |   26 +
 44 files changed, 7528 insertions(+), 3 deletions(-)
 create mode 100644 packages/infra/.gitkeep
 create mode 100644 packages/infra/.stack/keys/local.pub
 create mode 100644 packages/infra/README.md
 create mode 100644 packages/infra/alchemy.run.ts
 create mode 100644 packages/infra/deployment-check.run.ts
 create mode 100644 packages/infra/deployment-scope-check.run.ts
 create mode 100644 packages/infra/fly/web/fly.toml
 create mode 100644 packages/infra/modules/aws-ec2-app.helpers.test.ts
 create mode 100644 packages/infra/modules/aws-ec2-app.helpers.ts
 create mode 100644 packages/infra/modules/aws-ec2-app.ts
 create mode 100644 packages/infra/modules/aws-ec2-deploy.ts
 create mode 100644 packages/infra/modules/aws-secrets.ts
 create mode 100644 packages/infra/modules/aws-secrets/index.ts
 create mode 100644 packages/infra/modules/aws-secrets/policies.ts
 create mode 100644 packages/infra/modules/database.ts
 create mode 100644 packages/infra/modules/deployment-plan.ts
 create mode 100644 packages/infra/modules/deployment/artifact.test.ts
 create mode 100644 packages/infra/modules/deployment/artifact.ts
 create mode 100644 packages/infra/modules/deployment/aws-ec2-deploy.test.ts
 create mode 100644 packages/infra/modules/deployment/aws-ec2-deploy.ts
 create mode 100644 packages/infra/modules/deployment/aws-ec2-userdata.ts
 create mode 100644 packages/infra/modules/deployment/index.ts
 create mode 100644 packages/infra/modules/deployment/plan.test.ts
 create mode 100644 packages/infra/modules/deployment/plan.ts
 create mode 100644 packages/infra/modules/machines.ts
 create mode 100644 packages/infra/package.json
 create mode 100644 packages/infra/package.json.backup
 create mode 100644 packages/infra/src/alchemy.ts
 create mode 100644 packages/infra/src/index.test.ts
 create mode 100644 packages/infra/src/index.ts
 create mode 100644 packages/infra/src/resources/ec2-instance.test.ts
 create mode 100644 packages/infra/src/resources/ec2-instance.ts
 create mode 100644 packages/infra/src/resources/ec2-lifecycle.ts
 create mode 100644 packages/infra/src/resources/iam-instance-profile.ts
 create mode 100644 packages/infra/src/resources/iam-role.ts
 create mode 100644 packages/infra/src/resources/key-pair.ts
 create mode 100644 packages/infra/src/resources/security-group.ts
 create mode 100644 packages/infra/src/stacks/env.ts
 create mode 100644 packages/infra/src/stacks/repo.run.ts
 create mode 100644 packages/infra/src/types.ts
 create mode 100644 packages/infra/sst.config.ts
 create mode 100644 packages/infra/tsconfig.json

diff --git a/.gitignore b/.gitignore
index eb92515e..6500c95a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -100,7 +100,6 @@ devenv.local.yaml
 dist
 logs
 node_modules
-packages/infra/
 packages/scripts/entrypoints/
 process-compose.yaml
 temp
diff --git a/nix/stackpanel/infra/codegen.nix b/nix/stackpanel/infra/codegen.nix
index 9936a99c..312d0191 100644
--- a/nix/stackpanel/infra/codegen.nix
+++ b/nix/stackpanel/infra/codegen.nix
@@ -606,8 +606,6 @@ in
       STACKPANEL_INFRA_INPUTS = "${stateDir}/infra-inputs.json";
     };
 
-    # Gitignore the generated infra package directory
-    stackpanel.gitignore.entries = [ "${outputDir}/" ];
 
     # Turbo workspace package (generates package.json + turbo.json tasks)
     # ==========================================================================
diff --git a/packages/infra/.gitkeep b/packages/infra/.gitkeep
new file mode 100644
index 00000000..e69de29b
diff --git a/packages/infra/.stack/keys/local.pub b/packages/infra/.stack/keys/local.pub
new file mode 100644
index 00000000..aba0cb6e
--- /dev/null
+++ b/packages/infra/.stack/keys/local.pub
@@ -0,0 +1 @@
+age1yegftjs39p42j5r0n32crc8hc6dz6mq2rlj96va62rlph9zmt5qs7k5j0r
diff --git a/packages/infra/README.md b/packages/infra/README.md
new file mode 100644
index 00000000..07fadbc0
--- /dev/null
+++ b/packages/infra/README.md
@@ -0,0 +1,99 @@
+# @stackpanel/infra
+
+> Auto-generated by Stackpanel — do not edit manually.
+> Regenerate with `write-files` or restart devshell.
+
+Infrastructure-as-code package for **stackpanel**, powered by [Alchemy](https://github.com/sam-goodwin/alchemy).
+
+## Modules (5)
+
+### AWS EC2 Apps (`aws-ec2-app`)
+
+Provision EC2 instances for apps and emit machine inventory
+
+Dependencies: `@aws-sdk/client-ec2`, `@aws-sdk/client-ecr`, `@aws-sdk/client-elastic-load-balancing-v2`, `@aws-sdk/client-iam`, `@aws-sdk/client-ssm`, `@aws-sdk/client-sts`
+
+**Outputs:**
+  - `albOutputs` — ALB outputs per app (JSON) *(synced)*
+  - `ecrOutputs` — ECR outputs per app (JSON) *(synced)*
+  - `instanceIds` — Instance IDs (JSON) *(synced)*
+  - `machines` — Machine inventory (JSON) *(synced)*
+  - `privateIps` — Instance private IPs (JSON) *(synced)*
+  - `publicDns` — Instance public DNS (JSON) *(synced)*
+  - `publicIps` — Instance public IPs (JSON) *(synced)*
+  - `ssmOutputs` — SSM outputs per app (JSON) *(synced)*
+
+### AWS Secrets Infrastructure (`aws-secrets`)
+
+OIDC provider, IAM role, and KMS key for secrets management
+
+Dependencies: `@aws-sdk/client-iam`, `@aws-sdk/client-kms`, `@aws-sdk/client-ssm`, `@aws-sdk/client-sts`
+
+**Outputs:**
+  - `kmsAliasName` — KMS key alias name *(synced)*
+  - `kmsKeyArn` — KMS key ARN for secrets encryption *(synced)*
+  - `kmsKeyId` — KMS key ID *(synced)*
+  - `oidcProviderArn` — OIDC provider ARN *(synced)*
+  - `roleArn` — IAM role ARN for OIDC authentication *(synced)*
+  - `roleName` — IAM role name *(synced)*
+
+### Database (`database`)
+
+Postgres database provisioning (Neon / devenv / Docker)
+
+Dependencies: `alchemy`
+
+**Outputs:**
+  - `databaseUrl` — PostgreSQL connection URL *(synced)*
+  - `provider` — Active database provider (neon, devenv, docker) *(synced)*
+
+### App Deployment (`deployment`)
+
+Deploys apps to their configured hosts (cloudflare)
+
+
+**Outputs:**
+  - `docsUrl` — Deployed URL for docs *(synced)*
+  - `webUrl` — Deployed URL for web *(synced)*
+
+### Machine Inventory (`machines`)
+
+Machine inventory provider for Colmena deployments
+
+Dependencies: `@aws-sdk/client-ec2`
+
+**Outputs:**
+  - `machines` — Machine inventory (JSON) *(synced)*
+
+
+## Usage
+
+```bash
+# Deploy all infra modules
+cd packages/infra && bun run alchemy.run.ts
+
+# Destroy all resources
+cd packages/infra && bun run alchemy.run.ts --destroy
+```
+
+## Storage Backend
+
+SOPS (encrypted YAML file)
+
+## Architecture
+
+```
+packages/infra/
+├── alchemy.run.ts          # Orchestrator (imports all modules, syncs outputs)
+├── package.json
+├── tsconfig.json
+├── src/
+│   ├── index.ts            # Infra class (input resolution, output sync)
+│   └── types.ts            # Per-module TypeScript interfaces
+└── modules/
+    ├── aws-ec2-app.ts
+    ├── aws-secrets.ts
+    ├── database.ts
+    ├── deployment.ts
+    ├── machines.ts
+```
diff --git a/packages/infra/alchemy.run.ts b/packages/infra/alchemy.run.ts
new file mode 100644
index 00000000..3cef5326
--- /dev/null
+++ b/packages/infra/alchemy.run.ts
@@ -0,0 +1,59 @@
+// Generated by stackpanel — do not edit manually.
+import alchemy from "alchemy";
+import { CloudflareStateStore } from "alchemy/state";
+import Infra from "./src/index.ts";
+// Register legacy custom-resource providers so pending deletions from
+// earlier generated stacks can still be finalized after migrations.
+import "./src/resources/ec2-instance.ts";
+import "./src/resources/iam-instance-profile.ts";
+import "./src/resources/iam-role.ts";
+import "./src/resources/key-pair.ts";
+import "./src/resources/security-group.ts";
+
+
+const app = await alchemy("stackpanel-infra", {
+  stateStore: process.env.CLOUDFLARE_API_TOKEN
+    ? (scope) =>
+        new CloudflareStateStore(scope, {
+          apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN!),
+        })
+    : undefined,
+});
+
+// Import and run infra modules
+const aws_ec2_appOutputs = (await import("./modules/aws-ec2-app.ts")).default;
+
+const aws_secretsOutputs = (await import("./modules/aws-secrets/index.ts")).default;
+
+const databaseOutputs = (await import("./modules/database.ts")).default;
+
+const deploymentOutputs = (await import("./modules/deployment/index.ts")).default;
+
+const machinesOutputs = (await import("./modules/machines.ts")).default;
+
+
+// Sync declared outputs to storage backend
+await Infra.syncAll({
+"aws-ec2-app": {
+  outputs: aws_ec2_appOutputs,
+  syncKeys: ["albOutputs","ecrOutputs","instanceIds","machines","privateIps","publicDns","publicIps","ssmOutputs"],
+},
+"aws-secrets": {
+  outputs: aws_secretsOutputs,
+  syncKeys: ["kmsAliasName","kmsKeyArn","kmsKeyId","oidcProviderArn","roleArn","roleName"],
+},
+"database": {
+  outputs: databaseOutputs,
+  syncKeys: ["databaseUrl","provider"],
+},
+"deployment": {
+  outputs: deploymentOutputs,
+  syncKeys: ["docsUrl","webUrl"],
+},
+"machines": {
+  outputs: machinesOutputs,
+  syncKeys: ["machines"],
+},
+});
+
+await app.finalize();
diff --git a/packages/infra/deployment-check.run.ts b/packages/infra/deployment-check.run.ts
new file mode 100644
index 00000000..19111667
--- /dev/null
+++ b/packages/infra/deployment-check.run.ts
@@ -0,0 +1,15 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import alchemy from "alchemy";
+
+process.chdir(
+  path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", ".."),
+);
+
+const app = await alchemy("stackpanel-deployment-check-v10");
+
+const outputs = (await import("./modules/deployment.ts")).default;
+
+console.log(outputs);
+
+await app.finalize();
diff --git a/packages/infra/deployment-scope-check.run.ts b/packages/infra/deployment-scope-check.run.ts
new file mode 100644
index 00000000..47a99321
--- /dev/null
+++ b/packages/infra/deployment-scope-check.run.ts
@@ -0,0 +1,15 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import alchemy from "alchemy";
+
+process.chdir(
+  path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", ".."),
+);
+
+const app = await alchemy("stackpanel-deployment-scope-check");
+
+const outputs = (await import("./modules/deployment.ts")).default;
+
+console.log(outputs);
+
+await app.finalize();
diff --git a/packages/infra/fly/web/fly.toml b/packages/infra/fly/web/fly.toml
new file mode 100644
index 00000000..572ae7e2
--- /dev/null
+++ b/packages/infra/fly/web/fly.toml
@@ -0,0 +1,33 @@
+# Generated by stackpanel - do not edit manually
+# Regenerate by entering the devshell: nix develop --impure
+#
+# Deploy workflow (uses nix2container/dockerTools):
+#   1. Build app:        bun run build (in app directory)
+#   2. Build container:  container-build web
+#   3. Push container:   container-copy web docker://registry.fly.io/
+#   4. Deploy:           flyctl deploy --config packages/infra/fly/web/fly.toml --image registry.fly.io/stackpanel-web:latest
+#
+# Or use turbo workflow:
+#   turbo run ship:web
+
+app = "stackpanel-web"
+org = "darkmatter"
+
+# Build section removed - we use pre-built container images
+# Container is built with nix2container/dockerTools and pushed via skopeo
+
+[env]
+PORT = '3000'
+
+[http_service]
+internal_port = 3000
+force_https = true
+auto_stop_machines = "suspend"
+auto_start_machines = true
+min_machines_running = 0
+processes = ["app"]
+
+[[vm]]
+memory = "512mb"
+cpu_kind = "shared"
+cpus = 1
diff --git a/packages/infra/modules/aws-ec2-app.helpers.test.ts b/packages/infra/modules/aws-ec2-app.helpers.test.ts
new file mode 100644
index 00000000..ec47d425
--- /dev/null
+++ b/packages/infra/modules/aws-ec2-app.helpers.test.ts
@@ -0,0 +1,104 @@
+// @ts-nocheck
+import { describe, expect, test } from "bun:test";
+import {
+  buildAlbTargets,
+  buildSecurityGroupEgressResources,
+  buildSecurityGroupIngressResources,
+  sanitizeAwsName,
+  toAwsTags,
+} from "./aws-ec2-app.helpers";
+
+describe("aws-ec2-app native helpers", () => {
+  test("toAwsTags returns undefined for empty tags", () => {
+    expect(toAwsTags(undefined)).toBeUndefined();
+    expect(toAwsTags({})).toBeUndefined();
+  });
+
+  test("toAwsTags converts records into AWS tag objects", () => {
+    expect(
+      toAwsTags({
+        Name: "stackpanel-staging",
+        ManagedBy: "stackpanel-infra",
+      }),
+    ).toEqual([
+      { Key: "Name", Value: "stackpanel-staging" },
+      { Key: "ManagedBy", Value: "stackpanel-infra" },
+    ]);
+  });
+
+  test("sanitizeAwsName normalizes invalid characters and truncates", () => {
+    expect(sanitizeAwsName("stackpanel/staging_alb", 32)).toBe("stackpanel-staging-alb");
+    expect(sanitizeAwsName("this-name-is-way-too-long-for-an-elb-resource", 32)).toBe(
+      "this-name-is-way-too-long-for-an",
+    );
+  });
+
+  test("buildAlbTargets emits instance target descriptions", () => {
+    expect(buildAlbTargets(["i-abc", "i-def"], 8080)).toEqual([
+      { Id: "i-abc", Port: 8080 },
+      { Id: "i-def", Port: 8080 },
+    ]);
+  });
+
+  test("buildSecurityGroupIngressResources expands ipv4, ipv6, and source groups", () => {
+    expect(
+      buildSecurityGroupIngressResources("sg-123", [
+        {
+          fromPort: 80,
+          toPort: 80,
+          protocol: "tcp",
+          cidrBlocks: ["0.0.0.0/0"],
+          ipv6CidrBlocks: ["::/0"],
+          securityGroupIds: ["sg-source"],
+          description: "web",
+        },
+      ]),
+    ).toEqual([
+      {
+        GroupId: "sg-123",
+        IpProtocol: "tcp",
+        FromPort: 80,
+        ToPort: 80,
+        Description: "web",
+        CidrIp: "0.0.0.0/0",
+      },
+      {
+        GroupId: "sg-123",
+        IpProtocol: "tcp",
+        FromPort: 80,
+        ToPort: 80,
+        Description: "web",
+        CidrIpv6: "::/0",
+      },
+      {
+        GroupId: "sg-123",
+        IpProtocol: "tcp",
+        FromPort: 80,
+        ToPort: 80,
+        Description: "web",
+        SourceSecurityGroupId: "sg-source",
+      },
+    ]);
+  });
+
+  test("buildSecurityGroupEgressResources expands destination group rules", () => {
+    expect(
+      buildSecurityGroupEgressResources("sg-123", [
+        {
+          fromPort: 0,
+          toPort: 0,
+          protocol: "-1",
+          securityGroupIds: ["sg-dest"],
+        },
+      ]),
+    ).toEqual([
+      {
+        GroupId: "sg-123",
+        IpProtocol: "-1",
+        FromPort: 0,
+        ToPort: 0,
+        DestinationSecurityGroupId: "sg-dest",
+      },
+    ]);
+  });
+});
diff --git a/packages/infra/modules/aws-ec2-app.helpers.ts b/packages/infra/modules/aws-ec2-app.helpers.ts
new file mode 100644
index 00000000..3467c360
--- /dev/null
+++ b/packages/infra/modules/aws-ec2-app.helpers.ts
@@ -0,0 +1,95 @@
+export interface RuleConfigLike {
+  fromPort: number;
+  toPort: number;
+  protocol?: string;
+  cidrBlocks?: string[];
+  ipv6CidrBlocks?: string[];
+  securityGroupIds?: string[];
+  description?: string | null;
+}
+
+export function toAwsTags(tags?: Record<string, string>) {
+  if (!tags || Object.keys(tags).length === 0) {
+    return undefined;
+  }
+
+  return Object.entries(tags).map(([Key, Value]) => ({
+    Key,
+    Value,
+  }));
+}
+
+export function sanitizeAwsName(name: string, maxLength = 32) {
+  return name.replace(/[^a-zA-Z0-9-]/g, "-").slice(0, maxLength);
+}
+
+export function buildAlbTargets(instanceIds: string[], port?: number) {
+  return instanceIds.map((Id) => ({
+    Id,
+    ...(port === undefined ? {} : { Port: port }),
+  }));
+}
+
+export function buildSecurityGroupIngressResources(
+  groupId: string | undefined,
+  rules: RuleConfigLike[],
+) {
+  return rules.flatMap((rule) => [
+    ...(rule.cidrBlocks ?? []).map((cidr) => ({
+      ...(groupId ? { GroupId: groupId } : {}),
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIp: cidr,
+    })),
+    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
+      ...(groupId ? { GroupId: groupId } : {}),
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIpv6: cidr,
+    })),
+    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
+      ...(groupId ? { GroupId: groupId } : {}),
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      SourceSecurityGroupId: securityGroupId,
+    })),
+  ]);
+}
+
+export function buildSecurityGroupEgressResources(
+  groupId: string | undefined,
+  rules: RuleConfigLike[],
+) {
+  return rules.flatMap((rule) => [
+    ...(rule.cidrBlocks ?? []).map((cidr) => ({
+      ...(groupId ? { GroupId: groupId } : {}),
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIp: cidr,
+    })),
+    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
+      ...(groupId ? { GroupId: groupId } : {}),
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIpv6: cidr,
+    })),
+    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
+      ...(groupId ? { GroupId: groupId } : {}),
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      DestinationSecurityGroupId: securityGroupId,
+    })),
+  ]);
+}
diff --git a/packages/infra/modules/aws-ec2-app.ts b/packages/infra/modules/aws-ec2-app.ts
new file mode 100644
index 00000000..fdb03c91
--- /dev/null
+++ b/packages/infra/modules/aws-ec2-app.ts
@@ -0,0 +1,1051 @@
+// ==============================================================================
+// AWS EC2 Apps Module
+//
+// High-level app-centric EC2 provisioning with optional:
+//   - Security group creation
+//   - Key pair import
+//   - IAM role + instance profile
+//   - ALB + target group + listeners + host-based routing
+//   - ECR repository + GitHub OIDC push role
+//   - SSM parameter wiring (env file generation)
+//   - Machine inventory for Colmena
+// ==============================================================================
+import AWS from "alchemy/aws/control";
+import Infra from "@stackpanel/infra";
+import { Ec2Instance } from "@stackpanel/infra/resources/ec2-instance";
+import { IamInstanceProfile } from "@stackpanel/infra/resources/iam-instance-profile";
+import { IamRole } from "@stackpanel/infra/resources/iam-role";
+import { KeyPair } from "@stackpanel/infra/resources/key-pair";
+import { SecurityGroup } from "@stackpanel/infra/resources/security-group";
+
+// =============================================================================
+// Types
+// =============================================================================
+
+interface SshConfig {
+  user?: string;
+  port?: number;
+  keyPath?: string | null;
+}
+
+interface MachineMeta {
+  tags?: string[];
+  roles?: string[];
+  targetEnv?: string | null;
+  arch?: string | null;
+  ssh?: SshConfig;
+}
+
+interface RuleConfig {
+  fromPort: number;
+  toPort: number;
+  protocol?: string;
+  cidrBlocks?: string[];
+  ipv6CidrBlocks?: string[];
+  securityGroupIds?: string[];
+  description?: string | null;
+}
+
+interface SecurityGroupConfig {
+  create?: boolean;
+  name?: string | null;
+  description?: string | null;
+  ingress?: RuleConfig[];
+  egress?: RuleConfig[];
+  tags?: Record<string, string>;
+}
+
+interface KeyPairConfig {
+  create?: boolean;
+  name?: string | null;
+  publicKey?: string | null;
+  tags?: Record<string, string>;
+  destroyOnDelete?: boolean;
+}
+
+interface InlinePolicy {
+  name: string;
+  document: Record<string, unknown>;
+}
+
+interface IamConfig {
+  enable?: boolean;
+  roleName?: string | null;
+  assumeRolePolicy?: Record<string, unknown> | null;
+  managedPolicyArns?: string[];
+  inlinePolicies?: InlinePolicy[];
+  tags?: Record<string, string>;
+  instanceProfileName?: string | null;
+  instanceProfileTags?: Record<string, string>;
+}
+
+interface NixosConfig {
+  amiId?: string | null;
+  flakeUrl?: string | null;
+  hostConfig?: string | null;
+  flakeVersion?: string;
+}
+
+interface AlbHealthCheck {
+  enabled?: boolean;
+  path?: string;
+  protocol?: "HTTP" | "HTTPS" | "TCP";
+  port?: string | null;
+  interval?: number;
+  timeout?: number;
+  healthyThreshold?: number;
+  unhealthyThreshold?: number;
+  matcher?: string;
+}
+
+interface AlbTargetGroupConfig {
+  port?: number;
+  protocol?: "HTTP" | "HTTPS" | "TCP";
+  healthCheck?: AlbHealthCheck;
+}
+
+interface AlbConfig {
+  enable?: boolean;
+  create?: boolean;
+  name?: string | null;
+  scheme?: "internet-facing" | "internal";
+  ipAddressType?: "ipv4" | "dualstack";
+  subnetIds?: string[];
+  securityGroupIds?: string[];
+  http?: boolean;
+  https?: boolean;
+  certificateArn?: string | null;
+  sslPolicy?: string;
+  existingListenerHttpArn?: string | null;
+  existingListenerHttpsArn?: string | null;
+  hostnames?: string[];
+  hostRulePriority?: number;
+  targetGroup?: AlbTargetGroupConfig;
+}
+
+interface GithubOidcConfig {
+  enable?: boolean;
+  repoOwner?: string | null;
+  repoName?: string | null;
+  allowedBranches?: string[];
+  allowedWorkflows?: string[];
+  allowTags?: boolean;
+  roleName?: string | null;
+  oidcProviderArn?: string | null;
+  createOidcProvider?: boolean;
+}
+
+interface EcrConfig {
+  enable?: boolean;
+  create?: boolean;
+  repoName?: string | null;
+  imageTagMutability?: "MUTABLE" | "IMMUTABLE";
+  scanOnPush?: boolean;
+  lifecyclePolicy?: string | null;
+  github?: GithubOidcConfig;
+}
+
+interface SsmConfig {
+  enable?: boolean;
+  region?: string | null;
+  pathPrefix?: string | null;
+  parameters?: Record<string, string>;
+  secureParameters?: Record<string, string>;
+  envFilePath?: string | null;
+  refreshScriptPath?: string | null;
+  installCli?: boolean;
+  useChamber?: boolean;
+}
+
+interface InstanceOverride {
+  name?: string | null;
+  ami?: string | null;
+  osType?: "ubuntu" | "nixos";
+  nixos?: NixosConfig;
+  instanceType?: string | null;
+  subnetId?: string | null;
+  securityGroupIds?: string[];
+  keyName?: string | null;
+  iamInstanceProfile?: string | null;
+  userData?: string | null;
+  rootVolumeSize?: number | null;
+  associatePublicIp?: boolean;
+  tags?: Record<string, string>;
+  machine?: MachineMeta;
+}
+
+interface AppConfig {
+  instanceCount?: number;
+  instances?: InstanceOverride[];
+  ami?: string | null;
+  osType?: "ubuntu" | "nixos";
+  nixos?: NixosConfig;
+  instanceType?: string | null;
+  vpcId?: string | null;
+  subnetIds?: string[];
+  securityGroupIds?: string[];
+  securityGroup?: SecurityGroupConfig;
+  keyName?: string | null;
+  keyPair?: KeyPairConfig;
+  iam?: IamConfig;
+  iamInstanceProfile?: string | null;
+  userData?: string | null;
+  rootVolumeSize?: number | null;
+  associatePublicIp?: boolean;
+  tags?: Record<string, string>;
+  alb?: AlbConfig;
+  ecr?: EcrConfig;
+  ssm?: SsmConfig;
+  machine?: MachineMeta;
+}
+
+interface AwsEc2AppInputs {
+  defaults?: AppConfig;
+  apps: Record<string, AppConfig>;
+}
+
+// =============================================================================
+// Init
+// =============================================================================
+
+const infra = new Infra("aws-ec2-app");
+const inputs = infra.inputs<AwsEc2AppInputs>(
+  process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES,
+);
+
+const defaults = inputs.defaults ?? {};
+
+const { EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeImagesCommand } =
+  await import("@aws-sdk/client-ec2");
+
+const awsRegion = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+const ec2Client = new EC2Client(awsRegion ? { region: awsRegion } : {});
+
+// =============================================================================
+// Helpers
+// =============================================================================
+
+async function resolveDefaultNetwork(): Promise<{ vpcId: string; subnetIds: string[] }> {
+  const vpcs = await ec2Client.send(
+    new DescribeVpcsCommand({
+      Filters: [{ Name: "isDefault", Values: ["true"] }],
+    }),
+  );
+  const vpcId = vpcs.Vpcs?.[0]?.VpcId;
+  if (!vpcId) {
+    throw new Error("aws-ec2-app: unable to resolve default VPC");
+  }
+  const subnets = await ec2Client.send(
+    new DescribeSubnetsCommand({
+      Filters: [{ Name: "vpc-id", Values: [vpcId] }],
+    }),
+  );
+  const subnetIds = (subnets.Subnets ?? [])
+    .map((subnet) => subnet.SubnetId)
+    .filter((id): id is string => Boolean(id));
+  if (subnetIds.length === 0) {
+    throw new Error("aws-ec2-app: unable to resolve default subnets");
+  }
+  return { vpcId, subnetIds };
+}
+
+function pickList<T>(...lists: Array<T[] | undefined | null>): T[] {
+  for (const list of lists) {
+    if (list && list.length > 0) return list;
+  }
+  return [];
+}
+
+function mergeTags(...sources: Array<Record<string, string> | undefined>): Record<string, string> {
+  const merged: Record<string, string> = {};
+  for (const source of sources) {
+    if (!source) continue;
+    Object.assign(merged, source);
+  }
+  return merged;
+}
+
+function mergeMachineMeta(...sources: Array<MachineMeta | undefined>): MachineMeta {
+  const result: MachineMeta = {};
+  const tags = new Set<string>();
+  const roles = new Set<string>();
+
+  for (const source of sources) {
+    if (!source) continue;
+    (source.tags ?? []).forEach((tag) => tags.add(tag));
+    (source.roles ?? []).forEach((role) => roles.add(role));
+    if (source.targetEnv) result.targetEnv = source.targetEnv;
+    if (source.arch) result.arch = source.arch;
+    if (source.ssh) {
+      result.ssh = {
+        ...(result.ssh ?? {}),
+        ...source.ssh,
+      };
+    }
+  }
+
+  if (tags.size > 0) result.tags = Array.from(tags);
+  if (roles.size > 0) result.roles = Array.from(roles);
+  return result;
+}
+
+function toAwsTags(tags?: Record<string, string>) {
+  if (!tags || Object.keys(tags).length === 0) {
+    return undefined;
+  }
+
+  return Object.entries(tags).map(([Key, Value]) => ({
+    Key,
+    Value,
+  }));
+}
+
+function sanitizeAwsName(name: string, maxLength = 32) {
+  return name.replace(/[^a-zA-Z0-9-]/g, "-").slice(0, maxLength);
+}
+
+function buildAlbTargets(instanceIds: string[], port?: number) {
+  return instanceIds.map((Id) => ({
+    Id,
+    ...(port === undefined ? {} : { Port: port }),
+  }));
+}
+
+function buildSecurityGroupIngressResources(
+  groupId: string,
+  rules: RuleConfig[],
+) {
+  return rules.flatMap((rule) => [
+    ...(rule.cidrBlocks ?? []).map((cidr) => ({
+      GroupId: groupId,
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIp: cidr,
+    })),
+    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
+      GroupId: groupId,
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIpv6: cidr,
+    })),
+    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
+      GroupId: groupId,
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      SourceSecurityGroupId: securityGroupId,
+    })),
+  ]);
+}
+
+function buildSecurityGroupEgressResources(
+  groupId: string,
+  rules: RuleConfig[],
+) {
+  return rules.flatMap((rule) => [
+    ...(rule.cidrBlocks ?? []).map((cidr) => ({
+      GroupId: groupId,
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIp: cidr,
+    })),
+    ...(rule.ipv6CidrBlocks ?? []).map((cidr) => ({
+      GroupId: groupId,
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      CidrIpv6: cidr,
+    })),
+    ...(rule.securityGroupIds ?? []).map((securityGroupId) => ({
+      GroupId: groupId,
+      IpProtocol: rule.protocol ?? "tcp",
+      FromPort: rule.fromPort,
+      ToPort: rule.toPort,
+      Description: rule.description ?? undefined,
+      DestinationSecurityGroupId: securityGroupId,
+    })),
+  ]);
+}
+
+async function resolveAmi(
+  explicitAmi: string | null | undefined,
+  osType: "ubuntu" | "nixos",
+  nixos?: NixosConfig,
+): Promise<string> {
+  if (explicitAmi) return explicitAmi;
+
+  if (osType === "nixos") {
+    if (nixos?.amiId) return nixos.amiId;
+    const images = await ec2Client.send(
+      new DescribeImagesCommand({
+        Owners: ["535002876703"],
+        Filters: [
+          { Name: "name", Values: ["determinate/nixos/epoch-1/*"] },
+          { Name: "architecture", Values: ["x86_64"] },
+          { Name: "state", Values: ["available"] },
+        ],
+      }),
+    );
+    const sorted = (images.Images ?? []).sort((a, b) =>
+      (b.CreationDate ?? "").localeCompare(a.CreationDate ?? ""),
+    );
+    const imageId = sorted[0]?.ImageId;
+    if (!imageId) throw new Error("aws-ec2-app: no NixOS AMI found");
+    return imageId;
+  }
+
+  const images = await ec2Client.send(
+    new DescribeImagesCommand({
+      Owners: ["099720109477"],
+      Filters: [
+        {
+          Name: "name",
+          Values: ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"],
+        },
+        { Name: "state", Values: ["available"] },
+      ],
+    }),
+  );
+  const sorted = (images.Images ?? []).sort((a, b) =>
+    (b.CreationDate ?? "").localeCompare(a.CreationDate ?? ""),
+  );
+  const imageId = sorted[0]?.ImageId;
+  if (!imageId) throw new Error("aws-ec2-app: no Ubuntu AMI found");
+  return imageId;
+}
+
+function buildNixosUserData(nixos?: NixosConfig): string | null {
+  if (!nixos?.flakeUrl || !nixos?.hostConfig) return null;
+  const flakeVersion = nixos.flakeVersion ?? "*";
+  return `#!/usr/bin/env bash
+set -euo pipefail
+exec >> /var/log/user-data.log 2>&1
+
+echo "[+] Authenticating with FlakeHub using AWS STS..."
+determinate-nixd login aws
+
+echo "[+] Applying NixOS configuration: ${nixos.flakeUrl}/${flakeVersion}#nixosConfigurations.${nixos.hostConfig}"
+fh apply nixos "${nixos.flakeUrl}/${flakeVersion}#nixosConfigurations.${nixos.hostConfig}"
+
+echo "[+] NixOS configuration applied successfully"
+`;
+}
+
+async function getAccountId(): Promise<string> {
+  const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+  const client = new STSClient(awsRegion ? { region: awsRegion } : {});
+  const identity = await client.send(new GetCallerIdentityCommand({}));
+  return identity.Account!;
+}
+
+// =============================================================================
+// Resolve network
+// =============================================================================
+
+const defaultNetwork = await resolveDefaultNetwork();
+
+// =============================================================================
+// Outputs
+// =============================================================================
+
+const instanceIds: Record<string, string> = {};
+const publicIps: Record<string, string> = {};
+const privateIps: Record<string, string> = {};
+const publicDns: Record<string, string> = {};
+const machines: Record<string, Record<string, unknown>> = {};
+const albOutputs: Record<string, Record<string, unknown>> = {};
+const ecrOutputs: Record<string, Record<string, unknown>> = {};
+const ssmOutputs: Record<string, Record<string, unknown>> = {};
+
+// =============================================================================
+// Per-app loop
+// =============================================================================
+
+for (const [appName, appConfig] of Object.entries(inputs.apps ?? {})) {
+  const appSecurityGroup = { ...defaults.securityGroup, ...appConfig.securityGroup };
+  const appKeyPair = { ...defaults.keyPair, ...appConfig.keyPair };
+  const appIam = { ...defaults.iam, ...appConfig.iam };
+  const appAlb = { ...defaults.alb, ...appConfig.alb };
+  const appEcr = { ...defaults.ecr, ...appConfig.ecr };
+  const appSsm = { ...defaults.ssm, ...appConfig.ssm };
+
+  const vpcId = appConfig.vpcId ?? defaults.vpcId ?? defaultNetwork.vpcId;
+  const subnetIds = pickList(appConfig.subnetIds, defaults.subnetIds, defaultNetwork.subnetIds);
+  if (subnetIds.length === 0) {
+    throw new Error(`aws-ec2-app: no subnet IDs available for ${appName}`);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Security group
+  // ---------------------------------------------------------------------------
+  let securityGroupIds = pickList(appConfig.securityGroupIds, defaults.securityGroupIds);
+  if (appSecurityGroup?.create) {
+    const sgName = appSecurityGroup.name ?? `${appName}-sg`;
+    const ingressRules = appSecurityGroup.ingress ?? [];
+    const egressRules =
+      (appSecurityGroup.egress ?? []).length > 0
+        ? appSecurityGroup.egress
+        : [
+            {
+              fromPort: 0,
+              toPort: 0,
+              protocol: "-1",
+              cidrBlocks: ["0.0.0.0/0"],
+              ipv6CidrBlocks: ["::/0"],
+            },
+          ];
+    const sg = await SecurityGroup(infra.id(`${appName}-sg`), {
+      name: sgName,
+      description: appSecurityGroup.description ?? sgName,
+      vpcId,
+      ingress: ingressRules,
+      egress: egressRules ?? [],
+      tags: mergeTags(defaults.tags, appConfig.tags, appSecurityGroup.tags),
+    });
+    securityGroupIds = [sg.groupId];
+  }
+
+  // ---------------------------------------------------------------------------
+  // Key pair
+  // ---------------------------------------------------------------------------
+  let keyName = appConfig.keyName ?? defaults.keyName ?? null;
+  if (appKeyPair?.create) {
+    if (!appKeyPair.name || !appKeyPair.publicKey) {
+      throw new Error(`aws-ec2-app: key pair name and public key required for ${appName}`);
+    }
+    const keyPair = await KeyPair(infra.id(`${appName}-key`), {
+      keyName: appKeyPair.name,
+      publicKey: appKeyPair.publicKey,
+      tags: appKeyPair.tags,
+    });
+    keyName = keyPair.keyName;
+  }
+
+  // ---------------------------------------------------------------------------
+  // IAM role + instance profile
+  // ---------------------------------------------------------------------------
+  let iamInstanceProfile = appConfig.iamInstanceProfile ?? defaults.iamInstanceProfile ?? null;
+  if (appIam?.enable) {
+    const roleName = appIam.roleName ?? `${appName}-role`;
+    const role = await IamRole(infra.id(`${appName}-role`), {
+      roleName,
+      assumeRolePolicy: appIam.assumeRolePolicy ?? {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Principal: { Service: "ec2.amazonaws.com" },
+            Action: "sts:AssumeRole",
+          },
+        ],
+      },
+      description: `EC2 role for ${appName}`,
+      tags: appIam.tags,
+      managedPolicyArns: appIam.managedPolicyArns,
+      policies: (appIam.inlinePolicies ?? []).map((policy) => ({
+        policyName: policy.name,
+        policyDocument: policy.document,
+      })),
+    });
+    const profileName = appIam.instanceProfileName ?? `${roleName}-profile`;
+    await IamInstanceProfile(infra.id(`${appName}-profile`), {
+      name: profileName,
+      roleName: role.roleName,
+      tags: appIam.tags,
+    });
+    iamInstanceProfile = profileName;
+  }
+
+  // ---------------------------------------------------------------------------
+  // SSM parameters
+  // ---------------------------------------------------------------------------
+  if (appSsm?.enable) {
+    const prefix = appSsm.pathPrefix ?? `/${appName}`;
+    const allParams = {
+      ...(appSsm.parameters ?? {}),
+      ...(appSsm.secureParameters ?? {}),
+    };
+    const secureKeys = new Set(Object.keys(appSsm.secureParameters ?? {}));
+
+    for (const [key, value] of Object.entries(allParams)) {
+      const paramName = `${prefix}/${key}`;
+      await AWS.SSM.Parameter(infra.id(`${appName}-ssm-${key.toLowerCase()}`), {
+        Name: paramName,
+        Value: value,
+        Type: secureKeys.has(key) ? "SecureString" : "String",
+        adopt: true,
+      });
+    }
+
+    ssmOutputs[appName] = {
+      pathPrefix: prefix,
+      parameterCount: Object.keys(allParams).length,
+      envFilePath: appSsm.envFilePath ?? `/etc/default/${appName}.env`,
+    };
+  }
+
+  // ---------------------------------------------------------------------------
+  // ECR repository
+  // ---------------------------------------------------------------------------
+  if (appEcr?.enable) {
+    const repoName = appEcr.repoName ?? appName;
+    if (appEcr.create !== false) {
+      const defaultLifecyclePolicy = JSON.stringify({
+        rules: [
+          {
+            rulePriority: 1,
+            description: "Keep last 50 images",
+            selection: {
+              tagStatus: "any",
+              countType: "imageCountMoreThan",
+              countNumber: 50,
+            },
+            action: { type: "expire" },
+          },
+        ],
+      });
+      const repo = await AWS.ECR.Repository(infra.id(`${appName}-ecr`), {
+        RepositoryName: repoName,
+        ImageTagMutability: appEcr.imageTagMutability,
+        ImageScanningConfiguration: {
+          ScanOnPush: appEcr.scanOnPush ?? true,
+        },
+        LifecyclePolicy: {
+          LifecyclePolicyText: appEcr.lifecyclePolicy ?? defaultLifecyclePolicy,
+        },
+        EmptyOnDelete: true,
+        Tags: toAwsTags(mergeTags(defaults.tags, appConfig.tags)),
+        adopt: true,
+      });
+      ecrOutputs[appName] = {
+        repositoryUrl: repo.RepositoryUri,
+        repositoryArn: repo.Arn,
+        repositoryName: repo.RepositoryName ?? repoName,
+      };
+    }
+
+    // GitHub OIDC role for ECR push
+    const github = appEcr.github;
+    if (github?.enable) {
+      const accountId = await getAccountId();
+      let oidcProviderArn = github.oidcProviderArn ?? null;
+
+      if (!oidcProviderArn && github.createOidcProvider) {
+        const { GitHubOIDCProvider } = await import("alchemy/aws/oidc");
+        const oidc = await GitHubOIDCProvider(infra.id(`${appName}-oidc`), {});
+        oidcProviderArn = oidc.arn;
+      }
+
+      if (oidcProviderArn && github.repoOwner && github.repoName) {
+        const branchSubjects = (github.allowedBranches ?? []).map(
+          (b) => `repo:${github.repoOwner}/${github.repoName}:ref:refs/heads/${b}`,
+        );
+        const tagSubjects = github.allowTags
+          ? [`repo:${github.repoOwner}/${github.repoName}:ref:refs/tags/*`]
+          : [];
+        const workflowSubjects = (github.allowedWorkflows ?? []).map(
+          (w) => `repo:${github.repoOwner}/${github.repoName}:workflow:${w}`,
+        );
+        const allSubjects = [...branchSubjects, ...tagSubjects, ...workflowSubjects];
+        if (allSubjects.length === 0) {
+          allSubjects.push(`repo:${github.repoOwner}/${github.repoName}:*`);
+        }
+
+        const ghaRoleName = github.roleName ?? `${appName}-gha-ecr-push`;
+        const ecrRepoArn = `arn:aws:ecr:${awsRegion ?? "us-east-1"}:${accountId}:repository/${appEcr.repoName ?? appName}`;
+
+        const ssmPrefix = appSsm?.pathPrefix ?? `/${appName}`;
+
+        await IamRole(infra.id(`${appName}-gha-role`), {
+          roleName: ghaRoleName,
+          assumeRolePolicy: {
+            Version: "2012-10-17",
+            Statement: [
+              {
+                Sid: "GitHubActionsFederatedOIDC",
+                Effect: "Allow",
+                Principal: { Federated: oidcProviderArn },
+                Action: "sts:AssumeRoleWithWebIdentity",
+                Condition: {
+                  StringLike: {
+                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+                    "token.actions.githubusercontent.com:sub": allSubjects,
+                  },
+                },
+              },
+              {
+                Sid: "AllowRoot",
+                Effect: "Allow",
+                Principal: { AWS: `arn:aws:iam::${accountId}:root` },
+                Action: "sts:AssumeRole",
+              },
+            ],
+          },
+          description: `GitHub Actions role for ${appName} ECR push`,
+          tags: mergeTags(defaults.tags, appConfig.tags),
+          policies: [
+            {
+              policyName: `${ghaRoleName}-ecr`,
+              policyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                  {
+                    Sid: "ECRAuth",
+                    Effect: "Allow",
+                    Action: ["ecr:GetAuthorizationToken"],
+                    Resource: "*",
+                  },
+                  {
+                    Sid: "ECRPushPull",
+                    Effect: "Allow",
+                    Action: [
+                      "ecr:BatchCheckLayerAvailability",
+                      "ecr:BatchGetImage",
+                      "ecr:CompleteLayerUpload",
+                      "ecr:InitiateLayerUpload",
+                      "ecr:PutImage",
+                      "ecr:UploadLayerPart",
+                      "ecr:DescribeImages",
+                      "ecr:GetDownloadUrlForLayer",
+                      "ecr:ListImages",
+                    ],
+                    Resource: [ecrRepoArn],
+                  },
+                  {
+                    Sid: "SSMAccess",
+                    Effect: "Allow",
+                    Action: [
+                      "ssm:GetParameter",
+                      "ssm:GetParameters",
+                      "ssm:GetParametersByPath",
+                      "ssm:PutParameter",
+                      "ssm:DeleteParameter",
+                      "ssm:DescribeParameters",
+                    ],
+                    Resource: [
+                      `arn:aws:ssm:${awsRegion ?? "*"}:${accountId}:parameter${ssmPrefix}/*`,
+                    ],
+                  },
+                  {
+                    Sid: "SSMSendCommand",
+                    Effect: "Allow",
+                    Action: [
+                      "ssm:SendCommand",
+                      "ssm:ListCommandInvocations",
+                      "ssm:GetCommandInvocation",
+                    ],
+                    Resource: [
+                      `arn:aws:ssm:*:*:document/AWS-RunShellScript`,
+                      `arn:aws:ec2:*:${accountId}:instance/*`,
+                    ],
+                  },
+                  {
+                    Sid: "ECRCreateRepo",
+                    Effect: "Allow",
+                    Action: [
+                      "ecr:CreateRepository",
+                      "ecr:DescribeRepositories",
+                    ],
+                    Resource: "*",
+                  },
+                ],
+              },
+            },
+          ],
+        });
+
+        ecrOutputs[appName] = {
+          ...(ecrOutputs[appName] ?? {}),
+          ghaRoleName,
+        };
+      }
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // EC2 instances
+  // ---------------------------------------------------------------------------
+  const instanceList =
+    (appConfig.instances ?? []).length > 0
+      ? appConfig.instances ?? []
+      : Array.from({ length: appConfig.instanceCount ?? 1 }, () => ({} as InstanceOverride));
+
+  const appInstanceIds: string[] = [];
+
+  let index = 0;
+  for (const instance of instanceList) {
+    const instanceName = instance.name ?? `${appName}-${index + 1}`;
+    const osType = instance.osType ?? appConfig.osType ?? defaults.osType ?? "ubuntu";
+    const nixosConfig = { ...defaults.nixos, ...appConfig.nixos, ...instance.nixos };
+
+    const ami = await resolveAmi(
+      instance.ami ?? appConfig.ami ?? defaults.ami,
+      osType,
+      nixosConfig,
+    );
+
+    const subnetId = instance.subnetId ?? subnetIds[index % subnetIds.length];
+    const securityGroups = pickList(instance.securityGroupIds, securityGroupIds);
+
+    const userData =
+      instance.userData ??
+      appConfig.userData ??
+      defaults.userData ??
+      (osType === "nixos" ? buildNixosUserData(nixosConfig) : null);
+    const associatePublicIp =
+      instance.associatePublicIp ??
+      appConfig.associatePublicIp ??
+      defaults.associatePublicIp ??
+      true;
+
+    const instanceTags = mergeTags(defaults.tags, appConfig.tags, instance.tags, {
+      Name: instanceName,
+      Service: appName,
+      OSType: osType,
+    });
+    if (osType === "nixos" && nixosConfig.hostConfig) {
+      instanceTags.NixOSHostConfig = nixosConfig.hostConfig;
+    }
+    if (osType === "nixos" && nixosConfig.flakeUrl) {
+      instanceTags.NixOSFlakeURL = nixosConfig.flakeUrl;
+    }
+
+    const resource = await Ec2Instance(infra.id(instanceName), {
+      name: instanceName,
+      ami,
+      instanceType:
+        instance.instanceType ?? appConfig.instanceType ?? defaults.instanceType ?? "t3.micro",
+      subnetId,
+      securityGroupIds: securityGroups,
+      keyName: instance.keyName ?? appConfig.keyName ?? keyName ?? undefined,
+      iamInstanceProfile: instance.iamInstanceProfile ?? iamInstanceProfile ?? undefined,
+      userData: userData ?? undefined,
+      rootVolumeSize:
+        instance.rootVolumeSize ??
+        appConfig.rootVolumeSize ??
+        defaults.rootVolumeSize ??
+        undefined,
+      associatePublicIp,
+      tags: instanceTags,
+    });
+
+    appInstanceIds.push(resource.instanceId);
+    instanceIds[instanceName] = resource.instanceId;
+    if (resource.publicIp) publicIps[instanceName] = resource.publicIp;
+    if (resource.privateIp) privateIps[instanceName] = resource.privateIp;
+    if (resource.publicDns) publicDns[instanceName] = resource.publicDns;
+
+    const machineMeta = mergeMachineMeta(defaults.machine, appConfig.machine, instance.machine);
+    const host = resource.publicDns ?? resource.publicIp ?? resource.privateIp ?? null;
+
+    machines[instanceName] = {
+      id: resource.instanceId,
+      name: instanceName,
+      host,
+      ssh: {
+        user: machineMeta.ssh?.user ?? "root",
+        port: machineMeta.ssh?.port ?? 22,
+        keyPath: machineMeta.ssh?.keyPath ?? null,
+      },
+      tags: machineMeta.tags ?? [],
+      roles: machineMeta.roles ?? [],
+      targetEnv: machineMeta.targetEnv ?? null,
+      arch: machineMeta.arch ?? null,
+      provider: "aws-ec2",
+      publicIp: resource.PublicIp ?? null,
+      privateIp: resource.PrivateIp ?? null,
+      labels: instanceTags,
+      metadata: {
+        subnetId,
+        instanceType:
+          instance.instanceType ?? appConfig.instanceType ?? defaults.instanceType ?? "t3.micro",
+      },
+    };
+
+    index += 1;
+  }
+
+  // ---------------------------------------------------------------------------
+  // ALB + target group + listeners + host rules
+  // ---------------------------------------------------------------------------
+  if (appAlb?.enable && appInstanceIds.length > 0) {
+    const tgPort = appAlb.targetGroup?.port ?? 80;
+    const tgProtocol = appAlb.targetGroup?.protocol ?? "HTTP";
+    const tgHealthCheck = appAlb.targetGroup?.healthCheck ?? {};
+
+    const tgName = sanitizeAwsName(`${appName}-tg`);
+    const tg = await AWS.ElasticLoadBalancingV2.TargetGroup(infra.id(`${appName}-tg`), {
+      Name: tgName,
+      Port: tgPort,
+      Protocol: tgProtocol,
+      VpcId: vpcId,
+      HealthCheckEnabled: tgHealthCheck.enabled ?? true,
+      HealthCheckProtocol: tgHealthCheck.protocol ?? "HTTP",
+      HealthCheckPort: tgHealthCheck.port ?? undefined,
+      HealthCheckPath: tgHealthCheck.path ?? "/",
+      HealthCheckIntervalSeconds: tgHealthCheck.interval ?? 30,
+      HealthCheckTimeoutSeconds: tgHealthCheck.timeout ?? 10,
+      HealthyThresholdCount: tgHealthCheck.healthyThreshold ?? 2,
+      UnhealthyThresholdCount: tgHealthCheck.unhealthyThreshold ?? 3,
+      Matcher: tgHealthCheck.matcher ? { HttpCode: tgHealthCheck.matcher } : undefined,
+      Targets: buildAlbTargets(appInstanceIds, tgPort),
+      Tags: toAwsTags(mergeTags(defaults.tags, appConfig.tags)),
+      adopt: true,
+    });
+
+    let httpListenerArn: string | undefined;
+    let httpsListenerArn: string | undefined;
+
+    if (appAlb.create !== false) {
+      // Create ALB + ALB SG
+      const albSgName = appAlb.name
+        ? `${appAlb.name}-alb-sg`
+        : `${appName}-alb-sg`;
+      const albIngressRules: RuleConfig[] = [
+        {
+          fromPort: 80,
+          toPort: 80,
+          protocol: "tcp",
+          cidrBlocks: ["0.0.0.0/0"],
+          ipv6CidrBlocks: ["::/0"],
+          description: "HTTP",
+        },
+        {
+          fromPort: 443,
+          toPort: 443,
+          protocol: "tcp",
+          cidrBlocks: ["0.0.0.0/0"],
+          ipv6CidrBlocks: ["::/0"],
+          description: "HTTPS",
+        },
+      ];
+      const albEgressRules: RuleConfig[] = [
+        {
+          fromPort: 0,
+          toPort: 0,
+          protocol: "-1",
+          cidrBlocks: ["0.0.0.0/0"],
+          ipv6CidrBlocks: ["::/0"],
+        },
+      ];
+      const albSg = await SecurityGroup(infra.id(`${appName}-alb-sg`), {
+        name: albSgName,
+        description: `ALB security group for ${appName}`,
+        vpcId,
+        ingress: albIngressRules,
+        egress: albEgressRules,
+        tags: mergeTags(defaults.tags, appConfig.tags, { Name: albSgName }),
+      });
+
+      const albName = sanitizeAwsName(appAlb.name ?? `${appName}-alb`);
+      const alb = await AWS.ElasticLoadBalancingV2.LoadBalancer(infra.id(`${appName}-alb`), {
+        Name: albName,
+        Subnets: pickList(appAlb.subnetIds, subnetIds),
+        SecurityGroups: pickList(appAlb.securityGroupIds, [albSg.groupId]),
+        Scheme: appAlb.scheme ?? "internet-facing",
+        IpAddressType: appAlb.ipAddressType ?? "ipv4",
+        Type: "application",
+        Tags: toAwsTags(mergeTags(defaults.tags, appConfig.tags)),
+        adopt: true,
+      });
+
+      if (appAlb.http !== false) {
+        const httpListener = await AWS.ElasticLoadBalancingV2.Listener(
+          infra.id(`${appName}-http`),
+          {
+            LoadBalancerArn: alb.LoadBalancerArn,
+            Port: 80,
+            Protocol: "HTTP",
+            DefaultActions: [{ Type: "forward", TargetGroupArn: tg.TargetGroupArn }],
+            adopt: true,
+          },
+        );
+        httpListenerArn = httpListener.ListenerArn;
+      }
+
+      if (appAlb.https && appAlb.certificateArn) {
+        const httpsListener = await AWS.ElasticLoadBalancingV2.Listener(
+          infra.id(`${appName}-https`),
+          {
+            LoadBalancerArn: alb.LoadBalancerArn,
+            Port: 443,
+            Protocol: "HTTPS",
+            SslPolicy: appAlb.sslPolicy ?? "ELBSecurityPolicy-TLS13-1-2-2021-06",
+            Certificates: [{ CertificateArn: appAlb.certificateArn }],
+            DefaultActions: [{ Type: "forward", TargetGroupArn: tg.TargetGroupArn }],
+            adopt: true,
+          },
+        );
+        httpsListenerArn = httpsListener.ListenerArn;
+      }
+
+      albOutputs[appName] = {
+        albArn: alb.LoadBalancerArn,
+        albDnsName: alb.DNSName,
+        albZoneId: alb.CanonicalHostedZoneID,
+        targetGroupArn: tg.TargetGroupArn,
+        httpListenerArn: httpListenerArn ?? null,
+        httpsListenerArn: httpsListenerArn ?? null,
+      };
+    } else {
+      // Use existing shared listeners
+      httpListenerArn = appAlb.existingListenerHttpArn ?? undefined;
+      httpsListenerArn = appAlb.existingListenerHttpsArn ?? undefined;
+
+      albOutputs[appName] = {
+        targetGroupArn: tg.TargetGroupArn,
+        httpListenerArn: httpListenerArn ?? null,
+        httpsListenerArn: httpsListenerArn ?? null,
+      };
+    }
+
+    // Host-based routing rules
+    const hostnames = appAlb.hostnames ?? [];
+    if (hostnames.length > 0) {
+      const listenerArn = httpsListenerArn ?? httpListenerArn;
+      if (listenerArn) {
+        const priority = appAlb.hostRulePriority ?? 100;
+        await AWS.ElasticLoadBalancingV2.ListenerRule(
+          infra.id(`${appName}-host-rule`),
+          {
+            ListenerArn: listenerArn,
+            Priority: priority,
+            Conditions: [
+              {
+                Field: "host-header",
+                HostHeaderConfig: {
+                  Values: hostnames,
+                },
+              },
+            ],
+            Actions: [{ Type: "forward", TargetGroupArn: tg.TargetGroupArn }],
+            adopt: true,
+          },
+        );
+      }
+    }
+  }
+}
+
+// =============================================================================
+// Export
+// =============================================================================
+
+export default {
+  instanceIds: JSON.stringify(instanceIds),
+  publicIps: JSON.stringify(publicIps),
+  privateIps: JSON.stringify(privateIps),
+  publicDns: JSON.stringify(publicDns),
+  machines: JSON.stringify(machines),
+  albOutputs: JSON.stringify(albOutputs),
+  ecrOutputs: JSON.stringify(ecrOutputs),
+  ssmOutputs: JSON.stringify(ssmOutputs),
+};
diff --git a/packages/infra/modules/aws-ec2-deploy.ts b/packages/infra/modules/aws-ec2-deploy.ts
new file mode 100644
index 00000000..3bfdcfb8
--- /dev/null
+++ b/packages/infra/modules/aws-ec2-deploy.ts
@@ -0,0 +1,497 @@
+import { isSecret, type Secret } from "alchemy";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+import {
+  InternetGateway,
+  InternetGatewayAttachment,
+  Role,
+  Route,
+  RouteTable,
+  RouteTableAssociation,
+  SecurityGroup,
+  SecurityGroupRule,
+  SSMParameter,
+  Subnet,
+  Vpc,
+} from "alchemy/aws";
+import AWS from "alchemy/aws/control";
+
+const DEFAULT_IMAGE_ID =
+  "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}";
+
+type EnvironmentValue = string | Secret<string>;
+
+export interface Ec2ServerProps {
+  appName: string;
+  parameterPath: string;
+  artifactBucket: string;
+  artifactKey: string;
+  artifactVersion?: string;
+  environment: Record<string, EnvironmentValue>;
+  region?: string;
+  availabilityZone?: string | null;
+  imageId?: string | null;
+  instanceType?: string | null;
+  keyName?: string | null;
+  port?: number | null;
+  httpCidrBlocks?: string[];
+  sshCidrBlocks?: string[];
+  vpcCidrBlock?: string | null;
+  subnetCidrBlock?: string | null;
+  rootVolumeSize?: number | null;
+  tags?: Record<string, string>;
+}
+
+export interface Ec2Server extends Ec2ServerProps {
+  instanceId: string;
+  publicIp: string;
+  publicDnsName: string;
+  url: string;
+  vpcId: string;
+  subnetId: string;
+  securityGroupId: string;
+  roleArn: string;
+  instanceProfileArn: string;
+}
+
+export interface RuntimeLayout {
+  slug: string;
+  serviceName: string;
+  appRoot: string;
+  releaseRoot: string;
+  envFile: string;
+  archivePath: string;
+}
+
+export function deriveRuntimeLayout(appName: string): RuntimeLayout {
+  const slug = sanitizeName(appName);
+  const baseName = `stackpanel-${slug}`;
+
+  return {
+    slug,
+    serviceName: `${baseName}.service`,
+    appRoot: `/opt/${baseName}`,
+    releaseRoot: `/opt/${baseName}/release`,
+    envFile: `/etc/${baseName}.env`,
+    archivePath: `/tmp/${baseName}-release.tar.gz`,
+  };
+}
+
+export async function Ec2Server(
+  id: string,
+  props: Ec2ServerProps,
+): Promise<Ec2Server> {
+  const region = props.region ?? "us-west-2";
+  const availabilityZone = props.availabilityZone ?? `${region}a`;
+  const imageId = await resolveImageId(props.imageId ?? DEFAULT_IMAGE_ID, region);
+  const instanceType = props.instanceType ?? "t3.small";
+  const port = props.port ?? 80;
+  const httpCidrBlocks = props.httpCidrBlocks ?? ["0.0.0.0/0"];
+  const sshCidrBlocks = props.sshCidrBlocks ?? [];
+  const vpcCidrBlock = props.vpcCidrBlock ?? "10.42.0.0/16";
+  const subnetCidrBlock = props.subnetCidrBlock ?? "10.42.1.0/24";
+  const rootVolumeSize = props.rootVolumeSize ?? 20;
+  const namePrefix = props.tags?.Stage ? `${id}-${props.tags.Stage}` : id;
+  const layout = deriveRuntimeLayout(props.appName);
+  const tags = {
+    Name: id,
+    ManagedBy: "alchemy",
+    Service: props.appName,
+    ...props.tags,
+  };
+
+  const role = await Role(`${id}-instance-role`, {
+    roleName: `${namePrefix}-instance-role`,
+    assumeRolePolicy: {
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: {
+            Service: "ec2.amazonaws.com",
+          },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    },
+    description: `Allows the EC2 instance for ${props.appName} to read boot-time config and artifacts.`,
+    managedPolicyArns: [
+      "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    ],
+    policies: [
+      {
+        policyName: `${id}-read-config`,
+        policyDocument: {
+          Version: "2012-10-17",
+          Statement: [
+            {
+              Effect: "Allow",
+              Action: [
+                "ssm:GetParameter",
+                "ssm:GetParameters",
+                "ssm:GetParametersByPath",
+              ],
+              Resource: [
+                `arn:aws:ssm:${region}:*:parameter${props.parameterPath}`,
+                `arn:aws:ssm:${region}:*:parameter${props.parameterPath}/*`,
+              ],
+            },
+            {
+              Effect: "Allow",
+              Action: ["s3:GetBucketLocation", "s3:ListBucket"],
+              Resource: [`arn:aws:s3:::${props.artifactBucket}`],
+              Condition: {
+                StringLike: {
+                  "s3:prefix": [props.artifactKey],
+                },
+              },
+            },
+            {
+              Effect: "Allow",
+              Action: ["s3:GetObject"],
+              Resource: [
+                `arn:aws:s3:::${props.artifactBucket}/${props.artifactKey}`,
+              ],
+            },
+            {
+              Effect: "Allow",
+              Action: ["kms:Decrypt"],
+              Resource: "*",
+            },
+          ],
+        },
+      },
+    ],
+    tags,
+  });
+
+  const instanceProfileName = `${namePrefix}-instance-profile`;
+  const instanceProfile = await AWS.IAM.InstanceProfile(
+    `${id}-instance-profile`,
+    {
+      InstanceProfileName: instanceProfileName,
+      Roles: [role.roleName],
+    },
+  );
+
+  await Promise.all(
+    Object.entries(props.environment).map(([key, value]) => {
+      const name = `${trimTrailingSlash(props.parameterPath)}/${key}`;
+
+      if (isSecret(value)) {
+        return SSMParameter(`${id}-env-${key.toLowerCase()}`, {
+          name,
+          description: `Runtime configuration for ${props.appName}: ${key}`,
+          type: "SecureString",
+          value,
+          tags,
+        });
+      }
+
+      return SSMParameter(`${id}-env-${key.toLowerCase()}`, {
+        name,
+        description: `Runtime configuration for ${props.appName}: ${key}`,
+        value,
+        tags,
+      });
+    }),
+  );
+
+  const vpc = await Vpc(`${id}-vpc`, {
+    cidrBlock: vpcCidrBlock,
+    enableDnsSupport: true,
+    enableDnsHostnames: true,
+    region,
+    tags,
+  });
+
+  const internetGateway = await InternetGateway(`${id}-igw`, {
+    region,
+    tags,
+  });
+
+  await InternetGatewayAttachment(`${id}-igw-attachment`, {
+    internetGateway,
+    vpc,
+    region,
+  });
+
+  const routeTable = await RouteTable(`${id}-public-rt`, {
+    vpc,
+    region,
+    tags,
+  });
+
+  await Route(`${id}-default-route`, {
+    routeTable,
+    region,
+    destinationCidrBlock: "0.0.0.0/0",
+    target: {
+      internetGateway,
+    },
+  });
+
+  const subnet = await Subnet(`${id}-public-subnet`, {
+    vpc,
+    region,
+    cidrBlock: subnetCidrBlock,
+    availabilityZone,
+    mapPublicIpOnLaunch: true,
+    tags,
+  });
+
+  await RouteTableAssociation(`${id}-public-association`, {
+    routeTable,
+    subnet,
+  });
+
+  const securityGroup = await SecurityGroup(`${id}-sg`, {
+    vpc,
+    region,
+    description: `Ingress rules for ${props.appName}`,
+    tags,
+  });
+
+  await Promise.all(
+    httpCidrBlocks.map((cidr, index) =>
+      SecurityGroupRule(`${id}-http-${index}`, {
+        securityGroup,
+        type: "ingress",
+        protocol: "tcp",
+        fromPort: port,
+        toPort: port,
+        cidrBlocks: [cidr],
+        description: `Allow HTTP traffic on port ${port}`,
+      }),
+    ),
+  );
+
+  if (props.keyName && sshCidrBlocks.length > 0) {
+    await Promise.all(
+      sshCidrBlocks.map((cidr, index) =>
+        SecurityGroupRule(`${id}-ssh-${index}`, {
+          securityGroup,
+          type: "ingress",
+          protocol: "tcp",
+          fromPort: 22,
+          toPort: 22,
+          cidrBlocks: [cidr],
+          description: "Allow SSH access",
+        }),
+      ),
+    );
+  }
+
+  const instance = await AWS.EC2.Instance(id, {
+    AvailabilityZone: availabilityZone,
+    IamInstanceProfile: instanceProfileName,
+    ImageId: imageId,
+    InstanceType: instanceType,
+    KeyName: props.keyName ?? undefined,
+    MetadataOptions: {
+      HttpEndpoint: "enabled",
+      HttpTokens: "required",
+    },
+    PropagateTagsToVolumeOnCreation: true,
+    SecurityGroupIds: [securityGroup.groupId],
+    SubnetId: subnet.subnetId,
+    Tags: toAwsTags(tags),
+    UserData: Buffer.from(
+      buildUserData({
+        appName: props.appName,
+        artifactBucket: props.artifactBucket,
+        artifactKey: props.artifactKey,
+        artifactVersion: props.artifactVersion,
+        layout,
+        parameterPath: props.parameterPath,
+        port,
+        region,
+      }),
+      "utf8",
+    ).toString("base64"),
+    BlockDeviceMappings: [
+      {
+        DeviceName: "/dev/xvda",
+        Ebs: {
+          DeleteOnTermination: true,
+          VolumeSize: rootVolumeSize,
+          VolumeType: "gp3",
+        },
+      },
+    ],
+  });
+
+  const host = instance.PublicDnsName || instance.PublicIp;
+  const url = `http://${host}${port === 80 ? "" : `:${port}`}`;
+
+  return {
+    ...props,
+    availabilityZone,
+    imageId,
+    instanceType,
+    port,
+    rootVolumeSize,
+    publicIp: instance.PublicIp,
+    instanceId: instance.InstanceId,
+    publicDnsName: instance.PublicDnsName,
+    url,
+    vpcId: vpc.vpcId,
+    subnetId: subnet.subnetId,
+    securityGroupId: securityGroup.groupId,
+    roleArn: role.arn,
+    instanceProfileArn: instanceProfile.Arn,
+  };
+}
+
+export function buildUserData({
+  appName,
+  artifactBucket,
+  artifactKey,
+  artifactVersion,
+  layout = deriveRuntimeLayout(appName),
+  parameterPath,
+  port,
+  region,
+}: {
+  appName: string;
+  artifactBucket: string;
+  artifactKey: string;
+  artifactVersion?: string;
+  layout?: RuntimeLayout;
+  parameterPath: string;
+  port: number;
+  region: string;
+  rootVolumeSize?: number | null;
+}) {
+  return `#!/bin/bash
+set -euxo pipefail
+
+export HOME=/root
+export PATH=/usr/local/bin:/usr/bin:/bin
+
+dnf update -y
+dnf install -y jq unzip nodejs
+
+curl -fsSL https://bun.sh/install | bash
+export BUN_INSTALL=/root/.bun
+export PATH=$BUN_INSTALL/bin:$PATH
+
+cat >/usr/local/bin/${layout.slug}-bootstrap <<'EOF'
+#!/bin/bash
+set -euo pipefail
+
+export HOME=/root
+export PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
+export AWS_REGION=${shellString(region)}
+
+ARTIFACT_BUCKET=${shellString(artifactBucket)}
+ARTIFACT_KEY=${shellString(artifactKey)}
+ARTIFACT_VERSION=${shellString(artifactVersion ?? "unknown")}
+PARAMETER_PATH=${shellString(trimTrailingSlash(parameterPath))}
+APP_ROOT=${shellString(layout.appRoot)}
+RELEASE_ROOT=${shellString(layout.releaseRoot)}
+ENV_FILE=${shellString(layout.envFile)}
+ARCHIVE_PATH=${shellString(layout.archivePath)}
+
+rm -rf "$RELEASE_ROOT"
+mkdir -p "$RELEASE_ROOT"
+
+aws s3 cp "s3://$ARTIFACT_BUCKET/$ARTIFACT_KEY" "$ARCHIVE_PATH" --region "$AWS_REGION"
+tar -xzf "$ARCHIVE_PATH" -C "$RELEASE_ROOT"
+
+cat >"$ENV_FILE" <<ENVEOF
+NODE_ENV=production
+HOST=0.0.0.0
+PORT=${port}
+ARTIFACT_BUCKET=$ARTIFACT_BUCKET
+ARTIFACT_KEY=$ARTIFACT_KEY
+ARTIFACT_VERSION=$ARTIFACT_VERSION
+ENVEOF
+
+aws ssm get-parameters-by-path \\
+  --path "$PARAMETER_PATH" \\
+  --recursive \\
+  --with-decryption \\
+  --output json \\
+  --region "$AWS_REGION" \\
+| jq -r '.Parameters[] | "\\(.Name | split("/")[-1])=\\(.Value)"' >>"$ENV_FILE"
+EOF
+
+chmod +x /usr/local/bin/${layout.slug}-bootstrap
+/usr/local/bin/${layout.slug}-bootstrap
+
+cat >/etc/systemd/system/${layout.serviceName} <<'EOF'
+[Unit]
+Description=stackpanel ${appName}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=${layout.releaseRoot}
+Environment=PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
+EnvironmentFile=${layout.envFile}
+ExecStart=/usr/bin/node ${layout.releaseRoot}/.output/server/index.mjs
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now ${layout.serviceName}
+`;
+}
+
+async function resolveImageId(imageId: string, region: string) {
+  if (imageId.startsWith("ami-")) {
+    return imageId;
+  }
+
+  const match = imageId.match(/^\{\{resolve:ssm:([^}:]+)(?::\d+)?\}\}$/);
+  if (!match) {
+    return imageId;
+  }
+
+  const parameterName = match[1];
+  const client = new SSMClient({ region });
+  const response = await client.send(
+    new GetParameterCommand({
+      Name: parameterName,
+    }),
+  );
+  const resolvedImageId = response.Parameter?.Value;
+
+  if (!resolvedImageId?.startsWith("ami-")) {
+    throw new Error(
+      `Resolved AMI from SSM parameter ${parameterName} was not a valid EC2 image id.`,
+    );
+  }
+
+  return resolvedImageId;
+}
+
+function toAwsTags(tags: Record<string, string>) {
+  return Object.entries(tags).map(([Key, Value]) => ({
+    Key,
+    Value,
+  }));
+}
+
+function trimTrailingSlash(value: string) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+
+function shellString(value: string) {
+  return JSON.stringify(value);
+}
+
+function sanitizeName(value: string) {
+  const sanitized = value
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+
+  return sanitized || "app";
+}
diff --git a/packages/infra/modules/aws-secrets.ts b/packages/infra/modules/aws-secrets.ts
new file mode 100644
index 00000000..2f980329
--- /dev/null
+++ b/packages/infra/modules/aws-secrets.ts
@@ -0,0 +1,249 @@
+// ==============================================================================
+// AWS Secrets Infrastructure Module
+//
+// Provisions:
+//   - GitHub Actions / Fly.io OIDC provider
+//   - IAM role with OIDC trust policy
+//   - KMS key + alias for secrets encryption
+//   - KMS access policy attached to the role
+//
+// This is a stackpanel infra module. It uses the @stackpanel/infra library
+// for input resolution and output collection.
+// ==============================================================================
+import { Role } from "alchemy/aws";
+import AWS from "alchemy/aws/control";
+import { GitHubOIDCProvider } from "alchemy/aws/oidc";
+import { AccountId } from "alchemy/aws";
+import Infra from "@stackpanel/infra";
+
+const infra = new Infra("aws-secrets");
+const inputs = infra.inputs(process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES);
+
+// ============================================================================
+// IAM Role
+// ============================================================================
+
+const accountId = await AccountId();
+const oidcProviderUrl = "token.actions.githubusercontent.com";
+const oidcProviderArn = `arn:aws:iam::${accountId}:oidc-provider/${oidcProviderUrl}`;
+
+// Build assume role policy based on OIDC provider type
+let assumeRolePolicy: any;
+
+switch (inputs.oidc.provider) {
+	case "github-actions": {
+		const { org, repo } = inputs.oidc.githubActions;
+		assumeRolePolicy = {
+			Version: "2012-10-17" as const,
+			Statement: [
+				{
+					Effect: "Allow" as const,
+					Principal: {
+						Federated: oidcProviderArn,
+					},
+					Action: "sts:AssumeRoleWithWebIdentity",
+					Condition: {
+						StringEquals: {
+							[`${oidcProviderUrl}:aud`]: "sts.amazonaws.com",
+						},
+						StringLike: {
+							[`${oidcProviderUrl}:sub`]: `repo:${org}/${repo}:*`,
+						},
+					},
+				},
+			],
+		};
+		break;
+	}
+
+	case "flyio": {
+		const { orgId, appName } = inputs.oidc.flyio;
+		const flyOidcUrl = `oidc.fly.io/${orgId}`;
+		assumeRolePolicy = {
+			Version: "2012-10-17" as const,
+			Statement: [
+				{
+					Effect: "Allow" as const,
+					Principal: {
+						Federated: `arn:aws:iam::${accountId}:oidc-provider/${flyOidcUrl}`,
+					},
+					Action: "sts:AssumeRoleWithWebIdentity",
+					Condition: {
+						StringEquals: {
+							[`${flyOidcUrl}:aud`]: "sts.amazonaws.com",
+						},
+						StringLike: {
+							[`${flyOidcUrl}:sub`]: `${orgId}:${appName}:*`,
+						},
+					},
+				},
+			],
+		};
+		break;
+	}
+
+	case "roles-anywhere": {
+		assumeRolePolicy = {
+			Version: "2012-10-17" as const,
+			Statement: [
+				{
+					Effect: "Allow" as const,
+					Principal: {
+						Service: "rolesanywhere.amazonaws.com",
+					},
+					Action: [
+						"sts:AssumeRole",
+						"sts:TagSession",
+						"sts:SetSourceIdentity",
+					],
+					Condition: {
+						ArnEquals: {
+							"aws:SourceArn":
+								inputs.oidc.rolesAnywhere.trustAnchorArn,
+						},
+					},
+				},
+			],
+		};
+		break;
+	}
+
+	default: {
+		// No OIDC — basic role with no trust policy
+		assumeRolePolicy = {
+			Version: "2012-10-17" as const,
+			Statement: [],
+		};
+	}
+}
+
+const role = await Role(infra.id("role"), {
+	roleName: inputs.iam.roleName,
+	assumeRolePolicy,
+	description: `IAM role for ${inputs.projectName} secrets access`,
+	tags: {
+		Project: inputs.projectName,
+		ManagedBy: "stackpanel-infra",
+	},
+	managedPolicyArns: inputs.iam.additionalPolicies ?? [],
+});
+
+// ============================================================================
+// GitHub OIDC Provider (only for github-actions provider)
+// ============================================================================
+let resolvedOidcProviderArn = oidcProviderArn;
+
+if (inputs.oidc.provider === "github-actions") {
+	const oidcProvider = await GitHubOIDCProvider(infra.id("oidc"), {
+		owner: inputs.oidc.githubActions.org,
+		repository: inputs.oidc.githubActions.repo,
+		roleArn: role.arn,
+	});
+	resolvedOidcProviderArn = oidcProvider.providerArn;
+}
+
+// ============================================================================
+// KMS Key + Alias
+// ============================================================================
+
+const kmsKeyPolicy = JSON.stringify({
+	Version: "2012-10-17",
+	Statement: [
+		// Root account gets full access
+		{
+			Effect: "Allow",
+			Principal: {
+				AWS: `arn:aws:iam::${accountId}:root`,
+			},
+			Action: "kms:*",
+			Resource: "*",
+		},
+		// The secrets role gets encrypt/decrypt
+		{
+			Effect: "Allow",
+			Principal: {
+				AWS: role.arn,
+			},
+			Action: [
+				"kms:Decrypt",
+				"kms:Encrypt",
+				"kms:GenerateDataKey*",
+				"kms:DescribeKey",
+			],
+			Resource: "*",
+		},
+	],
+});
+
+const kmsKey = await AWS.KMS.Key(infra.id("kms-key"), {
+	Description: `KMS key for encrypting ${inputs.projectName} secrets`,
+	EnableKeyRotation: true,
+	PendingWindowInDays: inputs.kms.deletionWindowDays,
+	KeyPolicy: JSON.parse(kmsKeyPolicy),
+	Tags: Object.entries({
+		Name: inputs.kms.alias,
+		Project: inputs.projectName,
+		ManagedBy: "stackpanel-infra",
+	}).map(([Key, Value]) => ({ Key, Value })),
+	adopt: true,
+});
+
+const kmsAlias = await AWS.KMS.Alias(infra.id("kms-alias"), {
+	AliasName: `alias/${inputs.kms.alias}`,
+	TargetKeyId: kmsKey.KeyId,
+	adopt: true,
+});
+
+// Grant the role KMS permissions via inline policy
+await Role(infra.id("role"), {
+	roleName: inputs.iam.roleName,
+	assumeRolePolicy,
+	description: `IAM role for ${inputs.projectName} secrets access`,
+	tags: {
+		Project: inputs.projectName,
+		ManagedBy: "stackpanel-infra",
+	},
+	managedPolicyArns: inputs.iam.additionalPolicies ?? [],
+	policies: [
+		{
+			policyName: `${inputs.iam.roleName}-kms-policy`,
+			policyDocument: {
+				Version: "2012-10-17",
+				Statement: [
+					{
+						Effect: "Allow",
+						Action: [
+							"kms:Decrypt",
+							"kms:Encrypt",
+							"kms:GenerateDataKey*",
+							"kms:DescribeKey",
+						],
+						Resource: kmsKey.Arn,
+					},
+					{
+						Effect: "Allow",
+						Action: ["kms:Decrypt"],
+						Resource: "*",
+						Condition: {
+							StringLike: {
+								"kms:RequestAlias": `alias/${inputs.kms.alias}`,
+							},
+						},
+					},
+				],
+			},
+		},
+	],
+});
+
+// ============================================================================
+// Outputs
+// ============================================================================
+export default {
+	roleArn: role.arn,
+	roleName: role.roleName,
+	kmsKeyArn: kmsKey.Arn,
+	kmsKeyId: kmsKey.KeyId,
+	kmsAliasName: kmsAlias.AliasName,
+	oidcProviderArn: resolvedOidcProviderArn,
+};
diff --git a/packages/infra/modules/aws-secrets/index.ts b/packages/infra/modules/aws-secrets/index.ts
new file mode 100644
index 00000000..33519bf7
--- /dev/null
+++ b/packages/infra/modules/aws-secrets/index.ts
@@ -0,0 +1,85 @@
+import { AccountId } from "alchemy/aws";
+import AWS from "alchemy/aws/control";
+import { GitHubOIDCProvider } from "alchemy/aws/oidc";
+import Infra from "@stackpanel/infra";
+import { IamRole } from "@stackpanel/infra/resources/iam-role";
+import {
+  buildAssumeRolePolicy,
+  buildKmsKeyPolicy,
+  buildRoleKmsInlinePolicy,
+  githubActionsProviderArn,
+} from "./policies";
+
+const infra = new Infra("aws-secrets");
+const inputs = infra.inputs(process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES);
+
+const accountId = await AccountId();
+const assumeRolePolicy = buildAssumeRolePolicy(inputs.oidc, accountId) as any;
+
+const roleTags = {
+  Project: inputs.projectName,
+  ManagedBy: "stackpanel-infra",
+};
+
+const rolePolicyName = `${inputs.iam.roleName}-kms-policy`;
+
+const role = await IamRole(infra.id("role"), {
+  roleName: inputs.iam.roleName,
+  assumeRolePolicy,
+  description: `IAM role for ${inputs.projectName} secrets access`,
+  tags: roleTags,
+  managedPolicyArns: inputs.iam.additionalPolicies ?? [],
+});
+
+let resolvedOidcProviderArn = githubActionsProviderArn(accountId);
+
+if (inputs.oidc.provider === "github-actions") {
+  const oidcProvider = await GitHubOIDCProvider(infra.id("oidc"), {
+    adopt: true,
+    owner: inputs.oidc.githubActions.org,
+    repository: inputs.oidc.githubActions.repo,
+    roleArn: role.arn,
+  } as any);
+  resolvedOidcProviderArn = oidcProvider.providerArn;
+}
+
+const kmsKey = await AWS.KMS.Key(infra.id("kms-key"), {
+  Description: `KMS key for encrypting ${inputs.projectName} secrets`,
+  EnableKeyRotation: true,
+  PendingWindowInDays: inputs.kms.deletionWindowDays,
+  KeyPolicy: JSON.parse(buildKmsKeyPolicy(accountId, role.arn)),
+  Tags: Object.entries({
+    Name: inputs.kms.alias,
+    ...roleTags,
+  }).map(([Key, Value]) => ({ Key, Value })),
+  adopt: true,
+});
+
+const kmsAlias = await AWS.KMS.Alias(infra.id("kms-alias"), {
+  AliasName: `alias/${inputs.kms.alias}`,
+  TargetKeyId: kmsKey.KeyId,
+  adopt: true,
+});
+
+await IamRole(infra.id("role"), {
+  roleName: inputs.iam.roleName,
+  assumeRolePolicy,
+  description: `IAM role for ${inputs.projectName} secrets access`,
+  tags: roleTags,
+  managedPolicyArns: inputs.iam.additionalPolicies ?? [],
+  policies: [
+    {
+      policyName: rolePolicyName,
+      ...buildRoleKmsInlinePolicy(inputs.kms.alias, kmsKey.Arn),
+    },
+  ],
+});
+
+export default {
+  roleArn: role.arn,
+  roleName: role.roleName,
+  kmsKeyArn: kmsKey.Arn,
+  kmsKeyId: kmsKey.KeyId,
+  kmsAliasName: kmsAlias.AliasName,
+  oidcProviderArn: resolvedOidcProviderArn,
+};
diff --git a/packages/infra/modules/aws-secrets/policies.ts b/packages/infra/modules/aws-secrets/policies.ts
new file mode 100644
index 00000000..bc0a2091
--- /dev/null
+++ b/packages/infra/modules/aws-secrets/policies.ts
@@ -0,0 +1,147 @@
+const OIDC_PROVIDER_URL = "token.actions.githubusercontent.com";
+
+type OidcInputs = {
+  provider: "github-actions" | "flyio" | "roles-anywhere" | string;
+  githubActions: {
+    org: string;
+    repo: string;
+  };
+  flyio: {
+    orgId: string;
+    appName: string;
+  };
+  rolesAnywhere: {
+    trustAnchorArn: string;
+  };
+};
+
+export function githubActionsProviderArn(accountId: string): string {
+  return `arn:aws:iam::${accountId}:oidc-provider/${OIDC_PROVIDER_URL}`;
+}
+
+export function buildAssumeRolePolicy(inputs: OidcInputs, accountId: string): unknown {
+  switch (inputs.provider) {
+    case "github-actions": {
+      const { org, repo } = inputs.githubActions;
+      return {
+        Version: "2012-10-17" as const,
+        Statement: [
+          {
+            Effect: "Allow" as const,
+            Principal: {
+              Federated: githubActionsProviderArn(accountId),
+            },
+            Action: "sts:AssumeRoleWithWebIdentity",
+            Condition: {
+              StringEquals: {
+                [`${OIDC_PROVIDER_URL}:aud`]: "sts.amazonaws.com",
+              },
+              StringLike: {
+                [`${OIDC_PROVIDER_URL}:sub`]: `repo:${org}/${repo}:*`,
+              },
+            },
+          },
+        ],
+      };
+    }
+
+    case "flyio": {
+      const { orgId, appName } = inputs.flyio;
+      const flyOidcUrl = `oidc.fly.io/${orgId}`;
+      return {
+        Version: "2012-10-17" as const,
+        Statement: [
+          {
+            Effect: "Allow" as const,
+            Principal: {
+              Federated: `arn:aws:iam::${accountId}:oidc-provider/${flyOidcUrl}`,
+            },
+            Action: "sts:AssumeRoleWithWebIdentity",
+            Condition: {
+              StringEquals: {
+                [`${flyOidcUrl}:aud`]: "sts.amazonaws.com",
+              },
+              StringLike: {
+                [`${flyOidcUrl}:sub`]: `${orgId}:${appName}:*`,
+              },
+            },
+          },
+        ],
+      };
+    }
+
+    case "roles-anywhere":
+      return {
+        Version: "2012-10-17" as const,
+        Statement: [
+          {
+            Effect: "Allow" as const,
+            Principal: {
+              Service: "rolesanywhere.amazonaws.com",
+            },
+            Action: ["sts:AssumeRole", "sts:TagSession", "sts:SetSourceIdentity"],
+            Condition: {
+              ArnEquals: {
+                "aws:SourceArn": inputs.rolesAnywhere.trustAnchorArn,
+              },
+            },
+          },
+        ],
+      };
+
+    default:
+      return {
+        Version: "2012-10-17" as const,
+        Statement: [],
+      };
+  }
+}
+
+export function buildKmsKeyPolicy(accountId: string, roleArn: string): string {
+  return JSON.stringify({
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Allow",
+        Principal: {
+          AWS: `arn:aws:iam::${accountId}:root`,
+        },
+        Action: "kms:*",
+        Resource: "*",
+      },
+      {
+        Effect: "Allow",
+        Principal: {
+          AWS: roleArn,
+        },
+        Action: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey*", "kms:DescribeKey"],
+        Resource: "*",
+      },
+    ],
+  });
+}
+
+export function buildRoleKmsInlinePolicy(alias: string, keyArn: string): { policyDocument: unknown } {
+  return {
+    policyDocument: {
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Action: ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey*", "kms:DescribeKey"],
+          Resource: keyArn,
+        },
+        {
+          Effect: "Allow",
+          Action: ["kms:Decrypt"],
+          Resource: "*",
+          Condition: {
+            StringLike: {
+              "kms:RequestAlias": `alias/${alias}`,
+            },
+          },
+        },
+      ],
+    },
+  };
+}
diff --git a/packages/infra/modules/database.ts b/packages/infra/modules/database.ts
new file mode 100644
index 00000000..48a30614
--- /dev/null
+++ b/packages/infra/modules/database.ts
@@ -0,0 +1,229 @@
+// ==============================================================================
+// Database Infrastructure Module
+//
+// Provisions the appropriate database backend based on environment:
+//   - Neon Postgres (production / CI)
+//   - Devenv Postgres (local development with Nix)
+//   - Docker Postgres (local development fallback)
+//
+// Inputs (from Nix via infra-inputs.json):
+//   projectName: string
+//   name: string (database name)
+//   provider: "auto" | "neon" | "devenv" | "docker"
+//   neon: { region, pgVersion, apiKeySsmPath, enable-branching }
+//   devenv: { database, user, password, host, port }
+//   docker: { image, tag, user, password, port, network }
+//   ssm: { enable, pathPrefix }
+//
+// Outputs:
+//   { databaseUrl: string, provider: string }
+// ==============================================================================
+import alchemy, { Resource } from "alchemy";
+import type { Context } from "alchemy";
+import { SSMParameter } from "alchemy/aws";
+import { NeonBranch, NeonProject } from "alchemy/neon";
+import * as docker from "alchemy/docker";
+import Infra from "@stackpanel/infra";
+
+// Try to import helpers from @gen/alchemy, fall back to inline
+let getSSMSecret: (name: string) => Promise<string>;
+try {
+  const helpers = await import("@gen/alchemy/helpers");
+  getSSMSecret = helpers.getSSMSecret;
+} catch {
+  // Fallback: inline SSM helper
+  getSSMSecret = async (name: string): Promise<string> => {
+    const { SSMClient, GetParameterCommand } = await import(
+      "@aws-sdk/client-ssm"
+    );
+    const client = new SSMClient({});
+    const response = await client.send(
+      new GetParameterCommand({ Name: name, WithDecryption: true }),
+    );
+    if (!response.Parameter?.Value) {
+      throw new Error(`SSM Parameter ${name} not found or empty`);
+    }
+    return response.Parameter.Value;
+  };
+}
+
+// ============================================================================
+// Custom Resource: Devenv Postgres (read-only reference to devenv service)
+// ============================================================================
+interface DevenvPostgresProps {
+  database: string;
+  user: string;
+  password: string;
+  port?: number;
+  host?: string;
+}
+
+interface DevenvPostgres extends DevenvPostgresProps {
+  connectionUrl: string;
+}
+
+const DevenvPostgres = Resource(
+  "devenv::Postgres",
+  async function (
+    this: Context<DevenvPostgres>,
+    _id: string,
+    props: DevenvPostgresProps,
+  ): Promise<DevenvPostgres> {
+    if (this.phase === "delete") {
+      return this.destroy();
+    }
+    const host = props.host ?? "localhost";
+    const port = props.port ?? 5432;
+    const connectionUrl = `postgresql://${props.user}:${props.password}@${host}:${port}/${props.database}`;
+    return { ...props, host, port, connectionUrl };
+  },
+);
+
+// ============================================================================
+// Module setup
+// ============================================================================
+const infra = new Infra("database");
+const inputs = infra.inputs(process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES);
+
+const USE_DEVENV =
+  process.env.IN_NIX_SHELL === "impure" ||
+  process.env.DEVENV_ROOT !== undefined;
+const USE_DOCKER = !USE_DEVENV && process.env.USE_DOCKER === "true";
+const STAGE = process.env.STAGE || "dev";
+const IS_PREVIEW = STAGE !== "prod" && STAGE !== "dev";
+
+// Resolve provider
+let provider: string;
+if (inputs.provider === "auto") {
+  if (USE_DEVENV) provider = "devenv";
+  else if (USE_DOCKER) provider = "docker";
+  else provider = "neon";
+} else {
+  provider = inputs.provider;
+}
+
+// ============================================================================
+// Provision database based on resolved provider
+// ============================================================================
+let databaseUrl: string;
+
+switch (provider) {
+  case "devenv": {
+    const pg = await DevenvPostgres(infra.id("devenv-postgres"), {
+      database: inputs.devenv.database,
+      user: inputs.devenv.user,
+      password: inputs.devenv.password,
+      port: inputs.devenv.port,
+      host: inputs.devenv.host,
+    });
+    databaseUrl = pg.connectionUrl;
+    console.log(`[database] Using Devenv Postgres: ${databaseUrl}`);
+    break;
+  }
+
+  case "docker": {
+    const network = await docker.Network(infra.id("network"), {
+      name: inputs.docker.network,
+    });
+
+    const volume = await docker.Volume(infra.id("postgres-data"), {
+      name: `${inputs.name}_postgres_data`,
+      labels: [
+        { name: "app", value: inputs.projectName },
+        { name: "service", value: "postgres" },
+      ],
+    });
+
+    const image = await docker.RemoteImage(infra.id("postgres-image"), {
+      name: inputs.docker.image,
+      tag: inputs.docker.tag,
+    });
+
+    await docker.Container(infra.id("postgres-container"), {
+      name: `${inputs.projectName}-postgres`,
+      image: image.imageRef,
+      networks: [{ name: network.name }],
+      volumes: [
+        {
+          hostPath: volume.name,
+          containerPath: "/var/lib/postgresql/data",
+        },
+      ],
+      environment: {
+        POSTGRES_USER: inputs.docker.user,
+        POSTGRES_PASSWORD: inputs.docker.password,
+        POSTGRES_DB: inputs.name,
+      },
+      ports: [
+        {
+          internal: 5432,
+          external: inputs.docker.port,
+        },
+      ],
+      start: true,
+    });
+
+    databaseUrl = `postgresql://${inputs.docker.user}:${inputs.docker.password}@localhost:${inputs.docker.port}/${inputs.name}`;
+    console.log(`[database] Using Docker Postgres: ${databaseUrl}`);
+    break;
+  }
+
+  case "neon":
+  default: {
+    const neonApiKey = await getSSMSecret(inputs.neon.apiKeySsmPath);
+
+    const neonProject = await NeonProject(infra.id("neon-project"), {
+      name: inputs.name,
+      apiKey: alchemy.secret(neonApiKey),
+      region_id: inputs.neon.region,
+      pg_version: inputs.neon.pgVersion,
+    });
+
+    if (IS_PREVIEW && inputs.neon["enable-branching"]) {
+      // Create a separate branch for preview environments
+      const previewBranch = await NeonBranch(infra.id(`neon-branch-${STAGE}`), {
+        project: neonProject,
+        name: STAGE,
+        apiKey: alchemy.secret(neonApiKey),
+        endpoints: [{ type: "read_write" }],
+      });
+      const connUri = previewBranch.connectionUris[0];
+      if (!connUri) {
+        throw new Error(`No connection URI available for branch ${STAGE}`);
+      }
+      databaseUrl = connUri.connection_uri.unencrypted;
+      console.log(
+        `[database] Using Neon Preview Branch: ${previewBranch.name}`,
+      );
+    } else {
+      databaseUrl =
+        neonProject.connection_uris[0].connection_uri.unencrypted;
+      console.log(
+        `[database] Using Neon: ${neonProject.name} (branch: ${neonProject.branch.name})`,
+      );
+    }
+
+    // Optionally write to SSM
+    if (inputs.ssm.enable) {
+      await SSMParameter(infra.id("database-url-ssm"), {
+        name: `${inputs.ssm.pathPrefix}/${STAGE}/database-url`,
+        type: "SecureString",
+        value: alchemy.secret(databaseUrl),
+        description: `Database connection URL for ${inputs.projectName} ${STAGE}`,
+        tags: {
+          app: inputs.projectName,
+          stage: STAGE,
+        },
+      });
+    }
+    break;
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+export default {
+  databaseUrl,
+  provider,
+};
diff --git a/packages/infra/modules/deployment-plan.ts b/packages/infra/modules/deployment-plan.ts
new file mode 100644
index 00000000..af1dbc54
--- /dev/null
+++ b/packages/infra/modules/deployment-plan.ts
@@ -0,0 +1,107 @@
+export interface AppInput {
+  framework: string;
+  host: string;
+  path: string;
+  bindings: string[];
+  secrets: string[];
+  aws?: {
+    region?: string | null;
+    availabilityZone?: string | null;
+    imageId?: string | null;
+    instanceType?: string | null;
+    keyName?: string | null;
+    port?: number | null;
+    parameterPath?: string | null;
+    httpCidrBlocks?: string[];
+    sshCidrBlocks?: string[];
+    rootVolumeSize?: number | null;
+    vpcCidrBlock?: string | null;
+    subnetCidrBlock?: string | null;
+    tags?: Record<string, string>;
+  };
+  cloudflare?: {
+    workerName?: string;
+    route?: string | null;
+    compatibility?: "node" | "browser";
+  };
+  ssr?: boolean;
+  assetsDir?: string;
+  entrypoint?: string;
+  output?: string;
+}
+
+export interface DeploymentInputs {
+  apps: Record<string, AppInput>;
+  aws?: {
+    region?: string | null;
+    instanceType?: string | null;
+    port?: number | null;
+    artifact?: {
+      bucket?: string | null;
+      keyPrefix?: string | null;
+    };
+  };
+  cloudflare?: {
+    compatibilityDate?: string | null;
+    defaultRoute?: string | null;
+  };
+}
+
+export type DeploymentPlan =
+  | {
+      kind: "cloudflare-nextjs-app";
+      appScopeName: string;
+      cwd: string;
+      resourceName: "website";
+    }
+  | {
+      kind: "cloudflare-app";
+      appScopeName: string;
+      cwd: string;
+      framework: string;
+      resourceName: string;
+    }
+  | {
+      kind: "aws-ec2-app";
+      appScopeName: string;
+      cwd: string;
+      resourceName: string;
+    };
+
+export function buildDeploymentPlan(
+  appName: string,
+  app: AppInput,
+): DeploymentPlan {
+  switch (app.host) {
+    case "cloudflare":
+      if (app.framework === "nextjs") {
+        return {
+          kind: "cloudflare-nextjs-app",
+          appScopeName: appName,
+          cwd: app.path,
+          resourceName: "website",
+        };
+      }
+
+      return {
+        kind: "cloudflare-app",
+        appScopeName: appName,
+        cwd: app.path,
+        framework: app.framework,
+        resourceName: appName,
+      };
+
+    case "aws":
+      return {
+        kind: "aws-ec2-app",
+        appScopeName: appName,
+        cwd: app.path,
+        resourceName: appName,
+      };
+
+    default:
+      throw new Error(
+        `Unsupported host "${app.host}" in deployment plan builder`,
+      );
+  }
+}
diff --git a/packages/infra/modules/deployment/artifact.test.ts b/packages/infra/modules/deployment/artifact.test.ts
new file mode 100644
index 00000000..4b932aeb
--- /dev/null
+++ b/packages/infra/modules/deployment/artifact.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, test } from "bun:test";
+import { resolveEc2ArtifactConfig } from "./artifact";
+
+describe("resolveEc2ArtifactConfig", () => {
+  test("does not require an artifact for nixos deploys", () => {
+    expect(
+      resolveEc2ArtifactConfig({
+        osType: "nixos",
+        stage: "staging",
+        env: {},
+        globalArtifact: {},
+      }),
+    ).toBeNull();
+  });
+
+  test("derives the artifact location for amazon-linux deploys", () => {
+    expect(
+      resolveEc2ArtifactConfig({
+        osType: "amazon-linux",
+        stage: "staging",
+        env: {
+          EC2_ARTIFACT_VERSION: "abc123",
+        },
+        globalArtifact: {
+          bucket: "stackpanel-artifacts",
+          keyPrefix: "web",
+        },
+      }),
+    ).toEqual({
+      artifactBucket: "stackpanel-artifacts",
+      artifactKey: "web/staging/abc123/release.tar.gz",
+      artifactVersion: "abc123",
+    });
+  });
+
+  test("still requires an artifact bucket for amazon-linux deploys", () => {
+    expect(() =>
+      resolveEc2ArtifactConfig({
+        osType: "amazon-linux",
+        stage: "staging",
+        env: {
+          EC2_ARTIFACT_VERSION: "abc123",
+        },
+        globalArtifact: {},
+      }),
+    ).toThrow(
+      "EC2_ARTIFACT_BUCKET is required unless stackpanel.deployment.aws.artifact.bucket is configured",
+    );
+  });
+});
diff --git a/packages/infra/modules/deployment/artifact.ts b/packages/infra/modules/deployment/artifact.ts
new file mode 100644
index 00000000..f993fb80
--- /dev/null
+++ b/packages/infra/modules/deployment/artifact.ts
@@ -0,0 +1,50 @@
+export interface Ec2ArtifactConfig {
+  artifactBucket: string;
+  artifactKey: string;
+  artifactVersion?: string;
+}
+
+export interface ResolveEc2ArtifactConfigInput {
+  osType: "amazon-linux" | "nixos";
+  stage: string;
+  env: Record<string, string | undefined>;
+  globalArtifact: {
+    bucket?: string | null;
+    keyPrefix?: string | null;
+  };
+}
+
+export function resolveEc2ArtifactConfig(
+  input: ResolveEc2ArtifactConfigInput,
+): Ec2ArtifactConfig | null {
+  if (input.osType === "nixos") {
+    return null;
+  }
+
+  const artifactVersion = input.env.EC2_ARTIFACT_VERSION;
+  const artifactBucket = input.env.EC2_ARTIFACT_BUCKET ?? input.globalArtifact.bucket;
+  const artifactKey = input.env.EC2_ARTIFACT_KEY
+    ?? (
+      artifactVersion
+        ? `${input.globalArtifact.keyPrefix ?? "web"}/${input.stage}/${artifactVersion}/release.tar.gz`
+        : undefined
+    );
+
+  if (!artifactBucket) {
+    throw new Error(
+      "EC2_ARTIFACT_BUCKET is required unless stackpanel.deployment.aws.artifact.bucket is configured",
+    );
+  }
+
+  if (!artifactKey) {
+    throw new Error(
+      "EC2_ARTIFACT_KEY is required unless EC2_ARTIFACT_VERSION and stackpanel.deployment.aws.artifact.keyPrefix are available",
+    );
+  }
+
+  return {
+    artifactBucket,
+    artifactKey,
+    artifactVersion,
+  };
+}
diff --git a/packages/infra/modules/deployment/aws-ec2-deploy.test.ts b/packages/infra/modules/deployment/aws-ec2-deploy.test.ts
new file mode 100644
index 00000000..1f3ad471
--- /dev/null
+++ b/packages/infra/modules/deployment/aws-ec2-deploy.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildUserData,
+  deriveRuntimeLayout,
+} from "./aws-ec2-deploy";
+
+describe("deriveRuntimeLayout", () => {
+  test("derives runtime paths and service names from app name", () => {
+    expect(deriveRuntimeLayout("web")).toEqual({
+      appRoot: "/opt/stackpanel-web",
+      archivePath: "/tmp/stackpanel-web-release.tar.gz",
+      envFile: "/etc/stackpanel-web.env",
+      releaseRoot: "/opt/stackpanel-web/release",
+      serviceName: "stackpanel-web.service",
+      slug: "web",
+    });
+
+    expect(deriveRuntimeLayout("docs_site")).toEqual({
+      appRoot: "/opt/stackpanel-docs-site",
+      archivePath: "/tmp/stackpanel-docs-site-release.tar.gz",
+      envFile: "/etc/stackpanel-docs-site.env",
+      releaseRoot: "/opt/stackpanel-docs-site/release",
+      serviceName: "stackpanel-docs-site.service",
+      slug: "docs-site",
+    });
+  });
+});
+
+describe("buildUserData", () => {
+  test("uses the derived runtime layout instead of hard-coded web paths", () => {
+    const script = buildUserData({
+      appName: "docs_site",
+      artifactBucket: "bucket-name",
+      artifactKey: "docs/staging/release.tar.gz",
+      parameterPath: "/stackpanel/staging/docs-runtime",
+      port: 8080,
+      region: "us-west-2",
+      rootVolumeSize: 30,
+    });
+
+    expect(script).toContain('APP_ROOT="/opt/stackpanel-docs-site"');
+    expect(script).toContain('ENV_FILE="/etc/stackpanel-docs-site.env"');
+    expect(script).toContain('ARCHIVE_PATH="/tmp/stackpanel-docs-site-release.tar.gz"');
+    expect(script).toContain("/etc/systemd/system/stackpanel-docs-site.service");
+    expect(script).toContain("ExecStart=/usr/bin/node /opt/stackpanel-docs-site/release/.output/server/index.mjs");
+    expect(script).toContain("PORT=8080");
+  });
+});
diff --git a/packages/infra/modules/deployment/aws-ec2-deploy.ts b/packages/infra/modules/deployment/aws-ec2-deploy.ts
new file mode 100644
index 00000000..82cdb203
--- /dev/null
+++ b/packages/infra/modules/deployment/aws-ec2-deploy.ts
@@ -0,0 +1,349 @@
+// =============================================================================
+// aws-ec2-deploy.ts — Provision a self-contained EC2 app environment
+//
+// Creates a complete VPC-based deployment for a single app:
+//   VPC -> Subnet -> IGW -> Route -> Security Group -> IAM Role -> EC2 Instance
+//
+// The instance's user-data is generated by aws-ec2-userdata.ts, which
+// supports both Amazon Linux (tarball + node) and NixOS (static boot
+// for Colmena-based deploys).
+//
+// Runtime secrets are stored in SSM Parameter Store. The instance's IAM
+// role grants read access to the parameter path and the S3 artifact bucket.
+// =============================================================================
+import { isSecret, type Secret } from "alchemy";
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+import {
+  InternetGateway,
+  InternetGatewayAttachment,
+  Route,
+  RouteTable,
+  RouteTableAssociation,
+  SecurityGroup,
+  SecurityGroupRule,
+  SSMParameter,
+  Subnet,
+  Vpc,
+} from "alchemy/aws";
+import { Ec2Instance } from "@stackpanel/infra/resources/ec2-instance";
+import { IamInstanceProfile } from "@stackpanel/infra/resources/iam-instance-profile";
+import { IamRole } from "@stackpanel/infra/resources/iam-role";
+import { buildUserData, buildNixosUserData } from "./aws-ec2-userdata";
+
+// ---- Default AMI (Amazon Linux 2023, resolved at deploy time via SSM) -------
+const DEFAULT_IMAGE_ID =
+  "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}";
+
+// ---- Types ------------------------------------------------------------------
+
+type EnvironmentValue = string | Secret<string>;
+
+export interface Ec2ServerProps {
+  appName: string;
+  parameterPath: string;
+  artifactBucket: string;
+  artifactKey: string;
+  artifactVersion?: string;
+  environment: Record<string, EnvironmentValue>;
+  region?: string;
+  availabilityZone?: string | null;
+  imageId?: string | null;
+  instanceType?: string | null;
+  keyName?: string | null;
+  port?: number | null;
+  httpCidrBlocks?: string[];
+  sshCidrBlocks?: string[];
+  vpcCidrBlock?: string | null;
+  subnetCidrBlock?: string | null;
+  rootVolumeSize?: number | null;
+  tags?: Record<string, string>;
+  osType?: "amazon-linux" | "nixos";
+}
+
+export interface Ec2Server extends Ec2ServerProps {
+  instanceId: string;
+  publicIp: string;
+  publicDnsName: string;
+  url: string;
+  vpcId: string;
+  subnetId: string;
+  securityGroupId: string;
+  roleArn: string;
+  instanceProfileArn: string;
+}
+
+export interface RuntimeLayout {
+  slug: string;
+  serviceName: string;
+  appRoot: string;
+  releaseRoot: string;
+  envFile: string;
+  archivePath: string;
+}
+
+// ---- Layout derivation ------------------------------------------------------
+
+/** Standard filesystem layout for a deployed app on an EC2 instance. */
+export function deriveRuntimeLayout(appName: string): RuntimeLayout {
+  const slug = sanitizeName(appName);
+  const baseName = `stackpanel-${slug}`;
+
+  return {
+    slug,
+    serviceName: `${baseName}.service`,
+    appRoot: `/opt/${baseName}`,
+    releaseRoot: `/opt/${baseName}/release`,
+    envFile: `/etc/${baseName}.env`,
+    archivePath: `/tmp/${baseName}-release.tar.gz`,
+  };
+}
+
+// ---- Main provisioning function ---------------------------------------------
+
+export async function Ec2Server(
+  id: string,
+  props: Ec2ServerProps,
+): Promise<Ec2Server> {
+  const region = props.region ?? "us-west-2";
+  const availabilityZone = props.availabilityZone ?? `${region}a`;
+  const defaultImageId =
+    props.osType === "nixos"
+      ? await resolveNixosAmi(region)
+      : DEFAULT_IMAGE_ID;
+  const imageId = await resolveImageId(props.imageId ?? defaultImageId, region);
+  const instanceType = props.instanceType ?? "t3.small";
+  const port = props.port ?? 80;
+  const httpCidrBlocks = props.httpCidrBlocks ?? ["0.0.0.0/0"];
+  const sshCidrBlocks = props.sshCidrBlocks ?? [];
+  const vpcCidrBlock = props.vpcCidrBlock ?? "10.42.0.0/16";
+  const subnetCidrBlock = props.subnetCidrBlock ?? "10.42.1.0/24";
+  const rootVolumeSize = props.rootVolumeSize ?? 20;
+  const namePrefix = props.tags?.Stage ? `${id}-${props.tags.Stage}` : id;
+  const layout = deriveRuntimeLayout(props.appName);
+  const tags = {
+    Name: id,
+    ManagedBy: "alchemy",
+    Service: props.appName,
+    ...props.tags,
+  };
+
+  // -- IAM: role + instance profile -------------------------------------------
+
+  const role = await IamRole(`${id}-instance-role`, {
+    roleName: `${namePrefix}-instance-role`,
+    assumeRolePolicy: {
+      Version: "2012-10-17",
+      Statement: [{
+        Effect: "Allow",
+        Principal: { Service: "ec2.amazonaws.com" },
+        Action: "sts:AssumeRole",
+      }],
+    },
+    description: `Allows the EC2 instance for ${props.appName} to read boot-time config and artifacts.`,
+    managedPolicyArns: [
+      "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
+    ],
+    policies: [{
+      policyName: `${id}-read-config`,
+      policyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
+            Resource: [
+              `arn:aws:ssm:${region}:*:parameter${props.parameterPath}`,
+              `arn:aws:ssm:${region}:*:parameter${props.parameterPath}/*`,
+            ],
+          },
+          {
+            Effect: "Allow",
+            Action: ["s3:GetBucketLocation", "s3:ListBucket"],
+            Resource: [`arn:aws:s3:::${props.artifactBucket}`],
+            Condition: { StringLike: { "s3:prefix": [props.artifactKey] } },
+          },
+          {
+            Effect: "Allow",
+            Action: ["s3:GetObject"],
+            Resource: [`arn:aws:s3:::${props.artifactBucket}/${props.artifactKey}`],
+          },
+          {
+            Effect: "Allow",
+            Action: ["kms:Decrypt"],
+            Resource: "*",
+          },
+        ],
+      },
+    }],
+    tags,
+  });
+
+  const instanceProfileName = `${namePrefix}-instance-profile`;
+  const instanceProfile = await IamInstanceProfile(`${id}-instance-profile`, {
+    name: instanceProfileName,
+    roleName: role.roleName,
+    tags,
+  });
+
+  // -- SSM parameters (runtime environment) -----------------------------------
+
+  await Promise.all(
+    Object.entries(props.environment).map(([key, value]) => {
+      const name = `${trimTrailingSlash(props.parameterPath)}/${key}`;
+      return SSMParameter(`${id}-env-${key.toLowerCase()}`, {
+        name,
+        description: `Runtime configuration for ${props.appName}: ${key}`,
+        ...(isSecret(value) ? { type: "SecureString", value } : { value }),
+        tags,
+      });
+    }),
+  );
+
+  // -- VPC + networking -------------------------------------------------------
+
+  const vpc = await Vpc(`${id}-vpc`, {
+    cidrBlock: vpcCidrBlock, enableDnsSupport: true, enableDnsHostnames: true, region, tags,
+  });
+
+  const internetGateway = await InternetGateway(`${id}-igw`, { region, tags });
+
+  await InternetGatewayAttachment(`${id}-igw-attachment`, {
+    internetGateway, vpc, region,
+  });
+
+  const routeTable = await RouteTable(`${id}-public-rt`, { vpc, region, tags });
+
+  await Route(`${id}-default-route`, {
+    routeTable, region, destinationCidrBlock: "0.0.0.0/0",
+    target: { internetGateway },
+  });
+
+  const subnet = await Subnet(`${id}-public-subnet`, {
+    vpc, region, cidrBlock: subnetCidrBlock, availabilityZone,
+    mapPublicIpOnLaunch: true, tags,
+  });
+
+  await RouteTableAssociation(`${id}-public-association`, { routeTable, subnet });
+
+  // -- Security group + rules -------------------------------------------------
+
+  const securityGroup = await SecurityGroup(`${id}-sg`, {
+    vpc, region, description: `Ingress rules for ${props.appName}`, tags,
+  });
+
+  await Promise.all(
+    httpCidrBlocks.map((cidr, index) =>
+      SecurityGroupRule(`${id}-http-${index}`, {
+        securityGroup, type: "ingress", protocol: "tcp",
+        fromPort: port, toPort: port, cidrBlocks: [cidr],
+        description: `Allow HTTP traffic on port ${port}`,
+      }),
+    ),
+  );
+
+  if (props.keyName && sshCidrBlocks.length > 0) {
+    await Promise.all(
+      sshCidrBlocks.map((cidr, index) =>
+        SecurityGroupRule(`${id}-ssh-${index}`, {
+          securityGroup, type: "ingress", protocol: "tcp",
+          fromPort: 22, toPort: 22, cidrBlocks: [cidr],
+          description: "Allow SSH access",
+        }),
+      ),
+    );
+  }
+
+  // -- EC2 instance -----------------------------------------------------------
+
+  const userData =
+    props.osType === "nixos"
+      ? buildNixosUserData({ region, parameterPath: props.parameterPath })
+      : buildUserData({
+          appName: props.appName,
+          artifactBucket: props.artifactBucket,
+          artifactKey: props.artifactKey,
+          artifactVersion: props.artifactVersion,
+          layout,
+          parameterPath: props.parameterPath,
+          port,
+          region,
+        });
+
+  const instance = await Ec2Instance(id, {
+    name: id, ami: imageId, instanceType,
+    subnetId: subnet.subnetId, securityGroupIds: [securityGroup.groupId],
+    keyName: props.keyName ?? undefined, iamInstanceProfile: instanceProfileName,
+    userData, rootVolumeSize, associatePublicIp: true, tags,
+  });
+
+  const host = instance.publicDns || instance.publicIp;
+  const url = `http://${host}${port === 80 ? "" : `:${port}`}`;
+
+  return {
+    ...props, availabilityZone, imageId, instanceType, port, rootVolumeSize,
+    publicIp: instance.publicIp ?? "",
+    instanceId: instance.instanceId,
+    publicDnsName: instance.publicDns ?? "",
+    url,
+    vpcId: vpc.vpcId,
+    subnetId: subnet.subnetId,
+    securityGroupId: securityGroup.groupId,
+    roleArn: role.arn,
+    instanceProfileArn: instanceProfile.Arn,
+  };
+}
+
+// ---- AMI resolution ---------------------------------------------------------
+
+/** Resolve SSM-parameter-style AMI references ({{resolve:ssm:...}}) to real AMI IDs. */
+async function resolveImageId(imageId: string, region: string) {
+  if (imageId.startsWith("ami-")) return imageId;
+
+  const match = imageId.match(/^\{\{resolve:ssm:([^}:]+)(?::\d+)?\}\}$/);
+  if (!match) return imageId;
+
+  const client = new SSMClient({ region });
+  const response = await client.send(new GetParameterCommand({ Name: match[1] }));
+  const resolvedImageId = response.Parameter?.Value;
+
+  if (!resolvedImageId?.startsWith("ami-")) {
+    throw new Error(`Resolved AMI from SSM parameter ${match[1]} was not a valid EC2 image id.`);
+  }
+  return resolvedImageId;
+}
+
+/** Find the latest Determinate Systems NixOS AMI in the given region. */
+async function resolveNixosAmi(region: string): Promise<string> {
+  const { EC2Client, DescribeImagesCommand } = await import("@aws-sdk/client-ec2");
+  const client = new EC2Client({ region });
+  const images = await client.send(
+    new DescribeImagesCommand({
+      Owners: ["535002876703"],
+      Filters: [
+        { Name: "name", Values: ["determinate/nixos/epoch-1/*"] },
+        { Name: "architecture", Values: ["x86_64"] },
+        { Name: "state", Values: ["available"] },
+      ],
+    }),
+  );
+  const sorted = (images.Images ?? []).sort((a, b) =>
+    (b.CreationDate ?? "").localeCompare(a.CreationDate ?? ""),
+  );
+  const imageId = sorted[0]?.ImageId;
+  if (!imageId) throw new Error("No Determinate NixOS AMI found in " + region);
+  return imageId;
+}
+
+// ---- String helpers ---------------------------------------------------------
+
+function toAwsTags(tags: Record<string, string>) {
+  return Object.entries(tags).map(([Key, Value]) => ({ Key, Value }));
+}
+
+function trimTrailingSlash(value: string) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+
+function sanitizeName(value: string) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "app";
+}
diff --git a/packages/infra/modules/deployment/aws-ec2-userdata.ts b/packages/infra/modules/deployment/aws-ec2-userdata.ts
new file mode 100644
index 00000000..a9145ad2
--- /dev/null
+++ b/packages/infra/modules/deployment/aws-ec2-userdata.ts
@@ -0,0 +1,160 @@
+// =============================================================================
+// aws-ec2-userdata.ts — User-data script generators for EC2 instances
+//
+// Two boot strategies:
+//
+//   amazon-linux (default):
+//     Installs Node/Bun via dnf, pulls a tarball artifact from S3,
+//     loads runtime env from SSM, writes a systemd unit that runs
+//     `node .output/server/index.mjs`.
+//
+//   nixos:
+//     Minimal boot script. The real configuration comes later via
+//     Colmena (nixos-rebuild switch) which pulls the pre-built
+//     closure from Cachix. UserData is static so the instance is
+//     never replaced on deploy — only the NixOS system config changes.
+//
+// These are pure string-returning functions with no AWS SDK calls.
+// =============================================================================
+
+import type { RuntimeLayout } from "./aws-ec2-deploy";
+
+// ---- Amazon Linux 2023 user-data --------------------------------------------
+
+export function buildUserData({
+  appName,
+  artifactBucket,
+  artifactKey,
+  artifactVersion,
+  layout,
+  parameterPath,
+  port,
+  region,
+}: {
+  appName: string;
+  artifactBucket: string;
+  artifactKey: string;
+  artifactVersion?: string;
+  layout: RuntimeLayout;
+  parameterPath: string;
+  port: number;
+  region: string;
+}) {
+  return `#!/bin/bash
+set -euxo pipefail
+
+export HOME=/root
+export PATH=/usr/local/bin:/usr/bin:/bin
+
+dnf update -y
+dnf install -y jq unzip nodejs
+
+curl -fsSL https://bun.sh/install | bash
+export BUN_INSTALL=/root/.bun
+export PATH=$BUN_INSTALL/bin:$PATH
+
+cat >/usr/local/bin/${layout.slug}-bootstrap <<'EOF'
+#!/bin/bash
+set -euo pipefail
+
+export HOME=/root
+export PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
+export AWS_REGION=${shellString(region)}
+
+ARTIFACT_BUCKET=${shellString(artifactBucket)}
+ARTIFACT_KEY=${shellString(artifactKey)}
+ARTIFACT_VERSION=${shellString(artifactVersion ?? "unknown")}
+PARAMETER_PATH=${shellString(trimTrailingSlash(parameterPath))}
+APP_ROOT=${shellString(layout.appRoot)}
+RELEASE_ROOT=${shellString(layout.releaseRoot)}
+ENV_FILE=${shellString(layout.envFile)}
+ARCHIVE_PATH=${shellString(layout.archivePath)}
+
+rm -rf "$RELEASE_ROOT"
+mkdir -p "$RELEASE_ROOT"
+
+aws s3 cp "s3://$ARTIFACT_BUCKET/$ARTIFACT_KEY" "$ARCHIVE_PATH" --region "$AWS_REGION"
+tar -xzf "$ARCHIVE_PATH" -C "$RELEASE_ROOT"
+
+cat >"$ENV_FILE" <<ENVEOF
+NODE_ENV=production
+HOST=0.0.0.0
+PORT=${port}
+ARTIFACT_BUCKET=$ARTIFACT_BUCKET
+ARTIFACT_KEY=$ARTIFACT_KEY
+ARTIFACT_VERSION=$ARTIFACT_VERSION
+ENVEOF
+
+aws ssm get-parameters-by-path \\
+  --path "$PARAMETER_PATH" \\
+  --recursive \\
+  --with-decryption \\
+  --output json \\
+  --region "$AWS_REGION" \\
+| jq -r '.Parameters[] | "\\(.Name | split("/")[-1])=\\(.Value)"' >>"$ENV_FILE"
+EOF
+
+chmod +x /usr/local/bin/${layout.slug}-bootstrap
+/usr/local/bin/${layout.slug}-bootstrap
+
+cat >/etc/systemd/system/${layout.serviceName} <<'EOF'
+[Unit]
+Description=stackpanel ${appName}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=${layout.releaseRoot}
+Environment=PATH=/root/.bun/bin:/usr/local/bin:/usr/bin:/bin
+EnvironmentFile=${layout.envFile}
+ExecStart=/usr/bin/node ${layout.releaseRoot}/.output/server/index.mjs
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now ${layout.serviceName}
+`;
+}
+
+// ---- NixOS user-data --------------------------------------------------------
+
+/**
+ * NixOS instances get a static boot script that only logs metadata.
+ * The actual system configuration is applied later by Colmena, which
+ * pulls the pre-built closure from Cachix. Because this script never
+ * changes between deploys, the Ec2Instance resource won't trigger
+ * a replacement on each deploy.
+ */
+export function buildNixosUserData({
+  region,
+  parameterPath,
+}: {
+  region: string;
+  parameterPath: string;
+}) {
+  return `#!/usr/bin/env bash
+set -euo pipefail
+exec >> /var/log/user-data.log 2>&1
+
+echo "[+] NixOS instance booted"
+echo "[+] SSM parameter path: ${shellString(trimTrailingSlash(parameterPath))}"
+echo "[+] Region: ${shellString(region)}"
+echo "[+] Instance ready for Colmena deployment"
+`;
+}
+
+// ---- String helpers ---------------------------------------------------------
+
+function trimTrailingSlash(value: string) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+
+function shellString(value: string) {
+  return JSON.stringify(value);
+}
diff --git a/packages/infra/modules/deployment/index.ts b/packages/infra/modules/deployment/index.ts
new file mode 100644
index 00000000..bb9b94fd
--- /dev/null
+++ b/packages/infra/modules/deployment/index.ts
@@ -0,0 +1,471 @@
+// ==============================================================================
+// Deployment Infra Module — Orchestrator
+//
+// Top-level entry point for `just deploy`. Reads the Nix-generated
+// infra-inputs.json, builds a deployment plan for each app, and dispatches
+// to the appropriate host handler (Cloudflare or AWS EC2).
+//
+// Each app gets its own Alchemy app scope so `alchemy deploy --app <name>`
+// follows Alchemy's documented monorepo workflow.
+//
+// Flow:
+//   infra-inputs.json -> plan.ts (build plan) -> deploy{Cloudflare,Aws}App
+//     -> Cloudflare: TanStackStart / Worker / Vite / etc.
+//     -> AWS:        aws-ec2-deploy.ts (VPC + IAM + EC2 + SSM)
+// ==============================================================================
+import alchemy, { type Secret } from "alchemy";
+import { execFileSync } from "node:child_process";
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { TanStackStart } from "alchemy/cloudflare";
+import * as cloudflare from "alchemy/cloudflare";
+import { CloudflareStateStore } from "alchemy/state";
+import Infra from "@stackpanel/infra";
+import {
+  buildDeploymentPlan,
+  type AppInput,
+  type DeploymentInputs,
+} from "./plan";
+import { Ec2Server } from "./aws-ec2-deploy";
+
+// ---- Alchemy app factory (uses generated config if available) ----------------
+
+type CreateApp = (name?: string) => Promise<{ finalize(): Promise<void> }>;
+
+let createApp: CreateApp;
+try {
+  const mod = await import("@gen/alchemy");
+  createApp = mod.createApp;
+} catch {
+  createApp = async (name?: string) =>
+    alchemy(name ?? "stackpanel-infra", {
+      stage: process.env.STAGE ?? undefined,
+      stateStore: process.env.CLOUDFLARE_API_TOKEN
+        ? (scope) =>
+            new CloudflareStateStore(scope, {
+              apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN!),
+            })
+        : undefined,
+    });
+}
+
+// ---- Load inputs from Nix ---------------------------------------------------
+
+const infra = new Infra("deployment");
+const inputs = infra.inputs<DeploymentInputs>(
+  process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES,
+);
+
+const STAGE = process.env.STAGE ?? "dev";
+const DEPLOYMENT_APP_FILTER = process.env.STACKPANEL_DEPLOYMENT_APP ?? null;
+
+// ---- Binding resolution (env vars + secrets) --------------------------------
+
+const STAGE_URL_DEFAULTS: Record<string, (stage: string) => string> = {
+  CORS_ORIGIN: (stage) =>
+    stage === "prod"
+      ? "https://stackpanel.com"
+      : `https://${stage}.stackpanel.com`,
+  BETTER_AUTH_URL: (stage) =>
+    stage === "prod"
+      ? "https://stackpanel.com"
+      : `https://${stage}.stackpanel.com`,
+  POLAR_SUCCESS_URL: (stage) =>
+    stage === "prod"
+      ? "https://stackpanel.com"
+      : `https://${stage}.stackpanel.com`,
+};
+
+function resolveBindings(
+  bindingNames: string[],
+  secretNames: string[],
+): Record<string, unknown> {
+  const secretSet = new Set(secretNames);
+  const resolved: Record<string, unknown> = {};
+
+  for (const key of bindingNames) {
+    const envValue = process.env[key];
+    const defaultFn = STAGE_URL_DEFAULTS[key];
+    const value = envValue ?? (defaultFn ? defaultFn(STAGE) : undefined);
+    resolved[key] = secretSet.has(key) ? alchemy.secret(value ?? "") : value;
+  }
+
+  return resolved;
+}
+
+function resolveAwsEnvironment(
+  bindingNames: string[],
+  secretNames: string[],
+): Record<string, string | Secret<string>> {
+  const secretSet = new Set(secretNames);
+  const resolved: Record<string, string | Secret<string>> = {};
+
+  for (const key of bindingNames) {
+    const envValue = process.env[key];
+    const defaultFn = STAGE_URL_DEFAULTS[key];
+    const value = envValue ?? (defaultFn ? defaultFn(STAGE) : "");
+    if (secretSet.has(key)) {
+      if (!value && STAGE === "prod") {
+        throw new Error(`Missing required secret binding "${key}" for AWS deployment`);
+      }
+      resolved[key] = alchemy.secret(value || "PLACEHOLDER");
+      continue;
+    }
+    resolved[key] = value;
+  }
+
+  return resolved;
+}
+
+function requireEnv(name: string) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} environment variable is required`);
+  }
+  return value;
+}
+
+function resolveArtifactLocation() {
+  const artifactVersion = process.env.EC2_ARTIFACT_VERSION;
+  const artifactBucket = process.env.EC2_ARTIFACT_BUCKET ?? inputs.aws?.artifact?.bucket;
+  const artifactKey = process.env.EC2_ARTIFACT_KEY
+    ?? (
+      artifactVersion
+        ? `${inputs.aws?.artifact?.keyPrefix ?? "web"}/${STAGE}/${artifactVersion}/release.tar.gz`
+        : undefined
+    );
+
+  if (!artifactBucket) {
+    throw new Error(
+      "EC2_ARTIFACT_BUCKET is required unless stackpanel.deployment.aws.artifact.bucket is configured",
+    );
+  }
+
+  if (!artifactKey) {
+    throw new Error(
+      "EC2_ARTIFACT_KEY is required unless EC2_ARTIFACT_VERSION and stackpanel.deployment.aws.artifact.keyPrefix are available",
+    );
+  }
+
+  return {
+    artifactBucket,
+    artifactKey,
+    artifactVersion,
+  };
+}
+
+// ---- Cloudflare helpers -----------------------------------------------------
+
+function cloudflareProps(name: string, app: AppInput) {
+  const route = app.cloudflare?.route ?? inputs.cloudflare?.defaultRoute ?? null;
+
+  return {
+    adopt: true,
+    cwd: app.path,
+    name: app.cloudflare?.workerName ?? name,
+    url: true,
+    compatibility: app.cloudflare?.compatibility,
+    compatibilityDate: inputs.cloudflare?.compatibilityDate ?? undefined,
+    routes: route ? [route] : undefined,
+  };
+}
+
+const OPENNEXT_RUNTIME_PATCH = [
+  'const runtimeProcess = globalThis.process ?? process ?? {};',
+  'globalThis.process = runtimeProcess;',
+  'runtimeProcess.version ??= "v22.14.0";',
+  'runtimeProcess.versions ??= {};',
+  'Object.assign(runtimeProcess.versions, { node: "22.14.0", ...runtimeProcess.versions });',
+].join("\n");
+
+const OPENNEXT_RUNTIME_REGEX =
+  /(\s*)Object\.assign\(process, \{ version: process\.version \|\| "v22\.14\.0" \}\);\n\1Object\.assign\(process\.versions, \{ node: "22\.14\.0", \.\.\.process\.versions \}\);/;
+
+const OPENNEXT_DEBUG_FETCH_FROM = `async fetch(request, env, ctx) {
+        return runWithCloudflareRequestContext(request, env, ctx, async () => {`;
+
+const OPENNEXT_DEBUG_FETCH_TO = `async fetch(request, env, ctx) {
+        try {
+            return runWithCloudflareRequestContext(request, env, ctx, async () => {`;
+
+const OPENNEXT_DEBUG_FETCH_END_FROM = `        });
+    },`;
+
+const OPENNEXT_DEBUG_FETCH_END_TO = `        });
+        } catch (error) {
+            if (request.headers.get("x-stackpanel-debug") === "1") {
+                const stack = error instanceof Error ? \`${"${error.message}"}\n${"${error.stack ?? \"\"}"}\` : String(error);
+                return new Response(stack, {
+                    status: 500,
+                    headers: { "content-type": "text/plain; charset=UTF-8" }
+                });
+            }
+            throw error;
+        }
+    },`;
+
+function buildNextjsWorker(app: AppInput) {
+  const appPath = path.resolve(app.path);
+
+  execFileSync("bunx", ["opennextjs-cloudflare", "build"], {
+    cwd: appPath,
+    stdio: "inherit",
+  });
+
+  const initPath = path.join(appPath, ".open-next", "cloudflare", "init.js");
+  const initSource = readFileSync(initPath, "utf8");
+
+  if (!initSource.includes(OPENNEXT_RUNTIME_PATCH) && !OPENNEXT_RUNTIME_REGEX.test(initSource)) {
+    throw new Error(
+      `OpenNext runtime patch target not found in ${initPath}`,
+    );
+  }
+
+  if (!initSource.includes(OPENNEXT_RUNTIME_PATCH)) {
+    writeFileSync(
+      initPath,
+      initSource.replace(
+        OPENNEXT_RUNTIME_REGEX,
+        (_match, indent: string) =>
+          OPENNEXT_RUNTIME_PATCH.split("\n")
+            .map((line) => `${indent}${line}`)
+            .join("\n"),
+      ),
+    );
+  }
+
+  const pending = [path.join(appPath, ".open-next")];
+  while (pending.length > 0) {
+    const currentPath = pending.pop()!;
+    for (const entry of readdirSync(currentPath, { withFileTypes: true })) {
+      const entryPath = path.join(currentPath, entry.name);
+
+      if (entry.isDirectory()) {
+        pending.push(entryPath);
+        continue;
+      }
+
+      if (!entry.isFile() || (!entry.name.endsWith(".js") && !entry.name.endsWith(".mjs"))) {
+        continue;
+      }
+
+      const source = readFileSync(entryPath, "utf8");
+      if (source.includes("Object.entries(env)")) {
+        writeFileSync(
+          entryPath,
+          source.replaceAll(
+            "Object.entries(env)",
+            "Object.entries(env ?? {})",
+          ),
+        );
+      }
+    }
+  }
+
+  if (process.env.STACKPANEL_DEPLOYMENT_DEBUG_RESPONSE === "1") {
+    const workerPath = path.join(appPath, ".open-next", "worker.js");
+    const workerSource = readFileSync(workerPath, "utf8");
+
+    if (
+      workerSource.includes(OPENNEXT_DEBUG_FETCH_FROM) &&
+      workerSource.includes(OPENNEXT_DEBUG_FETCH_END_FROM)
+    ) {
+      writeFileSync(
+        workerPath,
+        workerSource
+          .replace(OPENNEXT_DEBUG_FETCH_FROM, OPENNEXT_DEBUG_FETCH_TO)
+          .replace(OPENNEXT_DEBUG_FETCH_END_FROM, OPENNEXT_DEBUG_FETCH_END_TO),
+      );
+    }
+  }
+}
+
+async function withAppScope<T>(
+  appScopeName: string,
+  run: () => Promise<T>,
+): Promise<T> {
+  const app = await createApp(appScopeName);
+
+  try {
+    const result = await run();
+    await app.finalize();
+    return result;
+  } catch (error) {
+    await app.finalize();
+    throw error;
+  }
+}
+
+// ---- Host-specific deploy functions -----------------------------------------
+
+async function deployCloudflareApp(
+  appName: string,
+  app: AppInput,
+): Promise<{ url: string }> {
+  const bindings = resolveBindings(app.bindings, app.secrets);
+  const plan = buildDeploymentPlan(appName, app);
+
+  return withAppScope(plan.appScopeName, async () => {
+    switch (plan.kind) {
+      case "cloudflare-nextjs-app":
+        buildNextjsWorker(app);
+
+        return cloudflare.Worker(plan.resourceName, {
+          ...cloudflareProps(appName, app),
+          assets: {
+            html_handling: "auto-trailing-slash",
+            not_found_handling: "none",
+            run_worker_first: false,
+          },
+          bindings: {
+            ...bindings,
+            ASSETS: {
+              path: path.join(app.path, ".open-next", "assets"),
+              type: "assets",
+            },
+          },
+          entrypoint: ".open-next/worker.js",
+          noBundle: true,
+          rules: [
+            {
+              globs: [
+                "**/*.js",
+                "**/*.mjs",
+                "**/*.wasm",
+                ".build/**/*.js",
+                ".build/**/*.mjs",
+              ],
+            },
+          ],
+        });
+
+      case "cloudflare-app":
+        switch (plan.framework) {
+          case "tanstack-start":
+            return TanStackStart(plan.resourceName, {
+              ...cloudflareProps(appName, app),
+              bindings,
+            });
+
+          case "astro":
+            return (await import("alchemy/cloudflare")).Astro(plan.resourceName, {
+              ...cloudflareProps(appName, app),
+              bindings,
+            });
+
+          case "remix":
+            return (await import("alchemy/cloudflare")).Remix(plan.resourceName, {
+              ...cloudflareProps(appName, app),
+              bindings,
+            });
+
+          case "nuxt":
+            return (await import("alchemy/cloudflare")).Nuxt(plan.resourceName, {
+              ...cloudflareProps(appName, app),
+              bindings,
+            });
+
+          case "vite":
+            return cloudflare.Vite(plan.resourceName, {
+              ...cloudflareProps(appName, app),
+              assets: app.assetsDir ?? "dist",
+              bindings,
+              dev: { command: "bun run dev" },
+            });
+
+          case "hono":
+            return cloudflare.Worker(plan.resourceName, {
+              ...cloudflareProps(appName, app),
+              entrypoint: app.entrypoint ?? "src/index.ts",
+              bindings,
+            });
+
+          default:
+            throw new Error(
+              `Unsupported framework "${plan.framework}" for host "cloudflare"`,
+            );
+        }
+    }
+  });
+}
+
+async function deployAwsApp(
+  appName: string,
+  app: AppInput,
+): Promise<{ url: string }> {
+  const environment = resolveAwsEnvironment(app.bindings, app.secrets);
+  const plan = buildDeploymentPlan(appName, app);
+
+  if (plan.kind !== "aws-ec2-app") {
+    throw new Error(
+      `Unsupported AWS deployment plan "${plan.kind}" for ${appName}`,
+    );
+  }
+
+  const { artifactBucket, artifactKey, artifactVersion } = resolveArtifactLocation();
+  const region = app.aws?.region ?? inputs.aws?.region ?? "us-west-2";
+
+  const osType = (app.aws?.osType as "amazon-linux" | "nixos") ?? "amazon-linux";
+
+  return withAppScope(plan.appScopeName, async () =>
+    Ec2Server(plan.resourceName, {
+      appName,
+      artifactBucket,
+      artifactKey,
+      artifactVersion,
+      environment,
+      region,
+      availabilityZone: app.aws?.availabilityZone ?? undefined,
+      imageId: app.aws?.imageId ?? undefined,
+      instanceType: app.aws?.instanceType ?? inputs.aws?.instanceType ?? undefined,
+      keyName: app.aws?.keyName ?? undefined,
+      parameterPath:
+        app.aws?.parameterPath ?? `/stackpanel/${STAGE}/${appName}-runtime`,
+      port: app.aws?.port ?? inputs.aws?.port ?? 80,
+      httpCidrBlocks:
+        app.aws?.httpCidrBlocks?.length ? app.aws.httpCidrBlocks : undefined,
+      sshCidrBlocks:
+        app.aws?.sshCidrBlocks?.length ? app.aws.sshCidrBlocks : undefined,
+      rootVolumeSize: app.aws?.rootVolumeSize ?? undefined,
+      vpcCidrBlock: app.aws?.vpcCidrBlock ?? undefined,
+      subnetCidrBlock: app.aws?.subnetCidrBlock ?? undefined,
+      osType,
+      tags: {
+        App: "stackpanel",
+        Stage: STAGE,
+        ...(app.aws?.tags ?? {}),
+      },
+    }),
+  );
+}
+
+// ---- Main dispatch loop -----------------------------------------------------
+
+const outputs: Record<string, string> = {};
+const deployableApps = Object.entries(inputs.apps ?? {}).filter(
+  ([appName]) => DEPLOYMENT_APP_FILTER === null || appName === DEPLOYMENT_APP_FILTER,
+);
+
+for (const [appName, app] of deployableApps) {
+  let resource: { url: string };
+
+  switch (app.host) {
+    case "cloudflare":
+      resource = await deployCloudflareApp(appName, app);
+      break;
+
+    case "aws":
+      resource = await deployAwsApp(appName, app);
+      break;
+
+    default:
+      throw new Error(
+        `Unsupported host "${app.host}" in infra deployment module`,
+      );
+  }
+
+  outputs[`${appName}Url`] = resource.url;
+  console.log(`[${STAGE}] ${appName} -> ${resource.url}`);
+}
+
+export default outputs;
diff --git a/packages/infra/modules/deployment/plan.test.ts b/packages/infra/modules/deployment/plan.test.ts
new file mode 100644
index 00000000..908fdfe3
--- /dev/null
+++ b/packages/infra/modules/deployment/plan.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+import { buildDeploymentPlan } from "./plan";
+
+describe("buildDeploymentPlan", () => {
+  test("uses app-scoped Alchemy plan for Cloudflare Next.js apps", () => {
+    const plan = buildDeploymentPlan("docs", {
+      bindings: ["ASSET_HOST"],
+      framework: "nextjs",
+      host: "cloudflare",
+      path: "apps/docs",
+      secrets: [],
+      cloudflare: {
+        compatibility: "node",
+        workerName: "stackpanel-docs",
+      },
+    });
+
+    expect(plan.kind).toBe("cloudflare-nextjs-app");
+    expect(plan.appScopeName).toBe("docs");
+    expect(plan.resourceName).toBe("website");
+    expect(plan.cwd).toBe("apps/docs");
+  });
+
+  test("uses aws ec2 plan for AWS-hosted apps", () => {
+    const plan = buildDeploymentPlan("web", {
+      bindings: ["DATABASE_URL", "BETTER_AUTH_SECRET"],
+      framework: "tanstack-start",
+      host: "aws",
+      path: "apps/web",
+      secrets: ["DATABASE_URL", "BETTER_AUTH_SECRET"],
+      aws: {
+        instanceType: "t3.small",
+        port: 80,
+        region: "us-west-2",
+      },
+    });
+
+    expect(plan.kind).toBe("aws-ec2-app");
+    expect(plan.appScopeName).toBe("web");
+    expect(plan.resourceName).toBe("web");
+    expect(plan.cwd).toBe("apps/web");
+  });
+});
diff --git a/packages/infra/modules/deployment/plan.ts b/packages/infra/modules/deployment/plan.ts
new file mode 100644
index 00000000..c138733f
--- /dev/null
+++ b/packages/infra/modules/deployment/plan.ts
@@ -0,0 +1,134 @@
+// =============================================================================
+// plan.ts — Deployment plan types and builder
+//
+// Translates the Nix-provided per-app config (framework + host) into a
+// concrete DeploymentPlan that the orchestrator (index.ts) dispatches on.
+//
+// The plan is a discriminated union on `kind` so the orchestrator gets
+// type-safe access to host-specific fields.
+// =============================================================================
+
+/** Per-app config as serialized from Nix via infra-inputs.json. */
+export interface AppInput {
+  framework: string;
+  host: string;
+  path: string;
+  /** Environment variable names to bind (both plaintext and secrets). */
+  bindings: string[];
+  /** Subset of bindings that should be stored as SecureString in SSM. */
+  secrets: string[];
+
+  /** AWS-specific config (only present when host === "aws"). */
+  aws?: {
+    region?: string | null;
+    availabilityZone?: string | null;
+    imageId?: string | null;
+    instanceType?: string | null;
+    keyName?: string | null;
+    port?: number | null;
+    parameterPath?: string | null;
+    httpCidrBlocks?: string[];
+    sshCidrBlocks?: string[];
+    rootVolumeSize?: number | null;
+    vpcCidrBlock?: string | null;
+    subnetCidrBlock?: string | null;
+    tags?: Record<string, string>;
+    /** "amazon-linux" uses tarball + UserData bootstrap; "nixos" uses static boot + Colmena. */
+    osType?: "amazon-linux" | "nixos";
+  };
+
+  /** Cloudflare-specific config (only present when host === "cloudflare"). */
+  cloudflare?: {
+    workerName?: string;
+    route?: string | null;
+    compatibility?: "node" | "browser";
+  };
+
+  /** Framework-specific overrides (present regardless of host). */
+  ssr?: boolean;
+  assetsDir?: string;
+  entrypoint?: string;
+  output?: string;
+}
+
+/** Global deployment config from stackpanel.deployment.* in Nix. */
+export interface DeploymentInputs {
+  apps: Record<string, AppInput>;
+  aws?: {
+    region?: string | null;
+    instanceType?: string | null;
+    port?: number | null;
+    artifact?: {
+      bucket?: string | null;
+      keyPrefix?: string | null;
+    };
+  };
+  cloudflare?: {
+    compatibilityDate?: string | null;
+    defaultRoute?: string | null;
+  };
+}
+
+/**
+ * Discriminated union describing how to deploy a single app.
+ * The orchestrator switches on `kind` to call the right deploy function.
+ */
+export type DeploymentPlan =
+  | {
+      kind: "cloudflare-nextjs-app";
+      appScopeName: string;
+      cwd: string;
+      resourceName: "website";
+    }
+  | {
+      kind: "cloudflare-app";
+      appScopeName: string;
+      cwd: string;
+      framework: string;
+      resourceName: string;
+    }
+  | {
+      kind: "aws-ec2-app";
+      appScopeName: string;
+      cwd: string;
+      resourceName: string;
+    };
+
+/** Map (framework, host) -> DeploymentPlan for a single app. */
+export function buildDeploymentPlan(
+  appName: string,
+  app: AppInput,
+): DeploymentPlan {
+  switch (app.host) {
+    case "cloudflare":
+      if (app.framework === "nextjs") {
+        return {
+          kind: "cloudflare-nextjs-app",
+          appScopeName: appName,
+          cwd: app.path,
+          resourceName: "website",
+        };
+      }
+
+      return {
+        kind: "cloudflare-app",
+        appScopeName: appName,
+        cwd: app.path,
+        framework: app.framework,
+        resourceName: appName,
+      };
+
+    case "aws":
+      return {
+        kind: "aws-ec2-app",
+        appScopeName: appName,
+        cwd: app.path,
+        resourceName: appName,
+      };
+
+    default:
+      throw new Error(
+        `Unsupported host "${app.host}" in deployment plan builder`,
+      );
+  }
+}
diff --git a/packages/infra/modules/machines.ts b/packages/infra/modules/machines.ts
new file mode 100644
index 00000000..26115f84
--- /dev/null
+++ b/packages/infra/modules/machines.ts
@@ -0,0 +1,192 @@
+// ==============================================================================
+// Machine Inventory Infra Module
+//
+// Accepts machine definitions from Nix and emits a JSON string output.
+// This output is intended to be pulled into stackpanel.infra.outputs.machines
+// and consumed by Colmena.
+// ==============================================================================
+import Infra from "@stackpanel/infra";
+
+interface MachineSshConfig {
+  user?: string;
+  port?: number;
+  keyPath?: string | null;
+}
+
+interface MachineDefinition {
+  id?: string | null;
+  name?: string | null;
+  host?: string | null;
+  ssh?: MachineSshConfig;
+  tags?: string[];
+  roles?: string[];
+  provider?: string | null;
+  arch?: string | null;
+  publicIp?: string | null;
+  privateIp?: string | null;
+  labels?: Record<string, string>;
+  nixosProfile?: string | null;
+  nixosModules?: string[];
+  targetEnv?: string | null;
+  env?: Record<string, string>;
+  metadata?: Record<string, unknown>;
+}
+
+interface MachineInputs {
+  source?: "static" | "aws-ec2";
+  machines: Record<string, MachineDefinition>;
+  aws?: {
+    region?: string | null;
+    instanceIds?: string[];
+    filters?: Array<{ name: string; values: string[] }>;
+    nameTagKeys?: string[];
+    roleTagKeys?: string[];
+    tagKeys?: string[];
+    envTagKeys?: string[];
+    hostPreference?: Array<"publicDns" | "publicIp" | "privateIp">;
+    ssh?: MachineSshConfig;
+  };
+}
+
+const infra = new Infra("machines");
+const inputs = infra.inputs<MachineInputs>(
+  process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES,
+);
+
+const source = inputs.source ?? "static";
+const machines = inputs.machines ?? {};
+
+function tagMap(tags?: Array<{ Key?: string; Value?: string }>): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const tag of tags ?? []) {
+    if (!tag.Key) continue;
+    result[tag.Key] = tag.Value ?? "";
+  }
+  return result;
+}
+
+function pickTagValue(tags: Record<string, string>, keys: string[]): string | null {
+  for (const key of keys) {
+    const value = tags[key];
+    if (value) return value;
+  }
+  return null;
+}
+
+function collectTagValues(tags: Record<string, string>, keys: string[]): string[] {
+  const values: string[] = [];
+  for (const key of keys) {
+    const value = tags[key];
+    if (value) values.push(value);
+  }
+  return values;
+}
+
+function pickHost(
+  instance: {
+    PublicDnsName?: string;
+    PublicIpAddress?: string;
+    PrivateIpAddress?: string;
+  },
+  preference: Array<"publicDns" | "publicIp" | "privateIp">,
+): string | null {
+  for (const pref of preference) {
+    if (pref === "publicDns" && instance.PublicDnsName) return instance.PublicDnsName;
+    if (pref === "publicIp" && instance.PublicIpAddress) return instance.PublicIpAddress;
+    if (pref === "privateIp" && instance.PrivateIpAddress) return instance.PrivateIpAddress;
+  }
+  return null;
+}
+
+function mapArchitecture(arch?: string | null): string | null {
+  if (!arch) return null;
+  if (arch === "arm64") return "aarch64-linux";
+  if (arch === "x86_64") return "x86_64-linux";
+  return null;
+}
+
+async function loadAwsMachines(awsConfig?: MachineInputs["aws"]): Promise<Record<string, MachineDefinition>> {
+  const config = awsConfig ?? {};
+  const { EC2Client, DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
+
+  const region = config.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+  const client = new EC2Client(region ? { region } : {});
+
+  const instanceIds = config.instanceIds ?? [];
+  const filters = (config.filters ?? []).map((filter) => ({
+    Name: filter.name,
+    Values: filter.values,
+  }));
+
+  if (instanceIds.length === 0 && filters.length === 0) {
+    console.warn("[machines] No instance IDs or filters provided; inventory will be empty.");
+    return {};
+  }
+
+  const hostPreference = config.hostPreference ?? ["publicDns", "publicIp", "privateIp"];
+  const nameTagKeys = config.nameTagKeys ?? ["Name"];
+  const roleTagKeys = config.roleTagKeys ?? [];
+  const tagKeys = config.tagKeys ?? [];
+  const envTagKeys = config.envTagKeys ?? [];
+  const defaultSsh = config.ssh ?? { user: "root", port: 22, keyPath: null };
+
+  const inventory: Record<string, MachineDefinition> = {};
+  let nextToken: string | undefined;
+
+  do {
+    const response = await client.send(
+      new DescribeInstancesCommand({
+        InstanceIds: instanceIds.length > 0 ? instanceIds : undefined,
+        Filters: filters.length > 0 ? filters : undefined,
+        NextToken: nextToken,
+      }),
+    );
+
+    for (const reservation of response.Reservations ?? []) {
+      for (const instance of reservation.Instances ?? []) {
+        const instanceId = instance.InstanceId ?? "";
+        if (!instanceId) continue;
+
+        const tags = tagMap(instance.Tags);
+        const name = pickTagValue(tags, nameTagKeys) ?? instanceId;
+        const roles = collectTagValues(tags, roleTagKeys);
+        const extraTags = collectTagValues(tags, tagKeys);
+        const targetEnv = pickTagValue(tags, envTagKeys);
+        const host = pickHost(instance, hostPreference);
+
+        inventory[instanceId] = {
+          id: instanceId,
+          name,
+          host,
+          ssh: defaultSsh,
+          roles,
+          tags: extraTags,
+          provider: "aws-ec2",
+          arch: mapArchitecture(instance.Architecture),
+          publicIp: instance.PublicIpAddress ?? null,
+          privateIp: instance.PrivateIpAddress ?? null,
+          labels: tags,
+          targetEnv,
+          metadata: {
+            availabilityZone: instance.Placement?.AvailabilityZone,
+            instanceType: instance.InstanceType,
+            state: instance.State?.Name,
+          },
+        };
+      }
+    }
+
+    nextToken = response.NextToken;
+  } while (nextToken);
+
+  return inventory;
+}
+
+const resolvedMachines =
+  source === "aws-ec2"
+    ? await loadAwsMachines(inputs.aws)
+    : machines;
+
+export default {
+  machines: JSON.stringify(resolvedMachines),
+};
diff --git a/packages/infra/package.json b/packages/infra/package.json
new file mode 100644
index 00000000..4d41fc79
--- /dev/null
+++ b/packages/infra/package.json
@@ -0,0 +1,41 @@
+{
+  "dependencies": {
+    "@aws-sdk/client-ec2": "^3.953.0",
+    "@aws-sdk/client-ecr": "^3.953.0",
+    "@aws-sdk/client-elastic-load-balancing-v2": "^3.953.0",
+    "@aws-sdk/client-iam": "^3.953.0",
+    "@aws-sdk/client-kms": "^3.953.0",
+    "@aws-sdk/client-ssm": "^3.953.0",
+    "@aws-sdk/client-sts": "^3.953.0",
+    "@pulumi/aws": "^7.15.0",
+    "alchemy": "^0.81.2",
+    "sst": "^3.17.25"
+  },
+  "devDependencies": {
+    "bun2nix": "latest"
+  },
+  "exports": {
+    ".": {
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "default": "./src/*.ts"
+    }
+  },
+  "name": "@stackpanel/infra",
+  "private": true,
+  "scripts": {
+    "alchemy:deploy": "alchemy deploy",
+    "alchemy:destroy": "alchemy destroy",
+    "alchemy:dev": "alchemy dev",
+    "container:build:web": "cd ../.. && nix build --impure .#packages.x86_64-linux.container-web",
+    "container:push:web": "cd ../.. && nix run --impure .#copy-container-web -- docker://registry.fly.io/ --dest-creds x:$(flyctl auth token)",
+    "deploy:web": "cd ../.. && (flyctl status -a stackpanel-web > /dev/null 2>&1 || flyctl apps create stackpanel-web --org darkmatter) && flyctl deploy --config apps/web/fly.toml --image registry.fly.io/stackpanel-web:latest",
+    "postinstall": "test -f bun.lock && bun2nix -o bun.nix || true",
+    "ship:web": "turbo run deploy:web",
+    "sst:deploy": "bunx sst deploy",
+    "sst:dev": "bunx sst dev",
+    "sst:remove": "bunx sst remove"
+  },
+  "type": "module"
+}
diff --git a/packages/infra/package.json.backup b/packages/infra/package.json.backup
new file mode 100644
index 00000000..4d41fc79
--- /dev/null
+++ b/packages/infra/package.json.backup
@@ -0,0 +1,41 @@
+{
+  "dependencies": {
+    "@aws-sdk/client-ec2": "^3.953.0",
+    "@aws-sdk/client-ecr": "^3.953.0",
+    "@aws-sdk/client-elastic-load-balancing-v2": "^3.953.0",
+    "@aws-sdk/client-iam": "^3.953.0",
+    "@aws-sdk/client-kms": "^3.953.0",
+    "@aws-sdk/client-ssm": "^3.953.0",
+    "@aws-sdk/client-sts": "^3.953.0",
+    "@pulumi/aws": "^7.15.0",
+    "alchemy": "^0.81.2",
+    "sst": "^3.17.25"
+  },
+  "devDependencies": {
+    "bun2nix": "latest"
+  },
+  "exports": {
+    ".": {
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "default": "./src/*.ts"
+    }
+  },
+  "name": "@stackpanel/infra",
+  "private": true,
+  "scripts": {
+    "alchemy:deploy": "alchemy deploy",
+    "alchemy:destroy": "alchemy destroy",
+    "alchemy:dev": "alchemy dev",
+    "container:build:web": "cd ../.. && nix build --impure .#packages.x86_64-linux.container-web",
+    "container:push:web": "cd ../.. && nix run --impure .#copy-container-web -- docker://registry.fly.io/ --dest-creds x:$(flyctl auth token)",
+    "deploy:web": "cd ../.. && (flyctl status -a stackpanel-web > /dev/null 2>&1 || flyctl apps create stackpanel-web --org darkmatter) && flyctl deploy --config apps/web/fly.toml --image registry.fly.io/stackpanel-web:latest",
+    "postinstall": "test -f bun.lock && bun2nix -o bun.nix || true",
+    "ship:web": "turbo run deploy:web",
+    "sst:deploy": "bunx sst deploy",
+    "sst:dev": "bunx sst dev",
+    "sst:remove": "bunx sst remove"
+  },
+  "type": "module"
+}
diff --git a/packages/infra/src/alchemy.ts b/packages/infra/src/alchemy.ts
new file mode 100644
index 00000000..f0c572e5
--- /dev/null
+++ b/packages/infra/src/alchemy.ts
@@ -0,0 +1,471 @@
+import * as crypto from "node:crypto";
+import type { Context } from "alchemy";
+import alchemy, { Resource } from "alchemy";
+import { SSMParameter } from "alchemy/aws";
+import * as cloudflare from "alchemy/cloudflare";
+import * as docker from "alchemy/docker";
+import { NeonBranch, NeonProject } from "alchemy/neon";
+import { UpstashRedis } from "alchemy/upstash";
+import { config } from "dotenv";
+
+config({ path: "./.env" });
+config({ path: "./apps/web/.env" });
+config({ path: "./apps/server/.env" });
+
+const app = await alchemy("stackpanel");
+
+// ----------------------------------------------------------------------------
+// Configuration
+// ----------------------------------------------------------------------------
+const USE_DEVENV =
+	process.env.IN_NIX_SHELL === "impure" ||
+	process.env.DEVENV_ROOT !== undefined;
+const USE_DOCKER = !USE_DEVENV && process.env.USE_DOCKER === "true";
+const STAGE = process.env.STAGE || "dev";
+const IS_PREVIEW = STAGE !== "prod" && STAGE !== "dev";
+
+// ----------------------------------------------------------------------------
+// Helper: Compute stable port from project name (mirrors Nix mkProjectPort)
+// ----------------------------------------------------------------------------
+function computeProjectPort(
+	name: string,
+	minPort = 3000,
+	portRange = 7000,
+): number {
+	const hash = crypto.createHash("md5").update(name).digest("hex");
+	const portOffset = Number.parseInt(hash.substring(0, 4), 16);
+	return minPort + (portOffset % portRange);
+}
+
+// ----------------------------------------------------------------------------
+// Custom Resource: Devenv Postgres (read-only reference to devenv service)
+// ----------------------------------------------------------------------------
+interface DevenvPostgresProps {
+	/** Database name */
+	database: string;
+	/** Username */
+	user: string;
+	/** Password */
+	password: string;
+	/** Port (defaults to 5432) */
+	port?: number;
+	/** Host (defaults to localhost) */
+	host?: string;
+}
+
+export interface DevenvPostgres extends DevenvPostgresProps {
+	/** Connection URL */
+	connectionUrl: string;
+}
+
+export const DevenvPostgres = Resource(
+	"devenv::Postgres",
+	async function (
+		this: Context<DevenvPostgres>,
+		_id: string,
+		props: DevenvPostgresProps,
+	): Promise<DevenvPostgres> {
+		// This is a read-only reference - no create/update/delete needed
+		if (this.phase === "delete") {
+			return this.destroy();
+		}
+
+		const host = props.host ?? "localhost";
+		const port = props.port ?? 5432;
+		const connectionUrl = `postgresql://${props.user}:${props.password}@${host}:${port}/${props.database}`;
+
+		return {
+			...props,
+			host,
+			port,
+			connectionUrl,
+		};
+	},
+);
+
+// ----------------------------------------------------------------------------
+// Custom Resource: Devenv Redis (read-only reference to devenv service)
+// ----------------------------------------------------------------------------
+export interface DevenvRedisProps {
+	/** Port (defaults to 6379) */
+	port?: number;
+	/** Host (defaults to localhost) */
+	host?: string;
+}
+
+export interface DevenvRedis extends DevenvRedisProps {
+	/** Connection URL */
+	connectionUrl: string;
+}
+
+export const DevenvRedis = Resource(
+	"devenv::Redis",
+	async function (
+		this: Context<DevenvRedis>,
+		_id: string,
+		props: DevenvRedisProps,
+	): Promise<DevenvRedis> {
+		// This is a read-only reference - no create/update/delete needed
+		if (this.phase === "delete") {
+			return this.destroy();
+		}
+
+		const host = props.host ?? "localhost";
+		const port = props.port ?? 6379;
+		const connectionUrl = `redis://${host}:${port}`;
+
+		return {
+			...props,
+			host,
+			port,
+			connectionUrl,
+		};
+	},
+);
+
+// ----------------------------------------------------------------------------
+// Custom Resource: Devenv Caddy (read-only reference to devenv Caddy service)
+// ----------------------------------------------------------------------------
+export interface DevenvCaddyProps {
+	/** Project name for computing stable port */
+	projectName: string;
+	/** Override the computed port */
+	port?: number;
+	/** Virtual host domain */
+	domain?: string;
+}
+
+export interface DevenvCaddy extends DevenvCaddyProps {
+	/** Computed stable port */
+	projectPort: number;
+	/** URL to access the service */
+	url: string;
+}
+
+const DevenvCaddy = Resource(
+	"devenv::Caddy",
+	async function (
+		this: Context<DevenvCaddy>,
+		_id: string,
+		props: DevenvCaddyProps,
+	): Promise<DevenvCaddy> {
+		if (this.phase === "delete") {
+			return this.destroy();
+		}
+
+		const projectPort = props.port ?? computeProjectPort(props.projectName);
+		const domain = props.domain ?? `${props.projectName}.localhost`;
+		const url = `http://${domain}`;
+
+		return {
+			...props,
+			projectPort,
+			url,
+		};
+	},
+);
+
+// ----------------------------------------------------------------------------
+// Helper: Read secrets from SSM (for API keys that are pre-populated)
+// ----------------------------------------------------------------------------
+export async function getSSMSecret(name: string): Promise<string> {
+	// biome-ignore lint: Alchemy provides @aws-sdk/client-ssm as a peer dependency
+	// @ts-ignore - peer dependency
+	const { SSMClient, GetParameterCommand } = await import(
+		"@aws-sdk/client-ssm"
+	);
+	const client = new SSMClient({});
+	const response = await client.send(
+		new GetParameterCommand({
+			Name: name,
+			WithDecryption: true,
+		}),
+	);
+	if (!response.Parameter?.Value) {
+		throw new Error(`SSM Parameter ${name} not found or empty`);
+	}
+	return response.Parameter.Value;
+}
+
+// ============================================================================
+// Database: Devenv Postgres (Local) or Neon (Production) or Docker (Fallback)
+// ============================================================================
+let databaseUrl: string;
+let neonProject: Awaited<ReturnType<typeof NeonProject>> | undefined;
+
+if (USE_DEVENV) {
+	// Use devenv-managed Postgres (matches services.nix configuration)
+	const devenvPostgres = await DevenvPostgres("devenv_postgres", {
+		database: "stackpanel",
+		user: "pguser",
+		password: "password",
+		port: 5432,
+	});
+
+	databaseUrl = devenvPostgres.connectionUrl;
+	console.log("Using Devenv Postgres:", databaseUrl);
+} else if (USE_DOCKER) {
+	// Docker Postgres for local development (fallback when not in devenv)
+	const network = await docker.Network("stackpanel_network", {
+		name: "stackpanel_network",
+	});
+
+	const postgresVolume = await docker.Volume("postgres_data", {
+		name: "postgres_data",
+		labels: [
+			{ name: "app", value: "stackpanel" },
+			{ name: "service", value: "postgres" },
+		],
+	});
+
+	const postgresImage = await docker.RemoteImage("postgres_image", {
+		name: "postgres",
+		tag: "16-alpine",
+	});
+
+	await docker.Container("postgres_container", {
+		name: "stackpanel-postgres",
+		image: postgresImage.imageRef,
+		networks: [{ name: network.name }],
+		volumes: [
+			{
+				hostPath: postgresVolume.name,
+				containerPath: "/var/lib/postgresql/data",
+			},
+		],
+		environment: {
+			POSTGRES_USER: "stackpanel",
+			POSTGRES_PASSWORD: "stackpanel",
+			POSTGRES_DB: "stackpanel",
+		},
+		ports: [
+			{
+				internal: 5432,
+				external: 5432,
+			},
+		],
+		start: true,
+	});
+
+	databaseUrl = "postgresql://stackpanel:stackpanel@localhost:5432/stackpanel";
+	console.log("Using Docker Postgres:", databaseUrl);
+} else {
+	// Read Neon API key from SSM (pre-populated)
+	const neonApiKey = await getSSMSecret("/common/neon-api-key");
+
+	// Create Neon project (or adopt existing)
+	neonProject = await NeonProject("stackpanel_neon_project", {
+		name: "stackpanel",
+		apiKey: alchemy.secret(neonApiKey),
+		region_id: "aws-us-east-1",
+		pg_version: 16,
+	});
+
+	// For preview branches, create a separate Neon branch
+	if (IS_PREVIEW) {
+		const previewBranch = await NeonBranch(`neon_branch_${STAGE}`, {
+			project: neonProject,
+			name: STAGE,
+			apiKey: alchemy.secret(neonApiKey),
+			endpoints: [{ type: "read_write" }],
+		});
+		const connUri = previewBranch.connectionUris[0];
+		if (!connUri) {
+			throw new Error(`No connection URI available for branch ${STAGE}`);
+		}
+		databaseUrl = connUri.connection_uri.unencrypted;
+		console.log("Using Neon Preview Branch:", previewBranch.name);
+	} else {
+		// Use main branch for dev/prod
+		databaseUrl = neonProject.connection_uris[0].connection_uri.unencrypted;
+		console.log(
+			"Using Neon Database:",
+			neonProject.name,
+			"Branch:",
+			neonProject.branch.name,
+		);
+	}
+
+	// Write database URL to SSM so other services can read it
+	await SSMParameter("database_url", {
+		name: `/stackpanel/${STAGE}/database-url`,
+		type: "SecureString",
+		value: alchemy.secret(databaseUrl),
+		description: `Database connection URL for stackpanel ${STAGE}`,
+		tags: {
+			app: "stackpanel",
+			stage: STAGE,
+		},
+	});
+}
+
+// ============================================================================
+// Cache: Devenv Redis (Local) or Upstash Redis (Production) or Docker (Fallback)
+// ============================================================================
+let redisUrl: string;
+let redisToken: string | undefined;
+
+if (USE_DEVENV) {
+	// Use devenv-managed Redis (matches services.nix configuration)
+	const devenvRedis = await DevenvRedis("devenv_redis", {
+		port: 6379, // devenv default
+	});
+
+	redisUrl = devenvRedis.connectionUrl;
+	console.log("Using Devenv Redis:", redisUrl);
+} else if (USE_DOCKER) {
+	// Docker Valkey for local development (fallback when not in devenv)
+	const network = await docker.Network("stackpanel_network", {
+		name: "stackpanel_network",
+	});
+
+	const redisVolume = await docker.Volume("redis_data", {
+		name: "redis_data",
+		labels: [
+			{ name: "app", value: "stackpanel" },
+			{ name: "service", value: "redis" },
+		],
+	});
+
+	const redisImage = await docker.RemoteImage("redis_image", {
+		name: "valkey/valkey",
+		tag: "latest",
+	});
+
+	await docker.Container("redis_container", {
+		name: "stackpanel-redis",
+		image: redisImage.imageRef,
+		networks: [{ name: network.name }],
+		volumes: [
+			{
+				hostPath: redisVolume.name,
+				containerPath: "/data",
+			},
+		],
+		ports: [
+			{
+				internal: 6379,
+				external: 6379,
+			},
+		],
+		start: true,
+	});
+
+	redisUrl = "redis://localhost:6379";
+	console.log("Using Docker Valkey:", redisUrl);
+} else {
+	// Read Upstash credentials from SSM (pre-populated)
+	const upstashApiKey = await getSSMSecret("/common/upstash-api-key");
+	const upstashEmail = await getSSMSecret("/common/upstash-email");
+
+	// Create Upstash Redis (unique per stage for preview branches)
+	const upstashRedis = await UpstashRedis(`stackpanel_redis_${STAGE}`, {
+		name: `stackpanel-${STAGE}`,
+		primaryRegion: "us-east-1",
+		apiKey: alchemy.secret(upstashApiKey),
+		email: upstashEmail,
+	});
+
+	redisUrl = upstashRedis.endpoint;
+	redisToken = upstashRedis.restToken.unencrypted;
+	console.log("Using Upstash Redis:", upstashRedis.name, "Endpoint:", redisUrl);
+
+	// Write Redis connection info to SSM
+	await SSMParameter("redis_url", {
+		name: `/stackpanel/${STAGE}/redis-url`,
+		type: "String",
+		value: redisUrl,
+		description: `Redis URL for stackpanel ${STAGE}`,
+		tags: {
+			app: "stackpanel",
+			stage: STAGE,
+		},
+	});
+
+	await SSMParameter("redis_token", {
+		name: `/stackpanel/${STAGE}/redis-token`,
+		type: "SecureString",
+		value: alchemy.secret(redisToken),
+		description: `Redis REST token for stackpanel ${STAGE}`,
+		tags: {
+			app: "stackpanel",
+			stage: STAGE,
+		},
+	});
+}
+
+// ============================================================================
+// Caddy: Devenv-managed reverse proxy with stable port
+// ============================================================================
+let caddyConfig: Awaited<ReturnType<typeof DevenvCaddy>> | undefined;
+let devServerPort = 3000; // default port
+
+if (USE_DEVENV) {
+	// Use devenv-managed Caddy with computed stable port
+	caddyConfig = await DevenvCaddy("devenv_caddy", {
+		projectName: "stackpanel",
+		domain: "stackpanel.localhost",
+	});
+
+	// The dev server should run on the port that Caddy proxies to (3001 per services.nix)
+	devServerPort = 3001;
+	console.log(
+		`Using Devenv Caddy: ${caddyConfig.url} (project port: ${caddyConfig.projectPort})`,
+	);
+}
+
+// ============================================================================
+// Cloudflare Workers
+// ============================================================================
+export const web = await cloudflare.Vite("web", {
+	cwd: "apps/web",
+	assets: "dist",
+	bindings: {
+		VITE_SERVER_URL: process.env.VITE_SERVER_URL || "",
+	},
+	dev: {
+		command: "bun run dev",
+	},
+});
+
+export const server = await cloudflare.Worker("server", {
+	cwd: "apps/server",
+	entrypoint: "src/index.ts",
+	compatibility: "node",
+	bindings: {
+		// Database (Devenv, Neon, or Docker Postgres)
+		DATABASE_URL: alchemy.secret(databaseUrl),
+
+		// Cache (Devenv, Upstash, or Docker Valkey)
+		REDIS_URL: redisUrl,
+		...(redisToken
+			? { UPSTASH_REDIS_REST_TOKEN: alchemy.secret(redisToken) }
+			: {}),
+
+		// Auth & API
+		CORS_ORIGIN: process.env.CORS_ORIGIN || "",
+		BETTER_AUTH_SECRET: alchemy.secret(process.env.BETTER_AUTH_SECRET),
+		BETTER_AUTH_URL: process.env.BETTER_AUTH_URL || "",
+		GOOGLE_GENERATIVE_AI_API_KEY: alchemy.secret(
+			process.env.GOOGLE_GENERATIVE_AI_API_KEY,
+		),
+		POLAR_ACCESS_TOKEN: alchemy.secret(process.env.POLAR_ACCESS_TOKEN),
+		POLAR_SUCCESS_URL: process.env.POLAR_SUCCESS_URL || "",
+	},
+	dev: {
+		port: devServerPort,
+	},
+});
+
+// ============================================================================
+// Exports
+// ============================================================================
+export { databaseUrl, redisUrl, redisToken, caddyConfig };
+
+console.log(`Web    -> ${web.url}`);
+console.log(`Server -> ${server.url}`);
+if (caddyConfig) {
+	console.log(`Caddy  -> ${caddyConfig.url}`);
+}
+
+await app.finalize();
diff --git a/packages/infra/src/index.test.ts b/packages/infra/src/index.test.ts
new file mode 100644
index 00000000..96063c7e
--- /dev/null
+++ b/packages/infra/src/index.test.ts
@@ -0,0 +1,84 @@
+// @ts-nocheck
+import { afterEach, describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import Infra from "./index.ts";
+
+const ORIGINAL_ENV = { ...process.env };
+
+afterEach(() => {
+  process.env = { ...ORIGINAL_ENV };
+});
+
+describe("Infra.inputs", () => {
+  test("preserves app ids while normalizing structured input keys", () => {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "stackpanel-infra-"));
+    const inputsPath = path.join(tempDir, "infra-inputs.json");
+
+    fs.writeFileSync(
+      inputsPath,
+      JSON.stringify({
+        "aws-ec2-app": {
+          apps: {
+            "stackpanel-staging": {
+              "instance-count": 2,
+              "instance-type": "t2.micro",
+              iam: {
+                "role-name": "stackpanel-staging-ec2-role",
+                "instance-profile-name": "stackpanel-staging-ec2-role-profile",
+              },
+              tags: {
+                "managed-by": "stackpanel-infra",
+              },
+              ssm: {
+                parameters: {
+                  "API-TOKEN": "secret",
+                },
+              },
+            },
+          },
+        },
+      }),
+    );
+
+    process.env.STACKPANEL_ROOT = tempDir;
+    process.env.STACKPANEL_INFRA_INPUTS = inputsPath;
+
+    const infra = new Infra("aws-ec2-app");
+    const inputs = infra.inputs<{
+      apps: Record<
+        string,
+        {
+          instanceCount?: number;
+          instanceType?: string;
+          iam?: {
+            roleName?: string;
+            instanceProfileName?: string;
+          };
+          tags?: Record<string, string>;
+          ssm?: {
+            parameters?: Record<string, string>;
+          };
+        }
+      >;
+    }>();
+
+    expect(inputs.apps["stackpanel-staging"]).toBeDefined();
+    expect(inputs.apps.stackpanelStaging).toBeUndefined();
+    expect(inputs.apps["stackpanel-staging"]?.instanceCount).toBe(2);
+    expect(inputs.apps["stackpanel-staging"]?.instanceType).toBe("t2.micro");
+    expect(inputs.apps["stackpanel-staging"]?.iam?.roleName).toBe(
+      "stackpanel-staging-ec2-role",
+    );
+    expect(inputs.apps["stackpanel-staging"]?.iam?.instanceProfileName).toBe(
+      "stackpanel-staging-ec2-role-profile",
+    );
+    expect(inputs.apps["stackpanel-staging"]?.tags?.["managed-by"]).toBe(
+      "stackpanel-infra",
+    );
+    expect(inputs.apps["stackpanel-staging"]?.ssm?.parameters?.["API-TOKEN"]).toBe(
+      "secret",
+    );
+  });
+});
diff --git a/packages/infra/src/index.ts b/packages/infra/src/index.ts
new file mode 100644
index 00000000..73de2f40
--- /dev/null
+++ b/packages/infra/src/index.ts
@@ -0,0 +1,352 @@
+// Generated by stackpanel — do not edit manually.
+// @stackpanel/infra — Infrastructure module library
+import { execSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+// Embedded project config
+// @ts-ignore
+const PROJECT_CONFIG = {"keyFormat":"$module-$key","projectName":"stackpanel","storageBackend":{"filePath":".stack/secrets/vars/dev.sops.yaml","group":"dev","type":"sops"}} as const;
+
+/**
+ * Resolve the project root directory.
+ */
+function getRoot(): string {
+  return (
+    PROJECT_CONFIG.root ||
+    process.env.STACKPANEL_ROOT ||
+    execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim() ||
+    process.cwd()
+  );
+}
+
+let _root: string | undefined;
+function ROOT(): string {
+  if (!_root) _root = getRoot();
+  return _root;
+}
+
+const PRESERVED_MAP_KEYS = new Set([
+  "apps",
+  "parameters",
+  "secureParameters",
+  "tags",
+]);
+
+function toCamelCaseKey(key: string): string {
+  return key.replace(/-([a-zA-Z0-9])/g, (_match, char: string) =>
+    char.toUpperCase(),
+  );
+}
+
+function normalizeInputKeys<T>(value: T, parentKey?: string): T {
+  if (Array.isArray(value)) {
+    return value.map((item) => normalizeInputKeys(item)) as T;
+  }
+
+  if (value !== null && typeof value === "object") {
+    const preserveChildKeys = parentKey ? PRESERVED_MAP_KEYS.has(parentKey) : false;
+    const result: Record<string, unknown> = {};
+    for (const [key, entry] of Object.entries(value)) {
+      const normalizedKey = preserveChildKeys ? key : toCamelCaseKey(key);
+      result[normalizedKey] = normalizeInputKeys(entry, normalizedKey);
+    }
+    return result as T;
+  }
+
+  return value;
+}
+
+/**
+ * Read and parse the infra inputs JSON file.
+ * Resolution order:
+ *   1. STACKPANEL_INFRA_INPUTS env var (path to JSON file)
+ *   2. .stack/state/infra-inputs.json (default location)
+ */
+function loadAllInputs(): Record<string, any> {
+  const relPath =
+    process.env.STACKPANEL_INFRA_INPUTS ??
+    ".stack/state/infra-inputs.json";
+  const inputsPath = path.resolve(ROOT(), relPath);
+
+  try {
+    const raw = fs.readFileSync(inputsPath, "utf-8");
+    const parsed = JSON.parse(raw) as Record<string, unknown>;
+    return Object.fromEntries(
+      Object.entries(parsed).map(([key, value]) => [key, normalizeInputKeys(value)]),
+    );
+  } catch {
+    console.warn(
+      `[infra] Could not read inputs from ${inputsPath}, using empty inputs`,
+    );
+    return {};
+  }
+}
+
+/**
+ * Decrypt AGE-encrypted values in an object tree.
+ * Values matching ENC[age,...] are decrypted using STACKPANEL_AGE_KEY.
+ */
+function decryptValues<T>(obj: T): T {
+  if (typeof obj === "string" && obj.startsWith("ENC[age,")) {
+    const ageKey = process.env.STACKPANEL_AGE_KEY;
+    if (!ageKey) {
+      console.warn(
+        "[infra] Found AGE-encrypted value but STACKPANEL_AGE_KEY is not set",
+      );
+      return obj;
+    }
+    try {
+      const encrypted = obj.slice(8, -1); // Remove ENC[age,...] wrapper
+      const result = execSync(
+        `echo "${encrypted}" | base64 -d | age -d -i <(echo "${ageKey}")`,
+        {
+          encoding: "utf-8",
+          shell: "/bin/bash",
+          stdio: ["pipe", "pipe", "pipe"],
+        },
+      ).trim();
+      return result as unknown as T;
+    } catch (err) {
+      console.warn("[infra] Failed to decrypt AGE value:", err);
+      return obj;
+    }
+  }
+
+  if (Array.isArray(obj)) {
+    return obj.map(decryptValues) as unknown as T;
+  }
+
+  if (obj !== null && typeof obj === "object") {
+    const result: any = {};
+    for (const [key, value] of Object.entries(obj)) {
+      result[key] = decryptValues(value);
+    }
+    return result as T;
+  }
+
+  return obj;
+}
+
+/**
+ * Deep merge two objects (overrides win).
+ */
+function deepMerge(base: any, overrides: any): any {
+  if (overrides === undefined || overrides === null) return base;
+  if (typeof base !== "object" || typeof overrides !== "object")
+    return overrides;
+  if (Array.isArray(base) || Array.isArray(overrides)) return overrides;
+
+  const result = { ...base };
+  for (const [key, value] of Object.entries(overrides)) {
+    result[key] = deepMerge(result[key], value);
+  }
+  return result;
+}
+
+/**
+ * Format an output key using the project key format template.
+ */
+function formatKey(moduleId: string, key: string): string {
+  return PROJECT_CONFIG.keyFormat
+    .replace(/\$module/g, moduleId)
+    .replace(/\$key/g, key);
+}
+
+// =========================================================================
+// Infra class
+// =========================================================================
+
+export default class Infra {
+  private moduleId: string;
+
+  constructor(moduleId: string) {
+    this.moduleId = moduleId;
+  }
+
+  /**
+   * Resolve inputs for this module.
+   *
+   * @param overrides - Optional overrides (JSON string or object).
+   *   Use process.env.STACKPANEL_INFRA_INPUTS_OVERRIDES for CI tweaks.
+   * @returns The module's input configuration with AGE values decrypted.
+   */
+  inputs<T = Record<string, any>>(overrides?: string | Record<string, any>): T {
+    const allInputs = loadAllInputs();
+    let moduleInputs = allInputs[this.moduleId] ?? {};
+
+    // Apply overrides
+    if (overrides) {
+      const overrideObj =
+        typeof overrides === "string" ? JSON.parse(overrides) : overrides;
+      moduleInputs = deepMerge(moduleInputs, overrideObj);
+    }
+
+    // Decrypt any AGE-encrypted values
+    return decryptValues(moduleInputs) as T;
+  }
+
+  /**
+   * Scoped alchemy resource identifier.
+   * Prevents collisions between modules.
+   *
+   * @example
+   * infra.id("role") // → "aws-secrets-role"
+   */
+  id(resourceName: string): string {
+    return `${this.moduleId}-${resourceName}`;
+  }
+
+  /**
+   * Sync all module outputs to the configured storage backend.
+   *
+   * @param modules - Map of module ID → { outputs, syncKeys }
+   */
+  static async syncAll(
+    modules: Record<
+      string,
+      {
+        outputs: Record<string, string>;
+        syncKeys: string[];
+      }
+    >,
+  ): Promise<void> {
+    const backend = PROJECT_CONFIG.storageBackend;
+    if (backend.type === "none") {
+      console.log("[infra] Storage backend is 'none', skipping output sync");
+      return;
+    }
+
+    // Collect all entries to sync
+    const entries: Array<{ formattedKey: string; value: string }> = [];
+    for (const [moduleId, mod] of Object.entries(modules)) {
+      for (const syncKey of mod.syncKeys) {
+        const value = mod.outputs[syncKey];
+        if (value !== undefined && value !== null) {
+          entries.push({
+            formattedKey: formatKey(moduleId, syncKey),
+            value: String(value),
+          });
+        }
+      }
+    }
+
+    if (entries.length === 0) {
+      console.log("[infra] No outputs to sync");
+      return;
+    }
+
+    console.log(
+      `[infra] Syncing ${entries.length} outputs to ${backend.type}...`,
+    );
+
+    switch (backend.type) {
+      case "chamber": {
+        const service = (backend as any).service;
+        for (const { formattedKey, value } of entries) {
+          try {
+            execSync(
+              `printf '%s' ${JSON.stringify(value)} | chamber write ${service} ${formattedKey}`,
+              { stdio: "pipe" },
+            );
+            console.log(`  ✓ chamber write ${service} ${formattedKey}`);
+          } catch (err) {
+            console.error(
+              `  ✗ Failed to write ${formattedKey} to chamber:`,
+              err,
+            );
+          }
+        }
+        break;
+      }
+
+      case "sops": {
+        const filePath = (backend as any).filePath;
+        const dir = path.dirname(filePath);
+
+        if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+
+        // Create the SOPS file if it doesn't exist yet
+        if (!fs.existsSync(filePath)) {
+          const initYaml = `_init: true\n`;
+          const tmpPath = `${filePath}.tmp`;
+          fs.writeFileSync(tmpPath, initYaml);
+          try {
+            execSync(`sops --encrypt --in-place "${tmpPath}"`, {
+              stdio: "pipe",
+            });
+            fs.renameSync(tmpPath, filePath);
+            console.log(`  Created new SOPS file: ${filePath}`);
+          } catch (err) {
+            console.error(`  ✗ Failed to create SOPS file:`, err);
+            if (fs.existsSync(tmpPath)) fs.unlinkSync(tmpPath);
+            break;
+          }
+        }
+
+        // Use `sops set` for each key — non-destructive, preserves existing secrets
+        for (const { formattedKey, value } of entries) {
+          try {
+            const jsonPath = JSON.stringify([formattedKey]);
+            const jsonValue = JSON.stringify(value);
+            execSync(`sops set ${JSON.stringify(filePath)} ${JSON.stringify(jsonPath)} ${JSON.stringify(jsonValue)}`, {
+              stdio: "pipe",
+              cwd: ROOT(),
+            });
+            console.log(`  ✓ sops set ${formattedKey} in ${filePath}`);
+          } catch (err) {
+            console.error(
+              `  ✗ Failed to set ${formattedKey} in ${filePath}:`,
+              err,
+            );
+          }
+        }
+
+        // Clean up _init placeholder if it exists
+        try {
+          const decrypted = execSync(`sops decrypt ${JSON.stringify(filePath)}`, {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+          });
+          if (decrypted.includes("_init:")) {
+            const tmpPath = `${filePath}.tmp`;
+            // Remove _init key via yq, re-encrypt
+            execSync(
+              `sops decrypt ${JSON.stringify(filePath)} | yq 'del(._init)' > "${tmpPath}" && sops --encrypt --in-place "${tmpPath}" && mv "${tmpPath}" ${JSON.stringify(filePath)}`,
+              { stdio: "pipe" },
+            );
+          }
+        } catch {
+          // Non-fatal: _init cleanup is best-effort
+        }
+        break;
+      }
+
+      case "ssm": {
+        const prefix = (backend as any).prefix;
+        const { SSMParameter } = await import("alchemy/aws");
+        const alchemy = await import("alchemy");
+        for (const { formattedKey, value } of entries) {
+          try {
+            await SSMParameter(`infra-output-${formattedKey}`, {
+              name: `${prefix}/${formattedKey}`,
+              value: alchemy.default.secret(value),
+              type: "SecureString",
+              description: `Infrastructure output: ${formattedKey}`,
+              tags: {
+                "managed-by": "stackpanel-infra",
+                module: formattedKey.split("-")[0] ?? "unknown",
+              },
+            });
+            console.log(`  ✓ SSM ${prefix}/${formattedKey}`);
+          } catch (err) {
+            console.error(`  ✗ Failed to write ${formattedKey} to SSM:`, err);
+          }
+        }
+        break;
+      }
+    }
+
+    console.log("[infra] Output sync complete");
+  }
+}
diff --git a/packages/infra/src/resources/ec2-instance.test.ts b/packages/infra/src/resources/ec2-instance.test.ts
new file mode 100644
index 00000000..a72d4a38
--- /dev/null
+++ b/packages/infra/src/resources/ec2-instance.test.ts
@@ -0,0 +1,180 @@
+// @ts-nocheck
+import { describe, expect, test } from "bun:test";
+import {
+  coerceEc2InstanceState,
+  isEc2InstanceReady,
+  normalizeEc2InstanceProps,
+  requiresEc2InstanceReplacement,
+  shouldReuseEc2InstanceState,
+} from "./ec2-instance";
+
+describe("Ec2Instance replacement planning", () => {
+  test("ignores equivalent props when comparing desired state snapshots", () => {
+    const previous = normalizeEc2InstanceProps({
+      name: "web",
+      ami: "ami-123",
+      instanceType: "t3.small",
+      subnetId: "subnet-123",
+      securityGroupIds: ["sg-123"],
+      iamInstanceProfile: "web-profile",
+      userData: "bootstrap-v1",
+      tags: { Name: "web", Stage: "staging" },
+    });
+
+    const next = normalizeEc2InstanceProps({
+      name: "web",
+      ami: "ami-123",
+      instanceType: "t3.small",
+      subnetId: "subnet-123",
+      securityGroupIds: ["sg-123"],
+      iamInstanceProfile: "web-profile",
+      userData: "bootstrap-v1",
+      tags: { Stage: "staging", Name: "web" },
+    });
+
+    expect(requiresEc2InstanceReplacement(previous, next)).toBe(false);
+  });
+
+  test("replaces when bootstrap user data changes", () => {
+    const previous = normalizeEc2InstanceProps({
+      name: "web",
+      ami: "ami-123",
+      instanceType: "t3.small",
+      subnetId: "subnet-123",
+      securityGroupIds: ["sg-123"],
+      iamInstanceProfile: "web-profile",
+      userData: "bootstrap-v1",
+    });
+
+    const next = normalizeEc2InstanceProps({
+      name: "web",
+      ami: "ami-123",
+      instanceType: "t3.small",
+      subnetId: "subnet-123",
+      securityGroupIds: ["sg-123"],
+      iamInstanceProfile: "web-profile",
+      userData: "bootstrap-v2",
+    });
+
+    expect(requiresEc2InstanceReplacement(previous, next)).toBe(true);
+  });
+
+  test("replaces when network identity changes", () => {
+    const previous = normalizeEc2InstanceProps({
+      name: "web",
+      ami: "ami-123",
+      instanceType: "t3.small",
+      subnetId: "subnet-123",
+      securityGroupIds: ["sg-123"],
+    });
+
+    const next = normalizeEc2InstanceProps({
+      name: "web",
+      ami: "ami-123",
+      instanceType: "t3.small",
+      subnetId: "subnet-123",
+      securityGroupIds: ["sg-456"],
+    });
+
+    expect(requiresEc2InstanceReplacement(previous, next)).toBe(true);
+  });
+
+  test("adopts legacy AWS control output without forcing recreation", () => {
+    const state = coerceEc2InstanceState({
+      id: "i-legacy",
+      PublicIp: "1.2.3.4",
+      PrivateIp: "10.0.0.10",
+      PublicDnsName: "ec2-1-2-3-4.compute.amazonaws.com",
+      desiredState: {
+        ImageId: "ami-123",
+        InstanceType: "t3.small",
+        SubnetId: "subnet-123",
+        SecurityGroupIds: ["sg-123"],
+        IamInstanceProfile: "web-profile",
+        UserData: "bootstrap-v1",
+        BlockDeviceMappings: [
+          {
+            Ebs: {
+              VolumeSize: 20,
+            },
+          },
+        ],
+        Tags: [
+          { Key: "Stage", Value: "staging" },
+          { Key: "Name", Value: "web" },
+        ],
+      },
+    });
+
+    expect(state.instanceId).toBe("i-legacy");
+    expect(state.publicIp).toBe("1.2.3.4");
+    expect(state.publicDns).toBe("ec2-1-2-3-4.compute.amazonaws.com");
+    expect(state.propsSnapshot).toEqual(
+      normalizeEc2InstanceProps({
+        name: "legacy",
+        ami: "ami-123",
+        instanceType: "t3.small",
+        subnetId: "subnet-123",
+        securityGroupIds: ["sg-123"],
+        iamInstanceProfile: "web-profile",
+        userData: "bootstrap-v1",
+        rootVolumeSize: 20,
+        tags: {
+          Name: "web",
+          Stage: "staging",
+        },
+      }),
+    );
+  });
+
+  test("waits for public endpoint details when a public instance is expected", () => {
+    expect(
+      isEc2InstanceReady(
+        {
+          State: { Name: "running" },
+          PublicIpAddress: "1.2.3.4",
+          PublicDnsName: "ec2-1-2-3-4.compute.amazonaws.com",
+        },
+        true,
+      ),
+    ).toBe(true);
+
+    expect(
+      isEc2InstanceReady(
+        {
+          State: { Name: "running" },
+          PublicIpAddress: "1.2.3.4",
+          PublicDnsName: "",
+        },
+        true,
+      ),
+    ).toBe(true);
+
+    expect(
+      isEc2InstanceReady(
+        {
+          State: { Name: "pending" },
+          PublicIpAddress: "1.2.3.4",
+          PublicDnsName: "ec2-1-2-3-4.compute.amazonaws.com",
+        },
+        true,
+      ),
+    ).toBe(false);
+  });
+
+  test("does not reuse prior output during replacement creates", () => {
+    expect(
+      shouldReuseEc2InstanceState("create", {
+        instanceId: "i-old",
+        state: "terminated",
+      }),
+    ).toBe(false);
+
+    expect(
+      shouldReuseEc2InstanceState("update", {
+        instanceId: "i-old",
+        state: "running",
+      }),
+    ).toBe(true);
+  });
+});
diff --git a/packages/infra/src/resources/ec2-instance.ts b/packages/infra/src/resources/ec2-instance.ts
new file mode 100644
index 00000000..44410aeb
--- /dev/null
+++ b/packages/infra/src/resources/ec2-instance.ts
@@ -0,0 +1,238 @@
+// =============================================================================
+// ec2-instance.tpl.ts — Custom Alchemy resource for AWS EC2 instances
+//
+// This is the Alchemy resource definition (create / update / delete / replace).
+// Lifecycle decision logic (should we replace? can we adopt legacy state?)
+// lives in ec2-lifecycle.tpl.ts to keep this file focused on AWS API calls.
+//
+// Generated by stackpanel — static library code.
+// =============================================================================
+import type { Context } from "alchemy";
+import { Resource } from "alchemy";
+import {
+  type Ec2Instance,
+  type Ec2InstanceProps,
+  type NormalizedEc2InstanceProps,
+  coerceEc2InstanceState,
+  isEc2InstanceReady,
+  normalizeEc2InstanceProps,
+  requiresEc2InstanceReplacement,
+  shouldReuseEc2InstanceState,
+} from "./ec2-lifecycle";
+
+// Re-export types and helpers so existing imports from this module still work.
+export {
+  type Ec2Instance,
+  type Ec2InstanceProps,
+  type NormalizedEc2InstanceProps,
+  coerceEc2InstanceState,
+  isEc2InstanceReady,
+  normalizeEc2InstanceProps,
+  requiresEc2InstanceReplacement,
+  shouldReuseEc2InstanceState,
+};
+
+// ---- AWS helpers ------------------------------------------------------------
+
+/** Accept either an ARN or a profile name for the RunInstances API. */
+function formatIamInstanceProfile(
+  iamInstanceProfile: string | null | undefined,
+): { Arn: string } | { Name: string } | undefined {
+  if (!iamInstanceProfile) return undefined;
+  return iamInstanceProfile.startsWith("arn:")
+    ? { Arn: iamInstanceProfile }
+    : { Name: iamInstanceProfile };
+}
+
+/** IAM instance profiles take a few seconds to propagate after creation. */
+function isRetryableIamInstanceProfileError(err: unknown): boolean {
+  if (!err || typeof err !== "object") return false;
+  const name = "name" in err ? String((err as { name?: unknown }).name) : "";
+  const message = "message" in err ? String((err as { message?: unknown }).message) : "";
+  return (
+    name === "InvalidParameterValue" &&
+    /iamInstanceProfile\.(arn|name)/i.test(message) &&
+    /Invalid IAM Instance Profile/i.test(message)
+  );
+}
+
+async function runInstancesWithRetry(
+  client: InstanceType<(typeof import("@aws-sdk/client-ec2"))["EC2Client"]>,
+  command: import("@aws-sdk/client-ec2").RunInstancesCommand,
+  attempts = 10,
+): Promise<import("@aws-sdk/client-ec2").RunInstancesCommandOutput> {
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    try {
+      return await client.send(command);
+    } catch (err) {
+      if (!isRetryableIamInstanceProfileError(err) || attempt === attempts - 1) throw err;
+      await new Promise((resolve) => setTimeout(resolve, 3000));
+    }
+  }
+  throw new Error("Unable to create EC2 instance");
+}
+
+/** Poll DescribeInstances until the instance is running (and public, if applicable). */
+async function waitForEc2InstanceDetails(
+  client: InstanceType<(typeof import("@aws-sdk/client-ec2"))["EC2Client"]>,
+  instanceId: string,
+  requirePublicEndpoint: boolean,
+  attempts = 40,
+) {
+  const { DescribeInstancesCommand } = await import("@aws-sdk/client-ec2");
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    const described = await client.send(
+      new DescribeInstancesCommand({ InstanceIds: [instanceId] }),
+    );
+    const instance = described.Reservations?.[0]?.Instances?.[0];
+    if (isEc2InstanceReady(instance, requirePublicEndpoint)) return instance;
+    await new Promise((resolve) => setTimeout(resolve, 3000));
+  }
+
+  throw new Error(`Timed out waiting for EC2 instance ${instanceId} to become ready`);
+}
+
+/** Diff-apply tags: remove stale keys, upsert current ones. */
+async function syncInstanceTags(
+  client: InstanceType<(typeof import("@aws-sdk/client-ec2"))["EC2Client"]>,
+  instanceId: string,
+  previous: Record<string, string>,
+  next: Record<string, string>,
+) {
+  const { CreateTagsCommand, DeleteTagsCommand } = await import("@aws-sdk/client-ec2");
+
+  const removedKeys = Object.keys(previous).filter((key) => !(key in next));
+  if (removedKeys.length > 0) {
+    await client.send(
+      new DeleteTagsCommand({
+        Resources: [instanceId],
+        Tags: removedKeys.map((Key) => ({ Key })),
+      }),
+    );
+  }
+
+  if (Object.keys(next).length > 0) {
+    await client.send(
+      new CreateTagsCommand({
+        Resources: [instanceId],
+        Tags: Object.entries(next).map(([Key, Value]) => ({ Key, Value })),
+      }),
+    );
+  }
+}
+
+// ---- Alchemy resource -------------------------------------------------------
+
+export const Ec2Instance = Resource(
+  "stackpanel::Ec2Instance",
+  async function (
+    this: Context<Ec2Instance>,
+    _id: string,
+    props: Ec2InstanceProps,
+  ): Promise<Ec2Instance> {
+    const {
+      EC2Client,
+      RunInstancesCommand,
+      TerminateInstancesCommand,
+    } = await import("@aws-sdk/client-ec2");
+
+    const client = new EC2Client({});
+    const propsSnapshot = normalizeEc2InstanceProps(props);
+
+    // Attempt to read legacy Cloud Control state for migration scenarios.
+    const migratedState = coerceEc2InstanceState(this.output);
+    const reusableState = shouldReuseEc2InstanceState(this.phase, migratedState)
+      ? migratedState
+      : {};
+
+    // -- Delete ---------------------------------------------------------------
+    if (this.phase === "delete") {
+      if (props.destroyOnDelete === false) return this.destroy();
+      if (this.output?.instanceId) {
+        await client.send(
+          new TerminateInstancesCommand({ InstanceIds: [this.output.instanceId] }),
+        );
+      }
+      return this.destroy();
+    }
+
+    // -- Replace check --------------------------------------------------------
+    // Compare our stored snapshot against the new desired props.
+    // Only triggers on actual immutable changes, not on AWS's synthetic fields.
+    const previousSnapshot = this.output?.propsSnapshot ?? reusableState.propsSnapshot;
+    if (
+      this.phase === "update" &&
+      previousSnapshot &&
+      requiresEc2InstanceReplacement(previousSnapshot, propsSnapshot)
+    ) {
+      return this.replace();
+    }
+
+    // -- Create or adopt ------------------------------------------------------
+    let instanceId = shouldReuseEc2InstanceState(this.phase, this.output)
+      ? this.output?.instanceId
+      : reusableState.instanceId;
+
+    if (!instanceId) {
+      const run = await runInstancesWithRetry(
+        client,
+        new RunInstancesCommand({
+          ImageId: props.ami,
+          InstanceType: props.instanceType,
+          SubnetId: props.subnetId,
+          SecurityGroupIds: props.securityGroupIds,
+          KeyName: props.keyName ?? undefined,
+          IamInstanceProfile: formatIamInstanceProfile(props.iamInstanceProfile),
+          UserData: props.userData
+            ? Buffer.from(props.userData).toString("base64")
+            : undefined,
+          MinCount: 1,
+          MaxCount: 1,
+          BlockDeviceMappings: props.rootVolumeSize
+            ? [{ DeviceName: "/dev/xvda", Ebs: { VolumeSize: props.rootVolumeSize, VolumeType: "gp3" } }]
+            : undefined,
+          NetworkInterfaces: props.associatePublicIp === false
+            ? [{ DeviceIndex: 0, SubnetId: props.subnetId, Groups: props.securityGroupIds, AssociatePublicIpAddress: false }]
+            : undefined,
+          TagSpecifications: [{
+            ResourceType: "instance",
+            Tags: Object.entries({
+              Name: props.name,
+              ...props.tags,
+              alchemy_stage: this.stage,
+              alchemy_resource: this.id,
+            }).map(([Key, Value]) => ({ Key, Value })),
+          }],
+        }),
+      );
+      instanceId = run.Instances?.[0]?.InstanceId;
+    }
+
+    if (!instanceId) throw new Error(`Unable to create EC2 instance ${props.name}`);
+
+    // -- Tag sync -------------------------------------------------------------
+    if (this.phase === "update") {
+      await syncInstanceTags(client, instanceId, previousSnapshot?.tags ?? {}, propsSnapshot.tags);
+    } else if (Object.keys(propsSnapshot.tags).length > 0) {
+      await syncInstanceTags(client, instanceId, {}, propsSnapshot.tags);
+    }
+
+    // -- Wait for readiness ---------------------------------------------------
+    const instance = await waitForEc2InstanceDetails(
+      client,
+      instanceId,
+      propsSnapshot.associatePublicIp,
+    );
+
+    return {
+      instanceId,
+      publicIp: instance?.PublicIpAddress ?? null,
+      privateIp: instance?.PrivateIpAddress ?? null,
+      publicDns: instance?.PublicDnsName ?? null,
+      state: instance?.State?.Name ?? null,
+      name: props.name,
+      propsSnapshot,
+    };
+  },
+);
diff --git a/packages/infra/src/resources/ec2-lifecycle.ts b/packages/infra/src/resources/ec2-lifecycle.ts
new file mode 100644
index 00000000..c0d1f910
--- /dev/null
+++ b/packages/infra/src/resources/ec2-lifecycle.ts
@@ -0,0 +1,246 @@
+// =============================================================================
+// ec2-lifecycle.tpl.ts — EC2 instance lifecycle decision helpers
+//
+// Pure functions (no AWS calls) that determine whether an EC2 instance
+// should be replaced, updated, or adopted from legacy state.
+//
+// Key design decision: Alchemy's Cloud Control EC2 provider compares
+// desired state against the live AWS model, which includes synthetic
+// fields like SecurityGroups (by name). That causes false replacements.
+// Instead, this module stores a normalized snapshot of the desired props
+// in Alchemy state and compares snapshot-to-snapshot, ignoring whatever
+// extra fields AWS returns.
+//
+// Generated by stackpanel — static library code.
+// =============================================================================
+
+// ---- Types ------------------------------------------------------------------
+
+export interface Ec2InstanceProps {
+  name: string;
+  ami: string;
+  instanceType: string;
+  subnetId: string;
+  securityGroupIds: string[];
+  keyName?: string | null;
+  iamInstanceProfile?: string | null;
+  userData?: string | null;
+  rootVolumeSize?: number | null;
+  associatePublicIp?: boolean;
+  tags?: Record<string, string>;
+  destroyOnDelete?: boolean;
+}
+
+/** Deterministic representation of EC2 props, used for diffing across deploys. */
+export interface NormalizedEc2InstanceProps {
+  ami: string;
+  instanceType: string;
+  subnetId: string;
+  securityGroupIds: string[];
+  keyName: string | null;
+  iamInstanceProfile: string | null;
+  userData: string | null;
+  rootVolumeSize: number | null;
+  associatePublicIp: boolean;
+  tags: Record<string, string>;
+}
+
+export interface Ec2Instance {
+  instanceId: string;
+  publicIp?: string | null;
+  privateIp?: string | null;
+  publicDns?: string | null;
+  state?: string | null;
+  name: string;
+  /** Stored snapshot of the props that created/last updated this instance. */
+  propsSnapshot: NormalizedEc2InstanceProps;
+}
+
+// ---- Normalization ----------------------------------------------------------
+
+function sortRecord(value: Record<string, string> | undefined): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(value ?? {}).sort(([left], [right]) => left.localeCompare(right)),
+  );
+}
+
+/**
+ * Convert raw Ec2InstanceProps into a deterministic snapshot.
+ * Sorts arrays and records so ordering differences don't trigger replacements.
+ */
+export function normalizeEc2InstanceProps(
+  props: Ec2InstanceProps,
+): NormalizedEc2InstanceProps {
+  return {
+    ami: props.ami,
+    instanceType: props.instanceType,
+    subnetId: props.subnetId,
+    securityGroupIds: [...props.securityGroupIds].sort(),
+    keyName: props.keyName ?? null,
+    iamInstanceProfile: props.iamInstanceProfile ?? null,
+    userData: props.userData ?? null,
+    rootVolumeSize: props.rootVolumeSize ?? null,
+    associatePublicIp: props.associatePublicIp ?? true,
+    tags: sortRecord(props.tags),
+  };
+}
+
+// ---- Replacement detection --------------------------------------------------
+
+/**
+ * Returns true if any immutable property changed between deploys.
+ * Tag changes are NOT immutable — they get synced in-place.
+ */
+export function requiresEc2InstanceReplacement(
+  previous: NormalizedEc2InstanceProps,
+  next: NormalizedEc2InstanceProps,
+): boolean {
+  return (
+    previous.ami !== next.ami ||
+    previous.instanceType !== next.instanceType ||
+    previous.subnetId !== next.subnetId ||
+    JSON.stringify(previous.securityGroupIds) !== JSON.stringify(next.securityGroupIds) ||
+    previous.keyName !== next.keyName ||
+    previous.iamInstanceProfile !== next.iamInstanceProfile ||
+    previous.userData !== next.userData ||
+    previous.rootVolumeSize !== next.rootVolumeSize ||
+    previous.associatePublicIp !== next.associatePublicIp
+  );
+}
+
+// ---- Legacy state migration -------------------------------------------------
+//
+// When migrating from AWS Cloud Control's EC2 provider (AWS::EC2::Instance)
+// to this custom resource, the Alchemy state file contains CloudFormation-
+// shaped output (PascalCase fields, desiredState blob). These functions
+// coerce that legacy shape into our Ec2Instance type so the resource can
+// adopt the existing instance without forcing a replacement.
+
+/** Convert AWS CloudFormation Tag array [{Key, Value}] to a plain record. */
+function tagsToRecord(value: unknown): Record<string, string> {
+  if (!Array.isArray(value)) return {};
+
+  return Object.fromEntries(
+    value
+      .flatMap((tag) => {
+        if (!tag || typeof tag !== "object") return [];
+        const record = tag as { Key?: unknown; Value?: unknown };
+        if (typeof record.Key !== "string" || typeof record.Value !== "string") return [];
+        return [[record.Key, record.Value] as const];
+      })
+      .sort(([left], [right]) => left.localeCompare(right)),
+  );
+}
+
+/**
+ * Best-effort coercion of legacy Cloud Control output into Ec2Instance shape.
+ * Falls back gracefully — any field that can't be read is set to null/undefined.
+ */
+export function coerceEc2InstanceState(output: unknown): Partial<Ec2Instance> {
+  if (!output || typeof output !== "object") return {};
+
+  const record = output as Record<string, any>;
+  const desiredState =
+    record.desiredState && typeof record.desiredState === "object"
+      ? (record.desiredState as Record<string, any>)
+      : {};
+
+  // Cloud Control nests networking under NetworkInterfaces[0]
+  const networkInterface =
+    desiredState.NetworkInterfaces?.[0] ?? record.NetworkInterfaces?.[0] ?? {};
+  const securityGroupIds =
+    desiredState.SecurityGroupIds ?? networkInterface.GroupSet ?? record.SecurityGroupIds ?? [];
+  const subnetId =
+    desiredState.SubnetId ?? networkInterface.SubnetId ?? record.SubnetId;
+  const ami = desiredState.ImageId ?? record.ImageId;
+  const instanceType = desiredState.InstanceType ?? record.InstanceType;
+
+  let propsSnapshot: NormalizedEc2InstanceProps | undefined;
+  if (
+    typeof ami === "string" &&
+    typeof instanceType === "string" &&
+    typeof subnetId === "string" &&
+    Array.isArray(securityGroupIds)
+  ) {
+    const desiredMappings = desiredState.BlockDeviceMappings ?? record.BlockDeviceMappings ?? [];
+    const rootVolumeSize = desiredMappings?.[0]?.Ebs?.VolumeSize;
+
+    propsSnapshot = normalizeEc2InstanceProps({
+      name: String(record.name ?? "legacy"),
+      ami,
+      instanceType,
+      subnetId,
+      securityGroupIds: securityGroupIds.filter(
+        (value: unknown): value is string => typeof value === "string",
+      ),
+      keyName:
+        typeof (desiredState.KeyName ?? record.KeyName) === "string"
+          ? (desiredState.KeyName ?? record.KeyName) : null,
+      iamInstanceProfile:
+        typeof (desiredState.IamInstanceProfile ?? record.IamInstanceProfile) === "string"
+          ? (desiredState.IamInstanceProfile ?? record.IamInstanceProfile) : null,
+      userData:
+        typeof (desiredState.UserData ?? record.UserData) === "string"
+          ? (desiredState.UserData ?? record.UserData) : null,
+      rootVolumeSize: typeof rootVolumeSize === "number" ? rootVolumeSize : null,
+      associatePublicIp:
+        typeof networkInterface.AssociatePublicIpAddress === "boolean"
+          ? networkInterface.AssociatePublicIpAddress : true,
+      tags: tagsToRecord(desiredState.Tags ?? record.Tags),
+    });
+  }
+
+  return {
+    instanceId:
+      (typeof record.instanceId === "string" ? record.instanceId : null) ??
+      (typeof record.InstanceId === "string" ? record.InstanceId : null) ??
+      (typeof record.id === "string" ? record.id : null) ??
+      undefined,
+    publicIp:
+      (typeof record.publicIp === "string" ? record.publicIp : null) ??
+      (typeof record.PublicIp === "string" ? record.PublicIp : null) ?? null,
+    privateIp:
+      (typeof record.privateIp === "string" ? record.privateIp : null) ??
+      (typeof record.PrivateIp === "string" ? record.PrivateIp : null) ??
+      (typeof record.PrivateIpAddress === "string" ? record.PrivateIpAddress : null) ?? null,
+    publicDns:
+      (typeof record.publicDns === "string" ? record.publicDns : null) ??
+      (typeof record.PublicDnsName === "string" ? record.PublicDnsName : null) ?? null,
+    state:
+      (typeof record.state === "string" ? record.state : null) ??
+      (typeof record.State?.Name === "string" ? record.State.Name : null) ?? null,
+    name: typeof record.name === "string" ? record.name : "legacy",
+    propsSnapshot,
+  };
+}
+
+// ---- Phase guards -----------------------------------------------------------
+
+/**
+ * During Alchemy's replace flow, the resource is called in a create-like
+ * phase but still receives the OLD (terminated) output. We must not reuse
+ * a terminated instance's ID — only update phases should inherit state.
+ */
+export function shouldReuseEc2InstanceState(
+  phase: string,
+  output: Partial<Ec2Instance> | null | undefined,
+): boolean {
+  return phase === "update" && Boolean(output?.instanceId);
+}
+
+/**
+ * An instance is "ready" when it's running and, for public instances,
+ * has been assigned at least an IP or DNS name.
+ */
+export function isEc2InstanceReady(
+  instance: {
+    State?: { Name?: string | null } | null;
+    PublicIpAddress?: string | null;
+    PublicDnsName?: string | null;
+  } | null | undefined,
+  requirePublicEndpoint: boolean,
+): boolean {
+  if (instance?.State?.Name !== "running") return false;
+  if (!requirePublicEndpoint) return true;
+  return Boolean(instance.PublicIpAddress || instance.PublicDnsName);
+}
diff --git a/packages/infra/src/resources/iam-instance-profile.ts b/packages/infra/src/resources/iam-instance-profile.ts
new file mode 100644
index 00000000..a7731270
--- /dev/null
+++ b/packages/infra/src/resources/iam-instance-profile.ts
@@ -0,0 +1,199 @@
+// Custom alchemy Resource for AWS IAM Instance Profile.
+// Generated by stackpanel — static library code.
+import type { Context } from "alchemy";
+import { Resource } from "alchemy";
+
+export interface IamInstanceProfileProps {
+  name: string;
+  roleName: string;
+  tags?: Record<string, string>;
+  destroyOnDelete?: boolean;
+}
+
+export interface IamInstanceProfile {
+  name: string;
+  arn: string;
+  roleName: string;
+  adopted?: boolean;
+}
+
+function isNoSuchEntityError(err: unknown): boolean {
+  if (!err || typeof err !== "object") return false;
+  const name = "name" in err ? String((err as { name?: unknown }).name) : "";
+  return name === "NoSuchEntity" || name === "NoSuchEntityException";
+}
+
+async function getInstanceProfileWithRetry(
+  client: InstanceType<(typeof import("@aws-sdk/client-iam"))["IAMClient"]>,
+  name: string,
+  attempts = 10,
+): Promise<import("@aws-sdk/client-iam").GetInstanceProfileCommandOutput> {
+  const { GetInstanceProfileCommand } = await import("@aws-sdk/client-iam");
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    try {
+      return await client.send(
+        new GetInstanceProfileCommand({ InstanceProfileName: name }),
+      );
+    } catch (err) {
+      if (!isNoSuchEntityError(err) || attempt === attempts - 1) {
+        throw err;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+  }
+
+  throw new Error(`Unable to resolve instance profile ${name}`);
+}
+
+async function addRoleToInstanceProfileWithRetry(
+  client: InstanceType<(typeof import("@aws-sdk/client-iam"))["IAMClient"]>,
+  profileName: string,
+  roleName: string,
+  attempts = 10,
+): Promise<void> {
+  const { AddRoleToInstanceProfileCommand } = await import("@aws-sdk/client-iam");
+
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    try {
+      await client.send(
+        new AddRoleToInstanceProfileCommand({
+          InstanceProfileName: profileName,
+          RoleName: roleName,
+        }),
+      );
+      return;
+    } catch (err) {
+      if (!isNoSuchEntityError(err) || attempt === attempts - 1) {
+        throw err;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+  }
+}
+
+export const IamInstanceProfile = Resource(
+  "stackpanel::IamInstanceProfile",
+  async function (
+    this: Context<IamInstanceProfile>,
+    _id: string,
+    props: IamInstanceProfileProps,
+  ): Promise<IamInstanceProfile> {
+    const {
+      IAMClient,
+      GetInstanceProfileCommand,
+      CreateInstanceProfileCommand,
+      AddRoleToInstanceProfileCommand,
+      RemoveRoleFromInstanceProfileCommand,
+      TagInstanceProfileCommand,
+      DeleteInstanceProfileCommand,
+    } = await import("@aws-sdk/client-iam");
+
+    const client = new IAMClient({});
+
+    if (this.phase === "delete") {
+      if (props.destroyOnDelete === false) {
+        return this.destroy();
+      }
+      try {
+        const existing = await client.send(
+          new GetInstanceProfileCommand({ InstanceProfileName: props.name }),
+        );
+        const roles = existing.InstanceProfile?.Roles ?? [];
+        for (const role of roles) {
+          await client.send(
+            new RemoveRoleFromInstanceProfileCommand({
+              InstanceProfileName: props.name,
+              RoleName: role.RoleName!,
+            }),
+          );
+        }
+        await client.send(
+          new DeleteInstanceProfileCommand({ InstanceProfileName: props.name }),
+        );
+      } catch (err: any) {
+        if (!isNoSuchEntityError(err)) throw err;
+      }
+      return this.destroy();
+    }
+
+    let adopted = this.output?.adopted ?? false;
+    let profile = this.output;
+
+    if (profile) {
+      try {
+        const existing = await getInstanceProfileWithRetry(client, props.name, 1);
+        profile = {
+          name: props.name,
+          arn: existing.InstanceProfile?.Arn ?? profile.arn,
+          roleName: props.roleName,
+        };
+      } catch (err) {
+        if (!isNoSuchEntityError(err)) throw err;
+        profile = undefined;
+        adopted = false;
+      }
+    }
+
+    if (!profile) {
+      try {
+        const existing = await client.send(
+          new GetInstanceProfileCommand({ InstanceProfileName: props.name }),
+        );
+        if (existing.InstanceProfile?.Arn) {
+          adopted = true;
+          profile = {
+            name: props.name,
+            arn: existing.InstanceProfile.Arn,
+            roleName: props.roleName,
+          };
+        }
+      } catch (err: any) {
+        if (!isNoSuchEntityError(err)) throw err;
+      }
+    }
+
+    if (!profile) {
+      const created = await client.send(
+        new CreateInstanceProfileCommand({
+          InstanceProfileName: props.name,
+          Tags: props.tags
+            ? Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value }))
+            : undefined,
+        }),
+      );
+      if (!created.InstanceProfile?.Arn) {
+        throw new Error(`Unable to create instance profile ${props.name}`);
+      }
+      profile = {
+        name: props.name,
+        arn: created.InstanceProfile.Arn,
+        roleName: props.roleName,
+      };
+    }
+
+    if (props.tags && Object.keys(props.tags).length > 0) {
+      await client.send(
+        new TagInstanceProfileCommand({
+          InstanceProfileName: props.name,
+          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
+        }),
+      );
+    }
+
+    const current = await getInstanceProfileWithRetry(client, props.name);
+    const existingRoles = new Set(
+      (current.InstanceProfile?.Roles ?? []).map((role) => role.RoleName),
+    );
+    if (!existingRoles.has(props.roleName)) {
+      await addRoleToInstanceProfileWithRetry(client, props.name, props.roleName);
+    }
+
+    return {
+      name: props.name,
+      arn: current.InstanceProfile?.Arn ?? profile.arn,
+      roleName: props.roleName,
+      adopted,
+    };
+  },
+);
diff --git a/packages/infra/src/resources/iam-role.ts b/packages/infra/src/resources/iam-role.ts
new file mode 100644
index 00000000..60b68a77
--- /dev/null
+++ b/packages/infra/src/resources/iam-role.ts
@@ -0,0 +1,152 @@
+import type { Context } from "alchemy";
+import { Resource } from "alchemy";
+
+export interface IamInlinePolicy {
+  policyName: string;
+  policyDocument: unknown;
+}
+
+export interface IamRoleProps {
+  roleName: string;
+  assumeRolePolicy: unknown;
+  description?: string;
+  tags?: Record<string, string>;
+  managedPolicyArns?: string[];
+  policies?: IamInlinePolicy[];
+  destroyOnDelete?: boolean;
+}
+
+export interface IamRole extends IamRoleProps {
+  arn: string;
+  adopted?: boolean;
+}
+
+function asPolicyJson(policy: unknown): string {
+  return typeof policy === "string" ? policy : JSON.stringify(policy);
+}
+
+export const IamRole = Resource(
+  "stackpanel::IamRole",
+  async function (
+    this: Context<IamRole>,
+    _id: string,
+    props: IamRoleProps,
+  ): Promise<IamRole> {
+    const {
+      IAMClient,
+      CreateRoleCommand,
+      GetRoleCommand,
+      UpdateAssumeRolePolicyCommand,
+      UpdateRoleDescriptionCommand,
+      TagRoleCommand,
+      ListAttachedRolePoliciesCommand,
+      AttachRolePolicyCommand,
+      PutRolePolicyCommand,
+    } = await import("@aws-sdk/client-iam");
+
+    const client = new IAMClient({});
+
+    if (this.phase === "delete") {
+      return this.destroy();
+    }
+
+    let adopted = this.output?.adopted ?? false;
+
+    const getExistingRole = async () => {
+      try {
+        const existing = await client.send(new GetRoleCommand({ RoleName: props.roleName }));
+        return existing.Role;
+      } catch (err: any) {
+        if (err.name === "NoSuchEntityException") {
+          return undefined;
+        }
+        throw err;
+      }
+    };
+
+    let role = await getExistingRole();
+
+    if (!role) {
+      const created = await client.send(
+        new CreateRoleCommand({
+          RoleName: props.roleName,
+          AssumeRolePolicyDocument: asPolicyJson(props.assumeRolePolicy),
+          Description: props.description,
+          Tags: Object.entries(props.tags ?? {}).map(([Key, Value]) => ({ Key, Value })),
+        }),
+      );
+      role = created.Role;
+    } else {
+      adopted = true;
+    }
+
+    await client.send(
+      new UpdateAssumeRolePolicyCommand({
+        RoleName: props.roleName,
+        PolicyDocument: asPolicyJson(props.assumeRolePolicy),
+      }),
+    );
+
+    if (props.description) {
+      await client.send(
+        new UpdateRoleDescriptionCommand({
+          RoleName: props.roleName,
+          Description: props.description,
+        }),
+      );
+    }
+
+    if (props.tags && Object.keys(props.tags).length > 0) {
+      await client.send(
+        new TagRoleCommand({
+          RoleName: props.roleName,
+          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
+        }),
+      );
+    }
+
+    const managedPolicyArns = props.managedPolicyArns ?? [];
+    if (managedPolicyArns.length > 0) {
+      const attached = await client.send(
+        new ListAttachedRolePoliciesCommand({
+          RoleName: props.roleName,
+        }),
+      );
+      const attachedArns = new Set((attached.AttachedPolicies ?? []).map((policy) => policy.PolicyArn));
+
+      for (const arn of managedPolicyArns) {
+        if (!attachedArns.has(arn)) {
+          await client.send(
+            new AttachRolePolicyCommand({
+              RoleName: props.roleName,
+              PolicyArn: arn,
+            }),
+          );
+        }
+      }
+    }
+
+    for (const policy of props.policies ?? []) {
+      await client.send(
+        new PutRolePolicyCommand({
+          RoleName: props.roleName,
+          PolicyName: policy.policyName,
+          PolicyDocument: asPolicyJson(policy.policyDocument),
+        }),
+      );
+    }
+
+    const finalRole = await client.send(new GetRoleCommand({ RoleName: props.roleName }));
+    const finalArn = finalRole.Role?.Arn ?? role?.Arn;
+
+    if (!finalArn) {
+      throw new Error(`Unable to resolve ARN for IAM role ${props.roleName}`);
+    }
+
+    return {
+      ...props,
+      arn: finalArn,
+      adopted,
+    };
+  },
+);
diff --git a/packages/infra/src/resources/key-pair.ts b/packages/infra/src/resources/key-pair.ts
new file mode 100644
index 00000000..6bcf4061
--- /dev/null
+++ b/packages/infra/src/resources/key-pair.ts
@@ -0,0 +1,104 @@
+// Custom alchemy Resource for AWS Key Pair.
+// Generated by stackpanel — static library code.
+import type { Context } from "alchemy";
+import { Resource } from "alchemy";
+
+export interface KeyPairProps {
+  keyName: string;
+  publicKey: string;
+  tags?: Record<string, string>;
+  destroyOnDelete?: boolean;
+}
+
+export interface KeyPair {
+  keyName: string;
+  keyPairId?: string;
+  adopted?: boolean;
+}
+
+function hasTags(tags: Record<string, string> | undefined): tags is Record<string, string> {
+  return Boolean(tags && Object.keys(tags).length > 0);
+}
+
+export const KeyPair = Resource(
+  "stackpanel::KeyPair",
+  async function (
+    this: Context<KeyPair>,
+    _id: string,
+    props: KeyPairProps,
+  ): Promise<KeyPair> {
+    const {
+      EC2Client,
+      DescribeKeyPairsCommand,
+      ImportKeyPairCommand,
+      CreateTagsCommand,
+      DeleteKeyPairCommand,
+    } = await import("@aws-sdk/client-ec2");
+
+    const client = new EC2Client({});
+
+    if (this.phase === "delete") {
+      if (props.destroyOnDelete === false) {
+        return this.destroy();
+      }
+
+      try {
+        await client.send(new DeleteKeyPairCommand({ KeyName: props.keyName }));
+      } catch (err: any) {
+        if (err.name !== "InvalidKeyPair.NotFound") throw err;
+      }
+
+      return this.destroy();
+    }
+
+    let adopted = this.output?.adopted ?? false;
+    let keyPairId = this.output?.keyPairId;
+
+    try {
+      const existing = await client.send(
+        new DescribeKeyPairsCommand({ KeyNames: [props.keyName] }),
+      );
+      const found = existing.KeyPairs?.[0];
+      if (found?.KeyPairId) {
+        adopted = true;
+        keyPairId = found.KeyPairId;
+      }
+    } catch (err: any) {
+      if (err.name !== "InvalidKeyPair.NotFound") throw err;
+    }
+
+    if (!keyPairId) {
+      const imported = await client.send(
+        new ImportKeyPairCommand({
+          KeyName: props.keyName,
+          PublicKeyMaterial: Buffer.from(props.publicKey),
+          TagSpecifications: hasTags(props.tags)
+            ? [
+                {
+                  ResourceType: "key-pair",
+                  Tags: Object.entries(props.tags).map(([Key, Value]) => ({
+                    Key,
+                    Value,
+                  })),
+                },
+              ]
+            : undefined,
+        }),
+      );
+      keyPairId = imported.KeyPairId;
+    } else if (hasTags(props.tags)) {
+      await client.send(
+        new CreateTagsCommand({
+          Resources: [keyPairId],
+          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
+        }),
+      );
+    }
+
+    return {
+      keyName: props.keyName,
+      keyPairId,
+      adopted,
+    };
+  },
+);
diff --git a/packages/infra/src/resources/security-group.ts b/packages/infra/src/resources/security-group.ts
new file mode 100644
index 00000000..a82581f7
--- /dev/null
+++ b/packages/infra/src/resources/security-group.ts
@@ -0,0 +1,181 @@
+// Custom alchemy Resource for AWS Security Group.
+// Generated by stackpanel — static library code.
+import type { Context } from "alchemy";
+import { Resource } from "alchemy";
+
+export interface SecurityGroupRule {
+  fromPort: number;
+  toPort: number;
+  protocol: string;
+  cidrBlocks?: string[];
+  ipv6CidrBlocks?: string[];
+  securityGroupIds?: string[];
+  description?: string;
+}
+
+export interface SecurityGroupProps {
+  name: string;
+  description?: string;
+  vpcId: string;
+  ingress?: SecurityGroupRule[];
+  egress?: SecurityGroupRule[];
+  tags?: Record<string, string>;
+  destroyOnDelete?: boolean;
+}
+
+export interface SecurityGroup {
+  groupId: string;
+  name: string;
+  adopted?: boolean;
+}
+
+export const SecurityGroup = Resource(
+  "stackpanel::SecurityGroup",
+  async function (
+    this: Context<SecurityGroup>,
+    _id: string,
+    props: SecurityGroupProps,
+  ): Promise<SecurityGroup> {
+    const {
+      EC2Client,
+      CreateSecurityGroupCommand,
+      DescribeSecurityGroupsCommand,
+      AuthorizeSecurityGroupIngressCommand,
+      AuthorizeSecurityGroupEgressCommand,
+      CreateTagsCommand,
+      DeleteSecurityGroupCommand,
+    } = await import("@aws-sdk/client-ec2");
+
+    const client = new EC2Client({});
+
+    if (this.phase === "delete") {
+      if (props.destroyOnDelete === false) {
+        return this.destroy();
+      }
+
+      if (this.output?.groupId) {
+        try {
+          await client.send(
+            new DeleteSecurityGroupCommand({ GroupId: this.output.groupId }),
+          );
+        } catch (err: any) {
+          if (err.name !== "InvalidGroup.NotFound") throw err;
+        }
+      }
+      return this.destroy();
+    }
+
+    let groupId = this.output?.groupId;
+    let adopted = this.output?.adopted ?? false;
+
+    if (!groupId) {
+      const existing = await client.send(
+        new DescribeSecurityGroupsCommand({
+          Filters: [
+            { Name: "group-name", Values: [props.name] },
+            { Name: "vpc-id", Values: [props.vpcId] },
+          ],
+        }),
+      );
+      const found = existing.SecurityGroups?.[0];
+      if (found?.GroupId) {
+        groupId = found.GroupId;
+        adopted = true;
+      }
+    }
+
+    if (!groupId) {
+      const created = await client.send(
+        new CreateSecurityGroupCommand({
+          GroupName: props.name,
+          Description: props.description ?? props.name,
+          VpcId: props.vpcId,
+        }),
+      );
+      groupId = created.GroupId;
+    }
+
+    if (!groupId) {
+      throw new Error(`Unable to resolve security group id for ${props.name}`);
+    }
+
+    if (props.tags && Object.keys(props.tags).length > 0) {
+      await client.send(
+        new CreateTagsCommand({
+          Resources: [groupId],
+          Tags: Object.entries(props.tags).map(([Key, Value]) => ({ Key, Value })),
+        }),
+      );
+    }
+
+    const ingressRules = props.ingress ?? [];
+    if (ingressRules.length > 0) {
+      try {
+        await client.send(
+          new AuthorizeSecurityGroupIngressCommand({
+            GroupId: groupId,
+            IpPermissions: ingressRules.map((rule) => ({
+              IpProtocol: rule.protocol,
+              FromPort: rule.fromPort,
+              ToPort: rule.toPort,
+              IpRanges: (rule.cidrBlocks ?? []).map((CidrIp) => ({
+                CidrIp,
+                Description: rule.description,
+              })),
+              Ipv6Ranges: (rule.ipv6CidrBlocks ?? []).map((CidrIpv6) => ({
+                CidrIpv6,
+                Description: rule.description,
+              })),
+              UserIdGroupPairs: (rule.securityGroupIds ?? []).map((GroupId) => ({
+                GroupId,
+                Description: rule.description,
+              })),
+            })),
+          }),
+        );
+      } catch (err: any) {
+        if (err.name !== "InvalidPermission.Duplicate") {
+          throw err;
+        }
+      }
+    }
+
+    const egressRules = props.egress ?? [];
+    if (egressRules.length > 0) {
+      try {
+        await client.send(
+          new AuthorizeSecurityGroupEgressCommand({
+            GroupId: groupId,
+            IpPermissions: egressRules.map((rule) => ({
+              IpProtocol: rule.protocol,
+              FromPort: rule.fromPort,
+              ToPort: rule.toPort,
+              IpRanges: (rule.cidrBlocks ?? []).map((CidrIp) => ({
+                CidrIp,
+                Description: rule.description,
+              })),
+              Ipv6Ranges: (rule.ipv6CidrBlocks ?? []).map((CidrIpv6) => ({
+                CidrIpv6,
+                Description: rule.description,
+              })),
+              UserIdGroupPairs: (rule.securityGroupIds ?? []).map((GroupId) => ({
+                GroupId,
+                Description: rule.description,
+              })),
+            })),
+          }),
+        );
+      } catch (err: any) {
+        if (err.name !== "InvalidPermission.Duplicate") {
+          throw err;
+        }
+      }
+    }
+
+    return {
+      groupId,
+      name: props.name,
+      adopted,
+    };
+  },
+);
diff --git a/packages/infra/src/stacks/env.ts b/packages/infra/src/stacks/env.ts
new file mode 100644
index 00000000..506dd3fe
--- /dev/null
+++ b/packages/infra/src/stacks/env.ts
@@ -0,0 +1,32 @@
+import type { AlchemyOptions, Phase } from "alchemy";
+import alchemy from "alchemy";
+import { CloudflareStateStore } from "alchemy/state";
+
+export const CLOUDFLARE_EMAIL = alchemy.env.CLOUDFLARE_EMAIL;
+
+export const CLOUDFLARE_ACCOUNT_ID = alchemy.env.CLOUDFLARE_ACCOUNT_ID;
+
+export const CLOUDFLARE_API_KEY = alchemy.secret.env.CLOUDFLARE_API_KEY;
+
+export const STRIPE_API_KEY = alchemy.secret.env.STRIPE_API_KEY;
+
+export const OPENAI_API_KEY = alchemy.secret.env.OPENAI_API_KEY;
+
+export const NEON_API_KEY = alchemy.secret.env.NEON_API_KEY;
+
+export const UPSTASH_API_KEY = alchemy.secret.env.UPSTASH_API_KEY;
+
+export default {
+  stage: process.env.BRANCH_PREFIX || "prod",
+  phase:
+    (process.env.ALCHEMY_PHASE as Phase) ??
+    (process.argv.includes("--destroy")
+      ? "destroy"
+      : process.argv.includes("--read")
+        ? "read"
+        : "up"),
+  // pass the password in (you can get it from anywhere, e.g. stdin)
+  password: process.env.SECRET_PASSPHRASE,
+  quiet: process.argv.includes("--quiet"),
+  stateStore: (scope) => new CloudflareStateStore(scope),
+} satisfies AlchemyOptions;
diff --git a/packages/infra/src/stacks/repo.run.ts b/packages/infra/src/stacks/repo.run.ts
new file mode 100644
index 00000000..84c3b88f
--- /dev/null
+++ b/packages/infra/src/stacks/repo.run.ts
@@ -0,0 +1,144 @@
+// ensure providers are registered (for deletion purposes)
+import "alchemy/aws";
+import "alchemy/aws/oidc";
+import "alchemy/cloudflare";
+import "alchemy/os";
+
+import alchemy from "alchemy";
+import { AccountId, Role, SSMParameter } from "alchemy/aws";
+import { GitHubOIDCProvider } from "alchemy/aws/oidc";
+import { AccountApiToken, R2Bucket } from "alchemy/cloudflare";
+import { GitHubSecret, RepositoryEnvironment } from "alchemy/github";
+import env, {
+  CLOUDFLARE_ACCOUNT_ID,
+  CLOUDFLARE_API_KEY,
+  CLOUDFLARE_EMAIL,
+  NEON_API_KEY,
+  OPENAI_API_KEY,
+  STRIPE_API_KEY,
+  UPSTASH_API_KEY,
+} from "./env.ts";
+
+const app = await alchemy("alchemy:repo", env);
+
+const awsAccountId = await AccountId();
+
+const githubRole = await Role("github-oidc-role", {
+  roleName: "alchemy-github-oidc-role",
+  assumeRolePolicy: {
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Sid: "GitHubOIDC",
+        Effect: "Allow",
+        Principal: {
+          Federated: `arn:aws:iam::${awsAccountId}:oidc-provider/token.actions.githubusercontent.com`,
+        },
+        Action: "sts:AssumeRoleWithWebIdentity",
+        Condition: {
+          StringEquals: {
+            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
+          },
+          StringLike: {
+            "token.actions.githubusercontent.com:sub":
+              "repo:alchemy-run/alchemy:*",
+          },
+        },
+      },
+    ],
+  },
+  // TODO: probably scope this down
+  managedPolicyArns: ["arn:aws:iam::aws:policy/AdministratorAccess"],
+});
+
+const stateStore = await R2Bucket("state-store", {
+  name: "alchemy-state-store",
+  adopt: true,
+});
+
+const testEnvironment = await RepositoryEnvironment("test environment", {
+  owner: "alchemy-run",
+  repository: "alchemy",
+  name: "test",
+  reviewers: {
+    users: ["alchemy-run"],
+  },
+});
+
+const accountAccessToken = await AccountApiToken("account-access-token", {
+  name: "alchemy-account-access-token",
+  policies: [
+    {
+      effect: "allow",
+      permissionGroups: ["Workers R2 Storage Write"],
+      resources: {
+        "com.cloudflare.api.account": "*",
+      },
+    },
+  ],
+});
+
+const secrets = {
+  AWS_ROLE_ARN: githubRole.arn,
+  CLOUDFLARE_ACCOUNT_ID,
+  CLOUDFLARE_API_KEY,
+  CLOUDFLARE_EMAIL,
+  STRIPE_API_KEY,
+  OPENAI_API_KEY,
+  NEON_API_KEY,
+  CLOUDFLARE_BUCKET_NAME: stateStore.name,
+  R2_ACCESS_KEY_ID: accountAccessToken.accessKeyId,
+  R2_SECRET_ACCESS_KEY: accountAccessToken.secretAccessKey,
+  SECRET_PASSPHRASE: alchemy.secret(process.env.SECRET_PASSPHRASE!),
+  UPSTASH_API_KEY,
+  UPSTASH_EMAIL: "sam@alchemy.run",
+  SENTRY_AUTH_TOKEN: alchemy.secret.env.SENTRY_AUTH_TOKEN,
+  SENTRY_ORG: alchemy.secret.env.SENTRY_ORG,
+  VERCEL_ACCESS_TOKEN: alchemy.secret.env.VERCEL_ACCESS_TOKEN,
+  ALCHEMY_PASSWORD: alchemy.secret.env.ALCHEMY_PASSWORD,
+  NPM_TOKEN: alchemy.secret.env.NPM_TOKEN,
+  ALCHEMY_STATE_TOKEN: alchemy.secret.env.ALCHEMY_STATE_TOKEN,
+  ANTHROPIC_API_KEY: alchemy.secret.env.ANTHROPIC_API_KEY,
+  PLANETSCALE_ORG_ID: alchemy.secret.env.PLANETSCALE_ORG_ID,
+  PLANETSCALE_API_TOKEN: alchemy.secret.env.PLANETSCALE_API_TOKEN,
+  SENTRY_DSN: alchemy.secret.env.SENTRY_DSN,
+};
+
+await Promise.all([
+  GitHubOIDCProvider("github-oidc", {
+    owner: "alchemy-run",
+    repository: "alchemy",
+    roleArn: githubRole.arn,
+  }),
+  SSMParameter("github-ci-secrets", {
+    name: "/alchemy/github-ci-secrets",
+    type: "SecureString",
+    value: alchemy.secret(
+      JSON.stringify(
+        Object.fromEntries(
+          Object.entries(secrets).map(([name, value]) => [
+            name,
+            typeof value === "string" ? value : value.unencrypted,
+          ]),
+        ),
+      ),
+    ),
+  }),
+  ...Object.entries(secrets).flatMap(async ([name, value]) => {
+    const props = {
+      owner: "alchemy-run",
+      repository: "alchemy",
+      name,
+      value: typeof value === "string" ? alchemy.secret(value) : value!,
+    };
+    return [
+      GitHubSecret(`github-secret-${name}`, {
+        ...props,
+        environment: testEnvironment.name,
+      }),
+      GitHubSecret(`github-repo-secret-${name}`, props),
+    ];
+  }),
+]);
+
+await app.finalize();
diff --git a/packages/infra/src/types.ts b/packages/infra/src/types.ts
new file mode 100644
index 00000000..1bca5863
--- /dev/null
+++ b/packages/infra/src/types.ts
@@ -0,0 +1,543 @@
+// Generated by stackpanel — do not edit manually.
+// TypeScript interfaces for infra module inputs.
+
+export interface AwsEc2AppInputs {
+  apps: {
+  docs: {
+  alb: {
+  certificateArn: any;
+  create: boolean;
+  enable: boolean;
+  existingListenerHttpArn: any;
+  existingListenerHttpsArn: any;
+  hostRulePriority: number;
+  hostnames: string[];
+  http: boolean;
+  https: boolean;
+  ipAddressType: string;
+  name: any;
+  scheme: string;
+  securityGroupIds: string[];
+  sslPolicy: string;
+  subnetIds: string[];
+  targetGroup: {
+  healthCheck: {
+  enabled: boolean;
+  healthyThreshold: number;
+  interval: number;
+  matcher: string;
+  path: string;
+  port: any;
+  protocol: string;
+  timeout: number;
+  unhealthyThreshold: number;
+};
+  port: number;
+  protocol: string;
+};
+};
+  ami: any;
+  associatePublicIp: boolean;
+  ecr: {
+  create: boolean;
+  enable: boolean;
+  github: {
+  allowTags: boolean;
+  allowedBranches: string[];
+  allowedWorkflows: string[];
+  createOidcProvider: boolean;
+  enable: boolean;
+  oidcProviderArn: any;
+  repoName: any;
+  repoOwner: any;
+  roleName: any;
+};
+  imageTagMutability: string;
+  lifecyclePolicy: any;
+  repoName: any;
+  scanOnPush: boolean;
+};
+  iam: {
+  assumeRolePolicy: any;
+  enable: boolean;
+  inlinePolicies: string[];
+  instanceProfileName: any;
+  instanceProfileTags: {
+
+};
+  managedPolicyArns: string[];
+  roleName: string;
+  tags: {
+
+};
+};
+  iamInstanceProfile: any;
+  instanceCount: number;
+  instanceType: string;
+  instances: string[];
+  keyName: any;
+  keyPair: {
+  create: boolean;
+  destroyOnDelete: boolean;
+  name: any;
+  publicKey: any;
+  tags: {
+
+};
+};
+  machine: {
+  arch: any;
+  roles: string[];
+  ssh: {
+  keyPath: any;
+  port: number;
+  user: string;
+};
+  tags: string[];
+  targetEnv: string;
+};
+  nixos: {
+  amiId: any;
+  flakeUrl: any;
+  flakeVersion: string;
+  hostConfig: any;
+};
+  osType: string;
+  rootVolumeSize: any;
+  securityGroup: {
+  create: boolean;
+  description: any;
+  egress: string[];
+  ingress: string[];
+  name: any;
+  tags: {
+
+};
+};
+  securityGroupIds: string[];
+  ssm: {
+  enable: boolean;
+  envFilePath: any;
+  installCli: boolean;
+  parameters: {
+
+};
+  pathPrefix: any;
+  refreshScriptPath: any;
+  region: any;
+  secureParameters: {
+
+};
+  useChamber: boolean;
+};
+  subnetIds: string[];
+  tags: {
+  managedBy: string;
+  name: string;
+};
+  userData: any;
+  vpcId: any;
+};
+  stackpanelStaging: {
+  alb: {
+  certificateArn: any;
+  create: boolean;
+  enable: boolean;
+  existingListenerHttpArn: any;
+  existingListenerHttpsArn: any;
+  hostRulePriority: number;
+  hostnames: string[];
+  http: boolean;
+  https: boolean;
+  ipAddressType: string;
+  name: any;
+  scheme: string;
+  securityGroupIds: string[];
+  sslPolicy: string;
+  subnetIds: string[];
+  targetGroup: {
+  healthCheck: {
+  enabled: boolean;
+  healthyThreshold: number;
+  interval: number;
+  matcher: string;
+  path: string;
+  port: any;
+  protocol: string;
+  timeout: number;
+  unhealthyThreshold: number;
+};
+  port: number;
+  protocol: string;
+};
+};
+  ami: any;
+  associatePublicIp: boolean;
+  ecr: {
+  create: boolean;
+  enable: boolean;
+  github: {
+  allowTags: boolean;
+  allowedBranches: string[];
+  allowedWorkflows: string[];
+  createOidcProvider: boolean;
+  enable: boolean;
+  oidcProviderArn: any;
+  repoName: any;
+  repoOwner: any;
+  roleName: any;
+};
+  imageTagMutability: string;
+  lifecyclePolicy: any;
+  repoName: any;
+  scanOnPush: boolean;
+};
+  iam: {
+  assumeRolePolicy: any;
+  enable: boolean;
+  inlinePolicies: string[];
+  instanceProfileName: any;
+  instanceProfileTags: {
+
+};
+  managedPolicyArns: string[];
+  roleName: string;
+  tags: {
+
+};
+};
+  iamInstanceProfile: any;
+  instanceCount: number;
+  instanceType: string;
+  instances: string[];
+  keyName: any;
+  keyPair: {
+  create: boolean;
+  destroyOnDelete: boolean;
+  name: string;
+  publicKey: string;
+  tags: {
+
+};
+};
+  machine: {
+  arch: any;
+  roles: string[];
+  ssh: {
+  keyPath: any;
+  port: number;
+  user: string;
+};
+  tags: string[];
+  targetEnv: string;
+};
+  nixos: {
+  amiId: any;
+  flakeUrl: any;
+  flakeVersion: string;
+  hostConfig: any;
+};
+  osType: string;
+  rootVolumeSize: any;
+  securityGroup: {
+  create: boolean;
+  description: any;
+  egress: string[];
+  ingress: string[];
+  name: any;
+  tags: {
+
+};
+};
+  securityGroupIds: string[];
+  ssm: {
+  enable: boolean;
+  envFilePath: any;
+  installCli: boolean;
+  parameters: {
+
+};
+  pathPrefix: any;
+  refreshScriptPath: any;
+  region: any;
+  secureParameters: {
+
+};
+  useChamber: boolean;
+};
+  subnetIds: string[];
+  tags: {
+  managedBy: string;
+  name: string;
+};
+  userData: any;
+  vpcId: any;
+};
+};
+  defaults: {
+  alb: {
+  certificateArn: any;
+  create: boolean;
+  enable: boolean;
+  existingListenerHttpArn: any;
+  existingListenerHttpsArn: any;
+  hostRulePriority: number;
+  hostnames: string[];
+  http: boolean;
+  https: boolean;
+  ipAddressType: string;
+  name: any;
+  scheme: string;
+  securityGroupIds: string[];
+  sslPolicy: string;
+  subnetIds: string[];
+  targetGroup: {
+  healthCheck: {
+  enabled: boolean;
+  healthyThreshold: number;
+  interval: number;
+  matcher: string;
+  path: string;
+  port: any;
+  protocol: string;
+  timeout: number;
+  unhealthyThreshold: number;
+};
+  port: number;
+  protocol: string;
+};
+};
+  ami: any;
+  associatePublicIp: boolean;
+  ecr: {
+  create: boolean;
+  enable: boolean;
+  github: {
+  allowTags: boolean;
+  allowedBranches: string[];
+  allowedWorkflows: string[];
+  createOidcProvider: boolean;
+  enable: boolean;
+  oidcProviderArn: any;
+  repoName: any;
+  repoOwner: any;
+  roleName: any;
+};
+  imageTagMutability: string;
+  lifecyclePolicy: any;
+  repoName: any;
+  scanOnPush: boolean;
+};
+  iam: {
+  assumeRolePolicy: any;
+  enable: boolean;
+  inlinePolicies: string[];
+  instanceProfileName: any;
+  instanceProfileTags: {
+
+};
+  managedPolicyArns: string[];
+  roleName: any;
+  tags: {
+
+};
+};
+  iamInstanceProfile: any;
+  instanceCount: number;
+  instanceType: any;
+  instances: string[];
+  keyName: any;
+  keyPair: {
+  create: boolean;
+  destroyOnDelete: boolean;
+  name: any;
+  publicKey: any;
+  tags: {
+
+};
+};
+  machine: {
+  arch: any;
+  roles: string[];
+  ssh: {
+  keyPath: any;
+  port: number;
+  user: string;
+};
+  tags: string[];
+  targetEnv: any;
+};
+  nixos: {
+  amiId: any;
+  flakeUrl: any;
+  flakeVersion: string;
+  hostConfig: any;
+};
+  osType: string;
+  rootVolumeSize: any;
+  securityGroup: {
+  create: boolean;
+  description: any;
+  egress: string[];
+  ingress: string[];
+  name: any;
+  tags: {
+
+};
+};
+  securityGroupIds: string[];
+  ssm: {
+  enable: boolean;
+  envFilePath: any;
+  installCli: boolean;
+  parameters: {
+
+};
+  pathPrefix: any;
+  refreshScriptPath: any;
+  region: any;
+  secureParameters: {
+
+};
+  useChamber: boolean;
+};
+  subnetIds: string[];
+  tags: {
+
+};
+  userData: any;
+  vpcId: any;
+};
+}
+
+export interface AwsSecretsInputs {
+  accountId: string;
+  iam: {
+  additionalPolicies: string[];
+  roleName: string;
+};
+  kms: {
+  alias: string;
+  deletionWindowDays: number;
+};
+  oidc: {
+  flyio: {
+  appName: string;
+  orgId: string;
+};
+  githubActions: {
+  branch: string;
+  org: string;
+  repo: string;
+};
+  provider: string;
+  rolesAnywhere: {
+  trustAnchorArn: string;
+};
+};
+  projectName: string;
+  region: string;
+  ssm: {
+  additionalPaths: string[];
+  enable: boolean;
+  groupPaths: string[];
+  keyPrefix: string;
+};
+}
+
+export interface DatabaseInputs {
+  devenv: {
+  database: string;
+  host: string;
+  password: string;
+  port: number;
+  user: string;
+};
+  docker: {
+  image: string;
+  network: string;
+  password: string;
+  port: number;
+  tag: string;
+  user: string;
+};
+  name: string;
+  neon: {
+  apiKeySsmPath: string;
+  enableBranching: boolean;
+  pgVersion: number;
+  region: string;
+};
+  projectName: string;
+  provider: string;
+  ssm: {
+  enable: boolean;
+  pathPrefix: string;
+};
+}
+
+export interface DeploymentInputs {
+  apps: {
+  docs: {
+  bindings: string[];
+  cloudflare: {
+  compatibility: string;
+  route: any;
+  workerName: string;
+};
+  framework: string;
+  host: string;
+  output: string;
+  path: string;
+  secrets: string[];
+};
+  web: {
+  bindings: string[];
+  cloudflare: {
+  compatibility: string;
+  route: any;
+  workerName: string;
+};
+  framework: string;
+  host: string;
+  path: string;
+  secrets: string[];
+};
+};
+  aws: {
+  artifact: {
+  bucket: any;
+  keyPrefix: string;
+};
+  instanceType: string;
+  port: number;
+  region: string;
+};
+  cloudflare: {
+  compatibilityDate: string;
+  defaultRoute: any;
+};
+}
+
+export interface MachinesInputs {
+  aws: {
+  envTagKeys: string[];
+  filters: string[];
+  hostPreference: string[];
+  instanceIds: string[];
+  nameTagKeys: string[];
+  region: string;
+  roleTagKeys: string[];
+  ssh: {
+  keyPath: any;
+  port: number;
+  user: string;
+};
+  tagKeys: string[];
+};
+  machines: {
+
+};
+  source: string;
+}
+
diff --git a/packages/infra/sst.config.ts b/packages/infra/sst.config.ts
new file mode 100644
index 00000000..06cd1d8f
--- /dev/null
+++ b/packages/infra/sst.config.ts
@@ -0,0 +1,211 @@
+/// <reference path="./.sst/platform/config.d.ts" />
+
+/**
+ * SST Configuration for Stackpanel Infrastructure
+ *
+ * This configures:
+ * 1. OIDC provider for GitHub Actions
+ * 2. IAM role for secrets access
+ * 3. KMS key for secrets encryption/decryption
+ *
+ * Generated by stackpanel - do not edit manually.
+ * Regenerate with: nix run .#generate
+ */
+
+// ===========================================================================
+// Interpolated values from Nix configuration
+// ===========================================================================
+const projectName = "stackpanel";
+const awsRegion = "us-west-2";
+
+export default $config({
+  app(input) {
+    return {
+      name: projectName,
+      removal: input?.stage === "production" ? "retain" : "remove",
+      protect: ["production"].includes(input?.stage ?? ""),
+      home: "aws",
+      providers: {
+        aws: {
+          region: awsRegion,
+        },
+      },
+    };
+  },
+
+  async run() {
+// syntax: ts
+// ========================================================================
+// GitHub Actions OIDC Provider
+// ========================================================================
+const githubOrg = "darkmatter";
+const githubRepo = "stackpanel";
+
+// Check if GitHub OIDC provider already exists (it's a singleton per account)
+const existingOidcArn = `arn:aws:iam::950224716579:oidc-provider/token.actions.githubusercontent.com`;
+
+// Use aws.iam.OpenIdConnectProvider.get to adopt existing provider
+// This avoids the "EntityAlreadyExists" error when the provider was created outside SST
+const githubOidcProvider = aws.iam.OpenIdConnectProvider.get("github-oidc", existingOidcArn);
+
+const oidcProviderArn = githubOidcProvider.arn;
+const oidcProviderUrl = "token.actions.githubusercontent.com";
+const oidcConditions = [
+  {
+    test: "StringEquals",
+    variable: `${oidcProviderUrl}:aud`,
+    values: ["sts.amazonaws.com"],
+  },
+  {
+    test: "StringLike",
+    variable: `${oidcProviderUrl}:sub`,
+    values: [`repo:${githubOrg}/${githubRepo}:*`],
+  },
+];
+
+// syntax: ts
+// ========================================================================
+// IAM Role for OIDC Authentication
+// ========================================================================
+const roleName = "stackpanel-secrets-role";
+
+const secretsRole = new aws.iam.Role(roleName, {
+  name: roleName,
+  assumeRolePolicy: aws.iam.getPolicyDocumentOutput({
+    statements: [{
+      effect: "Allow",
+      principals: [{
+        type: "Federated",
+        identifiers: [oidcProviderArn],
+      }],
+      actions: ["sts:AssumeRoleWithWebIdentity"],
+      conditions: oidcConditions,
+    }],
+  }).json,
+  tags: {
+    Name: roleName,
+    Environment: $app.stage,
+    ManagedBy: "sst",
+  },
+});
+
+// syntax: ts
+// ========================================================================
+// KMS Key for Secrets Encryption
+// ========================================================================
+const kmsAlias = "stackpanel-secrets";
+const kmsDeletionDays = 30;
+const awsAccountId = "950224716579";
+
+const secretsKey = new aws.kms.Key(kmsAlias, {
+  description: "KMS key for encrypting stackpanel secrets",
+  enableKeyRotation: true,
+  deletionWindowInDays: kmsDeletionDays,
+  policy: aws.iam.getPolicyDocumentOutput({
+    statements: [
+      // Allow root account full access
+      {
+        effect: "Allow",
+        principals: [{
+          type: "AWS",
+          identifiers: [`arn:aws:iam::${awsAccountId}:root`],
+        }],
+        actions: ["kms:*"],
+        resources: ["*"],
+      },
+      // Allow the secrets role to use the key
+      {
+        effect: "Allow",
+        principals: [{
+          type: "AWS",
+          identifiers: [secretsRole.arn],
+        }],
+        actions: [
+          "kms:Decrypt",
+          "kms:Encrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey",
+        ],
+        resources: ["*"],
+      },
+    ],
+  }).json,
+  tags: {
+    Name: kmsAlias,
+    Environment: $app.stage,
+    ManagedBy: "sst",
+  },
+});
+
+const secretsKeyAlias = new aws.kms.Alias(`${kmsAlias}-alias`, {
+  name: `alias/${kmsAlias}`,
+  targetKeyId: secretsKey.id,
+});
+
+// syntax: ts
+// ========================================================================
+// IAM Policy for KMS Access
+// ========================================================================
+new aws.iam.RolePolicy(`${roleName}-kms`, {
+  name: `${roleName}-kms-policy`,
+  role: secretsRole.id,
+  policy: aws.iam.getPolicyDocumentOutput({
+    statements: [
+      {
+        effect: "Allow",
+        actions: [
+          "kms:Decrypt",
+          "kms:Encrypt",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey",
+        ],
+        resources: [secretsKey.arn],
+      },
+      {
+        effect: "Allow",
+        actions: ["kms:Decrypt"],
+        resources: ["*"],
+        conditions: [
+          {
+            test: "StringLike",
+            variable: "kms:RequestAlias",
+            values: [`alias/${kmsAlias}`],
+          },
+        ],
+      },
+    ],
+  }).json,
+});
+
+    // ========================================================================
+    // Outputs
+    // ========================================================================
+    const providerType = "github-actions";
+    const providerDisplayName = "GitHub Actions";
+
+    return {
+      roleArn: secretsRole.arn,
+      roleName: secretsRole.name,
+      kmsKeyArn: secretsKey.arn,
+kmsKeyId: secretsKey.id,
+kmsKeyAlias: secretsKeyAlias.name,
+oidcProviderArn: githubOidcProvider.arn,
+provider: providerType,
+      setupInstructions: $interpolate`
+╔════════════════════════════════════════════════════════════════════╗
+║ Stackpanel Infrastructure Setup Complete                           ║
+╚════════════════════════════════════════════════════════════════════╝
+
+Role ARN: ${secretsRole.arn}
+KMS Key Alias: alias/${kmsAlias}
+
+Provider: ${providerDisplayName}
+
+To use this infrastructure:
+1. Configure your secrets with the KMS key
+2. Use the IAM role for decryption in your applications
+`,
+    };
+
+  },
+});
diff --git a/packages/infra/tsconfig.json b/packages/infra/tsconfig.json
new file mode 100644
index 00000000..d40fda1a
--- /dev/null
+++ b/packages/infra/tsconfig.json
@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "declaration": true,
+    "declarationMap": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "ES2022",
+    "moduleResolution": "bundler",
+    "outDir": "./dist",
+    "resolveJsonModule": true,
+    "rootDir": ".",
+    "skipLibCheck": true,
+    "strict": true,
+    "target": "ES2022"
+  },
+  "exclude": [
+    "node_modules",
+    "dist",
+    ".alchemy"
+  ],
+  "include": [
+    "src/**/*.ts",
+    "modules/**/*.ts",
+    "alchemy.run.ts"
+  ]
+}

From 290b761007d2d6bc63bb435f1c96354aee7b3eb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Pedro=20Bol=C3=ADvar=20Puente?= <raskolnikov@gnu.org>
Date: Tue, 31 Mar 2026 03:21:41 +0200
Subject: [PATCH 13/13] Fix bun module scripts

---
 nix/stackpanel/modules/bun/module.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nix/stackpanel/modules/bun/module.nix b/nix/stackpanel/modules/bun/module.nix
index 5d4f1e1f..0faea4f6 100644
--- a/nix/stackpanel/modules/bun/module.nix
+++ b/nix/stackpanel/modules/bun/module.nix
@@ -130,7 +130,7 @@
 
     # Runtime PATH for the generated wrapper script.
     # nodejs is always included so `node` is available when startScript uses it.
-    runtimePath = lib.makeBinPath ([pkgs.nodejs] ++ bunCfg.runtimeInputs);
+    runtimePath = lib.makeBinPath ([pkgs.nodejs pkgs.bun] ++ bunCfg.runtimeInputs);
 
     # Shell fragment that exports any statically-declared runtime env vars.
     # Interpolated directly into the wrapper heredoc by Nix.
@@ -231,13 +231,13 @@
         # Write a thin launcher that sets up the runtime environment and delegates
         # to startScript. Using a heredoc keeps the Nix string escaping clean;
         # ''${...} here is Nix interpolation (resolved at eval time, not at runtime).
-        cat > "$out/bin/${binaryName}" <<'WRAPPER'
+        cat > "$out/bin/${binaryName}" <<WRAPPER
         #!/usr/bin/env bash
         set -euo pipefail
         ${runtimeEnvExports}
         ${pathExport}
         cd "$out"
-        exec ${bunCfg.startScript} "$@"
+        exec ${bunCfg.startScript} "\$@"
         WRAPPER
         chmod +x "$out/bin/${binaryName}"