chore(ci): use Forgejo build and CDN publishing

Track v3.7 and patch releases for supported Traefik branches.
Set the stable Coolify v4 version to 4.1.2.

.agents/skills/configure-nightwatch/SKILL.md

@@ -0,0 +1,404 @@
+---
+name: configure-nightwatch
+description: Configures Laravel Nightwatch data collection, sampling rates, filtering rules, and redaction policies. Use when setting up Nightwatch, managing data volume, protecting sensitive data (PII), or optimizing event collection for production workloads.
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Nightwatch Configuration Guide
+
+This skill helps configure Laravel Nightwatch data collection to balance observability, performance, and privacy. Covers sampling strategies, filtering rules, and redaction methods across all event types.
+
+## Documentation Reference
+
+The [Nightwatch Documentation](https://nightwatch.laravel.com/docs) is the definitive and up-to-date source of information for all Nightwatch configuration options. This skill provides practical guidance and common patterns, but always consult the official documentation as the primary source of truth for specific details, environment variables, and API behavior. The documentation includes comprehensive coverage of:
+
+- [Filtering and Configuration](https://nightwatch.laravel.com/docs/filtering) - Core concepts for sampling, filtering, and redaction
+- Individual event type pages with specific configuration options:
+  - [Requests](https://nightwatch.laravel.com/docs/requests) - Request sampling, header handling, payload capture
+  - [Commands](https://nightwatch.laravel.com/docs/commands) - Command sampling and redaction
+  - [Queries](https://nightwatch.laravel.com/docs/queries) - Query filtering and redaction
+  - [Cache](https://nightwatch.laravel.com/docs/cache) - Cache event filtering by key or pattern
+  - [Jobs](https://nightwatch.laravel.com/docs/jobs) - Job filtering and sampling decoupling
+  - [Mail](https://nightwatch.laravel.com/docs/mail) - Mail event filtering
+  - [Notifications](https://nightwatch.laravel.com/docs/notifications) - Notification filtering by channel
+  - [Exceptions](https://nightwatch.laravel.com/docs/exceptions) - Exception sampling and throttling
+  - [Outgoing Requests](https://nightwatch.laravel.com/docs/outgoing-requests) - HTTP request filtering
+- [reference.md](reference.md) - Quick lookup table by event type, production presets, and verification checklist
+
+## Data Collection Flow
+
+Nightwatch processes events through three stages:
+
+1. **Sampling** - Controls which entry points are captured (requests, commands, scheduled tasks)
+2. **Filtering** - Excludes specific events after sampling (queries, cache, mail, etc.)
+3. **Redaction** - Modifies captured data to remove/obfuscate sensitive information
+
+```
+Request/Command/Scheduled Task
+       |
+       v
+   [Sampling?] ----NO----> Drop entire trace
+       | YES
+       v
+   Events generated
+       |
+       v
+   [Filtering?] ----YES---> Drop specific event
+       | NO
+       v
+   [Redaction] ----------> Store modified data
+```
+
+---
+
+## Sampling Configuration
+
+Sampling determines which entry points (requests, commands, scheduled tasks) trigger full trace collection. When an entry point is sampled, all related events are captured.
+
+### Global Sample Rates
+
+Configure via environment variables:
+
+```bash
+
+# Default: 100% sampling (all requests/commands captured)
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.1      # Recommended: 10% of requests
+
+NIGHTWATCH_COMMAND_SAMPLE_RATE=1.0      # Capture all commands
+
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0    # Always capture exceptions
+
+```
+
+**Recommendation**: Start with `0.1` (10%) for requests in production, adjust based on volume and needs.
+
+### Route-Based Sampling
+
+Apply different rates to specific routes using the `Sample` middleware:
+
+```php routes/web.php
+use Illuminate\Support\Facades\Route;
+use Laravel\Nightwatch\Http\Middleware\Sample;
+
+// Sample admin routes at 100%
+Route::middleware(Sample::rate(1.0))->prefix('admin')->group(function () {
+    // All admin routes sampled fully
+});
+
+// Sample API routes at 5%
+Route::middleware(Sample::rate(0.05))->prefix('api')->group(function () {
+    // API routes sampled sparingly
+});
+
+// Always sample critical endpoints
+Route::post('/checkout', [CheckoutController::class, 'process'])
+    ->middleware(Sample::always());
+
+// Never sample health checks
+Route::get('/health', [HealthController::class, 'check'])
+    ->middleware(Sample::never());
+```
+
+### Unmatched Route Sampling
+
+Handle 404/bot traffic with reduced sampling:
+
+```php routes/web.php
+Route::fallback(fn () => abort(404))
+    ->middleware(Sample::rate(0.01));  // 1% sampling for unmatched routes
+```
+
+### Dynamic Sampling
+
+Sample based on runtime conditions (user role, request attributes):
+
+```php app/Http/Middleware/SampleAdminRequests.php
+use Closure;
+use Illuminate\Http\Request;
+use Laravel\Nightwatch\Facades\Nightwatch;
+
+class SampleAdminRequests
+{
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user()?->isAdmin()) {
+            Nightwatch::sample();  // Always sample admin requests
+        }
+        return $next($request);
+    }
+}
+```
+
+### Command Sampling
+
+Exclude specific commands from sampling:
+
+```php AppServiceProvider.php
+use Illuminate\Console\Events\CommandStarting;
+use Illuminate\Support\Facades\Event;
+use Laravel\Nightwatch\Facades\Nightwatch;
+
+public function boot(): void
+{
+    Event::listen(function (CommandStarting $event) {
+        if (in_array($event->command, ['schedule:finish', 'horizon:snapshot'])) {
+            Nightwatch::dontSample();
+        }
+    });
+}
+```
+
+### Vendor Commands
+
+Nightwatch automatically ignores framework/internal commands. Opt-in to capture them:
+
+```php
+Nightwatch::captureDefaultVendorCommands();
+```
+
+---
+
+## Filtering Configuration
+
+Filtering excludes specific events from collection after sampling. Use filtering to reduce noise and quota usage.
+
+### Database Queries
+
+**Filter all queries** (disable query collection):
+
+```bash
+NIGHTWATCH_IGNORE_QUERIES=true
+```
+
+**Filter specific queries** by SQL pattern:
+
+```php AppServiceProvider.php
+use Laravel\Nightwatch\Facades\Nightwatch;
+use Laravel\Nightwatch\Records\Query;
+
+public function boot(): void
+{
+    // Filter job table queries (PostgreSQL)
+    Nightwatch::rejectQueries(function (Query $query) {
+        return str_contains($query->sql, 'into "jobs"');
+    });
+
+    // Filter cache table queries (MySQL)
+    Nightwatch::rejectQueries(function (Query $query) {
+        return str_contains($query->sql, 'from `cache`')
+            || str_contains($query->sql, 'into `cache`');
+    });
+}
+```
+
+### Cache Events
+
+**Filter all cache events**:
+
+```bash
+NIGHTWATCH_IGNORE_CACHE_EVENTS=true
+```
+
+**Filter by cache key patterns**:
+
+```php
+Nightwatch::rejectCacheKeys([
+    'my-app:users',                    // Exact match
+    '/^my-app:posts:/',                // Regex: starts with my-app:posts:
+    '/^[a-zA-Z0-9]{40}$/',             // Regex: session IDs
+]);
+```
+
+**Filter with callback**:
+
+```php
+use Laravel\Nightwatch\Records\CacheEvent;
+
+Nightwatch::rejectCacheEvents(function (CacheEvent $cacheEvent) {
+    return str_starts_with($cacheEvent->key, 'temp:');
+});
+```
+
+### Mail Events
+
+**Filter all mail**:
+
+```bash
+NIGHTWATCH_IGNORE_MAIL=true
+```
+
+**Filter specific mail**:
+
+```php
+use Laravel\Nightwatch\Records\Mail;
+
+Nightwatch::rejectMail(function (Mail $mail) {
+    return str_contains($mail->subject, 'Newsletter');
+});
+```
+
+### Notification Events
+
+**Filter all notifications**:
+
+```bash
+NIGHTWATCH_IGNORE_NOTIFICATIONS=true
+```
+
+**Filter by channel**:
+
+```php
+use Laravel\Nightwatch\Records\Notification;
+
+Nightwatch::rejectNotifications(function (Notification $notification) {
+    return $notification->channel === 'database';
+});
+```
+
+### Outgoing HTTP Requests
+
+**Filter all outgoing requests**:
+
+```bash
+NIGHTWATCH_IGNORE_OUTGOING_REQUESTS=true
+```
+
+**Filter by URL**:
+
+```php
+use Laravel\Nightwatch\Records\OutgoingRequest;
+
+Nightwatch::rejectOutgoingRequests(function (OutgoingRequest $request) {
+    return str_contains($request->url, 'analytics.example.com');
+});
+```
+
+### Queued Jobs
+
+**Filter specific jobs**:
+
+```php
+use Laravel\Nightwatch\Records\QueuedJob;
+
+Nightwatch::rejectQueuedJobs(function (QueuedJob $job) {
+    return $job->name === 'App\Jobs\LowPriorityJob';
+});
+```
+
+### Decoupling Job Sampling
+
+Sample jobs independently from parent contexts:
+
+```php
+use Illuminate\Support\Facades\Queue;
+
+public function boot(): void
+{
+    Queue::before(fn () => Nightwatch::sample(rate: 0.5));
+}
+```
+
+---
+
+## Redaction Configuration
+
+Redaction modifies captured data to remove or obfuscate sensitive information. Unlike filtering, redaction keeps the event but sanitizes its content.
+
+### Request Redaction
+
+**Redact sensitive headers** (automatically redacts: Authorization, Cookie, X-XSRF-TOKEN):
+
+```bash
+
+# Customize redacted headers
+
+NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-API-Key
+```
+
+**Redact request payloads** (disabled by default):
+
+```bash
+
+# Enable payload capture
+
+NIGHTWATCH_CAPTURE_REQUEST_PAYLOAD=true
+
+# Customize redacted fields
+
+NIGHTWATCH_REDACT_PAYLOAD_FIELDS=password,password_confirmation,ssn,credit_card
+```
+
+**Programmatic redaction**:
+
+```php
+use Laravel\Nightwatch\Facades\Nightwatch;
+use Laravel\Nightwatch\Records\Request;
+
+Nightwatch::redactRequests(function (Request $request) {
+    $request->url = str_replace('secret', '***', $request->url);
+    $request->ip = preg_replace('/\d+$/', '***', $request->ip);
+});
+```
+
+### Query Redaction
+
+```php
+use Laravel\Nightwatch\Records\Query;
+
+Nightwatch::redactQueries(function (Query $query) {
+    $query->sql = str_replace('secret_token', '***', $query->sql);
+});
+```
+
+### Cache Redaction
+
+```php
+use Laravel\Nightwatch\Records\CacheEvent;
+
+Nightwatch::redactCacheEvents(function (CacheEvent $cacheEvent) {
+    $cacheEvent->key = str_replace('user:', 'user:***:', $cacheEvent->key);
+});
+```
+
+### Command Redaction
+
+```php
+use Laravel\Nightwatch\Records\Command;
+
+Nightwatch::redactCommands(function (Command $command) {
+    $command->command = preg_replace('/--password=\S+/', '--password=***', $command->command);
+});
+```
+
+### Exception Redaction
+
+```php
+use Laravel\Nightwatch\Records\Exception;
+
+Nightwatch::redactExceptions(function (Exception $exception) {
+    $exception->message = str_replace('secret', '***', $exception->message);
+});
+```
+
+### Mail Redaction
+
+```php
+use Laravel\Nightwatch\Records\Mail;
+
+Nightwatch::redactMail(function (Mail $mail) {
+    $mail->subject = str_replace('Invoice #', 'Invoice ***', $mail->subject);
+});
+```
+
+### Outgoing Request Redaction
+
+```php
+use Laravel\Nightwatch\Records\OutgoingRequest;
+
+Nightwatch::redactOutgoingRequests(function (OutgoingRequest $outgoingRequest) {
+    $outgoingRequest->url = preg_replace('/api_key=\w+/', 'api_key=***', $outgoingRequest->url);
+});
+```

.agents/skills/configure-nightwatch/reference.md

@@ -0,0 +1,108 @@
+# Nightwatch Configuration Reference
+
+## Configuration Summary by Event Type
+
+| Event Type            | Sampling                                           | Filtering                                                                    | Redaction                 |
+| --------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------- |
+| **Requests**          | `NIGHTWATCH_REQUEST_SAMPLE_RATE`, Route middleware | Not applicable                                                               | Headers, payload, URL, IP |
+| **Commands**          | `NIGHTWATCH_COMMAND_SAMPLE_RATE`, Event listener   | Not applicable                                                               | Command arguments         |
+| **Queries**           | Parent context                                     | `rejectQueries()`, `NIGHTWATCH_IGNORE_QUERIES`                               | SQL statement             |
+| **Cache**             | Parent context                                     | `rejectCacheKeys()`, `rejectCacheEvents()`, `NIGHTWATCH_IGNORE_CACHE_EVENTS` | Cache key                 |
+| **Jobs**              | Parent context, Queue::before                      | `rejectQueuedJobs()`                                                         | Not applicable            |
+| **Mail**              | Parent context                                     | `rejectMail()`, `NIGHTWATCH_IGNORE_MAIL`                                     | Subject                   |
+| **Notifications**     | Parent context                                     | `rejectNotifications()`, `NIGHTWATCH_IGNORE_NOTIFICATIONS`                   | Not applicable            |
+| **Outgoing Requests** | Parent context                                     | `rejectOutgoingRequests()`, `NIGHTWATCH_IGNORE_OUTGOING_REQUESTS`            | URL                       |
+| **Exceptions**        | `NIGHTWATCH_EXCEPTION_SAMPLE_RATE`                 | Not applicable                                                               | Exception message         |
+
+---
+
+## Production Recommendations
+
+### High-Traffic Applications
+
+```bash
+
+# Conservative sampling
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.01          # 1% of requests
+
+NIGHTWATCH_COMMAND_SAMPLE_RATE=0.1           # 10% of commands
+
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0         # Always capture exceptions
+
+# Filter noisy events
+
+NIGHTWATCH_IGNORE_CACHE_EVENTS=true
+NIGHTWATCH_IGNORE_QUERIES=true               # Or filter specific queries programmatically
+
+```
+
+### Privacy-Conscious Applications
+
+```bash
+
+# Disable sensitive data collection
+
+NIGHTWATCH_CAPTURE_REQUEST_PAYLOAD=false
+NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-XSRF-TOKEN
+
+# Or use redaction in AppServiceProvider
+
+```
+
+### Balanced Configuration (Recommended Start)
+
+```bash
+
+# Sample rates
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.1
+NIGHTWATCH_COMMAND_SAMPLE_RATE=1.0
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0
+
+# Filter obvious noise programmatically
+
+# Redact PII as needed
+
+```
+
+---
+
+## Verification Checklist
+
+After configuration:
+
+- [ ] Sampling rates appropriate for traffic volume
+- [ ] Noisy events filtered (cache, certain queries)
+- [ ] Sensitive data redacted (PII, tokens, credentials)
+- [ ] Exceptions always captured for debugging
+- [ ] Test in development with `NIGHTWATCH_REQUEST_SAMPLE_RATE=1.0`
+- [ ] Monitor event quota usage in Nightwatch dashboard
+
+---
+
+## Common Patterns
+
+### Filter Health Checks + Reduce Sampling
+
+```php
+Route::get('/health', fn() => ['status' => 'ok'])
+    ->middleware(Sample::never());
+```
+
+### Exclude Internal/Vendor Queries
+
+```php
+Nightwatch::rejectQueries(fn($q) =>
+    str_contains($q->sql, 'telescope') ||
+    str_contains($q->sql, 'pulse')
+);
+```
+
+### Protect User Data in Cache Keys
+
+```php
+Nightwatch::redactCacheEvents(fn($e) =>
+    $e->key = preg_replace('/user:\d+/', 'user:***', $e->key)
+);
+```

.agents/skills/fortify-development/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fortify-development
-description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
+description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), passkeys, profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, passkeys, WebAuthn, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
 license: MIT
 metadata:
   author: laravel
@@ -32,6 +32,7 @@ ## Available Features
 - `Features::updateProfileInformation()` - Profile updates
 - `Features::updatePasswords()` - Password changes
 - `Features::twoFactorAuthentication()` - 2FA with QR codes and recovery codes
+- `Features::passkeys()` - Passwordless authentication with WebAuthn passkeys
 
 > Use `search-docs` for feature configuration options and customization patterns.
 
@@ -50,6 +51,18 @@ ### Two-Factor Authentication Setup
 
 > Use `search-docs` for TOTP implementation and recovery code handling patterns.
 
+### Passkeys Setup
+
+```
+- [ ] Add PasskeyAuthenticatable trait to User model and implement PasskeyUser
+- [ ] Enable passkeys feature in config/fortify.php
+- [ ] If the passkeys table migration is missing, publish via `php artisan vendor:publish --tag=fortify-migrations` and migrate
+- [ ] Configure passkeys relying_party_id, allowed_origins, user_handle_secret, and timeout if defaults are not suitable
+- [ ] Build UI with @laravel/passkeys for registration, login, confirmation, and deletion
+```
+
+> Use `search-docs` for passkey configuration options. For `@laravel/passkeys` frontend usage, refer to the package's README on npm.
+
 ### Email Verification Setup
 
 ```
@@ -129,3 +142,10 @@ ## Key Endpoints
 | 2FA Challenge          | POST     | `/two-factor-challenge`                     |
 | Get QR Code            | GET      | `/user/two-factor-qr-code`                  |
 | Recovery Codes         | GET/POST | `/user/two-factor-recovery-codes`           |
+| Passkey Login Options  | GET      | `/passkeys/login/options`                   |
+| Passkey Login          | POST     | `/passkeys/login`                           |
+| Passkey Confirm Options| GET      | `/passkeys/confirm/options`                 |
+| Passkey Confirm        | POST     | `/passkeys/confirm`                         |
+| Passkey Options        | GET      | `/user/passkeys/options`                    |
+| Register Passkey       | POST     | `/user/passkeys`                            |
+| Delete Passkey         | DELETE   | `/user/passkeys/{passkey}`                  |

.agents/skills/laravel-best-practices/SKILL.md

@@ -94,7 +94,7 @@ ### 8. Testing Patterns → `rules/testing.md`
 ### 9. Queue & Job Patterns → `rules/queue-jobs.md`
 
 - `retry_after` must exceed job `timeout`; use exponential backoff `[1, 5, 10]`
-- `ShouldBeUnique` to prevent duplicates; `WithoutOverlapping::untilProcessing()` for concurrency
+- `ShouldBeUnique` to prevent duplicates; `ShouldBeUniqueUntilProcessing` for early lock release
 - Always implement `failed()`; with `retryUntil()`, set `$tries = 0`
 - `RateLimited` middleware for external API calls; `Bus::batch()` for related jobs
 - Horizon for complex multi-queue scenarios

.agents/skills/laravel-best-practices/rules/architecture.md

@@ -82,7 +82,7 @@ ## Code to Interfaces
 
 ## Default Sort by Descending
 
-When no explicit order is specified, sort by `id` or `created_at` descending. Explicit ordering prevents cross-database inconsistencies between MySQL and Postgres.
+When no explicit order is specified, sort by `id` or `created_at` descending. Without an explicit `ORDER BY`, row order is undefined.
 
 Incorrect:
 ```php

.agents/skills/laravel-best-practices/rules/caching.md

@@ -2,7 +2,7 @@ # Caching Best Practices
 
 ## Use `Cache::remember()` Instead of Manual Get/Put
 
-Atomic pattern prevents race conditions and removes boilerplate.
+Cleaner cache-aside pattern that removes boilerplate. use `Cache::lock()` for race conditions.
 
 Incorrect:
 ```php

.agents/skills/laravel-best-practices/rules/config.md

@@ -2,7 +2,7 @@ # Configuration Best Practices
 
 ## `env()` Only in Config Files
 
-Direct `env()` calls return `null` when config is cached.
+Direct `env()` calls may return `null` when config is cached.
 
 Incorrect:
 ```php

.agents/skills/laravel-best-practices/rules/events-notifications.md

@@ -29,7 +29,11 @@ ## Always Queue Notifications
 
 ## Use `afterCommit()` on Notifications in Transactions
 
-Same race condition as events — the queued notification job may run before the transaction commits.
+Same race condition as events — call `afterCommit()` to delay dispatch until the transaction commits.
+
+```php
+$user->notify((new InvoicePaid($invoice))->afterCommit());
+```
 
 ## Route Notification Channels to Dedicated Queues
 

.agents/skills/laravel-best-practices/rules/http-client.md

@@ -52,7 +52,7 @@ ## Use Retry with Backoff for External APIs
 Only retry on specific errors:
 
 ```php
-$response = Http::retry(3, 100, function (Exception $exception, PendingRequest $request) {
+$response = Http::retry(3, 100, function (Throwable $exception, PendingRequest $request) {
     return $exception instanceof ConnectionException
         || ($exception instanceof RequestException && $exception->response->serverError());
 })->post('https://api.example.com/data');

.agents/skills/laravel-best-practices/rules/mail.md

@@ -10,7 +10,7 @@ ## Use `afterCommit()` on Mailables Inside Transactions
 
 ## Use `assertQueued()` Not `assertSent()` for Queued Mailables
 
-`Mail::assertSent()` only catches synchronous mail. Queued mailables silently pass `assertSent`, giving false confidence.
+`Mail::assertSent()` only catches synchronous mail. Queued mailables fail `assertSent` with a "Did you mean to use assertQueued()?" hint.
 
 Incorrect: `Mail::assertSent(OrderShipped::class);` when mailable implements `ShouldQueue`.
 

.agents/skills/laravel-best-practices/rules/queue-jobs.md

@@ -106,25 +106,23 @@ ## `retryUntil()` Needs `$tries = 0`
 ```php
 public $tries = 0;
 
-public function retryUntil(): DateTime
+public function retryUntil(): \DateTimeInterface
 {
     return now()->addHours(4);
 }
 ```
 
-## Use `WithoutOverlapping::untilProcessing()`
+## Use `ShouldBeUniqueUntilProcessing` for Early Lock Release
 
-Prevents concurrent execution while allowing new instances to queue.
+`ShouldBeUnique` holds the lock until the job completes. `ShouldBeUniqueUntilProcessing` releases it when processing starts, allowing new instances to queue.
 
 ```php
-public function middleware(): array
+class UpdateSearchIndex implements ShouldQueue, ShouldBeUniqueUntilProcessing
 {
-    return [new WithoutOverlapping($this->product->id)->untilProcessing()];
+    // Lock releases when processing begins, not when it finishes
 }
 ```
 
-Without `untilProcessing()`, the lock extends through queue wait time. With it, the lock releases when processing starts.
-
 ## Use Horizon for Complex Queue Scenarios
 
 Use Laravel Horizon when you need monitoring, auto-scaling, failure tracking, or multiple queues with different priorities.

.agents/skills/laravel-best-practices/rules/routing.md

@@ -36,7 +36,8 @@ ## Use Resource Controllers
 
 ```php
 Route::resource('posts', PostController::class);
-Route::apiResource('api/posts', Api\PostController::class);
+// In routes/api.php — the /api prefix is applied automatically
+Route::apiResource('posts', Api\PostController::class);
 ```
 
 ## Keep Controllers Thin

.agents/skills/laravel-best-practices/rules/security.md

@@ -32,7 +32,7 @@ ## Authorize Every Action
 
 Incorrect:
 ```php
-public function update(Request $request, Post $post)
+public function update(UpdatePostRequest $request, Post $post)
 {
     $post->update($request->validated());
 }
@@ -90,7 +90,7 @@ ## Escape Output to Prevent XSS
 
 ## CSRF Protection
 
-Include `@csrf` in all POST/PUT/DELETE Blade forms. Not needed in Inertia.
+Include `@csrf` in all POST/PUT/DELETE Blade forms. In Inertia apps, the `@csrf` directive is automatically applied.
 
 Incorrect:
 ```blade
@@ -121,7 +121,7 @@ ## Rate Limit Auth and API Routes
 
 ## Validate File Uploads
 
-Validate MIME type, extension, and size. Never trust client-provided filenames.
+Validate extension, MIME type, and size. The `mimes` rule checks extensions; use `mimetypes` for actual MIME type validation. Never trust client-provided filenames.
 
 ```php
 public function rules(): array

.agents/skills/laravel-best-practices/rules/testing.md

@@ -2,7 +2,7 @@ # Testing Best Practices
 
 ## Use `LazilyRefreshDatabase` Over `RefreshDatabase`
 
-`RefreshDatabase` runs all migrations every test run even when the schema hasn't changed. `LazilyRefreshDatabase` only migrates when needed, significantly speeding up large suites.
+`RefreshDatabase` migrates once per process and wraps each test in a rolled-back transaction. `LazilyRefreshDatabase` skips even that first migration if the schema is already up to date.
 
 ## Use Model Assertions Over Raw Database Assertions
 

.agents/skills/mcp-development/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: mcp-development
+description: "Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# MCP Development
+
+## Documentation
+
+Use `search-docs` for detailed Laravel MCP patterns and documentation.
+
+## Basic Usage
+
+Register MCP servers in `routes/ai.php`:
+
+<!-- Register MCP Server -->
+```php
+use Laravel\Mcp\Facades\Mcp;
+
+Mcp::web();
+```
+
+### Creating MCP Primitives
+
+Create MCP tools, resources, prompts, and servers using artisan commands:
+
+```bash
+php artisan make:mcp-tool ToolName        # Create a tool
+
+php artisan make:mcp-resource ResourceName # Create a resource
+
+php artisan make:mcp-prompt PromptName    # Create a prompt
+
+php artisan make:mcp-server ServerName    # Create a server
+
+```
+
+After creating primitives, register them in your server's `$tools`, `$resources`, or `$prompts` properties.
+
+### Tools
+
+<!-- MCP Tool Example -->
+```php
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Request;
+use Laravel\Mcp\Server\Response;
+
+class MyTool extends Tool
+{
+    public function handle(Request $request): Response
+    {
+        return new Response(['result' => 'success']);
+    }
+}
+```
+
+### Registering Primitives in a Server
+
+Each MCP server must explicitly declare the tools, resources, and prompts it exposes.
+
+<!-- Register Primitives in MCP Server -->
+```php
+use Laravel\Mcp\Server;
+
+class AppServer extends Server
+{
+    protected array $tools = [
+        \App\Mcp\Tools\MyTool::class,
+    ];
+
+    protected array $resources = [
+        \App\Mcp\Resources\MyResource::class,
+    ];
+
+    protected array $prompts = [
+        \App\Mcp\Prompts\MyPrompt::class,
+    ];
+}
+```
+
+## Verification
+
+1. Check `routes/ai.php` for proper registration
+2. Test tool via MCP client
+
+## Common Pitfalls
+
+- Running `mcp:start` command (it hangs waiting for input)
+- Using HTTPS locally with Node-based MCP clients
+- Not using `search-docs` for the latest MCP documentation
+- Not registering MCP server routes in `routes/ai.php`
+- Do not register `ai.php` in `bootstrap.php`; it is registered automatically.
+- OAuth registration supports custom URI schemes (e.g., `cursor://`, `vscode://`) for native desktop clients via `mcp.custom_schemes` config

.agents/skills/pest-testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pest-testing
-description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
+description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: test()/it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
 license: MIT
 metadata:
   author: laravel
@@ -18,6 +18,12 @@ ### Creating Tests
 
 All tests must be written using Pest. Use `php artisan make:test --pest {name}`.
 
+The `{name}` argument should include only the path and test name, but should not include the test suite.
+- Incorrect: `php artisan make:test --pest Feature/SomeFeatureTest` will generate `tests/Feature/Feature/SomeFeatureTest.php`
+- Correct: `php artisan make:test --pest SomeControllerTest` will generate `tests/Feature/SomeControllerTest.php`
+- Incorrect: `php artisan make:test --pest --unit Unit/SomeServiceTest` will generate `tests/Unit/Unit/SomeServiceTest.php`
+- Correct: `php artisan make:test --pest --unit SomeServiceTest` will generate `tests/Unit/SomeServiceTest.php`
+
 ### Test Organization
 
 - Unit/Feature tests: `tests/Feature` and `tests/Unit` directories.
@@ -26,6 +32,8 @@ ### Test Organization
 
 ### Basic Test Structure
 
+Pest supports both `test()` and `it()` functions. Before writing new tests, check existing test files in the same directory to match the project's convention. Use `test()` if existing tests use `test()`, or `it()` if they use `it()`.
+
 <!-- Basic Pest Test Example -->
 ```php
 it('is true', function () {
@@ -155,3 +163,4 @@ ## Common Pitfalls
 - Forgetting datasets for repetitive validation tests
 - Deleting tests without approval
 - Forgetting `assertNoJavaScriptErrors()` in browser tests
+- Prefixing `Feature/` or `Unit/` in `{name}` when using `make:test`

.claude/skills/configure-nightwatch/SKILL.md

@@ -0,0 +1,404 @@
+---
+name: configure-nightwatch
+description: Configures Laravel Nightwatch data collection, sampling rates, filtering rules, and redaction policies. Use when setting up Nightwatch, managing data volume, protecting sensitive data (PII), or optimizing event collection for production workloads.
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Nightwatch Configuration Guide
+
+This skill helps configure Laravel Nightwatch data collection to balance observability, performance, and privacy. Covers sampling strategies, filtering rules, and redaction methods across all event types.
+
+## Documentation Reference
+
+The [Nightwatch Documentation](https://nightwatch.laravel.com/docs) is the definitive and up-to-date source of information for all Nightwatch configuration options. This skill provides practical guidance and common patterns, but always consult the official documentation as the primary source of truth for specific details, environment variables, and API behavior. The documentation includes comprehensive coverage of:
+
+- [Filtering and Configuration](https://nightwatch.laravel.com/docs/filtering) - Core concepts for sampling, filtering, and redaction
+- Individual event type pages with specific configuration options:
+  - [Requests](https://nightwatch.laravel.com/docs/requests) - Request sampling, header handling, payload capture
+  - [Commands](https://nightwatch.laravel.com/docs/commands) - Command sampling and redaction
+  - [Queries](https://nightwatch.laravel.com/docs/queries) - Query filtering and redaction
+  - [Cache](https://nightwatch.laravel.com/docs/cache) - Cache event filtering by key or pattern
+  - [Jobs](https://nightwatch.laravel.com/docs/jobs) - Job filtering and sampling decoupling
+  - [Mail](https://nightwatch.laravel.com/docs/mail) - Mail event filtering
+  - [Notifications](https://nightwatch.laravel.com/docs/notifications) - Notification filtering by channel
+  - [Exceptions](https://nightwatch.laravel.com/docs/exceptions) - Exception sampling and throttling
+  - [Outgoing Requests](https://nightwatch.laravel.com/docs/outgoing-requests) - HTTP request filtering
+- [reference.md](reference.md) - Quick lookup table by event type, production presets, and verification checklist
+
+## Data Collection Flow
+
+Nightwatch processes events through three stages:
+
+1. **Sampling** - Controls which entry points are captured (requests, commands, scheduled tasks)
+2. **Filtering** - Excludes specific events after sampling (queries, cache, mail, etc.)
+3. **Redaction** - Modifies captured data to remove/obfuscate sensitive information
+
+```
+Request/Command/Scheduled Task
+       |
+       v
+   [Sampling?] ----NO----> Drop entire trace
+       | YES
+       v
+   Events generated
+       |
+       v
+   [Filtering?] ----YES---> Drop specific event
+       | NO
+       v
+   [Redaction] ----------> Store modified data
+```
+
+---
+
+## Sampling Configuration
+
+Sampling determines which entry points (requests, commands, scheduled tasks) trigger full trace collection. When an entry point is sampled, all related events are captured.
+
+### Global Sample Rates
+
+Configure via environment variables:
+
+```bash
+
+# Default: 100% sampling (all requests/commands captured)
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.1      # Recommended: 10% of requests
+
+NIGHTWATCH_COMMAND_SAMPLE_RATE=1.0      # Capture all commands
+
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0    # Always capture exceptions
+
+```
+
+**Recommendation**: Start with `0.1` (10%) for requests in production, adjust based on volume and needs.
+
+### Route-Based Sampling
+
+Apply different rates to specific routes using the `Sample` middleware:
+
+```php routes/web.php
+use Illuminate\Support\Facades\Route;
+use Laravel\Nightwatch\Http\Middleware\Sample;
+
+// Sample admin routes at 100%
+Route::middleware(Sample::rate(1.0))->prefix('admin')->group(function () {
+    // All admin routes sampled fully
+});
+
+// Sample API routes at 5%
+Route::middleware(Sample::rate(0.05))->prefix('api')->group(function () {
+    // API routes sampled sparingly
+});
+
+// Always sample critical endpoints
+Route::post('/checkout', [CheckoutController::class, 'process'])
+    ->middleware(Sample::always());
+
+// Never sample health checks
+Route::get('/health', [HealthController::class, 'check'])
+    ->middleware(Sample::never());
+```
+
+### Unmatched Route Sampling
+
+Handle 404/bot traffic with reduced sampling:
+
+```php routes/web.php
+Route::fallback(fn () => abort(404))
+    ->middleware(Sample::rate(0.01));  // 1% sampling for unmatched routes
+```
+
+### Dynamic Sampling
+
+Sample based on runtime conditions (user role, request attributes):
+
+```php app/Http/Middleware/SampleAdminRequests.php
+use Closure;
+use Illuminate\Http\Request;
+use Laravel\Nightwatch\Facades\Nightwatch;
+
+class SampleAdminRequests
+{
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user()?->isAdmin()) {
+            Nightwatch::sample();  // Always sample admin requests
+        }
+        return $next($request);
+    }
+}
+```
+
+### Command Sampling
+
+Exclude specific commands from sampling:
+
+```php AppServiceProvider.php
+use Illuminate\Console\Events\CommandStarting;
+use Illuminate\Support\Facades\Event;
+use Laravel\Nightwatch\Facades\Nightwatch;
+
+public function boot(): void
+{
+    Event::listen(function (CommandStarting $event) {
+        if (in_array($event->command, ['schedule:finish', 'horizon:snapshot'])) {
+            Nightwatch::dontSample();
+        }
+    });
+}
+```
+
+### Vendor Commands
+
+Nightwatch automatically ignores framework/internal commands. Opt-in to capture them:
+
+```php
+Nightwatch::captureDefaultVendorCommands();
+```
+
+---
+
+## Filtering Configuration
+
+Filtering excludes specific events from collection after sampling. Use filtering to reduce noise and quota usage.
+
+### Database Queries
+
+**Filter all queries** (disable query collection):
+
+```bash
+NIGHTWATCH_IGNORE_QUERIES=true
+```
+
+**Filter specific queries** by SQL pattern:
+
+```php AppServiceProvider.php
+use Laravel\Nightwatch\Facades\Nightwatch;
+use Laravel\Nightwatch\Records\Query;
+
+public function boot(): void
+{
+    // Filter job table queries (PostgreSQL)
+    Nightwatch::rejectQueries(function (Query $query) {
+        return str_contains($query->sql, 'into "jobs"');
+    });
+
+    // Filter cache table queries (MySQL)
+    Nightwatch::rejectQueries(function (Query $query) {
+        return str_contains($query->sql, 'from `cache`')
+            || str_contains($query->sql, 'into `cache`');
+    });
+}
+```
+
+### Cache Events
+
+**Filter all cache events**:
+
+```bash
+NIGHTWATCH_IGNORE_CACHE_EVENTS=true
+```
+
+**Filter by cache key patterns**:
+
+```php
+Nightwatch::rejectCacheKeys([
+    'my-app:users',                    // Exact match
+    '/^my-app:posts:/',                // Regex: starts with my-app:posts:
+    '/^[a-zA-Z0-9]{40}$/',             // Regex: session IDs
+]);
+```
+
+**Filter with callback**:
+
+```php
+use Laravel\Nightwatch\Records\CacheEvent;
+
+Nightwatch::rejectCacheEvents(function (CacheEvent $cacheEvent) {
+    return str_starts_with($cacheEvent->key, 'temp:');
+});
+```
+
+### Mail Events
+
+**Filter all mail**:
+
+```bash
+NIGHTWATCH_IGNORE_MAIL=true
+```
+
+**Filter specific mail**:
+
+```php
+use Laravel\Nightwatch\Records\Mail;
+
+Nightwatch::rejectMail(function (Mail $mail) {
+    return str_contains($mail->subject, 'Newsletter');
+});
+```
+
+### Notification Events
+
+**Filter all notifications**:
+
+```bash
+NIGHTWATCH_IGNORE_NOTIFICATIONS=true
+```
+
+**Filter by channel**:
+
+```php
+use Laravel\Nightwatch\Records\Notification;
+
+Nightwatch::rejectNotifications(function (Notification $notification) {
+    return $notification->channel === 'database';
+});
+```
+
+### Outgoing HTTP Requests
+
+**Filter all outgoing requests**:
+
+```bash
+NIGHTWATCH_IGNORE_OUTGOING_REQUESTS=true
+```
+
+**Filter by URL**:
+
+```php
+use Laravel\Nightwatch\Records\OutgoingRequest;
+
+Nightwatch::rejectOutgoingRequests(function (OutgoingRequest $request) {
+    return str_contains($request->url, 'analytics.example.com');
+});
+```
+
+### Queued Jobs
+
+**Filter specific jobs**:
+
+```php
+use Laravel\Nightwatch\Records\QueuedJob;
+
+Nightwatch::rejectQueuedJobs(function (QueuedJob $job) {
+    return $job->name === 'App\Jobs\LowPriorityJob';
+});
+```
+
+### Decoupling Job Sampling
+
+Sample jobs independently from parent contexts:
+
+```php
+use Illuminate\Support\Facades\Queue;
+
+public function boot(): void
+{
+    Queue::before(fn () => Nightwatch::sample(rate: 0.5));
+}
+```
+
+---
+
+## Redaction Configuration
+
+Redaction modifies captured data to remove or obfuscate sensitive information. Unlike filtering, redaction keeps the event but sanitizes its content.
+
+### Request Redaction
+
+**Redact sensitive headers** (automatically redacts: Authorization, Cookie, X-XSRF-TOKEN):
+
+```bash
+
+# Customize redacted headers
+
+NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-API-Key
+```
+
+**Redact request payloads** (disabled by default):
+
+```bash
+
+# Enable payload capture
+
+NIGHTWATCH_CAPTURE_REQUEST_PAYLOAD=true
+
+# Customize redacted fields
+
+NIGHTWATCH_REDACT_PAYLOAD_FIELDS=password,password_confirmation,ssn,credit_card
+```
+
+**Programmatic redaction**:
+
+```php
+use Laravel\Nightwatch\Facades\Nightwatch;
+use Laravel\Nightwatch\Records\Request;
+
+Nightwatch::redactRequests(function (Request $request) {
+    $request->url = str_replace('secret', '***', $request->url);
+    $request->ip = preg_replace('/\d+$/', '***', $request->ip);
+});
+```
+
+### Query Redaction
+
+```php
+use Laravel\Nightwatch\Records\Query;
+
+Nightwatch::redactQueries(function (Query $query) {
+    $query->sql = str_replace('secret_token', '***', $query->sql);
+});
+```
+
+### Cache Redaction
+
+```php
+use Laravel\Nightwatch\Records\CacheEvent;
+
+Nightwatch::redactCacheEvents(function (CacheEvent $cacheEvent) {
+    $cacheEvent->key = str_replace('user:', 'user:***:', $cacheEvent->key);
+});
+```
+
+### Command Redaction
+
+```php
+use Laravel\Nightwatch\Records\Command;
+
+Nightwatch::redactCommands(function (Command $command) {
+    $command->command = preg_replace('/--password=\S+/', '--password=***', $command->command);
+});
+```
+
+### Exception Redaction
+
+```php
+use Laravel\Nightwatch\Records\Exception;
+
+Nightwatch::redactExceptions(function (Exception $exception) {
+    $exception->message = str_replace('secret', '***', $exception->message);
+});
+```
+
+### Mail Redaction
+
+```php
+use Laravel\Nightwatch\Records\Mail;
+
+Nightwatch::redactMail(function (Mail $mail) {
+    $mail->subject = str_replace('Invoice #', 'Invoice ***', $mail->subject);
+});
+```
+
+### Outgoing Request Redaction
+
+```php
+use Laravel\Nightwatch\Records\OutgoingRequest;
+
+Nightwatch::redactOutgoingRequests(function (OutgoingRequest $outgoingRequest) {
+    $outgoingRequest->url = preg_replace('/api_key=\w+/', 'api_key=***', $outgoingRequest->url);
+});
+```

.claude/skills/configure-nightwatch/reference.md

@@ -0,0 +1,108 @@
+# Nightwatch Configuration Reference
+
+## Configuration Summary by Event Type
+
+| Event Type            | Sampling                                           | Filtering                                                                    | Redaction                 |
+| --------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------- |
+| **Requests**          | `NIGHTWATCH_REQUEST_SAMPLE_RATE`, Route middleware | Not applicable                                                               | Headers, payload, URL, IP |
+| **Commands**          | `NIGHTWATCH_COMMAND_SAMPLE_RATE`, Event listener   | Not applicable                                                               | Command arguments         |
+| **Queries**           | Parent context                                     | `rejectQueries()`, `NIGHTWATCH_IGNORE_QUERIES`                               | SQL statement             |
+| **Cache**             | Parent context                                     | `rejectCacheKeys()`, `rejectCacheEvents()`, `NIGHTWATCH_IGNORE_CACHE_EVENTS` | Cache key                 |
+| **Jobs**              | Parent context, Queue::before                      | `rejectQueuedJobs()`                                                         | Not applicable            |
+| **Mail**              | Parent context                                     | `rejectMail()`, `NIGHTWATCH_IGNORE_MAIL`                                     | Subject                   |
+| **Notifications**     | Parent context                                     | `rejectNotifications()`, `NIGHTWATCH_IGNORE_NOTIFICATIONS`                   | Not applicable            |
+| **Outgoing Requests** | Parent context                                     | `rejectOutgoingRequests()`, `NIGHTWATCH_IGNORE_OUTGOING_REQUESTS`            | URL                       |
+| **Exceptions**        | `NIGHTWATCH_EXCEPTION_SAMPLE_RATE`                 | Not applicable                                                               | Exception message         |
+
+---
+
+## Production Recommendations
+
+### High-Traffic Applications
+
+```bash
+
+# Conservative sampling
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.01          # 1% of requests
+
+NIGHTWATCH_COMMAND_SAMPLE_RATE=0.1           # 10% of commands
+
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0         # Always capture exceptions
+
+# Filter noisy events
+
+NIGHTWATCH_IGNORE_CACHE_EVENTS=true
+NIGHTWATCH_IGNORE_QUERIES=true               # Or filter specific queries programmatically
+
+```
+
+### Privacy-Conscious Applications
+
+```bash
+
+# Disable sensitive data collection
+
+NIGHTWATCH_CAPTURE_REQUEST_PAYLOAD=false
+NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-XSRF-TOKEN
+
+# Or use redaction in AppServiceProvider
+
+```
+
+### Balanced Configuration (Recommended Start)
+
+```bash
+
+# Sample rates
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.1
+NIGHTWATCH_COMMAND_SAMPLE_RATE=1.0
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0
+
+# Filter obvious noise programmatically
+
+# Redact PII as needed
+
+```
+
+---
+
+## Verification Checklist
+
+After configuration:
+
+- [ ] Sampling rates appropriate for traffic volume
+- [ ] Noisy events filtered (cache, certain queries)
+- [ ] Sensitive data redacted (PII, tokens, credentials)
+- [ ] Exceptions always captured for debugging
+- [ ] Test in development with `NIGHTWATCH_REQUEST_SAMPLE_RATE=1.0`
+- [ ] Monitor event quota usage in Nightwatch dashboard
+
+---
+
+## Common Patterns
+
+### Filter Health Checks + Reduce Sampling
+
+```php
+Route::get('/health', fn() => ['status' => 'ok'])
+    ->middleware(Sample::never());
+```
+
+### Exclude Internal/Vendor Queries
+
+```php
+Nightwatch::rejectQueries(fn($q) =>
+    str_contains($q->sql, 'telescope') ||
+    str_contains($q->sql, 'pulse')
+);
+```
+
+### Protect User Data in Cache Keys
+
+```php
+Nightwatch::redactCacheEvents(fn($e) =>
+    $e->key = preg_replace('/user:\d+/', 'user:***', $e->key)
+);
+```

.claude/skills/fortify-development/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fortify-development
-description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
+description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), passkeys, profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, passkeys, WebAuthn, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
 license: MIT
 metadata:
   author: laravel
@@ -32,6 +32,7 @@ ## Available Features
 - `Features::updateProfileInformation()` - Profile updates
 - `Features::updatePasswords()` - Password changes
 - `Features::twoFactorAuthentication()` - 2FA with QR codes and recovery codes
+- `Features::passkeys()` - Passwordless authentication with WebAuthn passkeys
 
 > Use `search-docs` for feature configuration options and customization patterns.
 
@@ -50,6 +51,18 @@ ### Two-Factor Authentication Setup
 
 > Use `search-docs` for TOTP implementation and recovery code handling patterns.
 
+### Passkeys Setup
+
+```
+- [ ] Add PasskeyAuthenticatable trait to User model and implement PasskeyUser
+- [ ] Enable passkeys feature in config/fortify.php
+- [ ] If the passkeys table migration is missing, publish via `php artisan vendor:publish --tag=fortify-migrations` and migrate
+- [ ] Configure passkeys relying_party_id, allowed_origins, user_handle_secret, and timeout if defaults are not suitable
+- [ ] Build UI with @laravel/passkeys for registration, login, confirmation, and deletion
+```
+
+> Use `search-docs` for passkey configuration options. For `@laravel/passkeys` frontend usage, refer to the package's README on npm.
+
 ### Email Verification Setup
 
 ```
@@ -129,3 +142,10 @@ ## Key Endpoints
 | 2FA Challenge          | POST     | `/two-factor-challenge`                     |
 | Get QR Code            | GET      | `/user/two-factor-qr-code`                  |
 | Recovery Codes         | GET/POST | `/user/two-factor-recovery-codes`           |
+| Passkey Login Options  | GET      | `/passkeys/login/options`                   |
+| Passkey Login          | POST     | `/passkeys/login`                           |
+| Passkey Confirm Options| GET      | `/passkeys/confirm/options`                 |
+| Passkey Confirm        | POST     | `/passkeys/confirm`                         |
+| Passkey Options        | GET      | `/user/passkeys/options`                    |
+| Register Passkey       | POST     | `/user/passkeys`                            |
+| Delete Passkey         | DELETE   | `/user/passkeys/{passkey}`                  |

.claude/skills/laravel-best-practices/SKILL.md

@@ -94,7 +94,7 @@ ### 8. Testing Patterns → `rules/testing.md`
 ### 9. Queue & Job Patterns → `rules/queue-jobs.md`
 
 - `retry_after` must exceed job `timeout`; use exponential backoff `[1, 5, 10]`
-- `ShouldBeUnique` to prevent duplicates; `WithoutOverlapping::untilProcessing()` for concurrency
+- `ShouldBeUnique` to prevent duplicates; `ShouldBeUniqueUntilProcessing` for early lock release
 - Always implement `failed()`; with `retryUntil()`, set `$tries = 0`
 - `RateLimited` middleware for external API calls; `Bus::batch()` for related jobs
 - Horizon for complex multi-queue scenarios

.claude/skills/laravel-best-practices/rules/architecture.md

@@ -82,7 +82,7 @@ ## Code to Interfaces
 
 ## Default Sort by Descending
 
-When no explicit order is specified, sort by `id` or `created_at` descending. Explicit ordering prevents cross-database inconsistencies between MySQL and Postgres.
+When no explicit order is specified, sort by `id` or `created_at` descending. Without an explicit `ORDER BY`, row order is undefined.
 
 Incorrect:
 ```php

.claude/skills/laravel-best-practices/rules/caching.md

@@ -2,7 +2,7 @@ # Caching Best Practices
 
 ## Use `Cache::remember()` Instead of Manual Get/Put
 
-Atomic pattern prevents race conditions and removes boilerplate.
+Cleaner cache-aside pattern that removes boilerplate. use `Cache::lock()` for race conditions.
 
 Incorrect:
 ```php

.claude/skills/laravel-best-practices/rules/config.md

@@ -2,7 +2,7 @@ # Configuration Best Practices
 
 ## `env()` Only in Config Files
 
-Direct `env()` calls return `null` when config is cached.
+Direct `env()` calls may return `null` when config is cached.
 
 Incorrect:
 ```php

.claude/skills/laravel-best-practices/rules/events-notifications.md

@@ -29,7 +29,11 @@ ## Always Queue Notifications
 
 ## Use `afterCommit()` on Notifications in Transactions
 
-Same race condition as events — the queued notification job may run before the transaction commits.
+Same race condition as events — call `afterCommit()` to delay dispatch until the transaction commits.
+
+```php
+$user->notify((new InvoicePaid($invoice))->afterCommit());
+```
 
 ## Route Notification Channels to Dedicated Queues
 

.claude/skills/laravel-best-practices/rules/http-client.md

@@ -52,7 +52,7 @@ ## Use Retry with Backoff for External APIs
 Only retry on specific errors:
 
 ```php
-$response = Http::retry(3, 100, function (Exception $exception, PendingRequest $request) {
+$response = Http::retry(3, 100, function (Throwable $exception, PendingRequest $request) {
     return $exception instanceof ConnectionException
         || ($exception instanceof RequestException && $exception->response->serverError());
 })->post('https://api.example.com/data');

.claude/skills/laravel-best-practices/rules/mail.md

@@ -10,7 +10,7 @@ ## Use `afterCommit()` on Mailables Inside Transactions
 
 ## Use `assertQueued()` Not `assertSent()` for Queued Mailables
 
-`Mail::assertSent()` only catches synchronous mail. Queued mailables silently pass `assertSent`, giving false confidence.
+`Mail::assertSent()` only catches synchronous mail. Queued mailables fail `assertSent` with a "Did you mean to use assertQueued()?" hint.
 
 Incorrect: `Mail::assertSent(OrderShipped::class);` when mailable implements `ShouldQueue`.
 

.claude/skills/laravel-best-practices/rules/queue-jobs.md

@@ -106,25 +106,23 @@ ## `retryUntil()` Needs `$tries = 0`
 ```php
 public $tries = 0;
 
-public function retryUntil(): DateTime
+public function retryUntil(): \DateTimeInterface
 {
     return now()->addHours(4);
 }
 ```
 
-## Use `WithoutOverlapping::untilProcessing()`
+## Use `ShouldBeUniqueUntilProcessing` for Early Lock Release
 
-Prevents concurrent execution while allowing new instances to queue.
+`ShouldBeUnique` holds the lock until the job completes. `ShouldBeUniqueUntilProcessing` releases it when processing starts, allowing new instances to queue.
 
 ```php
-public function middleware(): array
+class UpdateSearchIndex implements ShouldQueue, ShouldBeUniqueUntilProcessing
 {
-    return [new WithoutOverlapping($this->product->id)->untilProcessing()];
+    // Lock releases when processing begins, not when it finishes
 }
 ```
 
-Without `untilProcessing()`, the lock extends through queue wait time. With it, the lock releases when processing starts.
-
 ## Use Horizon for Complex Queue Scenarios
 
 Use Laravel Horizon when you need monitoring, auto-scaling, failure tracking, or multiple queues with different priorities.

.claude/skills/laravel-best-practices/rules/routing.md

@@ -36,7 +36,8 @@ ## Use Resource Controllers
 
 ```php
 Route::resource('posts', PostController::class);
-Route::apiResource('api/posts', Api\PostController::class);
+// In routes/api.php — the /api prefix is applied automatically
+Route::apiResource('posts', Api\PostController::class);
 ```
 
 ## Keep Controllers Thin

.claude/skills/laravel-best-practices/rules/security.md

@@ -32,7 +32,7 @@ ## Authorize Every Action
 
 Incorrect:
 ```php
-public function update(Request $request, Post $post)
+public function update(UpdatePostRequest $request, Post $post)
 {
     $post->update($request->validated());
 }
@@ -90,7 +90,7 @@ ## Escape Output to Prevent XSS
 
 ## CSRF Protection
 
-Include `@csrf` in all POST/PUT/DELETE Blade forms. Not needed in Inertia.
+Include `@csrf` in all POST/PUT/DELETE Blade forms. In Inertia apps, the `@csrf` directive is automatically applied.
 
 Incorrect:
 ```blade
@@ -121,7 +121,7 @@ ## Rate Limit Auth and API Routes
 
 ## Validate File Uploads
 
-Validate MIME type, extension, and size. Never trust client-provided filenames.
+Validate extension, MIME type, and size. The `mimes` rule checks extensions; use `mimetypes` for actual MIME type validation. Never trust client-provided filenames.
 
 ```php
 public function rules(): array

.claude/skills/laravel-best-practices/rules/testing.md

@@ -2,7 +2,7 @@ # Testing Best Practices
 
 ## Use `LazilyRefreshDatabase` Over `RefreshDatabase`
 
-`RefreshDatabase` runs all migrations every test run even when the schema hasn't changed. `LazilyRefreshDatabase` only migrates when needed, significantly speeding up large suites.
+`RefreshDatabase` migrates once per process and wraps each test in a rolled-back transaction. `LazilyRefreshDatabase` skips even that first migration if the schema is already up to date.
 
 ## Use Model Assertions Over Raw Database Assertions
 

.claude/skills/mcp-development/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: mcp-development
+description: "Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# MCP Development
+
+## Documentation
+
+Use `search-docs` for detailed Laravel MCP patterns and documentation.
+
+## Basic Usage
+
+Register MCP servers in `routes/ai.php`:
+
+<!-- Register MCP Server -->
+```php
+use Laravel\Mcp\Facades\Mcp;
+
+Mcp::web();
+```
+
+### Creating MCP Primitives
+
+Create MCP tools, resources, prompts, and servers using artisan commands:
+
+```bash
+php artisan make:mcp-tool ToolName        # Create a tool
+
+php artisan make:mcp-resource ResourceName # Create a resource
+
+php artisan make:mcp-prompt PromptName    # Create a prompt
+
+php artisan make:mcp-server ServerName    # Create a server
+
+```
+
+After creating primitives, register them in your server's `$tools`, `$resources`, or `$prompts` properties.
+
+### Tools
+
+<!-- MCP Tool Example -->
+```php
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Request;
+use Laravel\Mcp\Server\Response;
+
+class MyTool extends Tool
+{
+    public function handle(Request $request): Response
+    {
+        return new Response(['result' => 'success']);
+    }
+}
+```
+
+### Registering Primitives in a Server
+
+Each MCP server must explicitly declare the tools, resources, and prompts it exposes.
+
+<!-- Register Primitives in MCP Server -->
+```php
+use Laravel\Mcp\Server;
+
+class AppServer extends Server
+{
+    protected array $tools = [
+        \App\Mcp\Tools\MyTool::class,
+    ];
+
+    protected array $resources = [
+        \App\Mcp\Resources\MyResource::class,
+    ];
+
+    protected array $prompts = [
+        \App\Mcp\Prompts\MyPrompt::class,
+    ];
+}
+```
+
+## Verification
+
+1. Check `routes/ai.php` for proper registration
+2. Test tool via MCP client
+
+## Common Pitfalls
+
+- Running `mcp:start` command (it hangs waiting for input)
+- Using HTTPS locally with Node-based MCP clients
+- Not using `search-docs` for the latest MCP documentation
+- Not registering MCP server routes in `routes/ai.php`
+- Do not register `ai.php` in `bootstrap.php`; it is registered automatically.
+- OAuth registration supports custom URI schemes (e.g., `cursor://`, `vscode://`) for native desktop clients via `mcp.custom_schemes` config

.claude/skills/pest-testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pest-testing
-description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
+description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: test()/it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
 license: MIT
 metadata:
   author: laravel
@@ -18,6 +18,12 @@ ### Creating Tests
 
 All tests must be written using Pest. Use `php artisan make:test --pest {name}`.
 
+The `{name}` argument should include only the path and test name, but should not include the test suite.
+- Incorrect: `php artisan make:test --pest Feature/SomeFeatureTest` will generate `tests/Feature/Feature/SomeFeatureTest.php`
+- Correct: `php artisan make:test --pest SomeControllerTest` will generate `tests/Feature/SomeControllerTest.php`
+- Incorrect: `php artisan make:test --pest --unit Unit/SomeServiceTest` will generate `tests/Unit/Unit/SomeServiceTest.php`
+- Correct: `php artisan make:test --pest --unit SomeServiceTest` will generate `tests/Unit/SomeServiceTest.php`
+
 ### Test Organization
 
 - Unit/Feature tests: `tests/Feature` and `tests/Unit` directories.
@@ -26,6 +32,8 @@ ### Test Organization
 
 ### Basic Test Structure
 
+Pest supports both `test()` and `it()` functions. Before writing new tests, check existing test files in the same directory to match the project's convention. Use `test()` if existing tests use `test()`, or `it()` if they use `it()`.
+
 <!-- Basic Pest Test Example -->
 ```php
 it('is true', function () {
@@ -155,3 +163,4 @@ ## Common Pitfalls
 - Forgetting datasets for repetitive validation tests
 - Deleting tests without approval
 - Forgetting `assertNoJavaScriptErrors()` in browser tests
+- Prefixing `Feature/` or `Unit/` in `{name}` when using `make:test`

.cursor/skills/configure-nightwatch/SKILL.md

@@ -0,0 +1,404 @@
+---
+name: configure-nightwatch
+description: Configures Laravel Nightwatch data collection, sampling rates, filtering rules, and redaction policies. Use when setting up Nightwatch, managing data volume, protecting sensitive data (PII), or optimizing event collection for production workloads.
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Nightwatch Configuration Guide
+
+This skill helps configure Laravel Nightwatch data collection to balance observability, performance, and privacy. Covers sampling strategies, filtering rules, and redaction methods across all event types.
+
+## Documentation Reference
+
+The [Nightwatch Documentation](https://nightwatch.laravel.com/docs) is the definitive and up-to-date source of information for all Nightwatch configuration options. This skill provides practical guidance and common patterns, but always consult the official documentation as the primary source of truth for specific details, environment variables, and API behavior. The documentation includes comprehensive coverage of:
+
+- [Filtering and Configuration](https://nightwatch.laravel.com/docs/filtering) - Core concepts for sampling, filtering, and redaction
+- Individual event type pages with specific configuration options:
+  - [Requests](https://nightwatch.laravel.com/docs/requests) - Request sampling, header handling, payload capture
+  - [Commands](https://nightwatch.laravel.com/docs/commands) - Command sampling and redaction
+  - [Queries](https://nightwatch.laravel.com/docs/queries) - Query filtering and redaction
+  - [Cache](https://nightwatch.laravel.com/docs/cache) - Cache event filtering by key or pattern
+  - [Jobs](https://nightwatch.laravel.com/docs/jobs) - Job filtering and sampling decoupling
+  - [Mail](https://nightwatch.laravel.com/docs/mail) - Mail event filtering
+  - [Notifications](https://nightwatch.laravel.com/docs/notifications) - Notification filtering by channel
+  - [Exceptions](https://nightwatch.laravel.com/docs/exceptions) - Exception sampling and throttling
+  - [Outgoing Requests](https://nightwatch.laravel.com/docs/outgoing-requests) - HTTP request filtering
+- [reference.md](reference.md) - Quick lookup table by event type, production presets, and verification checklist
+
+## Data Collection Flow
+
+Nightwatch processes events through three stages:
+
+1. **Sampling** - Controls which entry points are captured (requests, commands, scheduled tasks)
+2. **Filtering** - Excludes specific events after sampling (queries, cache, mail, etc.)
+3. **Redaction** - Modifies captured data to remove/obfuscate sensitive information
+
+```
+Request/Command/Scheduled Task
+       |
+       v
+   [Sampling?] ----NO----> Drop entire trace
+       | YES
+       v
+   Events generated
+       |
+       v
+   [Filtering?] ----YES---> Drop specific event
+       | NO
+       v
+   [Redaction] ----------> Store modified data
+```
+
+---
+
+## Sampling Configuration
+
+Sampling determines which entry points (requests, commands, scheduled tasks) trigger full trace collection. When an entry point is sampled, all related events are captured.
+
+### Global Sample Rates
+
+Configure via environment variables:
+
+```bash
+
+# Default: 100% sampling (all requests/commands captured)
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.1      # Recommended: 10% of requests
+
+NIGHTWATCH_COMMAND_SAMPLE_RATE=1.0      # Capture all commands
+
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0    # Always capture exceptions
+
+```
+
+**Recommendation**: Start with `0.1` (10%) for requests in production, adjust based on volume and needs.
+
+### Route-Based Sampling
+
+Apply different rates to specific routes using the `Sample` middleware:
+
+```php routes/web.php
+use Illuminate\Support\Facades\Route;
+use Laravel\Nightwatch\Http\Middleware\Sample;
+
+// Sample admin routes at 100%
+Route::middleware(Sample::rate(1.0))->prefix('admin')->group(function () {
+    // All admin routes sampled fully
+});
+
+// Sample API routes at 5%
+Route::middleware(Sample::rate(0.05))->prefix('api')->group(function () {
+    // API routes sampled sparingly
+});
+
+// Always sample critical endpoints
+Route::post('/checkout', [CheckoutController::class, 'process'])
+    ->middleware(Sample::always());
+
+// Never sample health checks
+Route::get('/health', [HealthController::class, 'check'])
+    ->middleware(Sample::never());
+```
+
+### Unmatched Route Sampling
+
+Handle 404/bot traffic with reduced sampling:
+
+```php routes/web.php
+Route::fallback(fn () => abort(404))
+    ->middleware(Sample::rate(0.01));  // 1% sampling for unmatched routes
+```
+
+### Dynamic Sampling
+
+Sample based on runtime conditions (user role, request attributes):
+
+```php app/Http/Middleware/SampleAdminRequests.php
+use Closure;
+use Illuminate\Http\Request;
+use Laravel\Nightwatch\Facades\Nightwatch;
+
+class SampleAdminRequests
+{
+    public function handle(Request $request, Closure $next)
+    {
+        if ($request->user()?->isAdmin()) {
+            Nightwatch::sample();  // Always sample admin requests
+        }
+        return $next($request);
+    }
+}
+```
+
+### Command Sampling
+
+Exclude specific commands from sampling:
+
+```php AppServiceProvider.php
+use Illuminate\Console\Events\CommandStarting;
+use Illuminate\Support\Facades\Event;
+use Laravel\Nightwatch\Facades\Nightwatch;
+
+public function boot(): void
+{
+    Event::listen(function (CommandStarting $event) {
+        if (in_array($event->command, ['schedule:finish', 'horizon:snapshot'])) {
+            Nightwatch::dontSample();
+        }
+    });
+}
+```
+
+### Vendor Commands
+
+Nightwatch automatically ignores framework/internal commands. Opt-in to capture them:
+
+```php
+Nightwatch::captureDefaultVendorCommands();
+```
+
+---
+
+## Filtering Configuration
+
+Filtering excludes specific events from collection after sampling. Use filtering to reduce noise and quota usage.
+
+### Database Queries
+
+**Filter all queries** (disable query collection):
+
+```bash
+NIGHTWATCH_IGNORE_QUERIES=true
+```
+
+**Filter specific queries** by SQL pattern:
+
+```php AppServiceProvider.php
+use Laravel\Nightwatch\Facades\Nightwatch;
+use Laravel\Nightwatch\Records\Query;
+
+public function boot(): void
+{
+    // Filter job table queries (PostgreSQL)
+    Nightwatch::rejectQueries(function (Query $query) {
+        return str_contains($query->sql, 'into "jobs"');
+    });
+
+    // Filter cache table queries (MySQL)
+    Nightwatch::rejectQueries(function (Query $query) {
+        return str_contains($query->sql, 'from `cache`')
+            || str_contains($query->sql, 'into `cache`');
+    });
+}
+```
+
+### Cache Events
+
+**Filter all cache events**:
+
+```bash
+NIGHTWATCH_IGNORE_CACHE_EVENTS=true
+```
+
+**Filter by cache key patterns**:
+
+```php
+Nightwatch::rejectCacheKeys([
+    'my-app:users',                    // Exact match
+    '/^my-app:posts:/',                // Regex: starts with my-app:posts:
+    '/^[a-zA-Z0-9]{40}$/',             // Regex: session IDs
+]);
+```
+
+**Filter with callback**:
+
+```php
+use Laravel\Nightwatch\Records\CacheEvent;
+
+Nightwatch::rejectCacheEvents(function (CacheEvent $cacheEvent) {
+    return str_starts_with($cacheEvent->key, 'temp:');
+});
+```
+
+### Mail Events
+
+**Filter all mail**:
+
+```bash
+NIGHTWATCH_IGNORE_MAIL=true
+```
+
+**Filter specific mail**:
+
+```php
+use Laravel\Nightwatch\Records\Mail;
+
+Nightwatch::rejectMail(function (Mail $mail) {
+    return str_contains($mail->subject, 'Newsletter');
+});
+```
+
+### Notification Events
+
+**Filter all notifications**:
+
+```bash
+NIGHTWATCH_IGNORE_NOTIFICATIONS=true
+```
+
+**Filter by channel**:
+
+```php
+use Laravel\Nightwatch\Records\Notification;
+
+Nightwatch::rejectNotifications(function (Notification $notification) {
+    return $notification->channel === 'database';
+});
+```
+
+### Outgoing HTTP Requests
+
+**Filter all outgoing requests**:
+
+```bash
+NIGHTWATCH_IGNORE_OUTGOING_REQUESTS=true
+```
+
+**Filter by URL**:
+
+```php
+use Laravel\Nightwatch\Records\OutgoingRequest;
+
+Nightwatch::rejectOutgoingRequests(function (OutgoingRequest $request) {
+    return str_contains($request->url, 'analytics.example.com');
+});
+```
+
+### Queued Jobs
+
+**Filter specific jobs**:
+
+```php
+use Laravel\Nightwatch\Records\QueuedJob;
+
+Nightwatch::rejectQueuedJobs(function (QueuedJob $job) {
+    return $job->name === 'App\Jobs\LowPriorityJob';
+});
+```
+
+### Decoupling Job Sampling
+
+Sample jobs independently from parent contexts:
+
+```php
+use Illuminate\Support\Facades\Queue;
+
+public function boot(): void
+{
+    Queue::before(fn () => Nightwatch::sample(rate: 0.5));
+}
+```
+
+---
+
+## Redaction Configuration
+
+Redaction modifies captured data to remove or obfuscate sensitive information. Unlike filtering, redaction keeps the event but sanitizes its content.
+
+### Request Redaction
+
+**Redact sensitive headers** (automatically redacts: Authorization, Cookie, X-XSRF-TOKEN):
+
+```bash
+
+# Customize redacted headers
+
+NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-API-Key
+```
+
+**Redact request payloads** (disabled by default):
+
+```bash
+
+# Enable payload capture
+
+NIGHTWATCH_CAPTURE_REQUEST_PAYLOAD=true
+
+# Customize redacted fields
+
+NIGHTWATCH_REDACT_PAYLOAD_FIELDS=password,password_confirmation,ssn,credit_card
+```
+
+**Programmatic redaction**:
+
+```php
+use Laravel\Nightwatch\Facades\Nightwatch;
+use Laravel\Nightwatch\Records\Request;
+
+Nightwatch::redactRequests(function (Request $request) {
+    $request->url = str_replace('secret', '***', $request->url);
+    $request->ip = preg_replace('/\d+$/', '***', $request->ip);
+});
+```
+
+### Query Redaction
+
+```php
+use Laravel\Nightwatch\Records\Query;
+
+Nightwatch::redactQueries(function (Query $query) {
+    $query->sql = str_replace('secret_token', '***', $query->sql);
+});
+```
+
+### Cache Redaction
+
+```php
+use Laravel\Nightwatch\Records\CacheEvent;
+
+Nightwatch::redactCacheEvents(function (CacheEvent $cacheEvent) {
+    $cacheEvent->key = str_replace('user:', 'user:***:', $cacheEvent->key);
+});
+```
+
+### Command Redaction
+
+```php
+use Laravel\Nightwatch\Records\Command;
+
+Nightwatch::redactCommands(function (Command $command) {
+    $command->command = preg_replace('/--password=\S+/', '--password=***', $command->command);
+});
+```
+
+### Exception Redaction
+
+```php
+use Laravel\Nightwatch\Records\Exception;
+
+Nightwatch::redactExceptions(function (Exception $exception) {
+    $exception->message = str_replace('secret', '***', $exception->message);
+});
+```
+
+### Mail Redaction
+
+```php
+use Laravel\Nightwatch\Records\Mail;
+
+Nightwatch::redactMail(function (Mail $mail) {
+    $mail->subject = str_replace('Invoice #', 'Invoice ***', $mail->subject);
+});
+```
+
+### Outgoing Request Redaction
+
+```php
+use Laravel\Nightwatch\Records\OutgoingRequest;
+
+Nightwatch::redactOutgoingRequests(function (OutgoingRequest $outgoingRequest) {
+    $outgoingRequest->url = preg_replace('/api_key=\w+/', 'api_key=***', $outgoingRequest->url);
+});
+```

.cursor/skills/configure-nightwatch/reference.md

@@ -0,0 +1,108 @@
+# Nightwatch Configuration Reference
+
+## Configuration Summary by Event Type
+
+| Event Type            | Sampling                                           | Filtering                                                                    | Redaction                 |
+| --------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------- |
+| **Requests**          | `NIGHTWATCH_REQUEST_SAMPLE_RATE`, Route middleware | Not applicable                                                               | Headers, payload, URL, IP |
+| **Commands**          | `NIGHTWATCH_COMMAND_SAMPLE_RATE`, Event listener   | Not applicable                                                               | Command arguments         |
+| **Queries**           | Parent context                                     | `rejectQueries()`, `NIGHTWATCH_IGNORE_QUERIES`                               | SQL statement             |
+| **Cache**             | Parent context                                     | `rejectCacheKeys()`, `rejectCacheEvents()`, `NIGHTWATCH_IGNORE_CACHE_EVENTS` | Cache key                 |
+| **Jobs**              | Parent context, Queue::before                      | `rejectQueuedJobs()`                                                         | Not applicable            |
+| **Mail**              | Parent context                                     | `rejectMail()`, `NIGHTWATCH_IGNORE_MAIL`                                     | Subject                   |
+| **Notifications**     | Parent context                                     | `rejectNotifications()`, `NIGHTWATCH_IGNORE_NOTIFICATIONS`                   | Not applicable            |
+| **Outgoing Requests** | Parent context                                     | `rejectOutgoingRequests()`, `NIGHTWATCH_IGNORE_OUTGOING_REQUESTS`            | URL                       |
+| **Exceptions**        | `NIGHTWATCH_EXCEPTION_SAMPLE_RATE`                 | Not applicable                                                               | Exception message         |
+
+---
+
+## Production Recommendations
+
+### High-Traffic Applications
+
+```bash
+
+# Conservative sampling
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.01          # 1% of requests
+
+NIGHTWATCH_COMMAND_SAMPLE_RATE=0.1           # 10% of commands
+
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0         # Always capture exceptions
+
+# Filter noisy events
+
+NIGHTWATCH_IGNORE_CACHE_EVENTS=true
+NIGHTWATCH_IGNORE_QUERIES=true               # Or filter specific queries programmatically
+
+```
+
+### Privacy-Conscious Applications
+
+```bash
+
+# Disable sensitive data collection
+
+NIGHTWATCH_CAPTURE_REQUEST_PAYLOAD=false
+NIGHTWATCH_REDACT_HEADERS=Authorization,Cookie,Proxy-Authorization,X-XSRF-TOKEN
+
+# Or use redaction in AppServiceProvider
+
+```
+
+### Balanced Configuration (Recommended Start)
+
+```bash
+
+# Sample rates
+
+NIGHTWATCH_REQUEST_SAMPLE_RATE=0.1
+NIGHTWATCH_COMMAND_SAMPLE_RATE=1.0
+NIGHTWATCH_EXCEPTION_SAMPLE_RATE=1.0
+
+# Filter obvious noise programmatically
+
+# Redact PII as needed
+
+```
+
+---
+
+## Verification Checklist
+
+After configuration:
+
+- [ ] Sampling rates appropriate for traffic volume
+- [ ] Noisy events filtered (cache, certain queries)
+- [ ] Sensitive data redacted (PII, tokens, credentials)
+- [ ] Exceptions always captured for debugging
+- [ ] Test in development with `NIGHTWATCH_REQUEST_SAMPLE_RATE=1.0`
+- [ ] Monitor event quota usage in Nightwatch dashboard
+
+---
+
+## Common Patterns
+
+### Filter Health Checks + Reduce Sampling
+
+```php
+Route::get('/health', fn() => ['status' => 'ok'])
+    ->middleware(Sample::never());
+```
+
+### Exclude Internal/Vendor Queries
+
+```php
+Nightwatch::rejectQueries(fn($q) =>
+    str_contains($q->sql, 'telescope') ||
+    str_contains($q->sql, 'pulse')
+);
+```
+
+### Protect User Data in Cache Keys
+
+```php
+Nightwatch::redactCacheEvents(fn($e) =>
+    $e->key = preg_replace('/user:\d+/', 'user:***', $e->key)
+);
+```

.cursor/skills/fortify-development/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fortify-development
-description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
+description: 'ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), passkeys, profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, passkeys, WebAuthn, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.'
 license: MIT
 metadata:
   author: laravel
@@ -32,6 +32,7 @@ ## Available Features
 - `Features::updateProfileInformation()` - Profile updates
 - `Features::updatePasswords()` - Password changes
 - `Features::twoFactorAuthentication()` - 2FA with QR codes and recovery codes
+- `Features::passkeys()` - Passwordless authentication with WebAuthn passkeys
 
 > Use `search-docs` for feature configuration options and customization patterns.
 
@@ -50,6 +51,18 @@ ### Two-Factor Authentication Setup
 
 > Use `search-docs` for TOTP implementation and recovery code handling patterns.
 
+### Passkeys Setup
+
+```
+- [ ] Add PasskeyAuthenticatable trait to User model and implement PasskeyUser
+- [ ] Enable passkeys feature in config/fortify.php
+- [ ] If the passkeys table migration is missing, publish via `php artisan vendor:publish --tag=fortify-migrations` and migrate
+- [ ] Configure passkeys relying_party_id, allowed_origins, user_handle_secret, and timeout if defaults are not suitable
+- [ ] Build UI with @laravel/passkeys for registration, login, confirmation, and deletion
+```
+
+> Use `search-docs` for passkey configuration options. For `@laravel/passkeys` frontend usage, refer to the package's README on npm.
+
 ### Email Verification Setup
 
 ```
@@ -129,3 +142,10 @@ ## Key Endpoints
 | 2FA Challenge          | POST     | `/two-factor-challenge`                     |
 | Get QR Code            | GET      | `/user/two-factor-qr-code`                  |
 | Recovery Codes         | GET/POST | `/user/two-factor-recovery-codes`           |
+| Passkey Login Options  | GET      | `/passkeys/login/options`                   |
+| Passkey Login          | POST     | `/passkeys/login`                           |
+| Passkey Confirm Options| GET      | `/passkeys/confirm/options`                 |
+| Passkey Confirm        | POST     | `/passkeys/confirm`                         |
+| Passkey Options        | GET      | `/user/passkeys/options`                    |
+| Register Passkey       | POST     | `/user/passkeys`                            |
+| Delete Passkey         | DELETE   | `/user/passkeys/{passkey}`                  |

.cursor/skills/laravel-best-practices/SKILL.md

@@ -94,7 +94,7 @@ ### 8. Testing Patterns → `rules/testing.md`
 ### 9. Queue & Job Patterns → `rules/queue-jobs.md`
 
 - `retry_after` must exceed job `timeout`; use exponential backoff `[1, 5, 10]`
-- `ShouldBeUnique` to prevent duplicates; `WithoutOverlapping::untilProcessing()` for concurrency
+- `ShouldBeUnique` to prevent duplicates; `ShouldBeUniqueUntilProcessing` for early lock release
 - Always implement `failed()`; with `retryUntil()`, set `$tries = 0`
 - `RateLimited` middleware for external API calls; `Bus::batch()` for related jobs
 - Horizon for complex multi-queue scenarios

.cursor/skills/laravel-best-practices/rules/architecture.md

@@ -82,7 +82,7 @@ ## Code to Interfaces
 
 ## Default Sort by Descending
 
-When no explicit order is specified, sort by `id` or `created_at` descending. Explicit ordering prevents cross-database inconsistencies between MySQL and Postgres.
+When no explicit order is specified, sort by `id` or `created_at` descending. Without an explicit `ORDER BY`, row order is undefined.
 
 Incorrect:
 ```php

.cursor/skills/laravel-best-practices/rules/caching.md

@@ -2,7 +2,7 @@ # Caching Best Practices
 
 ## Use `Cache::remember()` Instead of Manual Get/Put
 
-Atomic pattern prevents race conditions and removes boilerplate.
+Cleaner cache-aside pattern that removes boilerplate. use `Cache::lock()` for race conditions.
 
 Incorrect:
 ```php

.cursor/skills/laravel-best-practices/rules/config.md

@@ -2,7 +2,7 @@ # Configuration Best Practices
 
 ## `env()` Only in Config Files
 
-Direct `env()` calls return `null` when config is cached.
+Direct `env()` calls may return `null` when config is cached.
 
 Incorrect:
 ```php

.cursor/skills/laravel-best-practices/rules/events-notifications.md

@@ -29,7 +29,11 @@ ## Always Queue Notifications
 
 ## Use `afterCommit()` on Notifications in Transactions
 
-Same race condition as events — the queued notification job may run before the transaction commits.
+Same race condition as events — call `afterCommit()` to delay dispatch until the transaction commits.
+
+```php
+$user->notify((new InvoicePaid($invoice))->afterCommit());
+```
 
 ## Route Notification Channels to Dedicated Queues
 

.cursor/skills/laravel-best-practices/rules/http-client.md

@@ -52,7 +52,7 @@ ## Use Retry with Backoff for External APIs
 Only retry on specific errors:
 
 ```php
-$response = Http::retry(3, 100, function (Exception $exception, PendingRequest $request) {
+$response = Http::retry(3, 100, function (Throwable $exception, PendingRequest $request) {
     return $exception instanceof ConnectionException
         || ($exception instanceof RequestException && $exception->response->serverError());
 })->post('https://api.example.com/data');

.cursor/skills/laravel-best-practices/rules/mail.md

@@ -10,7 +10,7 @@ ## Use `afterCommit()` on Mailables Inside Transactions
 
 ## Use `assertQueued()` Not `assertSent()` for Queued Mailables
 
-`Mail::assertSent()` only catches synchronous mail. Queued mailables silently pass `assertSent`, giving false confidence.
+`Mail::assertSent()` only catches synchronous mail. Queued mailables fail `assertSent` with a "Did you mean to use assertQueued()?" hint.
 
 Incorrect: `Mail::assertSent(OrderShipped::class);` when mailable implements `ShouldQueue`.
 

.cursor/skills/laravel-best-practices/rules/queue-jobs.md

@@ -106,25 +106,23 @@ ## `retryUntil()` Needs `$tries = 0`
 ```php
 public $tries = 0;
 
-public function retryUntil(): DateTime
+public function retryUntil(): \DateTimeInterface
 {
     return now()->addHours(4);
 }
 ```
 
-## Use `WithoutOverlapping::untilProcessing()`
+## Use `ShouldBeUniqueUntilProcessing` for Early Lock Release
 
-Prevents concurrent execution while allowing new instances to queue.
+`ShouldBeUnique` holds the lock until the job completes. `ShouldBeUniqueUntilProcessing` releases it when processing starts, allowing new instances to queue.
 
 ```php
-public function middleware(): array
+class UpdateSearchIndex implements ShouldQueue, ShouldBeUniqueUntilProcessing
 {
-    return [new WithoutOverlapping($this->product->id)->untilProcessing()];
+    // Lock releases when processing begins, not when it finishes
 }
 ```
 
-Without `untilProcessing()`, the lock extends through queue wait time. With it, the lock releases when processing starts.
-
 ## Use Horizon for Complex Queue Scenarios
 
 Use Laravel Horizon when you need monitoring, auto-scaling, failure tracking, or multiple queues with different priorities.

.cursor/skills/laravel-best-practices/rules/routing.md

@@ -36,7 +36,8 @@ ## Use Resource Controllers
 
 ```php
 Route::resource('posts', PostController::class);
-Route::apiResource('api/posts', Api\PostController::class);
+// In routes/api.php — the /api prefix is applied automatically
+Route::apiResource('posts', Api\PostController::class);
 ```
 
 ## Keep Controllers Thin

.cursor/skills/laravel-best-practices/rules/security.md

@@ -32,7 +32,7 @@ ## Authorize Every Action
 
 Incorrect:
 ```php
-public function update(Request $request, Post $post)
+public function update(UpdatePostRequest $request, Post $post)
 {
     $post->update($request->validated());
 }
@@ -90,7 +90,7 @@ ## Escape Output to Prevent XSS
 
 ## CSRF Protection
 
-Include `@csrf` in all POST/PUT/DELETE Blade forms. Not needed in Inertia.
+Include `@csrf` in all POST/PUT/DELETE Blade forms. In Inertia apps, the `@csrf` directive is automatically applied.
 
 Incorrect:
 ```blade
@@ -121,7 +121,7 @@ ## Rate Limit Auth and API Routes
 
 ## Validate File Uploads
 
-Validate MIME type, extension, and size. Never trust client-provided filenames.
+Validate extension, MIME type, and size. The `mimes` rule checks extensions; use `mimetypes` for actual MIME type validation. Never trust client-provided filenames.
 
 ```php
 public function rules(): array

.cursor/skills/laravel-best-practices/rules/testing.md

@@ -2,7 +2,7 @@ # Testing Best Practices
 
 ## Use `LazilyRefreshDatabase` Over `RefreshDatabase`
 
-`RefreshDatabase` runs all migrations every test run even when the schema hasn't changed. `LazilyRefreshDatabase` only migrates when needed, significantly speeding up large suites.
+`RefreshDatabase` migrates once per process and wraps each test in a rolled-back transaction. `LazilyRefreshDatabase` skips even that first migration if the schema is already up to date.
 
 ## Use Model Assertions Over Raw Database Assertions
 

.cursor/skills/mcp-development/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: mcp-development
+description: "Use this skill for Laravel MCP development only. Trigger when creating or editing MCP tools, resources, prompts, or servers in Laravel projects. Covers: artisan make:mcp-* generators, mcp:inspector, routes/ai.php, Tool/Resource/Prompt classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, and MCP debugging. Do not use for non-Laravel MCP projects or generic AI features without MCP."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# MCP Development
+
+## Documentation
+
+Use `search-docs` for detailed Laravel MCP patterns and documentation.
+
+## Basic Usage
+
+Register MCP servers in `routes/ai.php`:
+
+<!-- Register MCP Server -->
+```php
+use Laravel\Mcp\Facades\Mcp;
+
+Mcp::web();
+```
+
+### Creating MCP Primitives
+
+Create MCP tools, resources, prompts, and servers using artisan commands:
+
+```bash
+php artisan make:mcp-tool ToolName        # Create a tool
+
+php artisan make:mcp-resource ResourceName # Create a resource
+
+php artisan make:mcp-prompt PromptName    # Create a prompt
+
+php artisan make:mcp-server ServerName    # Create a server
+
+```
+
+After creating primitives, register them in your server's `$tools`, `$resources`, or `$prompts` properties.
+
+### Tools
+
+<!-- MCP Tool Example -->
+```php
+use Laravel\Mcp\Server\Tool;
+use Laravel\Mcp\Server\Request;
+use Laravel\Mcp\Server\Response;
+
+class MyTool extends Tool
+{
+    public function handle(Request $request): Response
+    {
+        return new Response(['result' => 'success']);
+    }
+}
+```
+
+### Registering Primitives in a Server
+
+Each MCP server must explicitly declare the tools, resources, and prompts it exposes.
+
+<!-- Register Primitives in MCP Server -->
+```php
+use Laravel\Mcp\Server;
+
+class AppServer extends Server
+{
+    protected array $tools = [
+        \App\Mcp\Tools\MyTool::class,
+    ];
+
+    protected array $resources = [
+        \App\Mcp\Resources\MyResource::class,
+    ];
+
+    protected array $prompts = [
+        \App\Mcp\Prompts\MyPrompt::class,
+    ];
+}
+```
+
+## Verification
+
+1. Check `routes/ai.php` for proper registration
+2. Test tool via MCP client
+
+## Common Pitfalls
+
+- Running `mcp:start` command (it hangs waiting for input)
+- Using HTTPS locally with Node-based MCP clients
+- Not using `search-docs` for the latest MCP documentation
+- Not registering MCP server routes in `routes/ai.php`
+- Do not register `ai.php` in `bootstrap.php`; it is registered automatically.
+- OAuth registration supports custom URI schemes (e.g., `cursor://`, `vscode://`) for native desktop clients via `mcp.custom_schemes` config

.cursor/skills/pest-testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pest-testing
-description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
+description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: test()/it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
 license: MIT
 metadata:
   author: laravel
@@ -18,6 +18,12 @@ ### Creating Tests
 
 All tests must be written using Pest. Use `php artisan make:test --pest {name}`.
 
+The `{name}` argument should include only the path and test name, but should not include the test suite.
+- Incorrect: `php artisan make:test --pest Feature/SomeFeatureTest` will generate `tests/Feature/Feature/SomeFeatureTest.php`
+- Correct: `php artisan make:test --pest SomeControllerTest` will generate `tests/Feature/SomeControllerTest.php`
+- Incorrect: `php artisan make:test --pest --unit Unit/SomeServiceTest` will generate `tests/Unit/Unit/SomeServiceTest.php`
+- Correct: `php artisan make:test --pest --unit SomeServiceTest` will generate `tests/Unit/SomeServiceTest.php`
+
 ### Test Organization
 
 - Unit/Feature tests: `tests/Feature` and `tests/Unit` directories.
@@ -26,6 +32,8 @@ ### Test Organization
 
 ### Basic Test Structure
 
+Pest supports both `test()` and `it()` functions. Before writing new tests, check existing test files in the same directory to match the project's convention. Use `test()` if existing tests use `test()`, or `it()` if they use `it()`.
+
 <!-- Basic Pest Test Example -->
 ```php
 it('is true', function () {
@@ -155,3 +163,4 @@ ## Common Pitfalls
 - Forgetting datasets for repetitive validation tests
 - Deleting tests without approval
 - Forgetting `assertNoJavaScriptErrors()` in browser tests
+- Prefixing `Feature/` or `Unit/` in `{name}` when using `make:test`

.env.development.example

@@ -27,15 +27,17 @@ DB_PORT=5432
 # DB_WRITE_PASSWORD=
 # DB_STICKY=true
 
-# Ray Configuration
-# Set to true to enable Ray
-RAY_ENABLED=false
-# Set custom ray port
-# RAY_PORT=
-
 # Enable Laravel Telescope for debugging
 TELESCOPE_ENABLED=false
 
+# Enable Laravel Debugbar (disabled by default; set true when needed)
+DEBUGBAR_ENABLED=false
+
+# Vite dev server. Defaults to localhost. For phone/LAN/Tailscale access, set to
+# the host machine's reachable IP (e.g. VITE_HOST=100.75.155.70), then recreate vite.
+VITE_HOST=localhost
+VITE_PORT=5173
+
 # Enable Laravel Nightwatch monitoring
 NIGHTWATCH_ENABLED=false
 NIGHTWATCH_TOKEN=

.env.production

@@ -15,4 +15,5 @@ ROOT_USERNAME=
 ROOT_USER_EMAIL=
 ROOT_USER_PASSWORD=
 
-REGISTRY_URL=ghcr.io
+REGISTRY_URL=forgejo.mapledeploy.ca
+CDN_URL=https://updates.mapledeploy.ca

.forgejo/workflows/build.yml

@@ -0,0 +1,103 @@
+name: Build MapleDeploy Coolify Image
+
+on:
+  push:
+    branches: [mapledeploy]
+    paths-ignore:
+      - "*.md"
+      - ".github/**"
+
+env:
+  REGISTRY: forgejo.mapledeploy.ca
+  CDN_STORAGE_ZONE: coolify-update
+  CDN_PULL_ZONE_ID: "5338895"
+  CDN_BASE_URL: https://updates.mapledeploy.ca
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get version
+        id: version
+        run: |
+          BASE_VERSION=$(sed -n "s/.*'version' => '\([^']*\)'.*/\1/p" config/constants.php)
+          TIMESTAMP=$(date -u +%Y%m%d%H%M)
+          VERSION="${BASE_VERSION}.${TIMESTAMP}"
+          HELPER_VERSION=$(sed -n "s/.*'helper_version' => '\([^']*\)'.*/\1/p" config/constants.php)
+          REALTIME_VERSION=$(sed -n "s/.*'realtime_version' => '\([^']*\)'.*/\1/p" config/constants.php)
+          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "HELPER_VERSION=${HELPER_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "REALTIME_VERSION=${REALTIME_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Building version: ${VERSION} (helper: ${HELPER_VERSION}, realtime: ${REALTIME_VERSION})"
+
+      - name: Login to Forgejo registry
+        run: |
+          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ github.repository_owner }} --password-stdin
+
+      - name: Build image
+        run: |
+          DOCKER_BUILDKIT=1 docker build -f docker/production/Dockerfile \
+            --build-arg MAPLEDEPLOY_VERSION=${{ steps.version.outputs.VERSION }} \
+            -t ${{ env.REGISTRY }}/${{ github.repository }}:${{ steps.version.outputs.VERSION }} \
+            -t ${{ env.REGISTRY }}/${{ github.repository }}:latest \
+            .
+
+      - name: Push image
+        run: |
+          docker push ${{ env.REGISTRY }}/${{ github.repository }}:${{ steps.version.outputs.VERSION }}
+          docker push ${{ env.REGISTRY }}/${{ github.repository }}:latest
+
+      - name: Generate versions.json
+        run: |
+          cat > versions.json <<EOF
+          {
+            "coolify": {
+              "v4": {
+                "version": "${{ steps.version.outputs.VERSION }}"
+              },
+              "helper": {
+                "version": "${{ steps.version.outputs.HELPER_VERSION }}"
+              },
+              "realtime": {
+                "version": "${{ steps.version.outputs.REALTIME_VERSION }}"
+              }
+            }
+          }
+          EOF
+          echo "Generated versions.json:"
+          cat versions.json
+
+      - name: Install curl
+        run: apk add --no-cache curl
+
+      - name: Upload artifacts to Bunny CDN
+        run: |
+          STORAGE_URL="https://storage.bunnycdn.com/${{ env.CDN_STORAGE_ZONE }}/coolify"
+
+          upload() {
+            local file="$1"
+            local dest="$2"
+            echo "Uploading ${file} -> ${dest}"
+            curl -fsSL -X PUT "${STORAGE_URL}/${dest}" \
+              -H "AccessKey: ${{ secrets.BUNNY_CDN_STORAGE_KEY }}" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary @"${file}"
+          }
+
+          upload versions.json versions.json
+          upload scripts/upgrade.sh upgrade.sh
+          upload scripts/upgrade-postgres.sh upgrade-postgres.sh
+          upload docker-compose.yml docker-compose.yml
+          upload docker-compose.prod.yml docker-compose.prod.yml
+          upload .env.production .env.production
+
+          echo "All artifacts uploaded."
+
+      - name: Purge CDN cache
+        run: |
+          curl -fsSL -X POST "https://api.bunny.net/pullzone/${{ env.CDN_PULL_ZONE_ID }}/purgeCache" \
+            -H "AccessKey: ${{ secrets.BUNNY_API_KEY }}" \
+            -H "Content-Type: application/json"
+          echo "CDN cache purged."

.github/ISSUE_TEMPLATE/01_BUG_REPORT.yml

@@ -1,7 +1,7 @@
 name: 🐞 Bug Report
 description: "File a new bug report."
 title: "[Bug]: "
-labels: ["🐛 Bug", "🔍 Triage"]
+labels: ["🔍 Triage"]
 body:
   - type: markdown
     attributes:
@@ -11,11 +11,23 @@ body:
 
   - type: textarea
     attributes:
-      label: Error Message and Logs
+      label: Description and Error Message
       description: Provide a detailed description of the error or exception you encountered, along with any relevant log output.
     validations:
       required: true
       
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: Please describe what you expected to happen instead of the issue. Be as detailed as possible.
+      value: |
+        1.
+        2.
+        3.
+        4.
+    validations:
+      required: true
+
   - type: textarea
     attributes:
       label: Steps to Reproduce
@@ -37,7 +49,7 @@ body:
     attributes:
       label: Coolify Version
       description: Please provide the Coolify version you are using. This can be found in the top left corner of your Coolify dashboard.
-      placeholder: "v4.0.0-beta.335"
+      placeholder: "v4.1.2"
     validations:
       required: true
 
@@ -56,6 +68,12 @@ body:
       description: Run `cat /etc/os-release` or `lsb_release -a` in your terminal and provide the operating system and version.
       placeholder: "Ubuntu 22.04"
       
+  - type: textarea
+    attributes:
+      label: Screenshots / Visuals
+      description: If possible, provide screenshots, screen recordings, or diagrams to help illustrate the issue.
+      placeholder: "Attach images or provide links to recordings demonstrating the problem."
+
   - type: textarea
     attributes:
       label: Additional Information

.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml

@@ -1,22 +0,0 @@
-name: Lock closed Issues, Discussions, and PRs
-
-on:
-  schedule:
-    - cron: '0 1 * * *'
-
-permissions:
-  issues: write
-  discussions: write
-  pull-requests: write
-
-jobs:
-  lock-threads:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Lock threads after 30 days of inactivity
-        uses: dessant/lock-threads@v5
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          issue-inactive-days: '30'
-          discussion-inactive-days: '30'
-          pr-inactive-days: '30'

.github/workflows/chore-manage-stale-issues-and-prs.yml

@@ -1,32 +0,0 @@
-name: Manage Stale Issues and PRs
-
-on:
-  schedule:
-    - cron: '0 2 * * *'
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  manage-stale:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Manage stale issues and PRs
-        uses: actions/stale@v9
-        id: stale
-        with:
-          stale-issue-message: 'This issue will be automatically closed in a few days if no response is received. Please provide an update with the requested information.'
-          stale-pr-message: 'This pull request requires attention. If no changes or response is received within the next few days, it will be automatically closed. Please update your PR or leave a comment with the requested information.'
-          close-issue-message: 'This issue has been automatically closed due to inactivity.'
-          close-pr-message: 'Thank you for your contribution. Due to inactivity, this PR was automatically closed. If you would like to continue working on this change in the future, feel free to reopen this PR or submit a new one.'
-          days-before-stale: 14
-          days-before-close: 7
-          stale-issue-label: '⏱︎ Stale'
-          stale-pr-label: '⏱︎ Stale'
-          only-labels: '💤 Waiting for feedback, 💤 Waiting for changes'
-          remove-stale-when-updated: true
-          operations-per-run: 100
-          labels-to-remove-when-unstale: '⏱︎ Stale, 💤 Waiting for feedback, 💤 Waiting for changes'
-          close-issue-reason: 'not_planned'
-          exempt-all-milestones: false

.github/workflows/chore-pr-comments.yml

@@ -1,49 +0,0 @@
-name: Add comment based on label
-on:
-  pull_request_target:
-    types:
-      - labeled
-
-permissions:
-  pull-requests: write
-
-jobs:
-  add-comment:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - label: "⚙️ Service"
-            body: |
-              Hi @${{ github.event.pull_request.user.login }}! 👋
-
-              It appears to us that you are either adding a new service or making changes to an existing one.
-              We kindly ask you to also review and update the **Coolify Documentation** to include this new service or it's new configuration needs.
-              This will help ensure that our documentation remains accurate and up-to-date for all users.
-
-              Coolify Docs Repository: https://github.com/coollabsio/coolify-docs
-              How to Contribute a new Service to the Docs: https://coolify.io/docs/get-started/contribute/service#adding-a-new-service-template-to-the-coolify-documentation
-          - label: "🛠️ Feature"
-            body: |
-              Hi @${{ github.event.pull_request.user.login }}! 👋
-
-              It appears to us that you are adding a new feature to Coolify.
-              We kindly ask you to also update the **Coolify Documentation** to include information about this new feature.
-              This will help ensure that our documentation remains accurate and up-to-date for all users.
-
-              Coolify Docs Repository: https://github.com/coollabsio/coolify-docs
-              How to Contribute to the Docs: https://coolify.io/docs/get-started/contribute/documentation
-          # - label: "✨ Enhancement"
-          #  body: |
-          #    It appears to us that you are making an enhancement to Coolify.
-          #    We kindly ask you to also review and update the Coolify Documentation to include information about this enhancement if applicable.
-          #    This will help ensure that our documentation remains accurate and up-to-date for all users.
-    steps:
-      - name: Add comment
-        if: github.event.label.name == matrix.label
-        run: gh pr comment "$NUMBER" --body "$BODY"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          NUMBER: ${{ github.event.pull_request.number }}
-          BODY: ${{ matrix.body }}

.github/workflows/claude.yml

@@ -1,37 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-      id-token: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          claude_args: '--model opus'

.github/workflows/cleanup-ghcr-untagged.yml

@@ -1,22 +0,0 @@
-name: Cleanup Untagged GHCR Images
-
-on:
-  workflow_dispatch:
-
-permissions:
-  packages: write
-
-jobs:
-  cleanup-all-packages:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        package: ['coolify', 'coolify-helper', 'coolify-realtime', 'coolify-testing-host']
-    steps:
-      - name: Delete untagged ${{ matrix.package }} images
-        uses: actions/delete-package-versions@v5
-        with:
-          package-name: ${{ matrix.package }}
-          package-type: 'container'
-          min-versions-to-keep: 0
-          delete-only-untagged-versions: 'true'

.github/workflows/coolify-helper-next.yml

@@ -1,117 +0,0 @@
-name: Coolify Helper Image Development
-
-on:
-  push:
-    branches: [ "next" ]
-    paths:
-      - .github/workflows/coolify-helper-next.yml
-      - docker/coolify-helper/Dockerfile
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify-helper"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/coolify-helper/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-${{ matrix.arch }}
-          labels: |
-            coolify.managed=true
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:next
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:next
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_DEV_RELEASE_CHANNEL  }}
-

.github/workflows/coolify-helper.yml

@@ -1,116 +0,0 @@
-name: Coolify Helper Image
-
-on:
-  push:
-    branches: [ "v4.x" ]
-    paths:
-      - .github/workflows/coolify-helper.yml
-      - docker/coolify-helper/Dockerfile
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify-helper"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/coolify-helper/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-          labels: |
-            coolify.managed=true
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL  }}
-

.github/workflows/coolify-production-build.yml

@@ -1,122 +0,0 @@
-name: Production Build (v4)
-
-on:
-  push:
-    branches: ["v4.x"]
-    paths-ignore:
-      - .github/workflows/coolify-helper.yml
-      - .github/workflows/coolify-helper-next.yml
-      - .github/workflows/coolify-realtime.yml
-      - .github/workflows/coolify-realtime-next.yml
-      - .github/workflows/pr-quality.yaml
-      - docker/coolify-helper/Dockerfile
-      - docker/coolify-realtime/Dockerfile
-      - docker/testing-host/Dockerfile
-      - templates/**
-      - CHANGELOG.md
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/production/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL  }}

.github/workflows/coolify-realtime-next.yml

@@ -1,120 +0,0 @@
-name: Coolify Realtime Development
-
-on:
-  push:
-    branches: [ "next" ]
-    paths:
-      - .github/workflows/coolify-realtime-next.yml
-      - docker/coolify-realtime/Dockerfile
-      - docker/coolify-realtime/terminal-server.js
-      - docker/coolify-realtime/package.json
-      - docker/coolify-realtime/package-lock.json
-      - docker/coolify-realtime/soketi-entrypoint.sh
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify-realtime"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/coolify-realtime/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-${{ matrix.arch }}
-          labels: |
-            coolify.managed=true
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:next
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-next \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:next
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_DEV_RELEASE_CHANNEL  }}

.github/workflows/coolify-realtime.yml

@@ -1,120 +0,0 @@
-name: Coolify Realtime
-
-on:
-  push:
-    branches: [ "v4.x" ]
-    paths:
-      - .github/workflows/coolify-realtime.yml
-      - docker/coolify-realtime/Dockerfile
-      - docker/coolify-realtime/terminal-server.js
-      - docker/coolify-realtime/package.json
-      - docker/coolify-realtime/package-lock.json
-      - docker/coolify-realtime/soketi-entrypoint.sh
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify-realtime"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/coolify-realtime/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-          labels: |
-            coolify.managed=true
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)"|xargs >> $GITHUB_OUTPUT
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL  }}

.github/workflows/coolify-staging-build.yml

@@ -1,134 +0,0 @@
-name: Staging Build
-
-on:
-  push:
-    branches-ignore:
-      - v4.x
-      - v3.x
-      - '**v5.x**'
-    paths-ignore:
-        - .github/workflows/coolify-helper.yml
-        - .github/workflows/coolify-helper-next.yml
-        - .github/workflows/coolify-realtime.yml
-        - .github/workflows/coolify-realtime-next.yml
-        - .github/workflows/pr-quality.yaml
-        - docker/coolify-helper/Dockerfile
-        - docker/coolify-realtime/Dockerfile
-        - docker/testing-host/Dockerfile
-        - templates/**
-        - CHANGELOG.md
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Sanitize branch name for Docker tag
-        id: sanitize
-        run: |
-          # Replace slashes and other invalid characters with dashes
-          SANITIZED_NAME=$(echo "${{ github.ref_name }}" | sed 's/[\/]/-/g')
-          echo "tag=${SANITIZED_NAME}" >> $GITHUB_OUTPUT
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/production/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-${{ matrix.arch }}
-          cache-from: |
-            type=gha,scope=build-${{ matrix.arch }}
-            type=registry,ref=${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=build-${{ matrix.arch }}
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Sanitize branch name for Docker tag
-        id: sanitize
-        run: |
-          # Replace slashes and other invalid characters with dashes
-          SANITIZED_NAME=$(echo "${{ github.ref_name }}" | sed 's/[\/]/-/g')
-          echo "tag=${SANITIZED_NAME}" >> $GITHUB_OUTPUT
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-         docker buildx imagetools create \
-         ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-amd64 \
-         ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-aarch64 \
-         --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.sanitize.outputs.tag }}
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_DEV_RELEASE_CHANNEL  }}

.github/workflows/coolify-testing-host.yml

@@ -1,104 +0,0 @@
-name: Coolify Testing Host
-
-on:
-  push:
-    branches: [ "next" ]
-    paths:
-      - .github/workflows/coolify-testing-host.yml
-      - docker/testing-host/Dockerfile
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  GITHUB_REGISTRY: ghcr.io
-  DOCKER_REGISTRY: docker.io
-  IMAGE_NAME: "coollabsio/coolify-testing-host"
-
-jobs:
-  build-push:
-    strategy:
-      matrix:
-        include:
-          - arch: amd64
-            platform: linux/amd64
-            runner: ubuntu-24.04
-          - arch: aarch64
-            platform: linux/aarch64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and Push Image (${{ matrix.arch }})
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/testing-host/Dockerfile
-          platforms: ${{ matrix.platform }}
-          push: true
-          tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest-${{ matrix.arch }}
-          labels: |
-            coolify.managed=true
-
-  merge-manifest:
-    runs-on: ubuntu-24.04
-    needs: build-push
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Login to ${{ env.GITHUB_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GITHUB_REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN  }}
-
-      - name: Login to ${{ env.DOCKER_REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
-        run: |
-          docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_DEV_RELEASE_CHANNEL  }}

.github/workflows/generate-changelog.yml

@@ -1,42 +0,0 @@
-name: Generate Changelog
-
-on:
-  push:
-    branches: [ v4.x ]
-    paths-ignore:
-      - .github/workflows/coolify-helper.yml
-      - .github/workflows/coolify-helper-next.yml
-      - .github/workflows/coolify-realtime.yml
-      - .github/workflows/coolify-realtime-next.yml
-      - .github/workflows/pr-quality.yaml
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-jobs:
-  changelog:
-    name: Generate changelog
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Generate changelog
-        uses: orhun/git-cliff-action@v4
-        with:
-          config: cliff.toml
-          args: --verbose
-        env:
-          OUTPUT: CHANGELOG.md
-          GITHUB_REPO: ${{ github.repository }}
-
-      - name: Commit
-        run: |
-          git config user.name 'github-actions[bot]'
-          git config user.email 'github-actions[bot]@users.noreply.github.com'
-          git add CHANGELOG.md
-          git commit -m "docs: update changelog"
-          git push https://${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git v4.x

.github/workflows/pr-quality.yaml

@@ -1,111 +0,0 @@
-name: PR Quality
-
-permissions:
-  contents: read
-  issues: read
-  pull-requests: write
-
-on:
-  pull_request_target:
-    types: [opened, reopened]
-
-jobs:
-  pr-quality:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: peakoss/anti-slop@v0
-        with:
-          # General Settings
-          max-failures: 4
-
-          # PR Branch Checks
-          allowed-target-branches: "next"
-          blocked-target-branches: ""
-          allowed-source-branches: ""
-          blocked-source-branches: |
-            main
-            master
-            v4.x
-
-          # PR Quality Checks
-          max-negative-reactions: 0
-          require-maintainer-can-modify: true
-
-          # PR Title Checks
-          require-conventional-title: true
-
-          # PR Description Checks
-          require-description: true
-          max-description-length: 2500
-          max-emoji-count: 2
-          max-code-references: 5
-          require-linked-issue: false
-          blocked-terms:  |
-            STRAWBERRY
-            🤖 Generated with Claude Code
-            Generated with Claude Code
-          blocked-issue-numbers: 8154
-
-          # PR Template Checks
-          require-pr-template: true
-          strict-pr-template-sections: "Contributor Agreement"
-          optional-pr-template-sections: "Issues,Preview"
-          max-additional-pr-template-sections: 2
-
-          # Commit Message Checks
-          max-commit-message-length: 500
-          require-conventional-commits: false
-          require-commit-author-match: true
-          blocked-commit-authors: ""
-
-          # File Checks
-          allowed-file-extensions: ""
-          allowed-paths: ""
-          blocked-paths: |
-            README.md
-            SECURITY.md
-            LICENSE
-            CODE_OF_CONDUCT.md
-            templates/service-templates-latest.json
-            templates/service-templates.json
-          require-final-newline: true
-          max-added-comments: 10
-
-          # User Checks
-          detect-spam-usernames: true
-          min-account-age: 30
-          max-daily-forks: 7
-          min-profile-completeness: 4
-
-          # Merge Checks
-          min-repo-merged-prs: 0
-          min-repo-merge-ratio: 0
-          min-global-merge-ratio: 30
-          global-merge-ratio-exclude-own: false
-
-          # Exemptions
-          exempt-draft-prs: false
-          exempt-bots: |
-            actions-user
-            dependabot[bot]
-            renovate[bot]
-            github-actions[bot]
-          exempt-users: ""
-          exempt-author-association: "OWNER,MEMBER,COLLABORATOR"
-          exempt-label: "quality/exempt"
-          exempt-pr-label: ""
-          exempt-all-milestones: false
-          exempt-all-pr-milestones: false
-          exempt-milestones: ""
-          exempt-pr-milestones: ""
-
-          # PR Success Actions
-          success-add-pr-labels: ""
-
-          # PR Failure Actions
-          failure-remove-pr-labels: ""
-          failure-remove-all-pr-labels: true
-          failure-add-pr-labels: "quality/rejected"
-          failure-pr-message: "This PR did not pass quality checks so it will be closed. If you believe this is a mistake please let us know."
-          close-pr: true
-          lock-pr: false

AGENTS.md

@@ -1,7 +1,147 @@
+# AGENTS.md
+
+This file provides guidance to agentic coding tools when working with code in this repository.
+
+## Project Overview
+
+Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
+
 ## Design Reference
 
 For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
 
+## Development Environment
+
+Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.
+
+```bash
+# Start dev environment (uses docker-compose.dev.yml)
+spin up                          # or: docker compose -f docker-compose.dev.yml up -d
+spin down                        # stop services
+```
+
+The app runs at `localhost:8000` by default. Vite dev server on port 5173.
+
+## Common Commands
+
+```bash
+# Tests (Pest 4)
+php artisan test --compact                          # all tests
+php artisan test --compact --filter=testName         # single test
+php artisan test --compact tests/Feature/SomeTest.php  # specific file
+
+# Code formatting (Pint, Laravel preset)
+vendor/bin/pint --dirty --format agent              # format changed files
+
+# Frontend
+npm run dev                     # vite dev server
+npm run build                   # production build
+```
+
+## Browser Tests (Pest Browser Plugin)
+
+Uses `pestphp/pest-plugin-browser` with Laravel Dusk 8. New browser tests go in `tests/v4/Browser/`.
+
+```bash
+# Run all browser tests
+php artisan test --compact tests/v4/Browser/
+
+# Run a specific browser test file
+php artisan test --compact tests/v4/Browser/LoginTest.php
+
+# Run a specific test by name
+php artisan test --compact --filter='can login with valid credentials'
+```
+
+### Writing Browser Tests
+
+- Place new tests in `tests/v4/Browser/` — legacy Dusk tests in `tests/Browser/` should not be used as reference.
+- Use `RefreshDatabase` and seed required data (at minimum `InstanceSettings::create(['id' => 0])`) in `beforeEach`.
+- Key API: `visit()`, `fill(field, value)`, `click(text)`, `assertSee()`, `assertDontSee()`, `assertPathIs()`, `screenshot()`.
+- Always call `screenshot()` at the end of each test for debugging.
+- For authenticated tests, create a helper function that logs in via the UI:
+
+```php
+function loginAsRoot(): mixed
+{
+    return visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login');
+}
+```
+
+- See `tests/v4/Browser/LoginTest.php`, `tests/v4/Browser/DashboardTest.php`, and `tests/v4/Browser/RegistrationTest.php` for conventions.
+- Chrome driver runs on `localhost:4444`, app on `localhost:8000` (configured in `tests/DuskTestCase.php`).
+- Legacy Dusk macros in `app/Providers/DuskServiceProvider.php` use the old `type()`/`press()` API — do not mix with Pest Browser Plugin's `fill()`/`click()` API.
+
+## Architecture
+
+### Backend Structure (app/)
+- **Actions/** — Domain actions organized by area (Application, Database, Docker, Proxy, Server, Service, Shared, Stripe, User, CoolifyTask, Fortify). Uses `lorisleiva/laravel-actions` with `AsAction` trait — actions can be called as objects, dispatched as jobs, or used as controllers.
+- **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components listen to private team channels for real-time status updates via Soketi.
+- **Jobs/** — Queue jobs for deployments (`ApplicationDeploymentJob`), backups, Docker cleanup, server management, proxy configuration. Uses Redis queue with Horizon for monitoring.
+- **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
+- **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
+- **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
+- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
+- **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
+- **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
+
+### API Layer
+- REST API at `/api/v1/` with OpenAPI 3.0 attributes (`use OpenApi\Attributes as OA`) for auto-generated docs
+- Authentication via Laravel Sanctum with custom `ApiAbility` middleware for token abilities (read, write, deploy)
+- `ApiSensitiveData` middleware masks sensitive fields (IDs, credentials) in responses
+- API controllers in `app/Http/Controllers/Api/` use inline `Validator` (not Form Request classes)
+- Response serialization via `serializeApiResponse()` helper
+
+### Authorization
+- Policy-based authorization with ~15 model-to-policy mappings in `AuthServiceProvider`
+- Custom gates: `createAnyResource`, `canAccessTerminal`
+- Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
+- Multi-tenancy via Teams — team auto-initializes notification settings on creation
+
+### Event Broadcasting
+- Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
+- Status change events: `ApplicationStatusChanged`, `ServiceStatusChanged`, `DatabaseStatusChanged`, `ProxyStatusChanged`
+- Livewire components subscribe to private team channels via `getListeners()`
+
+### Key Domain Concepts
+- **Server** — A managed host connected via SSH. Has settings, proxy config, and destinations.
+- **Application** — A deployed app (from Git or Docker image) with environment variables, previews, deployment queue.
+- **Service** — A pre-configured service stack from templates (`templates/service-templates-latest.json`).
+- **Standalone Databases** — Individual database instances (Postgres, MySQL, MariaDB, MongoDB, Redis, Clickhouse, KeyDB, Dragonfly).
+- **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
+- **Proxy** — Traefik reverse proxy managed per server.
+
+### Frontend
+- Livewire 3 components with Alpine.js for client-side interactivity
+- Blade templates in `resources/views/livewire/`
+- Tailwind CSS v4 with `@tailwindcss/forms` and `@tailwindcss/typography`
+- Vite for asset bundling
+
+### Laravel 10 Structure (NOT Laravel 11+ slim structure)
+- Middleware in `app/Http/Middleware/` — custom middleware includes `CheckForcePasswordReset`, `DecideWhatToDoWithUser`, `ApiAbility`, `ApiSensitiveData`
+- Kernels: `app/Http/Kernel.php`, `app/Console/Kernel.php`
+- Exception handler: `app/Exceptions/Handler.php`
+- Service providers in `app/Providers/`
+
+## Key Conventions
+
+- Use `php artisan make:*` commands with `--no-interaction` to create files
+- Use Eloquent relationships, avoid `DB::` facade — prefer `Model::query()`
+- PHP 8.5: constructor property promotion, explicit return types, type hints
+- Validation uses inline `Validator` facade in controllers/Livewire components and custom rules in `app/Rules/` — not Form Request classes
+- Run `vendor/bin/pint --dirty --format agent` before finalizing changes
+- Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
+- Check sibling files for conventions before creating new files
+
+## Git Workflow
+
+- Main branch: `v4.x`
+- Development branch: `next`
+- PRs should target `v4.x`
+
 <laravel-boost-guidelines>
 === foundation rules ===
 
@@ -17,6 +157,7 @@ ## Foundational Context
 - laravel/fortify (FORTIFY) - v1
 - laravel/framework (LARAVEL) - v12
 - laravel/horizon (HORIZON) - v5
+- laravel/mcp (MCP) - v0
 - laravel/nightwatch (NIGHTWATCH) - v1
 - laravel/pail (PAIL) - v1
 - laravel/prompts (PROMPTS) - v0
@@ -25,29 +166,16 @@ ## Foundational Context
 - livewire/livewire (LIVEWIRE) - v3
 - laravel/boost (BOOST) - v2
 - laravel/dusk (DUSK) - v8
-- laravel/mcp (MCP) - v0
 - laravel/pint (PINT) - v1
 - laravel/telescope (TELESCOPE) - v5
 - pestphp/pest (PEST) - v4
 - phpunit/phpunit (PHPUNIT) - v12
 - rector/rector (RECTOR) - v2
-- laravel-echo (ECHO) - v2
 - tailwindcss (TAILWINDCSS) - v4
-- vue (VUE) - v3
 
 ## Skills Activation
 
-This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
+This project has domain-specific skills available in `**/skills/**`. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-- `laravel-best-practices` — Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
-- `configuring-horizon` — Use this skill whenever the user mentions Horizon by name in a Laravel context. Covers the full Horizon lifecycle: installing Horizon (horizon:install, Sail setup), configuring config/horizon.php (supervisor blocks, queue assignments, balancing strategies, minProcesses/maxProcesses), fixing the dashboard (authorization via Gate::define viewHorizon, blank metrics, horizon:snapshot scheduling), and troubleshooting production issues (worker crashes, timeout chain ordering, LongWaitDetected notifications, waits config). Also covers job tagging and silencing. Do not use for generic Laravel queues without Horizon, SQS or database drivers, standalone Redis setup, Linux supervisord, Telescope, or job batching.
-- `socialite-development` — Manages OAuth social authentication with Laravel Socialite. Activate when adding social login providers; configuring OAuth redirect/callback flows; retrieving authenticated user details; customizing scopes or parameters; setting up community providers; testing with Socialite fakes; or when the user mentions social login, OAuth, Socialite, or third-party authentication.
-- `livewire-development` — Use for any task or question involving Livewire. Activate if user mentions Livewire, wire: directives, or Livewire-specific concepts like wire:model, wire:click, invoke this skill. Covers building new components, debugging reactivity issues, real-time form validation, loading states, migrating from Livewire 2 to 3, converting component formats (SFC/MFC/class-based), and performance optimization. Do not use for non-Livewire reactive UI (React, Vue, Alpine-only, Inertia.js) or standard Laravel forms without Livewire.
-- `pest-testing` — Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code.
-- `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS.
-- `fortify-development` — ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.
-- `laravel-actions` — Build, refactor, and troubleshoot Laravel Actions using lorisleiva/laravel-actions. Use when implementing reusable action classes (object/controller/job/listener/command), converting service classes/controllers/jobs into actions, orchestrating workflows via faked actions, or debugging action entrypoints and wiring.
-- `debugging-output-and-previewing-html-using-ray` — Use when user says "send to Ray," "show in Ray," "debug in Ray," "log to Ray," "display in Ray," or wants to visualize data, debug output, or show diagrams in the Ray desktop application.
 
 ## Conventions
 
@@ -107,7 +235,6 @@ ## Artisan
 - Run Artisan commands directly via the command line (e.g., `php artisan route:list`). Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters.
 - Inspect routes with `php artisan route:list`. Filter with: `--method=GET`, `--name=users`, `--path=api`, `--except-vendor`, `--only-vendor`.
 - Read configuration values using dot notation: `php artisan config:show app.name`, `php artisan config:show database.default`. Or read config files directly from the `config/` directory.
-- To check environment variables, read the `.env` file directly.
 
 ## Tinker
 
@@ -122,10 +249,16 @@ # PHP
 - Always use curly braces for control structures, even for single-line bodies.
 - Use PHP 8 constructor property promotion: `public function __construct(public GitHub $github) { }`. Do not leave empty zero-parameter `__construct()` methods unless the constructor is private.
 - Use explicit return type declarations and type hints for all method parameters: `function isAccessible(User $user, ?string $path = null): bool`
-- Use TitleCase for Enum keys: `FavoritePerson`, `BestLake`, `Monthly`.
+- Follow existing application Enum naming conventions.
 - Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic.
 - Use array shape type definitions in PHPDoc blocks.
 
+=== deployments rules ===
+
+# Deployment
+
+- Laravel can be deployed using [Laravel Cloud](https://cloud.laravel.com/), which is the fastest way to deploy and scale production Laravel applications.
+
 === tests rules ===
 
 # Test Enforcement
@@ -209,6 +342,7 @@ # Laravel Pint Code Formatter
 ## Pest
 
 - This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
+- The `{name}` argument should not include the test suite directory. Use `php artisan make:test --pest SomeFeatureTest` instead of `php artisan make:test --pest Feature/SomeFeatureTest`.
 - Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
 - Do NOT delete tests without approval.
 

CLAUDE.md

@@ -1,318 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
-
-## Design Reference
-
-For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
-
-## Development Environment
-
-Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.
-
-```bash
-# Start dev environment (uses docker-compose.dev.yml)
-spin up                          # or: docker compose -f docker-compose.dev.yml up -d
-spin down                        # stop services
-```
-
-The app runs at `localhost:8000` by default. Vite dev server on port 5173.
-
-## Common Commands
-
-```bash
-# Tests (Pest 4)
-php artisan test --compact                          # all tests
-php artisan test --compact --filter=testName         # single test
-php artisan test --compact tests/Feature/SomeTest.php  # specific file
-
-# Code formatting (Pint, Laravel preset)
-vendor/bin/pint --dirty --format agent              # format changed files
-
-# Frontend
-npm run dev                     # vite dev server
-npm run build                   # production build
-```
-
-## Architecture
-
-### Backend Structure (app/)
-- **Actions/** — Domain actions organized by area (Application, Database, Docker, Proxy, Server, Service, Shared, Stripe, User, CoolifyTask, Fortify). Uses `lorisleiva/laravel-actions` with `AsAction` trait — actions can be called as objects, dispatched as jobs, or used as controllers.
-- **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components listen to private team channels for real-time status updates via Soketi.
-- **Jobs/** — Queue jobs for deployments (`ApplicationDeploymentJob`), backups, Docker cleanup, server management, proxy configuration. Uses Redis queue with Horizon for monitoring.
-- **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
-- **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
-- **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
-- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
-- **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
-- **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
-
-### API Layer
-- REST API at `/api/v1/` with OpenAPI 3.0 attributes (`use OpenApi\Attributes as OA`) for auto-generated docs
-- Authentication via Laravel Sanctum with custom `ApiAbility` middleware for token abilities (read, write, deploy)
-- `ApiSensitiveData` middleware masks sensitive fields (IDs, credentials) in responses
-- API controllers in `app/Http/Controllers/Api/` use inline `Validator` (not Form Request classes)
-- Response serialization via `serializeApiResponse()` helper
-
-### Authorization
-- Policy-based authorization with ~15 model-to-policy mappings in `AuthServiceProvider`
-- Custom gates: `createAnyResource`, `canAccessTerminal`
-- Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
-- Multi-tenancy via Teams — team auto-initializes notification settings on creation
-
-### Event Broadcasting
-- Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
-- Status change events: `ApplicationStatusChanged`, `ServiceStatusChanged`, `DatabaseStatusChanged`, `ProxyStatusChanged`
-- Livewire components subscribe to private team channels via `getListeners()`
-
-### Key Domain Concepts
-- **Server** — A managed host connected via SSH. Has settings, proxy config, and destinations.
-- **Application** — A deployed app (from Git or Docker image) with environment variables, previews, deployment queue.
-- **Service** — A pre-configured service stack from templates (`templates/service-templates-latest.json`).
-- **Standalone Databases** — Individual database instances (Postgres, MySQL, MariaDB, MongoDB, Redis, Clickhouse, KeyDB, Dragonfly).
-- **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
-- **Proxy** — Traefik reverse proxy managed per server.
-
-### Frontend
-- Livewire 3 components with Alpine.js for client-side interactivity
-- Blade templates in `resources/views/livewire/`
-- Tailwind CSS v4 with `@tailwindcss/forms` and `@tailwindcss/typography`
-- Vite for asset bundling
-
-### Laravel 10 Structure (NOT Laravel 11+ slim structure)
-- Middleware in `app/Http/Middleware/` — custom middleware includes `CheckForcePasswordReset`, `DecideWhatToDoWithUser`, `ApiAbility`, `ApiSensitiveData`
-- Kernels: `app/Http/Kernel.php`, `app/Console/Kernel.php`
-- Exception handler: `app/Exceptions/Handler.php`
-- Service providers in `app/Providers/`
-
-## Key Conventions
-
-- Use `php artisan make:*` commands with `--no-interaction` to create files
-- Use Eloquent relationships, avoid `DB::` facade — prefer `Model::query()`
-- PHP 8.4: constructor property promotion, explicit return types, type hints
-- Validation uses inline `Validator` facade in controllers/Livewire components and custom rules in `app/Rules/` — not Form Request classes
-- Run `vendor/bin/pint --dirty --format agent` before finalizing changes
-- Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
-- Check sibling files for conventions before creating new files
-
-## Git Workflow
-
-- Main branch: `v4.x`
-- Development branch: `next`
-- PRs should target `v4.x`
-
-<laravel-boost-guidelines>
-=== foundation rules ===
-
-# Laravel Boost Guidelines
-
-The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
-
-## Foundational Context
-
-This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
-
-- php - 8.5
-- laravel/fortify (FORTIFY) - v1
-- laravel/framework (LARAVEL) - v12
-- laravel/horizon (HORIZON) - v5
-- laravel/nightwatch (NIGHTWATCH) - v1
-- laravel/pail (PAIL) - v1
-- laravel/prompts (PROMPTS) - v0
-- laravel/sanctum (SANCTUM) - v4
-- laravel/socialite (SOCIALITE) - v5
-- livewire/livewire (LIVEWIRE) - v3
-- laravel/boost (BOOST) - v2
-- laravel/dusk (DUSK) - v8
-- laravel/mcp (MCP) - v0
-- laravel/pint (PINT) - v1
-- laravel/telescope (TELESCOPE) - v5
-- pestphp/pest (PEST) - v4
-- phpunit/phpunit (PHPUNIT) - v12
-- rector/rector (RECTOR) - v2
-- laravel-echo (ECHO) - v2
-- tailwindcss (TAILWINDCSS) - v4
-- vue (VUE) - v3
-
-## Skills Activation
-
-This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-- `laravel-best-practices` — Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
-- `configuring-horizon` — Use this skill whenever the user mentions Horizon by name in a Laravel context. Covers the full Horizon lifecycle: installing Horizon (horizon:install, Sail setup), configuring config/horizon.php (supervisor blocks, queue assignments, balancing strategies, minProcesses/maxProcesses), fixing the dashboard (authorization via Gate::define viewHorizon, blank metrics, horizon:snapshot scheduling), and troubleshooting production issues (worker crashes, timeout chain ordering, LongWaitDetected notifications, waits config). Also covers job tagging and silencing. Do not use for generic Laravel queues without Horizon, SQS or database drivers, standalone Redis setup, Linux supervisord, Telescope, or job batching.
-- `socialite-development` — Manages OAuth social authentication with Laravel Socialite. Activate when adding social login providers; configuring OAuth redirect/callback flows; retrieving authenticated user details; customizing scopes or parameters; setting up community providers; testing with Socialite fakes; or when the user mentions social login, OAuth, Socialite, or third-party authentication.
-- `livewire-development` — Use for any task or question involving Livewire. Activate if user mentions Livewire, wire: directives, or Livewire-specific concepts like wire:model, wire:click, invoke this skill. Covers building new components, debugging reactivity issues, real-time form validation, loading states, migrating from Livewire 2 to 3, converting component formats (SFC/MFC/class-based), and performance optimization. Do not use for non-Livewire reactive UI (React, Vue, Alpine-only, Inertia.js) or standard Laravel forms without Livewire.
-- `pest-testing` — Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code.
-- `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS.
-- `fortify-development` — ACTIVATE when the user works on authentication in Laravel. This includes login, registration, password reset, email verification, two-factor authentication (2FA/TOTP/QR codes/recovery codes), profile updates, password confirmation, or any auth-related routes and controllers. Activate when the user mentions Fortify, auth, authentication, login, register, signup, forgot password, verify email, 2FA, or references app/Actions/Fortify/, CreateNewUser, UpdateUserProfileInformation, FortifyServiceProvider, config/fortify.php, or auth guards. Fortify is the frontend-agnostic authentication backend for Laravel that registers all auth routes and controllers. Also activate when building SPA or headless authentication, customizing login redirects, overriding response contracts like LoginResponse, or configuring login throttling. Do NOT activate for Laravel Passport (OAuth2 API tokens), Socialite (OAuth social login), or non-auth Laravel features.
-- `laravel-actions` — Build, refactor, and troubleshoot Laravel Actions using lorisleiva/laravel-actions. Use when implementing reusable action classes (object/controller/job/listener/command), converting service classes/controllers/jobs into actions, orchestrating workflows via faked actions, or debugging action entrypoints and wiring.
-- `debugging-output-and-previewing-html-using-ray` — Use when user says "send to Ray," "show in Ray," "debug in Ray," "log to Ray," "display in Ray," or wants to visualize data, debug output, or show diagrams in the Ray desktop application.
-
-## Conventions
-
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
-- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
-- Check for existing components to reuse before writing a new one.
-
-## Verification Scripts
-
-- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
-
-## Application Structure & Architecture
-
-- Stick to existing directory structure; don't create new base folders without approval.
-- Do not change the application's dependencies without approval.
-
-## Frontend Bundling
-
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
-
-## Documentation Files
-
-- You must only create documentation files if explicitly requested by the user.
-
-## Replies
-
-- Be concise in your explanations - focus on what's important rather than explaining obvious details.
-
-=== boost rules ===
-
-# Laravel Boost
-
-## Tools
-
-- Laravel Boost is an MCP server with tools designed specifically for this application. Prefer Boost tools over manual alternatives like shell commands or file reads.
-- Use `database-query` to run read-only queries against the database instead of writing raw SQL in tinker.
-- Use `database-schema` to inspect table structure before writing migrations or models.
-- Use `get-absolute-url` to resolve the correct scheme, domain, and port for project URLs. Always use this before sharing a URL with the user.
-- Use `browser-logs` to read browser logs, errors, and exceptions. Only recent logs are useful, ignore old entries.
-
-## Searching Documentation (IMPORTANT)
-
-- Always use `search-docs` before making code changes. Do not skip this step. It returns version-specific docs based on installed packages automatically.
-- Pass a `packages` array to scope results when you know which packages are relevant.
-- Use multiple broad, topic-based queries: `['rate limiting', 'routing rate limiting', 'routing']`. Expect the most relevant results first.
-- Do not add package names to queries because package info is already shared. Use `test resource table`, not `filament 4 test resource table`.
-
-### Search Syntax
-
-1. Use words for auto-stemmed AND logic: `rate limit` matches both "rate" AND "limit".
-2. Use `"quoted phrases"` for exact position matching: `"infinite scroll"` requires adjacent words in order.
-3. Combine words and phrases for mixed queries: `middleware "rate limit"`.
-4. Use multiple queries for OR logic: `queries=["authentication", "middleware"]`.
-
-## Artisan
-
-- Run Artisan commands directly via the command line (e.g., `php artisan route:list`). Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters.
-- Inspect routes with `php artisan route:list`. Filter with: `--method=GET`, `--name=users`, `--path=api`, `--except-vendor`, `--only-vendor`.
-- Read configuration values using dot notation: `php artisan config:show app.name`, `php artisan config:show database.default`. Or read config files directly from the `config/` directory.
-- To check environment variables, read the `.env` file directly.
-
-## Tinker
-
-- Execute PHP in app context for debugging and testing code. Do not create models without user approval, prefer tests with factories instead. Prefer existing Artisan commands over custom tinker code.
-- Always use single quotes to prevent shell expansion: `php artisan tinker --execute 'Your::code();'`
-  - Double quotes for PHP strings inside: `php artisan tinker --execute 'User::where("active", true)->count();'`
-
-=== php rules ===
-
-# PHP
-
-- Always use curly braces for control structures, even for single-line bodies.
-- Use PHP 8 constructor property promotion: `public function __construct(public GitHub $github) { }`. Do not leave empty zero-parameter `__construct()` methods unless the constructor is private.
-- Use explicit return type declarations and type hints for all method parameters: `function isAccessible(User $user, ?string $path = null): bool`
-- Use TitleCase for Enum keys: `FavoritePerson`, `BestLake`, `Monthly`.
-- Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic.
-- Use array shape type definitions in PHPDoc blocks.
-
-=== tests rules ===
-
-# Test Enforcement
-
-- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
-- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
-
-=== laravel/core rules ===
-
-# Do Things the Laravel Way
-
-- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using `php artisan list` and check their parameters with `php artisan [command] --help`.
-- If you're creating a generic PHP class, use `php artisan make:class`.
-- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
-
-### Model Creation
-
-- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `php artisan make:model --help` to check the available options.
-
-## APIs & Eloquent Resources
-
-- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
-
-## URL Generation
-
-- When generating links to other pages, prefer named routes and the `route()` function.
-
-## Testing
-
-- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
-- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
-- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
-
-## Vite Error
-
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
-
-=== laravel/v12 rules ===
-
-# Laravel 12
-
-- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
-- This project upgraded from Laravel 10 without migrating to the new streamlined Laravel file structure.
-- This is perfectly fine and recommended by Laravel. Follow the existing structure from Laravel 10. We do not need to migrate to the new Laravel structure unless the user explicitly requests it.
-
-## Laravel 10 Structure
-
-- Middleware typically lives in `app/Http/Middleware/` and service providers in `app/Providers/`.
-- There is no `bootstrap/app.php` application configuration in a Laravel 10 structure:
-    - Middleware registration happens in `app/Http/Kernel.php`
-    - Exception handling is in `app/Exceptions/Handler.php`
-    - Console commands and schedule register in `app/Console/Kernel.php`
-    - Rate limits likely exist in `RouteServiceProvider` or `app/Http/Kernel.php`
-
-## Database
-
-- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
-
-### Models
-
-- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
-
-=== livewire/core rules ===
-
-# Livewire
-
-- Livewire allow to build dynamic, reactive interfaces in PHP without writing JavaScript.
-- You can use Alpine.js for client-side interactions instead of JavaScript frameworks.
-- Keep state server-side so the UI reflects it. Validate and authorize in actions as you would in HTTP requests.
-
-=== pint/core rules ===
-
-# Laravel Pint Code Formatter
-
-- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
-- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
-
-=== pest/core rules ===
-
-## Pest
-
-- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
-- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
-- Do NOT delete tests without approval.
-
-</laravel-boost-guidelines>

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CONTRIBUTING.md

@@ -1,289 +1,231 @@
 # Contributing to Coolify
+We’re happy that you’re interested in contributing to Coolify!
 
-> "First, thanks for considering contributing to my project. It really means a lot!" - [@andrasbacsai](https://github.com/andrasbacsai)
+There are many ways to help:
+- Answer questions in GitHub Discussions or Discord
+- Report reproducible bugs
+- Submit pull requests to fix issues
+- Add new one-click services
+- Improve documentation
 
-You can ask for guidance anytime on our [Discord server](https://coollabs.io/discord) in the `#contribute` channel.
+Coolify is a PaaS used by 400,000+ people worldwide and maintained by two active maintainers. Contributions are welcome — but **alignment matters more than quantity**.
 
-To understand the tech stack, please refer to the [Tech Stack](TECH_STACK.md) document.
+This guide explains **what kind of contributions are likely to be accepted** and how to submit them properly. Following it saves time for both you and the maintainers.
-
-## Table of Contents
-
-1. [Setup Development Environment](#1-setup-development-environment)
-2. [Verify Installation](#2-verify-installation-optional)
-3. [Fork and Setup Local Repository](#3-fork-and-setup-local-repository)
-4. [Set up Environment Variables](#4-set-up-environment-variables)
-5. [Start Coolify](#5-start-coolify)
-6. [Start Development](#6-start-development)
-7. [Create a Pull Request](#7-create-a-pull-request)
-8. [Development Notes](#development-notes)
-9. [Resetting Development Environment](#resetting-development-environment)
-10. [Additional Contribution Guidelines](#additional-contribution-guidelines)
-
-## 1. Setup Development Environment
-
-Follow the steps below for your operating system:
-
-<details>
-<summary><strong>Windows</strong></summary>
-
-1. Install `docker-ce`, Docker Desktop (or similar):
-   - Docker CE (recommended):
-     - Install Windows Subsystem for Linux v2 (WSL2) by following this guide: [Install WSL](https://learn.microsoft.com/en-us/windows/wsl/install?ref=coolify)
-     - After installing WSL2, install Docker CE for your Linux distribution by following this guide: [Install Docker Engine](https://docs.docker.com/engine/install/?ref=coolify)
-     - Make sure to choose the appropriate Linux distribution (e.g., Ubuntu) when following the Docker installation guide
-   - Install Docker Desktop (easier):
-     - Download and install [Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/?ref=coolify)
-     - Ensure WSL2 backend is enabled in Docker Desktop settings
-
-2. Install Spin:
-   - Follow the instructions to install Spin on Windows from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-windows#download-and-install-spin-into-wsl2?ref=coolify)
-
-</details>
-
-<details>
-<summary><strong>MacOS</strong></summary>
-
-1. Install Orbstack, Docker Desktop (or similar):
-   - Orbstack (recommended, as it is a faster and lighter alternative to Docker Desktop):
-     - Download and install [Orbstack](https://docs.orbstack.dev/quick-start#installation?ref=coolify)
-   - Docker Desktop:
-     - Download and install [Docker Desktop for Mac](https://docs.docker.com/desktop/install/mac-install/?ref=coolify)
-
-2. Install Spin:
-   - Follow the instructions to install Spin on MacOS from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-macos/#download-and-install-spin?ref=coolify)
-
-</details>
-
-<details>
-<summary><strong>Linux</strong></summary>
-
-1. Install Docker Engine, Docker Desktop (or similar):
-   - Docker Engine (recommended, as there is no VM overhead):
-     - Follow the official [Docker Engine installation guide](https://docs.docker.com/engine/install/?ref=coolify) for your Linux distribution
-   - Docker Desktop:
-     - If you want a GUI, you can use [Docker Desktop for Linux](https://docs.docker.com/desktop/install/linux-install/?ref=coolify)
-
-2. Install Spin:
-   - Follow the instructions to install Spin on Linux from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-linux#configure-docker-permissions?ref=coolify)
-
-</details>
-
-## 2. Verify Installation (Optional)
-
-After installing Docker (or Orbstack) and Spin, verify the installation:
-
-1. Open a terminal or command prompt
-2. Run the following commands:
-   ```bash
-   docker --version
-   spin --version
-   ```
-   You should see version information for both Docker and Spin.
-
-## 3. Fork and Setup Local Repository
-
-1. Fork the [Coolify](https://github.com/coollabsio/coolify) repository to your GitHub account.
-
-2. Install a code editor on your machine (choose one):
-
-   | Editor | Platform | Download Link |
-   |--------|----------|---------------|
-   | Visual Studio Code (recommended free) | Windows/macOS/Linux | [Download](https://code.visualstudio.com/download?ref=coolify) |
-   | Cursor (recommended but paid) | Windows/macOS/Linux | [Download](https://www.cursor.com/?ref=coolify) |
-   | Zed (very fast) | macOS/Linux | [Download](https://zed.dev/download?ref=coolify) |
-
-3. Clone the Coolify Repository from your fork to your local machine
-   - Use `git clone` in the command line, or
-   - Use GitHub Desktop (recommended):
-     - Download and install from [https://desktop.github.com/](https://desktop.github.com/?ref=coolify)
-     - Open GitHub Desktop and login with your GitHub account
-     - Click on `File` -> `Clone Repository` select `github.com` as the repository location, then select your forked Coolify repository, choose the local path and then click `Clone`
-
-4. Open the cloned Coolify Repository in your chosen code editor.
-
-## 4. Set up Environment Variables
-
-1. In the Code Editor, locate the `.env.development.example` file in the root directory of your local Coolify repository.
-2. Duplicate the `.env.development.example` file and rename the copy to `.env`.
-3. Open the new `.env` file and review its contents. Adjust any environment variables as needed for your development setup.
-4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `spin up`.
-5. Save the changes to your `.env` file.
-
-## 5. Start Coolify
-
-1. Open a terminal in the local Coolify directory.
-2. Run the following command in the terminal (leave that terminal open):
-   ```bash
-   spin up
-   ```
-
-> [!NOTE]
-> You may see some errors, but don't worry; this is expected.
-
-3. If you encounter permission errors, especially on macOS, use:
-   ```bash
-   sudo spin up
-   ```
-
-> [!NOTE]
-> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `spin up` again.
-
-## 6. Start Development
-
-1. Access your Coolify instance:
-   - URL: `http://localhost:8000`
-   - Login: `test@example.com`
-   - Password: `password`
-
-2. Additional development tools:
-
-   | Tool | URL | Note |
-   |------|-----|------|
-   | Laravel Horizon (scheduler) | `http://localhost:8000/horizon` | Only accessible when logged in as root user |
-   | Mailpit (email catcher) | `http://localhost:8025` | |
-   | Telescope (debugging tool) | `http://localhost:8000/telescope` | Disabled by default |
-
-> [!NOTE]
-> To enable Telescope, add the following to your `.env` file:
-> ```env
-> TELESCOPE_ENABLED=true
-> ```
-
-## 7. Create a Pull Request
 
 > [!IMPORTANT]
-> Please read the [Pull Request Guidelines](#pull-request-guidelines) carefully before creating your PR.
+> These guidelines may feel stricter than in many open-source projects. That is intentional.
+> Clear structure and boundaries prevent maintainer burnout and keep the project sustainable long-term.
 
-1. After making changes or adding a new service:
-    - Commit your changes to your forked repository.
-    - Push the changes to your GitHub account.
 
-2. Creating the Pull Request (PR):
+## High-Level Expectations
-    - Navigate to the main Coolify repository on GitHub.
+- Coolify has a clear product direction.
-    - Click the "Pull requests" tab.
+- Ownership and decisions are centralized.
-    - Click the green "New pull request" button.
+- Review capacity is limited.
-    - Choose your fork and `next` branch as the compare branch.
+- Not every contribution will be accepted — even if technically correct.
-    - Click "Create pull request".
 
-3. Filling out the PR details:
+This is normal for a two-maintainer project.
-    - Give your PR a descriptive title.
-    - Use the Pull Request Template provided and fill in the details.
 
-> [!IMPORTANT]
-> Always set the base branch for your PR to the `next` branch of the Coolify repository, not the `v4.x` branch.
 
-4. Submit your PR:
+## State of the Project
-    - Review your changes one last time.
+Coolify is currently at v4. While v4 is stable, it has some limitations, including:
-    - Click "Create pull request" to submit.
+- Limited scaling support
+- A more complex user experience
+- Other smaller issues that need refinement
 
-> [!NOTE]
+These limitations will be addressed in Coolify v5, which is in the planning stage. Because of this, major features, architectural changes, or significant UI changes will not be accepted for v4 at this stage.
-> Make sure your PR is out of draft mode as soon as it's ready for review. PRs that are in draft mode for a long time may be closed by maintainers.
 
-After submission, maintainers will review your PR and may request changes or provide feedback.
+We welcome contributions that help stabilize v4 for a bug free experience.
 
-#### Pull Request Guidelines
-To maintain high-quality contributions and efficient review process:
-- **Target Branch**: Always target the `next` branch, never `v4.x` or any other branch. PRs targeting incorrect branches will be closed without review.
-- **Descriptive Titles**: Use clear, concise PR titles that describe the change (e.g., "fix: one click postgresql database stuck in restart loop" instead of "Fix database").
-- **PR Descriptions**: Provide detailed, meaningful descriptions. Avoid generic or AI-generated fluff. Include:
-  - What the change does
-  - Why it's needed
-  - How to test it
-  - Any breaking changes
-  - Screenshot or video recording of your changes working without any issues
-  - Links to related issues
-- **Link to Issues**: All PRs must link to an existing GitHub issue. If no issue exists, create one first. Unrelated PRs may be closed.
-- **Single Responsibility**: Each PR should address one issue or feature. Do not bundle unrelated changes.
-- **Draft Mode**: Use draft PRs for work-in-progress. Convert to ready-for-review only when complete and tested.
-- **Review Readiness**: Ensure your PR is ready for review within a reasonable timeframe (max 7 days in draft). Stale drafts may be closed.
-- **Current Focus**: We are currently prioritizing stability and bug fixes over new features. PRs adding new features may not be reviewed, or may be closed without review to maintain focus.
-- **Language Translations**: Coolify currently supports only English. Pull requests for new language translations will not be accepted. Multi-language support may be considered in the next major version (v5).
-- **AI Usage Policy**: We are not against AI tools—we use them ourselves. However, AI discourse is mandatory: You must fully understand the changes in your PR and be able to explain them clearly. Many PRs using AI lack this understanding, leading to untested or incorrect submissions. If you use AI, ensure you can articulate what the code does, why it was changed, and how it was tested.
 
-#### Review Process
+## What Makes a Strong Contribution
-- **Response Time**: Maintainers will review PRs promptly, but complex changes may take time. Be patient and responsive to feedback.
+The following types of contributions are most likely to be accepted:
-- **Revisions**: Address all review comments. Unresolved feedback may lead to PR closure.
-- **Merge Criteria**: PRs are merged only after:
-  - All tests pass (including CI)
-  - Code review approval
-- **Closing PRs**: PRs may be closed for:
-  - Inactivity (>7 days without response)
-  - Failure to meet guidelines
-  - Duplicate or superseded work
-  - Security or quality concerns
 
 #### Code Quality and Testing
 All contributions must adhere to the highest standards of code quality and testing:
 
-- **Testing Required**: Every PR must include steps to test your changes. Untested code will not be reviewed or merged.
+If your change is small and obvious (typo fix, small bug, minor docs update), you may open a pull request directly.
-- **Local Verification**: Ensure your changes work in the development environment. Test all affected features thoroughly.
-- **Code Standards**: Follow the existing code style, conventions, and patterns in the codebase.
-- **No AI-Generated Code**: Do not submit code generated by AI tools without fully understanding and verifying it. AI-generated submissions that are untested or incorrect will be rejected immediately.
 
 
-## Development Notes
+If you are fixing a bug in `file.yaml`, do not:
+- Reformat unrelated files
+- Refactor unrelated code
+- Fix style issues elsewhere
+- Combine multiple unrelated changes
 
-When working on Coolify, keep the following in mind:
+Even “improvements” increase review complexity.
 
-1. **Database Migrations**: After switching branches or making changes to the database structure, always run migrations:
+**One pull request = one logical change.**
-   ```bash
-   docker exec -it coolify php artisan migrate
-   ```
 
-2. **Resetting Development Setup**: To reset your development setup to a clean database with default values:
+If you want to refactor or clean up code, discuss it first and submit it separately.
-   ```bash
-   docker exec -it coolify php artisan migrate:fresh --seed
-   ```
 
-3. **Troubleshooting**: If you encounter unexpected behavior, ensure your database is up-to-date with the latest migrations and if possible reset the development setup to eliminate any environment-specific issues.
 
-> [!IMPORTANT]
+## Discussion Is Required for Larger Changes
-> Forgetting to migrate the database can cause problems, so make it a habit to run migrations after pulling changes or switching branches.
+For anything beyond a small fix, you must discuss it before opening a pull request.
 
-## Resetting Development Environment
+This includes:
+- New features
+- UI/UX changes
+- Changes to default behavior
+- Refactors or cleanup work
+- Performance rewrites
+- Architectural changes
+- Changes touching many files
 
-If you encounter issues or break your database or something else, follow these steps to start from a clean slate (works since `v4.0.0-beta.342`):
+Discussion happens in GitHub Discussions: https://github.com/coollabsio/coolify/discussions/categories/general
 
-1. Stop all running containers `ctrl + c`.
+Pull requests introducing major changes without prior discussion will be closed without review.
 
-2. Remove all Coolify containers:
+This ensures alignment before significant work is done.
-   ```bash
-   docker rm coolify coolify-db coolify-redis coolify-realtime coolify-testing-host coolify-minio coolify-vite-1 coolify-mail
-   ```
 
-3. Remove Coolify volumes (it is possible that the volumes have no `coolify` prefix on your machine, in that case remove the prefix from the command):
-   ```bash
-   docker volume rm coolify_dev_backups_data coolify_dev_postgres_data coolify_dev_redis_data coolify_dev_coolify_data coolify_dev_minio_data
-   ```
 
-4. Remove unused images:
+## What This Project Is Not
-   ```bash
+To set clear expectations:
-   docker image prune -a
+- Coolify is not optimized for first-time open-source contributors
-   ```
+- We do not provide beginner-focused mentorship issues
+- Large unsolicited changes are unlikely to be accepted
+- Broad refactors or style rewrites are not helpful
+- Low-effort AI-generated pull requests will be closed
 
-5. Start Coolify again:
+AI usage is allowed. However, contributors must fully understand what their changes do and why.
-   ```bash
-   spin up
-   ```
 
-6. Run database migrations and seeders:
+Clear expectations help everyone use their time effectively.
-   ```bash
-   docker exec -it coolify php artisan migrate:fresh --seed
-   ```
 
-After completing these steps, you'll have a fresh development setup.
 
-> [!IMPORTANT]
+# Ways to Contribute
-> Always run database migrations and seeders after switching branches or pulling updates to ensure your local database structure matches the current codebase and includes necessary seed data.
+## 1. Support Contributions
+We use Discord for most support requests and GitHub Discussions for help.
 
-## Additional Contribution Guidelines
+### Requesting Support
+If you need help:
+- Provide complete and detailed information
+- Include logs, screenshots, and steps to reproduce
+- Be respectful — support is voluntary
 
-### Contributing a New Service
+Do not ping people for attention. They respond when available.
 
-To add a new service to Coolify, please refer to our documentation:
+### Providing Support
-[Adding a New Service](https://coolify.io/docs/get-started/contribute/service)
+If you help others:
+- Verify your information before sharing
+- Be patient and respectful
+- Remember that not everyone has the same experience level
 
-### Contributing to Documentation
 
-To contribute to the Coolify documentation, please refer to this guide:
+## 2. Bug Report Contributions
-[Contributing to the Coolify Documentation](https://github.com/coollabsio/documentation-coolify/blob/main/readme.md)
+Create a GitHub issue **only** if:
+- The bug is reproducible
+- You have confirmed no existing issue already covers it
+
+For questions or general help, use GitHub Discussions or the Discord support channel.
+
+Bug reports must include:
+- Clear reproduction steps
+- Expected result
+- Actual result
+
+Incomplete reports and reports generated using AI may be closed.
+
+
+## 3. Code Contributions
+Maintainers may close pull requests at their discretion, without explanation.
+
+### Issue Requirement
+Every pull request should reference and close an Issue or Discussion.
+
+If none exists, create one first.
+
+Pull requests without linked issue or discussions may not be reviewed and can be closed at any time.
+
+
+## Commit Message Format
+All commits must start with an action and category:
+- `fix(ui):` — UI-related fixes
+- `feat(api):` — API-related changes
+- `feat(service):` — One-click service changes
+
+Examples:
+- `fix(api): version endpoint returns wrong data`
+- `feat(service): add supabase`
+
+Use the commit description only for concise context.
+
+Walls of text listing every change in description will be rejected.
+
+
+## Pull Request Title Format
+Pull request titles follow the same format:
+- `fix(ui):`
+- `feat(api):`
+- `feat(service):`
+
+Examples:
+- `fix(api): version endpoint returns wrong data`
+- `feat(service): add supabase`
+
+
+## AI Usage Disclosure
+If AI tools were used at any stage, mention it in the pull request description.
+
+AI is allowed.
+
+However:
+- You must understand every change
+- You must verify correctness
+- You must ensure it follows project patterns
+
+AI-generated pull requests without clear understanding will be closed.
+
+
+## Test Before Submitting
+Before submitting a pull request:
+- Manually test your changes thoroughly
+- Verify they work in a clean environment
+- Provide detailed testing steps in the PR description
+
+If maintainers cannot reproduce working behavior, the PR will be closed without further review.
+
+
+## Submitting a Pull Request
+- GitHub will auto-populate the PR template
+- The contributor agreement in PR description must remain intact
+- Pull requests without the contributor agreement will be closed
+- All pull requests must target the `next` branch
+- PRs targeting other branches will be closed without review
+
+
+## FAQ
+**Q: Should I ask before fixing a typo or a small bug?**  
+A: No, small, obvious fixes like typos or narrowly-scoped bug fixes can be submitted as a PR directly.
+
+**Q: I have an idea for a new feature.**  
+A: Awesome! Discuss it first in GitHub Discussions or Discord. **Do not** open a PR for new features without prior alignment.
+
+**Q: My PR was closed without detailed feedback.**  
+A: This usually means it didn’t align with the project’s direction, required more review bandwidth than available, or targeted major changes not allowed in v4. 
+
+**Q: Can I work on an open issue?**  
+A: Comment on the issue first to confirm it’s still relevant and that no one else is actively working on it. For anything beyond a small fix, discuss your approach before implementing.
+
+**Q: I noticed code that could be cleaned up while working on my change.**  
+A: Focus only on your stated goal. Cleanups or refactors should be submitted as separate PRs after discussion.
+
+**Q: Can I use AI to help with my PR?**  
+A: Yes, AI-assisted contributions are allowed. But you must fully understand and verify the changes. PRs that appear to be generated by AI without context understanding will be closed.
+
+**Q: My PR was closed without review. Can I submit a new one?**  
+A: Yes, but keep in mind a PR closure is feedback, not a rejection of your effort. It usually means the PR didn’t match the project goals or guidelines. Address these issues first — repeating the same approach may hurt your standing with maintainers.
+
+
+# Development Guides
+## Local Development
+To build and run Coolify locally, see: [Development](./DEVELOPMENT.md)
+
+### macOS Development with Lima
+Mac users can use [Lima](https://lima-vm.io/) to run a lightweight Linux virtual machine for local Coolify development. This is useful if you prefer a Linux-based Docker environment on macOS.
+
+After creating and starting a Lima VM, run the normal local development commands from inside the VM as described in [Development](./DEVELOPMENT.md).
+
+## Adding a New Service
+To add a new one-click service, follow: https://coolify.io/docs/get-started/contribute/service
+
+## Contributing to Documentation
+To contribute to documentation, see: https://coolify.io/docs/get-started/contribute/documentation

DEVELOPMENT.md

@@ -0,0 +1,212 @@
+# Contributing to Coolify
+> "First, thanks for considering contributing to my project. It really means a lot!" - [@andrasbacsai](https://github.com/andrasbacsai)
+
+You can ask for guidance anytime on our [Discord server](https://coollabs.io/discord) in the `#contribute` channel.
+
+To understand the tech stack, please refer to the [Tech Stack](TECH_STACK.md) document.
+
+
+## Table of Contents
+1. [Setup Development Environment](#1-setup-development-environment)
+2. [Verify Installation](#2-verify-installation-optional)
+3. [Fork and Setup Local Repository](#3-fork-and-setup-local-repository)
+4. [Set up Environment Variables](#4-set-up-environment-variables)
+5. [Start Coolify](#5-start-coolify)
+6. [Start Development](#6-start-development)
+7. [Create a Pull Request](#7-create-a-pull-request)
+8. [Development Notes](#development-notes)
+9. [Resetting Development Environment](#resetting-development-environment)
+10. [Additional Contribution Guidelines](#additional-contribution-guidelines)
+
+
+## 1. Setup Development Environment
+Follow the steps below for your operating system:
+
+<details>
+<summary><strong>Windows</strong></summary>
+
+1. Install `docker-ce`, Docker Desktop (or similar):
+   - Docker CE (recommended):
+     - Install Windows Subsystem for Linux v2 (WSL2) by following this guide: [Install WSL](https://learn.microsoft.com/en-us/windows/wsl/install?ref=coolify)
+     - After installing WSL2, install Docker CE for your Linux distribution by following this guide: [Install Docker Engine](https://docs.docker.com/engine/install/?ref=coolify)
+     - Make sure to choose the appropriate Linux distribution (e.g., Ubuntu) when following the Docker installation guide
+   - Install Docker Desktop (easier):
+     - Download and install [Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/?ref=coolify)
+     - Ensure WSL2 backend is enabled in Docker Desktop settings
+
+2. Install Spin:
+   - Follow the instructions to install Spin on Windows from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-windows#download-and-install-spin-into-wsl2?ref=coolify)
+
+</details>
+
+<details>
+<summary><strong>MacOS</strong></summary>
+
+1. Install Orbstack, Docker Desktop (or similar):
+   - Orbstack (recommended, as it is a faster and lighter alternative to Docker Desktop):
+     - Download and install [Orbstack](https://docs.orbstack.dev/quick-start#installation?ref=coolify)
+   - Docker Desktop:
+     - Download and install [Docker Desktop for Mac](https://docs.docker.com/desktop/install/mac-install/?ref=coolify)
+
+2. Install Spin:
+   - Follow the instructions to install Spin on MacOS from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-macos/#download-and-install-spin?ref=coolify)
+
+</details>
+
+<details>
+<summary><strong>Linux</strong></summary>
+
+1. Install Docker Engine, Docker Desktop (or similar):
+   - Docker Engine (recommended, as there is no VM overhead):
+     - Follow the official [Docker Engine installation guide](https://docs.docker.com/engine/install/?ref=coolify) for your Linux distribution
+   - Docker Desktop:
+     - If you want a GUI, you can use [Docker Desktop for Linux](https://docs.docker.com/desktop/install/linux-install/?ref=coolify)
+
+2. Install Spin:
+   - Follow the instructions to install Spin on Linux from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-linux#configure-docker-permissions?ref=coolify)
+
+</details>
+
+
+## 2. Verify Installation (Optional)
+After installing Docker (or Orbstack) and Spin, verify the installation:
+
+1. Open a terminal or command prompt
+2. Run the following commands:
+   ```bash
+   docker --version
+   spin --version
+   ```
+   You should see version information for both Docker and Spin.
+
+
+## 3. Fork and Setup Local Repository
+1. Fork the [Coolify](https://github.com/coollabsio/coolify) repository to your GitHub account.
+
+2. Install a code editor on your machine (choose one):
+
+   | Editor | Platform | Download Link |
+   |--------|----------|---------------|
+   | Visual Studio Code (recommended free) | Windows/macOS/Linux | [Download](https://code.visualstudio.com/download?ref=coolify) |
+   | Cursor (recommended but paid) | Windows/macOS/Linux | [Download](https://www.cursor.com/?ref=coolify) |
+   | Zed (very fast) | Windows/macOS/Linux | [Download](https://zed.dev/download?ref=coolify) |
+
+3. Clone the Coolify Repository from your fork to your local machine
+   - Use `git clone` in the command line, or
+   - Use GitHub Desktop (recommended):
+     - Download and install from [https://desktop.github.com/](https://desktop.github.com/?ref=coolify)
+     - Open GitHub Desktop and login with your GitHub account
+     - Click on `File` -> `Clone Repository` select `github.com` as the repository location, then select your forked Coolify repository, choose the local path and then click `Clone`
+
+4. Open the cloned Coolify Repository in your chosen code editor.
+
+
+## 4. Set up Environment Variables
+1. In the Code Editor, locate the `.env.development.example` file in the root directory of your local Coolify repository.
+2. Duplicate the `.env.development.example` file and rename the copy to `.env`.
+3. Open the new `.env` file and review its contents. Adjust any environment variables as needed for your development setup.
+4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `spin up`.
+5. Save the changes to your `.env` file.
+
+
+## 5. Start Coolify
+1. Open a terminal in the local Coolify directory.
+2. Run the following command in the terminal (leave that terminal open):
+   ```bash
+   spin up
+   ```
+
+> [!NOTE]
+> You may see some errors, but don't worry; this is expected.
+
+3. If you encounter permission errors, especially on macOS, use:
+   ```bash
+   sudo spin up
+   ```
+
+> [!NOTE]
+> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `spin up` again.
+
+
+## 6. Start Development
+1. Access your Coolify instance:
+   - URL: `http://localhost:8000`
+   - Login: `test@example.com`
+   - Password: `password`
+
+2. Additional development tools:
+
+   | Tool | URL | Note |
+   |------|-----|------|
+   | Laravel Horizon (scheduler) | `http://localhost:8000/horizon` | Only accessible when logged in as root user |
+   | Mailpit (email catcher) | `http://localhost:8025` | |
+   | Telescope (debugging tool) | `http://localhost:8000/telescope` | Disabled by default |
+
+> [!NOTE]
+> To enable Telescope, add the following to your `.env` file:
+> ```env
+> TELESCOPE_ENABLED=true
+> ```
+
+
+## Development Notes
+When working on Coolify, keep the following in mind:
+
+1. **Database Migrations**: After switching branches or making changes to the database structure, always run migrations:
+   ```bash
+   docker exec -it coolify php artisan migrate
+   ```
+
+2. **Resetting Development Setup**: To reset your development setup to a clean database with default values:
+   ```bash
+   docker exec -it coolify php artisan migrate:fresh --seed
+   ```
+
+3. **Troubleshooting**: If you encounter unexpected behavior, ensure your database is up-to-date with the latest migrations and if possible reset the development setup to eliminate any environment-specific issues.
+
+> [!IMPORTANT]
+> Forgetting to migrate the database can cause problems, so make it a habit to run migrations after pulling changes or switching branches.
+
+
+## Resetting Development Environment
+If you encounter issues or break your database or something else, follow these steps to start from a clean slate (works since `v4.0.0-beta.342`):
+
+1. Stop all running containers `ctrl + c`.
+
+2. Remove all Coolify containers:
+   ```bash
+   docker rm coolify coolify-db coolify-redis coolify-realtime coolify-testing-host coolify-minio coolify-vite-1 coolify-mail
+   ```
+
+3. Remove Coolify volumes (it is possible that the volumes have no `coolify` prefix on your machine, in that case remove the prefix from the command):
+   ```bash
+   docker volume rm coolify_dev_backups_data coolify_dev_postgres_data coolify_dev_redis_data coolify_dev_coolify_data coolify_dev_minio_data
+   ```
+
+4. Remove unused images:
+   ```bash
+   docker image prune -a
+   ```
+
+5. Start Coolify again:
+   ```bash
+   spin up
+   ```
+
+6. Run database migrations and seeders:
+   ```bash
+   docker exec -it coolify php artisan migrate:fresh --seed
+   ```
+
+After completing these steps, you'll have a fresh development setup.
+
+> [!IMPORTANT]
+> Always run database migrations and seeders after switching branches or pulling updates to ensure your local database structure matches the current codebase and includes necessary seed data.
+
+
+## Additional Development Guidelines
+### Adding a New Service
+To add a new service to Coolify, please refer to our documentation: [Adding a New Service](https://coolify.io/docs/get-started/contribute/service)
+
+### Development for Documentation
+To contribute to the Coolify documentation, please refer to this guide: [Contributing to the Coolify Documentation](https://coolify.io/docs/get-started/contribute/documentation)

README.md

@@ -57,106 +57,95 @@ ## Donations
 
 ### Huge Sponsors
 
-* [MVPS](https://www.mvps.net?ref=coolify.io) - Cheap VPS servers at the highest possible quality
+* [Context.dev](https://www.context.dev/) - Web scraping API for AI agents
-* [SerpAPI](https://serpapi.com?ref=coolify.io) - Google Search API — Scrape Google and other search engines from our fast, easy, and complete API
+* [SerpAPI](https://serpapi.com) - Google Search API — Scrape Google and other search engines from our fast, easy, and complete API.
-* [Seibert Group](https://seibert.link/coolifysoftware?ref=coolify.io) - Boost productivity company-wide with AI agents like Claude Code
+* [MVPS](https://www.mvps.net) - Cheap VPS servers at the highest possible quality
-* [ScreenshotOne](https://screenshotone.com?ref=coolify.io) - Screenshot API for devs
+* [ScreenshotOne](https://screenshotone.com) - Screenshot API for devs
-* [PrivateAlps](https://privatealps.net?ref=coolify.io) - Cloud Services Provider, VPS, servers infrastructure for people who care about privacy and control
+* [PrivateAlps](https://privatealps.net) - Cloud Services Provider, VPS, servers infrastructure for people who care about privacy and control
+* [Seibert Group](https://seibert.link/coolifysoftware) - Boost productivity company-wide with AI agents like Claude Code
+* [Contabo](https://contabo.com/en/coolify-vps/) - Cloud VPS & dedicated servers at unbeatable prices
 
 ### Big Sponsors
 
-* [23M](https://23m.com?ref=coolify.io) - Your experts for high-availability hosting solutions!
+* [Cloudways](https://www.cloudways.com/en/?id=2125302) - Managed cloud hosting platform by DigitalOcean
-* [American Cloud](https://americancloud.com?ref=coolify.io) - US-based cloud infrastructure services
+* [ByteBase](https://www.bytebase.com) - Database CI/CD and Security at Scale
-* [Arcjet](https://arcjet.com?ref=coolify.io) - Advanced web security and performance solutions
+* [Ramnode](https://ramnode.com/) - High Performance Cloud VPS Hosting
-* [BC Direct](https://bc.direct?ref=coolify.io) - Your trusted technology consulting partner
+* [23M](https://23m.com) - Your experts for high-availability hosting solutions!
-* [Blacksmith](https://blacksmith.sh?ref=coolify.io) - Infrastructure automation platform
+* [Macarne](https://macarne.com) - Best IP Transit & Carrier Ethernet Solutions for Simplified Network Connectivity
-* [Capture.page](https://capture.page/?ref=coolify.io) - Fast & Reliable Screenshot API for Developers
-* [ByteBase](https://www.bytebase.com?ref=coolify.io) - Database CI/CD and Security at Scale
-* [CodeRabbit](https://coderabbit.ai?ref=coolify.io) - Cut Code Review Time & Bugs in Half
-* [COMIT](https://comit.international?ref=coolify.io) - New York Times award–winning contractor
-* [CompAI](https://www.trycomp.ai?ref=coolify.io) - Open source compliance automation platform
-* [Convex](https://convex.link/coolify.io) - Open-source reactive database for web app developers
-* [Darweb](https://darweb.nl/?ref=coolify.io) - 3D CPQ solutions for ecommerce design
-* [Dataforest Cloud](https://cloud.dataforest.net/en?ref=coolify.io) - Deploy cloud servers as seeds independently in seconds. Enterprise hardware, premium network, 100% made in Germany.
-* [Formbricks](https://formbricks.com?ref=coolify.io) - The open source feedback platform
-* [GoldenVM](https://billing.goldenvm.com?ref=coolify.io) - Premium virtual machine hosting solutions
-* [Greptile](https://www.greptile.com?ref=coolify.io) - The AI Code Reviewer
 * [Hetzner](http://htznr.li/CoolifyXHetzner) - Server, cloud, hosting, and data center solutions
-* [Hostinger](https://www.hostinger.com/vps/coolify-hosting?ref=coolify.io) - Web hosting and VPS solutions
+* [Logto](https://logto.io) - The better identity infrastructure for developers
-* [JobsCollider](https://jobscollider.com/remote-jobs?ref=coolify.io) - 30,000+ remote jobs for developers
+* [Supadata](https://supadata.ai/) - Scrape YouTube, web, and files. Get AI-ready, clean data for your next project. 
-* [Juxtdigital](https://juxtdigital.com?ref=coolify.io) - Digital PR & AI Authority Building Agency
+* [Tolgee](https://tolgee.io) - The open source localization platform
-* [LiquidWeb](https://liquidweb.com?ref=coolify.io) - Premium managed hosting solutions
+* [Best Consultant](https://bc.direct) - Your trusted technology consulting partner
-* [Logto](https://logto.io?ref=coolify.io) - The better identity infrastructure for developers
+* [ArcJet](https://arcjet.com) - Advanced web security and performance solutions
-* [LumaDock](https://lumadock.com/vps-hosting/coolify?utm_source=coolify&utm_medium=sponsorship&utm_campaign=coolify_oss_sponsor_2026&utm_content=github_readme) - Fast and reliable virtual server hosting
+* [SupaGuide](https://supa.guide) - Your comprehensive guide to Supabase
-* [Macarne](https://macarne.com?ref=coolify.io) - Best IP Transit & Carrier Ethernet Solutions for Simplified Network Connectivity
+* [CodeRabbit](https://coderabbit.ai) - Cut Code Review Time & Bugs in Half
-* [Mobb](https://vibe.mobb.ai/?ref=coolify.io) - Secure Your AI-Generated Code to Unlock Dev Productivity
+* [Convex](https://convex.link/coolify.io) - Convex is the open-source reactive database for web app developers.
-* [PetroSky Cloud](https://petrosky.io?ref=coolify.io) - Open source cloud deployment solutions
+* [GoldenVM](https://billing.goldenvm.com) - Premium virtual machine hosting solutions
-* [PFGLabs](https://pfglabs.com?ref=coolify.io) - Build Real Projects with Golang
+* [Comit International](https://comit.international) - New York Times award–winning contractor!
-* [Ramnode](https://ramnode.com/?ref=coolify.io) - High Performance Cloud VPS Hosting
+* [Compai](https://www.trycomp.ai) - The open source compliance automation platform that does everything you need to get compliant, fast. Open source alternative to Drata & Vanta.
-* [SaasyKit](https://saasykit.com?ref=coolify.io) - Complete SaaS starter kit for developers
+* [Tigris](https://www.tigrisdata.com) - Modern S3 Alternative
-* [SupaGuide](https://supa.guide?ref=coolify.io) - Your comprehensive guide to Supabase
+* [Blacksmith](https://blacksmith.sh) - Infrastructure automation platform
-* [Supadata AI](https://supadata.ai/?ref=coolify.io) - Scrape YouTube, web, and files. Get AI-ready, clean data
+* [JobsCollider](https://jobscollider.com/remote-jobs) - 30,000+ remote jobs for developers
-* [Syntax.fm](https://syntax.fm?ref=coolify.io) - Podcast for web developers
+* [Darweb](https://darweb.nl/?ref=coolify.io&utm_source=coolify.io) - Design. Develop. Deliver. Specialized in 3D CPQ Solutions for eCommerce.
-* [Tigris](https://www.tigrisdata.com?ref=coolify.io) - Modern developer data platform
+* [Hostinger](https://www.hostinger.com/vps/coolify-hosting) - Web hosting and VPS solutions
-* [Tolgee](https://tolgee.io?ref=coolify.io) - The open source localization platform
+* [Mobb](https://vibe.mobb.ai/) - Secure Your AI-Generated Code to Unlock Dev Productivity
-* [Ubicloud](https://www.ubicloud.com?ref=coolify.io) - Open source cloud infrastructure platform
+* [Ubicloud](https://www.ubicloud.com) - Open source cloud infrastructure platform
-* [VPSDime](https://vpsdime.com?ref=coolify.io) - Affordable high-performance VPS hosting solutions
+* [PFGLabs](https://pfglabs.com) - Build Real Projects with Golang
-
+* [JuxtDigital](https://juxtdigital.com) - Digital PR & AI Authority Building Agency
+* [SaasyKit](https://saasykit.com) - Complete SaaS starter kit for developers
+* [American Cloud](https://americancloud.com) - US-based cloud infrastructure services
+* [LiquidWeb](https://liquidweb.com) - Premium managed hosting solutions
+* [Greptile](https://www.greptile.com) - The AI Code Reviewer
+* [VPSDime](https://vpsdime.com/) - Cheap VPS Hosting - 4GB for $5/month
+* [dataforest Cloud](https://cloud.dataforest.net/en) - Deploy cloud servers as seeds independently in seconds. Enterprise hardware, premium network, 100% made in Germany.
+* [ISHosting](https://ishosting.com/) - Hosting and VPS solutions
+* [PetroSky Cloud](https://petrosky.io) - Open source cloud deployment solutions
+* [QuickSrv](https://quicksrv.io/) - Fast and reliable server hosting
 
 ### Small Sponsors
 
-<a href="https://open-elements.com/?utm_source=coolify.io"><img width="60px" alt="OpenElements" src="https://github.com/OpenElements.png"/></a>
+<a href="https://www.movavi.com/mac.html?utm_source=coolify.io"><img width="60px" alt="Movavi" src="https://cdn.coollabs.io/sponsors/movavi.png"/></a>
-<a href="https://xaman.app/?utm_source=coolify.io"><img width="60px" alt="XamanApp" src="https://github.com/XamanApp.png"/></a>
+<a href="https://usefoil.com/"><img width="60px" alt="ABXY" src="https://usefoil.com/favicon.svg"/></a>
-<a href="https://www.uxwizz.com/?utm_source=coolify.io"><img width="60px" alt="UXWizz" src="https://github.com/UXWizz.png"/></a>
+<a href="https://www.launchfa.st/?utm_source=coolify.io"><img width="60px" alt="LaunchFast Boilerplates" src="https://github.com/LaunchFast-Boilerplates.png"/></a>
-<a href="https://evercam.io/?utm_source=coolify.io"><img width="60px" alt="Evercam" src="https://github.com/evercam.png"/></a>
+<a href="https://vanaways.co.uk/?utm_source=coolify.io"><img width="60px" alt="Vanaways" src="https://github.com/Vanaways.png"/></a>
-<a href="https://github.com/iujlaki"><img width="60px" alt="Imre Ujlaki" src="https://github.com/iujlaki.png"/></a>
+<a href="https://www.netrouting.com/?utm_source=coolify.io"><img width="60px" alt="Netrouting" src="https://github.com/netroutingcom.png"/></a>
-<a href="https://bsky.app/profile/jyc.dev"><img width="60px" alt="jyc.dev" src="https://github.com/jycouet.png"/></a>
+<a href="https://github.com/mindedtech"><img width="60px" alt="MindEd Tech" src="https://github.com/mindedtech.png"/></a>
-<a href="https://github.com/therealjp?utm_source=coolify.io"><img width="60px" alt="TheRealJP" src="https://github.com/therealjp.png"/></a>
-<a href="https://360creators.com/?utm_source=coolify.io"><img width="60px" alt="360Creators" src="https://opencollective-production.s3.us-west-1.amazonaws.com/account-avatar/503e0953-bff7-4296-b4cc-5e36d40eecc0/icon-360creators.png"/></a>
-<a href="https://github.com/aniftyco"><img width="60px" alt="NiftyCo" src="https://github.com/aniftyco.png"/></a>
-<a href="https://dry.software/?utm_source=coolify.io"><img width="60px" alt="Dry Software" src="https://github.com/dry-software.png"/></a>
-<a href="https://lightspeed.run/?utm_source=coolify.io"><img width="60px" alt="Lightspeed.run" src="https://github.com/lightspeedrun.png"/></a>
-<a href="https://linkdr.com?utm_source=coolify.io"><img width="60px" alt="LinkDr" src="https://github.com/LLM-Inc.png"/></a>
-<a href="http://gravitywiz.com/?utm_source=coolify.io"><img width="60px" alt="Gravity Wiz" src="https://github.com/gravitywiz.png"/></a>
-<a href="https://bitlaunch.io/?utm_source=coolify.io"><img width="60px" alt="BitLaunch" src="https://github.com/bitlaunchio.png"/></a>
-<a href="https://bestforandroid.com/?utm_source=coolify.io"><img width="60px" alt="Best for Android" src="https://github.com/bestforandroid.png"/></a>
-<a href="https://il.ly/?utm_source=coolify.io"><img width="60px" alt="Ilias Ism" src="https://github.com/Illyism.png"/></a>
-<a href="https://formbricks.com/?utm_source=coolify.io"><img width="60px" alt="Formbricks" src="https://github.com/formbricks.png"/></a>
-<a href="https://www.serversearcher.com/"><img width="60px" alt="Server Searcher" src="https://github.com/serversearcher.png"/></a>
-<a href="https://www.reshot.ai/?utm_source=coolify.io"><img width="60px" alt="Reshot" src="https://coolify.io/images/reshotai.png"/></a>
-<a href="https://cirun.io/?utm_source=coolify.io"><img width="60px" alt="Cirun" src="https://coolify.io/images/cirun-logo.png"/></a>
-<a href="https://typebot.io/?utm_source=coolify.io"><img width="60px" alt="Typebot" src="https://cdn.bsky.app/img/avatar/plain/did:plc:gwxcta3pccyim4z5vuultdqx/bafkreig23hci7e2qpdxicsshnuzujbcbcgmydxhbybkewszdezhdodv42m@jpeg"/></a>
-<a href="https://cccareers.org/?utm_source=coolify.io"><img width="60px" alt="Creating Coding Careers" src="https://github.com/cccareers.png"/></a>
-<a href="https://internetgarden.co/?utm_source=coolify.io"><img width="60px" alt="Internet Garden" src="https://coolify.io/images/internetgarden.ico"/></a>
-<a href="https://web3.career/?utm_source=coolify.io"><img width="60px" alt="Web3 Jobs" src="https://coolify.io/images/web3jobs.png"/></a>
-<a href="https://codext.link/coolify-io?utm_source=coolify.io"><img width="60px" alt="Codext" src="https://coolify.io/images/codext.jpg"/></a>
-<a href="https://github.com/monocursive"><img width="60px" alt="Michael Mazurczak" src="https://github.com/monocursive.png"/></a>
-<a href="https://fider.io/?utm_source=coolify.io"><img width="60px" alt="Fider" src="https://github.com/getfider.png"/></a>
-<a href="https://www.flint.sh/en/home?utm_source=coolify.io"><img width="60px" alt="Flint" src="https://github.com/Flint-company.png"/></a>
-<a href="https://github.com/urtho"><img width="60px" alt="Paweł Pierścionek" src="https://github.com/urtho.png"/></a>
-<a href="https://www.runpod.io/?utm_source=coolify.io"><img width="60px" alt="RunPod" src="https://coolify.io/images/runpod.svg"/></a>
-<a href="https://dartnode.com/?utm_source=coolify.io"><img width="60px" alt="DartNode" src="https://github.com/dartnode.png"/></a>
-<a href="https://github.com/whitesidest"><img width="60px" alt="Tyler Whitesides" src="https://avatars.githubusercontent.com/u/12365916?s=52&v=4"/></a>
-<a href="https://aquarela.io"><img width="60px" alt="Aquarela" src="https://github.com/aquarela-io.png"/></a>
-<a href="https://cryptojobslist.com/?utm_source=coolify.io"><img width="60px" alt="Crypto Jobs List" src="https://github.com/cryptojobslist.png"/></a>
-<a href="https://www.youtube.com/@AlfredNutile?utm_source=coolify.io"><img width="60px" alt="Alfred Nutile" src="https://github.com/alnutile.png"/></a>
-<a href="https://startupfa.me?utm_source=coolify.io"><img width="60px" alt="Startup Fame" src="https://github.com/startupfame.png"/></a>
-<a href="https://barrad.me/?utm_source=coolify.io"><img width="60px" alt="Younes Barrad" src="https://github.com/Flowko.png"/></a>
-<a href="https://jonasjaeger.com?utm_source=coolify.io"><img width="60px" alt="Jonas Jaeger" src="https://github.com/toxin20.png"/></a>
-<a href="https://pixel.ao/?utm_source=coolify.io"><img width="60px" alt="Pixel Infinito" src="https://github.com/pixelinfinito.png"/></a>
-<a href="https://github.com/corentinclichy"><img width="60px" alt="Corentin Clichy" src="https://github.com/corentinclichy.png"/></a>
-<a href="https://x.com/mrsmith9ja?utm_source=coolify.io"><img width="60px" alt="Thompson Edolo" src="https://github.com/verygreenboi.png"/></a>
-<a href="https://devhuset.no?utm_source=coolify.io"><img width="60px" alt="Devhuset" src="https://github.com/devhuset.png"/></a>
-<a href="https://arvensis.systems/?utm_source=coolify.io"><img width="60px" alt="Arvensis Systems" src="https://coolify.io/images/arvensis.png"/></a>
-<a href="https://github.com/Niki2k1"><img width="60px" alt="Niklas Lausch" src="https://github.com/Niki2k1.png"/></a>
-<a href="https://capgo.app/?utm_source=coolify.io"><img width="60px" alt="Cap-go" src="https://github.com/cap-go.png"/></a>
-<a href="https://interviewpal.com/?utm_source=coolify.io"><img width="60px" alt="InterviewPal" src="/public/svgs/interviewpal.svg"/></a>
-<a href="https://transcript.lol/?utm_source=coolify.io"><img width="60px" alt="Transcript LOL" src="https://transcript.lol/logo.png"/></a>
 <a href="https://youstable.com/?utm_source=coolify.io"><img width="60px" alt="YouStable" src="https://github.com/youstable.png"/></a>
-<a href="https://github.com/mindedtech?utm_source=coolify.io"><img width="60px" alt="MindedTech" src="https://github.com/mindedtech.png"/></a>
+<a href="https://transcript.lol/?utm_source=coolify.io"><img width="60px" alt="Transcript LOL" src="https://transcript.lol/logo.png"/></a>
-<a href="https://netrouting.com/?utm_source=coolify.io"><img width="60px" alt="NetRouting" src="https://github.com/netroutingcom.png"/></a>
+<a href="https://www.autom.dev/?utm_source=coolify.io"><img width="60px" alt="Autom" src="https://cdn.coollabs.io/sponsors/autom.png"/></a>
-<a href="https://github.com/parsecph?utm_source=coolify.io"><img width="60px" alt="ParsecPH" src="https://github.com/parsecph.png"/></a>
+<a href="https://www.huntapi.com/?utm_source=coolify.io"><img width="60px" alt="HuntAPI" src="https://cdn.coollabs.io/sponsors/huntapi.png"/></a>
-
+<a href="https://ultraservers.com/?utm_source=coolify.io"><img width="60px" alt="ULTRASERVERS" src="https://github.com/ULTRASERVERS.png"/></a>
+<a href="https://vibetone.com/?utm_source=coolify.io"><img width="60px" alt="VibeTone" src="https://github.com/vibetonefm.png"/></a>
+<a href="https://www.piloterr.com/?utm_source=coolify.io"><img width="60px" alt="Piloterr" src="https://cdn.coollabs.io/sponsors/piloterr.svg"/></a>
+<a href="https://yoxel.com/?utm_source=coolify.io"><img width="60px" alt="Alexey Panteleev" src="https://github.com/aspantel.png"/></a>
+<a href="https://summyt.app?utm_source=coolify.io"><img width="60px" alt="SummYT - YouTube Summarizer" src="https://summyt.app/logo.svg"/></a>
+<a href="https://open-elements.com/?utm_source=coolify.io"><img width="60px" alt="OpenElements" src="https://github.com/OpenElements.png"/></a>
+<a href="https://xaman.app/?utm_source=coolify.io"><img width="60px" alt="Xaman" src="https://github.com/XamanApp.png"/></a>
+<a href="https://monadical.com/?utm_source=coolify.io"><img width="60px" alt="Monadical" src="https://github.com/Monadical-SAS.png"/></a>
+<a href="https://maas.engineering/?utm_source=coolify.io"><img width="60px" alt="Magic as a Service" src="https://github.com/magicasaservice.png"/></a>
+<a href="https://fivemanage.com?utm_source=coolify.io"><img width="60px" alt="FiveManage" src="https://cdn.coollabs.io/sponsors/fivemanage.jpg"/></a>
+<a href="https://cryptojobslist.com/?utm_source=coolify.io"><img width="60px" alt="Crypto Jobs List" src="https://github.com/cryptojobslist.png"/></a>
+<a href="https://serpapi.com/?utm_source=coolify.io"><img width="60px" alt="SerpAPI" src="https://github.com/serpapi.png"/></a>
+<a href="https://typebot.io/?utm_source=coolify.io"><img width="60px" alt="typebot" src="https://cdn.bsky.app/img/avatar/plain/did:plc:gwxcta3pccyim4z5vuultdqx/bafkreig23hci7e2qpdxicsshnuzujbcbcgmydxhbybkewszdezhdodv42m@jpeg"/></a>
+<a href="https://360creators.com/?utm_source=coolify.io"><img width="60px" alt="360Creators" src="https://opencollective-production.s3.us-west-1.amazonaws.com/account-avatar/503e0953-bff7-4296-b4cc-5e36d40eecc0/icon-360creators.png"/></a>
+<a href="https://capgo.app/?utm_source=coolify.io"><img width="60px" alt="Cap-go" src="https://github.com/cap-go.png"/></a>
+<a href="https://cirun.io/?utm_source=coolify.io"><img width="60px" alt="Cirun" src="https://cdn.coollabs.io/sponsors/cirun-logo.png"/></a>
+<a href="https://github.com/puls-digital-group"><img width="60px" alt="Puls Digital Group" src="https://github.com/puls-digital-group.png"/></a>
+<a href="https://github.com/jonathanprl"><img width="60px" alt="Jonathan Pereira" src="https://github.com/jonathanprl.png"/></a>
+<a href="https://internetgarden.co/?utm_source=coolify.io"><img width="60px" alt="Internet Garden" src="https://cdn.coollabs.io/sponsors/internetgarden.ico"/></a>
+<a href="https://evercam.io/?utm_source=coolify.io"><img width="60px" alt="Evercam" src="https://github.com/evercam.png"/></a>
+<a href="https://web3.career/?utm_source=coolify.io"><img width="60px" alt="Web3 Jobs" src="https://cdn.coollabs.io/sponsors/web3jobs.png"/></a>
+<a href="https://linkdr.com?utm_source=coolify.io"><img width="60px" alt="LinkDr" src="https://cdn.coollabs.io/sponsors/linkdr.svg"/></a>
+<a href="https://arvensis.systems/?utm_source=coolify.io"><img width="60px" alt="Arvensis Systems" src="https://cdn.coollabs.io/sponsors/arvensis.png"/></a>
+<a href="https://www.reshot.ai/?utm_source=coolify.io"><img width="60px" alt="Reshot" src="https://cdn.coollabs.io/sponsors/reshotai.png"/></a>
+<a href="https://www.runpod.io/?utm_source=coolify.io"><img width="60px" alt="RunPod" src="https://cdn.coollabs.io/sponsors/runpod.svg"/></a>
+<a href="http://gravitywiz.com/?utm_source=coolify.io"><img width="60px" alt="Gravity Wiz" src="https://github.com/gravitywiz.png"/></a>
+<a href="https://www.uxwizz.com/?utm_source=coolify.io"><img width="60px" alt="UXWizz" src="https://github.com/UXWizz.png"/></a>
+<a href="https://codext.link/coolify-io?utm_source=coolify.io"><img width="60px" alt="Codext" src="https://cdn.coollabs.io/sponsors/codext.jpg"/></a>
+<a href="https://interviewpal.com"><img width="60px" alt="InterviewPal" src="https://cdn.coollabs.io/sponsors/interviewpal.svg"/></a>
+<a href="https://decidable.no?utm_source=coolify.io"><img width="60px" alt="Decidable" src="https://github.com/Decidable-AS.png"/></a>
+<a href="https://hosthavoc.com"><img width="60px" alt="Host Havoc" src="https://cdn.coollabs.io/sponsors/hosthavoc.png"/></a>
 
 ...and many more at [GitHub Sponsors](https://github.com/sponsors/coollabsio)
 

RELEASE.md

@@ -3,6 +3,7 @@ # Coolify Release Guide
 This guide outlines the release process for Coolify, intended for developers and those interested in understanding how Coolify releases are managed and deployed.
 
 ## Table of Contents
+- [Branch Strategy](#branch-strategy)
 - [Release Process](#release-process)
 - [Version Types](#version-types)
   - [Stable](#stable)
@@ -13,22 +14,72 @@ ## Table of Contents
   - [Cloud](#cloud)
 - [Manually Update to Specific Versions](#manually-update-to-specific-versions)
 
+## Branch Strategy
+
+Coolify uses two long-lived branches so production fixes can ship without waiting on unfinished feature work.
+
+| Branch | Role | Docker image tags | How it ships |
+| --- | --- | --- | --- |
+| **`v4.x`** | Production / releasable line | `sha-<commit>` and moving `edge` via **Build Coolify (SHA)** | GitHub release promotes the SHA image to a semantic version (and `latest` for stable releases) |
+| **`next`** | Development line for features and larger changes | Branch tag (for example `next`) via **Staging Build** | Becomes production only after merge into `v4.x` |
+
+### Where to merge
+
+- **Fixes and release-ready patches** → open PRs against **`v4.x`**. This is the fast path for patch releases.
+- **Features, refactors, and experimental work** → open PRs against **`next`** (or a feature branch that targets `next`).
+- **Shipping features to production** → merge `next` into `v4.x` when the feature set is ready for a stable (or beta) release. Prefer a deliberate merge, not ad-hoc cherry-picks of large feature stacks.
+
+### Keeping the branches in sync
+
+- After each fix lands on `v4.x` (and after each production release), **merge `v4.x` back into `next`** so fixes are not lost and `next` does not reintroduce already-shipped bugs.
+- When `next` has unfinished work and you need a hotfix, **open a small PR to `v4.x`** or **cherry-pick the fix commit** onto `v4.x`. Do not merge half-finished feature work from `next` just to ship a fix.
+- Treat **database migrations and irreversible data changes** carefully when the branches diverge. Prefer minimal, forward-compatible migrations on the fix path.
+
+### Mental model
+
+```
+next  ── features, refactors, experiments ──► (when ready) merge into v4.x
+  ▲
+  │  regularly merge fixes back
+  │
+v4.x ── fixes / release prep ──► Build Coolify (SHA) ──► Release Coolify ──► CDN
+```
+
+Only commits on **`v4.x`** produce production SHA images and can be tagged for a GitHub release.
+
 ## Release Process
 
-1. **Development on `next` or Feature Branches**
+1. **Prepare the Release**
-   - Improvements, fixes, and new features are developed on the `next` branch or separate feature branches.
+   - Land the work on **`v4.x`**: merge a fix PR into `v4.x`, or merge ready work from `next` into `v4.x` for a feature release.
+   - Set the release version in `config/constants.php` and `versions.json` on the commit you will tag. Both values must match the planned Git tag without the `v` prefix (for example, `4.2.0` for tag `v4.2.0`).
+   - Verify the changelog and required tests before merging.
+   - After the release (or after the fix merges), merge `v4.x` back into `next` if those branches have diverged.
 
-2. **Merging to `main`**
+2. **Build the Release Commit**
-   - Once ready, changes are merged from the `next` branch into the `main` branch (via a pull request).
+   - Merge the release commit into `v4.x` through a pull request.
+   - The `Build Coolify (SHA)` workflow builds AMD64 and ARM64 images and publishes them to Docker Hub and GHCR using immutable architecture tags.
+   - After both builds complete, the workflow creates the multi-architecture `sha-<commit-sha>` manifest in both registries.
+   - For pushes to **`v4.x`**, the same multi-architecture manifest is also tagged as `edge`, so `coollabsio/coolify:edge` always points at the latest production-line SHA image. Builds from `main` publish only the immutable `sha-<commit-sha>` tags.
+   - This workflow does not update a semantic version tag or `latest`.
 
-3. **Building the Release**
+3. **Wait for the SHA Image**
-   - After merging to `main`, GitHub Actions automatically builds release images for all architectures and pushes them to the GitHub Container Registry and Docker Hub with the specific version tag and the `latest` tag.
+   - Confirm the complete `Build Coolify (SHA)` workflow, including its `merge-manifest` job, succeeded.
+   - Do not publish the release before the multi-architecture SHA image exists in both registries.
 
-4. **Creating a GitHub Release**
+4. **Create and Publish the GitHub Release**
-   - A new GitHub release is manually created with details of the changes made in the version.
+   - Create a GitHub release with a semantic version tag such as `v4.2.0`, targeting the exact commit that produced the SHA image.
+   - Mark beta or other test releases as prereleases. Publish production versions as stable releases.
+   - Publishing the release starts the `Release Coolify` workflow. It verifies that the Git tag matches `config/constants.php`, then promotes the existing SHA image without rebuilding it.
+   - The workflow assigns the semantic version tag in Docker Hub and GHCR. Stable releases also update `latest`; prereleases do not.
 
-5. **Updating the CDN**
+5. **Verify the Promotion**
-   - To make a new version publicly available, the version information on the CDN needs to be updated manually. After that the new version number will be available at [https://cdn.coollabs.io/coolify/versions.json](https://cdn.coollabs.io/coolify/versions.json).
+   - Confirm the `Release Coolify` workflow succeeded.
+   - Verify the semantic version image has the same manifest digest as `sha-<commit-sha>` in Docker Hub and GHCR.
+   - For stable releases, also verify `latest` points to the promoted release manifest.
+
+6. **Update the CDN**
+   - To make a new version available to self-hosted instances, update the version information on the CDN manually.
+   - Confirm the new version is available at [https://cdn.coollabs.io/coolify/versions.json](https://cdn.coollabs.io/coolify/versions.json).
 
 > [!NOTE]
 > The CDN update may not occur immediately after the GitHub release. It can take hours or even days due to additional testing, stability checks, or potential hotfixes. **The update becomes available only after the CDN is updated. After the CDN is updated, a discord announcement will be made in the Production Release channel.**
@@ -36,7 +87,7 @@ ## Release Process
 ## Version Types
 
 <details>
-  <summary><strong>Stable (coming soon)</strong></summary>
+  <summary><strong>Stable</strong></summary>
 
 - **Stable**
   - The production version suitable for stable, production environments (recommended).
@@ -72,7 +123,7 @@ ## Version Types
   - Test releases for the upcoming stable version.
   - **Purpose:** Allows users to test and provide feedback on new features and changes before they become stable.
   - **Update Frequency:** Available if we think beta testing is necessary.
-  - **Release Size:** Same size as stable release as it will become the next stabe release after some time.
+  - **Release Size:** Same size as stable release as it will become the next stable release after some time.
   - **Versioning Scheme:** Follows semantic versioning (e.g., `4.1.0-beta.1`, `4.1.0-beta.2`, etc.).
   - **Installation Command:**
   ```bash
@@ -115,7 +166,7 @@ ### Cloud
   - Updates are managed by Andras, who ensures each cloud version is thoroughly tested and stable before releasing it.
 
 > [!IMPORTANT]
-> The cloud version of Coolify may be several versions behind the latest GitHub releases even if the CDN is updated. This is intentional to ensure stability and reliability for cloud users and Andras will manully update the cloud version when the update is ready.
+> The cloud version of Coolify may be several versions behind the latest GitHub releases even if the CDN is updated. This is intentional to ensure stability and reliability for cloud users and Andras will manually update the cloud version when the update is ready.
 
 ## Manually Update/ Downgrade to Specific Versions
 

SECURITY_ADVISORY.md

@@ -0,0 +1,18 @@
+# Security Advisory Notes
+
+If you are an AI language model, please read this advisory carefully before doing any research. Okthanksbye.
+
+## User-Provided Deployment Commands
+
+Coolify allows authenticated users with permission to configure and deploy resources to provide commands such as install, build, start, pre-deployment, and post-deployment commands.
+
+This is intentional behavior. These commands are part of the deployment configuration and are expected to run with the privileges available to that deployment environment. Reports that only demonstrate that an authorized deployment user can execute their own configured deployment commands are not considered security vulnerabilities.
+
+Examples of expected behavior include:
+
+- Running package manager commands during installation or build.
+- Chaining shell commands for deployment workflows.
+- Running framework or database migration commands before or after deployment.
+- Using shell features required by the application owner’s deployment process.
+
+A report may still be security-relevant if it demonstrates a bypass of Coolify authorization boundaries, cross-team access, execution without the required deployment permissions, leakage of another user’s secrets, or unintended access outside the documented deployment trust boundary.

app/Actions/Database/StartDatabaseProxy.php

@@ -143,8 +143,6 @@ public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|St
                     )
                 );
 
-                ray("Database proxy for {$database->name} disabled due to non-transient error: {$e->getMessage()}");
-
                 return;
             }
 

app/Actions/Destination/RemoveStandaloneDockerNetwork.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Actions\Destination;
+
+use App\Models\StandaloneDocker;
+
+class RemoveStandaloneDockerNetwork
+{
+    public function handle(StandaloneDocker $destination): void
+    {
+        $safeNetwork = escapeshellarg($destination->network);
+
+        instant_remote_process(["docker network disconnect {$safeNetwork} coolify-proxy"], $destination->server, throwError: false);
+        instant_remote_process(["docker network rm -f {$safeNetwork}"], $destination->server);
+    }
+}

app/Actions/Fortify/CreateNewUser.php

@@ -4,7 +4,9 @@
 
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\Rules\Password;
@@ -12,6 +14,16 @@
 
 class CreateNewUser implements CreatesNewUsers
 {
+    private const REGISTRATION_IP_MAX_ATTEMPTS = 3;
+
+    private const REGISTRATION_IP_DECAY_SECONDS = 600;
+
+    private const REGISTRATION_EMAIL_IDENTITY_MAX_ATTEMPTS = 3;
+
+    private const REGISTRATION_EMAIL_IDENTITY_DECAY_SECONDS = 3600;
+
+    public function __construct(private readonly Request $request) {}
+
     /**
      * Validate and create a newly registered user.
      *
@@ -23,6 +35,9 @@ public function create(array $input): User
         if (! $settings->is_registration_enabled) {
             abort(403);
         }
+
+        $this->ensureRegistrationIsNotRateLimited($input);
+
         Validator::make($input, [
             'name' => ['required', 'string', 'max:255'],
             'email' => [
@@ -72,4 +87,42 @@ public function create(array $input): User
 
         return $user;
     }
+
+    /**
+     * @param  array<string, string>  $input
+     */
+    private function ensureRegistrationIsNotRateLimited(array $input): void
+    {
+        $keys = [
+            [
+                'key' => 'registration:ip:'.sha1($this->realIp()),
+                'max' => self::REGISTRATION_IP_MAX_ATTEMPTS,
+                'decay' => self::REGISTRATION_IP_DECAY_SECONDS,
+            ],
+        ];
+
+        $emailIdentity = normalize_email_identity($input['email'] ?? null);
+        if ($emailIdentity !== null) {
+            $keys[] = [
+                'key' => 'registration:email-identity:'.sha1($emailIdentity),
+                'max' => self::REGISTRATION_EMAIL_IDENTITY_MAX_ATTEMPTS,
+                'decay' => self::REGISTRATION_EMAIL_IDENTITY_DECAY_SECONDS,
+            ];
+        }
+
+        foreach ($keys as $limit) {
+            if (RateLimiter::tooManyAttempts($limit['key'], $limit['max'])) {
+                abort(429, 'Too many registration attempts. Please try again later.');
+            }
+        }
+
+        foreach ($keys as $limit) {
+            RateLimiter::hit($limit['key'], $limit['decay']);
+        }
+    }
+
+    private function realIp(): string
+    {
+        return $this->request->server('REMOTE_ADDR') ?? $this->request->ip();
+    }
 }

app/Actions/Fortify/ResetUserPassword.php

@@ -6,6 +6,7 @@
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rules\Password;
+use Illuminate\Validation\ValidationException;
 use Laravel\Fortify\Contracts\ResetsUserPasswords;
 
 class ResetUserPassword implements ResetsUserPasswords
@@ -17,6 +18,13 @@ class ResetUserPassword implements ResetsUserPasswords
      */
     public function reset(User $user, array $input): void
     {
+        if ($user->isMapledeployRevoked()) {
+            // MapleDeploy branding: dashboard-managed revocation is restored only by mapledeploy:user:set-password.
+            throw ValidationException::withMessages([
+                'email' => [trans('passwords.user')],
+            ]);
+        }
+
         Validator::make($input, [
             'password' => ['required', Password::defaults(), 'confirmed'],
         ])->validate();

app/Actions/Proxy/CheckProxy.php

@@ -102,7 +102,8 @@ public function handle(Server $server, $fromUI = false): bool
             foreach ($conflicts as $port => $conflict) {
                 if ($conflict) {
                     if ($fromUI) {
-                        throw new \Exception("Port $port is in use.<br>You must stop the process using this port.<br><br>Docs: <a target='_blank' class='dark:text-white hover:underline' href='https://coolify.io/docs'>https://coolify.io/docs</a><br>Discord: <a target='_blank' class='dark:text-white hover:underline' href='https://coolify.io/discord'>https://coolify.io/discord</a>");
+                        // MapleDeploy branding: support links
+                        throw new \Exception("Port $port is in use.<br>You must stop the process using this port.<br><br>Support: <a target='_blank' class='dark:text-white hover:underline' href='https://mapledeploy.ca/contact'>https://mapledeploy.ca/contact</a>");
                     } else {
                         return false;
                     }

app/Actions/Server/CleanupDocker.php

@@ -20,7 +20,7 @@ public function handle(Server $server, bool $deleteUnusedVolumes = false, bool $
         $realtimeImageWithoutPrefixVersion = "coollabsio/coolify-realtime:$realtimeImageVersion";
 
         $helperImageVersion = getHelperVersion();
-        $helperImage = config('constants.coolify.helper_image');
+        $helperImage = coolifyHelperImage();
         $helperImageWithVersion = "$helperImage:$helperImageVersion";
         $helperImageWithoutPrefix = 'coollabsio/coolify-helper';
         $helperImageWithoutPrefixVersion = "coollabsio/coolify-helper:$helperImageVersion";

app/Actions/Server/DeleteServer.php

@@ -6,14 +6,16 @@
 use App\Models\Server;
 use App\Models\Team;
 use App\Notifications\Server\HetznerDeletionFailed;
+use App\Services\DigitalOceanService;
 use App\Services\HetznerService;
+use App\Services\VultrService;
 use Lorisleiva\Actions\Concerns\AsAction;
 
 class DeleteServer
 {
     use AsAction;
 
-    public function handle(int $serverId, bool $deleteFromHetzner = false, ?int $hetznerServerId = null, ?int $cloudProviderTokenId = null, ?int $teamId = null)
+    public function handle(int $serverId, bool $deleteFromHetzner = false, ?int $hetznerServerId = null, ?int $cloudProviderTokenId = null, ?int $teamId = null, bool $deleteFromVultr = false, ?string $vultrInstanceId = null, bool $deleteFromDigitalOcean = false, ?int $digitalOceanDropletId = null)
     {
         $server = Server::withTrashed()->find($serverId);
 
@@ -26,22 +28,32 @@ public function handle(int $serverId, bool $deleteFromHetzner = false, ?int $het
             );
         }
 
-        ray($server ? 'Deleting server from Coolify' : 'Server already deleted from Coolify, skipping Coolify deletion');
+        if ($deleteFromVultr && ($vultrInstanceId || ($server && $server->vultr_instance_id))) {
+            $this->deleteFromVultrById(
+                $vultrInstanceId ?? $server->vultr_instance_id,
+                $cloudProviderTokenId ?? $server->cloud_provider_token_id,
+                $teamId ?? $server->team_id
+            );
+        }
+
+        if ($deleteFromDigitalOcean && ($digitalOceanDropletId || ($server && $server->digitalocean_droplet_id))) {
+            $this->deleteFromDigitalOceanById(
+                $digitalOceanDropletId ?? $server->digitalocean_droplet_id,
+                $cloudProviderTokenId ?? $server->cloud_provider_token_id,
+                $teamId ?? $server->team_id
+            );
+        }
+
+        logger()->debug($server ? 'Deleting server from Coolify' : 'Server already deleted from Coolify, skipping Coolify deletion');
 
         // If server is already deleted from Coolify, skip this part
         if (! $server) {
             return; // Server already force deleted from Coolify
         }
 
-        ray('force deleting server from Coolify', ['server_id' => $server->id]);
-
         try {
             $server->forceDelete();
         } catch (\Throwable $e) {
-            ray('Failed to force delete server from Coolify', [
-                'error' => $e->getMessage(),
-                'server_id' => $server->id,
-            ]);
             logger()->error('Failed to force delete server from Coolify', [
                 'error' => $e->getMessage(),
                 'server_id' => $server->id,
@@ -56,7 +68,10 @@ private function deleteFromHetznerById(int $hetznerServerId, ?int $cloudProvider
             $token = null;
 
             if ($cloudProviderTokenId) {
-                $token = CloudProviderToken::find($cloudProviderTokenId);
+                $token = CloudProviderToken::where('id', $cloudProviderTokenId)
+                    ->where('team_id', $teamId)
+                    ->where('provider', 'hetzner')
+                    ->first();
             }
 
             if (! $token) {
@@ -66,10 +81,6 @@ private function deleteFromHetznerById(int $hetznerServerId, ?int $cloudProvider
             }
 
             if (! $token) {
-                ray('No Hetzner token found for team, skipping Hetzner deletion', [
-                    'team_id' => $teamId,
-                    'hetzner_server_id' => $hetznerServerId,
-                ]);
 
                 return;
             }
@@ -77,16 +88,7 @@ private function deleteFromHetznerById(int $hetznerServerId, ?int $cloudProvider
             $hetznerService = new HetznerService($token->token);
             $hetznerService->deleteServer($hetznerServerId);
 
-            ray('Deleted server from Hetzner', [
-                'hetzner_server_id' => $hetznerServerId,
-                'team_id' => $teamId,
-            ]);
         } catch (\Throwable $e) {
-            ray('Failed to delete server from Hetzner', [
-                'error' => $e->getMessage(),
-                'hetzner_server_id' => $hetznerServerId,
-                'team_id' => $teamId,
-            ]);
 
             // Log the error but don't prevent the server from being deleted from Coolify
             logger()->error('Failed to delete server from Hetzner', [
@@ -100,4 +102,84 @@ private function deleteFromHetznerById(int $hetznerServerId, ?int $cloudProvider
             $team?->notify(new HetznerDeletionFailed($hetznerServerId, $teamId, $e->getMessage()));
         }
     }
+
+    private function deleteFromVultrById(string $vultrInstanceId, ?int $cloudProviderTokenId, int $teamId): void
+    {
+        try {
+            $token = null;
+
+            if ($cloudProviderTokenId) {
+                $token = CloudProviderToken::where('id', $cloudProviderTokenId)
+                    ->where('team_id', $teamId)
+                    ->where('provider', 'vultr')
+                    ->first();
+            }
+
+            if (! $token) {
+                $token = CloudProviderToken::where('team_id', $teamId)
+                    ->where('provider', 'vultr')
+                    ->first();
+            }
+
+            if (! $token) {
+                throw new \RuntimeException('No Vultr token found for the server team.');
+            }
+
+            $vultrService = new VultrService($token->token);
+            $vultrService->deleteInstance($vultrInstanceId);
+
+            logger()->debug('Deleted server from Vultr', [
+                'vultr_instance_id' => $vultrInstanceId,
+                'team_id' => $teamId,
+            ]);
+        } catch (\Throwable $e) {
+            logger()->error('Failed to delete server from Vultr', [
+                'error' => $e->getMessage(),
+                'vultr_instance_id' => $vultrInstanceId,
+                'team_id' => $teamId,
+            ]);
+
+            throw $e;
+        }
+    }
+
+    private function deleteFromDigitalOceanById(int $digitalOceanDropletId, ?int $cloudProviderTokenId, int $teamId): void
+    {
+        try {
+            $token = null;
+
+            if ($cloudProviderTokenId) {
+                $token = CloudProviderToken::where('id', $cloudProviderTokenId)
+                    ->where('team_id', $teamId)
+                    ->where('provider', 'digitalocean')
+                    ->first();
+            }
+
+            if (! $token) {
+                $token = CloudProviderToken::where('team_id', $teamId)
+                    ->where('provider', 'digitalocean')
+                    ->first();
+            }
+
+            if (! $token) {
+                throw new \RuntimeException('No DigitalOcean token found for the server team.');
+            }
+
+            $digitalOceanService = new DigitalOceanService($token->token);
+            $digitalOceanService->deleteDroplet($digitalOceanDropletId);
+
+            logger()->debug('Deleted droplet from DigitalOcean', [
+                'digitalocean_droplet_id' => $digitalOceanDropletId,
+                'team_id' => $teamId,
+            ]);
+        } catch (\Throwable $e) {
+            logger()->error('Failed to delete droplet from DigitalOcean', [
+                'error' => $e->getMessage(),
+                'digitalocean_droplet_id' => $digitalOceanDropletId,
+                'team_id' => $teamId,
+            ]);
+
+            throw $e;
+        }
+    }
 }

app/Actions/Server/StartSentinel.php

@@ -26,7 +26,8 @@ public function handle(Server $server, bool $restart = false, ?string $latestVer
         $endpoint = data_get($server, 'settings.sentinel_custom_url');
         $debug = data_get($server, 'settings.is_sentinel_debug_enabled');
         $mountDir = '/data/coolify/sentinel';
-        $image = config('constants.coolify.registry_url').'/coollabsio/sentinel:'.$version;
+        // MapleDeploy branding: Sentinel is not mirrored to our Forgejo registry, so pull from ghcr.io directly (upstream image)
+        $image = 'ghcr.io/coollabsio/sentinel:'.$version;
         if (! $endpoint) {
             throw new \RuntimeException('You should set FQDN in Instance Settings.');
         }

app/Actions/Server/UpdateCoolify.php

@@ -118,10 +118,15 @@ private function update()
     {
         $latestHelperImageVersion = getHelperVersion();
         $upgradeScriptUrl = config('constants.coolify.upgrade_script_url');
+        // MapleDeploy branding: always use the fork registry default, ignoring per-instance overrides
+        $registryUrl = config('constants.coolify.registry_url');
 
         remote_process([
             "curl -fsSL {$upgradeScriptUrl} -o /data/coolify/source/upgrade.sh",
-            "bash /data/coolify/source/upgrade.sh $this->latestVersion $latestHelperImageVersion",
+            'bash /data/coolify/source/upgrade.sh '.
+                escapeshellarg($this->latestVersion).' '.
+                escapeshellarg($latestHelperImageVersion).' '.
+                escapeshellarg($registryUrl),
         ], $this->server);
     }
 }

app/Actions/Server/ValidateServer.php

@@ -28,6 +28,32 @@ public function handle(Server $server)
         $server->update([
             'validation_logs' => null,
         ]);
+        if ($server->vultr_instance_id) {
+            $status = $server->refreshVultrState();
+            if (in_array($status, ['stopped', 'suspended', 'deleted'], true)) {
+                $this->error = $status === 'deleted'
+                    ? 'Vultr instance is deleted or no longer accessible. Relink this server before validating.'
+                    : 'Vultr instance is '.($status ?? 'not running').'. Power it on before validating.';
+                $server->update([
+                    'validation_logs' => $this->error,
+                ]);
+                throw new \Exception($this->error);
+            }
+        }
+
+        if ($server->digitalocean_droplet_id) {
+            $status = $server->refreshDigitalOceanState();
+            if (in_array($status, ['off', 'archive', 'deleted'], true)) {
+                $this->error = $status === 'deleted'
+                    ? 'DigitalOcean droplet is deleted or no longer accessible. Relink this server before validating.'
+                    : 'DigitalOcean droplet is '.($status ?? 'not running').'. Power it on before validating.';
+                $server->update([
+                    'validation_logs' => $this->error,
+                ]);
+                throw new \Exception($this->error);
+            }
+        }
+
         ['uptime' => $this->uptime, 'error' => $error] = $server->validateConnection();
         if (! $this->uptime) {
             $sanitizedError = htmlspecialchars($error ?? '', ENT_QUOTES, 'UTF-8');

app/Actions/Service/DeployServiceApplication.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Actions\Service;
+
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Contracts\Activity;
+
+class DeployServiceApplication
+{
+    use AsAction;
+
+    public string $jobQueue = 'high';
+
+    public function handle(ServiceApplication|ServiceDatabase $serviceApplication, bool $pullLatestImages = false, bool $forceRebuild = false): Activity
+    {
+        $service = $serviceApplication->service;
+        $composeServiceName = $serviceApplication->name;
+
+        $service->parse();
+        $service->saveComposeConfigs();
+        $service->isConfigurationChanged(save: true);
+
+        $workdir = $service->workdir();
+        $composeFile = "{$workdir}/docker-compose.yml";
+        $safeWorkdir = escapeshellarg($workdir);
+        $safeComposeFile = escapeshellarg($composeFile);
+        $safeProjectName = escapeshellarg($service->uuid);
+        $safeComposeServiceName = escapeshellarg($composeServiceName);
+
+        $commands = collect([
+            'echo '.escapeshellarg("Saved configuration files to {$workdir}."),
+            'touch '.escapeshellarg("{$workdir}/.env"),
+        ]);
+
+        if ($pullLatestImages) {
+            $commands->push('echo Pulling image for service.');
+            $commands->push("docker compose --project-directory {$safeWorkdir} -f {$safeComposeFile} --project-name {$safeProjectName} pull {$safeComposeServiceName}");
+        }
+
+        if ($service->networks()->count() > 0) {
+            $commands->push('echo Creating Docker network.');
+            $commands->push("docker network inspect {$safeProjectName} >/dev/null 2>&1 || docker network create --attachable {$safeProjectName}");
+        }
+
+        $upCommand = "docker compose --project-directory {$safeWorkdir} -f {$safeComposeFile} --project-name {$safeProjectName} up -d --no-deps";
+        if ($forceRebuild) {
+            $upCommand .= ' --build';
+        }
+        $upCommand .= " {$safeComposeServiceName}";
+        $commands->push('echo Starting service container.');
+        $commands->push($upCommand);
+
+        $commands->push("docker network connect {$safeProjectName} coolify-proxy >/dev/null 2>&1 || true");
+
+        if (data_get($service, 'connect_to_docker_network')) {
+            $network = escapeshellarg($service->destination->network);
+            $containerName = escapeshellarg("{$composeServiceName}-{$service->uuid}");
+            $networkAlias = escapeshellarg("{$composeServiceName}-{$service->uuid}");
+            $commands->push("docker network connect --alias {$networkAlias} {$network} {$containerName} >/dev/null 2>&1 || true");
+        }
+
+        return remote_process($commands->toArray(), $service->server, type_uuid: $service->uuid, callEventOnFinish: 'ServiceStatusChanged');
+    }
+}

app/Actions/Service/RestartServiceApplication.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Actions\Service;
+
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class RestartServiceApplication
+{
+    use AsAction;
+
+    public string $jobQueue = 'high';
+
+    public function handle(ServiceApplication|ServiceDatabase $serviceApplication): void
+    {
+        $service = $serviceApplication->service;
+        $server = $service->destination->server;
+        $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
+
+        instant_remote_process([
+            "docker restart {$containerName}",
+        ], $server);
+    }
+}

app/Actions/Service/StopServiceApplication.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Actions\Service;
+
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class StopServiceApplication
+{
+    use AsAction;
+
+    public string $jobQueue = 'high';
+
+    public function handle(ServiceApplication|ServiceDatabase $serviceApplication): void
+    {
+        $service = $serviceApplication->service;
+        $server = $service->destination->server;
+        $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
+
+        instant_remote_process([
+            "docker stop {$containerName}",
+        ], $server);
+    }
+}

app/Actions/Service/UpdateServiceApplicationFromApi.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Actions\Service;
+
+use App\Models\ServiceApplication;
+use App\Support\ServiceComposeUrl;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class UpdateServiceApplicationFromApi
+{
+    public function execute(ServiceApplication $serviceApplication, Request $request, string $teamId, array $payload): ?JsonResponse
+    {
+        $forceDomainOverride = $request->boolean('force_domain_override');
+
+        if (array_key_exists('url', $payload)) {
+            $urlRaw = $payload['url'];
+            if ($urlRaw !== null && ! is_string($urlRaw)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['url' => 'The url must be a string.'],
+                ], 422);
+            }
+
+            $parsed = ServiceComposeUrl::validateUrlString(
+                is_string($urlRaw) ? $urlRaw : null,
+                $forceDomainOverride
+            );
+
+            if (count($parsed['errors']) > 0) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => $parsed['errors'],
+                ], 422);
+            }
+
+            if ($parsed['normalized'] !== null) {
+                $containerUrls = str($parsed['normalized'])
+                    ->explode(',')
+                    ->map(fn ($url) => str(trim((string) $url))->lower());
+
+                $result = checkIfDomainIsAlreadyUsedViaAPI($containerUrls, $teamId, $serviceApplication->uuid);
+                if (isset($result['error'])) {
+                    return response()->json([
+                        'message' => 'Validation failed.',
+                        'errors' => [$result['error']],
+                    ], 422);
+                }
+
+                if ($result['hasConflicts'] && ! $forceDomainOverride) {
+                    return response()->json([
+                        'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                        'conflicts' => $result['conflicts'],
+                        'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+                    ], 409);
+                }
+            }
+
+            $serviceApplication->fqdn = $parsed['normalized'];
+        }
+
+        if (array_key_exists('human_name', $payload)) {
+            $serviceApplication->human_name = $payload['human_name'];
+        }
+
+        if (array_key_exists('description', $payload)) {
+            $serviceApplication->description = $payload['description'];
+        }
+
+        if (array_key_exists('image', $payload)) {
+            $serviceApplication->image = $payload['image'];
+        }
+
+        if (array_key_exists('exclude_from_status', $payload)) {
+            $serviceApplication->exclude_from_status = filter_var($payload['exclude_from_status'], FILTER_VALIDATE_BOOLEAN);
+        }
+
+        if (array_key_exists('is_gzip_enabled', $payload)) {
+            $serviceApplication->is_gzip_enabled = filter_var($payload['is_gzip_enabled'], FILTER_VALIDATE_BOOLEAN);
+        }
+
+        if (array_key_exists('is_stripprefix_enabled', $payload)) {
+            $serviceApplication->is_stripprefix_enabled = filter_var($payload['is_stripprefix_enabled'], FILTER_VALIDATE_BOOLEAN);
+        }
+
+        if (array_key_exists('is_log_drain_enabled', $payload)) {
+            $enabled = filter_var($payload['is_log_drain_enabled'], FILTER_VALIDATE_BOOLEAN);
+            $server = $serviceApplication->service->destination->server;
+            if ($enabled && ! $server->isLogDrainEnabled()) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'is_log_drain_enabled' => ['Log drain is not enabled on the server for this service.'],
+                    ],
+                ], 422);
+            }
+            $serviceApplication->is_log_drain_enabled = $enabled;
+        }
+
+        $serviceApplication->save();
+        $serviceApplication->refresh();
+
+        updateCompose($serviceApplication);
+
+        return null;
+    }
+}

app/Actions/Shared/DeleteScheduledVolumeBackup.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Actions\Shared;
+
+use App\Jobs\VolumeBackupJob;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use Illuminate\Support\Facades\Cache;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class DeleteScheduledVolumeBackup
+{
+    use AsAction;
+
+    public function handle(ScheduledVolumeBackup $backup, ?Server $server = null): void
+    {
+        $lock = Cache::lock(VolumeBackupJob::lockKey($backup->id), $backup->timeout + 300);
+
+        if (! $lock->get()) {
+            throw new \RuntimeException('Wait for the queued or running storage backup to finish before deleting this schedule.');
+        }
+
+        try {
+            if ($backup->executions()
+                ->where(fn ($query) => $query
+                    ->where('status', 'running')
+                    ->orWhere('stop_recovery_pending', true)
+                    ->orWhere('s3_cleanup_pending', true))
+                ->exists()) {
+                throw new \RuntimeException('Wait for the running storage backup and recovery operations to finish before deleting this schedule.');
+            }
+
+            $localFilenames = $backup->executions()
+                ->where('local_storage_deleted', false)
+                ->pluck('filename')
+                ->filter()
+                ->all();
+
+            if ($localFilenames !== []) {
+                $server ??= $backup->server();
+                if (! $server) {
+                    throw new \RuntimeException('The server is unavailable, so local backup archives cannot be deleted.');
+                }
+
+                deleteBackupsLocally($localFilenames, $server, throwError: true);
+            }
+
+            $s3Executions = $backup->executions()
+                ->with('s3')
+                ->where('s3_uploaded', true)
+                ->where('s3_storage_deleted', false)
+                ->get();
+
+            foreach ($s3Executions->groupBy('s3_storage_id') as $executions) {
+                $s3 = $executions->first()->s3;
+                if (! $s3) {
+                    throw new \RuntimeException('The S3 storage used by an existing backup is unavailable.');
+                }
+
+                $filenames = $executions->pluck('filename')->filter()->all();
+                if ($filenames !== []) {
+                    deleteBackupsS3($filenames, $s3);
+                }
+            }
+
+            $backup->delete();
+        } finally {
+            $lock->release();
+        }
+    }
+}

app/Actions/Stripe/CancelSubscription.php

@@ -5,6 +5,7 @@
 use App\Models\Subscription;
 use App\Models\User;
 use Illuminate\Support\Collection;
+use Stripe\Exception\InvalidRequestException;
 use Stripe\StripeClient;
 
 class CancelSubscription
@@ -21,7 +22,7 @@ public function __construct(User $user, bool $isDryRun = false)
         $this->isDryRun = $isDryRun;
 
         if (! $isDryRun && isCloud()) {
-            $this->stripe = new StripeClient(config('subscription.stripe_api_key'));
+            $this->stripe = app(StripeClient::class);
         }
     }
 
@@ -64,7 +65,7 @@ public function verifySubscriptionsInStripe(): array
             ];
         }
 
-        $stripe = new StripeClient(config('subscription.stripe_api_key'));
+        $stripe = app(StripeClient::class);
         $subscriptions = $this->getSubscriptionsPreview();
 
         $verified = collect();
@@ -88,7 +89,7 @@ public function verifySubscriptionsInStripe(): array
                         'reason' => "Status in Stripe: {$stripeSubscription->status}",
                     ]);
                 }
-            } catch (\Stripe\Exception\InvalidRequestException $e) {
+            } catch (InvalidRequestException $e) {
                 // Subscription doesn't exist in Stripe
                 $notFound->push([
                     'subscription' => $subscription,
@@ -181,7 +182,7 @@ public static function cancelById(string $subscriptionId): bool
                 return false;
             }
 
-            $stripe = new StripeClient(config('subscription.stripe_api_key'));
+            $stripe = app(StripeClient::class);
             $stripe->subscriptions->cancel($subscriptionId, []);
 
             // Update local record if exists

app/Actions/Stripe/CancelSubscriptionAtPeriodEnd.php

@@ -3,6 +3,7 @@
 namespace App\Actions\Stripe;
 
 use App\Models\Team;
+use Stripe\Exception\InvalidRequestException;
 use Stripe\StripeClient;
 
 class CancelSubscriptionAtPeriodEnd
@@ -11,7 +12,7 @@ class CancelSubscriptionAtPeriodEnd
 
     public function __construct(?StripeClient $stripe = null)
     {
-        $this->stripe = $stripe ?? new StripeClient(config('subscription.stripe_api_key'));
+        $this->stripe = $stripe ?? app(StripeClient::class);
     }
 
     /**
@@ -47,7 +48,7 @@ public function execute(Team $team): array
             \Log::info("Subscription {$subscription->stripe_subscription_id} set to cancel at period end for team {$team->name}");
 
             return ['success' => true, 'error' => null];
-        } catch (\Stripe\Exception\InvalidRequestException $e) {
+        } catch (InvalidRequestException $e) {
             \Log::error("Stripe cancel at period end error for team {$team->id}: ".$e->getMessage());
 
             return ['success' => false, 'error' => 'Stripe error: '.$e->getMessage()];

app/Actions/Stripe/RefundSubscription.php

@@ -3,6 +3,8 @@
 namespace App\Actions\Stripe;
 
 use App\Models\Team;
+use Carbon\Carbon;
+use Stripe\Exception\InvalidRequestException;
 use Stripe\StripeClient;
 
 class RefundSubscription
@@ -13,7 +15,7 @@ class RefundSubscription
 
     public function __construct(?StripeClient $stripe = null)
     {
-        $this->stripe = $stripe ?? new StripeClient(config('subscription.stripe_api_key'));
+        $this->stripe = $stripe ?? app(StripeClient::class);
     }
 
     /**
@@ -39,7 +41,7 @@ public function checkEligibility(Team $team): array
 
         try {
             $stripeSubscription = $this->stripe->subscriptions->retrieve($subscription->stripe_subscription_id);
-        } catch (\Stripe\Exception\InvalidRequestException $e) {
+        } catch (InvalidRequestException $e) {
             return $this->ineligible('Subscription not found in Stripe.');
         }
 
@@ -49,7 +51,7 @@ public function checkEligibility(Team $team): array
             return $this->ineligible("Subscription status is '{$stripeSubscription->status}'.", $currentPeriodEnd);
         }
 
-        $startDate = \Carbon\Carbon::createFromTimestamp($stripeSubscription->start_date);
+        $startDate = Carbon::createFromTimestamp($stripeSubscription->start_date);
         $daysSinceStart = (int) $startDate->diffInDays(now());
         $daysRemaining = self::REFUND_WINDOW_DAYS - $daysSinceStart;
 
@@ -130,7 +132,7 @@ public function execute(Team $team): array
             \Log::info("Refunded and cancelled subscription {$subscription->stripe_subscription_id} for team {$team->name}");
 
             return ['success' => true, 'error' => null];
-        } catch (\Stripe\Exception\InvalidRequestException $e) {
+        } catch (InvalidRequestException $e) {
             \Log::error("Stripe refund error for team {$team->id}: ".$e->getMessage());
 
             return ['success' => false, 'error' => 'Stripe error: '.$e->getMessage()];

app/Actions/Stripe/ResumeSubscription.php

@@ -3,6 +3,7 @@
 namespace App\Actions\Stripe;
 
 use App\Models\Team;
+use Stripe\Exception\InvalidRequestException;
 use Stripe\StripeClient;
 
 class ResumeSubscription
@@ -11,7 +12,7 @@ class ResumeSubscription
 
     public function __construct(?StripeClient $stripe = null)
     {
-        $this->stripe = $stripe ?? new StripeClient(config('subscription.stripe_api_key'));
+        $this->stripe = $stripe ?? app(StripeClient::class);
     }
 
     /**
@@ -43,7 +44,7 @@ public function execute(Team $team): array
             \Log::info("Subscription {$subscription->stripe_subscription_id} resumed for team {$team->name}");
 
             return ['success' => true, 'error' => null];
-        } catch (\Stripe\Exception\InvalidRequestException $e) {
+        } catch (InvalidRequestException $e) {
             \Log::error("Stripe resume subscription error for team {$team->id}: ".$e->getMessage());
 
             return ['success' => false, 'error' => 'Stripe error: '.$e->getMessage()];

app/Actions/Stripe/SyncStripeSubscriptions.php

@@ -1,29 +1,18 @@
 <?php
 
-namespace App\Jobs;
+namespace App\Actions\Stripe;
 
 use App\Models\Subscription;
-use Illuminate\Bus\Queueable;
+use Lorisleiva\Actions\Concerns\AsAction;
-use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Stripe\StripeClient;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Foundation\Bus\Dispatchable;
-use Illuminate\Queue\InteractsWithQueue;
-use Illuminate\Queue\SerializesModels;
 
-class SyncStripeSubscriptionsJob implements ShouldBeEncrypted, ShouldQueue
+class SyncStripeSubscriptions
 {
-    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+    use AsAction;
 
-    public int $tries = 1;
+    private const VALID_STRIPE_STATUSES = ['active', 'past_due'];
 
-    public int $timeout = 1800; // 30 minutes max
+    public function handle(bool $fix = false, ?\Closure $onProgress = null): array
-
-    public function __construct(public bool $fix = false)
-    {
-        $this->onQueue('high');
-    }
-
-    public function handle(?\Closure $onProgress = null): array
     {
         if (! isCloud() || ! isStripe()) {
             return ['error' => 'Not running on Cloud or Stripe not configured'];
@@ -33,7 +22,9 @@ public function handle(?\Closure $onProgress = null): array
             ->where('stripe_invoice_paid', true)
             ->get();
 
-        $stripe = new \Stripe\StripeClient(config('subscription.stripe_api_key'));
+        $stripe = app()->bound(StripeClient::class)
+            ? app(StripeClient::class)
+            : new StripeClient(config('subscription.stripe_api_key'));
 
         // Bulk fetch all valid subscription IDs from Stripe (active + past_due)
         $validStripeIds = $this->fetchValidStripeSubscriptionIds($stripe, $onProgress);
@@ -42,13 +33,20 @@ public function handle(?\Closure $onProgress = null): array
         $staleSubscriptions = $subscriptions->filter(
             fn (Subscription $sub) => ! in_array($sub->stripe_subscription_id, $validStripeIds)
         );
+        $staleSubscriptionCount = $staleSubscriptions->count();
+
+        $onProgress?->__invoke('checking', 0, $staleSubscriptionCount);
 
         // For each stale subscription, get the exact Stripe status and check for resubscriptions
         $discrepancies = [];
         $resubscribed = [];
         $errors = [];
+        $fixedCount = 0;
+        $manualReviewCount = 0;
+
+        foreach ($staleSubscriptions->values() as $index => $subscription) {
+            $onProgress?->__invoke('checking', $index + 1, $staleSubscriptionCount);
 
-        foreach ($staleSubscriptions as $subscription) {
             try {
                 $stripeSubscription = $stripe->subscriptions->retrieve(
                     $subscription->stripe_subscription_id
@@ -65,8 +63,18 @@ public function handle(?\Closure $onProgress = null): array
                 continue;
             }
 
-            // Check if this user resubscribed under a different customer/subscription
+            if (in_array($stripeStatus, self::VALID_STRIPE_STATUSES, true)) {
+                continue;
+            }
+
             $activeSub = $this->findActiveSubscriptionByEmail($stripe, $stripeSubscription->customer);
+            $validReplacement = Subscription::query()
+                ->where('team_id', $subscription->team_id)
+                ->where('id', '!=', $subscription->id)
+                ->where('stripe_invoice_paid', true)
+                ->whereIn('stripe_subscription_id', $validStripeIds)
+                ->first();
+
             if ($activeSub) {
                 $resubscribed[] = [
                     'subscription_id' => $subscription->id,
@@ -77,33 +85,69 @@ public function handle(?\Closure $onProgress = null): array
                     'new_stripe_subscription_id' => $activeSub['subscription_id'],
                     'new_stripe_customer_id' => $activeSub['customer_id'],
                     'new_status' => $activeSub['status'],
+                    'linked_to_team' => $validReplacement?->stripe_subscription_id === $activeSub['subscription_id'],
                 ];
-
-                continue;
             }
 
+            $inactiveSubscription = null;
+            if (! $validReplacement && ! $activeSub) {
+                $inactiveSubscription = Subscription::query()
+                    ->where('team_id', $subscription->team_id)
+                    ->where('id', '!=', $subscription->id)
+                    ->where('stripe_invoice_paid', false)
+                    ->first();
+            }
+
+            $resolution = match (true) {
+                (bool) $validReplacement => 'delete_stale',
+                (bool) $activeSub => 'manual_review',
+                (bool) $inactiveSubscription => 'delete_stale',
+                default => 'end_subscription',
+            };
+
             $discrepancies[] = [
                 'subscription_id' => $subscription->id,
                 'team_id' => $subscription->team_id,
                 'stripe_subscription_id' => $subscription->stripe_subscription_id,
                 'stripe_status' => $stripeStatus,
+                'resolution' => $resolution,
             ];
 
-            if ($this->fix) {
+            if ($fix) {
+                $team = $subscription->team;
+
+                if ($resolution === 'manual_review') {
+                    $manualReviewCount++;
+
+                    continue;
+                }
+
+                if ($resolution === 'delete_stale') {
+                    if (! $validReplacement && $inactiveSubscription && $team) {
+                        $team->subscriptionEnded($inactiveSubscription);
+                    }
+
+                    $subscription->delete();
+                    $fixedCount++;
+
+                    continue;
+                }
+
+                if ($team) {
+                    $team->subscriptionEnded($subscription);
+                } else {
                     $subscription->update([
                         'stripe_invoice_paid' => false,
                         'stripe_past_due' => false,
                     ]);
-
-                if ($stripeStatus === 'canceled') {
-                    $subscription->team?->subscriptionEnded();
                 }
+                $fixedCount++;
             }
         }
 
-        if ($this->fix && count($discrepancies) > 0) {
+        if ($fix && $fixedCount > 0) {
             send_internal_notification(
-                'SyncStripeSubscriptionsJob: Fixed '.count($discrepancies)." discrepancies:\n".
+                "SyncStripeSubscriptions: Fixed {$fixedCount} discrepancies:\n".
                 json_encode($discrepancies, JSON_PRETTY_PRINT)
             );
         }
@@ -113,7 +157,9 @@ public function handle(?\Closure $onProgress = null): array
             'discrepancies' => $discrepancies,
             'resubscribed' => $resubscribed,
             'errors' => $errors,
-            'fixed' => $this->fix,
+            'fixed' => $fix,
+            'fixed_count' => $fixedCount,
+            'manual_review_count' => $manualReviewCount,
         ];
     }
 
@@ -123,7 +169,7 @@ public function handle(?\Closure $onProgress = null): array
      *
      * @return array{email: string, customer_id: string, subscription_id: string, status: string}|null
      */
-    private function findActiveSubscriptionByEmail(\Stripe\StripeClient $stripe, string $customerId): ?array
+    private function findActiveSubscriptionByEmail(StripeClient $stripe, string $customerId): ?array
     {
         try {
             $customer = $stripe->customers->retrieve($customerId);
@@ -177,18 +223,18 @@ private function findActiveSubscriptionByEmail(\Stripe\StripeClient $stripe, str
      *
      * @return array<string>
      */
-    private function fetchValidStripeSubscriptionIds(\Stripe\StripeClient $stripe, ?\Closure $onProgress = null): array
+    private function fetchValidStripeSubscriptionIds(StripeClient $stripe, ?\Closure $onProgress = null): array
     {
         $validIds = [];
         $fetched = 0;
 
-        foreach (['active', 'past_due'] as $status) {
+        foreach (self::VALID_STRIPE_STATUSES as $status) {
             foreach ($stripe->subscriptions->all(['status' => $status, 'limit' => 100])->autoPagingIterator() as $sub) {
                 $validIds[] = $sub->id;
                 $fetched++;
 
                 if ($onProgress) {
-                    $onProgress($fetched);
+                    $onProgress('fetching', $fetched, null);
                 }
             }
         }

app/Actions/Stripe/UpdateSubscriptionQuantity.php

@@ -17,7 +17,7 @@ class UpdateSubscriptionQuantity
 
     public function __construct(?StripeClient $stripe = null)
     {
-        $this->stripe = $stripe ?? new StripeClient(config('subscription.stripe_api_key'));
+        $this->stripe = $stripe ?? app(StripeClient::class);
     }
 
     /**

app/Console/Commands/Cloud/CleanupUnverifiedUsers.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Console\Commands\Cloud;
+
+use App\Models\User;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Str;
+
+class CleanupUnverifiedUsers extends Command
+{
+    protected $signature = 'cloud:cleanup-unverified-users
+                            {--yes : Delete eligible users instead of running a dry run}';
+
+    protected $description = 'Delete unverified users without Stripe subscriptions or defined resources';
+
+    public function handle(): int
+    {
+        if (! isCloud()) {
+            $this->error('This command can only be run on Coolify Cloud.');
+
+            return self::FAILURE;
+        }
+
+        $eligibleUsers = $this->eligibleUsers();
+        $eligibleCount = $eligibleUsers->count();
+
+        $this->info("Found {$eligibleCount} ".Str::plural('unverified user', $eligibleCount).' eligible for deletion.');
+        $shouldDelete = (bool) $this->option('yes');
+
+        if (! $shouldDelete) {
+            $this->warn('Dry run only. Use --yes to delete eligible users.');
+        }
+
+        $deletedCount = 0;
+
+        if ($eligibleCount > 0) {
+            $progressAction = $shouldDelete ? 'Deleting' : 'Checking';
+            $progressBar = $this->output->createProgressBar($eligibleCount);
+            $progressBar->setFormat("{$progressAction} eligible users: %current%/%max% [%bar%] %percent:3s%%");
+            $progressBar->start();
+
+            foreach ($eligibleUsers->lazyById(100) as $user) {
+                if ($shouldDelete && $user->delete()) {
+                    $deletedCount++;
+                }
+
+                $progressBar->advance();
+            }
+
+            $progressBar->finish();
+            $this->newLine(2);
+        }
+
+        if ($shouldDelete) {
+            $this->info("Deleted {$deletedCount} ".Str::plural('unverified user', $deletedCount).'.');
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function eligibleUsers(): Builder
+    {
+        return User::query()
+            ->where('id', '!=', 0)
+            ->whereNull('email_verified_at')
+            ->whereDoesntHave('teams', fn (Builder $query) => $query->whereKey(0))
+            ->whereDoesntHave('teams.subscription')
+            ->whereDoesntHave('teams.servers')
+            ->whereDoesntHave('teams', function (Builder $query) {
+                $query->whereHas('projects.applications')
+                    ->orWhereHas('projects.postgresqls')
+                    ->orWhereHas('projects.redis')
+                    ->orWhereHas('projects.mongodbs')
+                    ->orWhereHas('projects.mysqls')
+                    ->orWhereHas('projects.mariadbs')
+                    ->orWhereHas('projects.keydbs')
+                    ->orWhereHas('projects.dragonflies')
+                    ->orWhereHas('projects.clickhouses')
+                    ->orWhereHas('projects.services');
+            });
+    }
+}

app/Console/Commands/Cloud/CloudFixSubscription.php

@@ -4,6 +4,8 @@
 
 use App\Models\Team;
 use Illuminate\Console\Command;
+use Stripe\Exception\InvalidRequestException;
+use Stripe\StripeClient;
 
 class CloudFixSubscription extends Command
 {
@@ -31,7 +33,7 @@ class CloudFixSubscription extends Command
      */
     public function handle()
     {
-        $stripe = new \Stripe\StripeClient(config('subscription.stripe_api_key'));
+        $stripe = app(StripeClient::class);
 
         if ($this->option('verify-all')) {
             return $this->verifyAllActiveSubscriptions($stripe);
@@ -111,7 +113,7 @@ public function handle()
     /**
      * Fix canceled subscriptions in the database
      */
-    private function fixCanceledSubscriptions(\Stripe\StripeClient $stripe)
+    private function fixCanceledSubscriptions(StripeClient $stripe)
     {
         $isDryRun = $this->option('dry-run');
         $checkOne = $this->option('one');
@@ -220,7 +222,7 @@ private function fixCanceledSubscriptions(\Stripe\StripeClient $stripe)
                         break;
                     }
                 }
-            } catch (\Stripe\Exception\InvalidRequestException $e) {
+            } catch (InvalidRequestException $e) {
                 if ($e->getStripeCode() === 'resource_missing') {
                     $toFixCount++;
 
@@ -326,7 +328,7 @@ private function fixCanceledSubscriptions(\Stripe\StripeClient $stripe)
     /**
      * Verify all active subscriptions against Stripe API
      */
-    private function verifyAllActiveSubscriptions(\Stripe\StripeClient $stripe)
+    private function verifyAllActiveSubscriptions(StripeClient $stripe)
     {
         $isDryRun = $this->option('dry-run');
         $shouldFix = $this->option('fix-verified');
@@ -570,7 +572,7 @@ private function verifyAllActiveSubscriptions(\Stripe\StripeClient $stripe)
                             break;
                     }
 
-                } catch (\Stripe\Exception\InvalidRequestException $e) {
+                } catch (InvalidRequestException $e) {
                     $this->error('  → Error: '.$e->getMessage());
 
                     if ($e->getStripeCode() === 'resource_missing' || $e->getHttpStatus() === 404) {
@@ -730,7 +732,7 @@ private function fixSubscription($team, $subscription, $status)
     /**
      * Search for subscriptions by customer ID
      */
-    private function searchSubscriptionsByCustomer(\Stripe\StripeClient $stripe, $customerId, $requireActive = false)
+    private function searchSubscriptionsByCustomer(StripeClient $stripe, $customerId, $requireActive = false)
     {
         try {
             $subscriptions = $stripe->subscriptions->all([
@@ -770,7 +772,7 @@ private function searchSubscriptionsByCustomer(\Stripe\StripeClient $stripe, $cu
     /**
      * Search for subscriptions by team member emails
      */
-    private function searchSubscriptionsByEmails(\Stripe\StripeClient $stripe, $emails)
+    private function searchSubscriptionsByEmails(StripeClient $stripe, $emails)
     {
         $this->line('  → Searching by team member emails...');