@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/cli/deploy-init.js

@@ -39,12 +39,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK = exports.AGENTHIPPO_CLI_NPM_PACKAGE = exports.DEPLOY_PUBLIC_HOSTNAME = exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME = exports.DEPLOY_TARGETS = void 0;
 exports.isDeployTarget = isDeployTarget;
 exports.defaultRuntimeImage = defaultRuntimeImage;
+exports.packAttributionBody = packAttributionBody;
+exports.packAttributionComment = packAttributionComment;
+exports.withPackAttribution = withPackAttribution;
 exports.serveCmdArgs = serveCmdArgs;
 exports.resolveAgentHippoCliNpmVersion = resolveAgentHippoCliNpmVersion;
 exports.resolveDeployPublicHostname = resolveDeployPublicHostname;
 exports.scanEnvRefs = scanEnvRefs;
 exports.renderEnvExample = renderEnvExample;
 exports.renderAuthEnvExample = renderAuthEnvExample;
+exports.renderAuthBrokerDockerfile = renderAuthBrokerDockerfile;
+exports.isSecretLikeBasename = isSecretLikeBasename;
 exports.renderTarget = renderTarget;
 /**
  * `agenthippo deploy init` — generator for platform-native deploy artifacts
@@ -65,15 +70,58 @@ exports.renderTarget = renderTarget;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const serve_hardening_1 = require("./serve-hardening");
-exports.DEPLOY_TARGETS = ['vm', 'compose', 'cloudrun', 'databricks-app', 'spcs', 'cloudflare'];
+const identity_1 = require("./deploy/layers/identity");
+exports.DEPLOY_TARGETS = ['vm', 'compose', 'cloudrun', 'databricks-app', 'spcs', 'cloudflare', 'aws-ecs', 'azure-container-apps'];
 function isDeployTarget(value) {
     return exports.DEPLOY_TARGETS.includes(value);
 }
 /** Default runtime image for a pack engine (cursor needs the /engines layer). */
 function defaultRuntimeImage(engine) {
     return engine.trim().toLowerCase() === 'cursor'
-        ? 'ghcr.io/agenthippo/runtime:latest-cursor'
-        : 'ghcr.io/agenthippo/runtime:latest';
+        ? 'ghcr.io/agenthippoai/runtime:latest-cursor'
+        : 'ghcr.io/agenthippoai/runtime:latest';
+}
+/** Provenance line for generated deploy artifacts (pack-standard WS2). */
+function packAttributionBody(ctx) {
+    return `Generated from Agent Pack ${ctx.packName}@${ctx.packVersion} — packs.agenthippo.ai`;
+}
+function packAttributionComment(ctx, kind = 'hash') {
+    const body = packAttributionBody(ctx);
+    if (kind === 'html') {
+        return `<!-- ${body} -->`;
+    }
+    if (kind === 'sql') {
+        return `-- ${body}`;
+    }
+    return `# ${body}`;
+}
+/**
+ * Prepend pack provenance to a generated file. Skips JSON/TOML/JSONC (no comment syntax).
+ * Keeps shebangs first. Idempotent if packs.agenthippo.ai is already present near the top.
+ */
+function withPackAttribution(ctx, relPath, content) {
+    const head = content.slice(0, 400);
+    if (head.includes('packs.agenthippo.ai')) {
+        return content;
+    }
+    const base = path.basename(relPath);
+    const ext = path.extname(base).toLowerCase();
+    // Structured configs: don't invent comment syntax.
+    if (ext === '.json' || ext === '.jsonc' || base === 'wrangler.toml' || base === 'package.json') {
+        return content;
+    }
+    const kind = ext === '.html' || ext === '.md' ? 'html' :
+        ext === '.sql' ? 'sql' :
+            'hash';
+    const line = packAttributionComment(ctx, kind);
+    if (content.startsWith('#!')) {
+        const nl = content.indexOf('\n');
+        if (nl === -1) {
+            return `${content}\n${line}\n`;
+        }
+        return `${content.slice(0, nl + 1)}${line}\n${content.slice(nl + 1)}`;
+    }
+    return `${line}\n${content}`;
 }
 /** `serve` argv baked into generated Dockerfiles (matches agent.yaml engine/model). */
 function serveCmdArgs(ctx, opts) {
@@ -108,11 +156,11 @@ exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME = 'auth.agenthippo.ai';
 /** @deprecated Use {@link DEFAULT_DEPLOY_PUBLIC_HOSTNAME}. */
 exports.DEPLOY_PUBLIC_HOSTNAME = exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME;
 /** npm package for Databricks Apps source deploy (org: agenthippo-ai). */
-exports.AGENTHIPPO_CLI_NPM_PACKAGE = '@agenthippo-ai/cli';
+exports.AGENTHIPPO_CLI_NPM_PACKAGE = '@agenthippo-ai/agenthippo';
 /** Fallback when monorepo package.json is not present (customer runs published CLI). */
 exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK = 'latest';
 /**
- * Pin @agenthippo-ai/cli to the monorepo release version when `deploy init` runs from
+ * Pin @agenthippo-ai/agenthippo to the monorepo release version when `deploy init` runs from
  * a dev checkout; otherwise fall back to `latest`.
  */
 function resolveAgentHippoCliNpmVersion() {
@@ -192,8 +240,11 @@ function renderEnvExample(vars, opts) {
     if (isCursor) {
         lines.push('# Cursor engine (pack default model: auto):', 'CURSOR_API_KEY=             # https://cursor.com/settings → API keys');
     }
+    else if (opts?.gatewayDirect) {
+        lines.push('# Gateway-direct routing (agent → gateway.agenthippo.ai — no in-pod LiteLLM sidecar):', 'AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1', 'AGENTHIPPO_LITELLM_API_KEY=   # ahgw_… from create-gateway-key on the gateway host');
+    }
     else {
-        lines.push('# Model credential — pick ONE path (serve-v3 §10.2):', '#   ANTHROPIC_API_KEY=        # direct Anthropic', '#   CLAUDE_CODE_USE_BEDROCK=1 # existing AWS Bedrock entitlement (no new key)', '#   CLAUDE_CODE_USE_VERTEX=1  # existing GCP Vertex entitlement (no new key)', 'ANTHROPIC_API_KEY=');
+        lines.push('# Model credential — pick ONE path (serve-v3 §10.2):', '#   AgentHippo hosted gateway (colocated agents / CI — long-lived service key):', '#   AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1', '#   AGENTHIPPO_LITELLM_API_KEY=ahgw_…   # bun run create-gateway-key on gateway host', '#   Direct Anthropic:', 'ANTHROPIC_API_KEY=', '#   CLAUDE_CODE_USE_BEDROCK=1 # existing AWS Bedrock entitlement (no new key)', '#   CLAUDE_CODE_USE_VERTEX=1  # existing GCP Vertex entitlement (no new key)');
     }
     if (vars.length > 0) {
         lines.push('', '# Pack-referenced secrets (scanned from ${env:...}):');
@@ -202,7 +253,7 @@ function renderEnvExample(vars, opts) {
         }
     }
     if (opts?.edge) {
-        lines.push('', '# Public hostname — set once; Caddyfile reads {$AGENTHIPPO_PUBLIC_HOSTNAME}.', `AGENTHIPPO_PUBLIC_HOSTNAME=${hostname}`, '', '# Edge auth secrets (JWT signing key, Google OAuth client/cookie) live in .env.auth,', '# which is loaded ONLY by the auth-broker and oauth2-proxy services — never the agent.', '# Keeping the token-signing key out of the agent container limits blast radius if the', '# agent (which runs model-driven tool calls) is compromised. Copy .env.auth.example.', '', '# Cloudflare Tunnel (free — no Access seats), config-file mode in compose:', '#   cloudflared tunnel create <name>  → save the JSON as deploy/tunnel-credentials.json (gitignored)', '#   set the tunnel id in deploy/cloudflared.yml; cloudflared tunnel route dns <name> <hostname>', '# No token/env needed — the credentials JSON is mounted into the cloudflared container.');
+        lines.push('', '# Public hostname — set once; Caddyfile reads {$AGENTHIPPO_PUBLIC_HOSTNAME}.', `AGENTHIPPO_PUBLIC_HOSTNAME=${hostname}`, '', '# Multi-replica (serve-v4 P1): sticky by X-Agent-User in Caddyfile.', '#   docker compose up --scale agent=N', '#   AGENTHIPPO_STATE_S3_URI=s3://bucket/prefix   # S3-compatible (MinIO/R2/GCS/AWS)', '#   AGENTHIPPO_STATE_S3_ENDPOINT=                 # optional, e.g. http://minio:9000', '#   AGENTHIPPO_STATE_RESTORE_BOOT=none            # restore-on-miss (required when N>1)', '# Scale-down: drain (/ready inflight=0) then remove replica — see serve-v3-RUNBOOK.', '', '# Edge auth secrets (JWT signing key, Google OAuth client/cookie) live in .env.auth,', '# which is loaded ONLY by the auth-broker and oauth2-proxy services — never the agent.', '# Keeping the token-signing key out of the agent container limits blast radius if the', '# agent (which runs model-driven tool calls) is compromised. Copy .env.auth.example.', '', '# Cloudflare Tunnel (free — no Access seats), config-file mode in compose:', '#   cloudflared tunnel create <name>  → save the JSON as deploy/tunnel-credentials.json (gitignored)', '#   set the tunnel id in deploy/cloudflared.yml; cloudflared tunnel route dns <name> <hostname>', '# No token/env needed — the credentials JSON is mounted into the cloudflared container.');
     }
     return lines.join('\n') + '\n';
 }
@@ -229,6 +280,7 @@ function renderAuthEnvExample(opts) {
             'AGENTHIPPO_AUTH_JWT_SECRET=   # copy from auth.agenthippo.ai (openssl rand -hex 32 to generate one)',
             `AGENTHIPPO_AUTH_PUBLIC_URL=https://${hostname}`,
             'AGENTHIPPO_AUTH_ALLOWED_DOMAINS=agenthippo.ai',
+            'AGENTHIPPO_AUTH_DEV=0         # 1 enables /oauth/dev/login (tests only; never in production)',
             `AGENTHIPPO_AUTH_COOKIE_DOMAIN=${cookieDomain}   # scope the shared cookie to all subdomains`,
             `AGENTHIPPO_AUTH_IDP_URL=${idp}   # where browsers are sent to log in`,
             'AGENTHIPPO_AUTH_COOKIE_NAME=ah_token',
@@ -246,6 +298,7 @@ function renderAuthEnvExample(opts) {
             '# one Google OAuth client live only at the IdP.',
         ].join('\n') + '\n';
     }
+    const cookieDomain = opts?.cookieDomain || '.agenthippo.ai';
     return [
         '# Generated by `agenthippo deploy init`. Copy to .env.auth and fill in.',
         '# Loaded only by auth-broker + oauth2-proxy (docker-compose.yml). Never given to the agent.',
@@ -260,15 +313,16 @@ function renderAuthEnvExample(opts) {
         'OAUTH2_PROXY_EMAIL_DOMAINS=example.com',
         'OAUTH2_PROXY_REVERSE_PROXY=true',
         `OAUTH2_PROXY_REDIRECT_URL=https://${hostname}/oauth2/callback`,
-        '# Federated SSO (A′) — set when this edge is the central IdP for *.agenthippo.ai agents:',
-        'OAUTH2_PROXY_COOKIE_DOMAINS=.agenthippo.ai   # scope the oauth2-proxy session cookie to all subdomains',
+        '# Federated SSO (A′) — set when this edge is the central IdP for a fleet of agents:',
+        `OAUTH2_PROXY_COOKIE_DOMAINS=${cookieDomain}   # scope the oauth2-proxy session cookie to all subdomains`,
         '',
         '# IDE auth broker (team bootstrap for store + LiteLLM routing)',
         'AGENTHIPPO_AUTH_JWT_SECRET=   # openssl rand -hex 32',
         'AGENTHIPPO_AUTH_PUBLIC_URL=https://' + hostname,
         'AGENTHIPPO_AUTH_ALLOWED_DOMAINS=example.com',
+        'AGENTHIPPO_AUTH_DEV=0         # 1 enables /oauth/dev/login (tests only; never in production)',
         'AGENTHIPPO_AUTH_COOKIE_NAME=ah_token   # federated cookie holding the AgentHippo JWT',
-        'AGENTHIPPO_AUTH_COOKIE_DOMAIN=.agenthippo.ai   # set so /oauth/browser-login stamps a cross-subdomain cookie',
+        `AGENTHIPPO_AUTH_COOKIE_DOMAIN=${cookieDomain}   # set so /oauth/browser-login stamps a cross-subdomain cookie`,
         'AGENTHIPPO_TEAM_ID=team_default',
         'AGENTHIPPO_TEAM_NAME=Default Team',
         'AGENTHIPPO_TEAM_STORE_REPO=agenthippoai/agenthippo-store',
@@ -283,7 +337,7 @@ function renderAuthBrokerDockerfile() {
     return [
         '# Auth broker for IDE sign-in + team bootstrap API.',
         '# Build context = pack root: docker build -f deploy/Dockerfile.auth-broker -t <pack>-auth-broker:local .',
-        'FROM ghcr.io/agenthippo/runtime:local-cursor',
+        'FROM ghcr.io/agenthippoai/runtime:latest',
         'ENV AGENTHIPPO_AUTH_PORT=9780',
         'ENV AGENTHIPPO_AUTH_DATA_DIR=/data',
         'EXPOSE 9780',
@@ -292,6 +346,18 @@ function renderAuthBrokerDockerfile() {
         '',
     ].join('\n');
 }
+/** Secret-like basenames beyond `.env` and `*credentials*.json` — private keys, keystores, and
+ * credential files of any extension. Shared by renderDockerignore() below and copyPackToStaging()
+ * in commands/deploy.ts so the staging dir on disk and the generated .dockerignore never diverge. */
+function isSecretLikeBasename(base) {
+    if (/credentials/i.test(base))
+        return true;
+    if (/\.(pem|key|p12|pfx|jks|gpg|pgp)$/i.test(base))
+        return true;
+    if (/^id_(rsa|dsa|ecdsa|ed25519)$/i.test(base))
+        return true;
+    return false;
+}
 /** .dockerignore emitted alongside every image-building target's Dockerfile.
  * Keeps skills/, references/, scripts/ (required at runtime) and drops only VCS,
  * cache, and build cruft. node_modules is excluded so the linux/amd64 image
@@ -324,8 +390,20 @@ function renderDockerignore() {
         '.vscode',
         '*.swp',
         '# Secrets anywhere in the pack (defensive; deploy/ secrets are also covered below).',
+        '# Keep in sync with isSecretLikeBasename() above.',
         '**/.env',
-        '**/*credentials*.json',
+        '**/*credentials*',
+        '**/*.pem',
+        '**/*.key',
+        '**/*.p12',
+        '**/*.pfx',
+        '**/*.jks',
+        '**/*.gpg',
+        '**/*.pgp',
+        '**/id_rsa',
+        '**/id_dsa',
+        '**/id_ecdsa',
+        '**/id_ed25519',
         '# deploy/ holds build/deploy artifacts + secrets; only deploy/www/ ships at runtime.',
         'deploy/*',
         '!deploy/www',
@@ -362,17 +440,23 @@ function skillDepsInstallLines() {
 function agentServeHostEnvYaml(indent = '            ') {
     return `${indent}- { name: ${serve_hardening_1.SERVE_HOST_ENV}, value: ${serve_hardening_1.CONTAINER_SERVE_HOST} }`;
 }
-/** The Dockerfile shared by image-based targets (serve-v3 §A2). */
+/** The Dockerfile shared by image-based targets (serve-v3 §A2).
+ *  `extraEnv`: platform-specific ENV lines — e.g. pinning AGENTHIPPO_IDENTITY_HEADER for a
+ *  target whose container may be directly reachable (governance: identity-header pinning). */
 function sharedDockerfile(ctx, opts) {
     const cmd = serveCmdArgs(ctx, opts).map((a) => `"${a}"`).join(',');
     return [
-        `# Generated by \`agenthippo deploy init\`. Build context = pack root:`,
+        `${packAttributionComment(ctx)}. Build context = pack root:`,
         `#   docker build -f deploy/Dockerfile -t ${ctx.packName}:local .`,
         `FROM ${ctx.image}`,
+        `LABEL ai.agenthippo.pack.name="${ctx.packName}"`,
+        `LABEL ai.agenthippo.pack.version="${ctx.packVersion}"`,
+        `LABEL ai.agenthippo.pack.engine="${ctx.engine}"`,
         `COPY . /app/pack/`,
         ...skillDepsInstallLines(),
         `ENV AGENTHIPPO_NO_AUTO_INSTALL=1`,
         `ENV ${serve_hardening_1.SERVE_HOST_ENV}=${serve_hardening_1.CONTAINER_SERVE_HOST}`,
+        ...Object.entries(opts?.extraEnv ?? {}).map(([k, v]) => `ENV ${k}=${v}`),
         `EXPOSE ${ctx.port}`,
         // Runtime base image sets ENTRYPOINT ["agenthippo"]; CMD args append to it.
         `CMD [${cmd}]`,
@@ -448,95 +532,66 @@ function renderLandingPage(packName) {
         '',
     ].join('\n');
 }
+/** Sticky upstream for multi-replica serve (serve-v4 P1.1).
+ * Hash on X-Agent-User (SSO identity the edge already injects) so a user's
+ * sessions stay on one replica — keeps local state + in-process RateLimiter
+ * correct without Redis. Fallback ip_hash for tokened API callers without SSO.
+ * Scale: `docker compose up --scale agent=N` (set AGENTHIPPO_STATE_RESTORE_BOOT=none).
+ */
+function renderStickyAgentProxy(port, indent = '    ') {
+    return [
+        `${indent}# serve-v4 P1.1: sticky by user identity (not session body — edge can't hash POST).`,
+        `${indent}# In-process RateLimiter is globally correct per user under this policy.`,
+        `${indent}reverse_proxy agent:${port} {`,
+        `${indent}  lb_policy header X-Agent-User {`,
+        `${indent}    fallback ip_hash`,
+        `${indent}  }`,
+        `${indent}}`,
+    ];
+}
 /** Caddy config for the `edge` compose profile (oauth2-proxy + agent on Docker network). */
 function renderCaddyfile(ctx) {
+    const fed = ctx.ingress === 'edge-fed';
+    const idp = (ctx.idpUrl || '').trim().replace(/\/+$/, '');
+    const catchallBody = [
+        '    @api path /v1/*',
+        '    handle @api {',
+        ...renderStickyAgentProxy(ctx.port, '      '),
+        '    }',
+        '    root * /srv/www',
+        '    file_server',
+    ];
     return [
         '# SSO edge + Cloudflare Tunnel. Set AGENTHIPPO_PUBLIC_HOSTNAME in .env (Caddy reads it below).',
         '# TLS terminates at Cloudflare; origin listens on HTTP only.',
+        ...(fed
+            ? [
+                `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
+                '# this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser).',
+            ]
+            : []),
         '{',
         '  auto_https off',
         '}',
         '',
         'http://{$AGENTHIPPO_PUBLIC_HOSTNAME} {',
-        '  # Federated SSO (A′): browsers from *.agenthippo.ai subdomains land here to log in.',
-        '  # Gated behind oauth2-proxy (Google) → auth-broker mints + sets the shared .agenthippo.ai',
-        '  # cookie (ah_token), then redirects back to the agent subdomain (`return_to`). Must come',
-        '  # before the generic /oauth/* handle so it wins for this exact path.',
-        '  handle /oauth/browser-login {',
-        '    forward_auth oauth2-proxy:4180 {',
-        '      uri /oauth2/auth',
-        '      copy_headers X-Auth-Request-Email',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        redir * "/oauth2/sign_in?rd=/oauth/browser-login{http.request.uri.query}"',
-        '      }',
-        '    }',
-        '    reverse_proxy auth-broker:9780 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  handle /oauth/* {',
-        '    reverse_proxy auth-broker:9780 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  handle /api/ide/* {',
-        '    reverse_proxy auth-broker:9780 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  handle /oauth2/* {',
-        '    reverse_proxy oauth2-proxy:4180 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  @health path /health /ready',
-        '  handle @health {',
-        `    reverse_proxy agent:${ctx.port}`,
-        '  }',
-        '  # API clients (IDE) with a Bearer token: validate via auth-broker, copy identity header.',
-        '  @apiWithAuth {',
-        '    path /v1/*',
-        '    header Authorization *',
-        '  }',
-        '  handle @apiWithAuth {',
-        '    forward_auth auth-broker:9780 {',
-        '      uri /api/ide/me',
-        '      copy_headers X-Agent-User',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        respond "Unauthorized" 401',
-        '      }',
-        '    }',
-        `    reverse_proxy agent:${ctx.port}`,
-        '  }',
-        '  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User.',
-        '  handle {',
-        '    forward_auth oauth2-proxy:4180 {',
-        '      uri /oauth2/auth',
-        '      copy_headers X-Auth-Request-Email>X-Agent-User',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        redir * "/oauth2/sign_in?rd={http.request.uri.path}{http.request.uri.query}"',
-        '      }',
-        '    }',
-        '    @api path /v1/*',
-        '    handle @api {',
-        `      reverse_proxy agent:${ctx.port}`,
-        '    }',
-        '    root * /srv/www',
-        '    file_server',
-        '  }',
+        ...(fed
+            ? (0, identity_1.renderIdentityLayer)({
+                mode: 'federated',
+                authBrokerAddr: 'auth-broker:9780',
+                idpUrl: idp,
+                healthProxy: renderStickyAgentProxy(ctx.port, '    '),
+                agentProxy: renderStickyAgentProxy(ctx.port, '    '),
+                catchallBody,
+            })
+            : (0, identity_1.renderIdentityLayer)({
+                mode: 'self-issued',
+                oauth2ProxyAddr: 'oauth2-proxy:4180',
+                authBrokerAddr: 'auth-broker:9780',
+                healthProxy: renderStickyAgentProxy(ctx.port, '    '),
+                agentProxy: renderStickyAgentProxy(ctx.port, '    '),
+                catchallBody,
+            })),
         '}',
         '',
     ].join('\n');
@@ -577,9 +632,10 @@ function renderAgentComposeService(ctx, extraLines = []) {
         '',
     ];
 }
-/** oauth2-proxy + Caddy services for `--profile edge`. */
-function renderEdgeComposeServices() {
-    return [
+/** oauth2-proxy (self-issued only) + auth-broker + Caddy services for `--profile edge`.
+ *  `fed`: federated (verify-only against a central IdP) — no oauth2-proxy, no local Google client. */
+function renderEdgeComposeServices(fed) {
+    const oauth2Proxy = fed ? [] : [
         '  oauth2-proxy:',
         '    profiles: ["edge"]',
         '    image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
@@ -597,6 +653,9 @@ function renderEdgeComposeServices() {
         '      OAUTH2_PROXY_REVERSE_PROXY: "true"',
         '    expose: ["4180"]',
         '',
+    ];
+    return [
+        ...oauth2Proxy,
         '  auth-broker:',
         '    profiles: ["edge"]',
         '    build:',
@@ -622,7 +681,7 @@ function renderEdgeComposeServices() {
         '        required: false',
         '    ports: ["80:80", "443:443"]  # use 80:80 not 127.0.0.1:80 — breaks vmnetd on some Docker Desktop builds',
         '    volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro", "./www:/srv/www:ro"]',
-        '    depends_on: [oauth2-proxy, agent, auth-broker]',
+        `    depends_on: [${fed ? 'agent, auth-broker' : 'oauth2-proxy, agent, auth-broker'}]`,
         '',
     ];
 }
@@ -646,7 +705,7 @@ function renderTunnelComposeServices() {
 function renderEdgeTunnelUpScript(hostname) {
     return [
         '#!/usr/bin/env bash',
-        '# T0.5b — Cloudflare Tunnel + Google SSO (no Access seats). Run from pack root.',
+        '# T0.5b — Cloudflare Tunnel + Google SSO (no Access seats). Run: bash deploy/run-edge-tunnel.sh',
         'set -euo pipefail',
         'cd "$(dirname "$0")"',
         'docker compose --profile edge --profile tunnel up -d --build',
@@ -654,7 +713,113 @@ function renderEdgeTunnelUpScript(hostname) {
         '',
     ].join('\n');
 }
+/**
+ * Same-host colocation (PLAN/deploy.md §4 state 4, `d5-colocate`): this agent rides the org
+ * IdP's already-running Caddy + auth-broker instead of shipping its own — no Caddy, no
+ * oauth2-proxy, no local auth-broker, no local auth secrets at all. Ships only the agent
+ * container (joining the IdP's `agenthippo-idp-colocate` docker network via a fixed,
+ * predictable container name) plus a Caddy route snippet for the operator to drop into the
+ * IdP's `agents/` import directory (see enterprise-deploy/idp/Caddyfile + agents/README.md).
+ */
+function renderColocatedArtifacts(ctx) {
+    const idp = (ctx.idpUrl || '').trim().replace(/\/+$/, '');
+    const containerName = `${ctx.packName}-agent`;
+    const compose = [
+        '# Colocated agent (PLAN/deploy.md §4 state 4) — no Caddy/oauth2-proxy/auth-broker of its',
+        '# own. Joins the org IdP\'s docker network so its already-running Caddy can reach this',
+        '# agent by name; identity is verified entirely by the IdP\'s auth-broker (see',
+        '# deploy/agent-route.caddy for the route to copy onto the IdP host).',
+        `name: ${ctx.packName}`,
+        'services:',
+        '  agent:',
+        `    container_name: ${containerName}`,
+        '    build:',
+        '      context: ..',
+        '      dockerfile: deploy/Dockerfile',
+        '    env_file:',
+        '      - path: .env',
+        '        required: false',
+        '    volumes: ["agenthippo-state:/state"]',
+        '    networks: [colocate]',
+        `    expose: ["${ctx.port}"]`,
+        '',
+        'networks:',
+        '  colocate:',
+        '    external: true',
+        '    name: ${AGENTHIPPO_IDP_NETWORK:-agenthippo-idp-colocate}',
+        '',
+        'volumes:',
+        '  agenthippo-state:',
+        '',
+    ].join('\n');
+    const snippet = [
+        `# Colocated route for ${ctx.publicHostname} — copy into enterprise-deploy/idp/agents/`,
+        '# (rename e.g. to ' + ctx.packName + '.caddy), then on the IdP host:',
+        '#   docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile',
+        '# Requires this agent\'s docker-compose.yml (already generated) to be up, so',
+        `# ${containerName} exists on the shared \`agenthippo-idp-colocate\` network.`,
+        '# http:// (not https://) to match the IdP Caddyfile\'s TLS model: auto_https is off',
+        '# there and TLS terminates in front (Cloudflare Tunnel/nginx), so every site block —',
+        '# including this imported one — must be plain HTTP, same as the IdP\'s own site address.',
+        `http://${ctx.publicHostname} {`,
+        ...(0, identity_1.renderIdentityLayer)({
+            mode: 'federated',
+            authBrokerAddr: 'auth-broker:9780',
+            idpUrl: idp,
+            healthProxy: [`    reverse_proxy ${containerName}:${ctx.port}`],
+            agentProxy: [`    reverse_proxy ${containerName}:${ctx.port}`],
+        }),
+        '}',
+        '',
+    ].join('\n');
+    return {
+        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+        'docker-compose.yml': compose,
+        'agent-route.caddy': snippet,
+        'www/index.html': renderLandingPage(ctx.packName),
+        'README.md': [
+            `# Deploy: ${ctx.packName} — colocated with the org IdP`,
+            '',
+            'No Caddy, no oauth2-proxy, no local auth-broker, no auth secrets on this host — this',
+            'agent rides the org IdP\'s already-running edge (`enterprise-deploy/idp/`) instead.',
+            '',
+            '```bash',
+            'cp deploy/.env.example deploy/.env   # model key only — no auth secrets here at all',
+            '# Point at the IdP\'s colocate network if it was created under a different compose',
+            '# project name: export AGENTHIPPO_IDP_NETWORK=agenthippo-idp-colocate (the default)',
+            'docker compose -f deploy/docker-compose.yml up -d --build',
+            '',
+            '# Wire the route into the IdP\'s Caddy (one-time per agent):',
+            `cp deploy/agent-route.caddy <idp-host>:enterprise-deploy/idp/agents/${ctx.packName}.caddy`,
+            'docker compose -f enterprise-deploy/idp/docker-compose.yml exec caddy \\',
+            '  caddy reload --config /etc/caddy/Caddyfile',
+            '```',
+            '',
+            `DNS: point \`${ctx.publicHostname}\` at the IdP host (same as every other agent it fronts).`,
+            '',
+            '**hippopennyg / bare-metal (Cloudflare → nginx:443 → IdP Caddy :8080):** `deploy init` does',
+            '**not** create DNS or nginx for you. Without an explicit Cloudflare **A record**, the name',
+            'falls through to the `*.agenthippo.ai` wildcard (`ghs.googlehosted.com` from',
+            '`setup-agenthippo-domain.sh` for Cloud Run) — the site will look "broken" or hit Google.',
+            'After the steps above, run:',
+            '',
+            '```bash',
+            './enterprise-deploy/scripts/setup-colocated-agent-edge.sh \\',
+            `  --hostname ${ctx.publicHostname} --ssh root@168.119.174.239`,
+            '```',
+            '',
+            'See `enterprise-deploy/idp/agents/README.md` for the full checklist.',
+            '**Browser:** after Google SSO, open `https://' + ctx.publicHostname + '/` for the static chat UI',
+            '(`deploy/www/index.html` served by the agent container at GET /).',
+            '',
+            ...renderEgressNote(ctx),
+        ].join('\n'),
+    };
+}
 function vmArtifacts(ctx) {
+    if (ctx.ingress === 'edge-fed' && ctx.colocate) {
+        return renderColocatedArtifacts(ctx);
+    }
     const hostname = ctx.publicHostname;
     const run = [
         '#!/usr/bin/env bash',
@@ -715,7 +880,7 @@ function vmArtifacts(ctx) {
         '#   edge only:     docker compose --profile edge up -d  (SSO on :443, no tunnel)',
         'services:',
         ...renderAgentComposeService(ctx),
-        ...renderEdgeComposeServices(),
+        ...renderEdgeComposeServices(ctx.ingress === 'edge-fed'),
         ...renderTunnelComposeServices(),
         'volumes:',
         '  agenthippo-state:',
@@ -736,6 +901,10 @@ function vmArtifacts(ctx) {
         'README.md': [
             `# Deploy: ${ctx.packName} — T0.5 workbench/VM`,
             '',
+            'Staging root = this directory\'s parent (full pack copy). Commands below run from the staging root unless noted.',
+            '',
+            'To regenerate: run `agenthippo deploy init <path-to-pack> --target vm` from the **parent** of the pack (not from inside the pack), then `cd deploy-out/' + ctx.packName + '-vm`.',
+            '',
             '`cp deploy/.env.example deploy/.env` and fill in, then pick a path:',
             '',
             '**T0.5a — VPN only (simplest internal pilot)**',
@@ -746,18 +915,16 @@ function vmArtifacts(ctx) {
             '',
             '**T0.5b — Cloudflare Tunnel + Google SSO (recommended for WFH, no Access seats)**',
             '```bash',
-            'agenthippo deploy init . --target vm --force   # from pack root; review deploy/',
             'cp deploy/.env.example deploy/.env            # agent: model key + public hostname',
             'cp deploy/.env.auth.example deploy/.env.auth  # broker/oauth2-proxy: JWT + OAuth secrets (never loaded by the agent)',
             '# 1. Google Cloud → OAuth Web client for https://' + hostname,
             '#    Authorized origin + redirect: https://' + hostname + '/oauth2/callback',
             '# 2. cloudflared tunnel create <name>',
-            '#    cp ~/.cloudflared/<tunnel-id>.json deploy/tunnel-credentials.json  # gitignore; secret',
+            '#    cp ~/.cloudflared/<tunnel-id>.json ~/.agent-hippo/tunnel-credentials.json  # secret',
             '#    set tunnel: <tunnel-id> in deploy/cloudflared.yml',
             '#    cloudflared tunnel route dns <name> ' + hostname,
             '# 3. Fill deploy/.env (hostname, model key) and deploy/.env.auth (OAUTH2_PROXY_*, AGENTHIPPO_AUTH_JWT_SECRET)',
-            'cd deploy && docker compose --profile edge --profile tunnel up -d --build',
-            '# or from pack root: bash deploy/run-edge-tunnel.sh',
+            'bash deploy/run-edge-tunnel.sh',
             '# Users open https://' + hostname + ' → Google login → static chat UI → /v1/chat',
             '```',
             'Tunnel routing is **config-file mode** (`deploy/cloudflared.yml` → `http://caddy:80` on the compose network), not the Cloudflare dashboard public-hostname UI alone.',
@@ -770,6 +937,7 @@ function vmArtifacts(ctx) {
             '',
             '**Do not commit** `deploy/.env`, `deploy/.env.auth`, or `deploy/tunnel-credentials.json`.',
             '',
+            ...renderEgressNote(ctx),
         ].join('\n'),
     };
 }
@@ -799,6 +967,9 @@ const OTEL_COLLECTOR_COMPOSE_YAML = [
     '',
 ].join('\n');
 function composeArtifacts(ctx) {
+    if (ctx.ingress === 'edge-fed' && ctx.colocate) {
+        return renderColocatedArtifacts(ctx);
+    }
     const channels = ctx.gatewayChannels?.trim();
     const hostname = ctx.publicHostname;
     // Agent Anywhere: override the agent command to also run the gateway bridge,
@@ -820,7 +991,7 @@ function composeArtifacts(ctx) {
             '  # OPENCLAW_GATEWAY_TOKEN (or a paired device) to connect. Set it in .env.',
             '  openclaw-gateway:',
             '    profiles: ["channels"]',
-            '    image: ghcr.io/agenthippo/openclaw-gateway:2026.06',
+            '    image: ghcr.io/agenthippoai/openclaw-gateway:2026.06',
             '    env_file:',
             '      - path: .env',
             '        required: false',
@@ -845,13 +1016,13 @@ function composeArtifacts(ctx) {
         '# e.g.: docker compose -f deploy/docker-compose.yml --profile edge --profile tunnel up -d',
         'services:',
         ...renderAgentComposeService(ctx, agentExtra),
-        ...renderEdgeComposeServices(),
+        ...renderEdgeComposeServices(ctx.ingress === 'edge-fed'),
         ...renderTunnelComposeServices(),
         '  # LiteLLM gateway — self-contained image bakes the Spotlight config + OTEL hooks',
         '  # (build: docker build -f extensions/agentide/scripts/Dockerfile.litellm -t this-tag .)',
         '  litellm:',
         '    profiles: ["gateway"]',
-        '    image: ghcr.io/agenthippo/litellm-gateway:2026.06',
+        '    image: ghcr.io/agenthippoai/litellm-gateway:2026.06',
         '    env_file:',
         '      - path: .env',
         '        required: false',
@@ -902,6 +1073,7 @@ function composeArtifacts(ctx) {
             'Profiles compose: e.g. `--profile gateway --profile edge --profile tunnel up -d`.',
             'LiteLLM must speak Anthropic API format — our gateway image does.',
             '',
+            ...renderEgressNote(ctx),
         ].join('\n'),
     };
 }
@@ -921,6 +1093,9 @@ function composeArtifacts(ctx) {
  */
 function litellmProviderKeyEnv(model) {
     const m = (model || '').toLowerCase();
+    if (m === 'ah-auto') {
+        return 'AGENTHIPPO_GATEWAY_KEY';
+    }
     if (m.includes('codex')) {
         return 'OPENAI_CODEX_API_KEY';
     }
@@ -932,6 +1107,102 @@ function litellmProviderKeyEnv(model) {
     }
     return 'OPENAI_API_KEY';
 }
+/** True when the pack uses the managed Auto placeholder (routes via gateway.agenthippo.ai). */
+function isAhAutoModel(model) {
+    return (model || '').trim().toLowerCase() === 'ah-auto';
+}
+/** Org gateway base URL — agent gateway-direct mode points here (same as colocated agents). */
+const AGENTHIPPO_GATEWAY_BASE_URL = 'https://gateway.agenthippo.ai/v1';
+function usesGatewayDirect(ctx) {
+    return ctx.modelRouting === 'gateway';
+}
+/** The model-provider API host this pack's engine actually talks to — the one thing every
+ *  target's container needs outbound network access to. Generalizes the `spcs` target's
+ *  enforced "one EAI to api.anthropic.com" egress allowlist into a documented note every
+ *  other target ships too (governance layer, PLAN/deploy.md §6). */
+function egressHost(ctx) {
+    if (ctx.engine.trim().toLowerCase() === 'cursor') {
+        return 'api2.cursor.sh';
+    }
+    if (isAhAutoModel(ctx.model)) {
+        return 'gateway.agenthippo.ai';
+    }
+    const m = (ctx.model || '').toLowerCase();
+    if (m.includes('codex') || m.includes('gpt') || m.includes('openai')) {
+        return 'api.openai.com';
+    }
+    return 'api.anthropic.com';
+}
+/** Egress allowlist note, appended to a target's README (governance layer). */
+function renderEgressNote(ctx) {
+    const sidecarNote = usesGatewayDirect(ctx)
+        ? '.'
+        : ' — and, if the LiteLLM gateway/Spotlight sidecar is enabled, its own outbound is the same host.';
+    return [
+        `**Egress:** this container only needs outbound access to \`${egressHost(ctx)}:443\` (your model provider)${sidecarNote}`,
+        'Restrict egress to this allowlist if your org requires it.',
+        '',
+    ];
+}
+/**
+ * Data & access summary (governance layer, PLAN/deploy.md §3/§6): one generated page
+ * enumerating what secrets exist, what leaves the network, and the blast radius per
+ * component — pre-answering the questions a security review asks before it asks them.
+ * The `spcs` target's "one EAI to api.anthropic.com" README line is the model this
+ * generalizes to every target instead of leaving it to just one platform.
+ */
+function renderDataAccessSummary(ctx, target, edge, fed, colocate) {
+    const secrets = [
+        `\`${litellmProviderKeyEnv(ctx.model)}\` (or the pack's configured provider key) — your model provider credential`,
+    ];
+    const blastRadius = [
+        '**agent container** — can reach your model provider and read/write its own state volume. ' +
+            'Never holds the JWT signing secret or any OAuth client secret (`.env` vs `.env.auth` split).',
+    ];
+    if (edge) {
+        secrets.push('`AGENTHIPPO_AUTH_JWT_SECRET` — signs/verifies IDE bootstrap tokens (auth-broker only, never the agent)');
+        blastRadius.push('**auth-broker** — holds the JWT signing secret' +
+            (fed ? ' (shared with the central IdP)' : '') +
+            '; mints/verifies IDE tokens. Does not hold model provider credentials.');
+        if (!fed) {
+            secrets.push('`OAUTH2_PROXY_CLIENT_SECRET` + `OAUTH2_PROXY_COOKIE_SECRET` — this deployment\'s own Google OAuth client (oauth2-proxy only, never the agent)');
+            blastRadius.push('**oauth2-proxy** — holds this deployment\'s Google OAuth client secret; terminates the Google ' +
+                'login flow. Does not hold the JWT signing secret or model credentials.');
+        }
+    }
+    else if (colocate) {
+        blastRadius.push('**this deployment holds no auth secrets at all** — identity is verified entirely by the ' +
+            'org IdP\'s own auth-broker (see `agent-route.caddy`); nothing here signs or stores a JWT secret.');
+    }
+    return [
+        `# Data & access summary — ${ctx.packName} (${target}${ctx.ingress ? ` / ${ctx.ingress}` : ''})`,
+        '',
+        'Generated by `agenthippo deploy init` — answers the questions a security review asks first.',
+        '',
+        '## Secrets',
+        ...secrets.map((s) => `- ${s}`),
+        '',
+        '## Egress',
+        `- Outbound network access is needed only to \`${egressHost(ctx)}:443\` (your model provider).`,
+        ...(edge && fed ? [
+            '- API/Bearer requests are verified locally against the shared JWT secret — no network call ' +
+                'to the central IdP per request. The one-time browser login flow (unauthenticated visitors) ' +
+                'does redirect to the central IdP\'s public URL to sign in.',
+        ] : []),
+        ...(edge && !fed ? [
+            '- Google SSO calls `accounts.google.com` during login only (oauth2-proxy); no other third party is contacted per request.',
+        ] : []),
+        ...(colocate ? [
+            '- Identity is verified via the org IdP\'s own auth-broker over the shared private docker ' +
+                'network (`agenthippo-idp-colocate`), not a public network call. The one-time browser login ' +
+                'flow (unauthenticated visitors) still redirects to the central IdP\'s public URL to sign in.',
+        ] : []),
+        '',
+        '## Blast radius per component',
+        ...blastRadius.map((b) => `- ${b}`),
+        '',
+    ].join('\n');
+}
 function renderCloudrunServiceYaml(ctx) {
     const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
     return [
@@ -967,6 +1238,11 @@ function renderCloudrunServiceYaml(ctx) {
         '          env:',
         '            - { name: AGENTHIPPO_HOME, value: /state }',
         '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
+        // Pin serve to trust ONLY the IAP-verified header, so an authenticated caller
+        // cannot impersonate another user via a spoofed X-Agent-User header. The deploy
+        // script fills this with x-goog-authenticated-user-email when IAP is enabled, or
+        // leaves it empty (unpinned) during an ENABLE_IAP=0 bootstrap deploy.
+        '            - { name: AGENTHIPPO_IDENTITY_HEADER, value: "${IDENTITY_HEADER_VALUE}" }',
         agentServeHostEnvYaml(),
         '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
         '            - name: AGENTHIPPO_LITELLM_API_KEY',
@@ -1064,7 +1340,7 @@ function renderCloudrunSpotlightDeploy(ctx) {
         'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
         'REPO="${ARTIFACT_REPO:-agenthippo}"',
         'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippo/litellm-gateway:2026.06}"',
+        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippoai/litellm-gateway:2026.07}"',
         'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
         '# LITELLM_KEY = the proxy key the agent presents to LiteLLM (and LiteLLM master key).',
         'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
@@ -1075,10 +1351,10 @@ function renderCloudrunSpotlightDeploy(ctx) {
         '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
         'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
         '',
-        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippoai/runtime:latest',
         '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
         'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
         'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
         'docker push "$IMAGE"',
         '',
@@ -1088,10 +1364,18 @@ function renderCloudrunSpotlightDeploy(ctx) {
         'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-',
         'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
         '',
+        '# IAP (finalized below) forwards X-Goog-Authenticated-User-Email; pin serve to trust ONLY',
+        '# that header so an authenticated caller cannot impersonate another user via a spoofed',
+        '# X-Agent-User header. Skipped when ENABLE_IAP=0 (first-deploy bootstrap) since IAP never',
+        '# sets the header then.',
+        'IDENTITY_HEADER_VALUE=""',
+        '[[ "${ENABLE_IAP:-1}" == "1" ]] && IDENTITY_HEADER_VALUE="x-goog-authenticated-user-email" || true',
+        '',
         '# Render the multi-container template for this project (sed — no gettext dependency) and deploy.',
         'RENDERED="$(mktemp)"',
         'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\',
         '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" -e "s|\\${STATE_BUCKET}|${STATE_BUCKET}|g" \\',
+        '    -e "s|\\${IDENTITY_HEADER_VALUE}|${IDENTITY_HEADER_VALUE}|g" \\',
         '    deploy/service.yaml > "$RENDERED"',
         'gcloud run services replace "$RENDERED" --region "$REGION"',
         '',
@@ -1115,85 +1399,15 @@ function renderCloudrunSpotlightDeploy(ctx) {
  * via `localhost:<port>` (NOT docker-DNS names like the compose edge). Cloud Run terminates TLS
  * at the edge, so Caddy listens on HTTP `:{$PORT}` (`auto_https off`). The agent is NOT the
  * ingress here, so it listens on a distinct internal port (EDGE_AGENT_PORT) to avoid clashing
- * with Caddy on $PORT.
+ * with Caddy on $PORT. The Caddyfile renderers themselves live in `deploy/layers/identity.ts`
+ * (`renderSidecarEdgeCaddyfile`/`renderSidecarFedCaddyfile`) — reused verbatim by aws-ecs and
+ * azure-container-apps, which share this exact "TLS in front, one localhost" shape.
  */
-const EDGE_AGENT_PORT = 8090;
-/** Caddyfile for the Cloud Run edge — HTTP on $PORT (Cloud Run terminates TLS), localhost upstreams. */
-function renderCloudrunEdgeCaddyfile() {
-    return [
-        '# Cloud Run edge ingress. Cloud Run terminates TLS; Caddy listens on HTTP :{$PORT}.',
-        '# Sidecars share the pod\'s localhost → upstreams are 127.0.0.1:<port> (not docker-DNS names).',
-        '{',
-        '  auto_https off',
-        '}',
-        '',
-        ':{$PORT} {',
-        '  # Auth-broker: IDE sign-in callback + JWT validation endpoint.',
-        '  handle /oauth/* {',
-        '    reverse_proxy localhost:9780 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  handle /api/ide/* {',
-        '    reverse_proxy localhost:9780 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  # oauth2-proxy: Google SSO callback + sign-in.',
-        '  handle /oauth2/* {',
-        '    reverse_proxy localhost:4180 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  @health path /health /ready',
-        '  handle @health {',
-        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
-        '  }',
-        '  # IDE / API clients with a Bearer token: validate via auth-broker, copy identity header.',
-        '  @apiWithAuth {',
-        '    path /v1/*',
-        '    header Authorization *',
-        '  }',
-        '  handle @apiWithAuth {',
-        '    forward_auth localhost:9780 {',
-        '      uri /api/ide/me',
-        '      copy_headers X-Agent-User',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        respond "Unauthorized" 401',
-        '      }',
-        '    }',
-        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
-        '  }',
-        '  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User, then proxy',
-        '  # to the agent (which serves the www landing page at / and the API at /v1/*).',
-        '  handle {',
-        '    forward_auth localhost:4180 {',
-        '      uri /oauth2/auth',
-        '      copy_headers X-Auth-Request-Email>X-Agent-User',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        redir * "/oauth2/sign_in?rd={http.request.uri.path}{http.request.uri.query}"',
-        '      }',
-        '    }',
-        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
-        '  }',
-        '}',
-        '',
-    ].join('\n');
-}
 /** Cloud Run multi-container service behind the AgentHippo edge (Option B). Caddy is ingress. */
 function renderCloudrunEdgeServiceYaml(ctx) {
     const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
     const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: EDGE_AGENT_PORT })
+    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT })
         .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
     // Start order: sidecars before caddy (ingress) so Caddy's first request finds everyone up.
     const deps = isCursor
@@ -1284,7 +1498,7 @@ function renderCloudrunEdgeServiceYaml(ctx) {
         ]),
         '          volumeMounts:',
         '            - { name: state, mountPath: /state }',
-        ...startupProbeLines(EDGE_AGENT_PORT, true),
+        ...startupProbeLines(identity_1.EDGE_AGENT_PORT, true),
         ...resourceLimits('2000m', '2Gi'),
     ];
     if (!isCursor) {
@@ -1313,7 +1527,7 @@ function renderCloudrunEdgeDeploy(ctx) {
         'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
         'REPO="${ARTIFACT_REPO:-agenthippo}"',
         'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippo/litellm-gateway:2026.06}"',
+        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippoai/litellm-gateway:2026.07}"',
         '# Public hostname (custom domain mapped to the service) + the Google Workspace domain allowed by SSO.',
         'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=your.edge.hostname (gcloud run domain-mappings create --service $SERVICE --domain ...)}"',
         'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:?set ALLOWED_DOMAINS=yourworkspace.com (oauth2-proxy email domain + broker allowed domains)}"',
@@ -1336,10 +1550,10 @@ function renderCloudrunEdgeDeploy(ctx) {
         'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
         '',
         '# One agent image serves both the agent and the auth-broker containers (CLI ships `auth-broker`).',
-        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippoai/runtime:latest',
         '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
         'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
         'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
         'docker push "$IMAGE"',
         '',
@@ -1414,6 +1628,7 @@ function cloudrunArtifacts(ctx) {
                 '**Lean alternative (no Spotlight):** a single-container deploy that calls a provider directly',
                 '(or an external LiteLLM) — set `AGENTHIPPO_LITELLM_BASE_URL` to your endpoint and drop the sidecars.',
                 '',
+                ...renderEgressNote(ctx),
             ].join('\n'),
         };
     }
@@ -1449,13 +1664,21 @@ function cloudrunArtifacts(ctx) {
         'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
         '',
         '# Build from pack root; Dockerfile is deploy/Dockerfile (not pack root — gcloud --source . misses it).',
-        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippoai/runtime:latest',
         '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
         'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
         'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
         'docker push "$IMAGE"',
         '',
+        '# IAP (when enabled below) forwards X-Goog-Authenticated-User-Email; pin serve to trust',
+        '# ONLY that header so an authenticated caller cannot impersonate another user via a',
+        '# spoofed X-Agent-User header. Skipped when ENABLE_IAP=0 (first-deploy bootstrap) since',
+        '# IAP never sets the header then — pinning to an absent header would make every request',
+        '# anonymous instead of leaving body-supplied identity usable during bootstrap.',
+        'IDENTITY_ENV=""',
+        '[[ "${ENABLE_IAP:-1}" == "1" ]] && IDENTITY_ENV=",AGENTHIPPO_IDENTITY_HEADER=x-goog-authenticated-user-email" || true',
+        '',
         '# Deploy private (no --allow-unauthenticated). IAP + role grants are applied below on the beta track.',
         'gcloud run deploy "$SERVICE" \\',
         '  --image "$IMAGE" \\',
@@ -1465,7 +1688,7 @@ function cloudrunArtifacts(ctx) {
         '  --timeout 3600 \\',
         '  --add-volume name=state,type=cloud-storage,bucket="$STATE_BUCKET" \\',
         '  --add-volume-mount volume=state,mount-path=/state \\',
-        `  --set-env-vars ${runEnvVars} \\`,
+        `  --set-env-vars "${runEnvVars}\${IDENTITY_ENV}" \\`,
         ...(runSecrets ? [`  --set-secrets ${runSecrets} \\`] : []),
         '  --region "$REGION"',
         '',
@@ -1519,6 +1742,7 @@ function cloudrunArtifacts(ctx) {
             '  -d \'{"message":"Reply with exactly: CLOUDRUN_OK","session_id":"cr-1"}\'',
             '```',
             '',
+            ...renderEgressNote(ctx),
         ].join('\n'),
     };
 }
@@ -1530,7 +1754,7 @@ function cloudrunEdgeArtifacts(ctx, inbound, isCursor) {
     const files = {
         'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
         'www/index.html': renderLandingPage(ctx.packName),
-        'Caddyfile': renderCloudrunEdgeCaddyfile(),
+        'Caddyfile': (0, identity_1.renderSidecarEdgeCaddyfile)(),
         'service.yaml': renderCloudrunEdgeServiceYaml(ctx),
         'cloudrun-deploy.sh': renderCloudrunEdgeDeploy(ctx),
     };
@@ -1544,7 +1768,7 @@ function cloudrunEdgeArtifacts(ctx, inbound, isCursor) {
         '',
         `${sidecars} Sidecars share the pod\'s localhost (Cloud Run multi-container):`,
         '- **caddy** (ingress, the only port) → SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer',
-        `- **agent** → serves www + /v1/* on localhost:${EDGE_AGENT_PORT} (NOT ingress)`,
+        `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (NOT ingress)`,
         '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`) + IDE sign-in (`/oauth/*`)',
         '- **oauth2-proxy** → Google SSO for browser clients (`provider=google`)',
         ...(isCursor ? [] : [
@@ -1577,77 +1801,10 @@ function cloudrunEdgeArtifacts(ctx, inbound, isCursor) {
             ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
             : '**No inbound channel (1a):** scales to zero; traces + sessions persist on the GCS `/state` volume.',
         '',
+        ...renderEgressNote(ctx),
     ].join('\n');
     return files;
 }
-/**
- * A′ — Federated edge Caddyfile. No oauth2-proxy: Google login happens once at the central IdP
- * (`ctx.idpUrl`); this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for
- * browser). On a browser 401, redirect to the IdP's `/oauth/browser-login` to stamp the shared
- * `.agenthippo.ai` cookie, then return.
- */
-function renderCloudrunFedCaddyfile(ctx) {
-    const idp = (ctx.idpUrl || '').trim().replace(/\/+$/, '');
-    const loginRedirect = idp
-        ? `        redir * "${idp}/oauth/browser-login?return_to=https://{http.request.host}{http.request.uri}" 302`
-        : '        respond "Unauthorized" 401';
-    return [
-        '# Cloud Run federated edge (A′). Cloud Run terminates TLS; Caddy listens on HTTP :{$PORT}.',
-        `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
-        '# this agent only verifies the shared .agenthippo.ai AgentHippo JWT (Bearer for IDE, cookie for browser).',
-        '{',
-        '  auto_https off',
-        '}',
-        '',
-        ':{$PORT} {',
-        '  # Auth-broker: IDE bootstrap API + JWT validation (/api/ide/me is also used by forward_auth).',
-        '  handle /api/ide/* {',
-        '    reverse_proxy localhost:9780 {',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '    }',
-        '  }',
-        '  @health path /health /ready',
-        '  handle @health {',
-        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
-        '  }',
-        '  # IDE / API clients with a Bearer token: validate via auth-broker, copy identity header.',
-        '  @apiWithAuth {',
-        '    path /v1/*',
-        '    header Authorization *',
-        '  }',
-        '  handle @apiWithAuth {',
-        '    forward_auth localhost:9780 {',
-        '      uri /api/ide/me',
-        '      copy_headers X-Agent-User',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        respond "Unauthorized" 401',
-        '      }',
-        '    }',
-        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
-        '  }',
-        '  # Browser clients: the shared .agenthippo.ai cookie is verified by auth-broker. No cookie',
-        '  # → redirect to the central IdP to log in (it stamps the cookie), then return.',
-        '  handle {',
-        '    forward_auth localhost:9780 {',
-        '      uri /api/ide/me',
-        '      copy_headers X-Agent-User',
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        loginRedirect,
-        '      }',
-        '    }',
-        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
-        '  }',
-        '}',
-        '',
-    ].join('\n');
-}
 /** Cloud Run requires a startupProbe on any container that is a `depends_on` target, so the
  *  platform knows when the dependency is ready. `slow` = one generous 240s attempt (agent, which
  *  may warm an engine); otherwise 30×5s polls (sidecars that start fast). */
@@ -1690,7 +1847,7 @@ function resourceLimits(cpu, memory) {
 function renderCloudrunFedServiceYaml(ctx) {
     const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
     const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: EDGE_AGENT_PORT })
+    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT })
         .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
     const cookieDomain = (ctx.cookieDomain || '.agenthippo.ai').trim();
     const idpUrl = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
@@ -1766,11 +1923,13 @@ function renderCloudrunFedServiceYaml(ctx) {
         ]),
         '          volumeMounts:',
         '            - { name: state, mountPath: /state }',
-        ...startupProbeLines(EDGE_AGENT_PORT, true),
+        ...startupProbeLines(identity_1.EDGE_AGENT_PORT, true),
         ...resourceLimits('2000m', '2Gi'),
     ];
     if (!isCursor) {
-        lines.push('        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight).', '        - name: litellm', '          image: ${LITELLM_IMAGE}', '          env:', '            - { name: OTEL_EXPORTER, value: otlp_http }', '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }', '            - name: LITELLM_MASTER_KEY', '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }', `            # Upstream provider key for ${ctx.model || 'this model'} (matches the gateway's os.environ/${providerKeyEnv} ref).`, `            - name: ${providerKeyEnv}`, '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }', ...startupProbeLines(4443), ...resourceLimits('1000m', '1Gi'), '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.', '        - name: otel-collector', '          image: otel/opentelemetry-collector-contrib:0.118.0', '          args: ["--config=/etc/otel/config.yaml"]', '          env:', '            - { name: AGENT_HOME_DIR, value: /state }', '          volumeMounts:', '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }', '            - { name: state, mountPath: /state }', ...startupProbeLines(4318), ...resourceLimits('1000m', '512Mi'));
+        lines.push('        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight).', '        - name: litellm', '          image: ${LITELLM_IMAGE}', '          env:', '            - { name: OTEL_EXPORTER, value: otlp_http }', '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }', '            - name: LITELLM_MASTER_KEY', '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }', isAhAutoModel(ctx.model)
+            ? '            # ah-auto → gateway.agenthippo.ai (AGENTHIPPO_GATEWAY_KEY = ahgw_… service key).'
+            : `            # Upstream provider key for ${ctx.model || 'this model'} (matches os.environ/${providerKeyEnv}).`, `            - name: ${providerKeyEnv}`, '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }', ...startupProbeLines(4443), ...resourceLimits('1000m', '1Gi'), '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.', '        - name: otel-collector', '          image: otel/opentelemetry-collector-contrib:0.118.0', '          args: ["--config=/etc/otel/config.yaml"]', '          env:', '            - { name: AGENT_HOME_DIR, value: /state }', '          volumeMounts:', '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }', '            - { name: state, mountPath: /state }', ...startupProbeLines(4318), ...resourceLimits('1000m', '512Mi'));
     }
     lines.push('      volumes:', '        # In-memory state (matches the working spotlight deploy — no GCS SA perms needed).', '        - name: state', '          emptyDir:', '            medium: Memory', '            sizeLimit: 1Gi', '        - name: caddy-config', '          secret:', '            secretName: ${SERVICE}-caddyfile', '            items:', '              - { key: latest, path: Caddyfile }');
     if (!isCursor) {
@@ -1779,6 +1938,141 @@ function renderCloudrunFedServiceYaml(ctx) {
     lines.push('');
     return lines.join('\n');
 }
+/** A′ gateway-direct — federated edge without LiteLLM/OTEL sidecars. Agent calls the org gateway
+ *  (gateway.agenthippo.ai) directly — same wiring as colocated agents on hippopennyg. */
+function renderCloudrunFedGatewayServiceYaml(ctx) {
+    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT })
+        .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
+    const cookieDomain = (ctx.cookieDomain || '.agenthippo.ai').trim();
+    const idpUrl = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
+    const lines = [
+        '# Cloud Run + AgentHippo federated edge (A′) — gateway-direct (lean):',
+        '# Caddy (ingress) + auth-broker + agent. No LiteLLM/OTEL sidecars.',
+        '# Agent routes ah-auto (and other gateway models) to gateway.agenthippo.ai directly.',
+        '# Generated by `agenthippo deploy init --target cloudrun --ingress edge-fed --model-routing gateway`.',
+        'apiVersion: serving.knative.dev/v1',
+        'kind: Service',
+        'metadata:',
+        '  name: ${SERVICE}',
+        'spec:',
+        '  template:',
+        '    metadata:',
+        '      annotations:',
+        '        run.googleapis.com/cpu-throttling: "false"',
+        '        run.googleapis.com/startup-cpu-boost: "true"',
+        "        run.googleapis.com/container-dependencies: '{\"caddy\":[\"agent\",\"auth-broker\"]}'",
+        '        autoscaling.knative.dev/maxScale: "1"',
+        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
+        '    spec:',
+        '      timeoutSeconds: 3600',
+        '      containers:',
+        '        - name: caddy',
+        '          image: caddy:2.8-alpine',
+        '          ports:',
+        '            - name: http1',
+        `              containerPort: ${ctx.port}`,
+        '          volumeMounts:',
+        '            - { name: caddy-config, mountPath: /etc/caddy, readOnly: true }',
+        ...resourceLimits('1000m', '512Mi'),
+        '        - name: auth-broker',
+        '          image: ${IMAGE}',
+        '          args: ["auth-broker"]',
+        '          env:',
+        '            - { name: AGENTHIPPO_AUTH_PORT, value: "9780" }',
+        '            - { name: AGENTHIPPO_AUTH_DATA_DIR, value: /data }',
+        '            - { name: AGENTHIPPO_AUTH_PUBLIC_URL, value: https://${PUBLIC_HOSTNAME} }',
+        '            - { name: AGENTHIPPO_AUTH_ALLOWED_DOMAINS, value: ${ALLOWED_DOMAINS} }',
+        `            - { name: AGENTHIPPO_AUTH_COOKIE_DOMAIN, value: "${cookieDomain}" }`,
+        `            - { name: AGENTHIPPO_AUTH_IDP_URL, value: "${idpUrl}" }`,
+        '            - { name: AGENTHIPPO_AUTH_COOKIE_NAME, value: "ah_token" }',
+        '            - name: AGENTHIPPO_AUTH_JWT_SECRET',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-auth-jwt-secret, key: latest }',
+        ...startupProbeLines(9780),
+        ...resourceLimits('1000m', '512Mi'),
+        '        - name: agent',
+        '          image: ${IMAGE}',
+        `          args: [${agentArgs}]`,
+        '          env:',
+        '            - { name: AGENTHIPPO_HOME, value: /state }',
+        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
+        agentServeHostEnvYaml(),
+        `            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: "${AGENTHIPPO_GATEWAY_BASE_URL}" }`,
+        '            - name: AGENTHIPPO_LITELLM_API_KEY',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
+        '          volumeMounts:',
+        '            - { name: state, mountPath: /state }',
+        ...startupProbeLines(identity_1.EDGE_AGENT_PORT, true),
+        ...resourceLimits('2000m', '2Gi'),
+        '      volumes:',
+        '        - name: state',
+        '          emptyDir:',
+        '            medium: Memory',
+        '            sizeLimit: 1Gi',
+        '        - name: caddy-config',
+        '          secret:',
+        '            secretName: ${SERVICE}-caddyfile',
+        '            items:',
+        '              - { key: latest, path: Caddyfile }',
+        '',
+    ];
+    return lines.join('\n');
+}
+/** Deploy script for gateway-direct federated edge — no LiteLLM/OTEL secrets or sidecars. */
+function renderCloudrunFedGatewayDeploy(ctx) {
+    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
+    const providerHint = isAhAutoModel(ctx.model)
+        ? 'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>}"'
+        : 'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<gateway service key or provider key>}"';
+    return [
+        '#!/usr/bin/env bash',
+        '# Cloud Run + AgentHippo federated edge (A′) — gateway-direct (lean).',
+        `# Engine: ${ctx.engine}${modelNote}. Caddy + auth-broker + agent only — agent calls`,
+        '# gateway.agenthippo.ai directly (no in-pod LiteLLM/OTEL sidecars). Same model routing',
+        '# as colocated agents on hippopennyg.',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        `SERVICE="${ctx.packName}"`,
+        'REGION="${REGION:-us-central1}"',
+        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
+        'REPO="${ARTIFACT_REPO:-agenthippo}"',
+        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
+        'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai}"',
+        'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:-agenthippo.ai}"',
+        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>}"',
+        providerHint,
+        '',
+        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
+        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
+        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
+        '',
+        'DF_TMP="$(mktemp)"',
+        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
+        'docker push "$IMAGE"',
+        '',
+        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
+        'ensure_secret "${SERVICE}-caddyfile"; gcloud secrets versions add "${SERVICE}-caddyfile" --data-file=deploy/Caddyfile',
+        'ensure_secret "${SERVICE}-auth-jwt-secret"; printf %s "$AUTH_JWT_SECRET" | gcloud secrets versions add "${SERVICE}-auth-jwt-secret" --data-file=-',
+        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
+        '',
+        'RENDERED="$(mktemp)"',
+        'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\',
+        '    -e "s|\\${PUBLIC_HOSTNAME}|${PUBLIC_HOSTNAME}|g" -e "s|\\${ALLOWED_DOMAINS}|${ALLOWED_DOMAINS}|g" \\',
+        '    deploy/service.yaml > "$RENDERED"',
+        'gcloud run services replace "$RENDERED" --region "$REGION"',
+        '',
+        'gcloud run services add-iam-policy-binding "$SERVICE" --region "$REGION" \\',
+        '  --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true',
+        '',
+        'if [[ "$PUBLIC_HOSTNAME" != *.run.app ]]; then \\',
+        '  gcloud beta run domain-mappings describe "$PUBLIC_HOSTNAME" --region "$REGION" >/dev/null 2>&1 \\',
+        '    || gcloud beta run domain-mappings create --service "$SERVICE" --region "$REGION" --domain "$PUBLIC_HOSTNAME"; \\',
+        'fi',
+        '',
+    ].join('\n');
+}
 /** Deploy script for the federated edge (A′): build, upsert secrets (no OAuth), replace, make
  *  public, map the subdomain. No IAP; no Google OAuth client. */
 function renderCloudrunFedDeploy(ctx) {
@@ -1798,7 +2092,7 @@ function renderCloudrunFedDeploy(ctx) {
         'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
         'REPO="${ARTIFACT_REPO:-agenthippo}"',
         'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippo/litellm-gateway:2026.06}"',
+        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippoai/litellm-gateway:2026.07}"',
         '# Public hostname = a *.agenthippo.ai subdomain mapped to this service (one-time wildcard DNS).',
         'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai}"',
         'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:-agenthippo.ai}"',
@@ -1807,6 +2101,10 @@ function renderCloudrunFedDeploy(ctx) {
         'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>}"',
         ...(isCursor ? [
             'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<cursor api key>}"',
+        ] : isAhAutoModel(ctx.model) ? [
+            '# LiteLLM proxy key + AgentHippo gateway service key (ahgw_…) for ah-auto routing.',
+            'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
+            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>}"',
         ] : [
             '# LiteLLM proxy key + the upstream provider key the gateway uses for the model.',
             'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
@@ -1818,10 +2116,10 @@ function renderCloudrunFedDeploy(ctx) {
         'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
         '',
         '# One agent image serves both the agent and the auth-broker containers (CLI ships `auth-broker`).',
-        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippoai/runtime:latest',
         '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
         'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
         'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
         'docker push "$IMAGE"',
         '',
@@ -1839,30 +2137,36 @@ function renderCloudrunFedDeploy(ctx) {
 }
 /** A′ artifacts: Cloud Run behind the federated AgentHippo edge (Caddy + auth-broker; no oauth2-proxy). */
 function cloudrunFedArtifacts(ctx, inbound, isCursor) {
+    const gatewayDirect = usesGatewayDirect(ctx) && !isCursor;
     const sidecars = isCursor
         ? 'Caddy (ingress) + auth-broker + agent.'
-        : 'Caddy (ingress) + auth-broker + agent + LiteLLM + OTEL collector (Spotlight).';
+        : gatewayDirect
+            ? 'Caddy (ingress) + auth-broker + agent (gateway-direct — no LiteLLM/OTEL sidecars).'
+            : 'Caddy (ingress) + auth-broker + agent + LiteLLM + OTEL collector (Spotlight).';
     const idp = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
     const files = {
         'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
         'www/index.html': renderLandingPage(ctx.packName),
-        'Caddyfile': renderCloudrunFedCaddyfile(ctx),
-        'service.yaml': renderCloudrunFedServiceYaml(ctx),
-        'cloudrun-deploy.sh': renderCloudrunFedDeploy(ctx),
+        'Caddyfile': (0, identity_1.renderSidecarFedCaddyfile)(ctx.idpUrl),
+        'service.yaml': gatewayDirect ? renderCloudrunFedGatewayServiceYaml(ctx) : renderCloudrunFedServiceYaml(ctx),
+        'cloudrun-deploy.sh': gatewayDirect ? renderCloudrunFedGatewayDeploy(ctx) : renderCloudrunFedDeploy(ctx),
     };
-    if (!isCursor) {
+    if (!isCursor && !gatewayDirect) {
         files['otel-collector.yaml'] = OTEL_COLLECTOR_COMPOSE_YAML;
     }
     files['README.md'] = [
-        `# Deploy: ${ctx.packName} — Cloud Run + AgentHippo federated edge (A′)`,
+        `# Deploy: ${ctx.packName} — Cloud Run + AgentHippo federated edge (A′${gatewayDirect ? ', gateway-direct' : ''})`,
         '',
         `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
         '',
         `${sidecars} Sidecars share the pod\'s localhost (Cloud Run multi-container):`,
         '- **caddy** (ingress, the only port) → verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser)',
-        `- **agent** → serves www + /v1/* on localhost:${EDGE_AGENT_PORT} (NOT ingress)`,
+        `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (NOT ingress)`,
         '- **auth-broker** → validates the shared `.agenthippo.ai` JWT via `/api/ide/me` (same secret as the IdP)',
-        ...(isCursor ? [] : [
+        ...(gatewayDirect ? [
+            `- **model routing** → agent calls \`${AGENTHIPPO_GATEWAY_BASE_URL}\` directly (ahgw_… service key) — same as colocated agents`,
+            '- **no Spotlight sidecars** — traces are not collected in-pod; use gateway/Spotlight fleet analytics instead',
+        ] : isCursor ? [] : [
             '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
             '- **otel-collector** → writes JSONL traces to the in-memory `/state` volume',
         ]),
@@ -1877,23 +2181,31 @@ function cloudrunFedArtifacts(ctx, inbound, isCursor) {
         'cp deploy/.env.example deploy/.env && cp deploy/.env.auth.example deploy/.env.auth  # fill both',
         'export PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai   # e.g. cs.agenthippo.ai',
         'export AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>   # shared signing key',
-        ...(isCursor ? ['export PROVIDER_KEY=<cursor api key>'] : ['export LITELLM_KEY=… PROVIDER_KEY=…']),
+        ...(isCursor ? ['export PROVIDER_KEY=<cursor api key>'] : gatewayDirect
+            ? ['export PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>']
+            : isAhAutoModel(ctx.model)
+                ? ['export LITELLM_KEY=… PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>']
+                : ['export LITELLM_KEY=… PROVIDER_KEY=…']),
         'bash deploy/cloudrun-deploy.sh    # builds linux/amd64, upserts secrets, `gcloud run services replace`, maps the subdomain',
         '```',
         '',
         '**One-time setup (not per agent):** wildcard DNS `*.agenthippo.ai` → Cloud Run (`gctrl.run.app`),',
         `and the IdP (${idp}) must run the \`/oauth/browser-login\` route (oauth2-proxy forward_auth →`,
         'auth-broker sets the `ah_token` cookie on `.agenthippo.ai`). After that, every new agent is',
-        'just: `deploy init --ingress edge-fed` + this script — zero Console/OAuth work.',
+        gatewayDirect
+            ? 'just: `deploy init --ingress edge-fed --model-routing gateway` + this script — zero Console/OAuth work.'
+            : 'just: `deploy init --ingress edge-fed` + this script — zero Console/OAuth work.',
         '',
-        '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${LITELLM_IMAGE} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`)',
-        'are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).',
+        gatewayDirect
+            ? '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`) are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).'
+            : '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${LITELLM_IMAGE} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`) are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).',
         '`AGENTHIPPO_AUTH_COOKIE_DOMAIN` / `AGENTHIPPO_AUTH_IDP_URL` are baked in at generation time.',
         '',
         inbound
             ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
             : '**No inbound channel (1a):** scales to zero; in-memory `/state` is wiped on cold start (use the `edge` mode + GCS bucket if you need durable state).',
         '',
+        ...renderEgressNote(ctx),
     ].join('\n');
     return files;
 }
@@ -1929,7 +2241,17 @@ function databricksAppArtifacts(ctx) {
         "  '--workspace', '/tmp/agenthippo/workspace',",
         "  '--state-dir', '/tmp/agenthippo/state',",
         "  '--port', port,",
-        "], { stdio: 'inherit', env: { ...process.env, AGENTHIPPO_SERVE_HOST: '0.0.0.0' } });",
+        "], { stdio: 'inherit', env: {",
+        "  ...process.env,",
+        "  AGENTHIPPO_SERVE_HOST: '0.0.0.0',",
+        "  // Databricks Apps workspace SSO sets X-Forwarded-Email; pin serve to trust ONLY that",
+        "  // header so an authenticated caller cannot impersonate another user via a spoofed",
+        "  // X-Agent-User header (Databricks does not know about or strip that header).",
+        "  // Skipped when AGENTHIPPO_PIN_IDENTITY=0 (bootstrap escape hatch) — same idea as",
+        "  // Cloud Run's ENABLE_IAP=0: pinning to an absent header would make every request",
+        "  // anonymous instead of leaving body-supplied identity usable during bootstrap.",
+        "  ...(process.env.AGENTHIPPO_PIN_IDENTITY === '0' ? {} : { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' }),",
+        "} });",
         "child.on('exit', (code) => process.exit(code ?? 0));",
         '',
     ].join('\n');
@@ -1953,6 +2275,7 @@ function databricksAppArtifacts(ctx) {
             '> spike (serve-v3 §13.2). Without it serve queries as one app identity. Identity',
             '> attribution (`user_id`) works today; per-user *data* enforcement needs the spike.',
             '',
+            ...renderEgressNote(ctx),
         ].join('\n'),
     };
 }
@@ -2034,7 +2357,10 @@ function cloudflareArtifacts(ctx) {
         migrations: [{ tag: 'v1', new_sqlite_classes: ['Agent'] }],
     }, null, 2) + '\n';
     return {
-        'Dockerfile': sharedDockerfile(ctx),
+        // Pin identity to X-Agent-User so serve trusts ONLY the header the fronting Worker sets —
+        // unpinned, serve falls back to the same header name as an alias and a caller who reaches
+        // the container directly (bypassing the Worker/Access) could spoof it themselves.
+        'Dockerfile': sharedDockerfile(ctx, { extraEnv: { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' } }),
         'wrangler.jsonc': wrangler,
         'README.md': [
             `# Deploy: ${ctx.packName} — Cloudflare Container (T1-generic)`,
@@ -2044,6 +2370,537 @@ function cloudflareArtifacts(ctx) {
             'then proxies to the container binding. For the *external/unauthenticated* case',
             '(customer support), use the full reference at `examples/deploy/external-support/`.',
             '',
+            '**Identity pin:** the container trusts *only* `X-Agent-User` (`AGENTHIPPO_IDENTITY_HEADER`,',
+            'baked into the image) — the Worker must set it after Cloudflare Access verifies the user.',
+            'Requests without it resolve to no identity, even if the container is ever reachable',
+            'directly, bypassing the Worker.',
+            '',
+            '**Egress:** this container only needs outbound access to your model provider',
+            '(e.g. `api.anthropic.com:443`) — restrict it with a Cloudflare Worker/Zero Trust',
+            'egress policy if your org requires one.',
+            '',
+        ].join('\n'),
+    };
+}
+/**
+ * AWS ECS Fargate (T1-generic, `d8-aws-adapter`). Fargate's `awsvpc` network mode shares one
+ * task's network namespace across its containers — architecturally identical to Cloud Run's
+ * sidecar model, so the edge/edge-fed Caddyfiles and `EDGE_AGENT_PORT` convention are reused
+ * verbatim (PLAN/deploy.md §5, "what adding AWS looks like"): no new identity code, just a new
+ * platform adapter around the same shared identity layer.
+ *
+ * Scope: identity/exposure only (bare / edge / edge-fed) — no Spotlight/LiteLLM sidecar variant
+ * yet (that's the orthogonal model-gateway layer, not part of this pass). Newer and far less
+ * exercised than the Cloud Run path — read `deploy.sh` before running it against a real account.
+ */
+function awsEcsArtifacts(ctx) {
+    const fed = ctx.ingress === 'edge-fed';
+    const edge = ctx.ingress === 'edge' || fed;
+    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
+    if (!edge) {
+        // Bare single-container task — sits behind whatever ingress (ALB, API Gateway, internal
+        // VPC access) the org already runs, same positioning as cloudflare/databricks-app/spcs.
+        const taskDef = {
+            family: '${SERVICE}',
+            networkMode: 'awsvpc',
+            requiresCompatibilities: ['FARGATE'],
+            cpu: '512',
+            memory: '1024',
+            containerDefinitions: [
+                {
+                    name: 'agent',
+                    image: '${IMAGE}',
+                    essential: true,
+                    portMappings: [{ containerPort: ctx.port, protocol: 'tcp' }],
+                    environment: [{ name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' }],
+                    secrets: [{ name: providerKeyEnv, valueFrom: '${PROVIDER_KEY_SECRET_ARN}' }],
+                    logConfiguration: {
+                        logDriver: 'awslogs',
+                        options: {
+                            'awslogs-group': '/ecs/${SERVICE}',
+                            'awslogs-region': '${REGION}',
+                            'awslogs-stream-prefix': 'agent',
+                        },
+                    },
+                },
+            ],
+        };
+        const deploy = [
+            '#!/usr/bin/env bash',
+            '# T1-generic: AWS ECS Fargate, single container — bring your own ingress (ALB/API',
+            '# Gateway/internal VPC). For a self-contained ALB + AgentHippo edge, use --ingress edge',
+            '# or --ingress edge-fed instead.',
+            'set -euo pipefail',
+            ...anchorToStagingRoot(),
+            'SERVICE="' + ctx.packName + '"',
+            'REGION="${AWS_REGION:-us-east-1}"',
+            'ACCOUNT_ID="${ACCOUNT_ID:-$(aws sts get-caller-identity --query Account --output text)}"',
+            'REPO="agenthippo/${SERVICE}"',
+            'IMAGE="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/${REPO}:latest"',
+            '',
+            'aws ecr describe-repositories --repository-names "$REPO" --region "$REGION" >/dev/null 2>&1 \\',
+            '  || aws ecr create-repository --repository-name "$REPO" --region "$REGION"',
+            'aws ecr get-login-password --region "$REGION" \\',
+            '  | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"',
+            '',
+            'docker build --platform linux/amd64 -f deploy/Dockerfile -t "$IMAGE" .',
+            'docker push "$IMAGE"',
+            '',
+            `PROVIDER_KEY_SECRET_ARN="\${PROVIDER_KEY_SECRET_ARN:?set PROVIDER_KEY_SECRET_ARN — Secrets Manager ARN holding ${providerKeyEnv}}"`,
+            'TASK_JSON="$(sed -e "s|\\${IMAGE}|${IMAGE}|g" -e "s|\\${SERVICE}|${SERVICE}|g" \\',
+            '    -e "s|\\${REGION}|${REGION}|g" -e "s|\\${PROVIDER_KEY_SECRET_ARN}|${PROVIDER_KEY_SECRET_ARN}|g" \\',
+            '    deploy/task-definition.json)"',
+            'aws ecs register-task-definition --region "$REGION" --cli-input-json "$TASK_JSON" >/dev/null',
+            '',
+            'CLUSTER="${CLUSTER:?set CLUSTER — the ECS cluster to run in}"',
+            'aws ecs describe-services --cluster "$CLUSTER" --services "$SERVICE" --region "$REGION" 2>/dev/null \\',
+            '  | grep -q \'"status": "ACTIVE"\' \\',
+            '  && aws ecs update-service --cluster "$CLUSTER" --service "$SERVICE" \\',
+            '       --task-definition "$SERVICE" --region "$REGION" >/dev/null \\',
+            '  || aws ecs create-service --cluster "$CLUSTER" --service-name "$SERVICE" \\',
+            '       --task-definition "$SERVICE" --desired-count 1 --launch-type FARGATE \\',
+            '       --network-configuration "awsvpcConfiguration={subnets=[${SUBNETS:?set SUBNETS}],securityGroups=[${SECURITY_GROUPS:?set SECURITY_GROUPS}],assignPublicIp=ENABLED}" \\',
+            '       --region "$REGION" >/dev/null',
+            'echo "Deployed $SERVICE to ECS cluster $CLUSTER"',
+            '',
+        ].join('\n');
+        return {
+            'Dockerfile': sharedDockerfile(ctx),
+            'task-definition.json': JSON.stringify(taskDef, null, 2) + '\n',
+            'deploy.sh': deploy,
+            'README.md': [
+                `# Deploy: ${ctx.packName} — AWS ECS Fargate (T1-generic)`,
+                '',
+                `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
+                '',
+                'Single container, no ingress opinion — front it with whatever your org already runs',
+                '(ALB, API Gateway, internal VPC access). Use `--ingress edge` or `--ingress edge-fed`',
+                'for a self-contained ALB + AgentHippo edge instead.',
+                '',
+                '```bash',
+                'export CLUSTER=<ecs-cluster> SUBNETS=<subnet-ids> SECURITY_GROUPS=<sg-ids>',
+                'export PROVIDER_KEY_SECRET_ARN=<Secrets Manager ARN for your model provider key>',
+                'bash deploy/deploy.sh',
+                '```',
+                '',
+                '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
+                '> running it against a real account.',
+                '',
+                ...renderEgressNote(ctx),
+            ].join('\n'),
+        };
+    }
+    // Edge / edge-fed: Caddy + (self-issued: oauth2-proxy) + auth-broker + agent, one Fargate
+    // task (awsvpc network mode = shared localhost, exactly like Cloud Run sidecars) — reuses
+    // the identical Caddyfiles Cloud Run already renders.
+    const containers = [
+        {
+            name: 'caddy',
+            image: 'caddy:2.8-alpine',
+            essential: true,
+            portMappings: [{ containerPort: 8080, protocol: 'tcp' }],
+            environment: [{ name: 'AGENTHIPPO_PUBLIC_HOSTNAME', value: ctx.publicHostname }],
+            // Caddyfile is written to a mounted config volume by the deploy script (sed-templated,
+            // same "checked-in template, script substitutes it" pattern as the Cloud Run edge).
+            mountPoints: [{ sourceVolume: 'caddy-config', containerPath: '/etc/caddy' }],
+            logConfiguration: {
+                logDriver: 'awslogs',
+                options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'caddy' },
+            },
+        },
+        ...(fed ? [] : [{
+                name: 'oauth2-proxy',
+                image: 'quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
+                essential: true,
+                environment: [
+                    { name: 'OAUTH2_PROXY_HTTP_ADDRESS', value: '0.0.0.0:4180' },
+                    { name: 'OAUTH2_PROXY_UPSTREAMS', value: 'file:///dev/null' },
+                    { name: 'OAUTH2_PROXY_SET_XAUTHREQUEST', value: 'true' },
+                    { name: 'OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER', value: 'true' },
+                    { name: 'OAUTH2_PROXY_SKIP_PROVIDER_BUTTON', value: 'true' },
+                    { name: 'OAUTH2_PROXY_REVERSE_PROXY', value: 'true' },
+                ],
+                secrets: [
+                    { name: 'OAUTH2_PROXY_CLIENT_ID', valueFrom: '${OAUTH_CLIENT_ID_SECRET_ARN}' },
+                    { name: 'OAUTH2_PROXY_CLIENT_SECRET', valueFrom: '${OAUTH_CLIENT_SECRET_SECRET_ARN}' },
+                    { name: 'OAUTH2_PROXY_COOKIE_SECRET', valueFrom: '${OAUTH_COOKIE_SECRET_SECRET_ARN}' },
+                ],
+                logConfiguration: {
+                    logDriver: 'awslogs',
+                    options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'oauth2-proxy' },
+                },
+            }]),
+        {
+            name: 'auth-broker',
+            image: '${IMAGE}',
+            essential: true,
+            command: ['auth-broker'],
+            environment: [
+                { name: 'AGENTHIPPO_AUTH_PORT', value: '9780' },
+                ...(fed ? [
+                    { name: 'AGENTHIPPO_AUTH_COOKIE_DOMAIN', value: ctx.cookieDomain || '' },
+                    { name: 'AGENTHIPPO_AUTH_IDP_URL', value: ctx.idpUrl || '' },
+                ] : []),
+            ],
+            secrets: [{ name: 'AGENTHIPPO_AUTH_JWT_SECRET', valueFrom: '${AUTH_JWT_SECRET_SECRET_ARN}' }],
+            logConfiguration: {
+                logDriver: 'awslogs',
+                options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'auth-broker' },
+            },
+        },
+        {
+            name: 'agent',
+            image: '${IMAGE}',
+            essential: true,
+            command: serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT }),
+            environment: [{ name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' }],
+            secrets: [{ name: providerKeyEnv, valueFrom: '${PROVIDER_KEY_SECRET_ARN}' }],
+            logConfiguration: {
+                logDriver: 'awslogs',
+                options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'agent' },
+            },
+        },
+    ];
+    const taskDef = {
+        family: '${SERVICE}',
+        networkMode: 'awsvpc',
+        requiresCompatibilities: ['FARGATE'],
+        cpu: '1024',
+        memory: '2048',
+        volumes: [{ name: 'caddy-config' }],
+        containerDefinitions: containers,
+    };
+    const secretArgs = fed
+        ? 'PROVIDER_KEY_SECRET_ARN=<...> AUTH_JWT_SECRET_SECRET_ARN=<...>'
+        : 'PROVIDER_KEY_SECRET_ARN=<...> AUTH_JWT_SECRET_SECRET_ARN=<...> ' +
+            'OAUTH_CLIENT_ID_SECRET_ARN=<...> OAUTH_CLIENT_SECRET_SECRET_ARN=<...> OAUTH_COOKIE_SECRET_SECRET_ARN=<...>';
+    const deploy = [
+        '#!/usr/bin/env bash',
+        `# AWS ECS Fargate + AgentHippo edge (${fed ? 'edge-fed: federated identity, no oauth2-proxy' : 'edge: self-issued'}).`,
+        '# One-time setup (not per deploy): create an ALB + target group (protocol HTTP, port 8080,',
+        '# target type ip) pointed at this service, and an HTTPS listener forwarding to it — ALB',
+        '# terminates TLS, same as Cloud Run\'s edge path (Caddy listens on plain HTTP behind it).',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        'SERVICE="' + ctx.packName + '"',
+        'REGION="${AWS_REGION:-us-east-1}"',
+        'ACCOUNT_ID="${ACCOUNT_ID:-$(aws sts get-caller-identity --query Account --output text)}"',
+        'REPO="agenthippo/${SERVICE}"',
+        'IMAGE="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/${REPO}:latest"',
+        '',
+        'aws ecr describe-repositories --repository-names "$REPO" --region "$REGION" >/dev/null 2>&1 \\',
+        '  || aws ecr create-repository --repository-name "$REPO" --region "$REGION"',
+        'aws ecr get-login-password --region "$REGION" \\',
+        '  | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"',
+        '',
+        '# auth-broker reuses the agent image (CLI ships `auth-broker`).',
+        'docker build --platform linux/amd64 -f deploy/Dockerfile -t "$IMAGE" .',
+        'docker push "$IMAGE"',
+        '',
+        'PROVIDER_KEY_SECRET_ARN="${PROVIDER_KEY_SECRET_ARN:?set PROVIDER_KEY_SECRET_ARN}"',
+        'AUTH_JWT_SECRET_SECRET_ARN="${AUTH_JWT_SECRET_SECRET_ARN:?set AUTH_JWT_SECRET_SECRET_ARN}"',
+        ...(fed ? [] : [
+            'OAUTH_CLIENT_ID_SECRET_ARN="${OAUTH_CLIENT_ID_SECRET_ARN:?set OAUTH_CLIENT_ID_SECRET_ARN}"',
+            'OAUTH_CLIENT_SECRET_SECRET_ARN="${OAUTH_CLIENT_SECRET_SECRET_ARN:?set OAUTH_CLIENT_SECRET_SECRET_ARN}"',
+            'OAUTH_COOKIE_SECRET_SECRET_ARN="${OAUTH_COOKIE_SECRET_SECRET_ARN:?set OAUTH_COOKIE_SECRET_SECRET_ARN}"',
+        ]),
+        'TASK_JSON="$(sed -e "s|\\${IMAGE}|${IMAGE}|g" -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${REGION}|${REGION}|g" \\',
+        '    -e "s|\\${PROVIDER_KEY_SECRET_ARN}|${PROVIDER_KEY_SECRET_ARN}|g" \\',
+        '    -e "s|\\${AUTH_JWT_SECRET_SECRET_ARN}|${AUTH_JWT_SECRET_SECRET_ARN}|g" \\',
+        ...(fed ? [] : [
+            '    -e "s|\\${OAUTH_CLIENT_ID_SECRET_ARN}|${OAUTH_CLIENT_ID_SECRET_ARN}|g" \\',
+            '    -e "s|\\${OAUTH_CLIENT_SECRET_SECRET_ARN}|${OAUTH_CLIENT_SECRET_SECRET_ARN}|g" \\',
+            '    -e "s|\\${OAUTH_COOKIE_SECRET_SECRET_ARN}|${OAUTH_COOKIE_SECRET_SECRET_ARN}|g" \\',
+        ]),
+        '    deploy/task-definition.json)"',
+        'aws ecs register-task-definition --region "$REGION" --cli-input-json "$TASK_JSON" >/dev/null',
+        '',
+        'CLUSTER="${CLUSTER:?set CLUSTER}"',
+        'TARGET_GROUP_ARN="${TARGET_GROUP_ARN:?set TARGET_GROUP_ARN — from the one-time ALB setup above}"',
+        'aws ecs describe-services --cluster "$CLUSTER" --services "$SERVICE" --region "$REGION" 2>/dev/null \\',
+        '  | grep -q \'"status": "ACTIVE"\' \\',
+        '  && aws ecs update-service --cluster "$CLUSTER" --service "$SERVICE" \\',
+        '       --task-definition "$SERVICE" --region "$REGION" >/dev/null \\',
+        '  || aws ecs create-service --cluster "$CLUSTER" --service-name "$SERVICE" \\',
+        '       --task-definition "$SERVICE" --desired-count 1 --launch-type FARGATE \\',
+        '       --load-balancers "targetGroupArn=$TARGET_GROUP_ARN,containerName=caddy,containerPort=8080" \\',
+        '       --network-configuration "awsvpcConfiguration={subnets=[${SUBNETS:?set SUBNETS}],securityGroups=[${SECURITY_GROUPS:?set SECURITY_GROUPS}],assignPublicIp=ENABLED}" \\',
+        '       --region "$REGION" >/dev/null',
+        'echo "Deployed $SERVICE behind the AgentHippo edge on ECS cluster $CLUSTER"',
+        '',
+    ].join('\n');
+    return {
+        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'Caddyfile': fed ? (0, identity_1.renderSidecarFedCaddyfile)(ctx.idpUrl) : (0, identity_1.renderSidecarEdgeCaddyfile)(),
+        'task-definition.json': JSON.stringify(taskDef, null, 2) + '\n',
+        'deploy.sh': deploy,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — AWS ECS Fargate + AgentHippo edge (${fed ? 'edge-fed' : 'edge'})`,
+            '',
+            `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
+            '',
+            'One Fargate task, containers share the task\'s localhost (`awsvpc` network mode) —',
+            'the same sidecar shape Cloud Run uses, so the Caddyfile is identical:',
+            '- **caddy** (ingress, the only published port) → ' + (fed
+                ? 'verifies the shared AgentHippo JWT'
+                : 'SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer'),
+            `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (not published)`,
+            '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`)' + (fed ? ' against the shared IdP secret' : ''),
+            ...(fed ? [] : ['- **oauth2-proxy** → Google SSO for browser clients']),
+            '',
+            '**One-time setup (not per deploy):** an ALB + HTTPS listener + target group (HTTP, port',
+            '8080, target type `ip`) pointed at this service — ALB terminates TLS, Caddy stays HTTP.',
+            '',
+            '```bash',
+            `export CLUSTER=<ecs-cluster> SUBNETS=<subnet-ids> SECURITY_GROUPS=<sg-ids> TARGET_GROUP_ARN=<from ALB setup>`,
+            `export ${secretArgs}`,
+            'bash deploy/deploy.sh',
+            '```',
+            '',
+            '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
+            '> running it against a real account.',
+            '',
+            ...renderEgressNote(ctx),
+        ].join('\n'),
+    };
+}
+/**
+ * Azure Container Apps (T1-generic, `d9-azure-adapter`). One Container App's containers run
+ * as a single replica sharing localhost — the same sidecar shape as Cloud Run/ECS Fargate, so
+ * the edge/edge-fed Caddyfiles and `EDGE_AGENT_PORT` convention are reused verbatim again
+ * (PLAN/deploy.md §5). Container Apps environments provide built-in ingress + TLS termination,
+ * so unlike aws-ecs there's no separate one-time load-balancer setup — `--target-port` on the
+ * container app itself is the whole ingress story.
+ *
+ * Scope: identity/exposure only (bare / edge / edge-fed), same as aws-ecs — no Spotlight/LiteLLM
+ * sidecar variant yet. Newer and far less exercised than the Cloud Run path.
+ */
+function azureContainerAppsArtifacts(ctx) {
+    const fed = ctx.ingress === 'edge-fed';
+    const edge = ctx.ingress === 'edge' || fed;
+    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
+    const PORT = 8080;
+    if (!edge) {
+        const spec = {
+            properties: {
+                configuration: {
+                    ingress: { external: true, targetPort: ctx.port },
+                    secrets: [{ name: 'provider-key', value: '${PROVIDER_KEY}' }],
+                },
+                template: {
+                    containers: [
+                        {
+                            name: 'agent',
+                            image: '${IMAGE}',
+                            env: [
+                                { name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' },
+                                { name: providerKeyEnv, secretRef: 'provider-key' },
+                            ],
+                            resources: { cpu: 0.5, memory: '1Gi' },
+                        },
+                    ],
+                },
+            },
+        };
+        const deploy = [
+            '#!/usr/bin/env bash',
+            '# T1-generic: Azure Container Apps, single container — built-in ingress + TLS, no separate',
+            '# load balancer to stand up. For a self-contained AgentHippo edge, use --ingress edge or',
+            '# --ingress edge-fed instead.',
+            'set -euo pipefail',
+            ...anchorToStagingRoot(),
+            'SERVICE="' + ctx.packName + '"',
+            'RESOURCE_GROUP="${RESOURCE_GROUP:?set RESOURCE_GROUP}"',
+            'ENVIRONMENT="${CONTAINERAPPS_ENVIRONMENT:?set CONTAINERAPPS_ENVIRONMENT — az containerapp env create (one-time)}"',
+            'ACR_NAME="${ACR_NAME:?set ACR_NAME — an Azure Container Registry (one-time: az acr create)}"',
+            'IMAGE="${ACR_NAME}.azurecr.io/${SERVICE}:latest"',
+            `PROVIDER_KEY="\${PROVIDER_KEY:?set PROVIDER_KEY — your ${providerKeyEnv}}"`,
+            '',
+            '# Builds in ACR (no local docker login/push step needed).',
+            'az acr build --registry "$ACR_NAME" --image "${SERVICE}:latest" --file deploy/Dockerfile .',
+            '',
+            'az containerapp show --name "$SERVICE" --resource-group "$RESOURCE_GROUP" >/dev/null 2>&1 \\',
+            '  && az containerapp update --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
+            '       --image "$IMAGE" >/dev/null \\',
+            '  || az containerapp create --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
+            '       --environment "$ENVIRONMENT" --image "$IMAGE" \\',
+            '       --target-port ' + ctx.port + ' --ingress external \\',
+            '       --secrets "provider-key=$PROVIDER_KEY" \\',
+            `       --env-vars "AGENTHIPPO_NO_AUTO_INSTALL=1" "${providerKeyEnv}=secretref:provider-key" \\`,
+            '       >/dev/null',
+            'echo "Deployed $SERVICE to Container Apps environment $ENVIRONMENT"',
+            '',
+        ].join('\n');
+        return {
+            'Dockerfile': sharedDockerfile(ctx),
+            'containerapp.json': JSON.stringify(spec, null, 2) + '\n',
+            'deploy.sh': deploy,
+            'README.md': [
+                `# Deploy: ${ctx.packName} — Azure Container Apps (T1-generic)`,
+                '',
+                `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
+                '',
+                'Single container, built-in ingress + TLS — no separate load balancer to stand up.',
+                'Use `--ingress edge` or `--ingress edge-fed` for a self-contained AgentHippo edge instead.',
+                '',
+                '```bash',
+                'export RESOURCE_GROUP=<rg> CONTAINERAPPS_ENVIRONMENT=<env> ACR_NAME=<registry>',
+                `export PROVIDER_KEY=<your ${providerKeyEnv}>`,
+                'bash deploy/deploy.sh',
+                '```',
+                '',
+                '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
+                '> running it against a real account.',
+                '',
+                ...renderEgressNote(ctx),
+            ].join('\n'),
+        };
+    }
+    // Edge / edge-fed: Caddy + (self-issued: oauth2-proxy) + auth-broker + agent, one Container
+    // App (containers in one replica share localhost, same sidecar shape as Cloud Run/ECS) —
+    // reuses the identical Caddyfiles Cloud Run already renders.
+    const containers = [
+        {
+            name: 'caddy',
+            image: 'caddy:2.8-alpine',
+            env: [{ name: 'PORT', value: String(PORT) }, { name: 'AGENTHIPPO_PUBLIC_HOSTNAME', value: ctx.publicHostname }],
+            resources: { cpu: 0.25, memory: '0.5Gi' },
+        },
+        ...(fed ? [] : [{
+                name: 'oauth2-proxy',
+                image: 'quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
+                env: [
+                    { name: 'OAUTH2_PROXY_HTTP_ADDRESS', value: '0.0.0.0:4180' },
+                    { name: 'OAUTH2_PROXY_UPSTREAMS', value: 'file:///dev/null' },
+                    { name: 'OAUTH2_PROXY_SET_XAUTHREQUEST', value: 'true' },
+                    { name: 'OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER', value: 'true' },
+                    { name: 'OAUTH2_PROXY_SKIP_PROVIDER_BUTTON', value: 'true' },
+                    { name: 'OAUTH2_PROXY_REVERSE_PROXY', value: 'true' },
+                    { name: 'OAUTH2_PROXY_CLIENT_ID', secretRef: 'oauth-client-id' },
+                    { name: 'OAUTH2_PROXY_CLIENT_SECRET', secretRef: 'oauth-client-secret' },
+                    { name: 'OAUTH2_PROXY_COOKIE_SECRET', secretRef: 'oauth-cookie-secret' },
+                ],
+                resources: { cpu: 0.25, memory: '0.5Gi' },
+            }]),
+        {
+            name: 'auth-broker',
+            image: '${IMAGE}',
+            command: ['agenthippo', 'auth-broker'],
+            env: [
+                { name: 'AGENTHIPPO_AUTH_PORT', value: '9780' },
+                { name: 'AGENTHIPPO_AUTH_JWT_SECRET', secretRef: 'auth-jwt-secret' },
+                ...(fed ? [
+                    { name: 'AGENTHIPPO_AUTH_COOKIE_DOMAIN', value: ctx.cookieDomain || '' },
+                    { name: 'AGENTHIPPO_AUTH_IDP_URL', value: ctx.idpUrl || '' },
+                ] : []),
+            ],
+            resources: { cpu: 0.25, memory: '0.5Gi' },
+        },
+        {
+            name: 'agent',
+            image: '${IMAGE}',
+            command: serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT }),
+            env: [
+                { name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' },
+                { name: providerKeyEnv, secretRef: 'provider-key' },
+            ],
+            resources: { cpu: 0.5, memory: '1Gi' },
+        },
+    ];
+    const spec = {
+        properties: {
+            configuration: {
+                ingress: { external: true, targetPort: PORT },
+                secrets: [
+                    { name: 'auth-jwt-secret', value: '${AUTH_JWT_SECRET}' },
+                    { name: 'provider-key', value: '${PROVIDER_KEY}' },
+                    ...(fed ? [] : [
+                        { name: 'oauth-client-id', value: '${OAUTH_CLIENT_ID}' },
+                        { name: 'oauth-client-secret', value: '${OAUTH_CLIENT_SECRET}' },
+                        { name: 'oauth-cookie-secret', value: '${OAUTH_COOKIE_SECRET}' },
+                    ]),
+                ],
+            },
+            template: { containers },
+        },
+    };
+    const secretExports = [
+        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET}"',
+        `PROVIDER_KEY="\${PROVIDER_KEY:?set PROVIDER_KEY — your ${providerKeyEnv}}"`,
+        ...(fed ? [] : [
+            'OAUTH_CLIENT_ID="${OAUTH_CLIENT_ID:?set OAUTH_CLIENT_ID}"',
+            'OAUTH_CLIENT_SECRET="${OAUTH_CLIENT_SECRET:?set OAUTH_CLIENT_SECRET}"',
+            'OAUTH_COOKIE_SECRET="${OAUTH_COOKIE_SECRET:?set OAUTH_COOKIE_SECRET}"',
+        ]),
+    ];
+    const deploy = [
+        '#!/usr/bin/env bash',
+        `# Azure Container Apps + AgentHippo edge (${fed ? 'edge-fed: federated identity, no oauth2-proxy' : 'edge: self-issued'}).`,
+        '# Container Apps environments provide built-in ingress + TLS — no separate load balancer.',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        'SERVICE="' + ctx.packName + '"',
+        'RESOURCE_GROUP="${RESOURCE_GROUP:?set RESOURCE_GROUP}"',
+        'ENVIRONMENT="${CONTAINERAPPS_ENVIRONMENT:?set CONTAINERAPPS_ENVIRONMENT — az containerapp env create (one-time)}"',
+        'ACR_NAME="${ACR_NAME:?set ACR_NAME — an Azure Container Registry (one-time: az acr create)}"',
+        'IMAGE="${ACR_NAME}.azurecr.io/${SERVICE}:latest"',
+        '',
+        '# auth-broker reuses the agent image (CLI ships `auth-broker`). Builds in ACR.',
+        'az acr build --registry "$ACR_NAME" --image "${SERVICE}:latest" --file deploy/Dockerfile .',
+        '',
+        ...secretExports,
+        'SPEC_JSON="$(sed -e "s|\\${IMAGE}|${IMAGE}|g" -e "s|\\${AUTH_JWT_SECRET}|${AUTH_JWT_SECRET}|g" \\',
+        '    -e "s|\\${PROVIDER_KEY}|${PROVIDER_KEY}|g" \\',
+        ...(fed ? [] : [
+            '    -e "s|\\${OAUTH_CLIENT_ID}|${OAUTH_CLIENT_ID}|g" -e "s|\\${OAUTH_CLIENT_SECRET}|${OAUTH_CLIENT_SECRET}|g" \\',
+            '    -e "s|\\${OAUTH_COOKIE_SECRET}|${OAUTH_COOKIE_SECRET}|g" \\',
+        ]),
+        '    deploy/containerapp.json)"',
+        'echo "$SPEC_JSON" > /tmp/${SERVICE}-containerapp.json',
+        '',
+        '# `--yaml` also accepts JSON (JSON is valid YAML) — kept as .json so it\'s reviewable',
+        '# alongside the other checked-in templates without a format switch.',
+        'az containerapp show --name "$SERVICE" --resource-group "$RESOURCE_GROUP" >/dev/null 2>&1 \\',
+        '  && az containerapp update --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
+        '       --yaml /tmp/${SERVICE}-containerapp.json >/dev/null \\',
+        '  || az containerapp create --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
+        '       --environment "$ENVIRONMENT" --yaml /tmp/${SERVICE}-containerapp.json >/dev/null',
+        'echo "Deployed $SERVICE behind the AgentHippo edge in $ENVIRONMENT"',
+        '',
+    ].join('\n');
+    return {
+        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'Caddyfile': fed ? (0, identity_1.renderSidecarFedCaddyfile)(ctx.idpUrl) : (0, identity_1.renderSidecarEdgeCaddyfile)(),
+        'containerapp.json': JSON.stringify(spec, null, 2) + '\n',
+        'deploy.sh': deploy,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — Azure Container Apps + AgentHippo edge (${fed ? 'edge-fed' : 'edge'})`,
+            '',
+            `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
+            '',
+            'One Container App, containers share the replica\'s localhost — the same sidecar shape',
+            'Cloud Run/ECS Fargate use, so the Caddyfile is identical:',
+            '- **caddy** (ingress, the only published port) → ' + (fed
+                ? 'verifies the shared AgentHippo JWT'
+                : 'SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer'),
+            `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (not published)`,
+            '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`)' + (fed ? ' against the shared IdP secret' : ''),
+            ...(fed ? [] : ['- **oauth2-proxy** → Google SSO for browser clients']),
+            '',
+            'Built-in ingress + TLS termination — no separate load balancer to stand up.',
+            '',
+            '```bash',
+            'export RESOURCE_GROUP=<rg> CONTAINERAPPS_ENVIRONMENT=<env> ACR_NAME=<registry>',
+            ...secretExports.map((l) => 'export ' + l.split('=')[0] + '=<...>'),
+            'bash deploy/deploy.sh',
+            '```',
+            '',
+            '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
+            '> running it against a real account.',
+            '',
+            ...renderEgressNote(ctx),
         ].join('\n'),
     };
 }
@@ -2054,6 +2911,8 @@ const RENDERERS = {
     'databricks-app': databricksAppArtifacts,
     spcs: spcsArtifacts,
     cloudflare: cloudflareArtifacts,
+    'aws-ecs': awsEcsArtifacts,
+    'azure-container-apps': azureContainerAppsArtifacts,
 };
 /**
  * Render every artifact for a target (relative path → file content), always
@@ -2061,18 +2920,24 @@ const RENDERERS = {
  */
 function renderTarget(target, ctx) {
     const files = RENDERERS[target](ctx);
-    const fed = target === 'cloudrun' && ctx.ingress === 'edge-fed';
-    const edge = target === 'vm' || target === 'compose' || (target === 'cloudrun' && ctx.ingress === 'edge') || fed;
-    // .dockerignore only alongside a Dockerfile (image-based targets). databricks-app
-    // is source-based (platform builds it) and ships no Dockerfile.
+    // edge-fed applies to any Caddy-based target (vm/compose/cloudrun) — federates identity
+    // against a central IdP instead of each target running its own oauth2-proxy + Google client.
+    const fed = ctx.ingress === 'edge-fed';
+    // Colocated agents (state 4) ship no edge of their own at all — no Caddy, no oauth2-proxy,
+    // no local auth-broker, so no auth secrets (.env.auth.example / DATA-ACCESS.md) either.
+    const colocate = Boolean(ctx.colocate) && fed && (target === 'vm' || target === 'compose');
+    const gatewayDirect = usesGatewayDirect(ctx) && target === 'cloudrun' && fed;
+    const edge = !colocate && (target === 'vm' || target === 'compose'
+        || ((target === 'cloudrun' || target === 'aws-ecs' || target === 'azure-container-apps') && (ctx.ingress === 'edge' || fed)));
     const hasDockerfile = Object.keys(files).some((k) => k === 'Dockerfile' || k.endsWith('/Dockerfile'));
-    return {
+    const raw = {
         ...files,
         ...(hasDockerfile ? { '.dockerignore': renderDockerignore() } : {}),
         '.env.example': renderEnvExample(ctx.envVars, {
             edge,
             engine: ctx.engine,
             hostname: ctx.publicHostname,
+            gatewayDirect,
         }),
         // Edge auth secrets are split out so the agent container never loads them.
         ...(edge ? {
@@ -2083,5 +2948,11 @@ function renderTarget(target, ctx) {
                 cookieDomain: ctx.cookieDomain,
             }),
         } : {}),
+        'DATA-ACCESS.md': renderDataAccessSummary(ctx, target, edge, fed, colocate),
     };
+    const out = {};
+    for (const [rel, content] of Object.entries(raw)) {
+        out[rel] = withPackAttribution(ctx, rel, content);
+    }
+    return out;
 }