@agenthippo-ai/agenthippo 0.1.0

package/out/cli/deploy-init.js

@@ -0,0 +1,2087 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK = exports.AGENTHIPPO_CLI_NPM_PACKAGE = exports.DEPLOY_PUBLIC_HOSTNAME = exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME = exports.DEPLOY_TARGETS = void 0;
+exports.isDeployTarget = isDeployTarget;
+exports.defaultRuntimeImage = defaultRuntimeImage;
+exports.serveCmdArgs = serveCmdArgs;
+exports.resolveAgentHippoCliNpmVersion = resolveAgentHippoCliNpmVersion;
+exports.resolveDeployPublicHostname = resolveDeployPublicHostname;
+exports.scanEnvRefs = scanEnvRefs;
+exports.renderEnvExample = renderEnvExample;
+exports.renderAuthEnvExample = renderAuthEnvExample;
+exports.renderTarget = renderTarget;
+/**
+ * `agenthippo deploy init` — generator for platform-native deploy artifacts
+ * (serve-v3 §A4 / P2). We *generate templates into the pack repo*; we never run
+ * `docker build` or call a cloud. The customer's security team reads a 5-line
+ * Dockerfile and their CI/CLI does the rest.
+ *
+ * Tiers (serve-v3 §3): vm = T0.5/T1, compose = T2, cloudrun/cloudflare =
+ * T1-generic, databricks-app/spcs = T1-native.
+ *
+ * Deployment model (org IdP vs generated staging): see enterprise-deploy/README.md in the repo root.
+ * `deploy init` only writes templates; the customer runs scripts in deploy-out/ to deploy.
+ *
+ * This module is pure (string in, string out) apart from `scanEnvRefs`, which
+ * reads the pack to make its secret surface self-documenting. Kept separate
+ * from the command so it is unit-testable without fs or a cloud.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const serve_hardening_1 = require("./serve-hardening");
+exports.DEPLOY_TARGETS = ['vm', 'compose', 'cloudrun', 'databricks-app', 'spcs', 'cloudflare'];
+function isDeployTarget(value) {
+    return exports.DEPLOY_TARGETS.includes(value);
+}
+/** Default runtime image for a pack engine (cursor needs the /engines layer). */
+function defaultRuntimeImage(engine) {
+    return engine.trim().toLowerCase() === 'cursor'
+        ? 'ghcr.io/agenthippo/runtime:latest-cursor'
+        : 'ghcr.io/agenthippo/runtime:latest';
+}
+/** `serve` argv baked into generated Dockerfiles (matches agent.yaml engine/model). */
+function serveCmdArgs(ctx, opts) {
+    const args = [
+        'serve',
+        '--agent',
+        '/app/pack',
+        '--workspace',
+        '/state/workspace',
+        '--state-dir',
+        '/state',
+        '--port',
+        String(opts?.port ?? ctx.port),
+    ];
+    const engine = ctx.engine?.trim().toLowerCase();
+    if (engine && !['claude', 'codex'].includes(engine)) {
+        args.push('--engine', engine);
+    }
+    const model = ctx.model?.trim();
+    if (model) {
+        args.push('--model', model);
+    }
+    if (opts?.wwwDir) {
+        args.push('--www-dir', opts.wwwDir);
+    }
+    return args;
+}
+const TEXT_EXT = new Set(['.json', '.yaml', '.yml', '.md', '.env', '.example', '.txt', '.mcp']);
+const SKIP_DIRS = new Set(['node_modules', '.git', 'deploy', '.agent-hippo', 'dist', 'out']);
+/** Default public hostname when `--hostname` is not passed to `deploy init`. */
+exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME = 'auth.agenthippo.ai';
+/** @deprecated Use {@link DEFAULT_DEPLOY_PUBLIC_HOSTNAME}. */
+exports.DEPLOY_PUBLIC_HOSTNAME = exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME;
+/** npm package for Databricks Apps source deploy (org: agenthippo-ai). */
+exports.AGENTHIPPO_CLI_NPM_PACKAGE = '@agenthippo-ai/cli';
+/** Fallback when monorepo package.json is not present (customer runs published CLI). */
+exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK = 'latest';
+/**
+ * Pin @agenthippo-ai/cli to the monorepo release version when `deploy init` runs from
+ * a dev checkout; otherwise fall back to `latest`.
+ */
+function resolveAgentHippoCliNpmVersion() {
+    try {
+        const pkgPath = path.join(__dirname, '..', '..', '..', '..', 'package.json');
+        if (fs.existsSync(pkgPath)) {
+            const raw = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            const v = raw.version?.trim();
+            if (v) {
+                return v;
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    return exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK;
+}
+function resolveDeployPublicHostname(value) {
+    const trimmed = value?.trim();
+    return trimmed || exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME;
+}
+/**
+ * Recursively scan a pack for `${env:VAR}` references and return the sorted,
+ * de-duplicated variable names. This is what makes `.env.example` honest: the
+ * pack's secret surface is whatever it actually interpolates.
+ */
+function scanEnvRefs(dir) {
+    const found = new Set();
+    const re = /\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
+    const walk = (current) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name)) {
+                    walk(full);
+                }
+                continue;
+            }
+            // `.mcp.json` → ext `.json`; also accept files with a meaningful name even if extensionless config.
+            const ext = path.extname(entry.name).toLowerCase();
+            if (!TEXT_EXT.has(ext)) {
+                continue;
+            }
+            let text;
+            try {
+                text = fs.readFileSync(full, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            for (const m of text.matchAll(re)) {
+                found.add(m[1]);
+            }
+        }
+    };
+    walk(dir);
+    return [...found].sort();
+}
+/**
+ * Render `.env.example`. Always seeds the two serve needs (a bearer secret and
+ * a model credential) as comments, then lists every scanned pack variable.
+ */
+function renderEnvExample(vars, opts) {
+    const isCursor = opts?.engine?.trim().toLowerCase() === 'cursor';
+    const hostname = resolveDeployPublicHostname(opts?.hostname);
+    const lines = [
+        '# Generated by `agenthippo deploy init`. Copy to .env and fill in.',
+    ];
+    if (isCursor) {
+        lines.push('# Cursor engine (pack default model: auto):', 'CURSOR_API_KEY=             # https://cursor.com/settings → API keys');
+    }
+    else {
+        lines.push('# Model credential — pick ONE path (serve-v3 §10.2):', '#   ANTHROPIC_API_KEY=        # direct Anthropic', '#   CLAUDE_CODE_USE_BEDROCK=1 # existing AWS Bedrock entitlement (no new key)', '#   CLAUDE_CODE_USE_VERTEX=1  # existing GCP Vertex entitlement (no new key)', 'ANTHROPIC_API_KEY=');
+    }
+    if (vars.length > 0) {
+        lines.push('', '# Pack-referenced secrets (scanned from ${env:...}):');
+        for (const v of vars) {
+            lines.push(`${v}=`);
+        }
+    }
+    if (opts?.edge) {
+        lines.push('', '# Public hostname — set once; Caddyfile reads {$AGENTHIPPO_PUBLIC_HOSTNAME}.', `AGENTHIPPO_PUBLIC_HOSTNAME=${hostname}`, '', '# Edge auth secrets (JWT signing key, Google OAuth client/cookie) live in .env.auth,', '# which is loaded ONLY by the auth-broker and oauth2-proxy services — never the agent.', '# Keeping the token-signing key out of the agent container limits blast radius if the', '# agent (which runs model-driven tool calls) is compromised. Copy .env.auth.example.', '', '# Cloudflare Tunnel (free — no Access seats), config-file mode in compose:', '#   cloudflared tunnel create <name>  → save the JSON as deploy/tunnel-credentials.json (gitignored)', '#   set the tunnel id in deploy/cloudflared.yml; cloudflared tunnel route dns <name> <hostname>', '# No token/env needed — the credentials JSON is mounted into the cloudflared container.');
+    }
+    return lines.join('\n') + '\n';
+}
+/**
+ * Render `.env.auth.example` — the edge auth secrets (JWT signing key, Google OAuth
+ * client/cookie secrets, team bootstrap config). Loaded ONLY by the auth-broker and
+ * oauth2-proxy services (see docker-compose.yml), never the agent: the agent has no use
+ * for the token-signing key, so keeping it out of that container limits the blast radius
+ * of a compromised (model-driven) agent — it can no longer forge tokens for any identity.
+ */
+function renderAuthEnvExample(opts) {
+    const hostname = resolveDeployPublicHostname(opts?.hostname);
+    if (opts?.fed) {
+        const idp = (opts.idpUrl || 'https://auth.agenthippo.ai').replace(/\/+$/, '');
+        const cookieDomain = opts.cookieDomain || '.agenthippo.ai';
+        return [
+            '# Generated by `agenthippo deploy init --ingress edge-fed`. Copy to .env.auth and fill in.',
+            '# Federated edge (A′): NO Google OAuth client here. Google login happens once at the',
+            `# central IdP (${idp}); this agent only VERIFIES the shared ${cookieDomain} AgentHippo JWT.`,
+            '# Loaded only by auth-broker. Never given to the agent (limits token-forgery blast radius).',
+            '',
+            '# AgentHippo JWT signing key — MUST match the central IdP (auth.agenthippo.ai).',
+            '# Copy it from there (or the GCP secret it stores) so tokens issued by the IdP verify here.',
+            'AGENTHIPPO_AUTH_JWT_SECRET=   # copy from auth.agenthippo.ai (openssl rand -hex 32 to generate one)',
+            `AGENTHIPPO_AUTH_PUBLIC_URL=https://${hostname}`,
+            'AGENTHIPPO_AUTH_ALLOWED_DOMAINS=agenthippo.ai',
+            `AGENTHIPPO_AUTH_COOKIE_DOMAIN=${cookieDomain}   # scope the shared cookie to all subdomains`,
+            `AGENTHIPPO_AUTH_IDP_URL=${idp}   # where browsers are sent to log in`,
+            'AGENTHIPPO_AUTH_COOKIE_NAME=ah_token',
+            '',
+            '# Team bootstrap (store + LiteLLM routing) — same as the IdP if you want parity.',
+            'AGENTHIPPO_TEAM_ID=team_default',
+            'AGENTHIPPO_TEAM_NAME=Default Team',
+            'AGENTHIPPO_TEAM_STORE_REPO=agenthippoai/agenthippo-store',
+            'AGENTHIPPO_TEAM_STORE_INDEX_URL=https://agenthippoai.github.io/agenthippo-store',
+            'AGENTHIPPO_TEAM_GITHUB_ORG=agenthippoai',
+            'AGENTHIPPO_TEAM_LITELLM_BASE_URL=http://127.0.0.1:4000',
+            'AGENTHIPPO_TEAM_LITELLM_API_KEY=',
+            '',
+            '# No OAUTH2_PROXY_* here — this agent does not talk to Google. The one oauth2-proxy +',
+            '# one Google OAuth client live only at the IdP.',
+        ].join('\n') + '\n';
+    }
+    return [
+        '# Generated by `agenthippo deploy init`. Copy to .env.auth and fill in.',
+        '# Loaded only by auth-broker + oauth2-proxy (docker-compose.yml). Never given to the agent.',
+        '',
+        '# Google SSO (oauth2-proxy). GCP → OAuth client (Web):',
+        `#   Authorized origins: https://${hostname}`,
+        `#   Redirect URI:       https://${hostname}/oauth2/callback`,
+        'OAUTH2_PROXY_CLIENT_ID=',
+        'OAUTH2_PROXY_CLIENT_SECRET=',
+        'OAUTH2_PROXY_COOKIE_SECRET=   # openssl rand -base64 32 | head -c 32',
+        'OAUTH2_PROXY_PROVIDER=google',
+        'OAUTH2_PROXY_EMAIL_DOMAINS=example.com',
+        'OAUTH2_PROXY_REVERSE_PROXY=true',
+        `OAUTH2_PROXY_REDIRECT_URL=https://${hostname}/oauth2/callback`,
+        '# Federated SSO (A′) — set when this edge is the central IdP for *.agenthippo.ai agents:',
+        'OAUTH2_PROXY_COOKIE_DOMAINS=.agenthippo.ai   # scope the oauth2-proxy session cookie to all subdomains',
+        '',
+        '# IDE auth broker (team bootstrap for store + LiteLLM routing)',
+        'AGENTHIPPO_AUTH_JWT_SECRET=   # openssl rand -hex 32',
+        'AGENTHIPPO_AUTH_PUBLIC_URL=https://' + hostname,
+        'AGENTHIPPO_AUTH_ALLOWED_DOMAINS=example.com',
+        'AGENTHIPPO_AUTH_COOKIE_NAME=ah_token   # federated cookie holding the AgentHippo JWT',
+        'AGENTHIPPO_AUTH_COOKIE_DOMAIN=.agenthippo.ai   # set so /oauth/browser-login stamps a cross-subdomain cookie',
+        'AGENTHIPPO_TEAM_ID=team_default',
+        'AGENTHIPPO_TEAM_NAME=Default Team',
+        'AGENTHIPPO_TEAM_STORE_REPO=agenthippoai/agenthippo-store',
+        'AGENTHIPPO_TEAM_STORE_INDEX_URL=https://agenthippoai.github.io/agenthippo-store',
+        'AGENTHIPPO_TEAM_GITHUB_ORG=agenthippoai',
+        'AGENTHIPPO_TEAM_LITELLM_BASE_URL=http://127.0.0.1:4000',
+        'AGENTHIPPO_TEAM_LITELLM_API_KEY=',
+    ].join('\n') + '\n';
+}
+/** Auth broker sidecar for IDE sign-in + team bootstrap API. */
+function renderAuthBrokerDockerfile() {
+    return [
+        '# Auth broker for IDE sign-in + team bootstrap API.',
+        '# Build context = pack root: docker build -f deploy/Dockerfile.auth-broker -t <pack>-auth-broker:local .',
+        'FROM ghcr.io/agenthippo/runtime:local-cursor',
+        'ENV AGENTHIPPO_AUTH_PORT=9780',
+        'ENV AGENTHIPPO_AUTH_DATA_DIR=/data',
+        'EXPOSE 9780',
+        'VOLUME ["/data"]',
+        'CMD ["auth-broker"]',
+        '',
+    ].join('\n');
+}
+/** .dockerignore emitted alongside every image-building target's Dockerfile.
+ * Keeps skills/, references/, scripts/ (required at runtime) and drops only VCS,
+ * cache, and build cruft. node_modules is excluded so the linux/amd64 image
+ * reinstalls fresh deps via the Dockerfile skill-deps step — dev-machine
+ * node_modules may be wrong-arch (arm64/darwin) for the image. */
+function renderDockerignore() {
+    return [
+        '# Generated by `agenthippo deploy init`. Keeps skills/, references/, scripts/',
+        '# (needed at runtime) and drops only VCS/cache/build cruft. node_modules is',
+        '# excluded so the Dockerfile reinstalls fresh linux/amd64 deps for skills.',
+        '.git',
+        '.gitignore',
+        '.gitattributes',
+        '**/node_modules',
+        '**/__pycache__',
+        '**/.pytest_cache',
+        '**/.mypy_cache',
+        '**/.ruff_cache',
+        '**/.venv',
+        '**/venv',
+        '**/*.log',
+        '**/dist',
+        '**/build',
+        '**/.next',
+        '**/.turbo',
+        '**/.cache',
+        '.DS_Store',
+        '**/.DS_Store',
+        '.idea',
+        '.vscode',
+        '*.swp',
+        '# Secrets anywhere in the pack (defensive; deploy/ secrets are also covered below).',
+        '**/.env',
+        '**/*credentials*.json',
+        '# deploy/ holds build/deploy artifacts + secrets; only deploy/www/ ships at runtime.',
+        'deploy/*',
+        '!deploy/www',
+        '!deploy/www/**',
+        '',
+    ].join('\n');
+}
+/** Build-time install of skill dependencies (skills/** and scripts/**). Skills that
+ * ship their own requirements.txt / package.json need their libs present at runtime,
+ * but AGENTHIPPO_NO_AUTO_INSTALL=1 skips runtime installs — so we install at BUILD
+ * time. Pure no-op when no dep files are present (keeps minimal packs lean). pip3 is
+ * ensured only when a requirements.txt exists (the runtime base ships python3 but not
+ * necessarily pip). Runs as root, then drops back to the non-root agent user. */
+function skillDepsInstallLines() {
+    return [
+        '# Skill dependencies — installed at BUILD time so skills that ship their own',
+        '# requirements.txt / package.json have their libs present at runtime',
+        '# (AGENTHIPPO_NO_AUTO_INSTALL=1 skips runtime installs). No-op when none exist.',
+        'USER root',
+        'RUN set -e; \\',
+        '    py_reqs=$(find /app/pack/skills /app/pack/scripts -type f -name requirements.txt -not -path "*/node_modules/*" 2>/dev/null || true); \\',
+        '    if [ -n "$py_reqs" ]; then \\',
+        '      pip3 --version 2>/dev/null || (apt-get update && apt-get install -y --no-install-recommends python3-pip && rm -rf /var/lib/apt/lists/*); \\',
+        '      echo "$py_reqs" | while IFS= read -r f; do [ -n "$f" ] && pip3 install --no-cache-dir --break-system-packages -r "$f" || true; done; \\',
+        '    fi; \\',
+        '    pkg_json=$(find /app/pack/skills /app/pack/scripts -type f -name package.json -not -path "*/node_modules/*" 2>/dev/null || true); \\',
+        '    if [ -n "$pkg_json" ]; then \\',
+        '      echo "$pkg_json" | while IFS= read -r f; do [ -n "$f" ] && (cd "$(dirname "$f")" && npm install --omit=dev --no-audit --no-fund || true) || true; done; \\',
+        '    fi',
+        'USER agent',
+    ];
+}
+/** Cloud Run / compose agent env: bind on all interfaces inside the container network. */
+function agentServeHostEnvYaml(indent = '            ') {
+    return `${indent}- { name: ${serve_hardening_1.SERVE_HOST_ENV}, value: ${serve_hardening_1.CONTAINER_SERVE_HOST} }`;
+}
+/** The Dockerfile shared by image-based targets (serve-v3 §A2). */
+function sharedDockerfile(ctx, opts) {
+    const cmd = serveCmdArgs(ctx, opts).map((a) => `"${a}"`).join(',');
+    return [
+        `# Generated by \`agenthippo deploy init\`. Build context = pack root:`,
+        `#   docker build -f deploy/Dockerfile -t ${ctx.packName}:local .`,
+        `FROM ${ctx.image}`,
+        `COPY . /app/pack/`,
+        ...skillDepsInstallLines(),
+        `ENV AGENTHIPPO_NO_AUTO_INSTALL=1`,
+        `ENV ${serve_hardening_1.SERVE_HOST_ENV}=${serve_hardening_1.CONTAINER_SERVE_HOST}`,
+        `EXPOSE ${ctx.port}`,
+        // Runtime base image sets ENTRYPOINT ["agenthippo"]; CMD args append to it.
+        `CMD [${cmd}]`,
+        '',
+    ].join('\n');
+}
+/** Minimal post-SSO landing page (static chat UI → /v1/chat). */
+function renderLandingPage(packName) {
+    return [
+        '<!DOCTYPE html>',
+        '<html lang="en">',
+        '<head>',
+        '  <meta charset="utf-8" />',
+        '  <meta name="viewport" content="width=device-width, initial-scale=1" />',
+        `  <title>${packName}</title>`,
+        '  <style>',
+        '    :root { color-scheme: light dark; font-family: system-ui, sans-serif; }',
+        '    body { max-width: 720px; margin: 2rem auto; padding: 0 1rem; line-height: 1.5; }',
+        '    h1 { font-size: 1.4rem; margin-bottom: 0.25rem; }',
+        '    .sub { opacity: 0.7; font-size: 0.9rem; margin-bottom: 1.5rem; }',
+        '    #log { border: 1px solid #8884; border-radius: 8px; min-height: 200px; padding: 1rem; white-space: pre-wrap; margin-bottom: 1rem; }',
+        '    form { display: flex; gap: 0.5rem; }',
+        '    input[type=text] { flex: 1; padding: 0.6rem 0.75rem; border-radius: 6px; border: 1px solid #8886; font: inherit; }',
+        '    button { padding: 0.6rem 1rem; border-radius: 6px; border: 0; background: #2563eb; color: #fff; font: inherit; cursor: pointer; }',
+        '    button:disabled { opacity: 0.6; cursor: wait; }',
+        '  </style>',
+        '</head>',
+        '<body>',
+        `  <h1>${packName}</h1>`,
+        '  <p class="sub">Signed in via Google SSO. Chat uses the agent API behind this page.</p>',
+        '  <div id="log">Ready. Send a message below.</div>',
+        '  <form id="chat">',
+        '    <input id="msg" type="text" placeholder="Ask the agent…" autocomplete="off" required />',
+        '    <button type="submit">Send</button>',
+        '  </form>',
+        '  <script>',
+        '    const log = document.getElementById("log");',
+        '    const form = document.getElementById("chat");',
+        '    const input = document.getElementById("msg");',
+        '    // Stable per-browser session id so turns resume the same conversation (multi-turn).',
+        '    const sessionId = (self.crypto && crypto.randomUUID) ? crypto.randomUUID() : ("web-" + Date.now().toString(36) + Math.random().toString(36).slice(2));',
+        '    function append(text) {',
+        '      log.textContent += (log.textContent.endsWith("\\n") || log.textContent === "Ready. Send a message below." ? "" : "\\n") + text;',
+        '    }',
+        '    form.addEventListener("submit", async (e) => {',
+        '      e.preventDefault();',
+        '      const message = input.value.trim();',
+        '      if (!message) return;',
+        '      input.value = "";',
+        '      form.querySelector("button").disabled = true;',
+        '      append("\\nYou: " + message + "\\nAgent: ");',
+        '      try {',
+        '        const body = { message, session_id: sessionId };',
+        '        const res = await fetch("/v1/chat", {',
+        '          method: "POST",',
+        '          headers: { "Content-Type": "application/json" },',
+        '          body: JSON.stringify(body),',
+        '        });',
+        '        const data = await res.json();',
+        '        if (!res.ok) throw new Error(data.error || res.statusText);',
+        '        append(data.text || data.response || JSON.stringify(data));',
+        '      } catch (err) {',
+        '        append("[error] " + (err.message || err));',
+        '      } finally {',
+        '        form.querySelector("button").disabled = false;',
+        '        input.focus();',
+        '      }',
+        '    });',
+        '    input.focus();',
+        '  </script>',
+        '</body>',
+        '</html>',
+        '',
+    ].join('\n');
+}
+/** Caddy config for the `edge` compose profile (oauth2-proxy + agent on Docker network). */
+function renderCaddyfile(ctx) {
+    return [
+        '# SSO edge + Cloudflare Tunnel. Set AGENTHIPPO_PUBLIC_HOSTNAME in .env (Caddy reads it below).',
+        '# TLS terminates at Cloudflare; origin listens on HTTP only.',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        'http://{$AGENTHIPPO_PUBLIC_HOSTNAME} {',
+        '  # Federated SSO (A′): browsers from *.agenthippo.ai subdomains land here to log in.',
+        '  # Gated behind oauth2-proxy (Google) → auth-broker mints + sets the shared .agenthippo.ai',
+        '  # cookie (ah_token), then redirects back to the agent subdomain (`return_to`). Must come',
+        '  # before the generic /oauth/* handle so it wins for this exact path.',
+        '  handle /oauth/browser-login {',
+        '    forward_auth oauth2-proxy:4180 {',
+        '      uri /oauth2/auth',
+        '      copy_headers X-Auth-Request-Email',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        redir * "/oauth2/sign_in?rd=/oauth/browser-login{http.request.uri.query}"',
+        '      }',
+        '    }',
+        '    reverse_proxy auth-broker:9780 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  handle /oauth/* {',
+        '    reverse_proxy auth-broker:9780 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  handle /api/ide/* {',
+        '    reverse_proxy auth-broker:9780 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  handle /oauth2/* {',
+        '    reverse_proxy oauth2-proxy:4180 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  @health path /health /ready',
+        '  handle @health {',
+        `    reverse_proxy agent:${ctx.port}`,
+        '  }',
+        '  # API clients (IDE) with a Bearer token: validate via auth-broker, copy identity header.',
+        '  @apiWithAuth {',
+        '    path /v1/*',
+        '    header Authorization *',
+        '  }',
+        '  handle @apiWithAuth {',
+        '    forward_auth auth-broker:9780 {',
+        '      uri /api/ide/me',
+        '      copy_headers X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        respond "Unauthorized" 401',
+        '      }',
+        '    }',
+        `    reverse_proxy agent:${ctx.port}`,
+        '  }',
+        '  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User.',
+        '  handle {',
+        '    forward_auth oauth2-proxy:4180 {',
+        '      uri /oauth2/auth',
+        '      copy_headers X-Auth-Request-Email>X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        redir * "/oauth2/sign_in?rd={http.request.uri.path}{http.request.uri.query}"',
+        '      }',
+        '    }',
+        '    @api path /v1/*',
+        '    handle @api {',
+        `      reverse_proxy agent:${ctx.port}`,
+        '    }',
+        '    root * /srv/www',
+        '    file_server',
+        '  }',
+        '}',
+        '',
+    ].join('\n');
+}
+/** cloudflared config-file mode (optional). Prefer CLOUDFLARE_TUNNEL_TOKEN + compose `tunnel` profile. */
+function renderCloudflaredYml(hostname) {
+    return [
+        '# Cloudflare Tunnel — run as the compose `cloudflared` service (config-file mode).',
+        '# One-time setup:',
+        '#   cloudflared tunnel create <name>                 # creates the tunnel + a credentials JSON',
+        '#   cp <that-creds>.json deploy/tunnel-credentials.json   # mounted into the container (gitignore it!)',
+        `#   cloudflared tunnel route dns <name> ${hostname}`,
+        '#   set the tunnel id below, then: docker compose --profile edge --profile tunnel up -d',
+        'tunnel: <TUNNEL_ID>',
+        'credentials-file: /etc/cloudflared/credentials.json   # mounted from deploy/tunnel-credentials.json',
+        'ingress:',
+        `  - hostname: ${hostname}  # must match AGENTHIPPO_PUBLIC_HOSTNAME in .env`,
+        '    service: http://caddy:80   # cloudflared container → Caddy over the compose network',
+        '  - service: http_status:404',
+        '',
+    ].join('\n');
+}
+/** Shared `agent` service block for vm/compose docker-compose.yml (build context = pack root). */
+function renderAgentComposeService(ctx, extraLines = []) {
+    return [
+        '  agent:',
+        '    build:',
+        '      context: ..',
+        '      dockerfile: deploy/Dockerfile',
+        '    env_file:',
+        '      - path: .env',
+        '        required: false',
+        ...extraLines,
+        '    volumes: ["agenthippo-state:/state"]',
+        `    expose: ["${ctx.port}"]`,
+        '    # No host port — edge reaches agent on the Docker network only.',
+        '    # T0.5a VPN: bash deploy/run.sh binds 127.0.0.1:' + ctx.port + ' via docker run -p.',
+        '',
+    ];
+}
+/** oauth2-proxy + Caddy services for `--profile edge`. */
+function renderEdgeComposeServices() {
+    return [
+        '  oauth2-proxy:',
+        '    profiles: ["edge"]',
+        '    image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
+        '    env_file:',
+        '      - path: .env',
+        '        required: false',
+        '      - path: .env.auth   # OAuth client/cookie secrets — not shared with the agent',
+        '        required: false',
+        '    environment:',
+        '      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180',
+        '      OAUTH2_PROXY_UPSTREAMS: file:///dev/null',
+        '      OAUTH2_PROXY_SET_XAUTHREQUEST: "true"',
+        '      OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true"',
+        '      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"',
+        '      OAUTH2_PROXY_REVERSE_PROXY: "true"',
+        '    expose: ["4180"]',
+        '',
+        '  auth-broker:',
+        '    profiles: ["edge"]',
+        '    build:',
+        '      context: ..',
+        '      dockerfile: deploy/Dockerfile.auth-broker',
+        '    env_file:',
+        '      - path: .env',
+        '        required: false',
+        '      - path: .env.auth   # JWT signing key + team config — not shared with the agent',
+        '        required: false',
+        '    environment:',
+        '      AGENTHIPPO_AUTH_PORT: "9780"',
+        '      AGENTHIPPO_AUTH_DATA_DIR: /data',
+        '    user: "0:0"  # named volume /data is root-owned on first create',
+        '    volumes: ["auth-broker-data:/data"]',
+        '    expose: ["9780"]',
+        '',
+        '  caddy:',
+        '    profiles: ["edge"]',
+        '    image: caddy:2.8-alpine',
+        '    env_file:',
+        '      - path: .env',
+        '        required: false',
+        '    ports: ["80:80", "443:443"]  # use 80:80 not 127.0.0.1:80 — breaks vmnetd on some Docker Desktop builds',
+        '    volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro", "./www:/srv/www:ro"]',
+        '    depends_on: [oauth2-proxy, agent, auth-broker]',
+        '',
+    ];
+}
+/** cloudflared in compose — outbound tunnel to Cloudflare (free; no Access). */
+function renderTunnelComposeServices() {
+    return [
+        '  cloudflared:',
+        '    profiles: ["tunnel"]',
+        '    image: cloudflare/cloudflared:2024.12.2',
+        '    restart: unless-stopped',
+        '    # Config-file mode: routing lives in deploy/cloudflared.yml (GitOps), credentials',
+        '    # in deploy/tunnel-credentials.json (gitignored secret from `cloudflared tunnel create`).',
+        '    command: tunnel --config /etc/cloudflared/config.yml run',
+        '    volumes:',
+        '      - ./cloudflared.yml:/etc/cloudflared/config.yml:ro',
+        '      - ./tunnel-credentials.json:/etc/cloudflared/credentials.json:ro',
+        '    depends_on: [caddy]',
+        '',
+    ];
+}
+function renderEdgeTunnelUpScript(hostname) {
+    return [
+        '#!/usr/bin/env bash',
+        '# T0.5b — Cloudflare Tunnel + Google SSO (no Access seats). Run from pack root.',
+        'set -euo pipefail',
+        'cd "$(dirname "$0")"',
+        'docker compose --profile edge --profile tunnel up -d --build',
+        'echo "Public URL: https://' + hostname + ' (after DNS + tunnel route configured)"',
+        '',
+    ].join('\n');
+}
+function vmArtifacts(ctx) {
+    const hostname = ctx.publicHostname;
+    const run = [
+        '#!/usr/bin/env bash',
+        '# T0.5a — VPN + localhost only (no SSO edge). Binds 127.0.0.1 so LAN cannot bypass the proxy.',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        `IMAGE="${ctx.packName}:local"`,
+        'docker build -f deploy/Dockerfile -t "$IMAGE" .',
+        'docker rm -f agenthippo-agent 2>/dev/null || true',
+        'docker run -d --name agenthippo-agent --restart unless-stopped \\',
+        '  --env-file deploy/.env \\',
+        `  -v agenthippo-state:/state -p 127.0.0.1:${ctx.port}:${ctx.port} "$IMAGE"`,
+        `echo "agent on 127.0.0.1:${ctx.port} — health: curl localhost:${ctx.port}/health"`,
+        '',
+    ].join('\n');
+    const service = [
+        '# systemd user unit — survives logout (run: loginctl enable-linger $USER).',
+        '# VPN path:  cp deploy/agenthippo.service ~/.config/systemd/user/',
+        '# SSO path:  use agenthippo-edge.service (compose --profile edge)',
+        '# install: systemctl --user enable --now agenthippo',
+        '[Unit]',
+        'Description=AgentHippo agent (serve)',
+        'After=network-online.target docker.service',
+        '',
+        '[Service]',
+        `WorkingDirectory=%h/${ctx.packName}`,
+        'ExecStart=/usr/bin/env bash deploy/run.sh',
+        'Restart=always',
+        'RestartSec=5',
+        '',
+        '[Install]',
+        'WantedBy=default.target',
+        '',
+    ].join('\n');
+    const edgeService = [
+        '# systemd user unit — Cloudflare Tunnel + Google SSO + agent.',
+        '# install: cp deploy/agenthippo-edge.service ~/.config/systemd/user/',
+        '#          loginctl enable-linger $USER && systemctl --user enable --now agenthippo-edge',
+        '[Unit]',
+        'Description=AgentHippo agent (Tunnel + Google SSO)',
+        'After=network-online.target docker.service',
+        '',
+        '[Service]',
+        `WorkingDirectory=%h/${ctx.packName}/deploy`,
+        'ExecStart=/usr/bin/env docker compose -f docker-compose.yml --profile edge --profile tunnel up --build',
+        'ExecStop=/usr/bin/env docker compose -f docker-compose.yml --profile edge --profile tunnel down',
+        'Restart=always',
+        'RestartSec=5',
+        '',
+        '[Install]',
+        'WantedBy=default.target',
+        '',
+    ].join('\n');
+    const vmCompose = [
+        '# T0.5 workbench/VM. Paths:',
+        '#   T0.5a VPN:     bash deploy/run.sh',
+        '#   T0.5b remote:  bash deploy/run-edge-tunnel.sh  (Tunnel + Google SSO — recommended WFH)',
+        '#   edge only:     docker compose --profile edge up -d  (SSO on :443, no tunnel)',
+        'services:',
+        ...renderAgentComposeService(ctx),
+        ...renderEdgeComposeServices(),
+        ...renderTunnelComposeServices(),
+        'volumes:',
+        '  agenthippo-state:',
+        '  auth-broker-data:',
+        '',
+    ].join('\n');
+    return {
+        'Dockerfile': sharedDockerfile(ctx),
+        'Dockerfile.auth-broker': renderAuthBrokerDockerfile(),
+        'docker-compose.yml': vmCompose,
+        'run.sh': run,
+        'run-edge-tunnel.sh': renderEdgeTunnelUpScript(hostname),
+        'agenthippo.service': service,
+        'agenthippo-edge.service': edgeService,
+        'Caddyfile': renderCaddyfile(ctx),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'cloudflared.yml': renderCloudflaredYml(hostname),
+        'README.md': [
+            `# Deploy: ${ctx.packName} — T0.5 workbench/VM`,
+            '',
+            '`cp deploy/.env.example deploy/.env` and fill in, then pick a path:',
+            '',
+            '**T0.5a — VPN only (simplest internal pilot)**',
+            '```bash',
+            'bash deploy/run.sh',
+            '# curl http://127.0.0.1:' + ctx.port + '/v1/chat -d \'{"message":"hi"}\' ...',
+            '```',
+            '',
+            '**T0.5b — Cloudflare Tunnel + Google SSO (recommended for WFH, no Access seats)**',
+            '```bash',
+            'agenthippo deploy init . --target vm --force   # from pack root; review deploy/',
+            'cp deploy/.env.example deploy/.env            # agent: model key + public hostname',
+            'cp deploy/.env.auth.example deploy/.env.auth  # broker/oauth2-proxy: JWT + OAuth secrets (never loaded by the agent)',
+            '# 1. Google Cloud → OAuth Web client for https://' + hostname,
+            '#    Authorized origin + redirect: https://' + hostname + '/oauth2/callback',
+            '# 2. cloudflared tunnel create <name>',
+            '#    cp ~/.cloudflared/<tunnel-id>.json deploy/tunnel-credentials.json  # gitignore; secret',
+            '#    set tunnel: <tunnel-id> in deploy/cloudflared.yml',
+            '#    cloudflared tunnel route dns <name> ' + hostname,
+            '# 3. Fill deploy/.env (hostname, model key) and deploy/.env.auth (OAUTH2_PROXY_*, AGENTHIPPO_AUTH_JWT_SECRET)',
+            'cd deploy && docker compose --profile edge --profile tunnel up -d --build',
+            '# or from pack root: bash deploy/run-edge-tunnel.sh',
+            '# Users open https://' + hostname + ' → Google login → static chat UI → /v1/chat',
+            '```',
+            'Tunnel routing is **config-file mode** (`deploy/cloudflared.yml` → `http://caddy:80` on the compose network), not the Cloudflare dashboard public-hostname UI alone.',
+            'Optional: `agenthippo-edge.service` + `loginctl enable-linger $USER` for persistence.',
+            '',
+            '**Edge only (no tunnel)** — `docker compose --profile edge up -d` on LAN/VPN.',
+            '',
+            'Identity: Google → oauth2-proxy → `X-Agent-User` → serve (`www/index.html` sends a per-tab `session_id` for multi-turn).',
+            'Per-user *data* scoping needs Design B (§11.1) in the app layer — generic `serve` alone does not filter warehouse rows.',
+            '',
+            '**Do not commit** `deploy/.env`, `deploy/.env.auth`, or `deploy/tunnel-credentials.json`.',
+            '',
+        ].join('\n'),
+    };
+}
+/** Compose-tuned OTEL collector config: same pipeline as the canonical Spotlight
+ * collector, but bound to 0.0.0.0 so a sibling container (litellm) can reach it,
+ * and writing JSONL to the shared traces volume DuckDB/query-analytics.sh read. */
+const OTEL_COLLECTOR_COMPOSE_YAML = [
+    '# Spotlight OTEL collector (compose-tuned: 0.0.0.0 bind). Writes JSONL to',
+    '# ${AGENT_HOME_DIR}/analytics/traces/ — query with query-analytics.sh (DuckDB).',
+    'receivers:',
+    '  otlp:',
+    '    protocols:',
+    '      http: { endpoint: 0.0.0.0:4318 }',
+    '      grpc: { endpoint: 0.0.0.0:4317 }',
+    'processors:',
+    '  batch: { timeout: 500ms, send_batch_size: 10 }',
+    '  resource:',
+    '    attributes:',
+    '      - { key: service.name, value: agentide-litellm, action: upsert }',
+    'exporters:',
+    '  file/jsonl:',
+    '    path: ${AGENT_HOME_DIR}/analytics/traces/traces.jsonl',
+    '    rotation: { max_megabytes: 100, max_days: 30, max_backups: 10 }',
+    'service:',
+    '  pipelines:',
+    '    traces: { receivers: [otlp], processors: [batch, resource], exporters: [file/jsonl] }',
+    '',
+].join('\n');
+function composeArtifacts(ctx) {
+    const channels = ctx.gatewayChannels?.trim();
+    const hostname = ctx.publicHostname;
+    // Agent Anywhere: override the agent command to also run the gateway bridge,
+    // and add the OpenClaw gateway service (channels profile).
+    const agentGateway = channels
+        ? [
+            '    command:',
+            `      ["serve","--agent","/app/pack","--workspace","/state/workspace",`,
+            `       "--state-dir","/state","--port","${ctx.port}",`,
+            `       "--gateway-bridge","--bind","${channels}"]`,
+        ]
+        : [];
+    const channelsService = channels
+        ? [
+            '',
+            '  # Agent Anywhere gateway (OpenClaw) — Slack/Telegram bridge.',
+            '  # Build: docker build -f extensions/agentide/scripts/Dockerfile.gateway -t this-tag .',
+            '  # NOTE: the gateway runs in secured auth mode — the agent bridge needs',
+            '  # OPENCLAW_GATEWAY_TOKEN (or a paired device) to connect. Set it in .env.',
+            '  openclaw-gateway:',
+            '    profiles: ["channels"]',
+            '    image: ghcr.io/agenthippo/openclaw-gateway:2026.06',
+            '    env_file:',
+            '      - path: .env',
+            '        required: false',
+            '    volumes: ["openclaw-config:/root/.openclaw"]',
+            '    expose: ["18789"]',
+        ]
+        : [];
+    const agentExtra = [
+        '    environment:',
+        '      # Routed through LiteLLM only when the gateway profile is up; harmless otherwise.',
+        '      AGENTHIPPO_LITELLM_BASE_URL: http://litellm:4443',
+        ...(channels ? ['      OPENCLAW_GATEWAY_URL: ws://openclaw-gateway:18789'] : []),
+        ...agentGateway,
+    ];
+    const compose = [
+        '# T2 team/fleet stack (serve-v3 §8). Profiles:',
+        '#   default              = agent only (Docker network; no host port — use deploy/run.sh for T0.5a VPN)',
+        '#   --profile edge       = + Caddy + oauth2-proxy (Google SSO)',
+        '#   --profile tunnel     = + cloudflared (with edge; route hostname → http://caddy:80)',
+        '#   --profile gateway    = + LiteLLM + Spotlight OTEL collector',
+        '#   --profile channels   = + OpenClaw gateway (Agent Anywhere)',
+        '# e.g.: docker compose -f deploy/docker-compose.yml --profile edge --profile tunnel up -d',
+        'services:',
+        ...renderAgentComposeService(ctx, agentExtra),
+        ...renderEdgeComposeServices(),
+        ...renderTunnelComposeServices(),
+        '  # LiteLLM gateway — self-contained image bakes the Spotlight config + OTEL hooks',
+        '  # (build: docker build -f extensions/agentide/scripts/Dockerfile.litellm -t this-tag .)',
+        '  litellm:',
+        '    profiles: ["gateway"]',
+        '    image: ghcr.io/agenthippo/litellm-gateway:2026.06',
+        '    env_file:',
+        '      - path: .env',
+        '        required: false',
+        '    environment:',
+        '      OTEL_EXPORTER: otlp_http',
+        '      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318',
+        '    expose: ["4443"]',
+        '    depends_on: [otel-collector]',
+        '',
+        '  # Spotlight collector → JSONL traces volume (query with query-analytics.sh / DuckDB).',
+        '  otel-collector:',
+        '    profiles: ["gateway"]',
+        '    image: otel/opentelemetry-collector-contrib:0.118.0',
+        '    command: ["--config=/etc/otel-collector.yaml"]',
+        '    # Root so the collector can create /data/analytics on a fresh named volume',
+        '    # (the contrib image runs non-root; the volume root is root-owned).',
+        '    user: "0:0"',
+        '    environment: { AGENT_HOME_DIR: /data }',
+        '    volumes:',
+        '      - ./otel-collector.yaml:/etc/otel-collector.yaml:ro',
+        '      - spotlight-traces:/data',
+        ...channelsService,
+        '',
+        'volumes:',
+        '  agenthippo-state:',
+        '  auth-broker-data:',
+        '  spotlight-traces:',
+        ...(channels ? ['  openclaw-config:'] : []),
+        '',
+    ].join('\n');
+    return {
+        'Dockerfile': sharedDockerfile(ctx),
+        'Dockerfile.auth-broker': renderAuthBrokerDockerfile(),
+        'docker-compose.yml': compose,
+        'Caddyfile': renderCaddyfile(ctx),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'cloudflared.yml': renderCloudflaredYml(hostname),
+        'run-edge-tunnel.sh': renderEdgeTunnelUpScript(hostname),
+        'otel-collector.yaml': OTEL_COLLECTOR_COMPOSE_YAML,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — T2 team/fleet`,
+            '',
+            '- Agent only (VPN): `docker compose -f deploy/docker-compose.yml up -d`',
+            '- + Tunnel + Google SSO: `bash deploy/run-edge-tunnel.sh` (see vm README T0.5b).',
+            '- + LiteLLM gateway + Spotlight: `--profile gateway`.',
+            '- + Agent Anywhere: `--profile channels` + gateway env vars in `.env`.',
+            '',
+            'Profiles compose: e.g. `--profile gateway --profile edge --profile tunnel up -d`.',
+            'LiteLLM must speak Anthropic API format — our gateway image does.',
+            '',
+        ].join('\n'),
+    };
+}
+/**
+ * Cloud Run multi-container (sidecars) service — agent + LiteLLM + Spotlight OTEL collector,
+ * the Cloud Run analogue of the compose `--profile gateway` stack. Sidecars share the pod's
+ * localhost, so the agent routes to LiteLLM on 127.0.0.1:4443 and LiteLLM exports OTLP to the
+ * collector on 127.0.0.1:4318; the collector writes JSONL to the GCS-backed /state volume
+ * (query with query-analytics.sh / DuckDB). Deployed via `gcloud run services replace`.
+ *
+ * Placeholders (${SERVICE} ${IMAGE} ${STATE_BUCKET} ${LITELLM_IMAGE}) are substituted by the
+ * deploy script — kept as a checked-in template so the wiring is reviewable in git.
+ */
+/**
+ * The env var the LiteLLM gateway reads for a model's provider key — must match the
+ * `os.environ/<NAME>` reference in the gateway's model map (e.g. gpt-5.5 → OPENAI_API_KEY).
+ */
+function litellmProviderKeyEnv(model) {
+    const m = (model || '').toLowerCase();
+    if (m.includes('codex')) {
+        return 'OPENAI_CODEX_API_KEY';
+    }
+    if (m.includes('gpt') || m.includes('openai')) {
+        return 'OPENAI_API_KEY';
+    }
+    if (m.includes('claude') || m.includes('anthropic')) {
+        return 'ANTHROPIC_API_KEY';
+    }
+    return 'OPENAI_API_KEY';
+}
+function renderCloudrunServiceYaml(ctx) {
+    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
+    return [
+        '# Cloud Run multi-container: agent (ingress) + LiteLLM + Spotlight OTEL collector.',
+        '# Generated by `agenthippo deploy init`. Deploy with `bash deploy/cloudrun-deploy.sh`',
+        '# (it substitutes ${...} and runs `gcloud run services replace`). Traces land in the GCS',
+        '# /state volume at /state/analytics/traces — query with query-analytics.sh (DuckDB).',
+        'apiVersion: serving.knative.dev/v1',
+        'kind: Service',
+        'metadata:',
+        '  name: ${SERVICE}',
+        'spec:',
+        '  template:',
+        '    metadata:',
+        '      annotations:',
+        '        # Sidecars need CPU between requests (the collector flushes async); no scale-to-zero throttle.',
+        '        run.googleapis.com/cpu-throttling: "false"',
+        '        run.googleapis.com/startup-cpu-boost: "true"',
+        '        # Start order: collector → litellm → agent, so traces are never dropped on cold start.',
+        "        run.googleapis.com/container-dependencies: '{\"litellm\":[\"otel-collector\"],\"agent\":[\"litellm\"]}'",
+        '        autoscaling.knative.dev/maxScale: "1"',
+        // An inbound channel socket can't scale to zero — pin one always-on instance.
+        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
+        '    spec:',
+        '      timeoutSeconds: 3600',
+        '      containers:',
+        '        # Ingress container — the ONLY one with a port. Routes the engine through LiteLLM.',
+        '        - name: agent',
+        '          image: ${IMAGE}',
+        '          ports:',
+        '            - name: http1',
+        `              containerPort: ${ctx.port}`,
+        '          env:',
+        '            - { name: AGENTHIPPO_HOME, value: /state }',
+        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
+        agentServeHostEnvYaml(),
+        '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
+        '            - name: AGENTHIPPO_LITELLM_API_KEY',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
+        '          volumeMounts:',
+        '            - { name: state, mountPath: /state }',
+        '        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight cost/latency/tokens).',
+        '        - name: litellm',
+        '          image: ${LITELLM_IMAGE}',
+        '          env:',
+        '            - { name: OTEL_EXPORTER, value: otlp_http }',
+        '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }',
+        '            - name: LITELLM_MASTER_KEY',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
+        `            # Upstream provider key for ${ctx.model || 'this model'} (matches the gateway's os.environ/${providerKeyEnv} ref).`,
+        '            # Other models need their own key var — rename to match your model map.',
+        `            - name: ${providerKeyEnv}`,
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
+        '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.',
+        '        - name: otel-collector',
+        '          image: otel/opentelemetry-collector-contrib:0.118.0',
+        '          args: ["--config=/etc/otel/config.yaml"]',
+        '          env:',
+        '            - { name: AGENT_HOME_DIR, value: /state }',
+        '          volumeMounts:',
+        '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }',
+        '            - { name: state, mountPath: /state }',
+        '      volumes:',
+        '        - name: state',
+        '          csi:',
+        '            driver: gcsfuse.run.googleapis.com',
+        '            volumeAttributes:',
+        '              bucketName: ${STATE_BUCKET}',
+        '        - name: otel-config',
+        '          secret:',
+        '            secretName: ${SERVICE}-otel-config',
+        '            items:',
+        '              - { key: latest, path: config.yaml }',
+        '',
+    ].join('\n');
+}
+/** Anchor a generated deploy script to the staging root (parent of `deploy/`). The script
+ * lives at <staging>/deploy/<script>.sh; `docker build -f deploy/Dockerfile .` and the
+ * `deploy/service.yaml` / `deploy/.env` relative paths must resolve against the staging
+ * root, so the script works no matter which cwd it is invoked from. (compose-based scripts
+ * don't need this — `build: context: ..` in docker-compose.yml resolves relative to the
+ * compose file itself.) */
+function anchorToStagingRoot() {
+    return [
+        '# Anchor to the staging root (parent of deploy/) — this script runs from any cwd.',
+        'cd "$(dirname "$0")/.."',
+    ];
+}
+/** IAP finalization (corp SSO). `--iap` is beta-track only on `gcloud run`, and public
+ * access on an existing service is controlled via the run.invoker IAM binding (there
+ * is no `--no-allow-unauthenticated` flag on `services update`). So: enable IAP on the
+ * beta track, strip any allUsers invoker binding (keeps the service private), and grant
+ * IAP-secured Web User to each principal in IAP_MEMBERS (space-separated). Used by both
+ * the Spotlight deploy (`services replace`) and the T1-generic deploy (`run deploy`). */
+function iapFinalizeLines() {
+    return [
+        '# Ingress: corp SSO via IAP (forwards X-Goog-Authenticated-User-Email → user_id).',
+        '# --iap is beta-track only on `gcloud run`; public access on an existing service is',
+        '# controlled via the run.invoker IAM binding (no --no-allow-unauthenticated on',
+        '# `services update`). So: enable IAP on the beta track, strip any allUsers invoker',
+        '# binding (keeps the service private), and grant IAP-secured Web User to each',
+        '# principal in IAP_MEMBERS (space-separated, e.g.',
+        "#   IAP_MEMBERS='user:you@corp.com serviceAccount:sa@project.iam.gserviceaccount.com'",
+        '# ). Omit IAP_MEMBERS to rely on bindings you manage out-of-band.',
+        'if [[ "${ENABLE_IAP:-1}" == "1" ]]; then',
+        '  gcloud beta run services update "$SERVICE" --region "$REGION" --iap',
+        '  gcloud run services remove-iam-policy-binding "$SERVICE" --region "$REGION" \\',
+        '    --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true',
+        '  for m in ${IAP_MEMBERS:-}; do',
+        '    gcloud beta iap web add-iam-policy-binding \\',
+        '      --resource-type=cloud-run --service="$SERVICE" --region="$REGION" \\',
+        '      --member="$m" --role=roles/iap.httpsResourceAccessor',
+        '  done',
+        'fi',
+    ];
+}
+/** Deploy script for the Cloud Run Spotlight (multi-container) stack. */
+function renderCloudrunSpotlightDeploy(ctx) {
+    return [
+        '#!/usr/bin/env bash',
+        `# Cloud Run + Spotlight: agent + LiteLLM + OTEL collector sidecars (engine: ${ctx.engine}${ctx.model ? `, model ${ctx.model}` : ''}).`,
+        '# Traces persist in the GCS /state bucket; query with query-analytics.sh (DuckDB).',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        `SERVICE="${ctx.packName}"`,
+        'REGION="${REGION:-us-central1}"',
+        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
+        'REPO="${ARTIFACT_REPO:-agenthippo}"',
+        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
+        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippo/litellm-gateway:2026.06}"',
+        'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
+        '# LITELLM_KEY = the proxy key the agent presents to LiteLLM (and LiteLLM master key).',
+        'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
+        `# PROVIDER_KEY = upstream key the gateway uses for ${ctx.model || 'your model'} (gateway reads ${litellmProviderKeyEnv(ctx.model)}).`,
+        'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<upstream provider key>}"',
+        '',
+        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
+        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
+        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
+        '',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
+        'DF_TMP="$(mktemp)"',
+        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
+        'docker push "$IMAGE"',
+        '',
+        '# Secrets: Spotlight collector config + the LiteLLM proxy key.',
+        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
+        'ensure_secret "${SERVICE}-otel-config"; gcloud secrets versions add "${SERVICE}-otel-config" --data-file=deploy/otel-collector.yaml',
+        'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-',
+        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
+        '',
+        '# Render the multi-container template for this project (sed — no gettext dependency) and deploy.',
+        'RENDERED="$(mktemp)"',
+        'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\',
+        '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" -e "s|\\${STATE_BUCKET}|${STATE_BUCKET}|g" \\',
+        '    deploy/service.yaml > "$RENDERED"',
+        'gcloud run services replace "$RENDERED" --region "$REGION"',
+        '',
+        ...iapFinalizeLines(),
+        '',
+        '# Grant the runtime SA access to the secrets if needed:',
+        '#   SA="$(gcloud run services describe "$SERVICE" --region "$REGION" --format=\'value(spec.template.spec.serviceAccountName)\')"',
+        '#   for s in "${SERVICE}-otel-config" "${SERVICE}-litellm-key"; do gcloud secrets add-iam-policy-binding "$s" --member="serviceAccount:$SA" --role=roles/secretmanager.secretAccessor; done',
+        '',
+    ].join('\n');
+}
+/**
+ * Option B — AgentHippo edge on Cloud Run. Caddy is the ingress (the only container with a
+ * port) and fronts the agent with the SAME SSO flow the IDE already uses for `remote-vm`:
+ *   - Browser  → oauth2-proxy (Google SSO) → X-Agent-User → agent
+ *   - IDE/API  → auth-broker validates the AgentHippo Bearer JWT → X-Agent-User → agent
+ * No IAP, so the IDE points `spec.remote.url` straight at the public hostname and the existing
+ * `ensureSignedIn` + `buildServeAuthHeaders` path works unchanged.
+ *
+ * Cloud Run multi-container shares the pod's network namespace, so every sidecar is reached
+ * via `localhost:<port>` (NOT docker-DNS names like the compose edge). Cloud Run terminates TLS
+ * at the edge, so Caddy listens on HTTP `:{$PORT}` (`auto_https off`). The agent is NOT the
+ * ingress here, so it listens on a distinct internal port (EDGE_AGENT_PORT) to avoid clashing
+ * with Caddy on $PORT.
+ */
+const EDGE_AGENT_PORT = 8090;
+/** Caddyfile for the Cloud Run edge — HTTP on $PORT (Cloud Run terminates TLS), localhost upstreams. */
+function renderCloudrunEdgeCaddyfile() {
+    return [
+        '# Cloud Run edge ingress. Cloud Run terminates TLS; Caddy listens on HTTP :{$PORT}.',
+        '# Sidecars share the pod\'s localhost → upstreams are 127.0.0.1:<port> (not docker-DNS names).',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        ':{$PORT} {',
+        '  # Auth-broker: IDE sign-in callback + JWT validation endpoint.',
+        '  handle /oauth/* {',
+        '    reverse_proxy localhost:9780 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  handle /api/ide/* {',
+        '    reverse_proxy localhost:9780 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  # oauth2-proxy: Google SSO callback + sign-in.',
+        '  handle /oauth2/* {',
+        '    reverse_proxy localhost:4180 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  @health path /health /ready',
+        '  handle @health {',
+        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
+        '  }',
+        '  # IDE / API clients with a Bearer token: validate via auth-broker, copy identity header.',
+        '  @apiWithAuth {',
+        '    path /v1/*',
+        '    header Authorization *',
+        '  }',
+        '  handle @apiWithAuth {',
+        '    forward_auth localhost:9780 {',
+        '      uri /api/ide/me',
+        '      copy_headers X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        respond "Unauthorized" 401',
+        '      }',
+        '    }',
+        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
+        '  }',
+        '  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User, then proxy',
+        '  # to the agent (which serves the www landing page at / and the API at /v1/*).',
+        '  handle {',
+        '    forward_auth localhost:4180 {',
+        '      uri /oauth2/auth',
+        '      copy_headers X-Auth-Request-Email>X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        redir * "/oauth2/sign_in?rd={http.request.uri.path}{http.request.uri.query}"',
+        '      }',
+        '    }',
+        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
+        '  }',
+        '}',
+        '',
+    ].join('\n');
+}
+/** Cloud Run multi-container service behind the AgentHippo edge (Option B). Caddy is ingress. */
+function renderCloudrunEdgeServiceYaml(ctx) {
+    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
+    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
+    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: EDGE_AGENT_PORT })
+        .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
+    // Start order: sidecars before caddy (ingress) so Caddy's first request finds everyone up.
+    const deps = isCursor
+        ? '{"caddy":["agent","oauth2-proxy","auth-broker"]}'
+        : '{"caddy":["agent","oauth2-proxy","auth-broker"],"agent":["litellm"],"litellm":["otel-collector"]}';
+    const lines = [
+        '# Cloud Run + AgentHippo edge (Option B): Caddy (ingress) + oauth2-proxy + auth-broker',
+        '# + agent (+ LiteLLM + OTEL collector for Spotlight). No IAP — Caddy gates via SSO,',
+        '# so the IDE hits the public hostname directly with its AgentHippo Bearer token.',
+        '# Generated by `agenthippo deploy init --target cloudrun --ingress edge`.',
+        'apiVersion: serving.knative.dev/v1',
+        'kind: Service',
+        'metadata:',
+        '  name: ${SERVICE}',
+        'spec:',
+        '  template:',
+        '    metadata:',
+        '      annotations:',
+        '        run.googleapis.com/cpu-throttling: "false"',
+        '        run.googleapis.com/startup-cpu-boost: "true"',
+        `        run.googleapis.com/container-dependencies: '${deps}'`,
+        '        autoscaling.knative.dev/maxScale: "1"',
+        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
+        '    spec:',
+        '      timeoutSeconds: 3600',
+        '      containers:',
+        '        # Ingress — the ONLY container with a port. SSO edge for browsers + IDE Bearer.',
+        '        - name: caddy',
+        '          image: caddy:2.8-alpine',
+        '          ports:',
+        '            - name: http1',
+        `              containerPort: ${ctx.port}`,
+        '          volumeMounts:',
+        '            - { name: caddy-config, mountPath: /etc/caddy, readOnly: true }',
+        '        # Auth broker — validates IDE Bearer JWTs (/api/ide/me) + IDE sign-in (/oauth/*).',
+        '        # Reuses the agent runtime image (the `agenthippo` CLI ships `auth-broker`).',
+        '        - name: auth-broker',
+        '          image: ${IMAGE}',
+        '          args: ["auth-broker"]',
+        '          env:',
+        '            - { name: AGENTHIPPO_AUTH_PORT, value: "9780" }',
+        '            - { name: AGENTHIPPO_AUTH_DATA_DIR, value: /data }',
+        '            - { name: AGENTHIPPO_AUTH_PUBLIC_URL, value: https://${PUBLIC_HOSTNAME} }',
+        '            - { name: AGENTHIPPO_AUTH_ALLOWED_DOMAINS, value: ${ALLOWED_DOMAINS} }',
+        '            - name: AGENTHIPPO_AUTH_JWT_SECRET',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-auth-jwt-secret, key: latest }',
+        '        # oauth2-proxy — Google SSO for browser clients (provider=google).',
+        '        - name: oauth2-proxy',
+        '          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
+        '          env:',
+        '            - { name: OAUTH2_PROXY_HTTP_ADDRESS, value: 0.0.0.0:4180 }',
+        '            - { name: OAUTH2_PROXY_UPSTREAMS, value: file:///dev/null }',
+        '            - { name: OAUTH2_PROXY_SET_XAUTHREQUEST, value: "true" }',
+        '            - { name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER, value: "true" }',
+        '            - { name: OAUTH2_PROXY_SKIP_PROVIDER_BUTTON, value: "true" }',
+        '            - { name: OAUTH2_PROXY_REVERSE_PROXY, value: "true" }',
+        '            - { name: OAUTH2_PROXY_PROVIDER, value: google }',
+        '            - { name: OAUTH2_PROXY_EMAIL_DOMAINS, value: ${ALLOWED_DOMAINS} }',
+        '            - { name: OAUTH2_PROXY_REDIRECT_URL, value: https://${PUBLIC_HOSTNAME}/oauth2/callback }',
+        '            - name: OAUTH2_PROXY_CLIENT_ID',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-oauth-client-id, key: latest }',
+        '            - name: OAUTH2_PROXY_CLIENT_SECRET',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-oauth-client-secret, key: latest }',
+        '            - name: OAUTH2_PROXY_COOKIE_SECRET',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-oauth-cookie-secret, key: latest }',
+        '        # Agent — serves www + /v1/* on localhost (NOT ingress). Routed through LiteLLM.',
+        '        - name: agent',
+        '          image: ${IMAGE}',
+        `          args: [${agentArgs}]`,
+        '          env:',
+        '            - { name: AGENTHIPPO_HOME, value: /state }',
+        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
+        agentServeHostEnvYaml(),
+        ...(isCursor ? [
+            '            - { name: AGENTHIPPO_CUSTOM_ENGINES_DIR, value: /engines }',
+            '            - name: CURSOR_API_KEY',
+            '              valueFrom:',
+            '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
+        ] : [
+            '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
+            '            - name: AGENTHIPPO_LITELLM_API_KEY',
+            '              valueFrom:',
+            '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
+        ]),
+        '          volumeMounts:',
+        '            - { name: state, mountPath: /state }',
+        ...startupProbeLines(EDGE_AGENT_PORT, true),
+        ...resourceLimits('2000m', '2Gi'),
+    ];
+    if (!isCursor) {
+        lines.push('        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight).', '        - name: litellm', '          image: ${LITELLM_IMAGE}', '          env:', '            - { name: OTEL_EXPORTER, value: otlp_http }', '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }', '            - name: LITELLM_MASTER_KEY', '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }', `            # Upstream provider key for ${ctx.model || 'this model'} (matches the gateway's os.environ/${providerKeyEnv} ref).`, `            - name: ${providerKeyEnv}`, '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }', ...startupProbeLines(4443), ...resourceLimits('1000m', '1Gi'), '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.', '        - name: otel-collector', '          image: otel/opentelemetry-collector-contrib:0.118.0', '          args: ["--config=/etc/otel/config.yaml"]', '          env:', '            - { name: AGENT_HOME_DIR, value: /state }', '          volumeMounts:', '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }', '            - { name: state, mountPath: /state }', ...startupProbeLines(4318), ...resourceLimits('1000m', '512Mi'));
+    }
+    lines.push('      volumes:', '        - name: state', '          csi:', '            driver: gcsfuse.run.googleapis.com', '            volumeAttributes:', '              bucketName: ${STATE_BUCKET}', '        - name: caddy-config', '          secret:', '            secretName: ${SERVICE}-caddyfile', '            items:', '              - { key: latest, path: Caddyfile }');
+    if (!isCursor) {
+        lines.push('        - name: otel-config', '          secret:', '            secretName: ${SERVICE}-otel-config', '            items:', '              - { key: latest, path: config.yaml }');
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+/** Deploy script for the Cloud Run edge (Option B): build, upsert secrets, replace, make public. */
+function renderCloudrunEdgeDeploy(ctx) {
+    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
+    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
+    const lines = [
+        '#!/usr/bin/env bash',
+        `# Cloud Run + AgentHippo edge (Option B): Caddy + oauth2-proxy + auth-broker front the agent.`,
+        `# Engine: ${ctx.engine}${modelNote}. No IAP — Caddy gates via SSO (Google for browsers, AgentHippo JWT for IDE).`,
+        '# The IDE points spec.remote.url straight at https://$PUBLIC_HOSTNAME (same flow as remote-vm).',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        `SERVICE="${ctx.packName}"`,
+        'REGION="${REGION:-us-central1}"',
+        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
+        'REPO="${ARTIFACT_REPO:-agenthippo}"',
+        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
+        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippo/litellm-gateway:2026.06}"',
+        '# Public hostname (custom domain mapped to the service) + the Google Workspace domain allowed by SSO.',
+        'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=your.edge.hostname (gcloud run domain-mappings create --service $SERVICE --domain ...)}"',
+        'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:?set ALLOWED_DOMAINS=yourworkspace.com (oauth2-proxy email domain + broker allowed domains)}"',
+        'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
+        '# Edge secrets (from .env.auth): Google OAuth client + cookie secret + AgentHippo JWT signing key.',
+        'OAUTH_CLIENT_ID="${OAUTH_CLIENT_ID:?set OAUTH_CLIENT_ID=<google oauth web client id>}"',
+        'OAUTH_CLIENT_SECRET="${OAUTH_CLIENT_SECRET:?set OAUTH_CLIENT_SECRET=<google oauth web client secret>}"',
+        'OAUTH_COOKIE_SECRET="${OAUTH_COOKIE_SECRET:?set OAUTH_COOKIE_SECRET=$(openssl rand -base64 32 | head -c 32)}"',
+        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=$(openssl rand -hex 32)}"',
+        ...(isCursor ? [
+            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<cursor api key>}"',
+        ] : [
+            '# LiteLLM proxy key + the upstream provider key the gateway uses for the model.',
+            'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
+            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<upstream provider key>}"',
+        ]),
+        '',
+        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
+        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
+        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
+        '',
+        '# One agent image serves both the agent and the auth-broker containers (CLI ships `auth-broker`).',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
+        'DF_TMP="$(mktemp)"',
+        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
+        'docker push "$IMAGE"',
+        '',
+        '# Secrets: edge config + provider/litellm keys.',
+        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
+        'ensure_secret "${SERVICE}-caddyfile"; gcloud secrets versions add "${SERVICE}-caddyfile" --data-file=deploy/Caddyfile',
+        'ensure_secret "${SERVICE}-auth-jwt-secret"; printf %s "$AUTH_JWT_SECRET" | gcloud secrets versions add "${SERVICE}-auth-jwt-secret" --data-file=-',
+        'ensure_secret "${SERVICE}-oauth-client-id"; printf %s "$OAUTH_CLIENT_ID" | gcloud secrets versions add "${SERVICE}-oauth-client-id" --data-file=-',
+        'ensure_secret "${SERVICE}-oauth-client-secret"; printf %s "$OAUTH_CLIENT_SECRET" | gcloud secrets versions add "${SERVICE}-oauth-client-secret" --data-file=-',
+        'ensure_secret "${SERVICE}-oauth-cookie-secret"; printf %s "$OAUTH_COOKIE_SECRET" | gcloud secrets versions add "${SERVICE}-oauth-cookie-secret" --data-file=-',
+        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
+    ];
+    if (!isCursor) {
+        lines.push('ensure_secret "${SERVICE}-otel-config"; gcloud secrets versions add "${SERVICE}-otel-config" --data-file=deploy/otel-collector.yaml', 'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-');
+    }
+    lines.push('', '# Render the multi-container template for this project (sed — no gettext dependency) and deploy.', 'RENDERED="$(mktemp)"', 'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\', '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" -e "s|\\${STATE_BUCKET}|${STATE_BUCKET}|g" \\', '    -e "s|\\${PUBLIC_HOSTNAME}|${PUBLIC_HOSTNAME}|g" -e "s|\\${ALLOWED_DOMAINS}|${ALLOWED_DOMAINS}|g" \\', '    deploy/service.yaml > "$RENDERED"', 'gcloud run services replace "$RENDERED" --region "$REGION"', '', '# No IAP: Caddy is the gate, so Cloud Run itself must allow public ingress (allUsers invoker).', '# Without this, Cloud Run 403s before Caddy ever sees the request to run SSO.', 'gcloud run services add-iam-policy-binding "$SERVICE" --region "$REGION" \\', '  --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true', '', '# Map the custom domain (once): gcloud run domain-mappings create --service "$SERVICE" --region "$REGION" --domain "$PUBLIC_HOSTNAME"', '# Then add the CNAME Cloud Run prints to your DNS. Google OAuth Web client must list', '# https://$PUBLIC_HOSTNAME as an authorized origin + https://$PUBLIC_HOSTNAME/oauth2/callback as a redirect.', '', '# Grant the runtime SA access to the secrets if needed:', '#   SA="$(gcloud run services describe "$SERVICE" --region "$REGION" --format=\'value(spec.template.spec.serviceAccountName)\')"', '#   for s in "${SERVICE}-caddyfile" "${SERVICE}-auth-jwt-secret" "${SERVICE}-oauth-client-id" "${SERVICE}-oauth-client-secret" "${SERVICE}-oauth-cookie-secret" "${SERVICE}-provider-key"; do', '#     gcloud secrets add-iam-policy-binding "$s" --member="serviceAccount:$SA" --role=roles/secretmanager.secretAccessor', '#   done', '');
+    return lines.join('\n');
+}
+function cloudrunArtifacts(ctx) {
+    const inbound = Boolean(ctx.gatewayChannels?.trim()); // 1b: holds an always-listening channel socket
+    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
+    // Option B: AgentHippo edge on Cloud Run (Caddy + auth-broker + oauth2-proxy ingress).
+    // Same SSO flow the IDE already uses for remote-vm — point spec.remote.url at the public
+    // hostname and the existing ensureSignedIn + Bearer path works. No IAP, no IDE changes.
+    if (ctx.ingress === 'edge') {
+        return cloudrunEdgeArtifacts(ctx, inbound, isCursor);
+    }
+    // A′: federated edge — Caddy + auth-broker only (no oauth2-proxy). Google login stays at the
+    // central IdP; this agent verifies the shared .agenthippo.ai JWT. Scales to N agents with zero
+    // per-service OAuth client config. No IAP, no IDE changes.
+    if (ctx.ingress === 'edge-fed') {
+        return cloudrunFedArtifacts(ctx, inbound, isCursor);
+    }
+    // Model-routed engines (claude/codex) get the Spotlight multi-container stack: the agent
+    // calls a LiteLLM sidecar (so a `litellm/*` model resolves in-pod) and the OTEL collector
+    // lands cost/latency/token traces in the GCS /state volume. This also resolves the
+    // CLAUDE_CODE_USE_VERTEX-vs-LiteLLM contradiction — provider routing now lives on the gateway.
+    // Cursor talks to its own API (not through LiteLLM), so it keeps the lean single-container path.
+    if (!isCursor) {
+        return {
+            'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+            'www/index.html': renderLandingPage(ctx.packName),
+            'service.yaml': renderCloudrunServiceYaml(ctx),
+            'otel-collector.yaml': OTEL_COLLECTOR_COMPOSE_YAML,
+            'cloudrun-deploy.sh': renderCloudrunSpotlightDeploy(ctx),
+            'README.md': [
+                `# Deploy: ${ctx.packName} — Cloud Run + Spotlight (multi-container)`,
+                '',
+                `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
+                '',
+                'Three sidecars share the pod\'s localhost (Cloud Run multi-container):',
+                '- **agent** (ingress) → routes the engine to `http://localhost:4443`',
+                '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
+                '- **otel-collector** → writes JSONL traces to the GCS `/state` volume (`/state/analytics/traces`).',
+                '',
+                '```bash',
+                'gcloud storage buckets create gs://<your-state-bucket>   # once',
+                'export STATE_BUCKET=<your-state-bucket> LITELLM_KEY=<litellm proxy key>',
+                'bash deploy/cloudrun-deploy.sh   # builds linux/amd64, creates secrets, `gcloud run services replace service.yaml`',
+                '```',
+                '',
+                '`service.yaml` is the multi-container template (checked in so the wiring is reviewable);',
+                'the deploy script substitutes `${SERVICE} ${IMAGE} ${STATE_BUCKET} ${LITELLM_IMAGE}`.',
+                'Provider creds (Anthropic key / Vertex ADC / OpenAI …) go on the **litellm** sidecar, not the agent.',
+                '',
+                inbound
+                    ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
+                    : '**No inbound channel (1a):** scales to zero; traces + sessions persist on the GCS `/state` volume.',
+                '',
+                '**Spotlight:** once traffic flows, query the GCS-backed traces with `query-analytics.sh` (DuckDB) against `/state/analytics/traces`.',
+                '',
+                '**Lean alternative (no Spotlight):** a single-container deploy that calls a provider directly',
+                '(or an external LiteLLM) — set `AGENTHIPPO_LITELLM_BASE_URL` to your endpoint and drop the sidecars.',
+                '',
+            ].join('\n'),
+        };
+    }
+    // 1a (no inbound channel): scale-to-zero OK. 1b (inbound socket): pin a single,
+    // always-on instance with CPU always allocated so the socket survives.
+    const instanceFlags = inbound
+        ? '  --min-instances 1 --max-instances 1 --no-cpu-throttling \\'
+        : '  --min-instances 0 --max-instances 1 \\';
+    const runEnvVars = isCursor
+        ? 'AGENTHIPPO_NO_AUTO_INSTALL=1,AGENTHIPPO_HOME=/state,AGENTHIPPO_CUSTOM_ENGINES_DIR=/engines'
+        : 'CLAUDE_CODE_USE_VERTEX=1,AGENTHIPPO_NO_AUTO_INSTALL=1,AGENTHIPPO_HOME=/state';
+    const runSecrets = isCursor
+        ? 'CURSOR_API_KEY=agenthippo-cursor-key:latest'
+        : undefined;
+    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
+    const deploy = [
+        '#!/usr/bin/env bash',
+        `# T1-generic: Cloud Run with built-in IAP (corp SSO, no load balancer).`,
+        `# Engine: ${ctx.engine}${modelNote}. IAP forwards X-Goog-Authenticated-User-Email → user_id.`,
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        `SERVICE="${ctx.packName}"`,
+        'REGION="${REGION:-us-central1}"',
+        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
+        'REPO="${ARTIFACT_REPO:-agenthippo}"',
+        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
+        '# Q1: durable state. Cloud Run local disk is ephemeral (wiped on scale-to-zero),',
+        '# so mount a GCS bucket at /state — sessions/provider-sessions/analytics survive.',
+        'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
+        '',
+        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
+        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
+        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
+        '',
+        '# Build from pack root; Dockerfile is deploy/Dockerfile (not pack root — gcloud --source . misses it).',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
+        'DF_TMP="$(mktemp)"',
+        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
+        'docker push "$IMAGE"',
+        '',
+        '# Deploy private (no --allow-unauthenticated). IAP + role grants are applied below on the beta track.',
+        'gcloud run deploy "$SERVICE" \\',
+        '  --image "$IMAGE" \\',
+        '  --no-allow-unauthenticated \\',
+        `  --port ${ctx.port} \\`,
+        instanceFlags,
+        '  --timeout 3600 \\',
+        '  --add-volume name=state,type=cloud-storage,bucket="$STATE_BUCKET" \\',
+        '  --add-volume-mount volume=state,mount-path=/state \\',
+        `  --set-env-vars ${runEnvVars} \\`,
+        ...(runSecrets ? [`  --set-secrets ${runSecrets} \\`] : []),
+        '  --region "$REGION"',
+        '',
+        ...iapFinalizeLines(),
+        '',
+        '# Notes:',
+        inbound
+            ? '#  - INBOUND channel (1b): pinned min=max=1 + CPU-always-on so the socket stays alive (can\'t scale to zero).'
+            : '#  - No inbound channel (1a): scales to zero; state on the GCS volume survives the instance dying.',
+        '#  - GCS-FUSE adds latency on session read/write vs local disk; fine for chat, watch for heavy I/O.',
+        isCursor
+            ? '#  - Cursor engine: CURSOR_API_KEY secret + runtime:latest-cursor base (AGENTHIPPO_CUSTOM_ENGINES_DIR=/engines).'
+            : '#  - Vertex path = keyless Claude on your existing GCP entitlement; swap for ANTHROPIC_API_KEY if preferred.',
+        '#  - First deploy without IAP org setup: ENABLE_IAP=0 bash deploy/cloudrun-deploy.sh',
+        '',
+    ].join('\n');
+    const secretSteps = isCursor
+        ? [
+            '2. `gcloud secrets create agenthippo-cursor-key --data-file=-` (paste your `CURSOR_API_KEY`).',
+            '3. Grant Cloud Run access: `gcloud secrets add-iam-policy-binding agenthippo-cursor-key --member=serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com --role=roles/secretmanager.secretAccessor`.',
+            '4. `bash deploy/cloudrun-deploy.sh` — builds linux/amd64, pushes to Artifact Registry, deploys with GCS /state.',
+        ]
+        : [
+            '2. `bash deploy/cloudrun-deploy.sh` — builds linux/amd64, pushes to Artifact Registry, deploys with `--iap` + GCS /state.',
+        ];
+    return {
+        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'cloudrun-deploy.sh': deploy,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — Cloud Run (T1-generic)`,
+            '',
+            `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
+            '',
+            '1. `gcloud storage buckets create gs://<your-state-bucket>` then `export STATE_BUCKET=<your-state-bucket>`.',
+            ...secretSteps,
+            '',
+            'SSO + ingress: built-in IAP (`X-Goog-Authenticated-User-Email`). **Q1:** `/state` is a mounted GCS bucket.',
+            ctx.gatewayChannels ? '**Inbound channel (1b):** pinned single always-on instance (no scale-to-zero).' : '**No inbound channel (1a):** scales to zero; state persists on GCS.',
+            '',
+            '**Browser:** open the service URL → Google login → chat UI at `/` (same as vm `deploy/www/index.html`).',
+            '',
+            '**Verify** (smoke test via local proxy — bypasses IAP auth for direct testing):',
+            '```bash',
+            `gcloud run services proxy ${ctx.packName} --region "\${REGION:-us-central1}" &`,
+            'PROXY=http://127.0.0.1:8080',
+            'curl -s "$PROXY/ready"',
+            'curl -s -XPOST "$PROXY/v1/chat" \\',
+            '  -H "X-Goog-Authenticated-User-Email: accounts.google.com:you@corp.com" \\',
+            '  -H "Content-Type: application/json" \\',
+            '  -d \'{"message":"Reply with exactly: CLOUDRUN_OK","session_id":"cr-1"}\'',
+            '```',
+            '',
+        ].join('\n'),
+    };
+}
+/** Option B artifacts: Cloud Run behind the AgentHippo edge (Caddy + auth-broker + oauth2-proxy). */
+function cloudrunEdgeArtifacts(ctx, inbound, isCursor) {
+    const sidecars = isCursor
+        ? 'Caddy (ingress) + oauth2-proxy + auth-broker + agent.'
+        : 'Caddy (ingress) + oauth2-proxy + auth-broker + agent + LiteLLM + OTEL collector (Spotlight).';
+    const files = {
+        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'Caddyfile': renderCloudrunEdgeCaddyfile(),
+        'service.yaml': renderCloudrunEdgeServiceYaml(ctx),
+        'cloudrun-deploy.sh': renderCloudrunEdgeDeploy(ctx),
+    };
+    if (!isCursor) {
+        files['otel-collector.yaml'] = OTEL_COLLECTOR_COMPOSE_YAML;
+    }
+    files['README.md'] = [
+        `# Deploy: ${ctx.packName} — Cloud Run + AgentHippo edge (Option B)`,
+        '',
+        `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
+        '',
+        `${sidecars} Sidecars share the pod\'s localhost (Cloud Run multi-container):`,
+        '- **caddy** (ingress, the only port) → SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer',
+        `- **agent** → serves www + /v1/* on localhost:${EDGE_AGENT_PORT} (NOT ingress)`,
+        '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`) + IDE sign-in (`/oauth/*`)',
+        '- **oauth2-proxy** → Google SSO for browser clients (`provider=google`)',
+        ...(isCursor ? [] : [
+            '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
+            '- **otel-collector** → writes JSONL traces to the GCS `/state` volume',
+        ]),
+        '',
+        '**No IAP** — Caddy is the gate, so the IDE points `spec.remote.url` straight at',
+        '`https://$PUBLIC_HOSTNAME` and the existing AgentHippo SSO flow works (same as `remote-vm`).',
+        'Cloud Run itself is public (`allUsers` invoker) so traffic can reach Caddy to be authed.',
+        '',
+        '```bash',
+        'gcloud storage buckets create gs://<state-bucket>                 # once',
+        'cp deploy/.env.example deploy/.env && cp deploy/.env.auth.example deploy/.env.auth  # fill both',
+        'export PUBLIC_HOSTNAME=<your.edge.hostname> ALLOWED_DOMAINS=<yourworkspace.com>',
+        'export OAUTH_CLIENT_ID=… OAUTH_CLIENT_SECRET=… OAUTH_COOKIE_SECRET=… AUTH_JWT_SECRET=…',
+        ...(isCursor ? ['export PROVIDER_KEY=<cursor api key>'] : ['export LITELLM_KEY=… PROVIDER_KEY=… STATE_BUCKET=<state-bucket>']),
+        'bash deploy/cloudrun-deploy.sh    # builds linux/amd64, upserts secrets, `gcloud run services replace`',
+        'gcloud run domain-mappings create --service "$SERVICE" --region "${REGION:-us-central1}" --domain "$PUBLIC_HOSTNAME"  # once',
+        '```',
+        '',
+        'Google OAuth Web client (for oauth2-proxy): authorized origin `https://$PUBLIC_HOSTNAME`,',
+        'redirect `https://$PUBLIC_HOSTNAME/oauth2/callback`. Restrict to your Workspace domain via',
+        '`ALLOWED_DOMAINS` (oauth2-proxy `email_domains` + broker `allowed_domains`).',
+        '',
+        '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${LITELLM_IMAGE} ${STATE_BUCKET} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`)',
+        'are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).',
+        '',
+        inbound
+            ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
+            : '**No inbound channel (1a):** scales to zero; traces + sessions persist on the GCS `/state` volume.',
+        '',
+    ].join('\n');
+    return files;
+}
+/**
+ * A′ — Federated edge Caddyfile. No oauth2-proxy: Google login happens once at the central IdP
+ * (`ctx.idpUrl`); this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for
+ * browser). On a browser 401, redirect to the IdP's `/oauth/browser-login` to stamp the shared
+ * `.agenthippo.ai` cookie, then return.
+ */
+function renderCloudrunFedCaddyfile(ctx) {
+    const idp = (ctx.idpUrl || '').trim().replace(/\/+$/, '');
+    const loginRedirect = idp
+        ? `        redir * "${idp}/oauth/browser-login?return_to=https://{http.request.host}{http.request.uri}" 302`
+        : '        respond "Unauthorized" 401';
+    return [
+        '# Cloud Run federated edge (A′). Cloud Run terminates TLS; Caddy listens on HTTP :{$PORT}.',
+        `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
+        '# this agent only verifies the shared .agenthippo.ai AgentHippo JWT (Bearer for IDE, cookie for browser).',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        ':{$PORT} {',
+        '  # Auth-broker: IDE bootstrap API + JWT validation (/api/ide/me is also used by forward_auth).',
+        '  handle /api/ide/* {',
+        '    reverse_proxy localhost:9780 {',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '    }',
+        '  }',
+        '  @health path /health /ready',
+        '  handle @health {',
+        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
+        '  }',
+        '  # IDE / API clients with a Bearer token: validate via auth-broker, copy identity header.',
+        '  @apiWithAuth {',
+        '    path /v1/*',
+        '    header Authorization *',
+        '  }',
+        '  handle @apiWithAuth {',
+        '    forward_auth localhost:9780 {',
+        '      uri /api/ide/me',
+        '      copy_headers X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        respond "Unauthorized" 401',
+        '      }',
+        '    }',
+        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
+        '  }',
+        '  # Browser clients: the shared .agenthippo.ai cookie is verified by auth-broker. No cookie',
+        '  # → redirect to the central IdP to log in (it stamps the cookie), then return.',
+        '  handle {',
+        '    forward_auth localhost:9780 {',
+        '      uri /api/ide/me',
+        '      copy_headers X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        loginRedirect,
+        '      }',
+        '    }',
+        `    reverse_proxy localhost:${EDGE_AGENT_PORT}`,
+        '  }',
+        '}',
+        '',
+    ].join('\n');
+}
+/** Cloud Run requires a startupProbe on any container that is a `depends_on` target, so the
+ *  platform knows when the dependency is ready. `slow` = one generous 240s attempt (agent, which
+ *  may warm an engine); otherwise 30×5s polls (sidecars that start fast). */
+function startupProbeLines(port, slow = false) {
+    if (slow) {
+        // Slow starter (agent): check every 5s but tolerate up to 240s total. A single
+        // failureThreshold:1/periodSeconds:240 probe would only check ONCE at 240s, leaving
+        // the instance "no available instance" for the whole cold start and aborting requests.
+        return [
+            '          startupProbe:',
+            '            failureThreshold: 48',
+            '            periodSeconds: 5',
+            '            tcpSocket:',
+            `              port: ${port}`,
+            '            timeoutSeconds: 3',
+        ];
+    }
+    return [
+        '          startupProbe:',
+        '            failureThreshold: 30',
+        '            periodSeconds: 5',
+        '            tcpSocket:',
+        `              port: ${port}`,
+        '            timeoutSeconds: 3',
+    ];
+}
+/** Per-container CPU/memory limits. Cloud Run multi-container shares one instance whose total
+ *  memory = sum of container limits, so the streaming agent + Python LiteLLM need real headroom
+ *  (defaults of 256Mi each OOM-kill the instance mid-request → 503 "Service Unavailable"). */
+function resourceLimits(cpu, memory) {
+    return [
+        '          resources:',
+        '            limits:',
+        `              cpu: ${cpu}`,
+        `              memory: ${memory}`,
+    ];
+}
+/** A′ — Federated edge multi-container service. Caddy (ingress) + auth-broker + agent
+ *  (+ LiteLLM + OTEL for Spotlight). No oauth2-proxy container; in-memory emptyDir state. */
+function renderCloudrunFedServiceYaml(ctx) {
+    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
+    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
+    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: EDGE_AGENT_PORT })
+        .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
+    const cookieDomain = (ctx.cookieDomain || '.agenthippo.ai').trim();
+    const idpUrl = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
+    const deps = isCursor
+        ? '{"caddy":["agent","auth-broker"]}'
+        : '{"caddy":["agent","auth-broker"],"agent":["litellm"],"litellm":["otel-collector"]}';
+    const lines = [
+        '# Cloud Run + AgentHippo federated edge (A′): Caddy (ingress) + auth-broker + agent',
+        '# (+ LiteLLM + OTEL collector for Spotlight). No oauth2-proxy — Google login happens once',
+        '# at the central IdP; this agent verifies the shared .agenthippo.ai AgentHippo JWT.',
+        '# Generated by `agenthippo deploy init --target cloudrun --ingress edge-fed`.',
+        'apiVersion: serving.knative.dev/v1',
+        'kind: Service',
+        'metadata:',
+        '  name: ${SERVICE}',
+        'spec:',
+        '  template:',
+        '    metadata:',
+        '      annotations:',
+        '        run.googleapis.com/cpu-throttling: "false"',
+        '        run.googleapis.com/startup-cpu-boost: "true"',
+        `        run.googleapis.com/container-dependencies: '${deps}'`,
+        '        autoscaling.knative.dev/maxScale: "1"',
+        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
+        '    spec:',
+        '      timeoutSeconds: 3600',
+        '      containers:',
+        '        # Ingress — the ONLY container with a port. Verifies the shared JWT (no Google here).',
+        '        - name: caddy',
+        '          image: caddy:2.8-alpine',
+        '          ports:',
+        '            - name: http1',
+        `              containerPort: ${ctx.port}`,
+        '          volumeMounts:',
+        '            - { name: caddy-config, mountPath: /etc/caddy, readOnly: true }',
+        ...resourceLimits('1000m', '512Mi'),
+        '        # Auth broker — verifies IDE Bearer JWTs AND the federated .agenthippo.ai cookie (/api/ide/me).',
+        '        # Same shared AGENTHIPPO_AUTH_JWT_SECRET as the central IdP so its tokens verify here.',
+        '        - name: auth-broker',
+        '          image: ${IMAGE}',
+        '          args: ["auth-broker"]',
+        '          env:',
+        '            - { name: AGENTHIPPO_AUTH_PORT, value: "9780" }',
+        '            - { name: AGENTHIPPO_AUTH_DATA_DIR, value: /data }',
+        '            - { name: AGENTHIPPO_AUTH_PUBLIC_URL, value: https://${PUBLIC_HOSTNAME} }',
+        '            - { name: AGENTHIPPO_AUTH_ALLOWED_DOMAINS, value: ${ALLOWED_DOMAINS} }',
+        `            - { name: AGENTHIPPO_AUTH_COOKIE_DOMAIN, value: "${cookieDomain}" }`,
+        `            - { name: AGENTHIPPO_AUTH_IDP_URL, value: "${idpUrl}" }`,
+        '            - { name: AGENTHIPPO_AUTH_COOKIE_NAME, value: "ah_token" }',
+        '            - name: AGENTHIPPO_AUTH_JWT_SECRET',
+        '              valueFrom:',
+        '                secretKeyRef: { name: ${SERVICE}-auth-jwt-secret, key: latest }',
+        ...startupProbeLines(9780),
+        ...resourceLimits('1000m', '512Mi'),
+        '        # Agent — serves www + /v1/* on localhost (NOT ingress). Routed through LiteLLM.',
+        '        - name: agent',
+        '          image: ${IMAGE}',
+        `          args: [${agentArgs}]`,
+        '          env:',
+        '            - { name: AGENTHIPPO_HOME, value: /state }',
+        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
+        agentServeHostEnvYaml(),
+        ...(isCursor ? [
+            '            - { name: AGENTHIPPO_CUSTOM_ENGINES_DIR, value: /engines }',
+            '            - name: CURSOR_API_KEY',
+            '              valueFrom:',
+            '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
+        ] : [
+            '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
+            '            - name: AGENTHIPPO_LITELLM_API_KEY',
+            '              valueFrom:',
+            '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
+        ]),
+        '          volumeMounts:',
+        '            - { name: state, mountPath: /state }',
+        ...startupProbeLines(EDGE_AGENT_PORT, true),
+        ...resourceLimits('2000m', '2Gi'),
+    ];
+    if (!isCursor) {
+        lines.push('        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight).', '        - name: litellm', '          image: ${LITELLM_IMAGE}', '          env:', '            - { name: OTEL_EXPORTER, value: otlp_http }', '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }', '            - name: LITELLM_MASTER_KEY', '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }', `            # Upstream provider key for ${ctx.model || 'this model'} (matches the gateway's os.environ/${providerKeyEnv} ref).`, `            - name: ${providerKeyEnv}`, '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }', ...startupProbeLines(4443), ...resourceLimits('1000m', '1Gi'), '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.', '        - name: otel-collector', '          image: otel/opentelemetry-collector-contrib:0.118.0', '          args: ["--config=/etc/otel/config.yaml"]', '          env:', '            - { name: AGENT_HOME_DIR, value: /state }', '          volumeMounts:', '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }', '            - { name: state, mountPath: /state }', ...startupProbeLines(4318), ...resourceLimits('1000m', '512Mi'));
+    }
+    lines.push('      volumes:', '        # In-memory state (matches the working spotlight deploy — no GCS SA perms needed).', '        - name: state', '          emptyDir:', '            medium: Memory', '            sizeLimit: 1Gi', '        - name: caddy-config', '          secret:', '            secretName: ${SERVICE}-caddyfile', '            items:', '              - { key: latest, path: Caddyfile }');
+    if (!isCursor) {
+        lines.push('        - name: otel-config', '          secret:', '            secretName: ${SERVICE}-otel-config', '            items:', '              - { key: latest, path: config.yaml }');
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+/** Deploy script for the federated edge (A′): build, upsert secrets (no OAuth), replace, make
+ *  public, map the subdomain. No IAP; no Google OAuth client. */
+function renderCloudrunFedDeploy(ctx) {
+    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
+    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
+    const lines = [
+        '#!/usr/bin/env bash',
+        '# Cloud Run + AgentHippo federated edge (A′): Caddy + auth-broker front the agent.',
+        `# Engine: ${ctx.engine}${modelNote}. No oauth2-proxy, no per-service Google OAuth client —`,
+        '# Google login happens once at the central IdP (auth.agenthippo.ai); this agent verifies',
+        '# the shared .agenthippo.ai AgentHippo JWT (Bearer for IDE, cookie for browser). No IAP.',
+        '# The IDE points spec.remote.url straight at https://$PUBLIC_HOSTNAME (same flow as remote-vm).',
+        'set -euo pipefail',
+        ...anchorToStagingRoot(),
+        `SERVICE="${ctx.packName}"`,
+        'REGION="${REGION:-us-central1}"',
+        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
+        'REPO="${ARTIFACT_REPO:-agenthippo}"',
+        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
+        'LITELLM_IMAGE="${LITELLM_IMAGE:-ghcr.io/agenthippo/litellm-gateway:2026.06}"',
+        '# Public hostname = a *.agenthippo.ai subdomain mapped to this service (one-time wildcard DNS).',
+        'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai}"',
+        'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:-agenthippo.ai}"',
+        '# Shared AgentHippo JWT signing key — MUST match the central IdP (auth.agenthippo.ai).',
+        '# Copy it from the IdP (or the GCP secret it stores) so tokens issued there verify here.',
+        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>}"',
+        ...(isCursor ? [
+            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<cursor api key>}"',
+        ] : [
+            '# LiteLLM proxy key + the upstream provider key the gateway uses for the model.',
+            'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
+            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<upstream provider key>}"',
+        ]),
+        '',
+        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
+        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
+        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
+        '',
+        '# One agent image serves both the agent and the auth-broker containers (CLI ships `auth-broker`).',
+        '# Rewrite the runtime base to this project Artifact Registry (the ghcr.io/agenthippo/runtime:latest',
+        '# tag was retired; AR has runtime:latest / :latest-cursor). No-op if the base already targets AR.',
+        'DF_TMP="$(mktemp)"',
+        'sed "s|FROM ghcr.io/agenthippo/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
+        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
+        'docker push "$IMAGE"',
+        '',
+        '# Secrets: caddyfile + shared JWT secret + provider/litellm keys. NO OAuth client secrets.',
+        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
+        'ensure_secret "${SERVICE}-caddyfile"; gcloud secrets versions add "${SERVICE}-caddyfile" --data-file=deploy/Caddyfile',
+        'ensure_secret "${SERVICE}-auth-jwt-secret"; printf %s "$AUTH_JWT_SECRET" | gcloud secrets versions add "${SERVICE}-auth-jwt-secret" --data-file=-',
+        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
+    ];
+    if (!isCursor) {
+        lines.push('ensure_secret "${SERVICE}-otel-config"; gcloud secrets versions add "${SERVICE}-otel-config" --data-file=deploy/otel-collector.yaml', 'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-');
+    }
+    lines.push('', '# Render the multi-container template (sed — no gettext) and deploy.', 'RENDERED="$(mktemp)"', 'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\', '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" \\', '    -e "s|\\${PUBLIC_HOSTNAME}|${PUBLIC_HOSTNAME}|g" -e "s|\\${ALLOWED_DOMAINS}|${ALLOWED_DOMAINS}|g" \\', '    deploy/service.yaml > "$RENDERED"', 'gcloud run services replace "$RENDERED" --region "$REGION"', '', '# No IAP: Caddy is the gate, so Cloud Run must allow public ingress (allUsers invoker).', 'gcloud run services add-iam-policy-binding "$SERVICE" --region "$REGION" \\', '  --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true', '', '# Map the *.agenthippo.ai subdomain (idempotent). Requires one-time wildcard DNS', '# *.agenthippo.ai → Cloud Run (gctrl.run.app). No per-subdomain DNS, no Google OAuth edit.', '# Skip for *.run.app default URLs (no custom mapping needed there).', 'if [[ "$PUBLIC_HOSTNAME" != *.run.app ]]; then \\', '  gcloud beta run domain-mappings describe "$PUBLIC_HOSTNAME" --region "$REGION" >/dev/null 2>&1 \\', '    || gcloud beta run domain-mappings create --service "$SERVICE" --region "$REGION" --domain "$PUBLIC_HOSTNAME"; \\', 'fi', '', '# Grant the runtime SA access to the secrets if needed:', '#   SA="$(gcloud run services describe "$SERVICE" --region "$REGION" --format=\'value(spec.template.spec.serviceAccountName)\')"', '#   for s in caddyfile auth-jwt-secret provider-key; do', '#     gcloud secrets add-iam-policy-binding "${SERVICE}-$s" --member="serviceAccount:$SA" --role=roles/secretmanager.secretAccessor', '#   done', '');
+    return lines.join('\n');
+}
+/** A′ artifacts: Cloud Run behind the federated AgentHippo edge (Caddy + auth-broker; no oauth2-proxy). */
+function cloudrunFedArtifacts(ctx, inbound, isCursor) {
+    const sidecars = isCursor
+        ? 'Caddy (ingress) + auth-broker + agent.'
+        : 'Caddy (ingress) + auth-broker + agent + LiteLLM + OTEL collector (Spotlight).';
+    const idp = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
+    const files = {
+        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
+        'www/index.html': renderLandingPage(ctx.packName),
+        'Caddyfile': renderCloudrunFedCaddyfile(ctx),
+        'service.yaml': renderCloudrunFedServiceYaml(ctx),
+        'cloudrun-deploy.sh': renderCloudrunFedDeploy(ctx),
+    };
+    if (!isCursor) {
+        files['otel-collector.yaml'] = OTEL_COLLECTOR_COMPOSE_YAML;
+    }
+    files['README.md'] = [
+        `# Deploy: ${ctx.packName} — Cloud Run + AgentHippo federated edge (A′)`,
+        '',
+        `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
+        '',
+        `${sidecars} Sidecars share the pod\'s localhost (Cloud Run multi-container):`,
+        '- **caddy** (ingress, the only port) → verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser)',
+        `- **agent** → serves www + /v1/* on localhost:${EDGE_AGENT_PORT} (NOT ingress)`,
+        '- **auth-broker** → validates the shared `.agenthippo.ai` JWT via `/api/ide/me` (same secret as the IdP)',
+        ...(isCursor ? [] : [
+            '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
+            '- **otel-collector** → writes JSONL traces to the in-memory `/state` volume',
+        ]),
+        '',
+        '**No oauth2-proxy, no per-service Google OAuth client.** Google login happens once at the',
+        `central IdP (${idp}); this agent only verifies the resulting shared \`.agenthippo.ai\` JWT.`,
+        'The IDE points `spec.remote.url` at `https://$PUBLIC_HOSTNAME` and the existing AgentHippo',
+        'SSO flow works (same as `remote-vm`). Browser visits with no cookie are redirected to the',
+        'IdP to log in, then return. Cloud Run is public (`allUsers` invoker) so traffic reaches Caddy.',
+        '',
+        '```bash',
+        'cp deploy/.env.example deploy/.env && cp deploy/.env.auth.example deploy/.env.auth  # fill both',
+        'export PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai   # e.g. cs.agenthippo.ai',
+        'export AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>   # shared signing key',
+        ...(isCursor ? ['export PROVIDER_KEY=<cursor api key>'] : ['export LITELLM_KEY=… PROVIDER_KEY=…']),
+        'bash deploy/cloudrun-deploy.sh    # builds linux/amd64, upserts secrets, `gcloud run services replace`, maps the subdomain',
+        '```',
+        '',
+        '**One-time setup (not per agent):** wildcard DNS `*.agenthippo.ai` → Cloud Run (`gctrl.run.app`),',
+        `and the IdP (${idp}) must run the \`/oauth/browser-login\` route (oauth2-proxy forward_auth →`,
+        'auth-broker sets the `ah_token` cookie on `.agenthippo.ai`). After that, every new agent is',
+        'just: `deploy init --ingress edge-fed` + this script — zero Console/OAuth work.',
+        '',
+        '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${LITELLM_IMAGE} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`)',
+        'are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).',
+        '`AGENTHIPPO_AUTH_COOKIE_DOMAIN` / `AGENTHIPPO_AUTH_IDP_URL` are baked in at generation time.',
+        '',
+        inbound
+            ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
+            : '**No inbound channel (1a):** scales to zero; in-memory `/state` is wiped on cold start (use the `edge` mode + GCS bucket if you need durable state).',
+        '',
+    ].join('\n');
+    return files;
+}
+function databricksAppArtifacts(ctx) {
+    // Databricks Apps take SOURCE, not images — the platform builds it. serve-v3 §5.
+    const appYaml = [
+        '# Databricks App (serverless source app). Databricks runs `npm ci` then start.',
+        'command: ["node", "start.js"]',
+        'env:',
+        `  - name: PORT`,
+        `    value: "${ctx.port}"`,
+        'user_authorization:',
+        '  # OBO: Databricks forwards X-Forwarded-Access-Token (the asking user\'s',
+        '  # downscoped token) so SQL runs as that user → Unity Catalog enforces',
+        '  # per-user grants. serve-v3 §11.1.',
+        '  scopes: ["sql"]',
+        '',
+    ].join('\n');
+    const pkg = JSON.stringify({
+        name: ctx.packName,
+        private: true,
+        dependencies: {
+            [exports.AGENTHIPPO_CLI_NPM_PACKAGE]: resolveAgentHippoCliNpmVersion(),
+            '@anthropic-ai/claude-code': 'latest',
+        },
+    }, null, 2) + '\n';
+    const start = [
+        "// Databricks App entrypoint: exec serve against the bundled pack.",
+        "const { spawn } = require('node:child_process');",
+        "const port = process.env.PORT || '" + ctx.port + "';",
+        "const child = spawn('agenthippo', [",
+        "  'serve', '--agent', './pack',",
+        "  '--workspace', '/tmp/agenthippo/workspace',",
+        "  '--state-dir', '/tmp/agenthippo/state',",
+        "  '--port', port,",
+        "], { stdio: 'inherit', env: { ...process.env, AGENTHIPPO_SERVE_HOST: '0.0.0.0' } });",
+        "child.on('exit', (code) => process.exit(code ?? 0));",
+        '',
+    ].join('\n');
+    return {
+        'app.yaml': appYaml,
+        'package.json': pkg,
+        'start.js': start,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — Databricks App (T1-native, the wedge)`,
+            '',
+            '```bash',
+            'cp -r . ./databricks-app/pack    # bundle the pack next to start.js',
+            'databricks apps deploy ' + ctx.packName,
+            '```',
+            '',
+            '**Per-user permissions:** workspace SSO authenticates the user; OBO forwards',
+            '`X-Forwarded-Access-Token`, and the SQL tool authenticates to the warehouse as',
+            'that user, so Unity Catalog row filters apply automatically (serve-v3 §11.1).',
+            '',
+            '> ⚠️ The OBO *credential* seam (per-turn token → SQL tool) is the load-bearing',
+            '> spike (serve-v3 §13.2). Without it serve queries as one app identity. Identity',
+            '> attribution (`user_id`) works today; per-user *data* enforcement needs the spike.',
+            '',
+        ].join('\n'),
+    };
+}
+function spcsArtifacts(ctx) {
+    const spec = [
+        '# Snowpark Container Services spec. Push the runtime image to your account',
+        '# registry, then run deploy.sql in a worksheet. serve-v3 §6.',
+        'spec:',
+        '  containers:',
+        `    - name: ${ctx.packName}`,
+        `      image: /<db>/<schema>/<repo>/${ctx.packName}:latest`,
+        '      env:',
+        '        AGENTHIPPO_NO_AUTO_INSTALL: "1"',
+        '        AGENTHIPPO_HOME: /state',
+        '      readinessProbe:',
+        `        port: ${ctx.port}`,
+        '        path: /ready',
+        '      # Q1: durable state on a block volume — survives compute-pool suspend/resume.',
+        '      volumeMounts:',
+        '        - name: state',
+        '          mountPath: /state',
+        '  volumes:',
+        '    - name: state',
+        '      source: block',
+        '      size: 10Gi',
+        '  endpoints:',
+        `    - name: api`,
+        `      port: ${ctx.port}`,
+        '      public: true',
+        '',
+    ].join('\n');
+    const sql = [
+        '-- Run in a Snowflake worksheet. SPCS injects an OAuth session token at',
+        '-- /snowflake/session/token → the agent queries as the service role (no key-pair).',
+        'CREATE COMPUTE POOL IF NOT EXISTS agenthippo_pool',
+        '  MIN_NODES = 1 MAX_NODES = 1 INSTANCE_FAMILY = CPU_X64_S AUTO_SUSPEND_SECS = 600;',
+        '',
+        '-- Only egress: the model API. Everything else stays inside Snowflake.',
+        'CREATE OR REPLACE NETWORK RULE anthropic_rule',
+        "  MODE = EGRESS TYPE = HOST_PORT VALUE_LIST = ('api.anthropic.com:443');",
+        'CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION anthropic_eai',
+        '  ALLOWED_NETWORK_RULES = (anthropic_rule) ENABLED = TRUE;',
+        '',
+        `CREATE SERVICE ${ctx.packName}`,
+        '  IN COMPUTE POOL agenthippo_pool',
+        `  FROM SPECIFICATION_FILE = 'spec.yaml'`,
+        '  EXTERNAL_ACCESS_INTEGRATIONS = (anthropic_eai);',
+        '',
+    ].join('\n');
+    return {
+        'Dockerfile': sharedDockerfile(ctx),
+        'spec.yaml': spec,
+        'deploy.sql': sql,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — Snowflake SPCS (T1-native)`,
+            '',
+            '1. Build + push: `docker build -f deploy/Dockerfile -t <account-registry>/.../' + ctx.packName + ':latest . && docker push ...`',
+            '2. Upload `spec.yaml` to a stage, then run `deploy.sql` in a worksheet.',
+            '',
+            'Zero Snowflake credentials: SPCS injects a session token; the agent queries as the',
+            'service role, so RBAC is the permission system. Security review = "one EAI to api.anthropic.com".',
+            '',
+        ].join('\n'),
+    };
+}
+function cloudflareArtifacts(ctx) {
+    const wrangler = JSON.stringify({
+        name: ctx.packName,
+        compatibility_date: '2026-05-01',
+        containers: [
+            {
+                class_name: 'Agent',
+                image: './deploy/Dockerfile',
+                max_instances: 1,
+                instance_type: { vcpu: 2, memory_mib: 6144, disk_mb: 8192 },
+            },
+        ],
+        durable_objects: { bindings: [{ name: 'AGENT', class_name: 'Agent' }] },
+        migrations: [{ tag: 'v1', new_sqlite_classes: ['Agent'] }],
+    }, null, 2) + '\n';
+    return {
+        'Dockerfile': sharedDockerfile(ctx),
+        'wrangler.jsonc': wrangler,
+        'README.md': [
+            `# Deploy: ${ctx.packName} — Cloudflare Container (T1-generic)`,
+            '',
+            '`wrangler deploy` builds the Dockerfile and ships the container (scale-to-zero).',
+            'Front it with a Worker that does Cloudflare Access (SSO) and sets `X-Agent-User`,',
+            'then proxies to the container binding. For the *external/unauthenticated* case',
+            '(customer support), use the full reference at `examples/deploy/external-support/`.',
+            '',
+        ].join('\n'),
+    };
+}
+const RENDERERS = {
+    vm: vmArtifacts,
+    compose: composeArtifacts,
+    cloudrun: cloudrunArtifacts,
+    'databricks-app': databricksAppArtifacts,
+    spcs: spcsArtifacts,
+    cloudflare: cloudflareArtifacts,
+};
+/**
+ * Render every artifact for a target (relative path → file content), always
+ * including a scanned `.env.example`. Pure: no fs writes.
+ */
+function renderTarget(target, ctx) {
+    const files = RENDERERS[target](ctx);
+    const fed = target === 'cloudrun' && ctx.ingress === 'edge-fed';
+    const edge = target === 'vm' || target === 'compose' || (target === 'cloudrun' && ctx.ingress === 'edge') || fed;
+    // .dockerignore only alongside a Dockerfile (image-based targets). databricks-app
+    // is source-based (platform builds it) and ships no Dockerfile.
+    const hasDockerfile = Object.keys(files).some((k) => k === 'Dockerfile' || k.endsWith('/Dockerfile'));
+    return {
+        ...files,
+        ...(hasDockerfile ? { '.dockerignore': renderDockerignore() } : {}),
+        '.env.example': renderEnvExample(ctx.envVars, {
+            edge,
+            engine: ctx.engine,
+            hostname: ctx.publicHostname,
+        }),
+        // Edge auth secrets are split out so the agent container never loads them.
+        ...(edge ? {
+            '.env.auth.example': renderAuthEnvExample({
+                hostname: ctx.publicHostname,
+                fed,
+                idpUrl: ctx.idpUrl,
+                cookieDomain: ctx.cookieDomain,
+            }),
+        } : {}),
+    };
+}