@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/cli/deploy-init.js

@@ -1,3023 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK = exports.AGENTHIPPO_CLI_NPM_PACKAGE = exports.DEPLOY_PUBLIC_HOSTNAME = exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME = exports.CLAUDE_CODE_NPM_VERSION = exports.AGENTHIPPO_IMAGE_TAG = exports.AGENTHIPPO_IMAGE_REGISTRY = exports.DEPLOY_TARGETS = void 0;
-exports.isDeployTarget = isDeployTarget;
-exports.agenthippoImage = agenthippoImage;
-exports.defaultRuntimeImage = defaultRuntimeImage;
-exports.packAttributionBody = packAttributionBody;
-exports.packAttributionComment = packAttributionComment;
-exports.withPackAttribution = withPackAttribution;
-exports.serveCmdArgs = serveCmdArgs;
-exports.resolveAgentHippoCliNpmVersion = resolveAgentHippoCliNpmVersion;
-exports.resolveDeployPublicHostname = resolveDeployPublicHostname;
-exports.scanEnvRefs = scanEnvRefs;
-exports.renderEnvExample = renderEnvExample;
-exports.renderAuthEnvExample = renderAuthEnvExample;
-exports.renderAuthBrokerDockerfile = renderAuthBrokerDockerfile;
-exports.isSecretLikeBasename = isSecretLikeBasename;
-exports.dataPlaneTokenEnvVar = dataPlaneTokenEnvVar;
-exports.renderTarget = renderTarget;
-/**
- * `agenthippo deploy init` — generator for platform-native deploy artifacts
- * (serve-v3 §A4 / P2). We *generate templates into the pack repo*; we never run
- * `docker build` or call a cloud. The customer's security team reads a 5-line
- * Dockerfile and their CI/CLI does the rest.
- *
- * Tiers (serve-v3 §3): vm = T0.5/T1, compose = T2, cloudrun/cloudflare =
- * T1-generic, databricks-app/spcs = T1-native.
- *
- * Deployment model (org IdP vs generated staging): see enterprise-deploy/README.md in the repo root.
- * `deploy init` only writes templates; the customer runs scripts in deploy-out/ to deploy.
- *
- * This module is pure (string in, string out) apart from `scanEnvRefs`, which
- * reads the pack to make its secret surface self-documenting. Kept separate
- * from the command so it is unit-testable without fs or a cloud.
- */
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const serve_hardening_1 = require("./serve-hardening");
-const identity_1 = require("./deploy/layers/identity");
-exports.DEPLOY_TARGETS = ['vm', 'compose', 'cloudrun', 'databricks-app', 'spcs', 'cloudflare', 'aws-ecs', 'azure-container-apps'];
-function isDeployTarget(value) {
-    return exports.DEPLOY_TARGETS.includes(value);
-}
-/** GHCR namespace for every AgentHippo-published image. Canonical — `agenthippoai`,
- *  matching what scripts/release/publish-runtime-image.sh actually pushes to.
- *  (`ghcr.io/agenthippo/` — no trailing "ai" — is a dead namespace; do not reintroduce it.) */
-exports.AGENTHIPPO_IMAGE_REGISTRY = 'ghcr.io/agenthippoai';
-/**
- * The ONE dated tag every generated artifact pins to.
- *
- * Generated customer artifacts must never say `:latest`: a floating tag silently
- * re-points a customer's deployment at a different image, which is exactly what the
- * dated-tag policy in scripts/release/publish-runtime-image.sh exists to prevent.
- *
- * MUST match the `--version` used by scripts/release/publish-runtime-image.sh for the
- * currently promoted release (scheme: `YYYY.MM` or `YYYY.MM.DD` — see
- * scripts/release/README.md § Versioning). Bump here and in the publish run together.
- */
-exports.AGENTHIPPO_IMAGE_TAG = '2026.07';
-/**
- * Claude Code CLI version pinned into generated customer artifacts.
- *
- * `"latest"` here meant every customer install resolved a different version, so two
- * deploys of the same pack were not the same software. Keep this equal to the
- * `CLAUDE_CODE_VERSION` build ARG in extensions/agentide/scripts/Dockerfile.runtime,
- * so the source-based (Databricks) path and the container path ship the same engine.
- */
-exports.CLAUDE_CODE_NPM_VERSION = '2.1.220';
-/** `ghcr.io/agenthippoai/<name>:<dated tag>` — the only way to name a published image. */
-function agenthippoImage(name, variant) {
-    return `${exports.AGENTHIPPO_IMAGE_REGISTRY}/${name}:${exports.AGENTHIPPO_IMAGE_TAG}${variant ? `-${variant}` : ''}`;
-}
-/** Default runtime image for a pack engine (cursor needs the /engines layer). */
-function defaultRuntimeImage(engine) {
-    return engine.trim().toLowerCase() === 'cursor'
-        ? agenthippoImage('runtime', 'cursor')
-        : agenthippoImage('runtime');
-}
-/** Provenance line for generated deploy artifacts (pack-standard WS2). */
-function packAttributionBody(ctx) {
-    return `Generated from Agent Pack ${ctx.packName}@${ctx.packVersion} — packs.agenthippo.ai`;
-}
-function packAttributionComment(ctx, kind = 'hash') {
-    const body = packAttributionBody(ctx);
-    if (kind === 'html') {
-        return `<!-- ${body} -->`;
-    }
-    if (kind === 'sql') {
-        return `-- ${body}`;
-    }
-    return `# ${body}`;
-}
-/**
- * Prepend pack provenance to a generated file. Skips JSON/TOML/JSONC (no comment syntax).
- * Keeps shebangs first. Idempotent if packs.agenthippo.ai is already present near the top.
- */
-function withPackAttribution(ctx, relPath, content) {
-    const head = content.slice(0, 400);
-    if (head.includes('packs.agenthippo.ai')) {
-        return content;
-    }
-    const base = path.basename(relPath);
-    const ext = path.extname(base).toLowerCase();
-    // Structured configs: don't invent comment syntax.
-    if (ext === '.json' || ext === '.jsonc' || base === 'wrangler.toml' || base === 'package.json') {
-        return content;
-    }
-    const kind = ext === '.html' || ext === '.md' ? 'html' :
-        ext === '.sql' ? 'sql' :
-            'hash';
-    const line = packAttributionComment(ctx, kind);
-    if (content.startsWith('#!')) {
-        const nl = content.indexOf('\n');
-        if (nl === -1) {
-            return `${content}\n${line}\n`;
-        }
-        return `${content.slice(0, nl + 1)}${line}\n${content.slice(nl + 1)}`;
-    }
-    return `${line}\n${content}`;
-}
-/** `serve` argv baked into generated Dockerfiles (matches agent.yaml engine/model). */
-function serveCmdArgs(ctx, opts) {
-    const args = [
-        'serve',
-        '--agent',
-        '/app/pack',
-        '--workspace',
-        '/state/workspace',
-        '--state-dir',
-        '/state',
-        '--port',
-        String(opts?.port ?? ctx.port),
-    ];
-    const engine = ctx.engine?.trim().toLowerCase();
-    if (engine && !['claude', 'codex'].includes(engine)) {
-        args.push('--engine', engine);
-    }
-    const model = ctx.model?.trim();
-    if (model) {
-        args.push('--model', model);
-    }
-    if (opts?.wwwDir) {
-        args.push('--www-dir', opts.wwwDir);
-    }
-    return args;
-}
-const TEXT_EXT = new Set(['.json', '.yaml', '.yml', '.md', '.env', '.example', '.txt', '.mcp']);
-const SKIP_DIRS = new Set(['node_modules', '.git', 'deploy', '.agent-hippo', 'dist', 'out']);
-/** Default public hostname when `--hostname` is not passed to `deploy init`. */
-exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME = 'auth.agenthippo.ai';
-/** @deprecated Use {@link DEFAULT_DEPLOY_PUBLIC_HOSTNAME}. */
-exports.DEPLOY_PUBLIC_HOSTNAME = exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME;
-/** npm package for Databricks Apps source deploy (org: agenthippo-ai). */
-exports.AGENTHIPPO_CLI_NPM_PACKAGE = '@agenthippo-ai/agenthippo';
-/** Fallback when monorepo package.json is not present (customer runs published CLI). */
-exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK = 'latest';
-/**
- * Pin @agenthippo-ai/agenthippo to the monorepo release version when `deploy init` runs from
- * a dev checkout; otherwise fall back to `latest`.
- */
-function resolveAgentHippoCliNpmVersion() {
-    try {
-        const pkgPath = path.join(__dirname, '..', '..', '..', '..', 'package.json');
-        if (fs.existsSync(pkgPath)) {
-            const raw = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-            const v = raw.version?.trim();
-            if (v) {
-                return v;
-            }
-        }
-    }
-    catch {
-        // ignore
-    }
-    return exports.AGENTHIPPO_CLI_NPM_VERSION_FALLBACK;
-}
-function resolveDeployPublicHostname(value) {
-    const trimmed = value?.trim();
-    return trimmed || exports.DEFAULT_DEPLOY_PUBLIC_HOSTNAME;
-}
-/**
- * Recursively scan a pack for `${env:VAR}` references and return the sorted,
- * de-duplicated variable names. This is what makes `.env.example` honest: the
- * pack's secret surface is whatever it actually interpolates.
- */
-function scanEnvRefs(dir) {
-    const found = new Set();
-    const re = /\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
-    const walk = (current) => {
-        let entries;
-        try {
-            entries = fs.readdirSync(current, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            const full = path.join(current, entry.name);
-            if (entry.isDirectory()) {
-                if (!SKIP_DIRS.has(entry.name)) {
-                    walk(full);
-                }
-                continue;
-            }
-            // `.mcp.json` → ext `.json`; also accept files with a meaningful name even if extensionless config.
-            const ext = path.extname(entry.name).toLowerCase();
-            if (!TEXT_EXT.has(ext)) {
-                continue;
-            }
-            let text;
-            try {
-                text = fs.readFileSync(full, 'utf8');
-            }
-            catch {
-                continue;
-            }
-            for (const m of text.matchAll(re)) {
-                found.add(m[1]);
-            }
-        }
-    };
-    walk(dir);
-    return [...found].sort();
-}
-/**
- * Render `.env.example`. Always seeds the two serve needs (a bearer secret and
- * a model credential) as comments, then lists every scanned pack variable.
- */
-function renderEnvExample(vars, opts) {
-    const isCursor = opts?.engine?.trim().toLowerCase() === 'cursor';
-    const hostname = resolveDeployPublicHostname(opts?.hostname);
-    const lines = [
-        '# Generated by `agenthippo deploy init`. Copy to .env and fill in.',
-    ];
-    if (isCursor) {
-        lines.push('# Cursor engine (pack default model: auto):', 'CURSOR_API_KEY=             # https://cursor.com/settings → API keys');
-    }
-    else if (opts?.gatewayDirect) {
-        lines.push('# Gateway-direct routing (agent → gateway.agenthippo.ai — no in-pod LiteLLM sidecar):', 'AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1', 'AGENTHIPPO_LITELLM_API_KEY=   # ahgw_… from create-gateway-key on the gateway host');
-    }
-    else {
-        lines.push('# Model credential — pick ONE path (serve-v3 §10.2):', '#   AgentHippo hosted gateway (colocated agents / CI — long-lived service key):', '#   AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1', '#   AGENTHIPPO_LITELLM_API_KEY=ahgw_…   # bun run create-gateway-key on gateway host', '#   Direct Anthropic:', 'ANTHROPIC_API_KEY=', '#   CLAUDE_CODE_USE_BEDROCK=1 # existing AWS Bedrock entitlement (no new key)', '#   CLAUDE_CODE_USE_VERTEX=1  # existing GCP Vertex entitlement (no new key)');
-    }
-    if (vars.length > 0) {
-        lines.push('', '# Pack-referenced secrets (scanned from ${env:...}):');
-        for (const v of vars) {
-            lines.push(`${v}=`);
-        }
-    }
-    if (opts?.edge) {
-        lines.push('', '# Public hostname — set once; Caddyfile reads {$AGENTHIPPO_PUBLIC_HOSTNAME}.', `AGENTHIPPO_PUBLIC_HOSTNAME=${hostname}`, '', '# Multi-replica (serve-v4 P1): sticky by X-Agent-User in Caddyfile.', '#   docker compose up --scale agent=N', '#   AGENTHIPPO_STATE_S3_URI=s3://bucket/prefix   # S3-compatible (MinIO/R2/GCS/AWS)', '#   AGENTHIPPO_STATE_S3_ENDPOINT=                 # optional, e.g. http://minio:9000', '#   AGENTHIPPO_STATE_RESTORE_BOOT=none            # restore-on-miss (required when N>1)', '# Scale-down: drain (/ready inflight=0) then remove replica — see serve-v3-RUNBOOK.', '', '# Edge auth secrets (JWT signing key, Google OAuth client/cookie) live in .env.auth,', '# which is loaded ONLY by the auth-broker and oauth2-proxy services — never the agent.', '# Keeping the token-signing key out of the agent container limits blast radius if the', '# agent (which runs model-driven tool calls) is compromised. Copy .env.auth.example.', '', '# Cloudflare Tunnel (free — no Access seats), config-file mode in compose:', '#   cloudflared tunnel create <name>  → save the JSON as deploy/tunnel-credentials.json (gitignored)', '#   set the tunnel id in deploy/cloudflared.yml; cloudflared tunnel route dns <name> <hostname>', '# No token/env needed — the credentials JSON is mounted into the cloudflared container.');
-    }
-    return lines.join('\n') + '\n';
-}
-/**
- * Render `.env.auth.example` — the edge auth secrets (JWT signing key, Google OAuth
- * client/cookie secrets, team bootstrap config). Loaded ONLY by the auth-broker and
- * oauth2-proxy services (see docker-compose.yml), never the agent: the agent has no use
- * for the token-signing key, so keeping it out of that container limits the blast radius
- * of a compromised (model-driven) agent — it can no longer forge tokens for any identity.
- */
-function renderAuthEnvExample(opts) {
-    const hostname = resolveDeployPublicHostname(opts?.hostname);
-    if (opts?.fed) {
-        const idp = (opts.idpUrl || 'https://auth.agenthippo.ai').replace(/\/+$/, '');
-        const cookieDomain = opts.cookieDomain || '.agenthippo.ai';
-        return [
-            '# Generated by `agenthippo deploy init --ingress edge-fed`. Copy to .env.auth and fill in.',
-            '# Federated edge (A′): NO Google OAuth client here. Google login happens once at the',
-            `# central IdP (${idp}); this agent only VERIFIES the shared ${cookieDomain} AgentHippo JWT.`,
-            '# Loaded only by auth-broker. Never given to the agent (limits token-forgery blast radius).',
-            '',
-            '# AgentHippo JWT signing key — MUST match the central IdP (auth.agenthippo.ai).',
-            '# Copy it from there (or the GCP secret it stores) so tokens issued by the IdP verify here.',
-            'AGENTHIPPO_AUTH_JWT_SECRET=   # copy from auth.agenthippo.ai (openssl rand -hex 32 to generate one)',
-            `AGENTHIPPO_AUTH_PUBLIC_URL=https://${hostname}`,
-            'AGENTHIPPO_AUTH_ALLOWED_DOMAINS=agenthippo.ai',
-            'AGENTHIPPO_AUTH_DEV=0         # 1 enables /oauth/dev/login (tests only; never in production)',
-            `AGENTHIPPO_AUTH_COOKIE_DOMAIN=${cookieDomain}   # scope the shared cookie to all subdomains`,
-            `AGENTHIPPO_AUTH_IDP_URL=${idp}   # where browsers are sent to log in`,
-            'AGENTHIPPO_AUTH_COOKIE_NAME=ah_token',
-            '',
-            '# Team bootstrap (store + gateway routing) — same as the IdP if you want parity.',
-            'AGENTHIPPO_TEAM_ID=team_default',
-            'AGENTHIPPO_TEAM_NAME=Default Team',
-            'AGENTHIPPO_TEAM_STORE_REPO=agenthippoai/agenthippo-store',
-            'AGENTHIPPO_TEAM_STORE_INDEX_URL=https://agenthippoai.github.io/agenthippo-store',
-            'AGENTHIPPO_TEAM_GITHUB_ORG=agenthippoai',
-            '# An agenthippo-gateway deployment (JWT lane) — NOT bare LiteLLM. No key: the account',
-            '# JWT is the routing credential.',
-            'AGENTHIPPO_TEAM_GATEWAY_URL=https://gateway.agenthippo.ai/v1',
-            '',
-            '# No OAUTH2_PROXY_* here — this agent does not talk to Google. The one oauth2-proxy +',
-            '# one Google OAuth client live only at the IdP.',
-        ].join('\n') + '\n';
-    }
-    const cookieDomain = opts?.cookieDomain || '.agenthippo.ai';
-    return [
-        '# Generated by `agenthippo deploy init`. Copy to .env.auth and fill in.',
-        '# Loaded only by auth-broker + oauth2-proxy (docker-compose.yml). Never given to the agent.',
-        '',
-        '# Google SSO (oauth2-proxy). GCP → OAuth client (Web):',
-        `#   Authorized origins: https://${hostname}`,
-        `#   Redirect URI:       https://${hostname}/oauth2/callback`,
-        'OAUTH2_PROXY_CLIENT_ID=',
-        'OAUTH2_PROXY_CLIENT_SECRET=',
-        'OAUTH2_PROXY_COOKIE_SECRET=   # openssl rand -base64 32 | head -c 32',
-        'OAUTH2_PROXY_PROVIDER=google',
-        'OAUTH2_PROXY_EMAIL_DOMAINS=example.com',
-        'OAUTH2_PROXY_REVERSE_PROXY=true',
-        `OAUTH2_PROXY_REDIRECT_URL=https://${hostname}/oauth2/callback`,
-        '# Federated SSO (A′) — set when this edge is the central IdP for a fleet of agents:',
-        `OAUTH2_PROXY_COOKIE_DOMAINS=${cookieDomain}   # scope the oauth2-proxy session cookie to all subdomains`,
-        '',
-        '# IDE auth broker (team bootstrap for store + LiteLLM routing)',
-        'AGENTHIPPO_AUTH_JWT_SECRET=   # openssl rand -hex 32',
-        'AGENTHIPPO_AUTH_PUBLIC_URL=https://' + hostname,
-        'AGENTHIPPO_AUTH_ALLOWED_DOMAINS=example.com',
-        'AGENTHIPPO_AUTH_DEV=0         # 1 enables /oauth/dev/login (tests only; never in production)',
-        'AGENTHIPPO_AUTH_COOKIE_NAME=ah_token   # federated cookie holding the AgentHippo JWT',
-        `AGENTHIPPO_AUTH_COOKIE_DOMAIN=${cookieDomain}   # set so /oauth/browser-login stamps a cross-subdomain cookie`,
-        'AGENTHIPPO_TEAM_ID=team_default',
-        'AGENTHIPPO_TEAM_NAME=Default Team',
-        'AGENTHIPPO_TEAM_STORE_REPO=agenthippoai/agenthippo-store',
-        'AGENTHIPPO_TEAM_STORE_INDEX_URL=https://agenthippoai.github.io/agenthippo-store',
-        'AGENTHIPPO_TEAM_GITHUB_ORG=agenthippoai',
-        '# An agenthippo-gateway deployment (JWT lane) — NOT bare LiteLLM. No key: the account',
-        '# JWT is the routing credential.',
-        'AGENTHIPPO_TEAM_GATEWAY_URL=https://gateway.agenthippo.ai/v1',
-    ].join('\n') + '\n';
-}
-/** Auth broker sidecar for IDE sign-in + team bootstrap API. */
-function renderAuthBrokerDockerfile() {
-    return [
-        '# Auth broker for IDE sign-in + team bootstrap API.',
-        '# Build context = pack root: docker build -f deploy/Dockerfile.auth-broker -t <pack>-auth-broker:local .',
-        `FROM ${agenthippoImage('runtime')}`,
-        'ENV AGENTHIPPO_AUTH_PORT=9780',
-        'ENV AGENTHIPPO_AUTH_DATA_DIR=/data',
-        'EXPOSE 9780',
-        'VOLUME ["/data"]',
-        'CMD ["auth-broker"]',
-        '',
-    ].join('\n');
-}
-/** Secret-like basenames beyond `.env` and `*credentials*.json` — private keys, keystores, and
- * credential files of any extension. Shared by renderDockerignore() below and copyPackToStaging()
- * in commands/deploy.ts so the staging dir on disk and the generated .dockerignore never diverge. */
-function isSecretLikeBasename(base) {
-    if (/credentials/i.test(base))
-        return true;
-    if (/\.(pem|key|p12|pfx|jks|gpg|pgp)$/i.test(base))
-        return true;
-    if (/^id_(rsa|dsa|ecdsa|ed25519)$/i.test(base))
-        return true;
-    return false;
-}
-/** .dockerignore emitted alongside every image-building target's Dockerfile.
- * Keeps skills/, references/, scripts/ (required at runtime) and drops only VCS,
- * cache, and build cruft. node_modules is excluded so the linux/amd64 image
- * reinstalls fresh deps via the Dockerfile skill-deps step — dev-machine
- * node_modules may be wrong-arch (arm64/darwin) for the image. */
-function renderDockerignore() {
-    return [
-        '# Generated by `agenthippo deploy init`. Keeps skills/, references/, scripts/',
-        '# (needed at runtime) and drops only VCS/cache/build cruft. node_modules is',
-        '# excluded so the Dockerfile reinstalls fresh linux/amd64 deps for skills.',
-        '.git',
-        '.gitignore',
-        '.gitattributes',
-        '**/node_modules',
-        '**/__pycache__',
-        '**/.pytest_cache',
-        '**/.mypy_cache',
-        '**/.ruff_cache',
-        '**/.venv',
-        '**/venv',
-        '**/*.log',
-        '**/dist',
-        '**/build',
-        '**/.next',
-        '**/.turbo',
-        '**/.cache',
-        '.DS_Store',
-        '**/.DS_Store',
-        '.idea',
-        '.vscode',
-        '*.swp',
-        '# Secrets anywhere in the pack (defensive; deploy/ secrets are also covered below).',
-        '# Keep in sync with isSecretLikeBasename() above.',
-        '**/.env',
-        // `**/.env` alone does NOT match `.env.auth` / `.env.local` / `.env.production`.
-        // `.env.auth` carries AGENTHIPPO_AUTH_JWT_SECRET and OAUTH2_PROXY_* — baking it
-        // into a published layer leaks fleet-wide token-forgery material.
-        '**/.env.*',
-        '**/*credentials*',
-        '**/*.pem',
-        '**/*.key',
-        '**/*.p12',
-        '**/*.pfx',
-        '**/*.jks',
-        '**/*.gpg',
-        '**/*.pgp',
-        '**/id_rsa',
-        '**/id_dsa',
-        '**/id_ecdsa',
-        '**/id_ed25519',
-        '# …but *.example templates are safe and are what the README tells customers to copy.',
-        '!**/.env.example',
-        '!**/.env.*.example',
-        '# deploy/ holds build/deploy artifacts + secrets; only deploy/www/ ships at runtime.',
-        'deploy/*',
-        '!deploy/www',
-        '!deploy/www/**',
-        '',
-    ].join('\n');
-}
-/** Build-time install of skill dependencies (skills/** and scripts/**). Skills that
- * ship their own requirements.txt / package.json need their libs present at runtime,
- * but AGENTHIPPO_NO_AUTO_INSTALL=1 skips runtime installs — so we install at BUILD
- * time. Pure no-op when no dep files are present (keeps minimal packs lean). pip3 is
- * ensured only when a requirements.txt exists (the runtime base ships python3 but not
- * necessarily pip). Runs as root, then drops back to the non-root agent user. */
-function skillDepsInstallLines() {
-    return [
-        '# Skill dependencies — installed at BUILD time so skills that ship their own',
-        '# requirements.txt / package.json have their libs present at runtime',
-        '# (AGENTHIPPO_NO_AUTO_INSTALL=1 skips runtime installs). No-op when none exist.',
-        'USER root',
-        'RUN set -e; \\',
-        '    py_reqs=$(find /app/pack/skills /app/pack/scripts -type f -name requirements.txt -not -path "*/node_modules/*" 2>/dev/null || true); \\',
-        '    if [ -n "$py_reqs" ]; then \\',
-        '      pip3 --version 2>/dev/null || (apt-get update && apt-get install -y --no-install-recommends python3-pip && rm -rf /var/lib/apt/lists/*); \\',
-        '      echo "$py_reqs" | while IFS= read -r f; do [ -n "$f" ] && pip3 install --no-cache-dir --break-system-packages -r "$f" || true; done; \\',
-        '    fi; \\',
-        '    pkg_json=$(find /app/pack/skills /app/pack/scripts -type f -name package.json -not -path "*/node_modules/*" 2>/dev/null || true); \\',
-        '    if [ -n "$pkg_json" ]; then \\',
-        '      echo "$pkg_json" | while IFS= read -r f; do [ -n "$f" ] && (cd "$(dirname "$f")" && npm install --omit=dev --no-audit --no-fund || true) || true; done; \\',
-        '    fi',
-        'USER agent',
-    ];
-}
-/** Cloud Run / compose agent env: bind on all interfaces inside the container network. */
-function agentServeHostEnvYaml(indent = '            ') {
-    return `${indent}- { name: ${serve_hardening_1.SERVE_HOST_ENV}, value: ${serve_hardening_1.CONTAINER_SERVE_HOST} }`;
-}
-/** The Dockerfile shared by image-based targets (serve-v3 §A2).
- *  `extraEnv`: platform-specific ENV lines — e.g. pinning AGENTHIPPO_IDENTITY_HEADER for a
- *  target whose container may be directly reachable (governance: identity-header pinning). */
-function sharedDockerfile(ctx, opts) {
-    const cmd = serveCmdArgs(ctx, opts).map((a) => `"${a}"`).join(',');
-    return [
-        `${packAttributionComment(ctx)}. Build context = pack root:`,
-        `#   docker build -f deploy/Dockerfile -t ${ctx.packName}:local .`,
-        `FROM ${ctx.image}`,
-        `LABEL ai.agenthippo.pack.name="${ctx.packName}"`,
-        `LABEL ai.agenthippo.pack.version="${ctx.packVersion}"`,
-        `LABEL ai.agenthippo.pack.engine="${ctx.engine}"`,
-        `COPY . /app/pack/`,
-        ...skillDepsInstallLines(),
-        `ENV AGENTHIPPO_NO_AUTO_INSTALL=1`,
-        `ENV ${serve_hardening_1.SERVE_HOST_ENV}=${serve_hardening_1.CONTAINER_SERVE_HOST}`,
-        ...Object.entries(opts?.extraEnv ?? {}).map(([k, v]) => `ENV ${k}=${v}`),
-        `EXPOSE ${ctx.port}`,
-        // Runtime base image sets ENTRYPOINT ["agenthippo"]; CMD args append to it.
-        `CMD [${cmd}]`,
-        '',
-    ].join('\n');
-}
-/** Minimal post-SSO landing page (static chat UI → /v1/chat). */
-function renderLandingPage(packName) {
-    return [
-        '<!DOCTYPE html>',
-        '<html lang="en">',
-        '<head>',
-        '  <meta charset="utf-8" />',
-        '  <meta name="viewport" content="width=device-width, initial-scale=1" />',
-        `  <title>${packName}</title>`,
-        '  <style>',
-        '    :root { color-scheme: light dark; font-family: system-ui, sans-serif; }',
-        '    body { max-width: 720px; margin: 2rem auto; padding: 0 1rem; line-height: 1.5; }',
-        '    h1 { font-size: 1.4rem; margin-bottom: 0.25rem; }',
-        '    .sub { opacity: 0.7; font-size: 0.9rem; margin-bottom: 1.5rem; }',
-        '    #log { border: 1px solid #8884; border-radius: 8px; min-height: 200px; padding: 1rem; white-space: pre-wrap; margin-bottom: 1rem; }',
-        '    form { display: flex; gap: 0.5rem; }',
-        '    input[type=text] { flex: 1; padding: 0.6rem 0.75rem; border-radius: 6px; border: 1px solid #8886; font: inherit; }',
-        '    button { padding: 0.6rem 1rem; border-radius: 6px; border: 0; background: #2563eb; color: #fff; font: inherit; cursor: pointer; }',
-        '    button:disabled { opacity: 0.6; cursor: wait; }',
-        '  </style>',
-        '</head>',
-        '<body>',
-        `  <h1>${packName}</h1>`,
-        '  <p class="sub">Signed in via Google SSO. Chat uses the agent API behind this page.</p>',
-        '  <div id="log">Ready. Send a message below.</div>',
-        '  <form id="chat">',
-        '    <input id="msg" type="text" placeholder="Ask the agent…" autocomplete="off" required />',
-        '    <button type="submit">Send</button>',
-        '  </form>',
-        '  <script>',
-        '    const log = document.getElementById("log");',
-        '    const form = document.getElementById("chat");',
-        '    const input = document.getElementById("msg");',
-        '    // Stable per-browser session id so turns resume the same conversation (multi-turn).',
-        '    const sessionId = (self.crypto && crypto.randomUUID) ? crypto.randomUUID() : ("web-" + Date.now().toString(36) + Math.random().toString(36).slice(2));',
-        '    function append(text) {',
-        '      log.textContent += (log.textContent.endsWith("\\n") || log.textContent === "Ready. Send a message below." ? "" : "\\n") + text;',
-        '    }',
-        '    form.addEventListener("submit", async (e) => {',
-        '      e.preventDefault();',
-        '      const message = input.value.trim();',
-        '      if (!message) return;',
-        '      input.value = "";',
-        '      form.querySelector("button").disabled = true;',
-        '      append("\\nYou: " + message + "\\nAgent: ");',
-        '      try {',
-        '        const body = { message, session_id: sessionId };',
-        '        const res = await fetch("/v1/chat", {',
-        '          method: "POST",',
-        '          headers: { "Content-Type": "application/json" },',
-        '          body: JSON.stringify(body),',
-        '        });',
-        '        const data = await res.json();',
-        '        if (!res.ok) throw new Error(data.error || res.statusText);',
-        '        append(data.text || data.response || JSON.stringify(data));',
-        '      } catch (err) {',
-        '        append("[error] " + (err.message || err));',
-        '      } finally {',
-        '        form.querySelector("button").disabled = false;',
-        '        input.focus();',
-        '      }',
-        '    });',
-        '    input.focus();',
-        '  </script>',
-        '</body>',
-        '</html>',
-        '',
-    ].join('\n');
-}
-/** Sticky upstream for multi-replica serve (serve-v4 P1.1).
- * Hash on X-Agent-User (SSO identity the edge already injects) so a user's
- * sessions stay on one replica — keeps local state + in-process RateLimiter
- * correct without Redis. Fallback ip_hash for tokened API callers without SSO.
- * Scale: `docker compose up --scale agent=N` (set AGENTHIPPO_STATE_RESTORE_BOOT=none).
- */
-function renderStickyAgentProxy(port, indent = '    ') {
-    return [
-        `${indent}# serve-v4 P1.1: sticky by user identity (not session body — edge can't hash POST).`,
-        `${indent}# In-process RateLimiter is globally correct per user under this policy.`,
-        `${indent}reverse_proxy agent:${port} {`,
-        `${indent}  lb_policy header X-Agent-User {`,
-        `${indent}    fallback ip_hash`,
-        `${indent}  }`,
-        `${indent}}`,
-    ];
-}
-/** Caddy config for the `edge` compose profile (oauth2-proxy + agent on Docker network). */
-function renderCaddyfile(ctx) {
-    const fed = ctx.ingress === 'edge-fed';
-    const idp = (ctx.idpUrl || '').trim().replace(/\/+$/, '');
-    const catchallBody = [
-        '    @api path /v1/*',
-        '    handle @api {',
-        ...renderStickyAgentProxy(ctx.port, '      '),
-        '    }',
-        '    root * /srv/www',
-        '    file_server',
-    ];
-    return [
-        '# SSO edge + Cloudflare Tunnel. Set AGENTHIPPO_PUBLIC_HOSTNAME in .env (Caddy reads it below).',
-        '# TLS terminates at Cloudflare; origin listens on HTTP only.',
-        ...(fed
-            ? [
-                `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
-                '# this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser).',
-            ]
-            : []),
-        '{',
-        '  auto_https off',
-        '}',
-        '',
-        'http://{$AGENTHIPPO_PUBLIC_HOSTNAME} {',
-        ...(fed
-            ? (0, identity_1.renderIdentityLayer)({
-                mode: 'federated',
-                authBrokerAddr: 'auth-broker:9780',
-                idpUrl: idp,
-                healthProxy: renderStickyAgentProxy(ctx.port, '    '),
-                agentProxy: renderStickyAgentProxy(ctx.port, '    '),
-                catchallBody,
-            })
-            : (0, identity_1.renderIdentityLayer)({
-                mode: 'self-issued',
-                oauth2ProxyAddr: 'oauth2-proxy:4180',
-                authBrokerAddr: 'auth-broker:9780',
-                healthProxy: renderStickyAgentProxy(ctx.port, '    '),
-                agentProxy: renderStickyAgentProxy(ctx.port, '    '),
-                catchallBody,
-            })),
-        '}',
-        '',
-    ].join('\n');
-}
-/** cloudflared config-file mode (optional). Prefer CLOUDFLARE_TUNNEL_TOKEN + compose `tunnel` profile. */
-function renderCloudflaredYml(hostname) {
-    return [
-        '# Cloudflare Tunnel — run as the compose `cloudflared` service (config-file mode).',
-        '# One-time setup:',
-        '#   cloudflared tunnel create <name>                 # creates the tunnel + a credentials JSON',
-        '#   cp <that-creds>.json deploy/tunnel-credentials.json   # mounted into the container (gitignore it!)',
-        `#   cloudflared tunnel route dns <name> ${hostname}`,
-        '#   set the tunnel id below, then: docker compose --profile edge --profile tunnel up -d',
-        'tunnel: <TUNNEL_ID>',
-        'credentials-file: /etc/cloudflared/credentials.json   # mounted from deploy/tunnel-credentials.json',
-        'ingress:',
-        `  - hostname: ${hostname}  # must match AGENTHIPPO_PUBLIC_HOSTNAME in .env`,
-        '    service: http://caddy:80   # cloudflared container → Caddy over the compose network',
-        '  - service: http_status:404',
-        '',
-    ].join('\n');
-}
-/** Shared `agent` service block for vm/compose docker-compose.yml (build context = pack root). */
-function renderAgentComposeService(ctx, extraLines = []) {
-    return [
-        '  agent:',
-        '    build:',
-        '      context: ..',
-        '      dockerfile: deploy/Dockerfile',
-        '    env_file:',
-        '      - path: .env',
-        '        required: false',
-        ...extraLines,
-        '    volumes: ["agenthippo-state:/state"]',
-        `    expose: ["${ctx.port}"]`,
-        '    # No host port — edge reaches agent on the Docker network only.',
-        '    # T0.5a VPN: bash deploy/run.sh binds 127.0.0.1:' + ctx.port + ' via docker run -p.',
-        '',
-    ];
-}
-/** oauth2-proxy (self-issued only) + auth-broker + Caddy services for `--profile edge`.
- *  `fed`: federated (verify-only against a central IdP) — no oauth2-proxy, no local Google client. */
-function renderEdgeComposeServices(fed) {
-    const oauth2Proxy = fed ? [] : [
-        '  oauth2-proxy:',
-        '    profiles: ["edge"]',
-        '    image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
-        '    env_file:',
-        '      - path: .env',
-        '        required: false',
-        '      - path: .env.auth   # OAuth client/cookie secrets — not shared with the agent',
-        '        required: false',
-        '    environment:',
-        '      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180',
-        '      OAUTH2_PROXY_UPSTREAMS: file:///dev/null',
-        '      OAUTH2_PROXY_SET_XAUTHREQUEST: "true"',
-        '      OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true"',
-        '      OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"',
-        '      OAUTH2_PROXY_REVERSE_PROXY: "true"',
-        '    expose: ["4180"]',
-        '',
-    ];
-    return [
-        ...oauth2Proxy,
-        '  auth-broker:',
-        '    profiles: ["edge"]',
-        '    build:',
-        '      context: ..',
-        '      dockerfile: deploy/Dockerfile.auth-broker',
-        '    env_file:',
-        '      - path: .env',
-        '        required: false',
-        '      - path: .env.auth   # JWT signing key + team config — not shared with the agent',
-        '        required: false',
-        '    environment:',
-        '      AGENTHIPPO_AUTH_PORT: "9780"',
-        '      AGENTHIPPO_AUTH_DATA_DIR: /data',
-        '    user: "0:0"  # named volume /data is root-owned on first create',
-        '    volumes: ["auth-broker-data:/data"]',
-        '    expose: ["9780"]',
-        '',
-        '  caddy:',
-        '    profiles: ["edge"]',
-        '    image: caddy:2.8-alpine',
-        '    env_file:',
-        '      - path: .env',
-        '        required: false',
-        '    ports: ["80:80", "443:443"]  # use 80:80 not 127.0.0.1:80 — breaks vmnetd on some Docker Desktop builds',
-        '    volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro", "./www:/srv/www:ro"]',
-        `    depends_on: [${fed ? 'agent, auth-broker' : 'oauth2-proxy, agent, auth-broker'}]`,
-        '',
-    ];
-}
-/** cloudflared in compose — outbound tunnel to Cloudflare (free; no Access). */
-function renderTunnelComposeServices() {
-    return [
-        '  cloudflared:',
-        '    profiles: ["tunnel"]',
-        '    image: cloudflare/cloudflared:2024.12.2',
-        '    restart: unless-stopped',
-        '    # Config-file mode: routing lives in deploy/cloudflared.yml (GitOps), credentials',
-        '    # in deploy/tunnel-credentials.json (gitignored secret from `cloudflared tunnel create`).',
-        '    command: tunnel --config /etc/cloudflared/config.yml run',
-        '    volumes:',
-        '      - ./cloudflared.yml:/etc/cloudflared/config.yml:ro',
-        '      - ./tunnel-credentials.json:/etc/cloudflared/credentials.json:ro',
-        '    depends_on: [caddy]',
-        '',
-    ];
-}
-function renderEdgeTunnelUpScript(hostname) {
-    return [
-        '#!/usr/bin/env bash',
-        '# T0.5b — Cloudflare Tunnel + Google SSO (no Access seats). Run: bash deploy/run-edge-tunnel.sh',
-        'set -euo pipefail',
-        'cd "$(dirname "$0")"',
-        'docker compose --profile edge --profile tunnel up -d --build',
-        'echo "Public URL: https://' + hostname + ' (after DNS + tunnel route configured)"',
-        '',
-    ].join('\n');
-}
-/**
- * Same-host colocation (PLAN/deploy.md §4 state 4, `d5-colocate`): this agent rides the org
- * IdP's already-running Caddy + auth-broker instead of shipping its own — no Caddy, no
- * oauth2-proxy, no local auth-broker, no local auth secrets at all. Ships only the agent
- * container (joining the IdP's `agenthippo-idp-colocate` docker network via a fixed,
- * predictable container name) plus a Caddy route snippet for the operator to drop into the
- * IdP's `agents/` import directory (see enterprise-deploy/idp/Caddyfile + agents/README.md).
- */
-/** Env var (in the IdP/edge stack's env) holding the connector sidecar's register token —
- *  matches the connector's own AGENTHIPPO_DATA_PLANE_TOKEN. Convention proven by the
- *  dynamodb-analyst overlay: pack `dynamodb-analyst` → `DYNAMODB_ANALYST_DATA_PLANE_TOKEN`. */
-function dataPlaneTokenEnvVar(packName) {
-    return packName.toUpperCase().replace(/[^A-Z0-9]/g, '_') + '_DATA_PLANE_TOKEN';
-}
-function renderColocatedArtifacts(ctx) {
-    const idp = (ctx.idpUrl || '').trim().replace(/\/+$/, '');
-    const containerName = `${ctx.packName}-agent`;
-    const turnTokenEnvVar = dataPlaneTokenEnvVar(ctx.packName);
-    const compose = [
-        '# Colocated agent (PLAN/deploy.md §4 state 4) — no Caddy/oauth2-proxy/auth-broker of its',
-        '# own. Joins the org IdP\'s docker network so its already-running Caddy can reach this',
-        '# agent by name; identity is verified entirely by the IdP\'s auth-broker (see',
-        '# deploy/agent-route.caddy for the route to copy onto the IdP host).',
-        `name: ${ctx.packName}`,
-        'services:',
-        '  agent:',
-        `    container_name: ${containerName}`,
-        '    build:',
-        '      context: ..',
-        '      dockerfile: deploy/Dockerfile',
-        '    env_file:',
-        '      - path: .env',
-        '        required: false',
-        '    volumes: ["agenthippo-state:/state"]',
-        '    networks: [colocate]',
-        `    expose: ["${ctx.port}"]`,
-        '',
-        'networks:',
-        '  colocate:',
-        '    external: true',
-        '    name: ${AGENTHIPPO_IDP_NETWORK:-agenthippo-idp-colocate}',
-        '',
-        'volumes:',
-        '  agenthippo-state:',
-        '',
-    ].join('\n');
-    const snippet = [
-        `# Colocated route for ${ctx.publicHostname} — copy into enterprise-deploy/idp/agents/`,
-        '# (rename e.g. to ' + ctx.packName + '.caddy), then on the IdP host:',
-        '#   docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile',
-        '# Requires this agent\'s docker-compose.yml (already generated) to be up, so',
-        `# ${containerName} exists on the shared \`agenthippo-idp-colocate\` network.`,
-        '# http:// (not https://) to match the IdP Caddyfile\'s TLS model: auto_https is off',
-        '# there and TLS terminates in front (Cloudflare Tunnel/nginx), so every site block —',
-        '# including this imported one — must be plain HTTP, same as the IdP\'s own site address.',
-        `http://${ctx.publicHostname} {`,
-        ...(0, identity_1.renderIdentityLayer)({
-            mode: 'federated',
-            authBrokerAddr: 'auth-broker:9780',
-            idpUrl: idp,
-            healthProxy: [`    reverse_proxy ${containerName}:${ctx.port}`],
-            agentProxy: [`    reverse_proxy ${containerName}:${ctx.port}`],
-            ...(ctx.edgeTurnConnector
-                ? { turnRegistration: { connectorAddr: ctx.edgeTurnConnector, tokenEnvVar: turnTokenEnvVar } }
-                : {}),
-        }),
-        '}',
-        '',
-    ].join('\n');
-    return {
-        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-        'docker-compose.yml': compose,
-        'agent-route.caddy': snippet,
-        'www/index.html': renderLandingPage(ctx.packName),
-        'README.md': [
-            `# Deploy: ${ctx.packName} — colocated with the org IdP`,
-            '',
-            'No Caddy, no oauth2-proxy, no local auth-broker, no auth secrets on this host — this',
-            'agent rides the org IdP\'s already-running edge (`enterprise-deploy/idp/`) instead.',
-            '',
-            '```bash',
-            'cp deploy/.env.example deploy/.env   # model key only — no auth secrets here at all',
-            '# Point at the IdP\'s colocate network if it was created under a different compose',
-            '# project name: export AGENTHIPPO_IDP_NETWORK=agenthippo-idp-colocate (the default)',
-            'docker compose -f deploy/docker-compose.yml up -d --build',
-            '',
-            '# Wire the route into the IdP\'s Caddy (one-time per agent):',
-            `cp deploy/agent-route.caddy <idp-host>:enterprise-deploy/idp/agents/${ctx.packName}.caddy`,
-            ...(ctx.edgeTurnConnector
-                ? [
-                    '',
-                    '# EDGE turn registration (P1 fix): the route registers each chat turn with the connector',
-                    `# sidecar (${ctx.edgeTurnConnector}). Set the register token in the IdP stack's env —`,
-                    `# same value as the connector's AGENTHIPPO_DATA_PLANE_TOKEN — before reloading:`,
-                    `#   echo "${turnTokenEnvVar}=<token>" >> enterprise-deploy/idp/.env`,
-                    '# The agent container never holds this token (that is the point).',
-                ]
-                : []),
-            'docker compose -f enterprise-deploy/idp/docker-compose.yml exec caddy \\',
-            '  caddy reload --config /etc/caddy/Caddyfile',
-            '```',
-            '',
-            `DNS: point \`${ctx.publicHostname}\` at the IdP host (same as every other agent it fronts).`,
-            '',
-            '**hippopennyg / bare-metal (Cloudflare → nginx:443 → IdP Caddy :8080):** `deploy init` does',
-            '**not** create DNS or nginx for you. Without an explicit Cloudflare **A record**, the name',
-            'falls through to the `*.agenthippo.ai` wildcard (`ghs.googlehosted.com` from',
-            '`setup-agenthippo-domain.sh` for Cloud Run) — the site will look "broken" or hit Google.',
-            'After the steps above, run:',
-            '',
-            '```bash',
-            './enterprise-deploy/scripts/setup-colocated-agent-edge.sh \\',
-            `  --hostname ${ctx.publicHostname} --ssh root@168.119.174.239`,
-            '```',
-            '',
-            'See `enterprise-deploy/idp/agents/README.md` for the full checklist.',
-            '**Browser:** after Google SSO, open `https://' + ctx.publicHostname + '/` for the static chat UI',
-            '(`deploy/www/index.html` served by the agent container at GET /).',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-function vmArtifacts(ctx) {
-    if (ctx.ingress === 'edge-fed' && ctx.colocate) {
-        return renderColocatedArtifacts(ctx);
-    }
-    const hostname = ctx.publicHostname;
-    const run = [
-        '#!/usr/bin/env bash',
-        '# T0.5a — VPN + localhost only (no SSO edge). Binds 127.0.0.1 so LAN cannot bypass the proxy.',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        `IMAGE="${ctx.packName}:local"`,
-        'docker build -f deploy/Dockerfile -t "$IMAGE" .',
-        'docker rm -f agenthippo-agent 2>/dev/null || true',
-        'docker run -d --name agenthippo-agent --restart unless-stopped \\',
-        '  --env-file deploy/.env \\',
-        `  -v agenthippo-state:/state -p 127.0.0.1:${ctx.port}:${ctx.port} "$IMAGE"`,
-        `echo "agent on 127.0.0.1:${ctx.port} — health: curl localhost:${ctx.port}/health"`,
-        '',
-    ].join('\n');
-    const service = [
-        '# systemd user unit — survives logout (run: loginctl enable-linger $USER).',
-        '# VPN path:  cp deploy/agenthippo.service ~/.config/systemd/user/',
-        '# SSO path:  use agenthippo-edge.service (compose --profile edge)',
-        '# install: systemctl --user enable --now agenthippo',
-        '[Unit]',
-        'Description=AgentHippo agent (serve)',
-        'After=network-online.target docker.service',
-        '',
-        '[Service]',
-        `WorkingDirectory=%h/${ctx.packName}`,
-        'ExecStart=/usr/bin/env bash deploy/run.sh',
-        'Restart=always',
-        'RestartSec=5',
-        '',
-        '[Install]',
-        'WantedBy=default.target',
-        '',
-    ].join('\n');
-    const edgeService = [
-        '# systemd user unit — Cloudflare Tunnel + Google SSO + agent.',
-        '# install: cp deploy/agenthippo-edge.service ~/.config/systemd/user/',
-        '#          loginctl enable-linger $USER && systemctl --user enable --now agenthippo-edge',
-        '[Unit]',
-        'Description=AgentHippo agent (Tunnel + Google SSO)',
-        'After=network-online.target docker.service',
-        '',
-        '[Service]',
-        `WorkingDirectory=%h/${ctx.packName}/deploy`,
-        'ExecStart=/usr/bin/env docker compose -f docker-compose.yml --profile edge --profile tunnel up --build',
-        'ExecStop=/usr/bin/env docker compose -f docker-compose.yml --profile edge --profile tunnel down',
-        'Restart=always',
-        'RestartSec=5',
-        '',
-        '[Install]',
-        'WantedBy=default.target',
-        '',
-    ].join('\n');
-    const vmCompose = [
-        '# T0.5 workbench/VM. Paths:',
-        '#   T0.5a VPN:     bash deploy/run.sh',
-        '#   T0.5b remote:  bash deploy/run-edge-tunnel.sh  (Tunnel + Google SSO — recommended WFH)',
-        '#   edge only:     docker compose --profile edge up -d  (SSO on :443, no tunnel)',
-        'services:',
-        ...renderAgentComposeService(ctx),
-        ...renderEdgeComposeServices(ctx.ingress === 'edge-fed'),
-        ...renderTunnelComposeServices(),
-        'volumes:',
-        '  agenthippo-state:',
-        '  auth-broker-data:',
-        '',
-    ].join('\n');
-    return {
-        'Dockerfile': sharedDockerfile(ctx),
-        'Dockerfile.auth-broker': renderAuthBrokerDockerfile(),
-        'docker-compose.yml': vmCompose,
-        'run.sh': run,
-        'run-edge-tunnel.sh': renderEdgeTunnelUpScript(hostname),
-        'agenthippo.service': service,
-        'agenthippo-edge.service': edgeService,
-        'Caddyfile': renderCaddyfile(ctx),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'cloudflared.yml': renderCloudflaredYml(hostname),
-        'README.md': [
-            `# Deploy: ${ctx.packName} — T0.5 workbench/VM`,
-            '',
-            'Staging root = this directory\'s parent (full pack copy). Commands below run from the staging root unless noted.',
-            '',
-            'To regenerate: run `agenthippo deploy init <path-to-pack> --target vm` from the **parent** of the pack (not from inside the pack), then `cd deploy-out/' + ctx.packName + '-vm`.',
-            '',
-            '`cp deploy/.env.example deploy/.env` and fill in, then pick a path:',
-            '',
-            '**T0.5a — VPN only (simplest internal pilot)**',
-            '```bash',
-            'bash deploy/run.sh',
-            '# curl http://127.0.0.1:' + ctx.port + '/v1/chat -d \'{"message":"hi"}\' ...',
-            '```',
-            '',
-            '**T0.5b — Cloudflare Tunnel + Google SSO (recommended for WFH, no Access seats)**',
-            '```bash',
-            'cp deploy/.env.example deploy/.env            # agent: model key + public hostname',
-            'cp deploy/.env.auth.example deploy/.env.auth  # broker/oauth2-proxy: JWT + OAuth secrets (never loaded by the agent)',
-            '# 1. Google Cloud → OAuth Web client for https://' + hostname,
-            '#    Authorized origin + redirect: https://' + hostname + '/oauth2/callback',
-            '# 2. cloudflared tunnel create <name>',
-            '#    cp ~/.cloudflared/<tunnel-id>.json ~/.agent-hippo/tunnel-credentials.json  # secret',
-            '#    set tunnel: <tunnel-id> in deploy/cloudflared.yml',
-            '#    cloudflared tunnel route dns <name> ' + hostname,
-            '# 3. Fill deploy/.env (hostname, model key) and deploy/.env.auth (OAUTH2_PROXY_*, AGENTHIPPO_AUTH_JWT_SECRET)',
-            'bash deploy/run-edge-tunnel.sh',
-            '# Users open https://' + hostname + ' → Google login → static chat UI → /v1/chat',
-            '```',
-            'Tunnel routing is **config-file mode** (`deploy/cloudflared.yml` → `http://caddy:80` on the compose network), not the Cloudflare dashboard public-hostname UI alone.',
-            'Optional: `agenthippo-edge.service` + `loginctl enable-linger $USER` for persistence.',
-            '',
-            '**Edge only (no tunnel)** — `docker compose --profile edge up -d` on LAN/VPN.',
-            '',
-            'Identity: Google → oauth2-proxy → `X-Agent-User` → serve (`www/index.html` sends a per-tab `session_id` for multi-turn).',
-            'Per-user *data* scoping needs Design B (§11.1) in the app layer — generic `serve` alone does not filter warehouse rows.',
-            '',
-            '**Do not commit** `deploy/.env`, `deploy/.env.auth`, or `deploy/tunnel-credentials.json`.',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-/** Compose-tuned OTEL collector config: same pipeline as the canonical Spotlight
- * collector, but bound to 0.0.0.0 so a sibling container (litellm) can reach it,
- * and writing JSONL to the shared traces volume DuckDB/query-analytics.sh read. */
-const OTEL_COLLECTOR_COMPOSE_YAML = [
-    '# Spotlight OTEL collector (compose-tuned: 0.0.0.0 bind). Writes JSONL to',
-    '# ${AGENT_HOME_DIR}/analytics/traces/ — query with query-analytics.sh (DuckDB).',
-    'receivers:',
-    '  otlp:',
-    '    protocols:',
-    '      http: { endpoint: 0.0.0.0:4318 }',
-    '      grpc: { endpoint: 0.0.0.0:4317 }',
-    'processors:',
-    '  batch: { timeout: 500ms, send_batch_size: 10 }',
-    '  resource:',
-    '    attributes:',
-    '      - { key: service.name, value: agentide-litellm, action: upsert }',
-    'exporters:',
-    '  file/jsonl:',
-    '    path: ${AGENT_HOME_DIR}/analytics/traces/traces.jsonl',
-    '    rotation: { max_megabytes: 100, max_days: 30, max_backups: 10 }',
-    'service:',
-    '  pipelines:',
-    '    traces: { receivers: [otlp], processors: [batch, resource], exporters: [file/jsonl] }',
-    '',
-].join('\n');
-function composeArtifacts(ctx) {
-    if (ctx.ingress === 'edge-fed' && ctx.colocate) {
-        return renderColocatedArtifacts(ctx);
-    }
-    const channels = ctx.gatewayChannels?.trim();
-    const hostname = ctx.publicHostname;
-    // Agent Anywhere: override the agent command to also run the gateway bridge,
-    // and add the OpenClaw gateway service (channels profile).
-    const agentGateway = channels
-        ? [
-            '    command:',
-            `      ["serve","--agent","/app/pack","--workspace","/state/workspace",`,
-            `       "--state-dir","/state","--port","${ctx.port}",`,
-            `       "--gateway-bridge","--bind","${channels}"]`,
-        ]
-        : [];
-    const channelsService = channels
-        ? [
-            '',
-            '  # Agent Anywhere gateway (OpenClaw) — Slack/Telegram bridge.',
-            '  # Build: docker build -f extensions/agentide/scripts/Dockerfile.gateway -t this-tag .',
-            '  # NOTE: the gateway runs in secured auth mode — the agent bridge needs',
-            '  # OPENCLAW_GATEWAY_TOKEN (or a paired device) to connect. Set it in .env.',
-            '  openclaw-gateway:',
-            '    profiles: ["channels"]',
-            `    image: ${agenthippoImage('openclaw-gateway')}`,
-            '    env_file:',
-            '      - path: .env',
-            '        required: false',
-            '    volumes: ["openclaw-config:/root/.openclaw"]',
-            '    expose: ["18789"]',
-        ]
-        : [];
-    const agentExtra = [
-        '    environment:',
-        '      # Routed through LiteLLM only when the gateway profile is up; harmless otherwise.',
-        '      AGENTHIPPO_LITELLM_BASE_URL: http://litellm:4443',
-        ...(channels ? ['      OPENCLAW_GATEWAY_URL: ws://openclaw-gateway:18789'] : []),
-        ...agentGateway,
-    ];
-    const compose = [
-        '# T2 team/fleet stack (serve-v3 §8). Profiles:',
-        '#   default              = agent only (Docker network; no host port — use deploy/run.sh for T0.5a VPN)',
-        '#   --profile edge       = + Caddy + oauth2-proxy (Google SSO)',
-        '#   --profile tunnel     = + cloudflared (with edge; route hostname → http://caddy:80)',
-        '#   --profile gateway    = + LiteLLM + Spotlight OTEL collector',
-        '#   --profile channels   = + OpenClaw gateway (Agent Anywhere)',
-        '# e.g.: docker compose -f deploy/docker-compose.yml --profile edge --profile tunnel up -d',
-        'services:',
-        ...renderAgentComposeService(ctx, agentExtra),
-        ...renderEdgeComposeServices(ctx.ingress === 'edge-fed'),
-        ...renderTunnelComposeServices(),
-        '  # LiteLLM gateway — self-contained image bakes the Spotlight config + OTEL hooks',
-        '  # (build: docker build -f extensions/agentide/scripts/Dockerfile.litellm -t this-tag .)',
-        '  litellm:',
-        '    profiles: ["gateway"]',
-        `    image: ${agenthippoImage('litellm-gateway')}`,
-        '    env_file:',
-        '      - path: .env',
-        '        required: false',
-        '    environment:',
-        '      OTEL_EXPORTER: otlp_http',
-        '      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4318',
-        '    # The image defaults to --host 127.0.0.1 (safe when someone runs it bare).',
-        '    # Here it must answer the agent container over the compose network, so bind',
-        '    # 0.0.0.0 — and keep `expose:` rather than `ports:` so it is never reachable',
-        '    # from the host. Requires general_settings.master_key in the baked config.',
-        '    command: ["--config", "/config/litellm.config.yaml", "--port", "4443", "--host", "0.0.0.0"]',
-        '    expose: ["4443"]',
-        '    depends_on: [otel-collector]',
-        '',
-        '  # Spotlight collector → JSONL traces volume (query with query-analytics.sh / DuckDB).',
-        '  otel-collector:',
-        '    profiles: ["gateway"]',
-        '    image: otel/opentelemetry-collector-contrib:0.118.0',
-        '    command: ["--config=/etc/otel-collector.yaml"]',
-        '    # Root so the collector can create /data/analytics on a fresh named volume',
-        '    # (the contrib image runs non-root; the volume root is root-owned).',
-        '    user: "0:0"',
-        '    environment: { AGENT_HOME_DIR: /data }',
-        '    volumes:',
-        '      - ./otel-collector.yaml:/etc/otel-collector.yaml:ro',
-        '      - spotlight-traces:/data',
-        ...channelsService,
-        '',
-        'volumes:',
-        '  agenthippo-state:',
-        '  auth-broker-data:',
-        '  spotlight-traces:',
-        ...(channels ? ['  openclaw-config:'] : []),
-        '',
-    ].join('\n');
-    return {
-        'Dockerfile': sharedDockerfile(ctx),
-        'Dockerfile.auth-broker': renderAuthBrokerDockerfile(),
-        'docker-compose.yml': compose,
-        'Caddyfile': renderCaddyfile(ctx),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'cloudflared.yml': renderCloudflaredYml(hostname),
-        'run-edge-tunnel.sh': renderEdgeTunnelUpScript(hostname),
-        'otel-collector.yaml': OTEL_COLLECTOR_COMPOSE_YAML,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — T2 team/fleet`,
-            '',
-            '- Agent only (VPN): `docker compose -f deploy/docker-compose.yml up -d`',
-            '- + Tunnel + Google SSO: `bash deploy/run-edge-tunnel.sh` (see vm README T0.5b).',
-            '- + LiteLLM gateway + Spotlight: `--profile gateway`.',
-            '- + Agent Anywhere: `--profile channels` + gateway env vars in `.env`.',
-            '',
-            'Profiles compose: e.g. `--profile gateway --profile edge --profile tunnel up -d`.',
-            'LiteLLM must speak Anthropic API format — our gateway image does.',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-/**
- * Cloud Run multi-container (sidecars) service — agent + LiteLLM + Spotlight OTEL collector,
- * the Cloud Run analogue of the compose `--profile gateway` stack. Sidecars share the pod's
- * localhost, so the agent routes to LiteLLM on 127.0.0.1:4443 and LiteLLM exports OTLP to the
- * collector on 127.0.0.1:4318; the collector writes JSONL to the GCS-backed /state volume
- * (query with query-analytics.sh / DuckDB). Deployed via `gcloud run services replace`.
- *
- * Placeholders (${SERVICE} ${IMAGE} ${STATE_BUCKET} ${LITELLM_IMAGE}) are substituted by the
- * deploy script — kept as a checked-in template so the wiring is reviewable in git.
- */
-/**
- * The env var the LiteLLM gateway reads for a model's provider key — must match the
- * `os.environ/<NAME>` reference in the gateway's model map (e.g. gpt-5.5 → OPENAI_API_KEY).
- */
-function litellmProviderKeyEnv(model) {
-    const m = (model || '').toLowerCase();
-    if (m === 'ah-auto') {
-        return 'AGENTHIPPO_GATEWAY_KEY';
-    }
-    if (m.includes('codex')) {
-        return 'OPENAI_CODEX_API_KEY';
-    }
-    if (m.includes('gpt') || m.includes('openai')) {
-        return 'OPENAI_API_KEY';
-    }
-    if (m.includes('claude') || m.includes('anthropic')) {
-        return 'ANTHROPIC_API_KEY';
-    }
-    return 'OPENAI_API_KEY';
-}
-/** True when the pack uses the managed Auto placeholder (routes via gateway.agenthippo.ai). */
-function isAhAutoModel(model) {
-    return (model || '').trim().toLowerCase() === 'ah-auto';
-}
-/** Org gateway base URL — agent gateway-direct mode points here (same as colocated agents). */
-const AGENTHIPPO_GATEWAY_BASE_URL = 'https://gateway.agenthippo.ai/v1';
-function usesGatewayDirect(ctx) {
-    return ctx.modelRouting === 'gateway';
-}
-/** The model-provider API host this pack's engine actually talks to — the one thing every
- *  target's container needs outbound network access to. Generalizes the `spcs` target's
- *  enforced "one EAI to api.anthropic.com" egress allowlist into a documented note every
- *  other target ships too (governance layer, PLAN/deploy.md §6). */
-function egressHost(ctx) {
-    if (ctx.engine.trim().toLowerCase() === 'cursor') {
-        return 'api2.cursor.sh';
-    }
-    if (isAhAutoModel(ctx.model)) {
-        return 'gateway.agenthippo.ai';
-    }
-    const m = (ctx.model || '').toLowerCase();
-    if (m.includes('codex') || m.includes('gpt') || m.includes('openai')) {
-        return 'api.openai.com';
-    }
-    return 'api.anthropic.com';
-}
-/** Egress allowlist note, appended to a target's README (governance layer). */
-function renderEgressNote(ctx) {
-    const sidecarNote = usesGatewayDirect(ctx)
-        ? '.'
-        : ' — and, if the LiteLLM gateway/Spotlight sidecar is enabled, its own outbound is the same host.';
-    return [
-        `**Egress:** this container only needs outbound access to \`${egressHost(ctx)}:443\` (your model provider)${sidecarNote}`,
-        'Restrict egress to this allowlist if your org requires it.',
-        '',
-    ];
-}
-/**
- * Data & access summary (governance layer, PLAN/deploy.md §3/§6): one generated page
- * enumerating what secrets exist, what leaves the network, and the blast radius per
- * component — pre-answering the questions a security review asks before it asks them.
- * The `spcs` target's "one EAI to api.anthropic.com" README line is the model this
- * generalizes to every target instead of leaving it to just one platform.
- */
-function renderDataAccessSummary(ctx, target, edge, fed, colocate) {
-    const secrets = [
-        `\`${litellmProviderKeyEnv(ctx.model)}\` (or the pack's configured provider key) — your model provider credential`,
-    ];
-    const blastRadius = [
-        '**agent container** — can reach your model provider and read/write its own state volume. ' +
-            'Never holds the JWT signing secret or any OAuth client secret (`.env` vs `.env.auth` split).',
-    ];
-    if (edge) {
-        secrets.push('`AGENTHIPPO_AUTH_JWT_SECRET` — signs/verifies IDE bootstrap tokens (auth-broker only, never the agent)');
-        blastRadius.push('**auth-broker** — holds the JWT signing secret' +
-            (fed ? ' (shared with the central IdP)' : '') +
-            '; mints/verifies IDE tokens. Does not hold model provider credentials.');
-        if (!fed) {
-            secrets.push('`OAUTH2_PROXY_CLIENT_SECRET` + `OAUTH2_PROXY_COOKIE_SECRET` — this deployment\'s own Google OAuth client (oauth2-proxy only, never the agent)');
-            blastRadius.push('**oauth2-proxy** — holds this deployment\'s Google OAuth client secret; terminates the Google ' +
-                'login flow. Does not hold the JWT signing secret or model credentials.');
-        }
-    }
-    else if (colocate) {
-        blastRadius.push('**this deployment holds no auth secrets at all** — identity is verified entirely by the ' +
-            'org IdP\'s own auth-broker (see `agent-route.caddy`); nothing here signs or stores a JWT secret.');
-    }
-    return [
-        `# Data & access summary — ${ctx.packName} (${target}${ctx.ingress ? ` / ${ctx.ingress}` : ''})`,
-        '',
-        'Generated by `agenthippo deploy init` — answers the questions a security review asks first.',
-        '',
-        '## Secrets',
-        ...secrets.map((s) => `- ${s}`),
-        '',
-        '## Egress',
-        `- Outbound network access is needed only to \`${egressHost(ctx)}:443\` (your model provider).`,
-        ...(edge && fed ? [
-            '- API/Bearer requests are verified locally against the shared JWT secret — no network call ' +
-                'to the central IdP per request. The one-time browser login flow (unauthenticated visitors) ' +
-                'does redirect to the central IdP\'s public URL to sign in.',
-        ] : []),
-        ...(edge && !fed ? [
-            '- Google SSO calls `accounts.google.com` during login only (oauth2-proxy); no other third party is contacted per request.',
-        ] : []),
-        ...(colocate ? [
-            '- Identity is verified via the org IdP\'s own auth-broker over the shared private docker ' +
-                'network (`agenthippo-idp-colocate`), not a public network call. The one-time browser login ' +
-                'flow (unauthenticated visitors) still redirects to the central IdP\'s public URL to sign in.',
-        ] : []),
-        '',
-        '## Blast radius per component',
-        ...blastRadius.map((b) => `- ${b}`),
-        '',
-    ].join('\n');
-}
-function renderCloudrunServiceYaml(ctx) {
-    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    return [
-        '# Cloud Run multi-container: agent (ingress) + LiteLLM + Spotlight OTEL collector.',
-        '# Generated by `agenthippo deploy init`. Deploy with `bash deploy/cloudrun-deploy.sh`',
-        '# (it substitutes ${...} and runs `gcloud run services replace`). Traces land in the GCS',
-        '# /state volume at /state/analytics/traces — query with query-analytics.sh (DuckDB).',
-        'apiVersion: serving.knative.dev/v1',
-        'kind: Service',
-        'metadata:',
-        '  name: ${SERVICE}',
-        'spec:',
-        '  template:',
-        '    metadata:',
-        '      annotations:',
-        '        # Sidecars need CPU between requests (the collector flushes async); no scale-to-zero throttle.',
-        '        run.googleapis.com/cpu-throttling: "false"',
-        '        run.googleapis.com/startup-cpu-boost: "true"',
-        '        # Start order: collector → litellm → agent, so traces are never dropped on cold start.',
-        "        run.googleapis.com/container-dependencies: '{\"litellm\":[\"otel-collector\"],\"agent\":[\"litellm\"]}'",
-        '        autoscaling.knative.dev/maxScale: "1"',
-        // An inbound channel socket can't scale to zero — pin one always-on instance.
-        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
-        '    spec:',
-        '      timeoutSeconds: 3600',
-        '      containers:',
-        '        # Ingress container — the ONLY one with a port. Routes the engine through LiteLLM.',
-        '        - name: agent',
-        '          image: ${IMAGE}',
-        '          ports:',
-        '            - name: http1',
-        `              containerPort: ${ctx.port}`,
-        '          env:',
-        '            - { name: AGENTHIPPO_HOME, value: /state }',
-        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
-        // Pin serve to trust ONLY the IAP-verified header, so an authenticated caller
-        // cannot impersonate another user via a spoofed X-Agent-User header. The deploy
-        // script fills this with x-goog-authenticated-user-email when IAP is enabled, or
-        // leaves it empty (unpinned) during an ENABLE_IAP=0 bootstrap deploy.
-        '            - { name: AGENTHIPPO_IDENTITY_HEADER, value: "${IDENTITY_HEADER_VALUE}" }',
-        agentServeHostEnvYaml(),
-        '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
-        '            - name: AGENTHIPPO_LITELLM_API_KEY',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
-        '          volumeMounts:',
-        '            - { name: state, mountPath: /state }',
-        '        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight cost/latency/tokens).',
-        '        - name: litellm',
-        '          image: ${LITELLM_IMAGE}',
-        '          env:',
-        '            - { name: OTEL_EXPORTER, value: otlp_http }',
-        '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }',
-        '            - name: LITELLM_MASTER_KEY',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
-        `            # Upstream provider key for ${ctx.model || 'this model'} (matches the gateway's os.environ/${providerKeyEnv} ref).`,
-        '            # Other models need their own key var — rename to match your model map.',
-        `            - name: ${providerKeyEnv}`,
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
-        '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.',
-        '        - name: otel-collector',
-        '          image: otel/opentelemetry-collector-contrib:0.118.0',
-        '          args: ["--config=/etc/otel/config.yaml"]',
-        '          env:',
-        '            - { name: AGENT_HOME_DIR, value: /state }',
-        '          volumeMounts:',
-        '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }',
-        '            - { name: state, mountPath: /state }',
-        '      volumes:',
-        '        - name: state',
-        '          csi:',
-        '            driver: gcsfuse.run.googleapis.com',
-        '            volumeAttributes:',
-        '              bucketName: ${STATE_BUCKET}',
-        '        - name: otel-config',
-        '          secret:',
-        '            secretName: ${SERVICE}-otel-config',
-        '            items:',
-        '              - { key: latest, path: config.yaml }',
-        '',
-    ].join('\n');
-}
-/** Anchor a generated deploy script to the staging root (parent of `deploy/`). The script
- * lives at <staging>/deploy/<script>.sh; `docker build -f deploy/Dockerfile .` and the
- * `deploy/service.yaml` / `deploy/.env` relative paths must resolve against the staging
- * root, so the script works no matter which cwd it is invoked from. (compose-based scripts
- * don't need this — `build: context: ..` in docker-compose.yml resolves relative to the
- * compose file itself.) */
-function anchorToStagingRoot() {
-    return [
-        '# Anchor to the staging root (parent of deploy/) — this script runs from any cwd.',
-        'cd "$(dirname "$0")/.."',
-    ];
-}
-/** IAP finalization (corp SSO). `--iap` is beta-track only on `gcloud run`, and public
- * access on an existing service is controlled via the run.invoker IAM binding (there
- * is no `--no-allow-unauthenticated` flag on `services update`). So: enable IAP on the
- * beta track, strip any allUsers invoker binding (keeps the service private), and grant
- * IAP-secured Web User to each principal in IAP_MEMBERS (space-separated). Used by both
- * the Spotlight deploy (`services replace`) and the T1-generic deploy (`run deploy`). */
-function iapFinalizeLines() {
-    return [
-        '# Ingress: corp SSO via IAP (forwards X-Goog-Authenticated-User-Email → user_id).',
-        '# --iap is beta-track only on `gcloud run`; public access on an existing service is',
-        '# controlled via the run.invoker IAM binding (no --no-allow-unauthenticated on',
-        '# `services update`). So: enable IAP on the beta track, strip any allUsers invoker',
-        '# binding (keeps the service private), and grant IAP-secured Web User to each',
-        '# principal in IAP_MEMBERS (space-separated, e.g.',
-        "#   IAP_MEMBERS='user:you@corp.com serviceAccount:sa@project.iam.gserviceaccount.com'",
-        '# ). Omit IAP_MEMBERS to rely on bindings you manage out-of-band.',
-        'if [[ "${ENABLE_IAP:-1}" == "1" ]]; then',
-        '  gcloud beta run services update "$SERVICE" --region "$REGION" --iap',
-        '  gcloud run services remove-iam-policy-binding "$SERVICE" --region "$REGION" \\',
-        '    --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true',
-        '  for m in ${IAP_MEMBERS:-}; do',
-        '    gcloud beta iap web add-iam-policy-binding \\',
-        '      --resource-type=cloud-run --service="$SERVICE" --region="$REGION" \\',
-        '      --member="$m" --role=roles/iap.httpsResourceAccessor',
-        '  done',
-        'fi',
-    ];
-}
-/** Deploy script for the Cloud Run Spotlight (multi-container) stack. */
-function renderCloudrunSpotlightDeploy(ctx) {
-    return [
-        '#!/usr/bin/env bash',
-        `# Cloud Run + Spotlight: agent + LiteLLM + OTEL collector sidecars (engine: ${ctx.engine}${ctx.model ? `, model ${ctx.model}` : ''}).`,
-        '# Traces persist in the GCS /state bucket; query with query-analytics.sh (DuckDB).',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        `SERVICE="${ctx.packName}"`,
-        'REGION="${REGION:-us-central1}"',
-        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
-        'REPO="${ARTIFACT_REPO:-agenthippo}"',
-        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('litellm-gateway')}}"`,
-        'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
-        '# LITELLM_KEY = the proxy key the agent presents to LiteLLM (and LiteLLM master key).',
-        'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
-        `# PROVIDER_KEY = upstream key the gateway uses for ${ctx.model || 'your model'} (gateway reads ${litellmProviderKeyEnv(ctx.model)}).`,
-        'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<upstream provider key>}"',
-        '',
-        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
-        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
-        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
-        '',
-        '# Rewrite the runtime base to this project Artifact Registry. Customer artifacts pin a',
-        '# dated ghcr.io/agenthippoai/runtime tag; mirror that exact tag into AR. No-op if already AR.',
-        'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
-        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
-        'docker push "$IMAGE"',
-        '',
-        '# Secrets: Spotlight collector config + the LiteLLM proxy key.',
-        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
-        'ensure_secret "${SERVICE}-otel-config"; gcloud secrets versions add "${SERVICE}-otel-config" --data-file=deploy/otel-collector.yaml',
-        'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-',
-        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
-        '',
-        '# IAP (finalized below) forwards X-Goog-Authenticated-User-Email; pin serve to trust ONLY',
-        '# that header so an authenticated caller cannot impersonate another user via a spoofed',
-        '# X-Agent-User header. Skipped when ENABLE_IAP=0 (first-deploy bootstrap) since IAP never',
-        '# sets the header then.',
-        'IDENTITY_HEADER_VALUE=""',
-        '[[ "${ENABLE_IAP:-1}" == "1" ]] && IDENTITY_HEADER_VALUE="x-goog-authenticated-user-email" || true',
-        '',
-        '# Render the multi-container template for this project (sed — no gettext dependency) and deploy.',
-        'RENDERED="$(mktemp)"',
-        'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\',
-        '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" -e "s|\\${STATE_BUCKET}|${STATE_BUCKET}|g" \\',
-        '    -e "s|\\${IDENTITY_HEADER_VALUE}|${IDENTITY_HEADER_VALUE}|g" \\',
-        '    deploy/service.yaml > "$RENDERED"',
-        'gcloud run services replace "$RENDERED" --region "$REGION"',
-        '',
-        ...iapFinalizeLines(),
-        '',
-        '# Grant the runtime SA access to the secrets if needed:',
-        '#   SA="$(gcloud run services describe "$SERVICE" --region "$REGION" --format=\'value(spec.template.spec.serviceAccountName)\')"',
-        '#   for s in "${SERVICE}-otel-config" "${SERVICE}-litellm-key"; do gcloud secrets add-iam-policy-binding "$s" --member="serviceAccount:$SA" --role=roles/secretmanager.secretAccessor; done',
-        '',
-    ].join('\n');
-}
-/**
- * Option B — AgentHippo edge on Cloud Run. Caddy is the ingress (the only container with a
- * port) and fronts the agent with the SAME SSO flow the IDE already uses for `remote-vm`:
- *   - Browser  → oauth2-proxy (Google SSO) → X-Agent-User → agent
- *   - IDE/API  → auth-broker validates the AgentHippo Bearer JWT → X-Agent-User → agent
- * No IAP, so the IDE points `spec.remote.url` straight at the public hostname and the existing
- * `ensureSignedIn` + `buildServeAuthHeaders` path works unchanged.
- *
- * Cloud Run multi-container shares the pod's network namespace, so every sidecar is reached
- * via `localhost:<port>` (NOT docker-DNS names like the compose edge). Cloud Run terminates TLS
- * at the edge, so Caddy listens on HTTP `:{$PORT}` (`auto_https off`). The agent is NOT the
- * ingress here, so it listens on a distinct internal port (EDGE_AGENT_PORT) to avoid clashing
- * with Caddy on $PORT. The Caddyfile renderers themselves live in `deploy/layers/identity.ts`
- * (`renderSidecarEdgeCaddyfile`/`renderSidecarFedCaddyfile`) — reused verbatim by aws-ecs and
- * azure-container-apps, which share this exact "TLS in front, one localhost" shape.
- */
-/** Cloud Run multi-container service behind the AgentHippo edge (Option B). Caddy is ingress. */
-function renderCloudrunEdgeServiceYaml(ctx) {
-    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
-    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT })
-        .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
-    // Start order: sidecars before caddy (ingress) so Caddy's first request finds everyone up.
-    const deps = isCursor
-        ? '{"caddy":["agent","oauth2-proxy","auth-broker"]}'
-        : '{"caddy":["agent","oauth2-proxy","auth-broker"],"agent":["litellm"],"litellm":["otel-collector"]}';
-    const lines = [
-        '# Cloud Run + AgentHippo edge (Option B): Caddy (ingress) + oauth2-proxy + auth-broker',
-        '# + agent (+ LiteLLM + OTEL collector for Spotlight). No IAP — Caddy gates via SSO,',
-        '# so the IDE hits the public hostname directly with its AgentHippo Bearer token.',
-        '# Generated by `agenthippo deploy init --target cloudrun --ingress edge`.',
-        'apiVersion: serving.knative.dev/v1',
-        'kind: Service',
-        'metadata:',
-        '  name: ${SERVICE}',
-        'spec:',
-        '  template:',
-        '    metadata:',
-        '      annotations:',
-        '        run.googleapis.com/cpu-throttling: "false"',
-        '        run.googleapis.com/startup-cpu-boost: "true"',
-        `        run.googleapis.com/container-dependencies: '${deps}'`,
-        '        autoscaling.knative.dev/maxScale: "1"',
-        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
-        '    spec:',
-        '      timeoutSeconds: 3600',
-        '      containers:',
-        '        # Ingress — the ONLY container with a port. SSO edge for browsers + IDE Bearer.',
-        '        - name: caddy',
-        '          image: caddy:2.8-alpine',
-        '          ports:',
-        '            - name: http1',
-        `              containerPort: ${ctx.port}`,
-        '          volumeMounts:',
-        '            - { name: caddy-config, mountPath: /etc/caddy, readOnly: true }',
-        '        # Auth broker — validates IDE Bearer JWTs (/api/ide/me) + IDE sign-in (/oauth/*).',
-        '        # Reuses the agent runtime image (the `agenthippo` CLI ships `auth-broker`).',
-        '        - name: auth-broker',
-        '          image: ${IMAGE}',
-        '          args: ["auth-broker"]',
-        '          env:',
-        '            - { name: AGENTHIPPO_AUTH_PORT, value: "9780" }',
-        '            - { name: AGENTHIPPO_AUTH_DATA_DIR, value: /data }',
-        '            - { name: AGENTHIPPO_AUTH_PUBLIC_URL, value: https://${PUBLIC_HOSTNAME} }',
-        '            - { name: AGENTHIPPO_AUTH_ALLOWED_DOMAINS, value: ${ALLOWED_DOMAINS} }',
-        '            - name: AGENTHIPPO_AUTH_JWT_SECRET',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-auth-jwt-secret, key: latest }',
-        '        # oauth2-proxy — Google SSO for browser clients (provider=google).',
-        '        - name: oauth2-proxy',
-        '          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
-        '          env:',
-        '            - { name: OAUTH2_PROXY_HTTP_ADDRESS, value: 0.0.0.0:4180 }',
-        '            - { name: OAUTH2_PROXY_UPSTREAMS, value: file:///dev/null }',
-        '            - { name: OAUTH2_PROXY_SET_XAUTHREQUEST, value: "true" }',
-        '            - { name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER, value: "true" }',
-        '            - { name: OAUTH2_PROXY_SKIP_PROVIDER_BUTTON, value: "true" }',
-        '            - { name: OAUTH2_PROXY_REVERSE_PROXY, value: "true" }',
-        '            - { name: OAUTH2_PROXY_PROVIDER, value: google }',
-        '            - { name: OAUTH2_PROXY_EMAIL_DOMAINS, value: ${ALLOWED_DOMAINS} }',
-        '            - { name: OAUTH2_PROXY_REDIRECT_URL, value: https://${PUBLIC_HOSTNAME}/oauth2/callback }',
-        '            - name: OAUTH2_PROXY_CLIENT_ID',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-oauth-client-id, key: latest }',
-        '            - name: OAUTH2_PROXY_CLIENT_SECRET',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-oauth-client-secret, key: latest }',
-        '            - name: OAUTH2_PROXY_COOKIE_SECRET',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-oauth-cookie-secret, key: latest }',
-        '        # Agent — serves www + /v1/* on localhost (NOT ingress). Routed through LiteLLM.',
-        '        - name: agent',
-        '          image: ${IMAGE}',
-        `          args: [${agentArgs}]`,
-        '          env:',
-        '            - { name: AGENTHIPPO_HOME, value: /state }',
-        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
-        agentServeHostEnvYaml(),
-        ...(isCursor ? [
-            '            - { name: AGENTHIPPO_CUSTOM_ENGINES_DIR, value: /engines }',
-            '            - name: CURSOR_API_KEY',
-            '              valueFrom:',
-            '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
-        ] : [
-            '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
-            '            - name: AGENTHIPPO_LITELLM_API_KEY',
-            '              valueFrom:',
-            '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
-        ]),
-        '          volumeMounts:',
-        '            - { name: state, mountPath: /state }',
-        ...startupProbeLines(identity_1.EDGE_AGENT_PORT, true),
-        ...resourceLimits('2000m', '2Gi'),
-    ];
-    if (!isCursor) {
-        lines.push('        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight).', '        - name: litellm', '          image: ${LITELLM_IMAGE}', '          env:', '            - { name: OTEL_EXPORTER, value: otlp_http }', '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }', '            - name: LITELLM_MASTER_KEY', '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }', `            # Upstream provider key for ${ctx.model || 'this model'} (matches the gateway's os.environ/${providerKeyEnv} ref).`, `            - name: ${providerKeyEnv}`, '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }', ...startupProbeLines(4443), ...resourceLimits('1000m', '1Gi'), '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.', '        - name: otel-collector', '          image: otel/opentelemetry-collector-contrib:0.118.0', '          args: ["--config=/etc/otel/config.yaml"]', '          env:', '            - { name: AGENT_HOME_DIR, value: /state }', '          volumeMounts:', '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }', '            - { name: state, mountPath: /state }', ...startupProbeLines(4318), ...resourceLimits('1000m', '512Mi'));
-    }
-    lines.push('      volumes:', '        - name: state', '          csi:', '            driver: gcsfuse.run.googleapis.com', '            volumeAttributes:', '              bucketName: ${STATE_BUCKET}', '        - name: caddy-config', '          secret:', '            secretName: ${SERVICE}-caddyfile', '            items:', '              - { key: latest, path: Caddyfile }');
-    if (!isCursor) {
-        lines.push('        - name: otel-config', '          secret:', '            secretName: ${SERVICE}-otel-config', '            items:', '              - { key: latest, path: config.yaml }');
-    }
-    lines.push('');
-    return lines.join('\n');
-}
-/** Deploy script for the Cloud Run edge (Option B): build, upsert secrets, replace, make public. */
-function renderCloudrunEdgeDeploy(ctx) {
-    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
-    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
-    const lines = [
-        '#!/usr/bin/env bash',
-        `# Cloud Run + AgentHippo edge (Option B): Caddy + oauth2-proxy + auth-broker front the agent.`,
-        `# Engine: ${ctx.engine}${modelNote}. No IAP — Caddy gates via SSO (Google for browsers, AgentHippo JWT for IDE).`,
-        '# The IDE points spec.remote.url straight at https://$PUBLIC_HOSTNAME (same flow as remote-vm).',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        `SERVICE="${ctx.packName}"`,
-        'REGION="${REGION:-us-central1}"',
-        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
-        'REPO="${ARTIFACT_REPO:-agenthippo}"',
-        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('litellm-gateway')}}"`,
-        '# Public hostname (custom domain mapped to the service) + the Google Workspace domain allowed by SSO.',
-        'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=your.edge.hostname (gcloud run domain-mappings create --service $SERVICE --domain ...)}"',
-        'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:?set ALLOWED_DOMAINS=yourworkspace.com (oauth2-proxy email domain + broker allowed domains)}"',
-        'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
-        '# Edge secrets (from .env.auth): Google OAuth client + cookie secret + AgentHippo JWT signing key.',
-        'OAUTH_CLIENT_ID="${OAUTH_CLIENT_ID:?set OAUTH_CLIENT_ID=<google oauth web client id>}"',
-        'OAUTH_CLIENT_SECRET="${OAUTH_CLIENT_SECRET:?set OAUTH_CLIENT_SECRET=<google oauth web client secret>}"',
-        'OAUTH_COOKIE_SECRET="${OAUTH_COOKIE_SECRET:?set OAUTH_COOKIE_SECRET=$(openssl rand -base64 32 | head -c 32)}"',
-        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=$(openssl rand -hex 32)}"',
-        ...(isCursor ? [
-            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<cursor api key>}"',
-        ] : [
-            '# LiteLLM proxy key + the upstream provider key the gateway uses for the model.',
-            'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
-            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<upstream provider key>}"',
-        ]),
-        '',
-        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
-        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
-        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
-        '',
-        '# One agent image serves both the agent and the auth-broker containers (CLI ships `auth-broker`).',
-        '# Rewrite the runtime base to this project Artifact Registry. Customer artifacts pin a',
-        '# dated ghcr.io/agenthippoai/runtime tag; mirror that exact tag into AR. No-op if already AR.',
-        'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
-        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
-        'docker push "$IMAGE"',
-        '',
-        '# Secrets: edge config + provider/litellm keys.',
-        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
-        'ensure_secret "${SERVICE}-caddyfile"; gcloud secrets versions add "${SERVICE}-caddyfile" --data-file=deploy/Caddyfile',
-        'ensure_secret "${SERVICE}-auth-jwt-secret"; printf %s "$AUTH_JWT_SECRET" | gcloud secrets versions add "${SERVICE}-auth-jwt-secret" --data-file=-',
-        'ensure_secret "${SERVICE}-oauth-client-id"; printf %s "$OAUTH_CLIENT_ID" | gcloud secrets versions add "${SERVICE}-oauth-client-id" --data-file=-',
-        'ensure_secret "${SERVICE}-oauth-client-secret"; printf %s "$OAUTH_CLIENT_SECRET" | gcloud secrets versions add "${SERVICE}-oauth-client-secret" --data-file=-',
-        'ensure_secret "${SERVICE}-oauth-cookie-secret"; printf %s "$OAUTH_COOKIE_SECRET" | gcloud secrets versions add "${SERVICE}-oauth-cookie-secret" --data-file=-',
-        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
-    ];
-    if (!isCursor) {
-        lines.push('ensure_secret "${SERVICE}-otel-config"; gcloud secrets versions add "${SERVICE}-otel-config" --data-file=deploy/otel-collector.yaml', 'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-');
-    }
-    lines.push('', '# Render the multi-container template for this project (sed — no gettext dependency) and deploy.', 'RENDERED="$(mktemp)"', 'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\', '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" -e "s|\\${STATE_BUCKET}|${STATE_BUCKET}|g" \\', '    -e "s|\\${PUBLIC_HOSTNAME}|${PUBLIC_HOSTNAME}|g" -e "s|\\${ALLOWED_DOMAINS}|${ALLOWED_DOMAINS}|g" \\', '    deploy/service.yaml > "$RENDERED"', 'gcloud run services replace "$RENDERED" --region "$REGION"', '', '# No IAP: Caddy is the gate, so Cloud Run itself must allow public ingress (allUsers invoker).', '# Without this, Cloud Run 403s before Caddy ever sees the request to run SSO.', 'gcloud run services add-iam-policy-binding "$SERVICE" --region "$REGION" \\', '  --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true', '', '# Map the custom domain (once): gcloud run domain-mappings create --service "$SERVICE" --region "$REGION" --domain "$PUBLIC_HOSTNAME"', '# Then add the CNAME Cloud Run prints to your DNS. Google OAuth Web client must list', '# https://$PUBLIC_HOSTNAME as an authorized origin + https://$PUBLIC_HOSTNAME/oauth2/callback as a redirect.', '', '# Grant the runtime SA access to the secrets if needed:', '#   SA="$(gcloud run services describe "$SERVICE" --region "$REGION" --format=\'value(spec.template.spec.serviceAccountName)\')"', '#   for s in "${SERVICE}-caddyfile" "${SERVICE}-auth-jwt-secret" "${SERVICE}-oauth-client-id" "${SERVICE}-oauth-client-secret" "${SERVICE}-oauth-cookie-secret" "${SERVICE}-provider-key"; do', '#     gcloud secrets add-iam-policy-binding "$s" --member="serviceAccount:$SA" --role=roles/secretmanager.secretAccessor', '#   done', '');
-    return lines.join('\n');
-}
-function cloudrunArtifacts(ctx) {
-    const inbound = Boolean(ctx.gatewayChannels?.trim()); // 1b: holds an always-listening channel socket
-    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
-    // Option B: AgentHippo edge on Cloud Run (Caddy + auth-broker + oauth2-proxy ingress).
-    // Same SSO flow the IDE already uses for remote-vm — point spec.remote.url at the public
-    // hostname and the existing ensureSignedIn + Bearer path works. No IAP, no IDE changes.
-    if (ctx.ingress === 'edge') {
-        return cloudrunEdgeArtifacts(ctx, inbound, isCursor);
-    }
-    // A′: federated edge — Caddy + auth-broker only (no oauth2-proxy). Google login stays at the
-    // central IdP; this agent verifies the shared .agenthippo.ai JWT. Scales to N agents with zero
-    // per-service OAuth client config. No IAP, no IDE changes.
-    if (ctx.ingress === 'edge-fed') {
-        return cloudrunFedArtifacts(ctx, inbound, isCursor);
-    }
-    // Model-routed engines (claude/codex) get the Spotlight multi-container stack: the agent
-    // calls a LiteLLM sidecar (so a `litellm/*` model resolves in-pod) and the OTEL collector
-    // lands cost/latency/token traces in the GCS /state volume. This also resolves the
-    // CLAUDE_CODE_USE_VERTEX-vs-LiteLLM contradiction — provider routing now lives on the gateway.
-    // Cursor talks to its own API (not through LiteLLM), so it keeps the lean single-container path.
-    if (!isCursor) {
-        return {
-            'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-            'www/index.html': renderLandingPage(ctx.packName),
-            'service.yaml': renderCloudrunServiceYaml(ctx),
-            'otel-collector.yaml': OTEL_COLLECTOR_COMPOSE_YAML,
-            'cloudrun-deploy.sh': renderCloudrunSpotlightDeploy(ctx),
-            'README.md': [
-                `# Deploy: ${ctx.packName} — Cloud Run + Spotlight (multi-container)`,
-                '',
-                `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
-                '',
-                'Three sidecars share the pod\'s localhost (Cloud Run multi-container):',
-                '- **agent** (ingress) → routes the engine to `http://localhost:4443`',
-                '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
-                '- **otel-collector** → writes JSONL traces to the GCS `/state` volume (`/state/analytics/traces`).',
-                '',
-                '```bash',
-                'gcloud storage buckets create gs://<your-state-bucket>   # once',
-                'export STATE_BUCKET=<your-state-bucket> LITELLM_KEY=<litellm proxy key>',
-                'bash deploy/cloudrun-deploy.sh   # builds linux/amd64, creates secrets, `gcloud run services replace service.yaml`',
-                '```',
-                '',
-                '`service.yaml` is the multi-container template (checked in so the wiring is reviewable);',
-                'the deploy script substitutes `${SERVICE} ${IMAGE} ${STATE_BUCKET} ${LITELLM_IMAGE}`.',
-                'Provider creds (Anthropic key / Vertex ADC / OpenAI …) go on the **litellm** sidecar, not the agent.',
-                '',
-                inbound
-                    ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
-                    : '**No inbound channel (1a):** scales to zero; traces + sessions persist on the GCS `/state` volume.',
-                '',
-                '**Spotlight:** once traffic flows, query the GCS-backed traces with `query-analytics.sh` (DuckDB) against `/state/analytics/traces`.',
-                '',
-                '**Lean alternative (no Spotlight):** a single-container deploy that calls a provider directly',
-                '(or an external LiteLLM) — set `AGENTHIPPO_LITELLM_BASE_URL` to your endpoint and drop the sidecars.',
-                '',
-                ...renderEgressNote(ctx),
-            ].join('\n'),
-        };
-    }
-    // 1a (no inbound channel): scale-to-zero OK. 1b (inbound socket): pin a single,
-    // always-on instance with CPU always allocated so the socket survives.
-    const instanceFlags = inbound
-        ? '  --min-instances 1 --max-instances 1 --no-cpu-throttling \\'
-        : '  --min-instances 0 --max-instances 1 \\';
-    const runEnvVars = isCursor
-        ? 'AGENTHIPPO_NO_AUTO_INSTALL=1,AGENTHIPPO_HOME=/state,AGENTHIPPO_CUSTOM_ENGINES_DIR=/engines'
-        : 'CLAUDE_CODE_USE_VERTEX=1,AGENTHIPPO_NO_AUTO_INSTALL=1,AGENTHIPPO_HOME=/state';
-    const runSecrets = isCursor
-        ? 'CURSOR_API_KEY=agenthippo-cursor-key:latest'
-        : undefined;
-    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
-    const deploy = [
-        '#!/usr/bin/env bash',
-        `# T1-generic: Cloud Run with built-in IAP (corp SSO, no load balancer).`,
-        `# Engine: ${ctx.engine}${modelNote}. IAP forwards X-Goog-Authenticated-User-Email → user_id.`,
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        `SERVICE="${ctx.packName}"`,
-        'REGION="${REGION:-us-central1}"',
-        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
-        'REPO="${ARTIFACT_REPO:-agenthippo}"',
-        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        '# Q1: durable state. Cloud Run local disk is ephemeral (wiped on scale-to-zero),',
-        '# so mount a GCS bucket at /state — sessions/provider-sessions/analytics survive.',
-        'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
-        '',
-        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
-        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
-        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
-        '',
-        '# Build from pack root; Dockerfile is deploy/Dockerfile (not pack root — gcloud --source . misses it).',
-        '# Rewrite the runtime base to this project Artifact Registry. Customer artifacts pin a',
-        '# dated ghcr.io/agenthippoai/runtime tag; mirror that exact tag into AR. No-op if already AR.',
-        'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
-        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
-        'docker push "$IMAGE"',
-        '',
-        '# IAP (when enabled below) forwards X-Goog-Authenticated-User-Email; pin serve to trust',
-        '# ONLY that header so an authenticated caller cannot impersonate another user via a',
-        '# spoofed X-Agent-User header. Skipped when ENABLE_IAP=0 (first-deploy bootstrap) since',
-        '# IAP never sets the header then — pinning to an absent header would make every request',
-        '# anonymous instead of leaving body-supplied identity usable during bootstrap.',
-        'IDENTITY_ENV=""',
-        '[[ "${ENABLE_IAP:-1}" == "1" ]] && IDENTITY_ENV=",AGENTHIPPO_IDENTITY_HEADER=x-goog-authenticated-user-email" || true',
-        '',
-        '# Deploy private (no --allow-unauthenticated). IAP + role grants are applied below on the beta track.',
-        'gcloud run deploy "$SERVICE" \\',
-        '  --image "$IMAGE" \\',
-        '  --no-allow-unauthenticated \\',
-        `  --port ${ctx.port} \\`,
-        instanceFlags,
-        '  --timeout 3600 \\',
-        '  --add-volume name=state,type=cloud-storage,bucket="$STATE_BUCKET" \\',
-        '  --add-volume-mount volume=state,mount-path=/state \\',
-        `  --set-env-vars "${runEnvVars}\${IDENTITY_ENV}" \\`,
-        ...(runSecrets ? [`  --set-secrets ${runSecrets} \\`] : []),
-        '  --region "$REGION"',
-        '',
-        ...iapFinalizeLines(),
-        '',
-        '# Notes:',
-        inbound
-            ? '#  - INBOUND channel (1b): pinned min=max=1 + CPU-always-on so the socket stays alive (can\'t scale to zero).'
-            : '#  - No inbound channel (1a): scales to zero; state on the GCS volume survives the instance dying.',
-        '#  - GCS-FUSE adds latency on session read/write vs local disk; fine for chat, watch for heavy I/O.',
-        isCursor
-            ? `#  - Cursor engine: CURSOR_API_KEY secret + ${agenthippoImage('runtime', 'cursor')} base (AGENTHIPPO_CUSTOM_ENGINES_DIR=/engines).`
-            : '#  - Vertex path = keyless Claude on your existing GCP entitlement; swap for ANTHROPIC_API_KEY if preferred.',
-        '#  - First deploy without IAP org setup: ENABLE_IAP=0 bash deploy/cloudrun-deploy.sh',
-        '',
-    ].join('\n');
-    const secretSteps = isCursor
-        ? [
-            '2. `gcloud secrets create agenthippo-cursor-key --data-file=-` (paste your `CURSOR_API_KEY`).',
-            '3. Grant Cloud Run access: `gcloud secrets add-iam-policy-binding agenthippo-cursor-key --member=serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com --role=roles/secretmanager.secretAccessor`.',
-            '4. `bash deploy/cloudrun-deploy.sh` — builds linux/amd64, pushes to Artifact Registry, deploys with GCS /state.',
-        ]
-        : [
-            '2. `bash deploy/cloudrun-deploy.sh` — builds linux/amd64, pushes to Artifact Registry, deploys with `--iap` + GCS /state.',
-        ];
-    return {
-        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'cloudrun-deploy.sh': deploy,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — Cloud Run (T1-generic)`,
-            '',
-            `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
-            '',
-            '1. `gcloud storage buckets create gs://<your-state-bucket>` then `export STATE_BUCKET=<your-state-bucket>`.',
-            ...secretSteps,
-            '',
-            'SSO + ingress: built-in IAP (`X-Goog-Authenticated-User-Email`). **Q1:** `/state` is a mounted GCS bucket.',
-            ctx.gatewayChannels ? '**Inbound channel (1b):** pinned single always-on instance (no scale-to-zero).' : '**No inbound channel (1a):** scales to zero; state persists on GCS.',
-            '',
-            '**Browser:** open the service URL → Google login → chat UI at `/` (same as vm `deploy/www/index.html`).',
-            '',
-            '**Verify** (smoke test via local proxy — bypasses IAP auth for direct testing):',
-            '```bash',
-            `gcloud run services proxy ${ctx.packName} --region "\${REGION:-us-central1}" &`,
-            'PROXY=http://127.0.0.1:8080',
-            'curl -s "$PROXY/ready"',
-            'curl -s -XPOST "$PROXY/v1/chat" \\',
-            '  -H "X-Goog-Authenticated-User-Email: accounts.google.com:you@corp.com" \\',
-            '  -H "Content-Type: application/json" \\',
-            '  -d \'{"message":"Reply with exactly: CLOUDRUN_OK","session_id":"cr-1"}\'',
-            '```',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-/** Option B artifacts: Cloud Run behind the AgentHippo edge (Caddy + auth-broker + oauth2-proxy). */
-function cloudrunEdgeArtifacts(ctx, inbound, isCursor) {
-    const sidecars = isCursor
-        ? 'Caddy (ingress) + oauth2-proxy + auth-broker + agent.'
-        : 'Caddy (ingress) + oauth2-proxy + auth-broker + agent + LiteLLM + OTEL collector (Spotlight).';
-    const files = {
-        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'Caddyfile': (0, identity_1.renderSidecarEdgeCaddyfile)(),
-        'service.yaml': renderCloudrunEdgeServiceYaml(ctx),
-        'cloudrun-deploy.sh': renderCloudrunEdgeDeploy(ctx),
-    };
-    if (!isCursor) {
-        files['otel-collector.yaml'] = OTEL_COLLECTOR_COMPOSE_YAML;
-    }
-    files['README.md'] = [
-        `# Deploy: ${ctx.packName} — Cloud Run + AgentHippo edge (Option B)`,
-        '',
-        `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
-        '',
-        `${sidecars} Sidecars share the pod\'s localhost (Cloud Run multi-container):`,
-        '- **caddy** (ingress, the only port) → SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer',
-        `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (NOT ingress)`,
-        '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`) + IDE sign-in (`/oauth/*`)',
-        '- **oauth2-proxy** → Google SSO for browser clients (`provider=google`)',
-        ...(isCursor ? [] : [
-            '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
-            '- **otel-collector** → writes JSONL traces to the GCS `/state` volume',
-        ]),
-        '',
-        '**No IAP** — Caddy is the gate, so the IDE points `spec.remote.url` straight at',
-        '`https://$PUBLIC_HOSTNAME` and the existing AgentHippo SSO flow works (same as `remote-vm`).',
-        'Cloud Run itself is public (`allUsers` invoker) so traffic can reach Caddy to be authed.',
-        '',
-        '```bash',
-        'gcloud storage buckets create gs://<state-bucket>                 # once',
-        'cp deploy/.env.example deploy/.env && cp deploy/.env.auth.example deploy/.env.auth  # fill both',
-        'export PUBLIC_HOSTNAME=<your.edge.hostname> ALLOWED_DOMAINS=<yourworkspace.com>',
-        'export OAUTH_CLIENT_ID=… OAUTH_CLIENT_SECRET=… OAUTH_COOKIE_SECRET=… AUTH_JWT_SECRET=…',
-        ...(isCursor ? ['export PROVIDER_KEY=<cursor api key>'] : ['export LITELLM_KEY=… PROVIDER_KEY=… STATE_BUCKET=<state-bucket>']),
-        'bash deploy/cloudrun-deploy.sh    # builds linux/amd64, upserts secrets, `gcloud run services replace`',
-        'gcloud run domain-mappings create --service "$SERVICE" --region "${REGION:-us-central1}" --domain "$PUBLIC_HOSTNAME"  # once',
-        '```',
-        '',
-        'Google OAuth Web client (for oauth2-proxy): authorized origin `https://$PUBLIC_HOSTNAME`,',
-        'redirect `https://$PUBLIC_HOSTNAME/oauth2/callback`. Restrict to your Workspace domain via',
-        '`ALLOWED_DOMAINS` (oauth2-proxy `email_domains` + broker `allowed_domains`).',
-        '',
-        '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${LITELLM_IMAGE} ${STATE_BUCKET} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`)',
-        'are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).',
-        '',
-        inbound
-            ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
-            : '**No inbound channel (1a):** scales to zero; traces + sessions persist on the GCS `/state` volume.',
-        '',
-        ...renderEgressNote(ctx),
-    ].join('\n');
-    return files;
-}
-/** Cloud Run requires a startupProbe on any container that is a `depends_on` target, so the
- *  platform knows when the dependency is ready. `slow` = one generous 240s attempt (agent, which
- *  may warm an engine); otherwise 30×5s polls (sidecars that start fast). */
-function startupProbeLines(port, slow = false) {
-    if (slow) {
-        // Slow starter (agent): check every 5s but tolerate up to 240s total. A single
-        // failureThreshold:1/periodSeconds:240 probe would only check ONCE at 240s, leaving
-        // the instance "no available instance" for the whole cold start and aborting requests.
-        return [
-            '          startupProbe:',
-            '            failureThreshold: 48',
-            '            periodSeconds: 5',
-            '            tcpSocket:',
-            `              port: ${port}`,
-            '            timeoutSeconds: 3',
-        ];
-    }
-    return [
-        '          startupProbe:',
-        '            failureThreshold: 30',
-        '            periodSeconds: 5',
-        '            tcpSocket:',
-        `              port: ${port}`,
-        '            timeoutSeconds: 3',
-    ];
-}
-/** Per-container CPU/memory limits. Cloud Run multi-container shares one instance whose total
- *  memory = sum of container limits, so the streaming agent + Python LiteLLM need real headroom
- *  (defaults of 256Mi each OOM-kill the instance mid-request → 503 "Service Unavailable"). */
-function resourceLimits(cpu, memory) {
-    return [
-        '          resources:',
-        '            limits:',
-        `              cpu: ${cpu}`,
-        `              memory: ${memory}`,
-    ];
-}
-/** A′ — Federated edge multi-container service. Caddy (ingress) + auth-broker + agent
- *  (+ LiteLLM + OTEL for Spotlight). No oauth2-proxy container; in-memory emptyDir state. */
-function renderCloudrunFedServiceYaml(ctx) {
-    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
-    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT })
-        .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
-    const cookieDomain = (ctx.cookieDomain || '.agenthippo.ai').trim();
-    const idpUrl = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
-    const deps = isCursor
-        ? '{"caddy":["agent","auth-broker"]}'
-        : '{"caddy":["agent","auth-broker"],"agent":["litellm"],"litellm":["otel-collector"]}';
-    const lines = [
-        '# Cloud Run + AgentHippo federated edge (A′): Caddy (ingress) + auth-broker + agent',
-        '# (+ LiteLLM + OTEL collector for Spotlight). No oauth2-proxy — Google login happens once',
-        '# at the central IdP; this agent verifies the shared .agenthippo.ai AgentHippo JWT.',
-        '# Generated by `agenthippo deploy init --target cloudrun --ingress edge-fed`.',
-        'apiVersion: serving.knative.dev/v1',
-        'kind: Service',
-        'metadata:',
-        '  name: ${SERVICE}',
-        'spec:',
-        '  template:',
-        '    metadata:',
-        '      annotations:',
-        '        run.googleapis.com/cpu-throttling: "false"',
-        '        run.googleapis.com/startup-cpu-boost: "true"',
-        `        run.googleapis.com/container-dependencies: '${deps}'`,
-        '        autoscaling.knative.dev/maxScale: "1"',
-        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
-        '    spec:',
-        '      timeoutSeconds: 3600',
-        '      containers:',
-        '        # Ingress — the ONLY container with a port. Verifies the shared JWT (no Google here).',
-        '        - name: caddy',
-        '          image: caddy:2.8-alpine',
-        '          ports:',
-        '            - name: http1',
-        `              containerPort: ${ctx.port}`,
-        '          volumeMounts:',
-        '            - { name: caddy-config, mountPath: /etc/caddy, readOnly: true }',
-        ...resourceLimits('1000m', '512Mi'),
-        '        # Auth broker — verifies IDE Bearer JWTs AND the federated .agenthippo.ai cookie (/api/ide/me).',
-        '        # Same shared AGENTHIPPO_AUTH_JWT_SECRET as the central IdP so its tokens verify here.',
-        '        - name: auth-broker',
-        '          image: ${IMAGE}',
-        '          args: ["auth-broker"]',
-        '          env:',
-        '            - { name: AGENTHIPPO_AUTH_PORT, value: "9780" }',
-        '            - { name: AGENTHIPPO_AUTH_DATA_DIR, value: /data }',
-        '            - { name: AGENTHIPPO_AUTH_PUBLIC_URL, value: https://${PUBLIC_HOSTNAME} }',
-        '            - { name: AGENTHIPPO_AUTH_ALLOWED_DOMAINS, value: ${ALLOWED_DOMAINS} }',
-        `            - { name: AGENTHIPPO_AUTH_COOKIE_DOMAIN, value: "${cookieDomain}" }`,
-        `            - { name: AGENTHIPPO_AUTH_IDP_URL, value: "${idpUrl}" }`,
-        '            - { name: AGENTHIPPO_AUTH_COOKIE_NAME, value: "ah_token" }',
-        '            - name: AGENTHIPPO_AUTH_JWT_SECRET',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-auth-jwt-secret, key: latest }',
-        ...startupProbeLines(9780),
-        ...resourceLimits('1000m', '512Mi'),
-        '        # Agent — serves www + /v1/* on localhost (NOT ingress). Routed through LiteLLM.',
-        '        - name: agent',
-        '          image: ${IMAGE}',
-        `          args: [${agentArgs}]`,
-        '          env:',
-        '            - { name: AGENTHIPPO_HOME, value: /state }',
-        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
-        agentServeHostEnvYaml(),
-        ...(isCursor ? [
-            '            - { name: AGENTHIPPO_CUSTOM_ENGINES_DIR, value: /engines }',
-            '            - name: CURSOR_API_KEY',
-            '              valueFrom:',
-            '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
-        ] : [
-            '            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: http://localhost:4443 }',
-            '            - name: AGENTHIPPO_LITELLM_API_KEY',
-            '              valueFrom:',
-            '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }',
-        ]),
-        '          volumeMounts:',
-        '            - { name: state, mountPath: /state }',
-        ...startupProbeLines(identity_1.EDGE_AGENT_PORT, true),
-        ...resourceLimits('2000m', '2Gi'),
-    ];
-    if (!isCursor) {
-        lines.push('        # LiteLLM gateway sidecar — exports every call to the collector (Spotlight).', '        - name: litellm', '          image: ${LITELLM_IMAGE}', '          env:', '            - { name: OTEL_EXPORTER, value: otlp_http }', '            - { name: OTEL_EXPORTER_OTLP_ENDPOINT, value: http://localhost:4318 }', '            - name: LITELLM_MASTER_KEY', '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-litellm-key, key: latest }', isAhAutoModel(ctx.model)
-            ? '            # ah-auto → gateway.agenthippo.ai (AGENTHIPPO_GATEWAY_KEY = ahgw_… service key).'
-            : `            # Upstream provider key for ${ctx.model || 'this model'} (matches os.environ/${providerKeyEnv}).`, `            - name: ${providerKeyEnv}`, '              valueFrom:', '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }', ...startupProbeLines(4443), ...resourceLimits('1000m', '1Gi'), '        # Spotlight OTEL collector sidecar — writes JSONL traces into the shared /state volume.', '        - name: otel-collector', '          image: otel/opentelemetry-collector-contrib:0.118.0', '          args: ["--config=/etc/otel/config.yaml"]', '          env:', '            - { name: AGENT_HOME_DIR, value: /state }', '          volumeMounts:', '            - { name: otel-config, mountPath: /etc/otel, readOnly: true }', '            - { name: state, mountPath: /state }', ...startupProbeLines(4318), ...resourceLimits('1000m', '512Mi'));
-    }
-    lines.push('      volumes:', '        # In-memory state (matches the working spotlight deploy — no GCS SA perms needed).', '        - name: state', '          emptyDir:', '            medium: Memory', '            sizeLimit: 1Gi', '        - name: caddy-config', '          secret:', '            secretName: ${SERVICE}-caddyfile', '            items:', '              - { key: latest, path: Caddyfile }');
-    if (!isCursor) {
-        lines.push('        - name: otel-config', '          secret:', '            secretName: ${SERVICE}-otel-config', '            items:', '              - { key: latest, path: config.yaml }');
-    }
-    lines.push('');
-    return lines.join('\n');
-}
-/** A′ gateway-direct — federated edge without LiteLLM/OTEL sidecars. Agent calls the org gateway
- *  (gateway.agenthippo.ai) directly — same wiring as colocated agents on hippopennyg. */
-function renderCloudrunFedGatewayServiceYaml(ctx) {
-    const agentArgs = serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT })
-        .map((a) => `"${a.replace(/"/g, '\\"')}"`).join(', ');
-    const cookieDomain = (ctx.cookieDomain || '.agenthippo.ai').trim();
-    const idpUrl = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
-    const lines = [
-        '# Cloud Run + AgentHippo federated edge (A′) — gateway-direct (lean):',
-        '# Caddy (ingress) + auth-broker + agent. No LiteLLM/OTEL sidecars.',
-        '# Agent routes ah-auto (and other gateway models) to gateway.agenthippo.ai directly.',
-        '# Generated by `agenthippo deploy init --target cloudrun --ingress edge-fed --model-routing gateway`.',
-        'apiVersion: serving.knative.dev/v1',
-        'kind: Service',
-        'metadata:',
-        '  name: ${SERVICE}',
-        'spec:',
-        '  template:',
-        '    metadata:',
-        '      annotations:',
-        '        run.googleapis.com/cpu-throttling: "false"',
-        '        run.googleapis.com/startup-cpu-boost: "true"',
-        "        run.googleapis.com/container-dependencies: '{\"caddy\":[\"agent\",\"auth-broker\"]}'",
-        '        autoscaling.knative.dev/maxScale: "1"',
-        ...(ctx.gatewayChannels?.trim() ? ['        autoscaling.knative.dev/minScale: "1"'] : []),
-        '    spec:',
-        '      timeoutSeconds: 3600',
-        '      containers:',
-        '        - name: caddy',
-        '          image: caddy:2.8-alpine',
-        '          ports:',
-        '            - name: http1',
-        `              containerPort: ${ctx.port}`,
-        '          volumeMounts:',
-        '            - { name: caddy-config, mountPath: /etc/caddy, readOnly: true }',
-        ...resourceLimits('1000m', '512Mi'),
-        '        - name: auth-broker',
-        '          image: ${IMAGE}',
-        '          args: ["auth-broker"]',
-        '          env:',
-        '            - { name: AGENTHIPPO_AUTH_PORT, value: "9780" }',
-        '            - { name: AGENTHIPPO_AUTH_DATA_DIR, value: /data }',
-        '            - { name: AGENTHIPPO_AUTH_PUBLIC_URL, value: https://${PUBLIC_HOSTNAME} }',
-        '            - { name: AGENTHIPPO_AUTH_ALLOWED_DOMAINS, value: ${ALLOWED_DOMAINS} }',
-        `            - { name: AGENTHIPPO_AUTH_COOKIE_DOMAIN, value: "${cookieDomain}" }`,
-        `            - { name: AGENTHIPPO_AUTH_IDP_URL, value: "${idpUrl}" }`,
-        '            - { name: AGENTHIPPO_AUTH_COOKIE_NAME, value: "ah_token" }',
-        '            - name: AGENTHIPPO_AUTH_JWT_SECRET',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-auth-jwt-secret, key: latest }',
-        ...startupProbeLines(9780),
-        ...resourceLimits('1000m', '512Mi'),
-        '        - name: agent',
-        '          image: ${IMAGE}',
-        `          args: [${agentArgs}]`,
-        '          env:',
-        '            - { name: AGENTHIPPO_HOME, value: /state }',
-        '            - { name: AGENTHIPPO_NO_AUTO_INSTALL, value: "1" }',
-        agentServeHostEnvYaml(),
-        `            - { name: AGENTHIPPO_LITELLM_BASE_URL, value: "${AGENTHIPPO_GATEWAY_BASE_URL}" }`,
-        '            - name: AGENTHIPPO_LITELLM_API_KEY',
-        '              valueFrom:',
-        '                secretKeyRef: { name: ${SERVICE}-provider-key, key: latest }',
-        '          volumeMounts:',
-        '            - { name: state, mountPath: /state }',
-        ...startupProbeLines(identity_1.EDGE_AGENT_PORT, true),
-        ...resourceLimits('2000m', '2Gi'),
-        '      volumes:',
-        '        - name: state',
-        '          emptyDir:',
-        '            medium: Memory',
-        '            sizeLimit: 1Gi',
-        '        - name: caddy-config',
-        '          secret:',
-        '            secretName: ${SERVICE}-caddyfile',
-        '            items:',
-        '              - { key: latest, path: Caddyfile }',
-        '',
-    ];
-    return lines.join('\n');
-}
-/** Deploy script for gateway-direct federated edge — no LiteLLM/OTEL secrets or sidecars. */
-function renderCloudrunFedGatewayDeploy(ctx) {
-    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
-    const providerHint = isAhAutoModel(ctx.model)
-        ? 'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>}"'
-        : 'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<gateway service key or provider key>}"';
-    return [
-        '#!/usr/bin/env bash',
-        '# Cloud Run + AgentHippo federated edge (A′) — gateway-direct (lean).',
-        `# Engine: ${ctx.engine}${modelNote}. Caddy + auth-broker + agent only — agent calls`,
-        '# gateway.agenthippo.ai directly (no in-pod LiteLLM/OTEL sidecars). Same model routing',
-        '# as colocated agents on hippopennyg.',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        `SERVICE="${ctx.packName}"`,
-        'REGION="${REGION:-us-central1}"',
-        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
-        'REPO="${ARTIFACT_REPO:-agenthippo}"',
-        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai}"',
-        'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:-agenthippo.ai}"',
-        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>}"',
-        providerHint,
-        '',
-        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
-        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
-        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
-        '',
-        'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
-        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
-        'docker push "$IMAGE"',
-        '',
-        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
-        'ensure_secret "${SERVICE}-caddyfile"; gcloud secrets versions add "${SERVICE}-caddyfile" --data-file=deploy/Caddyfile',
-        'ensure_secret "${SERVICE}-auth-jwt-secret"; printf %s "$AUTH_JWT_SECRET" | gcloud secrets versions add "${SERVICE}-auth-jwt-secret" --data-file=-',
-        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
-        '',
-        'RENDERED="$(mktemp)"',
-        'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\',
-        '    -e "s|\\${PUBLIC_HOSTNAME}|${PUBLIC_HOSTNAME}|g" -e "s|\\${ALLOWED_DOMAINS}|${ALLOWED_DOMAINS}|g" \\',
-        '    deploy/service.yaml > "$RENDERED"',
-        'gcloud run services replace "$RENDERED" --region "$REGION"',
-        '',
-        'gcloud run services add-iam-policy-binding "$SERVICE" --region "$REGION" \\',
-        '  --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true',
-        '',
-        'if [[ "$PUBLIC_HOSTNAME" != *.run.app ]]; then \\',
-        '  gcloud beta run domain-mappings describe "$PUBLIC_HOSTNAME" --region "$REGION" >/dev/null 2>&1 \\',
-        '    || gcloud beta run domain-mappings create --service "$SERVICE" --region "$REGION" --domain "$PUBLIC_HOSTNAME"; \\',
-        'fi',
-        '',
-    ].join('\n');
-}
-/** Deploy script for the federated edge (A′): build, upsert secrets (no OAuth), replace, make
- *  public, map the subdomain. No IAP; no Google OAuth client. */
-function renderCloudrunFedDeploy(ctx) {
-    const isCursor = ctx.engine.trim().toLowerCase() === 'cursor';
-    const modelNote = ctx.model?.trim() ? `, model ${ctx.model.trim()}` : '';
-    const lines = [
-        '#!/usr/bin/env bash',
-        '# Cloud Run + AgentHippo federated edge (A′): Caddy + auth-broker front the agent.',
-        `# Engine: ${ctx.engine}${modelNote}. No oauth2-proxy, no per-service Google OAuth client —`,
-        '# Google login happens once at the central IdP (auth.agenthippo.ai); this agent verifies',
-        '# the shared .agenthippo.ai AgentHippo JWT (Bearer for IDE, cookie for browser). No IAP.',
-        '# The IDE points spec.remote.url straight at https://$PUBLIC_HOSTNAME (same flow as remote-vm).',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        `SERVICE="${ctx.packName}"`,
-        'REGION="${REGION:-us-central1}"',
-        'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
-        'REPO="${ARTIFACT_REPO:-agenthippo}"',
-        'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('litellm-gateway')}}"`,
-        '# Public hostname = a *.agenthippo.ai subdomain mapped to this service (one-time wildcard DNS).',
-        'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai}"',
-        'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:-agenthippo.ai}"',
-        '# Shared AgentHippo JWT signing key — MUST match the central IdP (auth.agenthippo.ai).',
-        '# Copy it from the IdP (or the GCP secret it stores) so tokens issued there verify here.',
-        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>}"',
-        ...(isCursor ? [
-            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<cursor api key>}"',
-        ] : isAhAutoModel(ctx.model) ? [
-            '# LiteLLM proxy key + AgentHippo gateway service key (ahgw_…) for ah-auto routing.',
-            'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
-            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>}"',
-        ] : [
-            '# LiteLLM proxy key + the upstream provider key the gateway uses for the model.',
-            'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
-            'PROVIDER_KEY="${PROVIDER_KEY:?set PROVIDER_KEY=<upstream provider key>}"',
-        ]),
-        '',
-        'gcloud artifacts repositories describe "$REPO" --location="$REGION" 2>/dev/null \\',
-        '  || gcloud artifacts repositories create "$REPO" --repository-format=docker --location="$REGION"',
-        'gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet',
-        '',
-        '# One agent image serves both the agent and the auth-broker containers (CLI ships `auth-broker`).',
-        '# Rewrite the runtime base to this project Artifact Registry. Customer artifacts pin a',
-        '# dated ghcr.io/agenthippoai/runtime tag; mirror that exact tag into AR. No-op if already AR.',
-        'DF_TMP="$(mktemp)"',
-        'sed "s|FROM ghcr.io/agenthippoai/runtime:|FROM ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/runtime:|" deploy/Dockerfile > "$DF_TMP"',
-        'docker build --pull --platform linux/amd64 -f "$DF_TMP" -t "$IMAGE" .',
-        'docker push "$IMAGE"',
-        '',
-        '# Secrets: caddyfile + shared JWT secret + provider/litellm keys. NO OAuth client secrets.',
-        'ensure_secret() { gcloud secrets describe "$1" >/dev/null 2>&1 || gcloud secrets create "$1" --replication-policy=automatic; }',
-        'ensure_secret "${SERVICE}-caddyfile"; gcloud secrets versions add "${SERVICE}-caddyfile" --data-file=deploy/Caddyfile',
-        'ensure_secret "${SERVICE}-auth-jwt-secret"; printf %s "$AUTH_JWT_SECRET" | gcloud secrets versions add "${SERVICE}-auth-jwt-secret" --data-file=-',
-        'ensure_secret "${SERVICE}-provider-key"; printf %s "$PROVIDER_KEY" | gcloud secrets versions add "${SERVICE}-provider-key" --data-file=-',
-    ];
-    if (!isCursor) {
-        lines.push('ensure_secret "${SERVICE}-otel-config"; gcloud secrets versions add "${SERVICE}-otel-config" --data-file=deploy/otel-collector.yaml', 'ensure_secret "${SERVICE}-litellm-key"; printf %s "$LITELLM_KEY" | gcloud secrets versions add "${SERVICE}-litellm-key" --data-file=-');
-    }
-    lines.push('', '# Render the multi-container template (sed — no gettext) and deploy.', 'RENDERED="$(mktemp)"', 'sed -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${IMAGE}|${IMAGE}|g" \\', '    -e "s|\\${LITELLM_IMAGE}|${LITELLM_IMAGE}|g" \\', '    -e "s|\\${PUBLIC_HOSTNAME}|${PUBLIC_HOSTNAME}|g" -e "s|\\${ALLOWED_DOMAINS}|${ALLOWED_DOMAINS}|g" \\', '    deploy/service.yaml > "$RENDERED"', 'gcloud run services replace "$RENDERED" --region "$REGION"', '', '# No IAP: Caddy is the gate, so Cloud Run must allow public ingress (allUsers invoker).', 'gcloud run services add-iam-policy-binding "$SERVICE" --region "$REGION" \\', '  --member=allUsers --role=roles/run.invoker >/dev/null 2>&1 || true', '', '# Map the *.agenthippo.ai subdomain (idempotent). Requires one-time wildcard DNS', '# *.agenthippo.ai → Cloud Run (gctrl.run.app). No per-subdomain DNS, no Google OAuth edit.', '# Skip for *.run.app default URLs (no custom mapping needed there).', 'if [[ "$PUBLIC_HOSTNAME" != *.run.app ]]; then \\', '  gcloud beta run domain-mappings describe "$PUBLIC_HOSTNAME" --region "$REGION" >/dev/null 2>&1 \\', '    || gcloud beta run domain-mappings create --service "$SERVICE" --region "$REGION" --domain "$PUBLIC_HOSTNAME"; \\', 'fi', '', '# Grant the runtime SA access to the secrets if needed:', '#   SA="$(gcloud run services describe "$SERVICE" --region "$REGION" --format=\'value(spec.template.spec.serviceAccountName)\')"', '#   for s in caddyfile auth-jwt-secret provider-key; do', '#     gcloud secrets add-iam-policy-binding "${SERVICE}-$s" --member="serviceAccount:$SA" --role=roles/secretmanager.secretAccessor', '#   done', '');
-    return lines.join('\n');
-}
-/** A′ artifacts: Cloud Run behind the federated AgentHippo edge (Caddy + auth-broker; no oauth2-proxy). */
-function cloudrunFedArtifacts(ctx, inbound, isCursor) {
-    const gatewayDirect = usesGatewayDirect(ctx) && !isCursor;
-    const sidecars = isCursor
-        ? 'Caddy (ingress) + auth-broker + agent.'
-        : gatewayDirect
-            ? 'Caddy (ingress) + auth-broker + agent (gateway-direct — no LiteLLM/OTEL sidecars).'
-            : 'Caddy (ingress) + auth-broker + agent + LiteLLM + OTEL collector (Spotlight).';
-    const idp = (ctx.idpUrl || 'https://auth.agenthippo.ai').trim().replace(/\/+$/, '');
-    const files = {
-        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'Caddyfile': (0, identity_1.renderSidecarFedCaddyfile)(ctx.idpUrl),
-        'service.yaml': gatewayDirect ? renderCloudrunFedGatewayServiceYaml(ctx) : renderCloudrunFedServiceYaml(ctx),
-        'cloudrun-deploy.sh': gatewayDirect ? renderCloudrunFedGatewayDeploy(ctx) : renderCloudrunFedDeploy(ctx),
-    };
-    if (!isCursor && !gatewayDirect) {
-        files['otel-collector.yaml'] = OTEL_COLLECTOR_COMPOSE_YAML;
-    }
-    files['README.md'] = [
-        `# Deploy: ${ctx.packName} — Cloud Run + AgentHippo federated edge (A′${gatewayDirect ? ', gateway-direct' : ''})`,
-        '',
-        `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}. Runtime base: \`${ctx.image}\`.`,
-        '',
-        `${sidecars} Sidecars share the pod\'s localhost (Cloud Run multi-container):`,
-        '- **caddy** (ingress, the only port) → verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser)',
-        `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (NOT ingress)`,
-        '- **auth-broker** → validates the shared `.agenthippo.ai` JWT via `/api/ide/me` (same secret as the IdP)',
-        ...(gatewayDirect ? [
-            `- **model routing** → agent calls \`${AGENTHIPPO_GATEWAY_BASE_URL}\` directly (ahgw_… service key) — same as colocated agents`,
-            '- **no Spotlight sidecars** — traces are not collected in-pod; use gateway/Spotlight fleet analytics instead',
-        ] : isCursor ? [] : [
-            '- **litellm** gateway → exports OTLP to `http://localhost:4318`',
-            '- **otel-collector** → writes JSONL traces to the in-memory `/state` volume',
-        ]),
-        '',
-        '**No oauth2-proxy, no per-service Google OAuth client.** Google login happens once at the',
-        `central IdP (${idp}); this agent only verifies the resulting shared \`.agenthippo.ai\` JWT.`,
-        'The IDE points `spec.remote.url` at `https://$PUBLIC_HOSTNAME` and the existing AgentHippo',
-        'SSO flow works (same as `remote-vm`). Browser visits with no cookie are redirected to the',
-        'IdP to log in, then return. Cloud Run is public (`allUsers` invoker) so traffic reaches Caddy.',
-        '',
-        '```bash',
-        'cp deploy/.env.example deploy/.env && cp deploy/.env.auth.example deploy/.env.auth  # fill both',
-        'export PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai   # e.g. cs.agenthippo.ai',
-        'export AUTH_JWT_SECRET=<copy from auth.agenthippo.ai>   # shared signing key',
-        ...(isCursor ? ['export PROVIDER_KEY=<cursor api key>'] : gatewayDirect
-            ? ['export PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>']
-            : isAhAutoModel(ctx.model)
-                ? ['export LITELLM_KEY=… PROVIDER_KEY=<ahgw_… from create-gateway-key on gateway host>']
-                : ['export LITELLM_KEY=… PROVIDER_KEY=…']),
-        'bash deploy/cloudrun-deploy.sh    # builds linux/amd64, upserts secrets, `gcloud run services replace`, maps the subdomain',
-        '```',
-        '',
-        '**One-time setup (not per agent):** wildcard DNS `*.agenthippo.ai` → Cloud Run (`gctrl.run.app`),',
-        `and the IdP (${idp}) must run the \`/oauth/browser-login\` route (oauth2-proxy forward_auth →`,
-        'auth-broker sets the `ah_token` cookie on `.agenthippo.ai`). After that, every new agent is',
-        gatewayDirect
-            ? 'just: `deploy init --ingress edge-fed --model-routing gateway` + this script — zero Console/OAuth work.'
-            : 'just: `deploy init --ingress edge-fed` + this script — zero Console/OAuth work.',
-        '',
-        gatewayDirect
-            ? '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`) are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).'
-            : '`service.yaml` placeholders (`${SERVICE} ${IMAGE} ${LITELLM_IMAGE} ${PUBLIC_HOSTNAME} ${ALLOWED_DOMAINS}`) are substituted by the deploy script. The Caddyfile is stored in Secret Manager (`${SERVICE}-caddyfile`).',
-        '`AGENTHIPPO_AUTH_COOKIE_DOMAIN` / `AGENTHIPPO_AUTH_IDP_URL` are baked in at generation time.',
-        '',
-        inbound
-            ? '**Inbound channel (1b):** `minScale: 1` pins one always-on instance (the socket can\'t scale to zero).'
-            : '**No inbound channel (1a):** scales to zero; in-memory `/state` is wiped on cold start (use the `edge` mode + GCS bucket if you need durable state).',
-        '',
-        ...renderEgressNote(ctx),
-    ].join('\n');
-    return files;
-}
-function databricksAppArtifacts(ctx) {
-    // Databricks Apps take SOURCE, not images — the platform builds it. serve-v3 §5.
-    const appYaml = [
-        '# Databricks App (serverless source app). Databricks runs `npm ci` then start.',
-        'command: ["node", "start.js"]',
-        'env:',
-        `  - name: PORT`,
-        `    value: "${ctx.port}"`,
-        'user_authorization:',
-        '  # OBO: Databricks forwards X-Forwarded-Access-Token (the asking user\'s',
-        '  # downscoped token) so SQL runs as that user → Unity Catalog enforces',
-        '  # per-user grants. serve-v3 §11.1.',
-        '  scopes: ["sql"]',
-        '',
-    ].join('\n');
-    const pkg = JSON.stringify({
-        name: ctx.packName,
-        private: true,
-        dependencies: {
-            [exports.AGENTHIPPO_CLI_NPM_PACKAGE]: resolveAgentHippoCliNpmVersion(),
-            '@anthropic-ai/claude-code': exports.CLAUDE_CODE_NPM_VERSION,
-        },
-    }, null, 2) + '\n';
-    const start = [
-        "// Databricks App entrypoint: exec serve against the bundled pack.",
-        "const { spawn } = require('node:child_process');",
-        "const port = process.env.PORT || '" + ctx.port + "';",
-        "const child = spawn('agenthippo', [",
-        "  'serve', '--agent', './pack',",
-        "  '--workspace', '/tmp/agenthippo/workspace',",
-        "  '--state-dir', '/tmp/agenthippo/state',",
-        "  '--port', port,",
-        "], { stdio: 'inherit', env: {",
-        "  ...process.env,",
-        "  AGENTHIPPO_SERVE_HOST: '0.0.0.0',",
-        "  // Databricks Apps workspace SSO sets X-Forwarded-Email; pin serve to trust ONLY that",
-        "  // header so an authenticated caller cannot impersonate another user via a spoofed",
-        "  // X-Agent-User header (Databricks does not know about or strip that header).",
-        "  // Skipped when AGENTHIPPO_PIN_IDENTITY=0 (bootstrap escape hatch) — same idea as",
-        "  // Cloud Run's ENABLE_IAP=0: pinning to an absent header would make every request",
-        "  // anonymous instead of leaving body-supplied identity usable during bootstrap.",
-        "  ...(process.env.AGENTHIPPO_PIN_IDENTITY === '0' ? {} : { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' }),",
-        "} });",
-        "child.on('exit', (code) => process.exit(code ?? 0));",
-        '',
-    ].join('\n');
-    return {
-        'app.yaml': appYaml,
-        'package.json': pkg,
-        'start.js': start,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — Databricks App (T1-native, the wedge)`,
-            '',
-            '```bash',
-            'cp -r . ./databricks-app/pack    # bundle the pack next to start.js',
-            'databricks apps deploy ' + ctx.packName,
-            '```',
-            '',
-            '**Per-user permissions:** workspace SSO authenticates the user; OBO forwards',
-            '`X-Forwarded-Access-Token`, and the SQL tool authenticates to the warehouse as',
-            'that user, so Unity Catalog row filters apply automatically (serve-v3 §11.1).',
-            '',
-            '> ⚠️ The OBO *credential* seam (per-turn token → SQL tool) is the load-bearing',
-            '> spike (serve-v3 §13.2). Without it serve queries as one app identity. Identity',
-            '> attribution (`user_id`) works today; per-user *data* enforcement needs the spike.',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-function spcsArtifacts(ctx) {
-    const spec = [
-        '# Snowpark Container Services spec. Push the runtime image to your account',
-        '# registry, then run deploy.sql in a worksheet. serve-v3 §6.',
-        'spec:',
-        '  containers:',
-        `    - name: ${ctx.packName}`,
-        `      image: /<db>/<schema>/<repo>/${ctx.packName}:latest`,
-        '      env:',
-        '        AGENTHIPPO_NO_AUTO_INSTALL: "1"',
-        '        AGENTHIPPO_HOME: /state',
-        '      readinessProbe:',
-        `        port: ${ctx.port}`,
-        '        path: /ready',
-        '      # Q1: durable state on a block volume — survives compute-pool suspend/resume.',
-        '      volumeMounts:',
-        '        - name: state',
-        '          mountPath: /state',
-        '  volumes:',
-        '    - name: state',
-        '      source: block',
-        '      size: 10Gi',
-        '  endpoints:',
-        `    - name: api`,
-        `      port: ${ctx.port}`,
-        '      public: true',
-        '',
-    ].join('\n');
-    const sql = [
-        '-- Run in a Snowflake worksheet. SPCS injects an OAuth session token at',
-        '-- /snowflake/session/token → the agent queries as the service role (no key-pair).',
-        'CREATE COMPUTE POOL IF NOT EXISTS agenthippo_pool',
-        '  MIN_NODES = 1 MAX_NODES = 1 INSTANCE_FAMILY = CPU_X64_S AUTO_SUSPEND_SECS = 600;',
-        '',
-        '-- Only egress: the model API. Everything else stays inside Snowflake.',
-        'CREATE OR REPLACE NETWORK RULE anthropic_rule',
-        "  MODE = EGRESS TYPE = HOST_PORT VALUE_LIST = ('api.anthropic.com:443');",
-        'CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION anthropic_eai',
-        '  ALLOWED_NETWORK_RULES = (anthropic_rule) ENABLED = TRUE;',
-        '',
-        `CREATE SERVICE ${ctx.packName}`,
-        '  IN COMPUTE POOL agenthippo_pool',
-        `  FROM SPECIFICATION_FILE = 'spec.yaml'`,
-        '  EXTERNAL_ACCESS_INTEGRATIONS = (anthropic_eai);',
-        '',
-    ].join('\n');
-    return {
-        'Dockerfile': sharedDockerfile(ctx),
-        'spec.yaml': spec,
-        'deploy.sql': sql,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — Snowflake SPCS (T1-native)`,
-            '',
-            '1. Build + push: `docker build -f deploy/Dockerfile -t <account-registry>/.../' + ctx.packName + ':latest . && docker push ...`',
-            '2. Upload `spec.yaml` to a stage, then run `deploy.sql` in a worksheet.',
-            '',
-            'Zero Snowflake credentials: SPCS injects a session token; the agent queries as the',
-            'service role, so RBAC is the permission system. Security review = "one EAI to api.anthropic.com".',
-            '',
-        ].join('\n'),
-    };
-}
-function cloudflareArtifacts(ctx) {
-    const wrangler = JSON.stringify({
-        name: ctx.packName,
-        compatibility_date: '2026-05-01',
-        containers: [
-            {
-                class_name: 'Agent',
-                image: './deploy/Dockerfile',
-                max_instances: 1,
-                instance_type: { vcpu: 2, memory_mib: 6144, disk_mb: 8192 },
-            },
-        ],
-        durable_objects: { bindings: [{ name: 'AGENT', class_name: 'Agent' }] },
-        migrations: [{ tag: 'v1', new_sqlite_classes: ['Agent'] }],
-    }, null, 2) + '\n';
-    return {
-        // Pin identity to X-Agent-User so serve trusts ONLY the header the fronting Worker sets —
-        // unpinned, serve falls back to the same header name as an alias and a caller who reaches
-        // the container directly (bypassing the Worker/Access) could spoof it themselves.
-        'Dockerfile': sharedDockerfile(ctx, { extraEnv: { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' } }),
-        'wrangler.jsonc': wrangler,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — Cloudflare Container (T1-generic)`,
-            '',
-            '`wrangler deploy` builds the Dockerfile and ships the container (scale-to-zero).',
-            'Front it with a Worker that does Cloudflare Access (SSO) and sets `X-Agent-User`,',
-            'then proxies to the container binding. For the *external/unauthenticated* case',
-            '(customer support), use the full reference at `examples/deploy/external-support/`.',
-            '',
-            '**Identity pin:** the container trusts *only* `X-Agent-User` (`AGENTHIPPO_IDENTITY_HEADER`,',
-            'baked into the image) — the Worker must set it after Cloudflare Access verifies the user.',
-            'Requests without it resolve to no identity, even if the container is ever reachable',
-            'directly, bypassing the Worker.',
-            '',
-            '**Egress:** this container only needs outbound access to your model provider',
-            '(e.g. `api.anthropic.com:443`) — restrict it with a Cloudflare Worker/Zero Trust',
-            'egress policy if your org requires one.',
-            '',
-        ].join('\n'),
-    };
-}
-/**
- * AWS ECS Fargate (T1-generic, `d8-aws-adapter`). Fargate's `awsvpc` network mode shares one
- * task's network namespace across its containers — architecturally identical to Cloud Run's
- * sidecar model, so the edge/edge-fed Caddyfiles and `EDGE_AGENT_PORT` convention are reused
- * verbatim (PLAN/deploy.md §5, "what adding AWS looks like"): no new identity code, just a new
- * platform adapter around the same shared identity layer.
- *
- * Scope: identity/exposure only (bare / edge / edge-fed) — no Spotlight/LiteLLM sidecar variant
- * yet (that's the orthogonal model-gateway layer, not part of this pass). Newer and far less
- * exercised than the Cloud Run path — read `deploy.sh` before running it against a real account.
- */
-function awsEcsArtifacts(ctx) {
-    const fed = ctx.ingress === 'edge-fed';
-    const edge = ctx.ingress === 'edge' || fed;
-    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    if (!edge) {
-        // Bare single-container task — sits behind whatever ingress (ALB, API Gateway, internal
-        // VPC access) the org already runs, same positioning as cloudflare/databricks-app/spcs.
-        const taskDef = {
-            family: '${SERVICE}',
-            networkMode: 'awsvpc',
-            requiresCompatibilities: ['FARGATE'],
-            cpu: '512',
-            memory: '1024',
-            containerDefinitions: [
-                {
-                    name: 'agent',
-                    image: '${IMAGE}',
-                    essential: true,
-                    portMappings: [{ containerPort: ctx.port, protocol: 'tcp' }],
-                    environment: [{ name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' }],
-                    secrets: [{ name: providerKeyEnv, valueFrom: '${PROVIDER_KEY_SECRET_ARN}' }],
-                    logConfiguration: {
-                        logDriver: 'awslogs',
-                        options: {
-                            'awslogs-group': '/ecs/${SERVICE}',
-                            'awslogs-region': '${REGION}',
-                            'awslogs-stream-prefix': 'agent',
-                        },
-                    },
-                },
-            ],
-        };
-        const deploy = [
-            '#!/usr/bin/env bash',
-            '# T1-generic: AWS ECS Fargate, single container — bring your own ingress (ALB/API',
-            '# Gateway/internal VPC). For a self-contained ALB + AgentHippo edge, use --ingress edge',
-            '# or --ingress edge-fed instead.',
-            'set -euo pipefail',
-            ...anchorToStagingRoot(),
-            'SERVICE="' + ctx.packName + '"',
-            'REGION="${AWS_REGION:-us-east-1}"',
-            'ACCOUNT_ID="${ACCOUNT_ID:-$(aws sts get-caller-identity --query Account --output text)}"',
-            'REPO="agenthippo/${SERVICE}"',
-            'IMAGE="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/${REPO}:latest"',
-            '',
-            'aws ecr describe-repositories --repository-names "$REPO" --region "$REGION" >/dev/null 2>&1 \\',
-            '  || aws ecr create-repository --repository-name "$REPO" --region "$REGION"',
-            'aws ecr get-login-password --region "$REGION" \\',
-            '  | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"',
-            '',
-            'docker build --platform linux/amd64 -f deploy/Dockerfile -t "$IMAGE" .',
-            'docker push "$IMAGE"',
-            '',
-            `PROVIDER_KEY_SECRET_ARN="\${PROVIDER_KEY_SECRET_ARN:?set PROVIDER_KEY_SECRET_ARN — Secrets Manager ARN holding ${providerKeyEnv}}"`,
-            'TASK_JSON="$(sed -e "s|\\${IMAGE}|${IMAGE}|g" -e "s|\\${SERVICE}|${SERVICE}|g" \\',
-            '    -e "s|\\${REGION}|${REGION}|g" -e "s|\\${PROVIDER_KEY_SECRET_ARN}|${PROVIDER_KEY_SECRET_ARN}|g" \\',
-            '    deploy/task-definition.json)"',
-            'aws ecs register-task-definition --region "$REGION" --cli-input-json "$TASK_JSON" >/dev/null',
-            '',
-            'CLUSTER="${CLUSTER:?set CLUSTER — the ECS cluster to run in}"',
-            'aws ecs describe-services --cluster "$CLUSTER" --services "$SERVICE" --region "$REGION" 2>/dev/null \\',
-            '  | grep -q \'"status": "ACTIVE"\' \\',
-            '  && aws ecs update-service --cluster "$CLUSTER" --service "$SERVICE" \\',
-            '       --task-definition "$SERVICE" --region "$REGION" >/dev/null \\',
-            '  || aws ecs create-service --cluster "$CLUSTER" --service-name "$SERVICE" \\',
-            '       --task-definition "$SERVICE" --desired-count 1 --launch-type FARGATE \\',
-            '       --network-configuration "awsvpcConfiguration={subnets=[${SUBNETS:?set SUBNETS}],securityGroups=[${SECURITY_GROUPS:?set SECURITY_GROUPS}],assignPublicIp=ENABLED}" \\',
-            '       --region "$REGION" >/dev/null',
-            'echo "Deployed $SERVICE to ECS cluster $CLUSTER"',
-            '',
-        ].join('\n');
-        return {
-            'Dockerfile': sharedDockerfile(ctx),
-            'task-definition.json': JSON.stringify(taskDef, null, 2) + '\n',
-            'deploy.sh': deploy,
-            'README.md': [
-                `# Deploy: ${ctx.packName} — AWS ECS Fargate (T1-generic)`,
-                '',
-                `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
-                '',
-                'Single container, no ingress opinion — front it with whatever your org already runs',
-                '(ALB, API Gateway, internal VPC access). Use `--ingress edge` or `--ingress edge-fed`',
-                'for a self-contained ALB + AgentHippo edge instead.',
-                '',
-                '```bash',
-                'export CLUSTER=<ecs-cluster> SUBNETS=<subnet-ids> SECURITY_GROUPS=<sg-ids>',
-                'export PROVIDER_KEY_SECRET_ARN=<Secrets Manager ARN for your model provider key>',
-                'bash deploy/deploy.sh',
-                '```',
-                '',
-                '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
-                '> running it against a real account.',
-                '',
-                ...renderEgressNote(ctx),
-            ].join('\n'),
-        };
-    }
-    // Edge / edge-fed: Caddy + (self-issued: oauth2-proxy) + auth-broker + agent, one Fargate
-    // task (awsvpc network mode = shared localhost, exactly like Cloud Run sidecars) — reuses
-    // the identical Caddyfiles Cloud Run already renders.
-    const containers = [
-        {
-            name: 'caddy',
-            image: 'caddy:2.8-alpine',
-            essential: true,
-            portMappings: [{ containerPort: 8080, protocol: 'tcp' }],
-            environment: [{ name: 'AGENTHIPPO_PUBLIC_HOSTNAME', value: ctx.publicHostname }],
-            // Caddyfile is written to a mounted config volume by the deploy script (sed-templated,
-            // same "checked-in template, script substitutes it" pattern as the Cloud Run edge).
-            mountPoints: [{ sourceVolume: 'caddy-config', containerPath: '/etc/caddy' }],
-            logConfiguration: {
-                logDriver: 'awslogs',
-                options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'caddy' },
-            },
-        },
-        ...(fed ? [] : [{
-                name: 'oauth2-proxy',
-                image: 'quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
-                essential: true,
-                environment: [
-                    { name: 'OAUTH2_PROXY_HTTP_ADDRESS', value: '0.0.0.0:4180' },
-                    { name: 'OAUTH2_PROXY_UPSTREAMS', value: 'file:///dev/null' },
-                    { name: 'OAUTH2_PROXY_SET_XAUTHREQUEST', value: 'true' },
-                    { name: 'OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER', value: 'true' },
-                    { name: 'OAUTH2_PROXY_SKIP_PROVIDER_BUTTON', value: 'true' },
-                    { name: 'OAUTH2_PROXY_REVERSE_PROXY', value: 'true' },
-                ],
-                secrets: [
-                    { name: 'OAUTH2_PROXY_CLIENT_ID', valueFrom: '${OAUTH_CLIENT_ID_SECRET_ARN}' },
-                    { name: 'OAUTH2_PROXY_CLIENT_SECRET', valueFrom: '${OAUTH_CLIENT_SECRET_SECRET_ARN}' },
-                    { name: 'OAUTH2_PROXY_COOKIE_SECRET', valueFrom: '${OAUTH_COOKIE_SECRET_SECRET_ARN}' },
-                ],
-                logConfiguration: {
-                    logDriver: 'awslogs',
-                    options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'oauth2-proxy' },
-                },
-            }]),
-        {
-            name: 'auth-broker',
-            image: '${IMAGE}',
-            essential: true,
-            command: ['auth-broker'],
-            environment: [
-                { name: 'AGENTHIPPO_AUTH_PORT', value: '9780' },
-                ...(fed ? [
-                    { name: 'AGENTHIPPO_AUTH_COOKIE_DOMAIN', value: ctx.cookieDomain || '' },
-                    { name: 'AGENTHIPPO_AUTH_IDP_URL', value: ctx.idpUrl || '' },
-                ] : []),
-            ],
-            secrets: [{ name: 'AGENTHIPPO_AUTH_JWT_SECRET', valueFrom: '${AUTH_JWT_SECRET_SECRET_ARN}' }],
-            logConfiguration: {
-                logDriver: 'awslogs',
-                options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'auth-broker' },
-            },
-        },
-        {
-            name: 'agent',
-            image: '${IMAGE}',
-            essential: true,
-            command: serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT }),
-            environment: [{ name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' }],
-            secrets: [{ name: providerKeyEnv, valueFrom: '${PROVIDER_KEY_SECRET_ARN}' }],
-            logConfiguration: {
-                logDriver: 'awslogs',
-                options: { 'awslogs-group': '/ecs/${SERVICE}', 'awslogs-region': '${REGION}', 'awslogs-stream-prefix': 'agent' },
-            },
-        },
-    ];
-    const taskDef = {
-        family: '${SERVICE}',
-        networkMode: 'awsvpc',
-        requiresCompatibilities: ['FARGATE'],
-        cpu: '1024',
-        memory: '2048',
-        volumes: [{ name: 'caddy-config' }],
-        containerDefinitions: containers,
-    };
-    const secretArgs = fed
-        ? 'PROVIDER_KEY_SECRET_ARN=<...> AUTH_JWT_SECRET_SECRET_ARN=<...>'
-        : 'PROVIDER_KEY_SECRET_ARN=<...> AUTH_JWT_SECRET_SECRET_ARN=<...> ' +
-            'OAUTH_CLIENT_ID_SECRET_ARN=<...> OAUTH_CLIENT_SECRET_SECRET_ARN=<...> OAUTH_COOKIE_SECRET_SECRET_ARN=<...>';
-    const deploy = [
-        '#!/usr/bin/env bash',
-        `# AWS ECS Fargate + AgentHippo edge (${fed ? 'edge-fed: federated identity, no oauth2-proxy' : 'edge: self-issued'}).`,
-        '# One-time setup (not per deploy): create an ALB + target group (protocol HTTP, port 8080,',
-        '# target type ip) pointed at this service, and an HTTPS listener forwarding to it — ALB',
-        '# terminates TLS, same as Cloud Run\'s edge path (Caddy listens on plain HTTP behind it).',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        'SERVICE="' + ctx.packName + '"',
-        'REGION="${AWS_REGION:-us-east-1}"',
-        'ACCOUNT_ID="${ACCOUNT_ID:-$(aws sts get-caller-identity --query Account --output text)}"',
-        'REPO="agenthippo/${SERVICE}"',
-        'IMAGE="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/${REPO}:latest"',
-        '',
-        'aws ecr describe-repositories --repository-names "$REPO" --region "$REGION" >/dev/null 2>&1 \\',
-        '  || aws ecr create-repository --repository-name "$REPO" --region "$REGION"',
-        'aws ecr get-login-password --region "$REGION" \\',
-        '  | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"',
-        '',
-        '# auth-broker reuses the agent image (CLI ships `auth-broker`).',
-        'docker build --platform linux/amd64 -f deploy/Dockerfile -t "$IMAGE" .',
-        'docker push "$IMAGE"',
-        '',
-        'PROVIDER_KEY_SECRET_ARN="${PROVIDER_KEY_SECRET_ARN:?set PROVIDER_KEY_SECRET_ARN}"',
-        'AUTH_JWT_SECRET_SECRET_ARN="${AUTH_JWT_SECRET_SECRET_ARN:?set AUTH_JWT_SECRET_SECRET_ARN}"',
-        ...(fed ? [] : [
-            'OAUTH_CLIENT_ID_SECRET_ARN="${OAUTH_CLIENT_ID_SECRET_ARN:?set OAUTH_CLIENT_ID_SECRET_ARN}"',
-            'OAUTH_CLIENT_SECRET_SECRET_ARN="${OAUTH_CLIENT_SECRET_SECRET_ARN:?set OAUTH_CLIENT_SECRET_SECRET_ARN}"',
-            'OAUTH_COOKIE_SECRET_SECRET_ARN="${OAUTH_COOKIE_SECRET_SECRET_ARN:?set OAUTH_COOKIE_SECRET_SECRET_ARN}"',
-        ]),
-        'TASK_JSON="$(sed -e "s|\\${IMAGE}|${IMAGE}|g" -e "s|\\${SERVICE}|${SERVICE}|g" -e "s|\\${REGION}|${REGION}|g" \\',
-        '    -e "s|\\${PROVIDER_KEY_SECRET_ARN}|${PROVIDER_KEY_SECRET_ARN}|g" \\',
-        '    -e "s|\\${AUTH_JWT_SECRET_SECRET_ARN}|${AUTH_JWT_SECRET_SECRET_ARN}|g" \\',
-        ...(fed ? [] : [
-            '    -e "s|\\${OAUTH_CLIENT_ID_SECRET_ARN}|${OAUTH_CLIENT_ID_SECRET_ARN}|g" \\',
-            '    -e "s|\\${OAUTH_CLIENT_SECRET_SECRET_ARN}|${OAUTH_CLIENT_SECRET_SECRET_ARN}|g" \\',
-            '    -e "s|\\${OAUTH_COOKIE_SECRET_SECRET_ARN}|${OAUTH_COOKIE_SECRET_SECRET_ARN}|g" \\',
-        ]),
-        '    deploy/task-definition.json)"',
-        'aws ecs register-task-definition --region "$REGION" --cli-input-json "$TASK_JSON" >/dev/null',
-        '',
-        'CLUSTER="${CLUSTER:?set CLUSTER}"',
-        'TARGET_GROUP_ARN="${TARGET_GROUP_ARN:?set TARGET_GROUP_ARN — from the one-time ALB setup above}"',
-        'aws ecs describe-services --cluster "$CLUSTER" --services "$SERVICE" --region "$REGION" 2>/dev/null \\',
-        '  | grep -q \'"status": "ACTIVE"\' \\',
-        '  && aws ecs update-service --cluster "$CLUSTER" --service "$SERVICE" \\',
-        '       --task-definition "$SERVICE" --region "$REGION" >/dev/null \\',
-        '  || aws ecs create-service --cluster "$CLUSTER" --service-name "$SERVICE" \\',
-        '       --task-definition "$SERVICE" --desired-count 1 --launch-type FARGATE \\',
-        '       --load-balancers "targetGroupArn=$TARGET_GROUP_ARN,containerName=caddy,containerPort=8080" \\',
-        '       --network-configuration "awsvpcConfiguration={subnets=[${SUBNETS:?set SUBNETS}],securityGroups=[${SECURITY_GROUPS:?set SECURITY_GROUPS}],assignPublicIp=ENABLED}" \\',
-        '       --region "$REGION" >/dev/null',
-        'echo "Deployed $SERVICE behind the AgentHippo edge on ECS cluster $CLUSTER"',
-        '',
-    ].join('\n');
-    return {
-        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'Caddyfile': fed ? (0, identity_1.renderSidecarFedCaddyfile)(ctx.idpUrl) : (0, identity_1.renderSidecarEdgeCaddyfile)(),
-        'task-definition.json': JSON.stringify(taskDef, null, 2) + '\n',
-        'deploy.sh': deploy,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — AWS ECS Fargate + AgentHippo edge (${fed ? 'edge-fed' : 'edge'})`,
-            '',
-            `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
-            '',
-            'One Fargate task, containers share the task\'s localhost (`awsvpc` network mode) —',
-            'the same sidecar shape Cloud Run uses, so the Caddyfile is identical:',
-            '- **caddy** (ingress, the only published port) → ' + (fed
-                ? 'verifies the shared AgentHippo JWT'
-                : 'SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer'),
-            `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (not published)`,
-            '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`)' + (fed ? ' against the shared IdP secret' : ''),
-            ...(fed ? [] : ['- **oauth2-proxy** → Google SSO for browser clients']),
-            '',
-            '**One-time setup (not per deploy):** an ALB + HTTPS listener + target group (HTTP, port',
-            '8080, target type `ip`) pointed at this service — ALB terminates TLS, Caddy stays HTTP.',
-            '',
-            '```bash',
-            `export CLUSTER=<ecs-cluster> SUBNETS=<subnet-ids> SECURITY_GROUPS=<sg-ids> TARGET_GROUP_ARN=<from ALB setup>`,
-            `export ${secretArgs}`,
-            'bash deploy/deploy.sh',
-            '```',
-            '',
-            '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
-            '> running it against a real account.',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-/**
- * Azure Container Apps (T1-generic, `d9-azure-adapter`). One Container App's containers run
- * as a single replica sharing localhost — the same sidecar shape as Cloud Run/ECS Fargate, so
- * the edge/edge-fed Caddyfiles and `EDGE_AGENT_PORT` convention are reused verbatim again
- * (PLAN/deploy.md §5). Container Apps environments provide built-in ingress + TLS termination,
- * so unlike aws-ecs there's no separate one-time load-balancer setup — `--target-port` on the
- * container app itself is the whole ingress story.
- *
- * Scope: identity/exposure only (bare / edge / edge-fed), same as aws-ecs — no Spotlight/LiteLLM
- * sidecar variant yet. Newer and far less exercised than the Cloud Run path.
- */
-function azureContainerAppsArtifacts(ctx) {
-    const fed = ctx.ingress === 'edge-fed';
-    const edge = ctx.ingress === 'edge' || fed;
-    const providerKeyEnv = litellmProviderKeyEnv(ctx.model);
-    const PORT = 8080;
-    if (!edge) {
-        const spec = {
-            properties: {
-                configuration: {
-                    ingress: { external: true, targetPort: ctx.port },
-                    secrets: [{ name: 'provider-key', value: '${PROVIDER_KEY}' }],
-                },
-                template: {
-                    containers: [
-                        {
-                            name: 'agent',
-                            image: '${IMAGE}',
-                            env: [
-                                { name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' },
-                                { name: providerKeyEnv, secretRef: 'provider-key' },
-                            ],
-                            resources: { cpu: 0.5, memory: '1Gi' },
-                        },
-                    ],
-                },
-            },
-        };
-        const deploy = [
-            '#!/usr/bin/env bash',
-            '# T1-generic: Azure Container Apps, single container — built-in ingress + TLS, no separate',
-            '# load balancer to stand up. For a self-contained AgentHippo edge, use --ingress edge or',
-            '# --ingress edge-fed instead.',
-            'set -euo pipefail',
-            ...anchorToStagingRoot(),
-            'SERVICE="' + ctx.packName + '"',
-            'RESOURCE_GROUP="${RESOURCE_GROUP:?set RESOURCE_GROUP}"',
-            'ENVIRONMENT="${CONTAINERAPPS_ENVIRONMENT:?set CONTAINERAPPS_ENVIRONMENT — az containerapp env create (one-time)}"',
-            'ACR_NAME="${ACR_NAME:?set ACR_NAME — an Azure Container Registry (one-time: az acr create)}"',
-            'IMAGE="${ACR_NAME}.azurecr.io/${SERVICE}:latest"',
-            `PROVIDER_KEY="\${PROVIDER_KEY:?set PROVIDER_KEY — your ${providerKeyEnv}}"`,
-            '',
-            '# Builds in ACR (no local docker login/push step needed).',
-            'az acr build --registry "$ACR_NAME" --image "${SERVICE}:latest" --file deploy/Dockerfile .',
-            '',
-            'az containerapp show --name "$SERVICE" --resource-group "$RESOURCE_GROUP" >/dev/null 2>&1 \\',
-            '  && az containerapp update --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
-            '       --image "$IMAGE" >/dev/null \\',
-            '  || az containerapp create --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
-            '       --environment "$ENVIRONMENT" --image "$IMAGE" \\',
-            '       --target-port ' + ctx.port + ' --ingress external \\',
-            '       --secrets "provider-key=$PROVIDER_KEY" \\',
-            `       --env-vars "AGENTHIPPO_NO_AUTO_INSTALL=1" "${providerKeyEnv}=secretref:provider-key" \\`,
-            '       >/dev/null',
-            'echo "Deployed $SERVICE to Container Apps environment $ENVIRONMENT"',
-            '',
-        ].join('\n');
-        return {
-            'Dockerfile': sharedDockerfile(ctx),
-            'containerapp.json': JSON.stringify(spec, null, 2) + '\n',
-            'deploy.sh': deploy,
-            'README.md': [
-                `# Deploy: ${ctx.packName} — Azure Container Apps (T1-generic)`,
-                '',
-                `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
-                '',
-                'Single container, built-in ingress + TLS — no separate load balancer to stand up.',
-                'Use `--ingress edge` or `--ingress edge-fed` for a self-contained AgentHippo edge instead.',
-                '',
-                '```bash',
-                'export RESOURCE_GROUP=<rg> CONTAINERAPPS_ENVIRONMENT=<env> ACR_NAME=<registry>',
-                `export PROVIDER_KEY=<your ${providerKeyEnv}>`,
-                'bash deploy/deploy.sh',
-                '```',
-                '',
-                '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
-                '> running it against a real account.',
-                '',
-                ...renderEgressNote(ctx),
-            ].join('\n'),
-        };
-    }
-    // Edge / edge-fed: Caddy + (self-issued: oauth2-proxy) + auth-broker + agent, one Container
-    // App (containers in one replica share localhost, same sidecar shape as Cloud Run/ECS) —
-    // reuses the identical Caddyfiles Cloud Run already renders.
-    const containers = [
-        {
-            name: 'caddy',
-            image: 'caddy:2.8-alpine',
-            env: [{ name: 'PORT', value: String(PORT) }, { name: 'AGENTHIPPO_PUBLIC_HOSTNAME', value: ctx.publicHostname }],
-            resources: { cpu: 0.25, memory: '0.5Gi' },
-        },
-        ...(fed ? [] : [{
-                name: 'oauth2-proxy',
-                image: 'quay.io/oauth2-proxy/oauth2-proxy:v7.7.1',
-                env: [
-                    { name: 'OAUTH2_PROXY_HTTP_ADDRESS', value: '0.0.0.0:4180' },
-                    { name: 'OAUTH2_PROXY_UPSTREAMS', value: 'file:///dev/null' },
-                    { name: 'OAUTH2_PROXY_SET_XAUTHREQUEST', value: 'true' },
-                    { name: 'OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER', value: 'true' },
-                    { name: 'OAUTH2_PROXY_SKIP_PROVIDER_BUTTON', value: 'true' },
-                    { name: 'OAUTH2_PROXY_REVERSE_PROXY', value: 'true' },
-                    { name: 'OAUTH2_PROXY_CLIENT_ID', secretRef: 'oauth-client-id' },
-                    { name: 'OAUTH2_PROXY_CLIENT_SECRET', secretRef: 'oauth-client-secret' },
-                    { name: 'OAUTH2_PROXY_COOKIE_SECRET', secretRef: 'oauth-cookie-secret' },
-                ],
-                resources: { cpu: 0.25, memory: '0.5Gi' },
-            }]),
-        {
-            name: 'auth-broker',
-            image: '${IMAGE}',
-            command: ['agenthippo', 'auth-broker'],
-            env: [
-                { name: 'AGENTHIPPO_AUTH_PORT', value: '9780' },
-                { name: 'AGENTHIPPO_AUTH_JWT_SECRET', secretRef: 'auth-jwt-secret' },
-                ...(fed ? [
-                    { name: 'AGENTHIPPO_AUTH_COOKIE_DOMAIN', value: ctx.cookieDomain || '' },
-                    { name: 'AGENTHIPPO_AUTH_IDP_URL', value: ctx.idpUrl || '' },
-                ] : []),
-            ],
-            resources: { cpu: 0.25, memory: '0.5Gi' },
-        },
-        {
-            name: 'agent',
-            image: '${IMAGE}',
-            command: serveCmdArgs(ctx, { wwwDir: '/app/pack/deploy/www', port: identity_1.EDGE_AGENT_PORT }),
-            env: [
-                { name: 'AGENTHIPPO_NO_AUTO_INSTALL', value: '1' },
-                { name: providerKeyEnv, secretRef: 'provider-key' },
-            ],
-            resources: { cpu: 0.5, memory: '1Gi' },
-        },
-    ];
-    const spec = {
-        properties: {
-            configuration: {
-                ingress: { external: true, targetPort: PORT },
-                secrets: [
-                    { name: 'auth-jwt-secret', value: '${AUTH_JWT_SECRET}' },
-                    { name: 'provider-key', value: '${PROVIDER_KEY}' },
-                    ...(fed ? [] : [
-                        { name: 'oauth-client-id', value: '${OAUTH_CLIENT_ID}' },
-                        { name: 'oauth-client-secret', value: '${OAUTH_CLIENT_SECRET}' },
-                        { name: 'oauth-cookie-secret', value: '${OAUTH_COOKIE_SECRET}' },
-                    ]),
-                ],
-            },
-            template: { containers },
-        },
-    };
-    const secretExports = [
-        'AUTH_JWT_SECRET="${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET}"',
-        `PROVIDER_KEY="\${PROVIDER_KEY:?set PROVIDER_KEY — your ${providerKeyEnv}}"`,
-        ...(fed ? [] : [
-            'OAUTH_CLIENT_ID="${OAUTH_CLIENT_ID:?set OAUTH_CLIENT_ID}"',
-            'OAUTH_CLIENT_SECRET="${OAUTH_CLIENT_SECRET:?set OAUTH_CLIENT_SECRET}"',
-            'OAUTH_COOKIE_SECRET="${OAUTH_COOKIE_SECRET:?set OAUTH_COOKIE_SECRET}"',
-        ]),
-    ];
-    const deploy = [
-        '#!/usr/bin/env bash',
-        `# Azure Container Apps + AgentHippo edge (${fed ? 'edge-fed: federated identity, no oauth2-proxy' : 'edge: self-issued'}).`,
-        '# Container Apps environments provide built-in ingress + TLS — no separate load balancer.',
-        'set -euo pipefail',
-        ...anchorToStagingRoot(),
-        'SERVICE="' + ctx.packName + '"',
-        'RESOURCE_GROUP="${RESOURCE_GROUP:?set RESOURCE_GROUP}"',
-        'ENVIRONMENT="${CONTAINERAPPS_ENVIRONMENT:?set CONTAINERAPPS_ENVIRONMENT — az containerapp env create (one-time)}"',
-        'ACR_NAME="${ACR_NAME:?set ACR_NAME — an Azure Container Registry (one-time: az acr create)}"',
-        'IMAGE="${ACR_NAME}.azurecr.io/${SERVICE}:latest"',
-        '',
-        '# auth-broker reuses the agent image (CLI ships `auth-broker`). Builds in ACR.',
-        'az acr build --registry "$ACR_NAME" --image "${SERVICE}:latest" --file deploy/Dockerfile .',
-        '',
-        ...secretExports,
-        'SPEC_JSON="$(sed -e "s|\\${IMAGE}|${IMAGE}|g" -e "s|\\${AUTH_JWT_SECRET}|${AUTH_JWT_SECRET}|g" \\',
-        '    -e "s|\\${PROVIDER_KEY}|${PROVIDER_KEY}|g" \\',
-        ...(fed ? [] : [
-            '    -e "s|\\${OAUTH_CLIENT_ID}|${OAUTH_CLIENT_ID}|g" -e "s|\\${OAUTH_CLIENT_SECRET}|${OAUTH_CLIENT_SECRET}|g" \\',
-            '    -e "s|\\${OAUTH_COOKIE_SECRET}|${OAUTH_COOKIE_SECRET}|g" \\',
-        ]),
-        '    deploy/containerapp.json)"',
-        'echo "$SPEC_JSON" > /tmp/${SERVICE}-containerapp.json',
-        '',
-        '# `--yaml` also accepts JSON (JSON is valid YAML) — kept as .json so it\'s reviewable',
-        '# alongside the other checked-in templates without a format switch.',
-        'az containerapp show --name "$SERVICE" --resource-group "$RESOURCE_GROUP" >/dev/null 2>&1 \\',
-        '  && az containerapp update --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
-        '       --yaml /tmp/${SERVICE}-containerapp.json >/dev/null \\',
-        '  || az containerapp create --name "$SERVICE" --resource-group "$RESOURCE_GROUP" \\',
-        '       --environment "$ENVIRONMENT" --yaml /tmp/${SERVICE}-containerapp.json >/dev/null',
-        'echo "Deployed $SERVICE behind the AgentHippo edge in $ENVIRONMENT"',
-        '',
-    ].join('\n');
-    return {
-        'Dockerfile': sharedDockerfile(ctx, { wwwDir: '/app/pack/deploy/www' }),
-        'www/index.html': renderLandingPage(ctx.packName),
-        'Caddyfile': fed ? (0, identity_1.renderSidecarFedCaddyfile)(ctx.idpUrl) : (0, identity_1.renderSidecarEdgeCaddyfile)(),
-        'containerapp.json': JSON.stringify(spec, null, 2) + '\n',
-        'deploy.sh': deploy,
-        'README.md': [
-            `# Deploy: ${ctx.packName} — Azure Container Apps + AgentHippo edge (${fed ? 'edge-fed' : 'edge'})`,
-            '',
-            `Engine: **${ctx.engine}**${ctx.model ? `, model: **${ctx.model}**` : ''}.`,
-            '',
-            'One Container App, containers share the replica\'s localhost — the same sidecar shape',
-            'Cloud Run/ECS Fargate use, so the Caddyfile is identical:',
-            '- **caddy** (ingress, the only published port) → ' + (fed
-                ? 'verifies the shared AgentHippo JWT'
-                : 'SSO edge: oauth2-proxy for browsers, auth-broker for IDE Bearer'),
-            `- **agent** → serves www + /v1/* on localhost:${identity_1.EDGE_AGENT_PORT} (not published)`,
-            '- **auth-broker** → validates IDE AgentHippo JWTs (`/api/ide/me`)' + (fed ? ' against the shared IdP secret' : ''),
-            ...(fed ? [] : ['- **oauth2-proxy** → Google SSO for browser clients']),
-            '',
-            'Built-in ingress + TLS termination — no separate load balancer to stand up.',
-            '',
-            '```bash',
-            'export RESOURCE_GROUP=<rg> CONTAINERAPPS_ENVIRONMENT=<env> ACR_NAME=<registry>',
-            ...secretExports.map((l) => 'export ' + l.split('=')[0] + '=<...>'),
-            'bash deploy/deploy.sh',
-            '```',
-            '',
-            '> ⚠️ Newer and far less exercised than the Cloud Run target — read `deploy.sh` before',
-            '> running it against a real account.',
-            '',
-            ...renderEgressNote(ctx),
-        ].join('\n'),
-    };
-}
-const RENDERERS = {
-    vm: vmArtifacts,
-    compose: composeArtifacts,
-    cloudrun: cloudrunArtifacts,
-    'databricks-app': databricksAppArtifacts,
-    spcs: spcsArtifacts,
-    cloudflare: cloudflareArtifacts,
-    'aws-ecs': awsEcsArtifacts,
-    'azure-container-apps': azureContainerAppsArtifacts,
-};
-/**
- * Render every artifact for a target (relative path → file content), always
- * including a scanned `.env.example`. Pure: no fs writes.
- */
-function renderTarget(target, ctx) {
-    const files = RENDERERS[target](ctx);
-    // edge-fed applies to any Caddy-based target (vm/compose/cloudrun) — federates identity
-    // against a central IdP instead of each target running its own oauth2-proxy + Google client.
-    const fed = ctx.ingress === 'edge-fed';
-    // Colocated agents (state 4) ship no edge of their own at all — no Caddy, no oauth2-proxy,
-    // no local auth-broker, so no auth secrets (.env.auth.example / DATA-ACCESS.md) either.
-    const colocate = Boolean(ctx.colocate) && fed && (target === 'vm' || target === 'compose');
-    const gatewayDirect = usesGatewayDirect(ctx) && target === 'cloudrun' && fed;
-    const edge = !colocate && (target === 'vm' || target === 'compose'
-        || ((target === 'cloudrun' || target === 'aws-ecs' || target === 'azure-container-apps') && (ctx.ingress === 'edge' || fed)));
-    const hasDockerfile = Object.keys(files).some((k) => k === 'Dockerfile' || k.endsWith('/Dockerfile'));
-    const raw = {
-        ...files,
-        ...(hasDockerfile ? { '.dockerignore': renderDockerignore() } : {}),
-        '.env.example': renderEnvExample(ctx.envVars, {
-            edge,
-            engine: ctx.engine,
-            hostname: ctx.publicHostname,
-            gatewayDirect,
-        }),
-        // Edge auth secrets are split out so the agent container never loads them.
-        ...(edge ? {
-            '.env.auth.example': renderAuthEnvExample({
-                hostname: ctx.publicHostname,
-                fed,
-                idpUrl: ctx.idpUrl,
-                cookieDomain: ctx.cookieDomain,
-            }),
-        } : {}),
-        'DATA-ACCESS.md': renderDataAccessSummary(ctx, target, edge, fed, colocate),
-    };
-    const out = {};
-    for (const [rel, content] of Object.entries(raw)) {
-        out[rel] = withPackAttribution(ctx, rel, content);
-    }
-    return out;
-}