@h-ai/cli 0.1.0-alpha.63 → 0.1.0-alpha.65

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { generateConfigFile } from './chunk-WW2MIO6T.js';
-import { cliM } from './chunk-X3RSYNBG.js';
+import { generateConfigFile, runtimeEnvironmentVariables, renderEnvironment, moduleEnvironmentVariables, parameterizeConfig } from './chunk-47V5OT22.js';
+import { cliM } from './chunk-IPG3QNYK.js';
 import './chunk-2H7UOFLK.js';
-import process4 from 'process';
+import process3 from 'process';
 import { cac } from 'cac';
 import chalk from 'chalk';
-import path2, { resolve } from 'path';
-import { fileURLToPath } from 'url';
+import path2, { resolve, join } from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { wrapAnsi } from 'fast-wrap-ansi';
 import fse from 'fs-extra';
 import Handlebars2 from 'handlebars';
@@ -16,24 +16,25 @@ import prompts from 'prompts';
 import { Buffer } from 'buffer';
 import { execSync, execFileSync } from 'child_process';
 import { randomBytes } from 'crypto';
-import { stringify, parse } from 'yaml';
-import { existsSync, readFileSync } from 'fs';
+import { stringify, parseDocument } from 'yaml';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { createRequire } from 'module';
 
 var CAMEL_CASE_SEPARATOR_REGEX = /[-_\s]+(.)?/g;
 var LEADING_CHAR_REGEX = /^./;
 function writeCliMessage(message) {
-  process4.stdout.write(`${message}
+  process3.stdout.write(`${message}
 `);
 }
 function writeCliError(message, error) {
-  process4.stderr.write(`${message}
+  process3.stderr.write(`${message}
 `);
   if (error !== void 0)
-    process4.stderr.write(`${error instanceof Error ? error.message : String(error)}
+    process3.stderr.write(`${error instanceof Error ? error.message : String(error)}
 `);
 }
 function formatPromptDescription(description) {
-  return wrapAnsi(description, Math.max(1, (process4.stdout.columns || 80) - 32), { hard: true });
+  return wrapAnsi(description, Math.max(1, (process3.stdout.columns || 80) - 32), { hard: true });
 }
 function toCamelCase(str) {
   return str.replace(CAMEL_CASE_SEPARATOR_REGEX, (_, c) => c ? c.toUpperCase() : "").replace(LEADING_CHAR_REGEX, (c) => c.toLowerCase());
@@ -121,7 +122,7 @@ Handlebars2.registerHelper("yaml", (key, value) => stringify({ [key]: value }).t
 Handlebars2.registerHelper("jsString", (value) => `'${JSON.stringify(value).slice(1, -1).replace(/\\"/g, '"').replace(/'/g, "\\'")}'`);
 Handlebars2.registerHelper("moduleConfig", function(moduleKey, enabled) {
   const content = generateConfigFile(moduleKey, this.moduleConfigs).trimEnd();
-  const configured = this.appType === "fullstack" && moduleKey === "iam" ? content.replace("seedDefaultData: true", "seedDefaultData: false") : content;
+  const configured = this.appType === "fullstack" && moduleKey === "iam" ? content.replace("HAI_IAM_SEEDDEFAULTDATA:true", "HAI_IAM_SEEDDEFAULTDATA:false").replace("variant: card", "variant: split") : content;
   return enabled ? configured : `# # \u672A\u542F\u7528\uFF1A\u5B89\u88C5\u5BF9\u5E94\u6A21\u5757\u5E76\u5728\u670D\u52A1\u7AEF runtime \u4E2D\u521D\u59CB\u5316\uFF0C\u518D\u53D6\u6D88\u6240\u9700\u914D\u7F6E\u7684\u6CE8\u91CA\u3002
 ${configured.split("\n").map((line) => line ? `# ${line}` : "").join("\n")}`;
 });
@@ -465,7 +466,7 @@ function buildAppHaiCatalogPackages(options) {
     packageNames.push("@h-ai/capacitor");
   return pickCatalogPackages(packageNames, HAI_CATALOG_PACKAGES);
 }
-function buildFullstackCatalogPackages(frontends) {
+function buildFullstackCatalogPackages(frontends, deploy = false) {
   const packageNames = [
     ...FULLSTACK_ROOT_CATALOG_PACKAGE_NAMES,
     ...FULLSTACK_CONTRACT_CATALOG_PACKAGE_NAMES,
@@ -478,6 +479,8 @@ function buildFullstackCatalogPackages(frontends) {
     packageNames.push(...FULLSTACK_APP_CATALOG_PACKAGE_NAMES);
   if (frontends.includes("desktop"))
     packageNames.push(...FULLSTACK_DESKTOP_CATALOG_PACKAGE_NAMES);
+  if (deploy)
+    packageNames.push("@h-ai/deploy");
   return pickCatalogPackages(packageNames, FULLSTACK_CATALOG_PACKAGES);
 }
 var FEATURE_ROUTE_DIRS = {
@@ -594,7 +597,7 @@ function buildTemplateContext(options) {
   const selectedFrontends = options.frontends ?? DEFAULT_FULLSTACK_FRONTENDS;
   let haiCatalogPackages;
   if (isFullstack) {
-    haiCatalogPackages = buildFullstackCatalogPackages(selectedFrontends);
+    haiCatalogPackages = buildFullstackCatalogPackages(selectedFrontends, featureMap.deploy);
   } else if (isApi) {
     haiCatalogPackages = buildApiWorkspaceCatalogPackages(featureMap);
   } else {
@@ -769,6 +772,10 @@ async function generateFromTemplates(projectPath, context) {
     }
   }
   await renderDynamicFiles(root, projectPath, context);
+  if (context.isSvelteOnlyApp || context.appType === "fullstack") {
+    const navigationDir = context.appType === "fullstack" ? path2.join(projectPath, "packages", `${context.projectName}-shared`, "src", "lib", "navigation") : path2.join(projectPath, "src", "lib", "navigation");
+    await fse.copy(path2.join(root, "shared", "hash-router.svelte.ts"), path2.join(navigationDir, "hash-router.svelte.ts"));
+  }
   if (context.hasI18n) {
     const i18nDir = path2.join(root, "i18n");
     if (await fse.pathExists(i18nDir)) {
@@ -839,7 +846,8 @@ async function renderHbsInDir(dir, destRoot, context) {
       continue;
     }
     const destPath = path2.join(destRoot, outRelPath);
-    const normalizedRendered = normalizeRenderedContent(rendered, outRelPath);
+    const configMatch = /(?:^|[/\\])config[/\\]_([^/\\]+)\.ya?ml$/.exec(outRelPath);
+    const normalizedRendered = normalizeRenderedContent(configMatch ? parameterizeConfig(configMatch[1], rendered) : rendered, outRelPath);
     await fse.ensureDir(path2.dirname(destPath));
     await fse.writeFile(destPath, normalizedRendered, "utf-8");
   }
@@ -1124,7 +1132,7 @@ async function createProject(options) {
     });
     await generateFromTemplates(projectPath, context);
     {
-      const { generateConfigFile: generateConfigFile2, generateEnvExample } = await import('./cli-config-templates-QRF6B5T4.js');
+      const { generateConfigFile: generateConfigFile2, generateEnvExample } = await import('./cli-config-templates-SJ2MBIR7.js');
       const configs = resolvedOptions.moduleConfigs;
       const isApiWorkspace = resolvedOptions.appType === "api";
       const isFullstack = resolvedOptions.appType === "fullstack";
@@ -1145,26 +1153,60 @@ async function createProject(options) {
           generateConfigFile2("core", configs)
         );
       }
-      const envExample = isApiWorkspace ? `${generateEnvExample(resolvedOptions.features, configs)}
-# =============================================================================
-# Service Runtime
-# =============================================================================
-PORT=3000
-` : isFullstack ? `${generateEnvExample(resolvedOptions.features, configs, true)}
-# First-start administrator password. The CLI generates a random value in .env.
+      const configContents = {};
+      for (const file of await fse.readdir(configDir)) {
+        if (/^_.*\.yml$/.test(file))
+          configContents[file.slice(1, -4)] = await fse.readFile(path2.join(configDir, file), "utf8");
+      }
+      const envFeatures = resolvedOptions.features;
+      const envContents = generateEnvExample(envFeatures, configs, isFullstack, configContents);
+      let envExample = isApiWorkspace ? envContents : isFullstack ? `${envContents}
+# First-start administrator password; must satisfy the IAM password policy.
 HAI_ADMIN_DEFAULT_PASSWORD=
 
-# Local development API. Use your public API origin for deployment/native clients.
+# Public API origin; never include credentials.
 PUBLIC_API_BASE=http://127.0.0.1:3000
-` : generateEnvExample(resolvedOptions.features, configs);
+` : context.isSvelteOnlyApp ? `${envContents}
+# Public API URL including /api/v1; never include credentials.
+PUBLIC_API_BASE=http://10.0.2.2:3000/api/v1
+` : envContents;
+      const runtimeVariables = /* @__PURE__ */ new Map();
+      for (const file of await fse.readdir(projectPath, { recursive: true, encoding: "utf8" })) {
+        if (!/\.(?:ts|js|mjs|svelte|envsh)$/.test(file))
+          continue;
+        for (const variable of runtimeEnvironmentVariables(await fse.readFile(path2.join(projectPath, file), "utf8")))
+          runtimeVariables.set(variable.name, variable);
+      }
+      const existingNames = new Set([...envExample.matchAll(/^(?:#\s*)?([A-Z][A-Z0-9_]*)=/gm)].map((match) => match[1]));
+      const runtimeExample = renderEnvironment([...runtimeVariables.values()].filter((variable) => !existingNames.has(variable.name)));
+      if (runtimeExample)
+        envExample += `
+# \u53EF\u9009\u8FD0\u884C\u5165\u53E3\uFF08\u6309\u7528\u9014\u6CE8\u5165\uFF0C\u4E0D\u8FDB\u5165\u516C\u5171\u9ED8\u8BA4\u503C\uFF09\uFF1A
+${runtimeExample.split("\n").map((line) => line && !line.startsWith("#") ? `# ${line}` : line).join("\n")}
+`;
       await writeFile(envExamplePath, envExample);
+      const envDirectory = path2.dirname(envExamplePath);
+      const sharedVariables = envExample.split("\n").filter((line) => /^[A-Z][A-Z0-9_]*=/.test(line));
+      await writeFile(path2.join(envDirectory, ".env"), `# \u516C\u5171\u57FA\u7840\u914D\u7F6E\uFF08\u53EF\u63D0\u4EA4\uFF09\uFF1B\u5B8C\u6574\u5B57\u6BB5\u8BF4\u660E\u89C1 .env.example\u3002
+${sharedVariables.join("\n")}
+`);
+      for (const [mode, environment] of [["dev", "development"], ["test", "test"], ["prod", "production"]]) {
+        await writeFile(path2.join(envDirectory, `.env.${mode}`), `# \u516C\u5171 ${mode} \u73AF\u5883\u914D\u7F6E\uFF1B\u672C\u673A\u79C1\u6709\u503C\u653E .env.local\uFF0C\u8FDB\u7A0B\u73AF\u5883\u53D8\u91CF\u4F18\u5148\u3002
+HAI_CORE_ENV=${environment}
+HAI_CORE_DEBUG=false
+HAI_CORE_LOGGING_LEVEL=${mode === "test" ? "warn" : mode === "dev" ? "debug" : "info"}
+`);
+      }
       if (isFullstack) {
         const password = `Aa1!${randomBytes(24).toString("base64url")}`;
-        await fse.writeFile(path2.join(projectPath, ".env"), envExample.replace("HAI_ADMIN_DEFAULT_PASSWORD=\n", `HAI_ADMIN_DEFAULT_PASSWORD=${password}
-`), { mode: 384 });
+        await fse.writeFile(path2.join(projectPath, ".env.local"), `# \u672C\u673A\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002
+HAI_ADMIN_DEFAULT_PASSWORD=${password}
+`, { mode: 384 });
+      } else {
+        await writeFile(path2.join(envDirectory, ".env.local"), "# \u672C\u673A\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u63D0\u4EA4 Git\uFF1B\u8986\u76D6\u516C\u5171\u57FA\u7840\u548C\u73AF\u5883\u914D\u7F6E\u3002\n");
       }
     }
-    const { generateSkillFiles } = await import('./cli-skill-templates-EZFW7D43.js');
+    const { generateSkillFiles } = await import('./cli-skill-templates-A5VIR5J6.js');
     await generateSkillFiles(
       projectPath,
       resolvedOptions.features,
@@ -1211,7 +1253,7 @@ async function resolveOptions(options) {
   writeCliMessage("");
   const onCancel = () => {
     writeCliMessage(chalk.red("\n\u5DF2\u53D6\u6D88"));
-    process4.exit(1);
+    process3.exit(1);
   };
   let projectName = options.name;
   if (!projectName && useDefaults) {
@@ -1277,7 +1319,7 @@ async function resolveOptions(options) {
   let selectedFeatures = [];
   const appTypeDefaults = APP_TYPES[selectedAppType].defaultFeatures;
   if (selectedAppType === "fullstack") {
-    selectedFeatures = resolveFeatureDependencies(appTypeDefaults);
+    selectedFeatures = resolveFeatureDependencies([...appTypeDefaults, ...options.features?.includes("deploy") ? ["deploy"] : []]);
   } else if (selectedTemplate === "custom" && !options.features && useDefaults) {
     selectedFeatures = resolveFeatureDependencies(appTypeDefaults);
   } else if (selectedTemplate === "custom" && !options.features) {
@@ -1467,7 +1509,7 @@ async function promptModuleConfigs(features, projectName) {
   const configs = {};
   const onCancel = () => {
     writeCliMessage(chalk.red("\n\u5DF2\u53D6\u6D88"));
-    process4.exit(1);
+    process3.exit(1);
   };
   writeCliMessage("");
   writeCliMessage(chalk.bold("  \u2699 \u6A21\u5757\u914D\u7F6E"));
@@ -1685,16 +1727,34 @@ function generateAiDevelopmentReadme() {
 
 \u4ECE\u672C\u9879\u76EE\u6839\u76EE\u5F55\u6253\u5F00\u6240\u7528\u7F16\u7801\u5DE5\u5177\uFF0C\u5148\u8BFB\u53D6 [AGENTS.md](./AGENTS.md)\u3002Claude Code \u901A\u8FC7 [CLAUDE.md](./CLAUDE.md) \u52A0\u8F7D\u9879\u76EE\u89C4\u5219\uFF1BGitHub Copilot \u4F7F\u7528 [.github/copilot-instructions.md](./.github/copilot-instructions.md)\uFF0COpenCode \u4F7F\u7528 AGENTS.md \u548C [opencode.json](./opencode.json)\u3002
 
+\u4E1A\u52A1\u4EE5\u7528\u6237\u5F53\u524D\u660E\u786E\u8981\u6C42\u53CA\u5176\u6307\u5B9A\u7684\u9700\u6C42/\u8BBE\u8BA1\u6587\u6863\u4E3A\u51C6\u3002\u6A21\u677F AGENTS\u3001README\u3001skills\u3001\u751F\u6210\u4EE3\u7801\u4E0E\u6D4B\u8BD5\u4E2D\u7684\u89D2\u8272/\u6743\u9650\u3001\u6D41\u7A0B\u3001\u9650\u989D\u548C\u67B6\u6784\u662F\u53EF\u8C03\u6574\u7684\u521D\u59CB\u65B9\u6848\uFF1B\u5BA1\u67E5\u5C06\u5DEE\u5F02\u5217\u4E3A\u6A21\u677F\u9002\u914D\u9879\uFF0C\u5B9E\u65BD\u6309\u6388\u6743\u540C\u6B65\u51B2\u7A81\u4EE3\u7801\u3001\u6D4B\u8BD5\u4E0E\u8FC7\u671F\u89C4\u5219\uFF0C\u4E0D\u8981\u6C42\u628A\u9700\u6C42\u6539\u56DE\u6A21\u677F\u3002\u6846\u67B6 API \u4EE5\u5F53\u524D\u5B89\u88C5\u7248\u672C\u516C\u5F00\u5951\u7EA6\u4E3A\u51C6\uFF0C\u670D\u52A1\u7AEF\u6388\u6743\u3001\u8D44\u6E90\u9694\u79BB\u3001\u8F93\u5165\u6821\u9A8C\u548C\u51ED\u636E\u4FDD\u62A4\u4ECD\u9700\u843D\u5B9E\u3002
+
 Codex\u3001Cursor\u3001Copilot\u3001OpenCode \u4ECE .agents/skills/ \u53D1\u73B0\u5171\u4EAB\u6280\u80FD\uFF1BClaude Code \u901A\u8FC7 CLAUDE.md \u5F15\u7528 AGENTS.md\uFF0C\u5E76\u6309\u9879\u76EE\u6307\u5F15\u8BFB\u53D6 .agents/skills/ \u7684\u540C\u4E00\u4EFD\u6B63\u6587\u3002\u9700\u6C42\u6216\u8BBE\u8BA1\u6587\u6863\u5728\u751F\u6210\u524D\u4F7F\u7528 [\u6587\u6863\u5BA1\u67E5 Skill](./.agents/skills/hai-spec-review/SKILL.md) \u4E25\u683C\u68C0\u67E5\u5B8C\u5907\u6027\u3001\u6B67\u4E49\u3001\u6280\u672F\u6B63\u786E\u6027\u548C\u547D\u540D\u4E00\u81F4\u6027\uFF0C\u95EE\u9898\u89E3\u51B3\u540E\u518D\u751F\u6210\u3002\u666E\u901A\u65B0\u589E\u3001\u4FEE\u6539\u3001\u4FEE\u590D\u4EFB\u52A1\u4F7F\u7528 [\u5E94\u7528\u5F00\u53D1 Skill](./.agents/skills/hai-app-create/SKILL.md) \u548C [\u5F00\u53D1\u89C4\u8303\u4E0E\u6846\u67B6\u80FD\u529B\u8DEF\u7531](./.agents/skills/hai-app-create/development.md)\uFF1B\u5177\u4F53\u6A21\u5757\u518D\u6309\u9700\u8BFB\u53D6\uFF0C\u4E0D\u80FD\u628A Skill \u5DF2\u4EA4\u4ED8\u5F53\u6210\u4F9D\u8D56\u5DF2\u5B89\u88C5\u6216\u914D\u7F6E\u5DF2\u542F\u7528\u3002
 
-\u6839\u636E\u6587\u6863\u89C4\u5212\u3001\u5B9E\u65BD\u6216\u8FD4\u4FEE\u65F6\uFF0C\u4F7F\u7528 [\u6587\u6863\u5B9E\u65BD Skill](./.agents/skills/hai-spec-implement/SKILL.md)\uFF1A\u6309\u53EF\u9A8C\u6536\u529F\u80FD\u62C6\u5206\uFF0C\u7EF4\u62A4 docs/task-list.md \u4E0E docs/tasks/ \u8BB0\u5F55\uFF0C\u6BCF\u9879\u5728\u72EC\u7ACB\u5206\u652F\u8D70 TDD\u3001\u9A8C\u8BC1\u4E0E\u672C\u5730\u5408\u5E76\uFF1B\u8FD4\u4FEE\u6CBF\u7528\u539F\u4EFB\u52A1\u4E0E\u5206\u652F\u5E76\u8FFD\u52A0\u8BC1\u636E\u3002\u4EC5\u89C4\u5212\u4E0D\u5F00\u59CB\u5B9E\u73B0\uFF0C\u6307\u5B9A\u4EFB\u52A1\u5148\u6838\u9A8C\u4F9D\u8D56\u3002
+\u6839\u636E\u6587\u6863\u89C4\u5212\u3001\u5B9E\u65BD\u3001\u8FD4\u4FEE\u6216\u6309\u5DF2\u63D0\u4EA4\u6587\u6863\u5DEE\u5F02\u540C\u6B65\u5B9E\u73B0\u65F6\uFF0C\u4F7F\u7528 [\u6587\u6863\u5B9E\u65BD Skill](./.agents/skills/hai-spec-implement/SKILL.md)\uFF1A\u7EF4\u62A4 docs/task-list.md \u4E0E docs/tasks/\uFF0C\u8BB0\u5F55\u5DF2\u9A8C\u6536\u6587\u6863\u548C\u5B9E\u73B0\u7684 Git SHA\uFF0C\u6BD4\u8F83\u56FA\u5B9A\u76EE\u6807\u7248\u672C\u540E\u66F4\u65B0\u539F\u4EFB\u52A1\u6216\u65B0\u5EFA\u4EFB\u52A1\uFF0C\u6BCF\u9879\u72EC\u7ACB\u5206\u652F TDD\u3001\u9A8C\u8BC1\u5E76\u672C\u5730\u5408\u5E76\uFF1B\u5168\u90E8\u5DEE\u5F02\u4E0E\u6574\u4F53\u9A8C\u6536\u901A\u8FC7\u540E\u624D\u63A8\u8FDB\u57FA\u7EBF\u3002\u8FD4\u4FEE\u6CBF\u7528\u539F\u4EFB\u52A1\u4E0E\u5206\u652F\u3002\u4EC5\u89C4\u5212\u4E0D\u5F00\u59CB\u5B9E\u73B0\uFF0C\u6307\u5B9A\u4EFB\u52A1\u5148\u6838\u9A8C\u4F9D\u8D56\u3002
 
 \u4F18\u5148\u590D\u7528\u9002\u7528\u7684 hai-framework \u516C\u5F00 API \u4E0E\u5DF2\u6709\u4E1A\u52A1\u5B9E\u73B0\u3002\u5B8C\u6210\u65F6\u8BF4\u660E\u590D\u7528\u7684\u80FD\u529B\u3001\u76F8\u5173\u80FD\u529B\u672A\u91C7\u7528\u7684\u539F\u56E0\uFF0C\u4EE5\u53CA\u5B89\u5168\u8FB9\u754C\u548C\u7C7B\u578B\u3001\u914D\u7F6E\u3001\u6587\u6848\u3001\u8C03\u7528\u65B9\u7684\u540C\u6B65\u60C5\u51B5\u3002\u8D28\u91CF\u9A8C\u8BC1\u6309\u5F53\u524D package.json \u6267\u884C typecheck \u2192 lint \u2192 build \u2192 test\uFF1BUI\u3001\u8DEF\u7531\u4E0E\u7AEF\u5230\u7AEF\u6D41\u7A0B\u53E6\u8FD0\u884C test:e2e\uFF0C\u672A\u8FD0\u884C\u9879\u8BF4\u660E\u539F\u56E0\u3002\u5B89\u5168\u4E0E\u8D28\u91CF\u89C4\u5219\u65E2\u8981\u6309\u89C4\u8303\u5BA1\u67E5\uFF0C\u4E5F\u8981\u8FD0\u884C\u95E8\u7981\u9A8C\u8BC1\u3002
 
-\u5DF2\u6709 hai \u9879\u76EE\u53EF\u8FD0\u884C hai init \u8865\u9F50\u7F3A\u5931\u7684 AI \u652F\u6301\u6587\u4EF6\u4E0E\u53C2\u8003\u8D44\u6E90\uFF1B\u5DF2\u6709 AGENTS.md\u3001Skill \u548C\u81EA\u5B9A\u4E49\u89C4\u5219\u4F1A\u4FDD\u7559\uFF0C\u5347\u7EA7\u65F6\u9700\u5C06\u4E0A\u8FF0\u666E\u901A\u5F00\u53D1\u5165\u53E3\u4E0E\u89C4\u8303\u663E\u5F0F\u5408\u5E76\u5230\u65E7\u6307\u5F15\u3002
+\u5DF2\u6709 hai \u9879\u76EE\u53EF\u8FD0\u884C hai init \u8865\u9F50\u7F3A\u5931\u7684 AI \u652F\u6301\u6587\u4EF6\u4E0E\u53C2\u8003\u8D44\u6E90\uFF1B\u5DF2\u6709 AGENTS.md\u3001Skill \u548C\u81EA\u5B9A\u4E49\u89C4\u5219\u4F1A\u4FDD\u7559\uFF0C\u5347\u7EA7\u65F6\u9700\u5C06\u4E0A\u8FF0\u9700\u6C42\u4F18\u5148\u89C4\u5219\u3001\u666E\u901A\u5F00\u53D1\u5165\u53E3\u4E0E\u89C4\u8303\u663E\u5F0F\u5408\u5E76\u5230\u65E7\u6307\u5F15\uFF0C\u5E76\u4FEE\u6B63\u5DF2\u88AB\u9700\u6C42\u66FF\u4EE3\u7684\u6A21\u677F\u7EA6\u675F\u3002
 
 `;
 }
+function generateEnvironmentReadme() {
+  return `## \u5206\u73AF\u5883\u914D\u7F6E
+
+\u8FD0\u884C\u53C2\u6570\u5728 \`.env.example\` \u4E2D\u9010\u9879\u8BF4\u660E\u7528\u9014\u3001\u679A\u4E3E\u548C\u8303\u56F4\u3002\`.env\` \u4E3A\u516C\u5171\u57FA\u7840\uFF0C\`.env.dev\` / \`.env.test\` / \`.env.prod\` \u4E3A\u73AF\u5883\u8986\u76D6\uFF0C\u5747\u63D0\u4EA4 Git\uFF1B\`.env.local\` \u4E3A\u672C\u673A\u79C1\u6709\u8986\u76D6\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002\u4F18\u5148\u7EA7\u4E3A\u8FDB\u7A0B\u73AF\u5883 > \`.env.local\` > \u73AF\u5883\u6587\u4EF6 > \`.env\`\u3002YAML \u663E\u5F0F\u5F15\u7528 \`HAI_<\u914D\u7F6E\u540D>_<\u8DEF\u5F84>\` \u5E76\u4FDD\u7559\u672C\u5730\u56DE\u9000\uFF0CcamelCase \u4E0D\u62C6\u8BCD\u3002\u5B8C\u6574\u547D\u4EE4\u3001\u52A0\u8F7D\u4F18\u5148\u7EA7\u548C Provider \u5207\u6362\u89C1 [\u73AF\u5883\u914D\u7F6E](.agents/skills/hai-app-create/development.md#\u73AF\u5883\u914D\u7F6E)\u3002
+
+| \u7528\u9014 | \u547D\u4EE4 |
+| --- | --- |
+| \u5F00\u53D1 / \u6D4B\u8BD5\u6A21\u5F0F / \u751F\u4EA7\u6A21\u5F0F\u9884\u89C8 | \`pnpm dev\` / \`dev:test\` / \`dev:prod\` |
+| \u7C7B\u578B\u68C0\u67E5\uFF08check \u4E3A\u522B\u540D\uFF09 | \`pnpm typecheck\` |
+| \u68C0\u67E5 / \u81EA\u52A8\u4FEE\u590D\u683C\u5F0F | \`pnpm lint\` / \`lint:fix\` |
+| \u6784\u5EFA / \u751F\u4EA7\u6A21\u5F0F\u6784\u5EFA | \`pnpm build\` / \`build:prod\` |
+| \u5355\u5143\u6D4B\u8BD5 / \u76D1\u542C / \u6D4F\u89C8\u5668\u9A8C\u6536 | \`pnpm test\` / \`test:watch\` / \`test:e2e\` |
+| Node \u670D\u52A1\u6309\u73AF\u5883\u542F\u52A8\uFF08\u6784\u5EFA\u540E\uFF09 | \`pnpm start\` / \`start:test\` / \`start:prod\` |
+
+Vite \u5BA2\u6237\u7AEF\u4F7F\u7528 \`preview\` \u9884\u89C8\u9759\u6001\u4EA7\u7269\uFF0CNode \u670D\u52A1\u4F7F\u7528 \`start\`\uFF1B\u7EAF contract/shared \u5E93\u53EA\u63D0\u4F9B\u9002\u7528\u7684\u6784\u5EFA\u548C\u8D28\u91CF\u547D\u4EE4\u3002API workspace \u7684\u73AF\u5883\u6587\u4EF6\u4F4D\u4E8E \`apps/<name>-service\`\uFF0Cfullstack \u4F4D\u4E8E\u5DE5\u7A0B\u6839\u3002`;
+}
 function generateReadme(name, appTypeLabel, pm, appType) {
   const install = getInstallCommand(pm);
   const isStaticImage = appType === "mobile-app";
@@ -1718,6 +1778,10 @@ ${getRunCommand(pm, "podman:build:data")}`;
 
 \u57FA\u4E8E hai Agent Framework \u6784\u5EFA\u7684${appTypeLabel}\u5E94\u7528\u3002
 
+## \u9875\u9762\u5E03\u5C40\u4E0E\u8DEF\u7531
+
+\u9875\u9762\u7EDF\u4E00\u7EE7\u627F\u6839\u5E03\u5C40\u7684 header/footer\u3002${appType === "mobile-app" ? "\u9875\u9762\u653E src/lib/pages/**/*.svelte\uFF0Chash \u8DEF\u7531\u81EA\u52A8\u53D1\u73B0\uFF0C\u5237\u65B0\u4E0E\u524D\u8FDB\u540E\u9000\u6062\u590D\u5F53\u524D\u9875\u3002" : "\u4F7F\u7528 SvelteKit \u81EA\u52A8\u6587\u4EF6\u8DEF\u7531\uFF0C\u65B0\u589E +page.svelte \u65E0\u9700\u7EF4\u62A4\u8DEF\u7531\u8868\uFF1B\u5237\u65B0\u5B9A\u4F4D\u4E0E\u670D\u52A1\u7AEF\u9274\u6743\u4FDD\u6301\u4E00\u81F4\u3002"}
+
 ## \u5F00\u53D1
 
 \`\`\`bash
@@ -1725,6 +1789,8 @@ ${install}
 ${getRunCommand(pm, "dev")}
 \`\`\`
 
+${generateEnvironmentReadme()}
+
 ## \u6784\u5EFA
 
 \`\`\`bash
@@ -1782,6 +1848,8 @@ ${pm} install
 ${pm} dev
 \`\`\`
 
+${generateEnvironmentReadme()}
+
 ## \u8D28\u91CF\u95E8\u7981
 
 \`\`\`bash
@@ -1883,11 +1951,17 @@ curl --fail http://127.0.0.1:8080/runtime-config.js
 
 \u5DF2\u542F\u7528\u524D\u7AEF\uFF1A${enabledFrontends || "Web / App / Desktop"}
 
+## \u9875\u9762\u5E03\u5C40\u4E0E\u8DEF\u7531
+
+Web/App/Desktop \u5171\u4EAB AppShell \u7684 header/footer\u3002\u65B0\u589E\u9875\u9762\u653E shared/src/lib/pages/**/*.svelte\uFF0C\u7531 HashRouter \u81EA\u52A8\u53D1\u73B0\u5E76\u6309\u9700\u52A0\u8F7D\uFF1B\u83DC\u5355\u53EA\u7EF4\u62A4\u5165\u53E3\u3002\u5730\u5740\u4F7F\u7528 #/\u9875\u9762\u8DEF\u5F84\uFF0C\u652F\u6301\u5237\u65B0\u3001\u67E5\u8BE2\u4E32\u4E0E\u6D4F\u89C8\u5668\u524D\u8FDB\u540E\u9000\uFF1BAPI \u6743\u9650\u4ECD\u7531\u670D\u52A1\u7AEF\u6821\u9A8C\u3002
+
 ## \u9ED8\u8BA4\u7BA1\u7406\u529F\u80FD
 
-\u9ED8\u8BA4\u542F\u7528 IAM\u3001reldb\u3001cache\u3001audit\u3001storage \u548C crypto\u3002\u7BA1\u7406\u5458\u53EF\u4EE5\u7BA1\u7406\u7528\u6237\uFF08\u65B0\u589E\u3001\u7F16\u8F91\u3001\u7981\u7528\u3001\u5220\u9664\u3001\u89D2\u8272\u5206\u914D\u3001\u5934\u50CF\u4E0A\u4F20\uFF09\u3001\u67E5\u770B\u4E24\u79CD\u56FA\u5B9A\u89D2\u8272\u53CA\u4EBA\u6570\u3001\u7EF4\u62A4\u89D2\u8272\u8BF4\u660E\u3001\u5206\u9875\u7B5B\u9009\u5BA1\u8BA1\u65E5\u5FD7\uFF1B\u666E\u901A\u7528\u6237\u53EA\u80FD\u7EF4\u62A4\u4E2A\u4EBA\u8D44\u6599\u3001\u5934\u50CF\u3001\u8BED\u8A00\u3001\u4E3B\u9898\u548C\u5BC6\u7801\u3002\u5BC6\u7801\u4FEE\u6539\u540E\u5168\u90E8\u4F1A\u8BDD\u5931\u6548\uFF0C\u9700\u8981\u91CD\u65B0\u767B\u5F55\u3002
+\u4EE5\u4E0B\u63CF\u8FF0\u53EF\u8FD0\u884C\u793A\u4F8B\u7684\u521D\u59CB\u4E1A\u52A1\uFF0C\u53EF\u6309\u5B9E\u9645\u9700\u6C42\u8C03\u6574\u6216\u79FB\u9664\uFF0C\u5E76\u540C\u6B65\u4EE3\u7801\u3001\u6570\u636E\u3001\u9274\u6743\u3001\u754C\u9762\u3001\u6D4B\u8BD5\u548C\u6587\u6863\u3002
+
+\u9ED8\u8BA4\u542F\u7528 IAM\u3001reldb\u3001cache\u3001audit\u3001storage \u548C crypto\u3002\u521D\u59CB\u7BA1\u7406\u5458\u53EF\u4EE5\u7BA1\u7406\u7528\u6237\uFF08\u65B0\u589E\u3001\u7F16\u8F91\u3001\u7981\u7528\u3001\u5220\u9664\u3001\u89D2\u8272\u5206\u914D\u3001\u5934\u50CF\u4E0A\u4F20\uFF09\u3001\u67E5\u770B admin/user \u89D2\u8272\u53CA\u4EBA\u6570\u3001\u7EF4\u62A4\u89D2\u8272\u8BF4\u660E\u3001\u5206\u9875\u7B5B\u9009\u5BA1\u8BA1\u65E5\u5FD7\uFF1B\u521D\u59CB\u666E\u901A\u7528\u6237\u8FDB\u5165\u4E2A\u4EBA\u8D44\u6599\u3001\u5934\u50CF\u3001\u8BED\u8A00\u3001\u4E3B\u9898\u548C\u5BC6\u7801\u8BBE\u7F6E\u3002\u9ED8\u8BA4\u5BC6\u7801\u4FEE\u6539\u540E\u5168\u90E8\u4F1A\u8BDD\u5931\u6548\uFF0C\u9700\u8981\u91CD\u65B0\u767B\u5F55\uFF1B\u89D2\u8272\u6A21\u578B\u3001\u8BBF\u95EE\u8303\u56F4\u548C\u4F1A\u8BDD\u7B56\u7565\u7531\u4E1A\u52A1\u9700\u6C42\u51B3\u5B9A\u3002
 
-CLI \u5DF2\u5728\u6839\u76EE\u5F55\u751F\u6210 \`.env\`\uFF0C\u5176\u4E2D \`HAI_ADMIN_DEFAULT_PASSWORD\` \u662F\u6BCF\u4E2A\u9879\u76EE\u72EC\u7ACB\u751F\u6210\u7684\u968F\u673A\u5F3A\u5BC6\u7801\u3002\u76F4\u63A5\u8FD0\u884C \`dev\` / \`start\` \u5373\u53EF\uFF0C\u9996\u6B21\u767B\u5F55\u4F7F\u7528\u7528\u6237\u540D \`admin\` \u548C\u8BE5\u5BC6\u7801\uFF1B\u4E5F\u53EF\u901A\u8FC7\u540C\u540D\u73AF\u5883\u53D8\u91CF\u8986\u76D6\u3002\u5BC6\u7801\u987B\u6EE1\u8DB3 \`_iam.yml\` \u7B56\u7565\uFF0C\u542F\u52A8\u5931\u8D25\u4F1A\u663E\u793A\u5177\u4F53\u6821\u9A8C\u539F\u56E0\u53CA\u9519\u8BEF\u7801\u3002\`.env\` \u5DF2\u88AB Git \u548C\u5BB9\u5668\u6784\u5EFA\u5FFD\u7565\uFF0C\`.env.example\` \u4E0D\u542B\u771F\u5B9E\u5BC6\u7801\uFF1B\u90E8\u7F72\u65F6\u8BBE\u7F6E\u76EE\u6807\u73AF\u5883\u81EA\u5DF1\u7684\u5BC6\u7801\u3002\u5DF2\u6709\u7528\u6237\u65F6\u4E0D\u4F1A\u91CD\u590D\u521B\u5EFA\u7BA1\u7406\u5458\u6216\u91CD\u8BBE\u5BC6\u7801\u3002
+CLI \u5DF2\u5728\u6839\u76EE\u5F55\u751F\u6210 \`.env.local\`\uFF0C\u5176\u4E2D \`HAI_ADMIN_DEFAULT_PASSWORD\` \u662F\u6BCF\u4E2A\u9879\u76EE\u72EC\u7ACB\u751F\u6210\u7684\u968F\u673A\u5F3A\u5BC6\u7801\u3002\u76F4\u63A5\u8FD0\u884C \`dev\` / \`start\` \u5373\u53EF\uFF0C\u9996\u6B21\u767B\u5F55\u4F7F\u7528\u7528\u6237\u540D \`admin\` \u548C\u8BE5\u5BC6\u7801\uFF1B\u4E5F\u53EF\u901A\u8FC7\u540C\u540D\u73AF\u5883\u53D8\u91CF\u8986\u76D6\u3002\u5BC6\u7801\u987B\u6EE1\u8DB3 \`_iam.yml\` \u7B56\u7565\uFF0C\u542F\u52A8\u5931\u8D25\u4F1A\u663E\u793A\u5177\u4F53\u6821\u9A8C\u539F\u56E0\u53CA\u9519\u8BEF\u7801\u3002\`.env.local\` \u5DF2\u88AB Git \u548C\u5BB9\u5668\u6784\u5EFA\u5FFD\u7565\uFF0C\`.env.example\` \u4E0D\u542B\u771F\u5B9E\u5BC6\u7801\uFF1B\u90E8\u7F72\u65F6\u8BBE\u7F6E\u76EE\u6807\u73AF\u5883\u81EA\u5DF1\u7684\u5BC6\u7801\u3002\u5DF2\u6709\u7528\u6237\u65F6\u4E0D\u4F1A\u91CD\u590D\u521B\u5EFA\u7BA1\u7406\u5458\u6216\u91CD\u8BBE\u5BC6\u7801\u3002
 
 \u672C\u5730\u5F00\u53D1\u9ED8\u8BA4 \`PUBLIC_API_BASE=http://127.0.0.1:3000\`\uFF0CVite \u4F7F\u7528\u540C\u6E90\u4EE3\u7406\uFF1B\u90E8\u7F72\u65F6\u6539\u4E3A\u5B9E\u9645\u516C\u7F51 API Origin\uFF0CAndroid \u6A21\u62DF\u5668\u8BBF\u95EE\u5BBF\u4E3B\u673A\u65F6\u4F7F\u7528 \`http://10.0.2.2:3000\`\u3002\u4E0D\u8981\u5C06\u5BC6\u94A5\u653E\u5165\u4EFB\u4F55 \`PUBLIC_\` \u6216 \`VITE_\` \u53D8\u91CF\u3002
 
@@ -1899,12 +1973,14 @@ CLI \u5DF2\u5728\u6839\u76EE\u5F55\u751F\u6210 \`.env\`\uFF0C\u5176\u4E2D \`HAI_
 
 \u670D\u52A1\u7AEF \`packages/${name}-serv/config/\` \u59CB\u7EC8\u4FDD\u7559 core\u3001serv\u3001db\u3001cache\u3001iam\u3001storage\u3001audit\u3001reach\u3001ai\u3001vecdb\u3001payment\u3001scheduler\u3001deploy \u5171 13 \u4EFD YAML\u3002\u5DF2\u7528\u6A21\u5757\u4FDD\u7559\u5DE5\u4F5C\u9ED8\u8BA4\u503C\uFF0C\u672A\u542F\u7528\u6A21\u5757\u6574\u4EFD\u6CE8\u91CA\uFF0C\u53EF\u9009\u5B57\u6BB5\u548C\u66FF\u4EE3 Provider \u6309\u5757\u6CE8\u91CA\uFF1B\u6839 \`.env.example\` \u4E5F\u4FDD\u7559\u672A\u542F\u7528\u6A21\u5757\u7684\u51ED\u636E\u793A\u4F8B\u3002Reach \u9ED8\u8BA4\u4E3A\u5F00\u53D1\u63A7\u5236\u53F0\u901A\u77E5\uFF0C\u751F\u4EA7\u6309 \`_reach.yml\` \u6CE8\u91CA\u66FF\u6362\u4E3A SMTP\u3001\u77ED\u4FE1\u6216 API Provider\uFF0C\u5E76\u4FDD\u6301\u540D\u79F0\u552F\u4E00\u3002
 
-\u81EA\u52A8\u751F\u6210\u7684 \`.env\` \u9ED8\u8BA4\u53EA\u542F\u7528\u521D\u59CB\u7BA1\u7406\u5458\u5BC6\u7801\u548C \`PUBLIC_API_BASE\`\uFF0C\u6A21\u5757\u73AF\u5883\u8986\u76D6\u4FDD\u7559\u6CE8\u91CA\uFF0CYAML \u662F\u9ED8\u8BA4\u503C\u6765\u6E90\u3002\u9700\u8981\u73AF\u5883\u8986\u76D6\u65F6\u663E\u5F0F\u53D6\u6D88\u5BF9\u5E94\u53D8\u91CF\u7684\u6CE8\u91CA\uFF1B\u7F16\u8F91 YAML \u65F6\u540C\u6B65\u6838\u5BF9\u5DF2\u6709\u8986\u76D6\u3002
+\u81EA\u52A8\u751F\u6210\u7684 \`.env\` \u5305\u542B\u5DF2\u542F\u7528\u6A21\u5757\u7684\u73AF\u5883\u53C2\u6570\uFF1BYAML \u663E\u5F0F\u5F15\u7528\u76F8\u540C\u53D8\u91CF\u5E76\u4FDD\u7559\u672C\u5730\u56DE\u9000\u3002\u7F16\u8F91\u73AF\u5883\u53C2\u6570\u4F18\u5148\u4FEE\u6539\u5BF9\u5E94 \`.env\`\uFF1B\u672A\u542F\u7528\u6A21\u5757\u4ECD\u4FDD\u7559\u6CE8\u91CA\u3002
 
 \u6269\u5C55\u65F6\u5148\u5728\u670D\u52A1\u7AEF workspace \u5B89\u88C5\u9700\u8981\u7684\u5305\uFF0C\u5728 \`src/server/runtime.ts\` \u6309\u6A21\u5757\u516C\u5F00 Schema \u6821\u9A8C\u914D\u7F6E\u3001\u521D\u59CB\u5316\u5E76\u53CD\u5E8F\u5173\u95ED\uFF0C\u518D\u63A5\u5165 contract/procedure \u548C\u754C\u9762\u3002\u6574\u4EFD\u6CE8\u91CA\u6587\u4EF6\u5148\u53BB\u6389\u4E00\u5C42\u5916\u5C42\u6CE8\u91CA\uFF0C\u53EF\u9009\u5757\u7EE7\u7EED\u6309\u9700\u5F00\u542F\uFF1B\u914D\u7F6E\u6587\u4EF6\u5B58\u5728\u4E0D\u4EE3\u8868\u4E1A\u52A1\u529F\u80FD\u5DF2\u63A5\u5165\u3002\`crypto.init()\` \u65E0\u914D\u7F6E\u53C2\u6570\uFF0Cdatapipe \u4E3A\u7EAF\u51FD\u6570\uFF0C\u4E0D\u751F\u6210\u865A\u6784 YAML\u3002
 
 \u73AF\u5883\u53D8\u91CF\u53EA\u8986\u76D6 YAML \u5DF2\u6709\u8DEF\u5F84\uFF0C\u6CE8\u91CA\u952E\u987B\u5148\u542F\u7528\uFF0C\u6216\u7528 \`HAI_DB\` / \`HAI_CACHE\` \u7B49\u6574\u4F53\u5BF9\u8C61\u8986\u76D6\u3002camelCase \u4E0D\u62C6\u8BCD\uFF0C\u4F8B\u5982 \`connectTimeout\` \u5BF9\u5E94 \`HAI_CACHE_CONNECTTIMEOUT\`\u3002\u4FEE\u6539\u914D\u7F6E\u540E\u91CD\u542F\u670D\u52A1\uFF1B\u8BED\u8A00\u5217\u8868\u5728\u5404\u524D\u7AEF/shared \u7684 \`project.inlang/settings.json\` \u4E2D\u540C\u6B65\u3002\`**/data/\` \u5FFD\u7565\u4EFB\u610F\u5C42\u7EA7\u7684\u6570\u636E\u76EE\u5F55\u53CA \`.gitkeep\`\uFF0C\u8FD0\u884C\u6570\u636E\u4E0D\u5165 Git\uFF0C\u8FD0\u884C\u65F6\u81EA\u52A8\u521B\u5EFA\u76EE\u5F55\u3002
 
+${generateEnvironmentReadme()}
+
 ## \u5F00\u53D1\u3001\u7F16\u8BD1\u4E0E\u6253\u5305
 
 \`\`\`bash
@@ -1942,7 +2018,7 @@ ${webBuildCommands}
 
 \`\`\`bash
 # Service\uFF1B\u4F7F\u7528 Podman \u65F6\u5C06 docker \u66FF\u6362\u4E3A podman
-docker run --rm -d --name ${name} -p 3000:3000 --env-file .env \\
+docker run --rm -d --name ${name} -p 3000:3000 --env-file .env --env-file .env.prod --env-file .env.local \\
   --mount type=bind,source=/absolute/path/to/config,target=/app/config,readonly \\
   --mount type=volume,source=${name}-data,target=/app/data \\
   ${name}:latest
@@ -1957,6 +2033,7 @@ curl --fail http://127.0.0.1:3000/ready
 ${webTestCommands}docker stop ${containerNames}
 \`\`\`
 
+- \u4E0A\u4F8B\u6309\u516C\u5171\u57FA\u7840\u3001\u751F\u4EA7\u73AF\u5883\u3001\u672C\u673A\u79C1\u6709\u6587\u4EF6\u7684\u987A\u5E8F\u6CE8\u5165\u53D8\u91CF\uFF1B\u8FD0\u884C\u524D\u5728\u76EE\u6807\u673A\u5668\u521B\u5EFA \`.env.local\` \u5E76\u8BBE\u7F6E\u81EA\u5DF1\u7684\u7BA1\u7406\u5458\u5BC6\u7801\u3002\u90E8\u7F72\u5E73\u53F0\u4E5F\u53EF\u76F4\u63A5\u6CE8\u5165\u540C\u540D\u53D8\u91CF\u3002
 - \u914D\u7F6E\u9ED8\u8BA4\u6765\u81EA \`packages/${name}-serv/config\`\uFF0C\u4E5F\u53EF\u6302\u8F7D\u5230 \`/app/config\`\uFF1BYAML \u4E2D\u7684 \`\${ENV_NAME:default}\` \u53EF\u7531 \`--env-file\` \u6216 \`-e\` \u6CE8\u5165\u3002
 - \u5E26\u6570\u636E\u6784\u5EFA\u4F1A\u628A \`packages/${name}-serv/data\` \u56FA\u5316\u4E3A\u955C\u50CF\u521D\u59CB\u6570\u636E\uFF1B\u6301\u4E45\u5316\u5199\u5165\u4ECD\u5E94\u4F7F\u7528 volume\u3002
 - Service \u7531 \`@h-ai/serv\` \u76F4\u63A5\u5BF9\u5916\u76D1\u542C\uFF0C\u4E0D\u989D\u5916\u542F\u52A8 Web \u8F6C\u53D1\u5C42\u3002
@@ -2118,7 +2195,7 @@ async function addModule(options) {
       core.logger.info(`\u53EF\u7528\u6A21\u5757: ${Object.keys(MODULE_MAP).join(", ")}`);
       return;
     }
-    const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-EZFW7D43.js');
+    const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-A5VIR5J6.js');
     if (moduleDef.packages.every((p) => project.haiPackages.includes(p))) {
       const generatedFiles2 = await generateProjectAiSupport(
         cwd,
@@ -2224,21 +2301,355 @@ async function addModule(options) {
     throw error;
   }
 }
+function displayDeployValue(name, value) {
+  if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
+    return cliM("cli_deploy_secret");
+  try {
+    const parsed2 = JSON.parse(value);
+    if (parsed2 && typeof parsed2 === "object") {
+      const sanitize = (object) => {
+        if (Array.isArray(object))
+          return object.map(sanitize);
+        if (object && typeof object === "object")
+          return Object.fromEntries(Object.entries(object).map(([key, item]) => [key, /PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(key.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(key) ? cliM("cli_deploy_secret") : typeof item === "string" ? displayDeployValue(key, item) : sanitize(item)]));
+        return object;
+      };
+      return JSON.stringify(sanitize(parsed2));
+    }
+  } catch {
+  }
+  try {
+    const url = new URL(value);
+    if (url.username || url.password) {
+      url.username = "***";
+      url.password = "***";
+    }
+    for (const key of url.searchParams.keys()) {
+      if (/password|secret|token|key|authorization/i.test(key))
+        url.searchParams.set(key, "***");
+    }
+    return url.toString();
+  } catch {
+    return value;
+  }
+}
+var CLOUD_FIELDS = {
+  "neon": ["apiKey"],
+  "upstash": ["email", "apiKey"],
+  "cloudflare-r2": ["accountId", "apiToken", "accessKeyId", "secretAccessKey"],
+  "resend": ["apiKey", "from"],
+  "aliyun": ["accessKeyId", "accessKeySecret", "signName"]
+};
+function targetConfig(requirement, environment) {
+  const result = {};
+  const parent = environment.targetValues[requirement.envPrefix];
+  if (parent) {
+    try {
+      Object.assign(result, JSON.parse(parent));
+    } catch {
+      return {};
+    }
+  }
+  for (const [key, value] of Object.entries(environment.targetValues)) {
+    if (key.startsWith(`${requirement.envPrefix}_`))
+      result[key.slice(requirement.envPrefix.length + 1).toLowerCase()] = value;
+  }
+  return result;
+}
+function canKeepMiddleware(requirement, backend, environment) {
+  const target = targetConfig(requirement, environment);
+  if (requirement.service === "ldap" && backend.backend === "disabled")
+    return environment.targetValues.HAI_IAM_LOGIN_LDAP === "false";
+  if (requirement.service === "ldap") {
+    if (!Object.keys(target).length)
+      return false;
+  } else if (target.type !== backend.backend) {
+    return false;
+  }
+  return backend.fields.filter((field) => field.required && !field.secret).every((field) => {
+    if ((target.url || requirement.config.url && Object.keys(target).length) && ["host", "port"].includes(field.name))
+      return true;
+    return target[field.name] !== void 0 && target[field.name] !== "" || target[field.name.toLowerCase()] !== void 0 && target[field.name.toLowerCase()] !== "";
+  }) && backend.fields.filter((field) => field.required && field.secret).every((field) => Boolean(requirement.config[field.name] || environment.values[`${requirement.envPrefix}_${field.name.toUpperCase()}`]));
+}
+async function ask(question) {
+  const answer = await prompts({ ...question, name: "value" });
+  if (answer.value === void 0)
+    throw new Error(cliM("cli_deploy_cancelled"));
+  return answer.value;
+}
+function validateField(value, field) {
+  if (value === "")
+    return field.required ? cliM("cli_deploy_required") : true;
+  if (field.kind === "port")
+    return /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 || cliM("cli_deploy_invalid_value");
+  if (field.kind === "number")
+    return /^\d+$/.test(value) && Number(value) >= (field.minimum ?? 0) && Number(value) <= (field.maximum ?? Number.MAX_SAFE_INTEGER) || cliM("cli_deploy_invalid_value");
+  if (field.kind === "boolean")
+    return ["true", "false"].includes(value) || cliM("cli_deploy_invalid_value");
+  if (field.kind === "url") {
+    try {
+      return Boolean(new URL(value).protocol);
+    } catch {
+      return cliM("cli_deploy_invalid_value");
+    }
+  }
+  if (field.name === "ssl") {
+    const parsed2 = parseDocument(value);
+    const ssl = parsed2.errors.length ? void 0 : parsed2.toJS();
+    return typeof ssl === "boolean" || ["require", "prefer", "allow", "disable"].includes(String(ssl)) || ssl !== null && typeof ssl === "object" && !Array.isArray(ssl) || cliM("cli_deploy_invalid_value");
+  }
+  if (field.name === "headers") {
+    try {
+      const headers = JSON.parse(value);
+      return headers !== null && typeof headers === "object" && !Array.isArray(headers) && Object.values(headers).every((item) => typeof item === "string") || cliM("cli_deploy_invalid_value");
+    } catch {
+      return cliM("cli_deploy_invalid_value");
+    }
+  }
+  if (field.name === "method")
+    return ["POST", "PUT"].includes(value) || cliM("cli_deploy_invalid_value");
+  return true;
+}
+function ensureConfigNode(appDir, requirement, backend) {
+  if (requirement.service === "ldap" && backend === "disabled")
+    return;
+  const directory = join(appDir, "config");
+  mkdirSync(directory, { recursive: true });
+  const path7 = join(directory, `_${requirement.configName}.yml`);
+  const document = parseDocument(existsSync(path7) ? readFileSync(path7, "utf8") : "{}\n");
+  if (document.errors.length)
+    throw new Error(cliM("cli_deploy_invalid_value"));
+  if (requirement.configPath.length && !document.hasIn(requirement.configPath))
+    document.setIn(requirement.configPath, requirement.configName === "reach" ? { name: requirement.config.name ?? requirement.service, type: backend } : {});
+  if (requirement.service === "ldap") {
+    if (!document.hasIn(["login"]))
+      document.setIn(["login"], {});
+    if (!document.hasIn(["login", "ldap"]))
+      document.setIn(["login", "ldap"], `\${HAI_IAM_LOGIN_LDAP:false}`);
+  }
+  const content = document.toString();
+  if (!existsSync(path7) || readFileSync(path7, "utf8") !== content)
+    writeFileSync(path7, content);
+}
+function connectionEnv(requirement, backend, config) {
+  if (requirement.service === "ldap")
+    return backend === "disabled" ? { HAI_IAM_LOGIN_LDAP: "false" } : { HAI_IAM_LOGIN_LDAP: "true", [requirement.envPrefix]: JSON.stringify(config) };
+  return { [requirement.envPrefix]: JSON.stringify({ ...config, type: backend }) };
+}
+async function configureDeployMiddleware(module, scan, environment, config, yes = false) {
+  const modes = {};
+  const services = {};
+  const existingServices = config.services && typeof config.services === "object" ? config.services : {};
+  const provider = config.provider;
+  for (const requirement of scan.middlewares ?? []) {
+    const choices = module.DEPLOY_MIDDLEWARE[requirement.service];
+    const current = choices.find((item) => item.backend === requirement.backend);
+    if (!current)
+      throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: requirement.backend } }));
+    core.logger.info(cliM("cli_deploy_middleware", { params: { service: requirement.service, backend: current.label, purpose: module.describeMiddlewareBackend(current), source: requirement.source } }));
+    const canKeep = canKeepMiddleware(requirement, current, environment);
+    const mode = yes ? canKeep ? "keep" : "default" : await ask({
+      type: "select",
+      name: "value",
+      message: cliM("cli_deploy_action", { params: { service: requirement.service } }),
+      choices: [
+        { title: cliM("cli_deploy_default"), value: "default" },
+        { title: cliM("cli_deploy_custom"), value: "custom" },
+        ...canKeep ? [{ title: cliM("cli_deploy_keep"), value: "keep" }] : []
+      ]
+    });
+    modes[requirement.envPrefix] = mode;
+    const previous = modes[requirement.service];
+    modes[requirement.service] = previous === "default" || mode === "default" ? "default" : previous === "custom" || mode === "custom" ? "custom" : "keep";
+    if (mode === "keep") {
+      if (!canKeep)
+        throw new Error(cliM("cli_deploy_missing_keep", { params: { service: requirement.service } }));
+      continue;
+    }
+    const backendName = yes ? current.backend : String(await ask({ type: "select", name: "value", message: cliM("cli_deploy_backend", { params: { service: requirement.service } }), initial: choices.indexOf(current), choices: choices.map((item) => ({ title: `${item.label} \u2014 ${module.describeMiddlewareBackend(item)}`, value: item.backend })) }));
+    const backend = choices.find((item) => item.backend === backendName);
+    if (!backend)
+      throw new Error(cliM("cli_deploy_invalid_value"));
+    requirement.backend = backendName;
+    const updates = {};
+    if (mode === "default" && backendName === "s3" && provider?.type === "docker-ssh") {
+      const container = config.container && typeof config.container === "object" ? config.container : {};
+      const currentEngine = container.s3Engine === "minio" ? "minio" : "rustfs";
+      const engine = yes ? currentEngine : String(await ask({ type: "select", name: "value", message: cliM("cli_deploy_s3_engine"), initial: currentEngine === "rustfs" ? 0 : 1, choices: [{ title: "RustFS", value: "rustfs" }, { title: "MinIO", value: "minio" }] }));
+      if (!["rustfs", "minio"].includes(engine))
+        throw new Error(cliM("cli_deploy_invalid_value"));
+      config.container = { ...container, s3Engine: engine };
+      updates.HAI_DEPLOY_CONTAINER_S3ENGINE = engine;
+      const deploymentFile = join(scan.appDir ?? ".", "config", "_deploy.yml");
+      const deployment = parseDocument(readFileSync(deploymentFile, "utf8"));
+      if (deployment.errors.length)
+        throw new Error(cliM("cli_deploy_invalid_value"));
+      if (!deployment.hasIn(["container", "s3Engine"])) {
+        if (!deployment.hasIn(["container"]))
+          deployment.setIn(["container"], {});
+        deployment.setIn(["container", "s3Engine"], `\${HAI_DEPLOY_CONTAINER_S3ENGINE:rustfs}`);
+        writeFileSync(deploymentFile, deployment.toString());
+      }
+    }
+    if (mode === "default" && provider?.type === "vercel") {
+      if (!backend.provisioner)
+        throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: backend.label } }));
+      const prior = existingServices[requirement.service];
+      const priorConfig = prior && typeof prior === "object" ? prior : {};
+      const cloud = { provisioner: backend.provisioner };
+      for (const name of CLOUD_FIELDS[backend.provisioner]) {
+        const key = `HAI_DEPLOY_SERVICES_${requirement.service.toUpperCase()}_${name.toUpperCase()}`;
+        const initial = String(priorConfig[name] ?? environment.values[key] ?? "");
+        const value = yes ? initial : String(await ask({ type: /key|token|secret/i.test(name) ? "password" : "text", name: "value", message: key, initial, validate: (input) => Boolean(input) || cliM("cli_deploy_required") }));
+        if (!value)
+          throw new Error(`${key}: ${cliM("cli_deploy_required")}`);
+        cloud[name] = value;
+        updates[key] = value;
+      }
+      services[requirement.service] = cloud;
+    } else {
+      if (mode === "default" && (requirement.service === "sms" || backendName === "api"))
+        throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: backend.label } }));
+      const connection = mode === "custom" && backendName === current.backend ? { ...requirement.config } : requirement.configName === "reach" ? { name: requirement.config.name ?? requirement.service } : {};
+      for (const field of backend.fields) {
+        const previous2 = backendName === current.backend ? requirement.config[field.name] : void 0;
+        const initial = previous2 === void 0 ? field.defaultValue ?? "" : typeof previous2 === "object" ? JSON.stringify(previous2) : String(previous2);
+        const variable = `${requirement.envPrefix}_${field.name.toUpperCase()}`;
+        const info = moduleEnvironmentVariables(requirement.configName).find((item) => item.name === variable);
+        const value = mode === "custom" && !yes ? String(await ask({ type: field.secret ? "password" : "text", name: "value", message: cliM("cli_deploy_field", { params: { name: variable, description: info?.description ?? field.name, constraint: info?.constraint ?? field.kind ?? "string" } }), initial, validate: (input) => validateField(String(input), field) })) : initial;
+        if (value !== "") {
+          connection[field.name] = field.kind === "number" || field.kind === "port" ? Number(value) : field.kind === "boolean" ? value === "true" : field.name === "headers" || field.name === "ssl" ? parseDocument(value).toJS() : value;
+        } else {
+          delete connection[field.name];
+        }
+      }
+      Object.assign(updates, connectionEnv(requirement, backendName, connection));
+    }
+    ensureConfigNode(scan.appDir ?? ".", requirement, backendName);
+    const saved = module.saveDeploymentEnvironment(environment, updates);
+    if (!saved.success)
+      throw new Error(saved.error.message);
+    for (const [name, value] of Object.entries(updates)) {
+      core.logger.info(cliM("cli_deploy_saved", { params: { name, value: displayDeployValue(name, value) } }));
+    }
+  }
+  config.services = Object.keys(services).length ? services : void 0;
+  return modes;
+}
+
+// src/commands/cli-deploy.ts
+function configObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+async function configureDeployTarget(module, config, environment, nonInteractive) {
+  const current = module.ProviderConfigSchema.safeParse(config.provider);
+  if (current.success) {
+    config.provider = current.data;
+    core.logger.info(cliM("cli_deploy_target_reused", { params: { target: current.data.type === "docker-ssh" ? `${current.data.ssh.username}@${current.data.ssh.host}:${current.data.ssh.port}` : "Vercel" } }));
+    return;
+  }
+  if (nonInteractive)
+    throw new Error(cliM("cli_deploy_target_missing", { params: { fields: current.error.issues.map((issue) => `provider.${issue.path.join(".")}`).join(", ") } }));
+  const original = configObject(config.provider);
+  const platform = await prompts({
+    type: "select",
+    name: "value",
+    message: cliM("cli_deploy_target_platform"),
+    choices: [{ title: cliM("cli_deploy_target_ssh"), value: "docker-ssh" }, { title: "Vercel", value: "vercel" }],
+    initial: original.type === "vercel" ? 1 : 0
+  });
+  if (!platform.value)
+    throw new Error(cliM("cli_deploy_cancelled"));
+  const input = async (name, initial, options = {}) => {
+    const answer = await prompts({
+      type: options.secret ? "password" : "text",
+      name: "value",
+      message: cliM("cli_deploy_target_field", { params: { name } }),
+      initial: options.secret ? void 0 : initial === void 0 ? "" : String(initial),
+      validate: (value) => options.port ? /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 || cliM("cli_deploy_invalid_value") : options.optional || !!value.trim() || cliM("cli_deploy_invalid_value")
+    });
+    if (answer.value === void 0)
+      throw new Error(cliM("cli_deploy_cancelled"));
+    return String(answer.value).trim();
+  };
+  let provider;
+  if (platform.value === "docker-ssh") {
+    core.logger.info(cliM("cli_deploy_target_ssh_hint"));
+    const ssh = configObject(original.ssh);
+    const remote = configObject(original.remote);
+    const expose = configObject(original.expose);
+    const host = await input("HAI_DEPLOY_PROVIDER_SSH_HOST", ssh.host);
+    const port = Number(await input("HAI_DEPLOY_PROVIDER_SSH_PORT", ssh.port ?? 22, { port: true }));
+    const username = await input("HAI_DEPLOY_PROVIDER_SSH_USERNAME", ssh.username);
+    const identityFile = await input("HAI_DEPLOY_PROVIDER_SSH_IDENTITYFILE", ssh.identityFile, { optional: true });
+    const knownHostsFile = await input("HAI_DEPLOY_PROVIDER_SSH_KNOWNHOSTSFILE", ssh.knownHostsFile, { optional: true });
+    const baseDir = await input("HAI_DEPLOY_PROVIDER_REMOTE_BASEDIR", remote.baseDir || "/opt/hai/apps");
+    const runtime = await prompts({ type: "select", name: "value", message: cliM("cli_deploy_target_runtime"), choices: ["auto", "podman", "docker"].map((value) => ({ title: value, value })), initial: ["auto", "podman", "docker"].indexOf(String(remote.runtime ?? "auto")) });
+    if (!runtime.value)
+      throw new Error(cliM("cli_deploy_cancelled"));
+    const hostPort = Number(await input("HAI_DEPLOY_PROVIDER_EXPOSE_HOSTPORT", expose.hostPort || 3e3, { port: true }));
+    const containerPort = Number(await input("HAI_DEPLOY_PROVIDER_EXPOSE_CONTAINERPORT", expose.containerPort || 3e3, { port: true }));
+    provider = {
+      type: "docker-ssh",
+      ssh: { ...ssh, host, port, username, identityFile: identityFile || void 0, knownHostsFile: knownHostsFile || void 0 },
+      remote: { ...remote, baseDir, runtime: runtime.value },
+      expose: { type: "port", hostPort, containerPort }
+    };
+  } else {
+    provider = { type: "vercel", token: await input("HAI_DEPLOY_PROVIDER_TOKEN", void 0, { secret: true }) };
+  }
+  const validated = module.ProviderConfigSchema.safeParse(provider);
+  if (!validated.success)
+    throw new Error(cliM("cli_deploy_invalid_value"));
+  const saved = module.saveDeploymentEnvironment(environment, { HAI_DEPLOY_PROVIDER: JSON.stringify(validated.data) }, { private: true });
+  if (!saved.success)
+    throw new Error(saved.error.message);
+  config.provider = validated.data;
+  core.logger.info(cliM("cli_deploy_target_saved"));
+}
 async function deployCommand(options) {
   const spinner = ora();
-  const cwd = options.cwd ?? process4.cwd();
-  const appDir = resolve(cwd, options.appDir ?? ".");
+  const cwd = options.cwd ?? process3.cwd();
+  let appDir = resolve(cwd, options.appDir ?? ".");
   let closeDeploy = null;
+  const originalEnv = { ...process3.env };
   try {
+    let environmentName = options.env;
+    if (!environmentName) {
+      if (!process3.stdin.isTTY)
+        throw new Error(cliM("cli_deploy_environment_hint"));
+      const answer = await prompts({ type: "text", name: "environment", message: cliM("cli_deploy_environment"), initial: "prod" });
+      environmentName = answer.environment;
+      if (!environmentName)
+        throw new Error(cliM("cli_deploy_cancelled"));
+    }
+    if (!options.yes && !process3.stdin.isTTY)
+      throw new Error(cliM("cli_deploy_environment_hint"));
     let deployModule;
     try {
-      deployModule = await import('./src-DUGLX4YB.js');
+      const localRequire = createRequire(resolve(appDir, "package.json"));
+      let localModule;
+      try {
+        localModule = localRequire.resolve("@h-ai/deploy");
+      } catch {
+      }
+      deployModule = localModule ? await import(pathToFileURL(localModule).href) : await import('./src-6PPBKQ6Q.js');
     } catch {
       core.logger.error(chalk.red(cliM("cli_deploy_module_missing")));
       core.logger.info(chalk.cyan("  pnpm add @h-ai/deploy"));
       throw new Error(cliM("cli_deploy_module_missing"));
     }
     const { deploy } = deployModule;
+    const scanResult = await deploy.scan(appDir, { environment: environmentName, envDir: options.envDir ? resolve(cwd, options.envDir) : void 0 });
+    if (!scanResult.success)
+      throw new Error(cliM("cli_deploy_scan_failed", { params: { message: scanResult.error.message } }));
+    const scan = scanResult.data;
+    appDir = scan.appDir ?? appDir;
+    const environment = deployModule.loadDeploymentEnvironment({ environment: environmentName, envDir: scan.envDir ?? appDir });
+    if (!environment.success)
+      throw new Error(environment.error.message);
+    Object.assign(process3.env, environment.data.values);
     spinner.start(cliM("cli_deploy_load_credentials"));
     const credResult = deploy.credentials.load();
     if (!credResult.success) {
@@ -2252,19 +2663,44 @@ async function deployCommand(options) {
       core.logger.info(chalk.cyan(cliM("cli_deploy_config_hint")));
       throw new Error(cliM("cli_deploy_config_missing", { params: { path: configPath } }));
     }
-    const configContent = readFileSync(configPath, "utf-8");
-    const rawConfig = interpolateEnvFallback(configContent);
-    const deployConfig = parse(rawConfig);
+    const loadedConfig = deployModule.loadDeploymentConfig("deploy", configPath, process3.env);
+    if (!loadedConfig.success)
+      throw new Error(loadedConfig.error.message);
+    const deployConfig = loadedConfig.data;
     spinner.succeed(cliM("cli_deploy_config_loaded"));
-    spinner.start(cliM("cli_deploy_scanning"));
-    const scanResult = await deploy.scan(appDir);
-    if (!scanResult.success) {
-      throw new Error(cliM("cli_deploy_scan_failed", { params: { message: scanResult.error.message } }));
-    }
-    const scan = scanResult.data;
+    await configureDeployTarget(deployModule, deployConfig, environment.data, options.yes);
     spinner.succeed(cliM("cli_deploy_scanned", { params: { name: scan.appName, sveltekit: String(scan.isSvelteKit), services: scan.requiredServices.join(", ") || cliM("cli_deploy_none") } }));
+    let skipMiddleware = options.skipMiddleware || options.skipProvision;
+    if (!skipMiddleware && !options.yes && scan.requiredServices.length) {
+      const action = await prompts({
+        type: "select",
+        name: "value",
+        message: cliM("cli_deploy_middleware_plan"),
+        choices: [{ title: cliM("cli_deploy_middleware_configure"), value: "configure" }, { title: cliM("cli_deploy_middleware_skip"), value: "skip" }]
+      });
+      if (!action.value)
+        throw new Error(cliM("cli_deploy_cancelled"));
+      skipMiddleware = action.value === "skip";
+    }
+    if (skipMiddleware)
+      core.logger.info(cliM("cli_deploy_middleware_skipped"));
+    const serviceModes = skipMiddleware ? Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) : await configureDeployMiddleware(deployModule, scan, environment.data, deployConfig, options.yes);
+    if (skipMiddleware)
+      deployConfig.services = void 0;
+    for (const key of Object.keys(process3.env)) {
+      if (originalEnv[key] === void 0)
+        delete process3.env[key];
+    }
+    Object.assign(process3.env, originalEnv);
+    const refreshed = deployModule.loadDeploymentEnvironment({ environment: environment.data.environment, envDir: environment.data.envDir });
+    if (!refreshed.success)
+      throw new Error(refreshed.error.message);
+    Object.assign(process3.env, refreshed.data.values);
     spinner.start(cliM("cli_deploy_initializing"));
-    const initResult = await deploy.init(deployConfig);
+    const validatedConfig = deployModule.DeployConfigSchema.safeParse(deployConfig);
+    if (!validatedConfig.success)
+      throw new Error(cliM("cli_deploy_init_failed", { params: { message: cliM("cli_deploy_invalid_value") } }));
+    const initResult = await deploy.init(validatedConfig.data);
     if (!initResult.success) {
       throw new Error(cliM("cli_deploy_init_failed", { params: { message: initResult.error.message } }));
     }
@@ -2273,8 +2709,11 @@ async function deployCommand(options) {
     spinner.start(cliM("cli_deploy_deploying"));
     const deployResult = await deploy.deployApp(appDir, {
       projectName: options.projectName,
-      skipProvision: options.skipProvision,
-      skipBuild: options.skipBuild
+      skipProvision: skipMiddleware,
+      skipBuild: options.skipBuild,
+      environment: environment.data.environment,
+      envDir: environment.data.envDir,
+      serviceModes
     });
     if (!deployResult.success) {
       if (deployResult.error.ext?.recovery) {
@@ -2285,6 +2724,21 @@ async function deployCommand(options) {
       throw new Error(cliM("cli_deploy_failed", { params: { message: deployResult.error.message } }));
     }
     spinner.succeed(chalk.green(cliM("cli_deploy_success")));
+    for (const key of Object.keys(process3.env)) {
+      if (originalEnv[key] === void 0)
+        delete process3.env[key];
+    }
+    Object.assign(process3.env, originalEnv);
+    const completedEnvironment = deployModule.loadDeploymentEnvironment({ environment: environment.data.environment, envDir: environment.data.envDir });
+    if (!completedEnvironment.success)
+      throw new Error(completedEnvironment.error.message);
+    for (const requirement of scan.middlewares ?? []) {
+      if ((serviceModes[requirement.envPrefix] ?? serviceModes[requirement.service]) === "keep")
+        continue;
+      const value = completedEnvironment.data.values[requirement.envPrefix];
+      if (value !== void 0)
+        core.logger.info(cliM("cli_deploy_saved", { params: { name: requirement.envPrefix, value: displayDeployValue(requirement.envPrefix, value) } }));
+    }
     core.logger.info("");
     core.logger.info(chalk.cyan(cliM("cli_deploy_url", { params: { url: deployResult.data.url } })));
     core.logger.info(chalk.gray(cliM("cli_deploy_id", { params: { id: deployResult.data.deploymentId } })));
@@ -2302,16 +2756,16 @@ async function deployCommand(options) {
         await closeDeploy();
       } catch (error) {
         core.logger.error("Failed to close deploy module", { error });
-        process4.exitCode = 1;
+        process3.exitCode = 1;
       }
     }
+    for (const key of Object.keys(process3.env)) {
+      if (originalEnv[key] === void 0)
+        delete process3.env[key];
+    }
+    Object.assign(process3.env, originalEnv);
   }
 }
-function interpolateEnvFallback(content) {
-  return content.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, key, defaultValue) => {
-    return process4.env[key] ?? defaultValue ?? "";
-  });
-}
 var GENERATORS = {
   page: {
     description: "SvelteKit \u9875\u9762",
@@ -2653,7 +3107,7 @@ async function initProject(options) {
     const { project, existing, missing } = result;
     spinner.succeed(`\u68C0\u6D4B\u5230\u9879\u76EE: ${chalk.cyan(project.name)}`);
     if (project.isHaiProject) {
-      const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-EZFW7D43.js');
+      const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-A5VIR5J6.js');
       const generatedFiles = await generateProjectAiSupport(cwd, resolveSkillNamesForPackages(project.haiPackages), {
         overwriteSkills: false,
         overwriteBridgeFiles: false
@@ -2757,7 +3211,7 @@ cli.command("create [name]", "\u521B\u5EFA\u65B0\u7684 hai \u9879\u76EE").option
       cwd: options.cwd
     });
   } catch {
-    process4.exitCode = 1;
+    process3.exitCode = 1;
   }
 });
 cli.command("add [module]", "\u5411\u73B0\u6709\u9879\u76EE\u6DFB\u52A0\u6A21\u5757").option("--no-install", "\u4E0D\u5B89\u88C5\u4F9D\u8D56").action(async (module, options) => {
@@ -2769,7 +3223,7 @@ cli.command("add [module]", "\u5411\u73B0\u6709\u9879\u76EE\u6DFB\u52A0\u6A21\u5
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process3.exit(1);
   }
 });
 cli.command("init", "\u521D\u59CB\u5316/\u6821\u9A8C\u9879\u76EE\u914D\u7F6E").option("-f, --force", "\u5F3A\u5236\u91CD\u65B0\u751F\u6210\u914D\u7F6E").action(async (options) => {
@@ -2780,7 +3234,7 @@ cli.command("init", "\u521D\u59CB\u5316/\u6821\u9A8C\u9879\u76EE\u914D\u7F6E").o
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process3.exit(1);
   }
 });
 cli.command("generate [type] [name]", "\u751F\u6210\u4EE3\u7801").alias("g").option("-o, --output <path>", "\u8F93\u51FA\u8DEF\u5F84").option("-f, --force", "\u8986\u76D6\u73B0\u6709\u6587\u4EF6").action(async (type, name, options) => {
@@ -2794,21 +3248,25 @@ cli.command("generate [type] [name]", "\u751F\u6210\u4EE3\u7801").alias("g").opt
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process3.exit(1);
   }
 });
-cli.command("deploy [appDir]", "\u90E8\u7F72\u5E94\u7528\u5230\u4E91\u5E73\u53F0").option("--project-name <name>", "\u9879\u76EE\u540D\u79F0\uFF08\u9ED8\u8BA4\u4ECE package.json \u8BFB\u53D6\uFF09").option("--skip-provision", "\u8DF3\u8FC7\u57FA\u7840\u8BBE\u65BD\u5F00\u901A").option("--skip-build", "\u8DF3\u8FC7\u6784\u5EFA").action(async (appDir, options) => {
+cli.command("deploy [appDir]", "\u90E8\u7F72\u5E94\u7528\u5230\u4E91\u5E73\u53F0").option("--env <environment>", "\u90E8\u7F72\u73AF\u5883\uFF08test / prod \u7B49\uFF0C\u5FC5\u987B\u5B58\u5728\u5BF9\u5E94\u73AF\u5883\u6587\u4EF6\uFF09").option("--env-dir <path>", "\u73AF\u5883\u6587\u4EF6\u6240\u5728\u76EE\u5F55\uFF08\u9ED8\u8BA4\u81EA\u52A8\u67E5\u627E\uFF09").option("-y, --yes", "\u6309\u5F53\u524D\u540E\u7AEF\u9ED8\u8BA4\u914D\u7F6E\u90E8\u7F72\uFF0C\u76EE\u6807\u73AF\u5883\u5DF2\u6709\u5B8C\u6574\u914D\u7F6E\u65F6\u4FDD\u6301\u4E0D\u53D8").option("--project-name <name>", "\u9879\u76EE\u540D\u79F0\uFF08\u9ED8\u8BA4\u4F7F\u7528\u5E94\u7528\u76EE\u5F55\u540D\uFF09").option("--skip-provision", "\u914D\u7F6E\u5DF2\u5B8C\u5907\uFF0C\u8DF3\u8FC7\u4E2D\u95F4\u4EF6\u914D\u7F6E\u4E0E\u5F00\u901A\uFF0C\u76F4\u63A5\u90E8\u7F72").option("--skip-middleware", "\u914D\u7F6E\u5DF2\u5B8C\u5907\uFF0C\u8DF3\u8FC7\u5168\u90E8\u4E2D\u95F4\u4EF6\u5904\u7406\uFF0C\u76F4\u63A5\u90E8\u7F72").option("--skip-build", "\u8DF3\u8FC7\u6784\u5EFA").action(async (appDir, options) => {
   try {
     await deployCommand({
       appDir,
+      env: options.env,
+      envDir: options.envDir,
+      yes: options.yes,
       projectName: options.projectName,
       skipProvision: options.skipProvision,
+      skipMiddleware: options.skipMiddleware,
       skipBuild: options.skipBuild,
       verbose: options.verbose,
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process3.exit(1);
   }
 });
 cli.command("g:page <name>", "\u751F\u6210\u9875\u9762").action(async (name, options) => {