@h-ai/cli 0.1.0-alpha.64 → 0.1.0-alpha.66

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { generateConfigFile } from './chunk-WW2MIO6T.js';
-import { cliM } from './chunk-X3RSYNBG.js';
+import { generateConfigFile, runtimeEnvironmentVariables, renderEnvironment, moduleEnvironmentVariables, parameterizeConfig } from './chunk-QYX6V7H2.js';
+import { cliM } from './chunk-FWN5B54L.js';
 import './chunk-2H7UOFLK.js';
 import process4 from 'process';
 import { cac } from 'cac';
 import chalk from 'chalk';
-import path2, { resolve } from 'path';
-import { fileURLToPath } from 'url';
+import path2, { resolve, join, dirname } from 'path';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { wrapAnsi } from 'fast-wrap-ansi';
 import fse from 'fs-extra';
 import Handlebars2 from 'handlebars';
@@ -14,10 +14,11 @@ import { core } from '@h-ai/core';
 import ora from 'ora';
 import prompts from 'prompts';
 import { Buffer } from 'buffer';
-import { execSync, execFileSync } from 'child_process';
-import { randomBytes } from 'crypto';
-import { stringify, parse } from 'yaml';
-import { existsSync, readFileSync } from 'fs';
+import { execSync, execFileSync, spawn } from 'child_process';
+import { randomBytes, createHash } from 'crypto';
+import { stringify, parseDocument } from 'yaml';
+import { readFileSync, mkdirSync, mkdtempSync, existsSync, createReadStream, writeFileSync, renameSync, rmSync } from 'fs';
+import { createRequire } from 'module';
 
 var CAMEL_CASE_SEPARATOR_REGEX = /[-_\s]+(.)?/g;
 var LEADING_CHAR_REGEX = /^./;
@@ -121,7 +122,7 @@ Handlebars2.registerHelper("yaml", (key, value) => stringify({ [key]: value }).t
 Handlebars2.registerHelper("jsString", (value) => `'${JSON.stringify(value).slice(1, -1).replace(/\\"/g, '"').replace(/'/g, "\\'")}'`);
 Handlebars2.registerHelper("moduleConfig", function(moduleKey, enabled) {
   const content = generateConfigFile(moduleKey, this.moduleConfigs).trimEnd();
-  const configured = this.appType === "fullstack" && moduleKey === "iam" ? content.replace("seedDefaultData: true", "seedDefaultData: false").replace("variant: card", "variant: split") : content;
+  const configured = this.appType === "fullstack" && moduleKey === "iam" ? content.replace("HAI_IAM_SEEDDEFAULTDATA:true", "HAI_IAM_SEEDDEFAULTDATA:false").replace("variant: card", "variant: split") : content;
   return enabled ? configured : `# # \u672A\u542F\u7528\uFF1A\u5B89\u88C5\u5BF9\u5E94\u6A21\u5757\u5E76\u5728\u670D\u52A1\u7AEF runtime \u4E2D\u521D\u59CB\u5316\uFF0C\u518D\u53D6\u6D88\u6240\u9700\u914D\u7F6E\u7684\u6CE8\u91CA\u3002
 ${configured.split("\n").map((line) => line ? `# ${line}` : "").join("\n")}`;
 });
@@ -207,6 +208,7 @@ var HAI_CATALOG_PACKAGE_NAMES = [
   "@h-ai/audit",
   "@h-ai/cache",
   "@h-ai/capacitor",
+  "@h-ai/cli",
   "@h-ai/core",
   "@h-ai/crypto",
   "@h-ai/datapipe",
@@ -387,6 +389,7 @@ function buildFullstackPackageSpecifiers(useCatalogProtocol) {
 function buildApiWorkspaceCatalogPackages(featureMap) {
   const packageNames = [
     ...API_WORKSPACE_EXTERNAL_CATALOG_PACKAGE_NAMES,
+    "@h-ai/cli",
     "@h-ai/api-client",
     "@h-ai/api-contract",
     "@h-ai/core",
@@ -421,7 +424,7 @@ function buildApiWorkspaceCatalogPackages(featureMap) {
   return pickCatalogPackages(packageNames, FULLSTACK_CATALOG_PACKAGES);
 }
 function buildAppHaiCatalogPackages(options) {
-  const packageNames = [];
+  const packageNames = ["@h-ai/cli"];
   if (options.isSvelteOnlyApp) {
     packageNames.push("@h-ai/api-client", "@h-ai/api-contract", "@h-ai/capacitor", "@h-ai/ui");
     return pickCatalogPackages(packageNames, HAI_CATALOG_PACKAGES);
@@ -465,9 +468,10 @@ function buildAppHaiCatalogPackages(options) {
     packageNames.push("@h-ai/capacitor");
   return pickCatalogPackages(packageNames, HAI_CATALOG_PACKAGES);
 }
-function buildFullstackCatalogPackages(frontends) {
+function buildFullstackCatalogPackages(frontends, deploy = false) {
   const packageNames = [
     ...FULLSTACK_ROOT_CATALOG_PACKAGE_NAMES,
+    "@h-ai/cli",
     ...FULLSTACK_CONTRACT_CATALOG_PACKAGE_NAMES,
     ...FULLSTACK_SERV_CATALOG_PACKAGE_NAMES,
     ...FULLSTACK_SHARED_CATALOG_PACKAGE_NAMES
@@ -478,6 +482,8 @@ function buildFullstackCatalogPackages(frontends) {
     packageNames.push(...FULLSTACK_APP_CATALOG_PACKAGE_NAMES);
   if (frontends.includes("desktop"))
     packageNames.push(...FULLSTACK_DESKTOP_CATALOG_PACKAGE_NAMES);
+  if (deploy)
+    packageNames.push("@h-ai/deploy");
   return pickCatalogPackages(packageNames, FULLSTACK_CATALOG_PACKAGES);
 }
 var FEATURE_ROUTE_DIRS = {
@@ -594,7 +600,7 @@ function buildTemplateContext(options) {
   const selectedFrontends = options.frontends ?? DEFAULT_FULLSTACK_FRONTENDS;
   let haiCatalogPackages;
   if (isFullstack) {
-    haiCatalogPackages = buildFullstackCatalogPackages(selectedFrontends);
+    haiCatalogPackages = buildFullstackCatalogPackages(selectedFrontends, featureMap.deploy);
   } else if (isApi) {
     haiCatalogPackages = buildApiWorkspaceCatalogPackages(featureMap);
   } else {
@@ -769,6 +775,16 @@ async function generateFromTemplates(projectPath, context) {
     }
   }
   await renderDynamicFiles(root, projectPath, context);
+  await fse.copy(path2.join(root, "shared", "run-e2e.mjs"), path2.join(projectPath, "scripts", "run-e2e.mjs"));
+  await fse.copy(path2.join(root, "shared", ".gitattributes"), path2.join(projectPath, ".gitattributes"));
+  if (context.isSvelteOnlyApp) {
+    await fse.copy(path2.join(root, "shared", "vite-runtime-config.ts"), path2.join(projectPath, "scripts", "vite-runtime-config.ts"));
+    await fse.copy(path2.join(root, "shared", "container-runtime-config.sh"), path2.join(projectPath, "docker", "19-runtime-config.sh"));
+  }
+  if (context.isSvelteOnlyApp || context.appType === "fullstack") {
+    const navigationDir = context.appType === "fullstack" ? path2.join(projectPath, "packages", `${context.projectName}-shared`, "src", "lib", "navigation") : path2.join(projectPath, "src", "lib", "navigation");
+    await fse.copy(path2.join(root, "shared", "hash-router.svelte.ts"), path2.join(navigationDir, "hash-router.svelte.ts"));
+  }
   if (context.hasI18n) {
     const i18nDir = path2.join(root, "i18n");
     if (await fse.pathExists(i18nDir)) {
@@ -839,7 +855,8 @@ async function renderHbsInDir(dir, destRoot, context) {
       continue;
     }
     const destPath = path2.join(destRoot, outRelPath);
-    const normalizedRendered = normalizeRenderedContent(rendered, outRelPath);
+    const configMatch = /(?:^|[/\\])config[/\\]_([^/\\]+)\.ya?ml$/.exec(outRelPath);
+    const normalizedRendered = normalizeRenderedContent(configMatch ? parameterizeConfig(configMatch[1], rendered) : rendered, outRelPath);
     await fse.ensureDir(path2.dirname(destPath));
     await fse.writeFile(destPath, normalizedRendered, "utf-8");
   }
@@ -1124,7 +1141,7 @@ async function createProject(options) {
     });
     await generateFromTemplates(projectPath, context);
     {
-      const { generateConfigFile: generateConfigFile2, generateEnvExample } = await import('./cli-config-templates-QRF6B5T4.js');
+      const { generateConfigFile: generateConfigFile2, generateEnvExample } = await import('./cli-config-templates-3XSFIXBP.js');
       const configs = resolvedOptions.moduleConfigs;
       const isApiWorkspace = resolvedOptions.appType === "api";
       const isFullstack = resolvedOptions.appType === "fullstack";
@@ -1145,26 +1162,60 @@ async function createProject(options) {
           generateConfigFile2("core", configs)
         );
       }
-      const envExample = isApiWorkspace ? `${generateEnvExample(resolvedOptions.features, configs)}
-# =============================================================================
-# Service Runtime
-# =============================================================================
-PORT=3000
-` : isFullstack ? `${generateEnvExample(resolvedOptions.features, configs, true)}
-# First-start administrator password. The CLI generates a random value in .env.
+      const configContents = {};
+      for (const file of await fse.readdir(configDir)) {
+        if (/^_.*\.yml$/.test(file))
+          configContents[file.slice(1, -4)] = await fse.readFile(path2.join(configDir, file), "utf8");
+      }
+      const envFeatures = resolvedOptions.features;
+      const envContents = generateEnvExample(envFeatures, configs, isFullstack, configContents);
+      let envExample = isApiWorkspace ? envContents : isFullstack ? `${envContents}
+# First-start administrator password; must satisfy the IAM password policy.
 HAI_ADMIN_DEFAULT_PASSWORD=
 
-# Local development API. Use your public API origin for deployment/native clients.
+# Public API origin; never include credentials.
 PUBLIC_API_BASE=http://127.0.0.1:3000
-` : generateEnvExample(resolvedOptions.features, configs);
+` : context.isSvelteOnlyApp ? `${envContents}
+# Public API URL including /api/v1; never include credentials.
+PUBLIC_API_BASE=http://10.0.2.2:3000/api/v1
+` : envContents;
+      const runtimeVariables = /* @__PURE__ */ new Map();
+      for (const file of await fse.readdir(projectPath, { recursive: true, encoding: "utf8" })) {
+        if (!/\.(?:ts|js|mjs|svelte|envsh)$/.test(file))
+          continue;
+        for (const variable of runtimeEnvironmentVariables(await fse.readFile(path2.join(projectPath, file), "utf8")))
+          runtimeVariables.set(variable.name, variable);
+      }
+      const existingNames = new Set([...envExample.matchAll(/^(?:#\s*)?([A-Z][A-Z0-9_]*)=/gm)].map((match) => match[1]));
+      const runtimeExample = renderEnvironment([...runtimeVariables.values()].filter((variable) => !existingNames.has(variable.name)));
+      if (runtimeExample)
+        envExample += `
+# \u53EF\u9009\u8FD0\u884C\u5165\u53E3\uFF08\u6309\u7528\u9014\u6CE8\u5165\uFF0C\u4E0D\u8FDB\u5165\u516C\u5171\u9ED8\u8BA4\u503C\uFF09\uFF1A
+${runtimeExample.split("\n").map((line) => line && !line.startsWith("#") ? `# ${line}` : line).join("\n")}
+`;
       await writeFile(envExamplePath, envExample);
+      const envDirectory = path2.dirname(envExamplePath);
+      const sharedVariables = envExample.split("\n").filter((line) => /^[A-Z][A-Z0-9_]*=/.test(line));
+      await writeFile(path2.join(envDirectory, ".env"), `# \u516C\u5171\u57FA\u7840\u914D\u7F6E\uFF08\u53EF\u63D0\u4EA4\uFF09\uFF1B\u5B8C\u6574\u5B57\u6BB5\u8BF4\u660E\u89C1 .env.example\u3002
+${sharedVariables.join("\n")}
+`);
+      for (const [mode, environment] of [["dev", "development"], ["test", "test"], ["prod", "production"]]) {
+        await writeFile(path2.join(envDirectory, `.env.${mode}`), `# \u516C\u5171 ${mode} \u73AF\u5883\u914D\u7F6E\uFF1B\u672C\u673A\u79C1\u6709\u503C\u653E .env.local\uFF0C\u8FDB\u7A0B\u73AF\u5883\u53D8\u91CF\u4F18\u5148\u3002
+HAI_CORE_ENV=${environment}
+HAI_CORE_DEBUG=false
+HAI_CORE_LOGGING_LEVEL=${mode === "test" ? "warn" : mode === "dev" ? "debug" : "info"}
+`);
+      }
       if (isFullstack) {
         const password = `Aa1!${randomBytes(24).toString("base64url")}`;
-        await fse.writeFile(path2.join(projectPath, ".env"), envExample.replace("HAI_ADMIN_DEFAULT_PASSWORD=\n", `HAI_ADMIN_DEFAULT_PASSWORD=${password}
-`), { mode: 384 });
+        await fse.writeFile(path2.join(projectPath, ".env.local"), `# \u672C\u673A\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002
+HAI_ADMIN_DEFAULT_PASSWORD=${password}
+`, { mode: 384 });
+      } else {
+        await writeFile(path2.join(envDirectory, ".env.local"), "# \u672C\u673A\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u63D0\u4EA4 Git\uFF1B\u8986\u76D6\u516C\u5171\u57FA\u7840\u548C\u73AF\u5883\u914D\u7F6E\u3002\n");
       }
     }
-    const { generateSkillFiles } = await import('./cli-skill-templates-EZFW7D43.js');
+    const { generateSkillFiles } = await import('./cli-skill-templates-TSYEQTCY.js');
     await generateSkillFiles(
       projectPath,
       resolvedOptions.features,
@@ -1277,7 +1328,7 @@ async function resolveOptions(options) {
   let selectedFeatures = [];
   const appTypeDefaults = APP_TYPES[selectedAppType].defaultFeatures;
   if (selectedAppType === "fullstack") {
-    selectedFeatures = resolveFeatureDependencies(appTypeDefaults);
+    selectedFeatures = resolveFeatureDependencies([...appTypeDefaults, ...options.features?.includes("deploy") ? ["deploy"] : []]);
   } else if (selectedTemplate === "custom" && !options.features && useDefaults) {
     selectedFeatures = resolveFeatureDependencies(appTypeDefaults);
   } else if (selectedTemplate === "custom" && !options.features) {
@@ -1685,39 +1736,44 @@ function generateAiDevelopmentReadme() {
 
 \u4ECE\u672C\u9879\u76EE\u6839\u76EE\u5F55\u6253\u5F00\u6240\u7528\u7F16\u7801\u5DE5\u5177\uFF0C\u5148\u8BFB\u53D6 [AGENTS.md](./AGENTS.md)\u3002Claude Code \u901A\u8FC7 [CLAUDE.md](./CLAUDE.md) \u52A0\u8F7D\u9879\u76EE\u89C4\u5219\uFF1BGitHub Copilot \u4F7F\u7528 [.github/copilot-instructions.md](./.github/copilot-instructions.md)\uFF0COpenCode \u4F7F\u7528 AGENTS.md \u548C [opencode.json](./opencode.json)\u3002
 
+\u4E1A\u52A1\u4EE5\u7528\u6237\u5F53\u524D\u660E\u786E\u8981\u6C42\u53CA\u5176\u6307\u5B9A\u7684\u9700\u6C42/\u8BBE\u8BA1\u6587\u6863\u4E3A\u51C6\u3002\u6A21\u677F AGENTS\u3001README\u3001skills\u3001\u751F\u6210\u4EE3\u7801\u4E0E\u6D4B\u8BD5\u4E2D\u7684\u89D2\u8272/\u6743\u9650\u3001\u6D41\u7A0B\u3001\u9650\u989D\u548C\u67B6\u6784\u662F\u53EF\u8C03\u6574\u7684\u521D\u59CB\u65B9\u6848\uFF1B\u5BA1\u67E5\u5C06\u5DEE\u5F02\u5217\u4E3A\u6A21\u677F\u9002\u914D\u9879\uFF0C\u5B9E\u65BD\u6309\u6388\u6743\u540C\u6B65\u51B2\u7A81\u4EE3\u7801\u3001\u6D4B\u8BD5\u4E0E\u8FC7\u671F\u89C4\u5219\uFF0C\u4E0D\u8981\u6C42\u628A\u9700\u6C42\u6539\u56DE\u6A21\u677F\u3002\u6846\u67B6 API \u4EE5\u5F53\u524D\u5B89\u88C5\u7248\u672C\u516C\u5F00\u5951\u7EA6\u4E3A\u51C6\uFF0C\u670D\u52A1\u7AEF\u6388\u6743\u3001\u8D44\u6E90\u9694\u79BB\u3001\u8F93\u5165\u6821\u9A8C\u548C\u51ED\u636E\u4FDD\u62A4\u4ECD\u9700\u843D\u5B9E\u3002
+
 Codex\u3001Cursor\u3001Copilot\u3001OpenCode \u4ECE .agents/skills/ \u53D1\u73B0\u5171\u4EAB\u6280\u80FD\uFF1BClaude Code \u901A\u8FC7 CLAUDE.md \u5F15\u7528 AGENTS.md\uFF0C\u5E76\u6309\u9879\u76EE\u6307\u5F15\u8BFB\u53D6 .agents/skills/ \u7684\u540C\u4E00\u4EFD\u6B63\u6587\u3002\u9700\u6C42\u6216\u8BBE\u8BA1\u6587\u6863\u5728\u751F\u6210\u524D\u4F7F\u7528 [\u6587\u6863\u5BA1\u67E5 Skill](./.agents/skills/hai-spec-review/SKILL.md) \u4E25\u683C\u68C0\u67E5\u5B8C\u5907\u6027\u3001\u6B67\u4E49\u3001\u6280\u672F\u6B63\u786E\u6027\u548C\u547D\u540D\u4E00\u81F4\u6027\uFF0C\u95EE\u9898\u89E3\u51B3\u540E\u518D\u751F\u6210\u3002\u666E\u901A\u65B0\u589E\u3001\u4FEE\u6539\u3001\u4FEE\u590D\u4EFB\u52A1\u4F7F\u7528 [\u5E94\u7528\u5F00\u53D1 Skill](./.agents/skills/hai-app-create/SKILL.md) \u548C [\u5F00\u53D1\u89C4\u8303\u4E0E\u6846\u67B6\u80FD\u529B\u8DEF\u7531](./.agents/skills/hai-app-create/development.md)\uFF1B\u5177\u4F53\u6A21\u5757\u518D\u6309\u9700\u8BFB\u53D6\uFF0C\u4E0D\u80FD\u628A Skill \u5DF2\u4EA4\u4ED8\u5F53\u6210\u4F9D\u8D56\u5DF2\u5B89\u88C5\u6216\u914D\u7F6E\u5DF2\u542F\u7528\u3002
 
-\u6839\u636E\u6587\u6863\u89C4\u5212\u3001\u5B9E\u65BD\u6216\u8FD4\u4FEE\u65F6\uFF0C\u4F7F\u7528 [\u6587\u6863\u5B9E\u65BD Skill](./.agents/skills/hai-spec-implement/SKILL.md)\uFF1A\u6309\u53EF\u9A8C\u6536\u529F\u80FD\u62C6\u5206\uFF0C\u7EF4\u62A4 docs/task-list.md \u4E0E docs/tasks/ \u8BB0\u5F55\uFF0C\u6BCF\u9879\u5728\u72EC\u7ACB\u5206\u652F\u8D70 TDD\u3001\u9A8C\u8BC1\u4E0E\u672C\u5730\u5408\u5E76\uFF1B\u8FD4\u4FEE\u6CBF\u7528\u539F\u4EFB\u52A1\u4E0E\u5206\u652F\u5E76\u8FFD\u52A0\u8BC1\u636E\u3002\u4EC5\u89C4\u5212\u4E0D\u5F00\u59CB\u5B9E\u73B0\uFF0C\u6307\u5B9A\u4EFB\u52A1\u5148\u6838\u9A8C\u4F9D\u8D56\u3002
+\u6839\u636E\u6587\u6863\u89C4\u5212\u3001\u5B9E\u65BD\u3001\u8FD4\u4FEE\u6216\u6309\u5DF2\u63D0\u4EA4\u6587\u6863\u5DEE\u5F02\u540C\u6B65\u5B9E\u73B0\u65F6\uFF0C\u4F7F\u7528 [\u6587\u6863\u5B9E\u65BD Skill](./.agents/skills/hai-spec-implement/SKILL.md)\uFF1A\u7EF4\u62A4 docs/task-list.md \u4E0E docs/tasks/\uFF0C\u8BB0\u5F55\u5DF2\u9A8C\u6536\u6587\u6863\u548C\u5B9E\u73B0\u7684 Git SHA\uFF0C\u6BD4\u8F83\u56FA\u5B9A\u76EE\u6807\u7248\u672C\u540E\u66F4\u65B0\u539F\u4EFB\u52A1\u6216\u65B0\u5EFA\u4EFB\u52A1\uFF0C\u6BCF\u9879\u72EC\u7ACB\u5206\u652F TDD\u3001\u9A8C\u8BC1\u5E76\u672C\u5730\u5408\u5E76\uFF1B\u5168\u90E8\u5DEE\u5F02\u4E0E\u6574\u4F53\u9A8C\u6536\u901A\u8FC7\u540E\u624D\u63A8\u8FDB\u57FA\u7EBF\u3002\u8FD4\u4FEE\u6CBF\u7528\u539F\u4EFB\u52A1\u4E0E\u5206\u652F\u3002\u4EC5\u89C4\u5212\u4E0D\u5F00\u59CB\u5B9E\u73B0\uFF0C\u6307\u5B9A\u4EFB\u52A1\u5148\u6838\u9A8C\u4F9D\u8D56\u3002
 
 \u4F18\u5148\u590D\u7528\u9002\u7528\u7684 hai-framework \u516C\u5F00 API \u4E0E\u5DF2\u6709\u4E1A\u52A1\u5B9E\u73B0\u3002\u5B8C\u6210\u65F6\u8BF4\u660E\u590D\u7528\u7684\u80FD\u529B\u3001\u76F8\u5173\u80FD\u529B\u672A\u91C7\u7528\u7684\u539F\u56E0\uFF0C\u4EE5\u53CA\u5B89\u5168\u8FB9\u754C\u548C\u7C7B\u578B\u3001\u914D\u7F6E\u3001\u6587\u6848\u3001\u8C03\u7528\u65B9\u7684\u540C\u6B65\u60C5\u51B5\u3002\u8D28\u91CF\u9A8C\u8BC1\u6309\u5F53\u524D package.json \u6267\u884C typecheck \u2192 lint \u2192 build \u2192 test\uFF1BUI\u3001\u8DEF\u7531\u4E0E\u7AEF\u5230\u7AEF\u6D41\u7A0B\u53E6\u8FD0\u884C test:e2e\uFF0C\u672A\u8FD0\u884C\u9879\u8BF4\u660E\u539F\u56E0\u3002\u5B89\u5168\u4E0E\u8D28\u91CF\u89C4\u5219\u65E2\u8981\u6309\u89C4\u8303\u5BA1\u67E5\uFF0C\u4E5F\u8981\u8FD0\u884C\u95E8\u7981\u9A8C\u8BC1\u3002
 
-\u5DF2\u6709 hai \u9879\u76EE\u53EF\u8FD0\u884C hai init \u8865\u9F50\u7F3A\u5931\u7684 AI \u652F\u6301\u6587\u4EF6\u4E0E\u53C2\u8003\u8D44\u6E90\uFF1B\u5DF2\u6709 AGENTS.md\u3001Skill \u548C\u81EA\u5B9A\u4E49\u89C4\u5219\u4F1A\u4FDD\u7559\uFF0C\u5347\u7EA7\u65F6\u9700\u5C06\u4E0A\u8FF0\u666E\u901A\u5F00\u53D1\u5165\u53E3\u4E0E\u89C4\u8303\u663E\u5F0F\u5408\u5E76\u5230\u65E7\u6307\u5F15\u3002
+\u5DF2\u6709 hai \u9879\u76EE\u53EF\u8FD0\u884C hai init \u8865\u9F50\u7F3A\u5931\u7684 AI \u652F\u6301\u6587\u4EF6\u4E0E\u53C2\u8003\u8D44\u6E90\uFF1B\u5DF2\u6709 AGENTS.md\u3001Skill \u548C\u81EA\u5B9A\u4E49\u89C4\u5219\u4F1A\u4FDD\u7559\uFF0C\u5347\u7EA7\u65F6\u9700\u5C06\u4E0A\u8FF0\u9700\u6C42\u4F18\u5148\u89C4\u5219\u3001\u666E\u901A\u5F00\u53D1\u5165\u53E3\u4E0E\u89C4\u8303\u663E\u5F0F\u5408\u5E76\u5230\u65E7\u6307\u5F15\uFF0C\u5E76\u4FEE\u6B63\u5DF2\u88AB\u9700\u6C42\u66FF\u4EE3\u7684\u6A21\u677F\u7EA6\u675F\u3002
 
 `;
 }
+function generateEnvironmentReadme() {
+  return `## \u5206\u73AF\u5883\u914D\u7F6E
+
+\u8FD0\u884C\u53C2\u6570\u5728 \`.env.example\` \u4E2D\u9010\u9879\u8BF4\u660E\u7528\u9014\u3001\u679A\u4E3E\u548C\u8303\u56F4\u3002\`.env\` \u4E3A\u516C\u5171\u57FA\u7840\uFF0C\`.env.dev\` / \`.env.test\` / \`.env.prod\` \u4E3A\u73AF\u5883\u8986\u76D6\uFF0C\u5747\u63D0\u4EA4 Git\uFF1B\`.env.local\` \u4E3A\u672C\u673A\u79C1\u6709\u8986\u76D6\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002\u4F18\u5148\u7EA7\u4E3A\u8FDB\u7A0B\u73AF\u5883 > \`.env.local\` > \u73AF\u5883\u6587\u4EF6 > \`.env\`\u3002YAML \u663E\u5F0F\u5F15\u7528 \`HAI_<\u914D\u7F6E\u540D>_<\u8DEF\u5F84>\` \u5E76\u4FDD\u7559\u672C\u5730\u56DE\u9000\uFF0CcamelCase \u4E0D\u62C6\u8BCD\u3002\u5B8C\u6574\u547D\u4EE4\u3001\u52A0\u8F7D\u4F18\u5148\u7EA7\u548C Provider \u5207\u6362\u89C1 [\u73AF\u5883\u914D\u7F6E](.agents/skills/hai-app-create/development.md#\u73AF\u5883\u914D\u7F6E)\u3002
+
+| \u7528\u9014 | \u547D\u4EE4 |
+| --- | --- |
+| \u5F00\u53D1 / \u6D4B\u8BD5\u6A21\u5F0F / \u751F\u4EA7\u6A21\u5F0F\u9884\u89C8 | \`pnpm dev\` / \`dev:test\` / \`dev:prod\` |
+| \u7C7B\u578B\u68C0\u67E5\uFF08check \u4E3A\u522B\u540D\uFF09 | \`pnpm typecheck\` |
+| \u68C0\u67E5 / \u81EA\u52A8\u4FEE\u590D\u683C\u5F0F | \`pnpm lint\` / \`lint:fix\` |
+| \u6E90\u7801\u6784\u5EFA / \u955C\u50CF\u6784\u5EFA | \`pnpm build\` / \`pnpm build --target docker\` |
+| \u5355\u5143\u6D4B\u8BD5 / \u76D1\u542C / \u6D4F\u89C8\u5668\u9A8C\u6536 | \`pnpm test\` / \`test:watch\` / \`test:e2e\` |
+| Node \u670D\u52A1\u6309\u73AF\u5883\u542F\u52A8\uFF08\u6784\u5EFA\u540E\uFF09 | \`pnpm start\` / \`start:test\` / \`start:prod\` |
+
+Vite \u5BA2\u6237\u7AEF\u4F7F\u7528 \`preview\` \u9884\u89C8\u9759\u6001\u4EA7\u7269\uFF0CNode \u670D\u52A1\u4F7F\u7528 \`start\`\uFF1B\u7EAF contract/shared \u5E93\u53EA\u63D0\u4F9B\u9002\u7528\u7684\u6784\u5EFA\u548C\u8D28\u91CF\u547D\u4EE4\u3002API workspace \u7684\u73AF\u5883\u6587\u4EF6\u4F4D\u4E8E \`apps/<name>-service\`\uFF0Cfullstack \u4F4D\u4E8E\u5DE5\u7A0B\u6839\u3002`;
+}
 function generateReadme(name, appTypeLabel, pm, appType) {
   const install = getInstallCommand(pm);
-  const isStaticImage = appType === "mobile-app";
-  const containerPort = isStaticImage ? 8080 : 3e3;
-  const runtimeOptions = isStaticImage ? "" : ` --env-file .env --mount type=bind,source=/absolute/path/to/config,target=/app/config,readonly --mount type=volume,source=${name}-data,target=/app/data`;
-  const embeddedDataBuild = isStaticImage ? "" : `
-# \u5E26 data/ \u521D\u59CB\u6570\u636E\u6784\u5EFA\uFF08\u4E8C\u9009\u4E00\uFF09
-${getRunCommand(pm, "docker:build:data")}
-${getRunCommand(pm, "podman:build:data")}`;
-  const runtimeNotes = isStaticImage ? "- \u8BE5\u6A21\u677F\u751F\u6210\u9759\u6001 Web \u955C\u50CF\uFF0C\u4E0D\u5305\u542B\u53EF\u5199\u6570\u636E\u5E93\u76EE\u5F55\u3002" : `\u4EE5\u4E0A\u4E09\u4E2A\u8FD0\u884C\u65F6\u53C2\u6570\u5747\u53EF\u6309\u9700\u5220\u9664\uFF1A
-
-| \u53C2\u6570 | \u7528\u9014 | \u53EF\u9009\u6027 |
-| --- | --- | --- |
-| \`--env-file .env\` | \u6279\u91CF\u4F20\u5165\u73AF\u5883\u53D8\u91CF\uFF1B\u4E5F\u53EF\u6539\u7528\u591A\u4E2A \`-e NAME=value\`\u3002 | \u53EF\u9009\uFF1B\u5220\u9664\u540E\u4F7F\u7528\u955C\u50CF\u548C YAML \u9ED8\u8BA4\u503C\u3002 |
-| \`--mount type=bind,...target=/app/config,readonly\` | \u7528\u5BBF\u4E3B\u673A\u914D\u7F6E\u76EE\u5F55\u8986\u76D6\u955C\u50CF\u5185 \`/app/config\`\uFF1B\u5FC5\u987B\u628A \`source\` \u6539\u6210\u771F\u5B9E\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\`readonly\` \u9632\u6B62\u5BB9\u5668\u4FEE\u6539\u914D\u7F6E\u3002 | \u53EF\u9009\uFF1B\u5220\u9664\u540E\u4F7F\u7528\u955C\u50CF\u81EA\u5E26\u914D\u7F6E\u3002 |
-| \`--mount type=volume,...target=/app/data\` | \u521B\u5EFA\u6216\u590D\u7528 named volume\uFF0C\u6301\u4E45\u5316 SQLite \u548C\u672C\u5730\u5B58\u50A8\u3002 | \u53EF\u9009\u4F46\u751F\u4EA7\u73AF\u5883\u5EFA\u8BAE\u4FDD\u7559\uFF1B\u5220\u9664\u540E\u6570\u636E\u53EA\u5199\u5165\u5BB9\u5668\u5C42\uFF0C\u4F7F\u7528 \`--rm\` \u5220\u9664\u5BB9\u5668\u65F6\u4F1A\u4E22\u5931\u3002 |
-
-- \u5E26\u6570\u636E\u6784\u5EFA\u4F1A\u628A\u5F53\u524D \`data/\`\uFF08\u4F8B\u5982\u9884\u7F6E SQLite \u6587\u4EF6\uFF09\u56FA\u5316\u4E3A\u955C\u50CF\u521D\u59CB\u5FEB\u7167\uFF1B\u8FD0\u884C\u540E\u4EA7\u751F\u7684\u65B0\u6570\u636E\u4ECD\u5E94\u5199\u5165 \`/app/data\` volume\u3002`;
-  const testPath = isStaticImage ? "/health" : "/";
   return `# ${name}
 
 \u57FA\u4E8E hai Agent Framework \u6784\u5EFA\u7684${appTypeLabel}\u5E94\u7528\u3002
 
+## \u9875\u9762\u5E03\u5C40\u4E0E\u8DEF\u7531
+
+\u9875\u9762\u7EDF\u4E00\u7EE7\u627F\u6839\u5E03\u5C40\u7684 header/footer\u3002${appType === "mobile-app" ? "\u9875\u9762\u653E src/lib/pages/**/*.svelte\uFF0Chash \u8DEF\u7531\u81EA\u52A8\u53D1\u73B0\uFF0C\u5237\u65B0\u4E0E\u524D\u8FDB\u540E\u9000\u6062\u590D\u5F53\u524D\u9875\u3002" : "\u4F7F\u7528 SvelteKit \u81EA\u52A8\u6587\u4EF6\u8DEF\u7531\uFF0C\u65B0\u589E +page.svelte \u65E0\u9700\u7EF4\u62A4\u8DEF\u7531\u8868\uFF1B\u5237\u65B0\u5B9A\u4F4D\u4E0E\u670D\u52A1\u7AEF\u9274\u6743\u4FDD\u6301\u4E00\u81F4\u3002"}
+
 ## \u5F00\u53D1
 
 \`\`\`bash
@@ -1725,6 +1781,8 @@ ${install}
 ${getRunCommand(pm, "dev")}
 \`\`\`
 
+${generateEnvironmentReadme()}
+
 ## \u6784\u5EFA
 
 \`\`\`bash
@@ -1733,31 +1791,20 @@ ${getRunCommand(pm, "i18n:compile")}
 ${getRunCommand(pm, "preview")}
 \`\`\`
 
-## \u5BB9\u5668\u8FD0\u884C
-
-### \u6784\u5EFA\u955C\u50CF
+## \u6784\u5EFA\u4E0E\u90E8\u7F72
 
 \`\`\`bash
-# \u666E\u901A\u6784\u5EFA\uFF08\u4E8C\u9009\u4E00\uFF09
-${getRunCommand(pm, "docker:build")}
-${getRunCommand(pm, "podman:build")}${embeddedDataBuild}
-\`\`\`
-
-### \u8FD0\u884C\u955C\u50CF
-
-\`\`\`bash
-# Docker\uFF1B\u4F7F\u7528 Podman \u65F6\u5C06 docker \u66FF\u6362\u4E3A podman
-docker run --rm -d --name ${name} -p ${containerPort}:${containerPort}${runtimeOptions} ${name}:latest
-\`\`\`
-
-### \u6D4B\u8BD5\u955C\u50CF
-
-\`\`\`bash
-curl --fail http://127.0.0.1:${containerPort}${testPath}
-docker stop ${name}
+# \u9ED8\u8BA4\u53EA\u7F16\u8BD1\u6E90\u7801\uFF1B\u4E0D\u9009\u62E9\u90E8\u7F72\u73AF\u5883
+${pm} build
+# \u6784\u5EFA\u5E76\u5BFC\u51FA API/Web \u955C\u50CF\uFF0Cauto \u4F18\u5148 Podman\u3001\u5176\u6B21 Docker
+${pm} build --target docker
+# \u9009\u62E9\u73AF\u5883\u3001\u4E2D\u95F4\u4EF6\u5E76\u4E0A\u4F20\u4E00\u4E2A Compose tar\uFF1B\u4E0D\u4F1A\u91CD\u65B0\u6784\u5EFA
+${pm} exec hai deploy . --env test
+# \u65E0\u6CD5\u8FDE\u63A5\u670D\u52A1\u5668\u65F6\u53EA\u751F\u6210\u5305\uFF0C\u6309\u8F93\u51FA\u8BF4\u660E\u624B\u5DE5\u642C\u8FD0\u548C\u542F\u52A8
+${pm} exec hai deploy . --env prod --bundle-only
 \`\`\`
 
-${runtimeNotes}
+\u955C\u50CF\u6784\u5EFA\u914D\u7F6E\u89C1 \`hai.build.json\`\u3002\u6784\u5EFA\u4EA7\u7269\u4FDD\u5B58\u5728 \`.hai/build/docker/<buildId>\`\uFF0C\u53EF\u7528 \`--artifact-dir\` \u9009\u62E9\u540C\u4E00\u4EFD\u4EA7\u7269\u90E8\u7F72\u5230 test/prod\u3002\u90E8\u7F72\u5305\u542B\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u80FD\u63D0\u4EA4 Git\u3002\u73AF\u5883\u5DF2\u914D\u7F6E\u5B8C\u5907\u53EF\u52A0 \`--skip-middleware\`\u3002\u670D\u52A1\u8FD0\u884C\u6570\u636E\u7531 volume \u6301\u4E45\u5316\uFF0C\u955C\u50CF\u4E0D\u6253\u5305\u672C\u673A data\u3002API/Web \u8054\u5408\u90E8\u7F72\u516C\u5F00 Web \u5165\u53E3\u5E76\u4EE3\u7406\u540C\u6E90 API\uFF1B\u6CA1\u6709 Web \u4EA7\u7269\u65F6\u53EA\u90E8\u7F72\u670D\u52A1\u3002
 
 ${generateAiDevelopmentReadme()}## \u6587\u6863
 
@@ -1782,6 +1829,8 @@ ${pm} install
 ${pm} dev
 \`\`\`
 
+${generateEnvironmentReadme()}
+
 ## \u8D28\u91CF\u95E8\u7981
 
 \`\`\`bash
@@ -1792,50 +1841,20 @@ ${pm} test
 ${pm} test:e2e
 \`\`\`
 
-## \u5BB9\u5668\u8FD0\u884C
-
-### \u6784\u5EFA\u955C\u50CF
+## \u6784\u5EFA\u4E0E\u90E8\u7F72
 
 \`\`\`bash
-# \u666E\u901A\u6784\u5EFA\uFF08\u4E8C\u9009\u4E00\uFF09
-${pm} docker:build
-${pm} podman:build
-
-# \u5C06 apps/${name}-service/data \u4F5C\u4E3A\u955C\u50CF\u521D\u59CB\u6570\u636E\u6784\u5EFA\uFF08\u4E8C\u9009\u4E00\uFF09
-${pm} docker:build:data
-${pm} podman:build:data
-\`\`\`
-
-### \u8FD0\u884C\u955C\u50CF
-
-\`\`\`bash
-# \u4F7F\u7528 Podman \u65F6\u5C06 docker \u66FF\u6362\u4E3A podman
-docker run --rm -d --name ${name} -p 3000:3000 --env-file .env \\
-  --mount type=bind,source=/absolute/path/to/config,target=/app/config,readonly \\
-  --mount type=volume,source=${name}-data,target=/app/data \\
-  ${name}:latest
-\`\`\`
-
-### \u6D4B\u8BD5\u955C\u50CF
-
-\`\`\`bash
-curl --fail http://127.0.0.1:3000/health
-curl --fail http://127.0.0.1:3000/ready
-curl --fail --request POST http://127.0.0.1:3000/api/v1/app/info \\
-  --header "Content-Type: application/json" --data '{}'
-docker stop ${name}
+# \u9ED8\u8BA4\u53EA\u7F16\u8BD1\u6E90\u7801\uFF1B\u4E0D\u9009\u62E9\u90E8\u7F72\u73AF\u5883
+${pm} build
+# \u6784\u5EFA\u5E76\u5BFC\u51FA API/Web \u955C\u50CF\uFF0Cauto \u4F18\u5148 Podman\u3001\u5176\u6B21 Docker
+${pm} build --target docker
+# \u9009\u62E9\u73AF\u5883\u3001\u4E2D\u95F4\u4EF6\u5E76\u4E0A\u4F20\u4E00\u4E2A Compose tar\uFF1B\u4E0D\u4F1A\u91CD\u65B0\u6784\u5EFA
+${pm} exec hai deploy apps/${name}-service --env test
+# \u65E0\u6CD5\u8FDE\u63A5\u670D\u52A1\u5668\u65F6\u53EA\u751F\u6210\u5305\uFF0C\u6309\u8F93\u51FA\u8BF4\u660E\u624B\u5DE5\u642C\u8FD0\u548C\u542F\u52A8
+${pm} exec hai deploy apps/${name}-service --env prod --bundle-only
 \`\`\`
 
-- \u914D\u7F6E\u9ED8\u8BA4\u6765\u81EA \`apps/${name}-service/config\`\uFF1B\u8FD0\u884C\u65F6\u53EF\u53EA\u8BFB\u6302\u8F7D\u5230 \`/app/config\` \u8986\u76D6\uFF0C\u5E76\u7528 YAML \u7684 \`\${ENV_NAME:default}\` \u5360\u4F4D\u7B26\u63A5\u6536\u73AF\u5883\u53D8\u91CF\u3002
-- \u5E26\u6570\u636E\u6784\u5EFA\u4F1A\u628A \`apps/${name}-service/data\` \u56FA\u5316\u4E3A\u955C\u50CF\u521D\u59CB\u6570\u636E\uFF1B\u751F\u4EA7\u5199\u5165\u4ECD\u5EFA\u8BAE\u4F7F\u7528 \`/app/data\` volume\u3002
-
-\u4EE5\u4E0A\u4E09\u4E2A\u8FD0\u884C\u65F6\u53C2\u6570\u5747\u53EF\u6309\u9700\u5220\u9664\uFF1A
-
-| \u53C2\u6570 | \u7528\u9014 | \u53EF\u9009\u6027 |
-| --- | --- | --- |
-| \`--env-file .env\` | \u6279\u91CF\u4F20\u5165\u73AF\u5883\u53D8\u91CF\uFF1B\u4E5F\u53EF\u6539\u7528\u591A\u4E2A \`-e NAME=value\`\u3002 | \u53EF\u9009\uFF1B\u5220\u9664\u540E\u4F7F\u7528\u955C\u50CF\u548C YAML \u9ED8\u8BA4\u503C\u3002 |
-| \`--mount type=bind,...target=/app/config,readonly\` | \u7528\u5BBF\u4E3B\u673A\u914D\u7F6E\u76EE\u5F55\u8986\u76D6\u955C\u50CF\u5185 \`/app/config\`\uFF1B\u5FC5\u987B\u628A \`source\` \u6539\u6210\u771F\u5B9E\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\`readonly\` \u9632\u6B62\u5BB9\u5668\u4FEE\u6539\u914D\u7F6E\u3002 | \u53EF\u9009\uFF1B\u5220\u9664\u540E\u4F7F\u7528\u955C\u50CF\u81EA\u5E26\u914D\u7F6E\u3002 |
-| \`--mount type=volume,...target=/app/data\` | \u521B\u5EFA\u6216\u590D\u7528 named volume\uFF0C\u6301\u4E45\u5316 SQLite \u548C\u672C\u5730\u5B58\u50A8\u3002 | \u53EF\u9009\u4F46\u751F\u4EA7\u73AF\u5883\u5EFA\u8BAE\u4FDD\u7559\uFF1B\u5220\u9664\u540E\u6570\u636E\u53EA\u5199\u5165\u5BB9\u5668\u5C42\uFF0C\u4F7F\u7528 \`--rm\` \u5220\u9664\u5BB9\u5668\u65F6\u4F1A\u4E22\u5931\u3002 |
+\u955C\u50CF\u6784\u5EFA\u914D\u7F6E\u89C1 \`hai.build.json\`\u3002\u6784\u5EFA\u4EA7\u7269\u4FDD\u5B58\u5728 \`.hai/build/docker/<buildId>\`\uFF0C\u53EF\u7528 \`--artifact-dir\` \u9009\u62E9\u540C\u4E00\u4EFD\u4EA7\u7269\u90E8\u7F72\u5230 test/prod\u3002\u90E8\u7F72\u5305\u542B\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u80FD\u63D0\u4EA4 Git\u3002\u73AF\u5883\u5DF2\u914D\u7F6E\u5B8C\u5907\u53EF\u52A0 \`--skip-middleware\`\u3002\u670D\u52A1\u8FD0\u884C\u6570\u636E\u7531 volume \u6301\u4E45\u5316\uFF0C\u955C\u50CF\u4E0D\u6253\u5305\u672C\u673A data\u3002API/Web \u8054\u5408\u90E8\u7F72\u516C\u5F00 Web \u5165\u53E3\u5E76\u4EE3\u7406\u540C\u6E90 API\uFF1B\u6CA1\u6709 Web \u4EA7\u7269\u65F6\u53EA\u90E8\u7F72\u670D\u52A1\u3002
 
 ## \u6269\u5C55\u5EFA\u8BAE
 
@@ -1853,20 +1872,6 @@ ${generateAiDevelopmentReadme()}## \u6587\u6863
 }
 function generateFullstackReadme(name, pm, frontends) {
   const enabledFrontends = frontends.map((target) => FRONTEND_TARGETS[target].name).join(" / ");
-  const webBuildCommands = frontends.includes("web") ? `
-# Web \u9759\u6001\u955C\u50CF\uFF08\u4E8C\u9009\u4E00\uFF09
-${pm} docker:build:web
-${pm} podman:build:web` : "";
-  const webRunCommand = frontends.includes("web") ? `
-
-# Web\uFF1BPUBLIC_API_BASE \u5728\u5BB9\u5668\u542F\u52A8\u65F6\u6CE8\u5165\uFF0C\u4E0D\u9700\u8981\u91CD\u65B0\u6784\u5EFA\u955C\u50CF
-docker run --rm -d --name ${name}-web -p 8080:8080 \\
-  -e PUBLIC_API_BASE=https://api.example.com \\
-  ${name}-web:latest` : "";
-  const webTestCommands = frontends.includes("web") ? `curl --fail http://127.0.0.1:8080/health
-curl --fail http://127.0.0.1:8080/runtime-config.js
-` : "";
-  const containerNames = frontends.includes("web") ? `${name} ${name}-web` : name;
   return `# ${name}
 
 \u57FA\u4E8E hai Agent Framework \u6784\u5EFA\u7684\u524D\u540E\u7AEF\u5206\u79BB\u591A\u5305\u5DE5\u7A0B\u3002
@@ -1883,11 +1888,17 @@ curl --fail http://127.0.0.1:8080/runtime-config.js
 
 \u5DF2\u542F\u7528\u524D\u7AEF\uFF1A${enabledFrontends || "Web / App / Desktop"}
 
+## \u9875\u9762\u5E03\u5C40\u4E0E\u8DEF\u7531
+
+Web/App/Desktop \u5171\u4EAB AppShell \u7684 header/footer\u3002\u65B0\u589E\u9875\u9762\u653E shared/src/lib/pages/**/*.svelte\uFF0C\u7531 HashRouter \u81EA\u52A8\u53D1\u73B0\u5E76\u6309\u9700\u52A0\u8F7D\uFF1B\u83DC\u5355\u53EA\u7EF4\u62A4\u5165\u53E3\u3002\u5730\u5740\u4F7F\u7528 #/\u9875\u9762\u8DEF\u5F84\uFF0C\u652F\u6301\u5237\u65B0\u3001\u67E5\u8BE2\u4E32\u4E0E\u6D4F\u89C8\u5668\u524D\u8FDB\u540E\u9000\uFF1BAPI \u6743\u9650\u4ECD\u7531\u670D\u52A1\u7AEF\u6821\u9A8C\u3002
+
 ## \u9ED8\u8BA4\u7BA1\u7406\u529F\u80FD
 
-\u9ED8\u8BA4\u542F\u7528 IAM\u3001reldb\u3001cache\u3001audit\u3001storage \u548C crypto\u3002\u7BA1\u7406\u5458\u53EF\u4EE5\u7BA1\u7406\u7528\u6237\uFF08\u65B0\u589E\u3001\u7F16\u8F91\u3001\u7981\u7528\u3001\u5220\u9664\u3001\u89D2\u8272\u5206\u914D\u3001\u5934\u50CF\u4E0A\u4F20\uFF09\u3001\u67E5\u770B\u4E24\u79CD\u56FA\u5B9A\u89D2\u8272\u53CA\u4EBA\u6570\u3001\u7EF4\u62A4\u89D2\u8272\u8BF4\u660E\u3001\u5206\u9875\u7B5B\u9009\u5BA1\u8BA1\u65E5\u5FD7\uFF1B\u666E\u901A\u7528\u6237\u53EA\u80FD\u7EF4\u62A4\u4E2A\u4EBA\u8D44\u6599\u3001\u5934\u50CF\u3001\u8BED\u8A00\u3001\u4E3B\u9898\u548C\u5BC6\u7801\u3002\u5BC6\u7801\u4FEE\u6539\u540E\u5168\u90E8\u4F1A\u8BDD\u5931\u6548\uFF0C\u9700\u8981\u91CD\u65B0\u767B\u5F55\u3002
+\u4EE5\u4E0B\u63CF\u8FF0\u53EF\u8FD0\u884C\u793A\u4F8B\u7684\u521D\u59CB\u4E1A\u52A1\uFF0C\u53EF\u6309\u5B9E\u9645\u9700\u6C42\u8C03\u6574\u6216\u79FB\u9664\uFF0C\u5E76\u540C\u6B65\u4EE3\u7801\u3001\u6570\u636E\u3001\u9274\u6743\u3001\u754C\u9762\u3001\u6D4B\u8BD5\u548C\u6587\u6863\u3002
+
+\u9ED8\u8BA4\u542F\u7528 IAM\u3001reldb\u3001cache\u3001audit\u3001storage \u548C crypto\u3002\u521D\u59CB\u7BA1\u7406\u5458\u53EF\u4EE5\u7BA1\u7406\u7528\u6237\uFF08\u65B0\u589E\u3001\u7F16\u8F91\u3001\u7981\u7528\u3001\u5220\u9664\u3001\u89D2\u8272\u5206\u914D\u3001\u5934\u50CF\u4E0A\u4F20\uFF09\u3001\u67E5\u770B admin/user \u89D2\u8272\u53CA\u4EBA\u6570\u3001\u7EF4\u62A4\u89D2\u8272\u8BF4\u660E\u3001\u5206\u9875\u7B5B\u9009\u5BA1\u8BA1\u65E5\u5FD7\uFF1B\u521D\u59CB\u666E\u901A\u7528\u6237\u8FDB\u5165\u4E2A\u4EBA\u8D44\u6599\u3001\u5934\u50CF\u3001\u8BED\u8A00\u3001\u4E3B\u9898\u548C\u5BC6\u7801\u8BBE\u7F6E\u3002\u9ED8\u8BA4\u5BC6\u7801\u4FEE\u6539\u540E\u5168\u90E8\u4F1A\u8BDD\u5931\u6548\uFF0C\u9700\u8981\u91CD\u65B0\u767B\u5F55\uFF1B\u89D2\u8272\u6A21\u578B\u3001\u8BBF\u95EE\u8303\u56F4\u548C\u4F1A\u8BDD\u7B56\u7565\u7531\u4E1A\u52A1\u9700\u6C42\u51B3\u5B9A\u3002
 
-CLI \u5DF2\u5728\u6839\u76EE\u5F55\u751F\u6210 \`.env\`\uFF0C\u5176\u4E2D \`HAI_ADMIN_DEFAULT_PASSWORD\` \u662F\u6BCF\u4E2A\u9879\u76EE\u72EC\u7ACB\u751F\u6210\u7684\u968F\u673A\u5F3A\u5BC6\u7801\u3002\u76F4\u63A5\u8FD0\u884C \`dev\` / \`start\` \u5373\u53EF\uFF0C\u9996\u6B21\u767B\u5F55\u4F7F\u7528\u7528\u6237\u540D \`admin\` \u548C\u8BE5\u5BC6\u7801\uFF1B\u4E5F\u53EF\u901A\u8FC7\u540C\u540D\u73AF\u5883\u53D8\u91CF\u8986\u76D6\u3002\u5BC6\u7801\u987B\u6EE1\u8DB3 \`_iam.yml\` \u7B56\u7565\uFF0C\u542F\u52A8\u5931\u8D25\u4F1A\u663E\u793A\u5177\u4F53\u6821\u9A8C\u539F\u56E0\u53CA\u9519\u8BEF\u7801\u3002\`.env\` \u5DF2\u88AB Git \u548C\u5BB9\u5668\u6784\u5EFA\u5FFD\u7565\uFF0C\`.env.example\` \u4E0D\u542B\u771F\u5B9E\u5BC6\u7801\uFF1B\u90E8\u7F72\u65F6\u8BBE\u7F6E\u76EE\u6807\u73AF\u5883\u81EA\u5DF1\u7684\u5BC6\u7801\u3002\u5DF2\u6709\u7528\u6237\u65F6\u4E0D\u4F1A\u91CD\u590D\u521B\u5EFA\u7BA1\u7406\u5458\u6216\u91CD\u8BBE\u5BC6\u7801\u3002
+CLI \u5DF2\u5728\u6839\u76EE\u5F55\u751F\u6210 \`.env.local\`\uFF0C\u5176\u4E2D \`HAI_ADMIN_DEFAULT_PASSWORD\` \u662F\u6BCF\u4E2A\u9879\u76EE\u72EC\u7ACB\u751F\u6210\u7684\u968F\u673A\u5F3A\u5BC6\u7801\u3002\u76F4\u63A5\u8FD0\u884C \`dev\` / \`start\` \u5373\u53EF\uFF0C\u9996\u6B21\u767B\u5F55\u4F7F\u7528\u7528\u6237\u540D \`admin\` \u548C\u8BE5\u5BC6\u7801\uFF1B\u4E5F\u53EF\u901A\u8FC7\u540C\u540D\u73AF\u5883\u53D8\u91CF\u8986\u76D6\u3002\u5BC6\u7801\u987B\u6EE1\u8DB3 \`_iam.yml\` \u7B56\u7565\uFF0C\u542F\u52A8\u5931\u8D25\u4F1A\u663E\u793A\u5177\u4F53\u6821\u9A8C\u539F\u56E0\u53CA\u9519\u8BEF\u7801\u3002\`.env.local\` \u5DF2\u88AB Git \u548C\u5BB9\u5668\u6784\u5EFA\u5FFD\u7565\uFF0C\`.env.example\` \u4E0D\u542B\u771F\u5B9E\u5BC6\u7801\uFF1B\u90E8\u7F72\u65F6\u8BBE\u7F6E\u76EE\u6807\u73AF\u5883\u81EA\u5DF1\u7684\u5BC6\u7801\u3002\u5DF2\u6709\u7528\u6237\u65F6\u4E0D\u4F1A\u91CD\u590D\u521B\u5EFA\u7BA1\u7406\u5458\u6216\u91CD\u8BBE\u5BC6\u7801\u3002
 
 \u672C\u5730\u5F00\u53D1\u9ED8\u8BA4 \`PUBLIC_API_BASE=http://127.0.0.1:3000\`\uFF0CVite \u4F7F\u7528\u540C\u6E90\u4EE3\u7406\uFF1B\u90E8\u7F72\u65F6\u6539\u4E3A\u5B9E\u9645\u516C\u7F51 API Origin\uFF0CAndroid \u6A21\u62DF\u5668\u8BBF\u95EE\u5BBF\u4E3B\u673A\u65F6\u4F7F\u7528 \`http://10.0.2.2:3000\`\u3002\u4E0D\u8981\u5C06\u5BC6\u94A5\u653E\u5165\u4EFB\u4F55 \`PUBLIC_\` \u6216 \`VITE_\` \u53D8\u91CF\u3002
 
@@ -1899,82 +1910,42 @@ CLI \u5DF2\u5728\u6839\u76EE\u5F55\u751F\u6210 \`.env\`\uFF0C\u5176\u4E2D \`HAI_
 
 \u670D\u52A1\u7AEF \`packages/${name}-serv/config/\` \u59CB\u7EC8\u4FDD\u7559 core\u3001serv\u3001db\u3001cache\u3001iam\u3001storage\u3001audit\u3001reach\u3001ai\u3001vecdb\u3001payment\u3001scheduler\u3001deploy \u5171 13 \u4EFD YAML\u3002\u5DF2\u7528\u6A21\u5757\u4FDD\u7559\u5DE5\u4F5C\u9ED8\u8BA4\u503C\uFF0C\u672A\u542F\u7528\u6A21\u5757\u6574\u4EFD\u6CE8\u91CA\uFF0C\u53EF\u9009\u5B57\u6BB5\u548C\u66FF\u4EE3 Provider \u6309\u5757\u6CE8\u91CA\uFF1B\u6839 \`.env.example\` \u4E5F\u4FDD\u7559\u672A\u542F\u7528\u6A21\u5757\u7684\u51ED\u636E\u793A\u4F8B\u3002Reach \u9ED8\u8BA4\u4E3A\u5F00\u53D1\u63A7\u5236\u53F0\u901A\u77E5\uFF0C\u751F\u4EA7\u6309 \`_reach.yml\` \u6CE8\u91CA\u66FF\u6362\u4E3A SMTP\u3001\u77ED\u4FE1\u6216 API Provider\uFF0C\u5E76\u4FDD\u6301\u540D\u79F0\u552F\u4E00\u3002
 
-\u81EA\u52A8\u751F\u6210\u7684 \`.env\` \u9ED8\u8BA4\u53EA\u542F\u7528\u521D\u59CB\u7BA1\u7406\u5458\u5BC6\u7801\u548C \`PUBLIC_API_BASE\`\uFF0C\u6A21\u5757\u73AF\u5883\u8986\u76D6\u4FDD\u7559\u6CE8\u91CA\uFF0CYAML \u662F\u9ED8\u8BA4\u503C\u6765\u6E90\u3002\u9700\u8981\u73AF\u5883\u8986\u76D6\u65F6\u663E\u5F0F\u53D6\u6D88\u5BF9\u5E94\u53D8\u91CF\u7684\u6CE8\u91CA\uFF1B\u7F16\u8F91 YAML \u65F6\u540C\u6B65\u6838\u5BF9\u5DF2\u6709\u8986\u76D6\u3002
+\u81EA\u52A8\u751F\u6210\u7684 \`.env\` \u5305\u542B\u5DF2\u542F\u7528\u6A21\u5757\u7684\u73AF\u5883\u53C2\u6570\uFF1BYAML \u663E\u5F0F\u5F15\u7528\u76F8\u540C\u53D8\u91CF\u5E76\u4FDD\u7559\u672C\u5730\u56DE\u9000\u3002\u7F16\u8F91\u73AF\u5883\u53C2\u6570\u4F18\u5148\u4FEE\u6539\u5BF9\u5E94 \`.env\`\uFF1B\u672A\u542F\u7528\u6A21\u5757\u4ECD\u4FDD\u7559\u6CE8\u91CA\u3002
 
 \u6269\u5C55\u65F6\u5148\u5728\u670D\u52A1\u7AEF workspace \u5B89\u88C5\u9700\u8981\u7684\u5305\uFF0C\u5728 \`src/server/runtime.ts\` \u6309\u6A21\u5757\u516C\u5F00 Schema \u6821\u9A8C\u914D\u7F6E\u3001\u521D\u59CB\u5316\u5E76\u53CD\u5E8F\u5173\u95ED\uFF0C\u518D\u63A5\u5165 contract/procedure \u548C\u754C\u9762\u3002\u6574\u4EFD\u6CE8\u91CA\u6587\u4EF6\u5148\u53BB\u6389\u4E00\u5C42\u5916\u5C42\u6CE8\u91CA\uFF0C\u53EF\u9009\u5757\u7EE7\u7EED\u6309\u9700\u5F00\u542F\uFF1B\u914D\u7F6E\u6587\u4EF6\u5B58\u5728\u4E0D\u4EE3\u8868\u4E1A\u52A1\u529F\u80FD\u5DF2\u63A5\u5165\u3002\`crypto.init()\` \u65E0\u914D\u7F6E\u53C2\u6570\uFF0Cdatapipe \u4E3A\u7EAF\u51FD\u6570\uFF0C\u4E0D\u751F\u6210\u865A\u6784 YAML\u3002
 
 \u73AF\u5883\u53D8\u91CF\u53EA\u8986\u76D6 YAML \u5DF2\u6709\u8DEF\u5F84\uFF0C\u6CE8\u91CA\u952E\u987B\u5148\u542F\u7528\uFF0C\u6216\u7528 \`HAI_DB\` / \`HAI_CACHE\` \u7B49\u6574\u4F53\u5BF9\u8C61\u8986\u76D6\u3002camelCase \u4E0D\u62C6\u8BCD\uFF0C\u4F8B\u5982 \`connectTimeout\` \u5BF9\u5E94 \`HAI_CACHE_CONNECTTIMEOUT\`\u3002\u4FEE\u6539\u914D\u7F6E\u540E\u91CD\u542F\u670D\u52A1\uFF1B\u8BED\u8A00\u5217\u8868\u5728\u5404\u524D\u7AEF/shared \u7684 \`project.inlang/settings.json\` \u4E2D\u540C\u6B65\u3002\`**/data/\` \u5FFD\u7565\u4EFB\u610F\u5C42\u7EA7\u7684\u6570\u636E\u76EE\u5F55\u53CA \`.gitkeep\`\uFF0C\u8FD0\u884C\u6570\u636E\u4E0D\u5165 Git\uFF0C\u8FD0\u884C\u65F6\u81EA\u52A8\u521B\u5EFA\u76EE\u5F55\u3002
 
-## \u5F00\u53D1\u3001\u7F16\u8BD1\u4E0E\u6253\u5305
+${generateEnvironmentReadme()}
+
+## \u5F00\u53D1\u4E0E\u6784\u5EFA
 
 \`\`\`bash
 ${pm} install
 ${pm} dev
-
-# \u4E00\u952E\u7F16\u8BD1\uFF1A\u7C7B\u578B\u68C0\u67E5 + \u5168\u5DE5\u4F5C\u533A\u6784\u5EFA
-${pm} compile
-
-# \u4E00\u952E\u6253\u5305\uFF1AWeb build\u3001App Capacitor sync\u3001Desktop Tauri build\uFF08\u6309\u542F\u7528\u524D\u7AEF\u6267\u884C\uFF09
-${pm} package
-
-# \u90E8\u7F72\u5165\u53E3\uFF1A\u9ED8\u8BA4\u6267\u884C package\uFF0C\u53EF\u66FF\u6362\u4E3A\u56E2\u961F\u81EA\u5DF1\u7684 CI/CD \u53D1\u5E03\u811A\u672C
-${pm} deploy
-\`\`\`
-
-## \u5BB9\u5668\u8FD0\u884C
-
-\u9ED8\u8BA4\u955C\u50CF\u76F4\u63A5\u8FD0\u884C API Service\uFF0C\u5916\u90E8\u7AEF\u53E3\u4E3A 3000\u3002
-
-### \u6784\u5EFA\u955C\u50CF
-
-\`\`\`bash
-# Service \u666E\u901A\u6784\u5EFA\uFF08\u4E8C\u9009\u4E00\uFF09
-${pm} docker:build
-${pm} podman:build
-
-# \u5C06 packages/${name}-serv/data \u4F5C\u4E3A\u955C\u50CF\u521D\u59CB\u6570\u636E\u6784\u5EFA\uFF08\u4E8C\u9009\u4E00\uFF09
-${pm} docker:build:data
-${pm} podman:build:data
-${webBuildCommands}
+${pm} typecheck
+${pm} build
+${pm} test
+${pm} test:e2e
+${frontends.includes("desktop") ? `${pm} build --target desktop --platform windows # Windows \u4E3B\u673A\uFF1BLinux/macOS \u5728\u5BF9\u5E94\u4E3B\u673A\u6784\u5EFA` : ""}
 \`\`\`
 
-### \u8FD0\u884C\u955C\u50CF
-
-\`\`\`bash
-# Service\uFF1B\u4F7F\u7528 Podman \u65F6\u5C06 docker \u66FF\u6362\u4E3A podman
-docker run --rm -d --name ${name} -p 3000:3000 --env-file .env \\
-  --mount type=bind,source=/absolute/path/to/config,target=/app/config,readonly \\
-  --mount type=volume,source=${name}-data,target=/app/data \\
-  ${name}:latest
-${webRunCommand}
-\`\`\`
+Tauri \u9700\u8981\u76EE\u6807\u7CFB\u7EDF\u7684 Rust target\u3001SDK \u548C\u6253\u5305\u5DE5\u5177\u3002\u6D4B\u8BD5\u4EA7\u751F\u7684\u4E34\u65F6\u5DE5\u7A0B\u3001\u622A\u56FE\u3001\u62A5\u544A\u3001\u5BB9\u5668\u3001\u955C\u50CF\u4E0E\u8FDB\u7A0B\u5E94\u5728 finally/teardown \u4E2D\u81EA\u52A8\u6E05\u7406\uFF0C\u5931\u8D25\u4E5F\u6267\u884C\u3002
 
-### \u6D4B\u8BD5\u955C\u50CF
+## \u6784\u5EFA\u4E0E\u90E8\u7F72
 
 \`\`\`bash
-curl --fail http://127.0.0.1:3000/health
-curl --fail http://127.0.0.1:3000/ready
-${webTestCommands}docker stop ${containerNames}
+# \u9ED8\u8BA4\u53EA\u7F16\u8BD1\u6E90\u7801\uFF1B\u4E0D\u9009\u62E9\u90E8\u7F72\u73AF\u5883
+${pm} build
+# \u6784\u5EFA\u5E76\u5BFC\u51FA API/Web \u955C\u50CF\uFF0Cauto \u4F18\u5148 Podman\u3001\u5176\u6B21 Docker
+${pm} build --target docker
+# \u9009\u62E9\u73AF\u5883\u3001\u4E2D\u95F4\u4EF6\u5E76\u4E0A\u4F20\u4E00\u4E2A Compose tar\uFF1B\u4E0D\u4F1A\u91CD\u65B0\u6784\u5EFA
+${pm} exec hai deploy packages/${name}-serv --env test
+# \u65E0\u6CD5\u8FDE\u63A5\u670D\u52A1\u5668\u65F6\u53EA\u751F\u6210\u5305\uFF0C\u6309\u8F93\u51FA\u8BF4\u660E\u624B\u5DE5\u642C\u8FD0\u548C\u542F\u52A8
+${pm} exec hai deploy packages/${name}-serv --env prod --bundle-only
 \`\`\`
 
-- \u914D\u7F6E\u9ED8\u8BA4\u6765\u81EA \`packages/${name}-serv/config\`\uFF0C\u4E5F\u53EF\u6302\u8F7D\u5230 \`/app/config\`\uFF1BYAML \u4E2D\u7684 \`\${ENV_NAME:default}\` \u53EF\u7531 \`--env-file\` \u6216 \`-e\` \u6CE8\u5165\u3002
-- \u5E26\u6570\u636E\u6784\u5EFA\u4F1A\u628A \`packages/${name}-serv/data\` \u56FA\u5316\u4E3A\u955C\u50CF\u521D\u59CB\u6570\u636E\uFF1B\u6301\u4E45\u5316\u5199\u5165\u4ECD\u5E94\u4F7F\u7528 volume\u3002
-- Service \u7531 \`@h-ai/serv\` \u76F4\u63A5\u5BF9\u5916\u76D1\u542C\uFF0C\u4E0D\u989D\u5916\u542F\u52A8 Web \u8F6C\u53D1\u5C42\u3002
-${frontends.includes("web") ? `- Web \u4F7F\u7528\u72EC\u7ACB\u9759\u6001\u955C\u50CF\u5E76\u652F\u6301\u4E00\u6B21\u6784\u5EFA\u3001\u591A\u73AF\u5883\u90E8\u7F72\uFF1B\u6784\u5EFA\u53EA\u9700\u8FD0\u884C \`${pm} docker:build:web\`\uFF0C\u542F\u52A8\u5BB9\u5668\u65F6\u901A\u8FC7 \`-e PUBLIC_API_BASE=https://api.example.com\` \u6307\u5411 Service \u5BF9\u5916\u5730\u5740\u3002\u672A\u8BBE\u7F6E\u65F6\u9ED8\u8BA4\u4F7F\u7528 Web \u9875\u9762\u81EA\u8EAB origin\u3002` : ""}
-
-\u4EE5\u4E0A\u4E09\u4E2A Service \u8FD0\u884C\u65F6\u53C2\u6570\u5747\u53EF\u6309\u9700\u5220\u9664\uFF1A
-
-| \u53C2\u6570 | \u7528\u9014 | \u53EF\u9009\u6027 |
-| --- | --- | --- |
-| \`--env-file .env\` | \u6279\u91CF\u4F20\u5165\u73AF\u5883\u53D8\u91CF\uFF1B\u4E5F\u53EF\u6539\u7528\u591A\u4E2A \`-e NAME=value\`\u3002 | \u53EF\u9009\uFF1B\u5220\u9664\u540E\u4F7F\u7528\u955C\u50CF\u548C YAML \u9ED8\u8BA4\u503C\u3002 |
-| \`--mount type=bind,...target=/app/config,readonly\` | \u7528\u5BBF\u4E3B\u673A\u914D\u7F6E\u76EE\u5F55\u8986\u76D6\u955C\u50CF\u5185 \`/app/config\`\uFF1B\u5FC5\u987B\u628A \`source\` \u6539\u6210\u771F\u5B9E\u7EDD\u5BF9\u8DEF\u5F84\uFF0C\`readonly\` \u9632\u6B62\u5BB9\u5668\u4FEE\u6539\u914D\u7F6E\u3002 | \u53EF\u9009\uFF1B\u5220\u9664\u540E\u4F7F\u7528\u955C\u50CF\u81EA\u5E26\u914D\u7F6E\u3002 |
-| \`--mount type=volume,...target=/app/data\` | \u521B\u5EFA\u6216\u590D\u7528 named volume\uFF0C\u6301\u4E45\u5316 SQLite \u548C\u672C\u5730\u5B58\u50A8\u3002 | \u53EF\u9009\u4F46\u751F\u4EA7\u73AF\u5883\u5EFA\u8BAE\u4FDD\u7559\uFF1B\u5220\u9664\u540E\u6570\u636E\u53EA\u5199\u5165\u5BB9\u5668\u5C42\uFF0C\u4F7F\u7528 \`--rm\` \u5220\u9664\u5BB9\u5668\u65F6\u4F1A\u4E22\u5931\u3002 |
-
-\u524D\u7AEF\u5355\u72EC\u4EA4\u4ED8\u547D\u4EE4\uFF1A
-
-- Web\uFF1A\`${pm} --filter ${name}-web build\` / \`${pm} --filter ${name}-web package\`
-- App\uFF1A\`${pm} --filter ${name}-app package\`\uFF0CAndroid/iOS \u53EF\u7528 \`cap:build:android:debug\` / \`cap:build:android:release\` / \`cap:build:ios\`
-- Desktop\uFF1A\`${pm} --filter ${name}-desktop tauri:dev\` / \`${pm} --filter ${name}-desktop package\`
+\u955C\u50CF\u6784\u5EFA\u914D\u7F6E\u89C1 \`hai.build.json\`\u3002\u6784\u5EFA\u4EA7\u7269\u4FDD\u5B58\u5728 \`.hai/build/docker/<buildId>\`\uFF0C\u53EF\u7528 \`--artifact-dir\` \u9009\u62E9\u540C\u4E00\u4EFD\u4EA7\u7269\u90E8\u7F72\u5230 test/prod\u3002\u90E8\u7F72\u5305\u542B\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u80FD\u63D0\u4EA4 Git\u3002\u73AF\u5883\u5DF2\u914D\u7F6E\u5B8C\u5907\u53EF\u52A0 \`--skip-middleware\`\u3002\u670D\u52A1\u8FD0\u884C\u6570\u636E\u7531 volume \u6301\u4E45\u5316\uFF0C\u955C\u50CF\u4E0D\u6253\u5305\u672C\u673A data\u3002API/Web \u8054\u5408\u90E8\u7F72\u516C\u5F00 Web \u5165\u53E3\u5E76\u4EE3\u7406\u540C\u6E90 API\uFF1B\u6CA1\u6709 Web \u4EA7\u7269\u65F6\u53EA\u90E8\u7F72\u670D\u52A1\u3002
 
 ## i18n \u4E0E shared \u534F\u540C
 
@@ -2118,7 +2089,7 @@ async function addModule(options) {
       core.logger.info(`\u53EF\u7528\u6A21\u5757: ${Object.keys(MODULE_MAP).join(", ")}`);
       return;
     }
-    const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-EZFW7D43.js');
+    const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-TSYEQTCY.js');
     if (moduleDef.packages.every((p) => project.haiPackages.includes(p))) {
       const generatedFiles2 = await generateProjectAiSupport(
         cwd,
@@ -2224,21 +2195,510 @@ async function addModule(options) {
     throw error;
   }
 }
+async function run(command, args, cwd, quiet = false) {
+  await new Promise((resolve3, reject) => {
+    const env = Object.fromEntries(Object.entries(process4.env).filter(([key]) => !/^(?:HAI_|PUBLIC_|VITE_)/.test(key)));
+    env.NODE_ENV = "production";
+    if (env.CI === "1" || env.CI === "0")
+      env.CI = env.CI === "1" ? "true" : "false";
+    const child = spawn(command, args, { cwd, env, windowsHide: true, stdio: quiet ? "ignore" : "inherit", shell: false });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? resolve3() : reject(new Error(cliM("cli_build_failed", { params: { command, code: String(code) } }))));
+  });
+}
+async function pnpm(args, cwd) {
+  const entry = process4.env.npm_execpath;
+  if (entry && /(?:^|[/\\])pnpm(?:-native)?(?:\.exe|\.[cm]?js)?$/i.test(entry))
+    return /\.[cm]?js$/i.test(entry) ? run(process4.execPath, [entry, ...args], cwd) : run(entry, args, cwd);
+  if (process4.platform === "win32") {
+    const directories = (process4.env.PATH ?? "").split(";");
+    for (const directory of directories) {
+      const executable = join(directory, "pnpm.exe");
+      if (existsSync(executable))
+        return run(executable, args, cwd);
+      for (const relative of ["node_modules/pnpm/bin/pnpm.cjs", "pnpm.cjs"]) {
+        const candidate = join(directory, relative);
+        if (existsSync(candidate))
+          return run(process4.execPath, [candidate, ...args], cwd);
+      }
+    }
+    throw new Error(cliM("cli_build_use_pnpm"));
+  }
+  return run("pnpm", args, cwd);
+}
+async function buildCommand(options) {
+  const cwd = resolve(options.cwd ?? process4.cwd());
+  const target = options.target ?? "compile";
+  if (!["compile", "docker", "desktop"].includes(target))
+    throw new Error(cliM("cli_build_target_invalid"));
+  if (target !== "docker" && (options.runtime !== void 0 || options.network !== void 0 || options.sqlitePrebuildMirror !== void 0 || options.httpProxy === false) || target !== "desktop" && (options.platform !== void 0 || options.arch !== void 0)) {
+    throw new Error(cliM("cli_build_options_invalid"));
+  }
+  if (target === "compile") {
+    await pnpm(["run", "compile"], cwd);
+    return;
+  }
+  const metadata = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+  const appVersion = metadata.version;
+  if (typeof appVersion !== "string" || appVersion.length > 80 || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i.test(appVersion))
+    throw new Error(cliM("cli_build_version_invalid"));
+  const config = JSON.parse(readFileSync(join(cwd, "hai.build.json"), "utf8"));
+  if (target === "desktop") {
+    const platforms = { win32: "windows", linux: "linux", darwin: "macos" };
+    const host = platforms[process4.platform];
+    const platform = options.platform ?? host;
+    const arch = options.arch ?? process4.arch;
+    if (!platform || platform !== host || !["x64", "arm64"].includes(arch))
+      throw new Error(cliM("cli_build_native_host"));
+    if (!config.desktop?.length)
+      throw new Error(cliM("cli_build_desktop_missing"));
+    const rustTarget = `${arch === "x64" ? "x86_64" : "aarch64"}-${platform === "windows" ? "pc-windows-msvc" : platform === "macos" ? "apple-darwin" : "unknown-linux-gnu"}`;
+    const bundles = platform === "windows" ? "nsis" : platform === "macos" ? "app,dmg" : "deb,appimage";
+    for (const directory of config.desktop)
+      await pnpm(["exec", "tauri", "build", "--target", rustTarget, "--bundles", bundles, "--config", JSON.stringify({ version: appVersion })], resolve(cwd, directory));
+    core.logger.info(cliM("cli_build_native_ready", { params: { target: rustTarget } }));
+    return;
+  }
+  if (!Array.isArray(config.images) || !config.images.length || config.images.filter((image) => image.name === "app").length !== 1 || config.images.length > 2 || new Set(config.images.map((image) => image.name)).size !== config.images.length || config.images.some((image) => !["app", "web"].includes(image.name) || image.containerPort !== void 0 && (!Number.isInteger(image.containerPort) || image.containerPort < 1 || image.containerPort > 65535))) {
+    throw new Error(cliM("cli_build_images_missing"));
+  }
+  const candidates = options.runtime && options.runtime !== "auto" ? [options.runtime] : ["podman", "docker"];
+  if (candidates.some((runtime2) => !["podman", "docker"].includes(runtime2)))
+    throw new Error(cliM("cli_build_runtime_missing"));
+  let runtime;
+  for (const candidate of candidates) {
+    try {
+      await run(candidate, ["version"], cwd, true);
+      runtime = candidate;
+      break;
+    } catch {
+    }
+  }
+  if (!runtime)
+    throw new Error(cliM("cli_build_runtime_missing"));
+  if (options.sqlitePrebuildMirror) {
+    const url = new URL(options.sqlitePrebuildMirror);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+      throw new Error(cliM("cli_build_mirror_invalid"));
+  }
+  const buildId = `${appVersion}-${Date.now()}-${randomBytes(3).toString("hex")}`;
+  const artifact = { version: 2, appVersion, buildId, images: [] };
+  const parent = join(cwd, ".hai/build/docker");
+  mkdirSync(parent, { recursive: true });
+  const staging = mkdtempSync(join(parent, ".building-"));
+  const built = [];
+  try {
+    for (const image of config.images) {
+      if (!["app", "web"].includes(image.name))
+        throw new Error(cliM("cli_build_images_missing"));
+      const context = resolve(cwd, image.context ?? ".");
+      const imageRef = `localhost/hai-${basenameSafe(cwd)}-${image.name}:${buildId.toLowerCase().replaceAll("+", "_")}`;
+      const args = ["build", "-f", resolve(context, image.dockerfile ?? "Dockerfile"), "-t", imageRef];
+      if (options.network !== void 0)
+        args.push("--network", options.network);
+      const ignore = `${resolve(context, image.dockerfile ?? "Dockerfile")}.dockerignore`;
+      if (runtime === "podman" && existsSync(ignore))
+        args.push("--ignorefile", ignore);
+      if (runtime === "podman") {
+        args.push("--format", "docker", "--jobs", "1", ...options.httpProxy === false ? ["--http-proxy=false"] : []);
+        if (options.httpProxy !== false) {
+          for (const key of ["HTTP_PROXY", "HTTPS_PROXY", "FTP_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "ftp_proxy", "no_proxy"]) {
+            if (process4.env[key])
+              args.push("--build-arg", `${key}=${process4.env[key]}`);
+          }
+        }
+      }
+      if (image.target)
+        args.push("--target", image.target);
+      if (options.sqlitePrebuildMirror)
+        args.push("--build-arg", `SQLITE_PREBUILD_MIRROR=${options.sqlitePrebuildMirror}`);
+      built.push(imageRef);
+      await run(runtime, [...args, context], cwd);
+      const file = `${image.name}-${appVersion}.tar`;
+      await run(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", join(staging, file), imageRef], cwd);
+      const hash = createHash("sha256");
+      for await (const chunk of createReadStream(join(staging, file)))
+        hash.update(chunk);
+      artifact.images.push({ name: image.name, file, imageRef, sha256: hash.digest("hex"), ...image.containerPort ? { containerPort: image.containerPort } : {} });
+    }
+    const output = join(parent, buildId);
+    writeFileSync(join(staging, "manifest.json"), `${JSON.stringify(artifact, null, 2)}
+`);
+    renameSync(staging, output);
+    writeFileSync(join(parent, `latest-${buildId}`), `${buildId}
+`);
+    renameSync(join(parent, `latest-${buildId}`), join(parent, "latest"));
+    core.logger.info(cliM("cli_build_ready", { params: { path: output, runtime } }));
+  } catch (error) {
+    for (const imageRef of built) {
+      try {
+        await run(runtime, ["image", "rm", imageRef], cwd, true);
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+}
+function basenameSafe(directory) {
+  return directory.slice(dirname(directory).length + 1).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+/, "") || "app";
+}
+function displayDeployValue(name, value) {
+  if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
+    return cliM("cli_deploy_secret");
+  try {
+    const parsed2 = JSON.parse(value);
+    if (parsed2 && typeof parsed2 === "object") {
+      const sanitize = (object) => {
+        if (Array.isArray(object))
+          return object.map(sanitize);
+        if (object && typeof object === "object")
+          return Object.fromEntries(Object.entries(object).map(([key, item]) => [key, /PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(key.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(key) ? cliM("cli_deploy_secret") : typeof item === "string" ? displayDeployValue(key, item) : sanitize(item)]));
+        return object;
+      };
+      return JSON.stringify(sanitize(parsed2));
+    }
+  } catch {
+  }
+  try {
+    const url = new URL(value);
+    if (url.username || url.password) {
+      url.username = "***";
+      url.password = "***";
+    }
+    for (const key of url.searchParams.keys()) {
+      if (/password|secret|token|key|authorization/i.test(key))
+        url.searchParams.set(key, "***");
+    }
+    return url.toString();
+  } catch {
+    return value;
+  }
+}
+var CLOUD_FIELDS = {
+  "neon": ["apiKey"],
+  "upstash": ["email", "apiKey"],
+  "cloudflare-r2": ["accountId", "apiToken", "accessKeyId", "secretAccessKey"],
+  "resend": ["apiKey", "from"],
+  "aliyun": ["accessKeyId", "accessKeySecret", "signName"]
+};
+function targetConfig(requirement, environment) {
+  const result = {};
+  const parent = environment.targetValues[requirement.envPrefix];
+  if (parent) {
+    try {
+      Object.assign(result, JSON.parse(parent));
+    } catch {
+      return {};
+    }
+  }
+  for (const [key, value] of Object.entries(environment.targetValues)) {
+    if (key.startsWith(`${requirement.envPrefix}_`))
+      result[key.slice(requirement.envPrefix.length + 1).toLowerCase()] = value;
+  }
+  return result;
+}
+function canKeepMiddleware(requirement, backend, environment) {
+  const target = targetConfig(requirement, environment);
+  if (requirement.service === "ldap" && backend.backend === "disabled")
+    return environment.targetValues.HAI_IAM_LOGIN_LDAP === "false";
+  if (requirement.service === "ldap") {
+    if (!Object.keys(target).length)
+      return false;
+  } else if (target.type !== backend.backend) {
+    return false;
+  }
+  return backend.fields.filter((field) => field.required && !field.secret).every((field) => {
+    if ((target.url || requirement.config.url && Object.keys(target).length) && ["host", "port"].includes(field.name))
+      return true;
+    return target[field.name] !== void 0 && target[field.name] !== "" || target[field.name.toLowerCase()] !== void 0 && target[field.name.toLowerCase()] !== "";
+  }) && backend.fields.filter((field) => field.required && field.secret).every((field) => Boolean(requirement.config[field.name] || environment.values[`${requirement.envPrefix}_${field.name.toUpperCase()}`]));
+}
+async function ask(question) {
+  const answer = await prompts({ ...question, name: "value" });
+  if (answer.value === void 0)
+    throw new Error(cliM("cli_deploy_cancelled"));
+  return answer.value;
+}
+function validateField(value, field) {
+  if (value === "")
+    return field.required ? cliM("cli_deploy_required") : true;
+  if (field.kind === "port")
+    return /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 || cliM("cli_deploy_invalid_value");
+  if (field.kind === "number")
+    return /^\d+$/.test(value) && Number(value) >= (field.minimum ?? 0) && Number(value) <= (field.maximum ?? Number.MAX_SAFE_INTEGER) || cliM("cli_deploy_invalid_value");
+  if (field.kind === "boolean")
+    return ["true", "false"].includes(value) || cliM("cli_deploy_invalid_value");
+  if (field.kind === "url") {
+    try {
+      return Boolean(new URL(value).protocol);
+    } catch {
+      return cliM("cli_deploy_invalid_value");
+    }
+  }
+  if (field.name === "ssl") {
+    const parsed2 = parseDocument(value);
+    const ssl = parsed2.errors.length ? void 0 : parsed2.toJS();
+    return typeof ssl === "boolean" || ["require", "prefer", "allow", "disable"].includes(String(ssl)) || ssl !== null && typeof ssl === "object" && !Array.isArray(ssl) || cliM("cli_deploy_invalid_value");
+  }
+  if (field.name === "headers") {
+    try {
+      const headers = JSON.parse(value);
+      return headers !== null && typeof headers === "object" && !Array.isArray(headers) && Object.values(headers).every((item) => typeof item === "string") || cliM("cli_deploy_invalid_value");
+    } catch {
+      return cliM("cli_deploy_invalid_value");
+    }
+  }
+  if (field.name === "method")
+    return ["POST", "PUT"].includes(value) || cliM("cli_deploy_invalid_value");
+  return true;
+}
+function ensureConfigNode(appDir, requirement, backend) {
+  if (requirement.service === "ldap" && backend === "disabled")
+    return;
+  const directory = join(appDir, "config");
+  mkdirSync(directory, { recursive: true });
+  const path7 = join(directory, `_${requirement.configName}.yml`);
+  const document = parseDocument(existsSync(path7) ? readFileSync(path7, "utf8") : "{}\n");
+  if (document.errors.length)
+    throw new Error(cliM("cli_deploy_invalid_value"));
+  if (requirement.configPath.length && !document.hasIn(requirement.configPath))
+    document.setIn(requirement.configPath, requirement.configName === "reach" ? { name: requirement.config.name ?? requirement.service, type: backend } : {});
+  if (requirement.service === "ldap") {
+    if (!document.hasIn(["login"]))
+      document.setIn(["login"], {});
+    if (!document.hasIn(["login", "ldap"]))
+      document.setIn(["login", "ldap"], `\${HAI_IAM_LOGIN_LDAP:false}`);
+  }
+  const content = document.toString();
+  if (!existsSync(path7) || readFileSync(path7, "utf8") !== content)
+    writeFileSync(path7, content);
+}
+function connectionEnv(requirement, backend, config) {
+  if (requirement.service === "ldap")
+    return backend === "disabled" ? { HAI_IAM_LOGIN_LDAP: "false" } : { HAI_IAM_LOGIN_LDAP: "true", [requirement.envPrefix]: JSON.stringify(config) };
+  return { [requirement.envPrefix]: JSON.stringify({ ...config, type: backend }) };
+}
+async function configureDeployMiddleware(module, scan, environment, config, yes = false) {
+  const modes = {};
+  const services = {};
+  const existingServices = config.services && typeof config.services === "object" ? config.services : {};
+  const provider = config.provider;
+  for (const requirement of scan.middlewares ?? []) {
+    const choices = module.DEPLOY_MIDDLEWARE[requirement.service];
+    const current = choices.find((item) => item.backend === requirement.backend);
+    if (!current)
+      throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: requirement.backend } }));
+    core.logger.info(cliM("cli_deploy_middleware", { params: { service: requirement.service, backend: current.label, purpose: module.describeMiddlewareBackend(current), source: requirement.source } }));
+    const canKeep = canKeepMiddleware(requirement, current, environment);
+    const mode = yes ? canKeep ? "keep" : "default" : await ask({
+      type: "select",
+      name: "value",
+      message: cliM("cli_deploy_action", { params: { service: requirement.service } }),
+      choices: [
+        { title: cliM("cli_deploy_default"), value: "default" },
+        { title: cliM("cli_deploy_custom"), value: "custom" },
+        ...canKeep ? [{ title: cliM("cli_deploy_keep"), value: "keep" }] : []
+      ]
+    });
+    modes[requirement.envPrefix] = mode;
+    const previous = modes[requirement.service];
+    modes[requirement.service] = previous === "default" || mode === "default" ? "default" : previous === "custom" || mode === "custom" ? "custom" : "keep";
+    if (mode === "keep") {
+      if (!canKeep)
+        throw new Error(cliM("cli_deploy_missing_keep", { params: { service: requirement.service } }));
+      continue;
+    }
+    const backendName = yes ? current.backend : String(await ask({ type: "select", name: "value", message: cliM("cli_deploy_backend", { params: { service: requirement.service } }), initial: choices.indexOf(current), choices: choices.map((item) => ({ title: `${item.label} \u2014 ${module.describeMiddlewareBackend(item)}`, value: item.backend })) }));
+    const backend = choices.find((item) => item.backend === backendName);
+    if (!backend)
+      throw new Error(cliM("cli_deploy_invalid_value"));
+    requirement.backend = backendName;
+    const updates = {};
+    if (mode === "default" && backendName === "s3" && provider?.type === "docker-ssh") {
+      const container = config.container && typeof config.container === "object" ? config.container : {};
+      const currentEngine = container.s3Engine === "minio" ? "minio" : "rustfs";
+      const engine = yes ? currentEngine : String(await ask({ type: "select", name: "value", message: cliM("cli_deploy_s3_engine"), initial: currentEngine === "rustfs" ? 0 : 1, choices: [{ title: "RustFS", value: "rustfs" }, { title: "MinIO", value: "minio" }] }));
+      if (!["rustfs", "minio"].includes(engine))
+        throw new Error(cliM("cli_deploy_invalid_value"));
+      config.container = { ...container, s3Engine: engine };
+      updates.HAI_DEPLOY_CONTAINER_S3ENGINE = engine;
+      const deploymentFile = join(scan.appDir ?? ".", "config", "_deploy.yml");
+      const deployment = parseDocument(readFileSync(deploymentFile, "utf8"));
+      if (deployment.errors.length)
+        throw new Error(cliM("cli_deploy_invalid_value"));
+      if (!deployment.hasIn(["container", "s3Engine"])) {
+        if (!deployment.hasIn(["container"]))
+          deployment.setIn(["container"], {});
+        deployment.setIn(["container", "s3Engine"], `\${HAI_DEPLOY_CONTAINER_S3ENGINE:rustfs}`);
+        writeFileSync(deploymentFile, deployment.toString());
+      }
+    }
+    if (mode === "default" && provider?.type === "vercel") {
+      if (!backend.provisioner)
+        throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: backend.label } }));
+      const prior = existingServices[requirement.service];
+      const priorConfig = prior && typeof prior === "object" ? prior : {};
+      const cloud = { provisioner: backend.provisioner };
+      for (const name of CLOUD_FIELDS[backend.provisioner]) {
+        const key = `HAI_DEPLOY_SERVICES_${requirement.service.toUpperCase()}_${name.toUpperCase()}`;
+        const initial = String(priorConfig[name] ?? environment.values[key] ?? "");
+        const value = yes ? initial : String(await ask({ type: /key|token|secret/i.test(name) ? "password" : "text", name: "value", message: key, initial, validate: (input) => Boolean(input) || cliM("cli_deploy_required") }));
+        if (!value)
+          throw new Error(`${key}: ${cliM("cli_deploy_required")}`);
+        cloud[name] = value;
+        updates[key] = value;
+      }
+      services[requirement.service] = cloud;
+    } else {
+      if (mode === "default" && (requirement.service === "sms" || backendName === "api"))
+        throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: backend.label } }));
+      const connection = mode === "custom" && backendName === current.backend ? { ...requirement.config } : requirement.configName === "reach" ? { name: requirement.config.name ?? requirement.service } : {};
+      for (const field of backend.fields) {
+        const previous2 = backendName === current.backend ? requirement.config[field.name] : void 0;
+        const initial = previous2 === void 0 ? field.defaultValue ?? "" : typeof previous2 === "object" ? JSON.stringify(previous2) : String(previous2);
+        const variable = `${requirement.envPrefix}_${field.name.toUpperCase()}`;
+        const info = moduleEnvironmentVariables(requirement.configName).find((item) => item.name === variable);
+        const value = mode === "custom" && !yes ? String(await ask({ type: field.secret ? "password" : "text", name: "value", message: cliM("cli_deploy_field", { params: { name: variable, description: info?.description ?? field.name, constraint: info?.constraint ?? field.kind ?? "string" } }), initial, validate: (input) => validateField(String(input), field) })) : initial;
+        if (value !== "") {
+          connection[field.name] = field.kind === "number" || field.kind === "port" ? Number(value) : field.kind === "boolean" ? value === "true" : field.name === "headers" || field.name === "ssl" ? parseDocument(value).toJS() : value;
+        } else {
+          delete connection[field.name];
+        }
+      }
+      Object.assign(updates, connectionEnv(requirement, backendName, connection));
+    }
+    ensureConfigNode(scan.appDir ?? ".", requirement, backendName);
+    const saved = module.saveDeploymentEnvironment(environment, updates);
+    if (!saved.success)
+      throw new Error(saved.error.message);
+    for (const [name, value] of Object.entries(updates)) {
+      core.logger.info(cliM("cli_deploy_saved", { params: { name, value: displayDeployValue(name, value) } }));
+    }
+  }
+  config.services = Object.keys(services).length ? services : void 0;
+  return modes;
+}
+
+// src/commands/cli-deploy.ts
+function configObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+async function configureDeployTarget(module, config, environment, nonInteractive, bundleOnly) {
+  if (bundleOnly) {
+    const existing = configObject(config.provider);
+    if (existing.type && existing.type !== "docker-ssh")
+      throw new Error(cliM("cli_deploy_bundle_provider"));
+    config.provider = { type: "docker-ssh", remote: { runtime: "auto" }, expose: { hostPort: 3e3 }, ...existing };
+  }
+  const current = module.ProviderConfigSchema.safeParse(config.provider);
+  if (current.success && (bundleOnly || current.data.type !== "docker-ssh" || current.data.ssh)) {
+    config.provider = current.data;
+    core.logger.info(cliM("cli_deploy_target_reused", { params: { target: current.data.type === "docker-ssh" ? current.data.ssh ? `${current.data.ssh.username}@${current.data.ssh.host}:${current.data.ssh.port}` : cliM("cli_deploy_bundle_local") : "Vercel" } }));
+    return;
+  }
+  if (nonInteractive)
+    throw new Error(cliM("cli_deploy_target_missing", { params: { fields: current.success ? "provider.ssh" : current.error.issues.map((issue) => `provider.${issue.path.join(".")}`).join(", ") } }));
+  const original = configObject(config.provider);
+  const platform = await prompts({
+    type: "select",
+    name: "value",
+    message: cliM("cli_deploy_target_platform"),
+    choices: [{ title: cliM("cli_deploy_target_ssh"), value: "docker-ssh" }, { title: "Vercel", value: "vercel" }],
+    initial: original.type === "vercel" ? 1 : 0
+  });
+  if (!platform.value)
+    throw new Error(cliM("cli_deploy_cancelled"));
+  const input = async (name, initial, options = {}) => {
+    const answer = await prompts({
+      type: options.secret ? "password" : "text",
+      name: "value",
+      message: cliM("cli_deploy_target_field", { params: { name } }),
+      initial: options.secret ? void 0 : initial === void 0 ? "" : String(initial),
+      validate: (value) => options.port ? /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 || cliM("cli_deploy_invalid_value") : options.optional || !!value.trim() || cliM("cli_deploy_invalid_value")
+    });
+    if (answer.value === void 0)
+      throw new Error(cliM("cli_deploy_cancelled"));
+    return String(answer.value).trim();
+  };
+  let provider;
+  if (platform.value === "docker-ssh") {
+    core.logger.info(cliM("cli_deploy_target_ssh_hint"));
+    const ssh = configObject(original.ssh);
+    const remote = configObject(original.remote);
+    const expose = configObject(original.expose);
+    const host = await input("HAI_DEPLOY_PROVIDER_SSH_HOST", ssh.host);
+    const port = Number(await input("HAI_DEPLOY_PROVIDER_SSH_PORT", ssh.port ?? 22, { port: true }));
+    const username = await input("HAI_DEPLOY_PROVIDER_SSH_USERNAME", ssh.username);
+    const identityFile = await input("HAI_DEPLOY_PROVIDER_SSH_IDENTITYFILE", ssh.identityFile, { optional: true });
+    const knownHostsFile = await input("HAI_DEPLOY_PROVIDER_SSH_KNOWNHOSTSFILE", ssh.knownHostsFile, { optional: true });
+    const baseDir = await input("HAI_DEPLOY_PROVIDER_REMOTE_BASEDIR", remote.baseDir || "/opt/hai/apps");
+    const runtime = await prompts({ type: "select", name: "value", message: cliM("cli_deploy_target_runtime"), choices: ["auto", "podman", "docker"].map((value) => ({ title: value, value })), initial: ["auto", "podman", "docker"].indexOf(String(remote.runtime ?? "auto")) });
+    if (!runtime.value)
+      throw new Error(cliM("cli_deploy_cancelled"));
+    const hostPort = Number(await input("HAI_DEPLOY_PROVIDER_EXPOSE_HOSTPORT", expose.hostPort || 3e3, { port: true }));
+    const containerPort = Number(await input("HAI_DEPLOY_PROVIDER_EXPOSE_CONTAINERPORT", expose.containerPort || 3e3, { port: true }));
+    provider = {
+      type: "docker-ssh",
+      ssh: { ...ssh, host, port, username, identityFile: identityFile || void 0, knownHostsFile: knownHostsFile || void 0 },
+      remote: { ...remote, baseDir, runtime: runtime.value },
+      expose: { type: "port", hostPort, containerPort }
+    };
+  } else {
+    provider = { type: "vercel", token: await input("HAI_DEPLOY_PROVIDER_TOKEN", void 0, { secret: true }) };
+  }
+  const validated = module.ProviderConfigSchema.safeParse(provider);
+  if (!validated.success)
+    throw new Error(cliM("cli_deploy_invalid_value"));
+  const saved = module.saveDeploymentEnvironment(environment, { HAI_DEPLOY_PROVIDER: JSON.stringify(validated.data) }, { private: true });
+  if (!saved.success)
+    throw new Error(saved.error.message);
+  config.provider = validated.data;
+  core.logger.info(cliM("cli_deploy_target_saved"));
+}
 async function deployCommand(options) {
   const spinner = ora();
   const cwd = options.cwd ?? process4.cwd();
-  const appDir = resolve(cwd, options.appDir ?? ".");
+  let appDir = resolve(cwd, options.appDir ?? ".");
   let closeDeploy = null;
+  const originalEnv = { ...process4.env };
   try {
+    let environmentName = options.env;
+    if (!environmentName) {
+      if (!process4.stdin.isTTY)
+        throw new Error(cliM("cli_deploy_environment_hint"));
+      const answer = await prompts({ type: "text", name: "environment", message: cliM("cli_deploy_environment"), initial: "prod" });
+      environmentName = answer.environment;
+      if (!environmentName)
+        throw new Error(cliM("cli_deploy_cancelled"));
+    }
+    if (!options.yes && !process4.stdin.isTTY)
+      throw new Error(cliM("cli_deploy_environment_hint"));
     let deployModule;
     try {
-      deployModule = await import('./src-DUGLX4YB.js');
+      const localRequire = createRequire(resolve(appDir, "package.json"));
+      let localModule;
+      try {
+        localModule = localRequire.resolve("@h-ai/deploy");
+      } catch {
+      }
+      deployModule = localModule ? await import(pathToFileURL(localModule).href) : await import('./src-RDQ2EIBT.js');
     } catch {
       core.logger.error(chalk.red(cliM("cli_deploy_module_missing")));
       core.logger.info(chalk.cyan("  pnpm add @h-ai/deploy"));
       throw new Error(cliM("cli_deploy_module_missing"));
     }
     const { deploy } = deployModule;
+    const scanResult = await deploy.scan(appDir, { environment: environmentName, envDir: options.envDir ? resolve(cwd, options.envDir) : void 0 });
+    if (!scanResult.success)
+      throw new Error(cliM("cli_deploy_scan_failed", { params: { message: scanResult.error.message } }));
+    const scan = scanResult.data;
+    appDir = scan.appDir ?? appDir;
+    const environment = deployModule.loadDeploymentEnvironment({ environment: environmentName, envDir: scan.envDir ?? appDir });
+    if (!environment.success)
+      throw new Error(environment.error.message);
+    Object.assign(process4.env, environment.data.values);
     spinner.start(cliM("cli_deploy_load_credentials"));
     const credResult = deploy.credentials.load();
     if (!credResult.success) {
@@ -2252,19 +2712,44 @@ async function deployCommand(options) {
       core.logger.info(chalk.cyan(cliM("cli_deploy_config_hint")));
       throw new Error(cliM("cli_deploy_config_missing", { params: { path: configPath } }));
     }
-    const configContent = readFileSync(configPath, "utf-8");
-    const rawConfig = interpolateEnvFallback(configContent);
-    const deployConfig = parse(rawConfig);
+    const loadedConfig = deployModule.loadDeploymentConfig("deploy", configPath, process4.env);
+    if (!loadedConfig.success)
+      throw new Error(loadedConfig.error.message);
+    const deployConfig = loadedConfig.data;
     spinner.succeed(cliM("cli_deploy_config_loaded"));
-    spinner.start(cliM("cli_deploy_scanning"));
-    const scanResult = await deploy.scan(appDir);
-    if (!scanResult.success) {
-      throw new Error(cliM("cli_deploy_scan_failed", { params: { message: scanResult.error.message } }));
-    }
-    const scan = scanResult.data;
+    await configureDeployTarget(deployModule, deployConfig, environment.data, options.yes, options.bundleOnly);
     spinner.succeed(cliM("cli_deploy_scanned", { params: { name: scan.appName, sveltekit: String(scan.isSvelteKit), services: scan.requiredServices.join(", ") || cliM("cli_deploy_none") } }));
+    let skipMiddleware = options.skipMiddleware;
+    if (!skipMiddleware && !options.yes && scan.requiredServices.length) {
+      const action = await prompts({
+        type: "select",
+        name: "value",
+        message: cliM("cli_deploy_middleware_plan"),
+        choices: [{ title: cliM("cli_deploy_middleware_configure"), value: "configure" }, { title: cliM("cli_deploy_middleware_skip"), value: "skip" }]
+      });
+      if (!action.value)
+        throw new Error(cliM("cli_deploy_cancelled"));
+      skipMiddleware = action.value === "skip";
+    }
+    if (skipMiddleware)
+      core.logger.info(cliM("cli_deploy_middleware_skipped"));
+    const serviceModes = skipMiddleware ? Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) : await configureDeployMiddleware(deployModule, scan, environment.data, deployConfig, options.yes);
+    if (skipMiddleware)
+      deployConfig.services = void 0;
+    for (const key of Object.keys(process4.env)) {
+      if (originalEnv[key] === void 0)
+        delete process4.env[key];
+    }
+    Object.assign(process4.env, originalEnv);
+    const refreshed = deployModule.loadDeploymentEnvironment({ environment: environment.data.environment, envDir: environment.data.envDir });
+    if (!refreshed.success)
+      throw new Error(refreshed.error.message);
+    Object.assign(process4.env, refreshed.data.values);
     spinner.start(cliM("cli_deploy_initializing"));
-    const initResult = await deploy.init(deployConfig);
+    const validatedConfig = deployModule.DeployConfigSchema.safeParse(deployConfig);
+    if (!validatedConfig.success)
+      throw new Error(cliM("cli_deploy_init_failed", { params: { message: cliM("cli_deploy_invalid_value") } }));
+    const initResult = await deploy.init(validatedConfig.data);
     if (!initResult.success) {
       throw new Error(cliM("cli_deploy_init_failed", { params: { message: initResult.error.message } }));
     }
@@ -2273,8 +2758,13 @@ async function deployCommand(options) {
     spinner.start(cliM("cli_deploy_deploying"));
     const deployResult = await deploy.deployApp(appDir, {
       projectName: options.projectName,
-      skipProvision: options.skipProvision,
-      skipBuild: options.skipBuild
+      skipMiddleware,
+      artifactDir: options.artifactDir ? resolve(cwd, options.artifactDir) : void 0,
+      bundleOnly: options.bundleOnly,
+      output: options.output ? resolve(cwd, options.output) : void 0,
+      environment: environment.data.environment,
+      envDir: environment.data.envDir,
+      serviceModes
     });
     if (!deployResult.success) {
       if (deployResult.error.ext?.recovery) {
@@ -2284,9 +2774,29 @@ async function deployCommand(options) {
       }
       throw new Error(cliM("cli_deploy_failed", { params: { message: deployResult.error.message } }));
     }
-    spinner.succeed(chalk.green(cliM("cli_deploy_success")));
+    spinner.succeed(chalk.green(cliM(deployResult.data.status === "packaged" ? "cli_deploy_bundle_ready" : "cli_deploy_success")));
+    for (const key of Object.keys(process4.env)) {
+      if (originalEnv[key] === void 0)
+        delete process4.env[key];
+    }
+    Object.assign(process4.env, originalEnv);
+    const completedEnvironment = deployModule.loadDeploymentEnvironment({ environment: environment.data.environment, envDir: environment.data.envDir });
+    if (!completedEnvironment.success)
+      throw new Error(completedEnvironment.error.message);
+    for (const requirement of scan.middlewares ?? []) {
+      if ((serviceModes[requirement.envPrefix] ?? serviceModes[requirement.service]) === "keep")
+        continue;
+      const value = completedEnvironment.data.values[requirement.envPrefix];
+      if (value !== void 0)
+        core.logger.info(cliM("cli_deploy_saved", { params: { name: requirement.envPrefix, value: displayDeployValue(requirement.envPrefix, value) } }));
+    }
     core.logger.info("");
-    core.logger.info(chalk.cyan(cliM("cli_deploy_url", { params: { url: deployResult.data.url } })));
+    if (deployResult.data.bundlePath)
+      core.logger.info(cliM("cli_deploy_bundle_path", { params: { path: deployResult.data.bundlePath } }));
+    if (deployResult.data.status === "packaged")
+      core.logger.info(deployResult.data.instructions ?? "");
+    else
+      core.logger.info(chalk.cyan(cliM("cli_deploy_url", { params: { url: deployResult.data.url } })));
     core.logger.info(chalk.gray(cliM("cli_deploy_id", { params: { id: deployResult.data.deploymentId } })));
     if (deployResult.data.envVarsSet.length > 0) {
       core.logger.info(chalk.gray(cliM("cli_deploy_env", { params: { names: deployResult.data.envVarsSet.join(", ") } })));
@@ -2305,13 +2815,13 @@ async function deployCommand(options) {
         process4.exitCode = 1;
       }
     }
+    for (const key of Object.keys(process4.env)) {
+      if (originalEnv[key] === void 0)
+        delete process4.env[key];
+    }
+    Object.assign(process4.env, originalEnv);
   }
 }
-function interpolateEnvFallback(content) {
-  return content.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, key, defaultValue) => {
-    return process4.env[key] ?? defaultValue ?? "";
-  });
-}
 var GENERATORS = {
   page: {
     description: "SvelteKit \u9875\u9762",
@@ -2653,7 +3163,7 @@ async function initProject(options) {
     const { project, existing, missing } = result;
     spinner.succeed(`\u68C0\u6D4B\u5230\u9879\u76EE: ${chalk.cyan(project.name)}`);
     if (project.isHaiProject) {
-      const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-EZFW7D43.js');
+      const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-TSYEQTCY.js');
       const generatedFiles = await generateProjectAiSupport(cwd, resolveSkillNamesForPackages(project.haiPackages), {
         overwriteSkills: false,
         overwriteBridgeFiles: false
@@ -2797,13 +3307,26 @@ cli.command("generate [type] [name]", "\u751F\u6210\u4EE3\u7801").alias("g").opt
     process4.exit(1);
   }
 });
-cli.command("deploy [appDir]", "\u90E8\u7F72\u5E94\u7528\u5230\u4E91\u5E73\u53F0").option("--project-name <name>", "\u9879\u76EE\u540D\u79F0\uFF08\u9ED8\u8BA4\u4ECE package.json \u8BFB\u53D6\uFF09").option("--skip-provision", "\u8DF3\u8FC7\u57FA\u7840\u8BBE\u65BD\u5F00\u901A").option("--skip-build", "\u8DF3\u8FC7\u6784\u5EFA").action(async (appDir, options) => {
+cli.command("build", "\u6784\u5EFA\u6E90\u7801\u3001Docker \u955C\u50CF\u6216 Tauri \u5B89\u88C5\u5305\uFF08\u4E0D\u533A\u5206\u90E8\u7F72\u73AF\u5883\uFF09").option("--target <target>", "\u4EA7\u7269\u7C7B\u578B\uFF1Acompile\uFF08\u9ED8\u8BA4\uFF09/ docker / desktop").option("--runtime <runtime>", "\u672C\u5730\u5BB9\u5668\u5F15\u64CE\uFF1Aauto\uFF08\u4F18\u5148 Podman\uFF09/ podman / docker").option("--network <network>", "\u5BB9\u5668\u6784\u5EFA\u7F51\u7EDC\uFF08\u9ED8\u8BA4\u5F15\u64CE\u8BBE\u7F6E\uFF09\uFF0C\u4F8B\u5982 rootless Podman \u7684 pasta").option("--platform <platform>", "Tauri \u76EE\u6807\u7CFB\u7EDF\uFF1Awindows / linux / macos\uFF08\u5728\u5BF9\u5E94\u7CFB\u7EDF\u6784\u5EFA\uFF09").option("--arch <arch>", "Tauri \u76EE\u6807\u67B6\u6784\uFF1Ax64 / arm64").option("--sqlite-prebuild-mirror <url>", "SQLite \u9884\u7F16\u8BD1\u4E8C\u8FDB\u5236\u955C\u50CF\u6839\u5730\u5740").option("--no-http-proxy", "Podman \u6784\u5EFA\u4E0D\u7EE7\u627F\u672C\u673A\u4EE3\u7406").action(async (options) => {
+  try {
+    await buildCommand(options);
+  } catch (error) {
+    writeCliMessage(error instanceof Error ? error.message : String(error));
+    process4.exitCode = 1;
+  }
+});
+cli.command("deploy [appDir]", "\u90E8\u7F72\u5E94\u7528\u5230\u4E91\u5E73\u53F0").option("--env <environment>", "\u90E8\u7F72\u73AF\u5883\uFF08test / prod \u7B49\uFF0C\u5FC5\u987B\u5B58\u5728\u5BF9\u5E94\u73AF\u5883\u6587\u4EF6\uFF09").option("--env-dir <path>", "\u73AF\u5883\u6587\u4EF6\u6240\u5728\u76EE\u5F55\uFF08\u9ED8\u8BA4\u81EA\u52A8\u67E5\u627E\uFF09").option("-y, --yes", "\u6309\u5F53\u524D\u540E\u7AEF\u9ED8\u8BA4\u914D\u7F6E\u90E8\u7F72\uFF0C\u76EE\u6807\u73AF\u5883\u5DF2\u6709\u5B8C\u6574\u914D\u7F6E\u65F6\u4FDD\u6301\u4E0D\u53D8").option("--project-name <name>", "\u9879\u76EE\u540D\u79F0\uFF08\u9ED8\u8BA4\u670D\u52A1\u5305\u540D\uFF0C\u7F3A\u5931\u65F6\u4E3A\u76EE\u5F55\u540D\uFF1B\u9644\u52A0\u73AF\u5883\u540E\u7F00\uFF09").option("--skip-middleware", "\u914D\u7F6E\u5DF2\u5B8C\u5907\uFF0C\u8DF3\u8FC7\u5168\u90E8\u4E2D\u95F4\u4EF6\u5904\u7406\uFF0C\u76F4\u63A5\u90E8\u7F72").option("--artifact-dir <path>", "\u5DF2\u6709\u955C\u50CF\u6784\u5EFA\u4EA7\u7269\u76EE\u5F55\uFF08\u542B manifest.json\uFF09").option("--bundle-only", "\u53EA\u751F\u6210 Compose \u90E8\u7F72 tar\uFF0C\u624B\u5DE5\u642C\u8FD0\uFF1B\u4E0D\u8FDE\u63A5 SSH").option("--output <path>", "\u90E8\u7F72 tar \u8F93\u51FA\u8DEF\u5F84\uFF0C\u81EA\u52A8\u8865\u5E94\u7528\u7248\u672C\u540E\u7F00").action(async (appDir, options) => {
   try {
     await deployCommand({
       appDir,
+      env: options.env,
+      envDir: options.envDir,
+      yes: options.yes,
       projectName: options.projectName,
-      skipProvision: options.skipProvision,
-      skipBuild: options.skipBuild,
+      skipMiddleware: options.skipMiddleware,
+      artifactDir: options.artifactDir,
+      bundleOnly: options.bundleOnly,
+      output: options.output,
       verbose: options.verbose,
       cwd: options.cwd
     });
@@ -2823,7 +3346,7 @@ cli.command("g:api <name>", "\u751F\u6210 API").action(async (name, options) =>
 cli.command("g:model <name>", "\u751F\u6210\u6570\u636E\u6A21\u578B").action(async (name, options) => {
   await generate({ type: "model", name, cwd: options.cwd });
 });
-cli.version(VERSION);
+cli.version(VERSION, "-V, --version");
 cli.help();
 var parsed = cli.parse();
 if (!cli.matchedCommand && !parsed.options.help && !parsed.options.version) {