@h-ai/cli 0.1.0-alpha.65 → 0.1.0-alpha.67

package/dist/{src-6PPBKQ6Q.js → src-2V6VP4I5.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { __export } from './chunk-2H7UOFLK.js';
-import { core, ok, err } from '@h-ai/core';
-import { readFileSync, existsSync, writeFileSync, chmodSync, mkdirSync, statSync, readdirSync } from 'fs';
+import { createHash, randomBytes } from 'crypto';
+import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, renameSync, rmSync, statSync, readdirSync } from 'fs';
 import { resolve, join, basename, dirname, relative, sep } from 'path';
+import { core, err, ok } from '@h-ai/core';
 import process2 from 'process';
 import { parseEnv } from 'util';
-import { parse as parse$1, stringify, parseAllDocuments } from 'yaml';
+import { LineCounter, parseDocument, parse as parse$1, stringify, parseAllDocuments } from 'yaml';
 import { homedir } from 'os';
-import { execSync, spawn } from 'child_process';
-import { randomBytes, createHash } from 'crypto';
+import { spawn } from 'child_process';
 import { Buffer } from 'buffer';
 
 // ../../node_modules/zod/v4/classic/external.js
@@ -1398,10 +1398,10 @@ function defineLazyInternal(inst, key, compute) {
           Object.defineProperty(this, key, { configurable: true, writable: true, value });
         broke = broke || outer;
         return value;
-      } catch (err17) {
+      } catch (err15) {
         delete this[key];
         broke = broke || outer;
-        throw err17;
+        throw err15;
       }
     },
     set(value) {
@@ -5037,7 +5037,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve3) {
+function isRecursive(inst, stack, resolve6) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5047,7 +5047,7 @@ function isRecursive(inst, stack, resolve3) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve3);
+      const answer = isRecursive(child, stack, resolve6);
       if (answer > result)
         result = answer;
     }
@@ -5058,7 +5058,7 @@ function isRecursive(inst, stack, resolve3) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (!desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve6) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5122,7 +5122,7 @@ function isRecursive(inst, stack, resolve3) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -12940,9 +12940,9 @@ function compile(schema, options) {
     const clone2 = withParser(schema, parser);
     clone2._zod.bag.validator = compileValidator(schema, parser);
     return clone2;
-  } catch (err17) {
+  } catch (err15) {
     if (options?.strict)
-      throw err17;
+      throw err15;
     return schema;
   }
 }
@@ -13032,8 +13032,8 @@ ${code}
   try {
     const factory = new F(...constantNames, factoryCode);
     fn = factory(...constantValues);
-  } catch (err17) {
-    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err17.message})`);
+  } catch (err15) {
+    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err15.message})`);
   }
   if (options?.debug) {
     fn.code = fullCode;
@@ -13071,9 +13071,9 @@ function compileChild(doc, ctx, schema, accessor, needsValue = true) {
   const varCounter = ctx.varCounter;
   try {
     return generateCheck(doc, ctx, schema, accessor, needsValue);
-  } catch (err17) {
-    if (!(err17 instanceof ZodCompileUnsupportedError) || !err17.islandable)
-      throw err17;
+  } catch (err15) {
+    if (!(err15 instanceof ZodCompileUnsupportedError) || !err15.islandable)
+      throw err15;
     doc.content.length = contentLen;
     if (ctx.constants.size > constantCount) {
       const trailing = Array.from(ctx.constants.keys()).slice(constantCount);
@@ -19668,6 +19668,52 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// ../deploy/src/deploy-artifact.ts
+var DeploymentArtifactSchema = external_exports.object({
+  /** 清单格式版本，与应用版本和部署环境无关。 */
+  version: external_exports.literal(3),
+  /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
+  appVersion: external_exports.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
+  /** 本次构建标识；同一应用版本允许重复构建。 */
+  buildId: external_exports.string().regex(/^[a-z0-9][\w.+-]*$/i),
+  /** 只包含所选镜像的构建不能用于首次安装。 */
+  partial: external_exports.boolean().default(false),
+  /** API 单独构建时仍保留工程的 Web 拓扑。 */
+  hasWeb: external_exports.boolean().default(false),
+  /** 工程显式配置的应用端口，部分构建未包含 app 镜像时仍保留；缺省由部署配置决定。 */
+  appContainerPort: external_exports.number().int().min(1).max(65535).optional(),
+  /** 工程显式配置的 Web 端口，部分构建未包含 web 镜像时仍保留；缺省使用部署默认值。 */
+  webContainerPort: external_exports.number().int().min(1).max(65535).optional(),
+  /** 本次构建选择的镜像归档。 */
+  images: external_exports.array(external_exports.object({
+    /** app 为服务或独立应用，web 为同源 API 代理的静态前端。 */
+    name: external_exports.enum(["app", "web"]),
+    /** 相对于清单目录的 tar 文件名。 */
+    file: external_exports.string().regex(/^[\w.+-]+\.tar$/),
+    /** 归档导入后可直接使用的不可变镜像引用。 */
+    imageRef: external_exports.string().regex(/^[a-z0-9][a-z0-9./:_-]*:[a-z0-9_][a-z0-9_.-]*$/).refine((value) => !value.endsWith(":latest")),
+    /** tar 内容的 SHA-256，用于部署前校验。 */
+    sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+    /** 容器内部监听端口；服务器公开端口由部署选择。 */
+    containerPort: external_exports.number().int().min(1).max(65535).optional()
+  })).min(1).max(2).refine((images) => new Set(images.map((image) => image.name)).size === images.length)
+}).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`)).refine((artifact) => artifact.partial || artifact.images.some((image) => image.name === "app")).refine((artifact) => artifact.partial || !artifact.hasWeb || artifact.images.some((image) => image.name === "web"));
+async function artifactChecksum(file2) {
+  const hash2 = createHash("sha256");
+  for await (const chunk of createReadStream(file2))
+    hash2.update(chunk);
+  return hash2.digest("hex");
+}
+async function readDeploymentArtifact(directory) {
+  const artifact = DeploymentArtifactSchema.parse(JSON.parse(readFileSync(resolve(directory, "manifest.json"), "utf8")));
+  for (const image of artifact.images) {
+    const file2 = resolve(directory, image.file);
+    if (!existsSync(file2) || !lstatSync(file2).isFile() || lstatSync(file2).isSymbolicLink() || await artifactChecksum(file2) !== image.sha256)
+      throw new Error(`Invalid artifact: ${image.file}`);
+  }
+  return artifact;
+}
+
 // ../deploy/messages/en-US.json
 var en_US_default = {
   deploy_notInitialized: "Deploy module not initialized, call deploy.init() first",
@@ -19678,7 +19724,6 @@ var en_US_default = {
   deploy_authRequired: "Authentication required",
   deploy_authFailed: "Authentication failed: {error}",
   deploy_projectCreateFailed: "Project creation failed: {error}",
-  deploy_buildFailed: "Application build failed: {error}",
   deploy_uploadFailed: "Build output upload failed: {error}",
   deploy_deployFailed: "Deployment failed: {error}",
   deploy_provisionFailed: "Service provisioning failed: {service} - {error}",
@@ -19698,8 +19743,6 @@ var en_US_default = {
   deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use.",
   deploy_commandTimeout: "Command timed out: {command}",
   deploy_commandFailed: "Command failed ({command}): {error}",
-  deploy_containerRuntimeNotFound: "No usable container runtime found: {runtime}",
-  deploy_containerBuildFailed: "Container image build failed: {error}",
   deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
   deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
   deploy_imageTransferFailed: "Image transfer failed: {error}",
@@ -19720,7 +19763,23 @@ var en_US_default = {
   deploy_purposeLdap: "Directory account authentication; the default directory has no business users",
   deploy_purposeConsole: "Messages go to application logs without delivery",
   deploy_purposeEmail: "Email/HTTP delivery; the default SMTP container only captures test messages",
-  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota"
+  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota",
+  deploy_webProxyInvalid: "The API prefix must be an absolute path containing only letters, numbers, underscores, hyphens and slashes.",
+  deploy_artifactInvalid: "Image artifacts are missing or invalid. Run pnpm build --target docker, select valid --artifact-dir, or use pnpm run deploy --build.",
+  deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
+  deploy_bundleInstructions: "Bundle: {file}\nIncludes all images needed by selected services, including self-hosted middleware.\nWith SSH access, run deploy.ps1 (Windows) or deploy.sh (Linux/macOS) from the adjacent deployment directory.\nFor isolated servers, copy and extract the tar into a separate directory, then run sh apply.sh /opt/hai/apps/project-environment.\nLinux requires Docker/Podman, Compose, sh, tar, sha256sum, awk, curl and filesystem/container permissions.\nPartial updates require a successful full installation with matching ports/layout. Steps return nonzero on failure; result-DEPLOYMENT_ID.json records the outcome.\nThe bundle contains private runtime configuration; transfer it securely.\nIncluded images:\n{images}",
+  deploy_bundleMetadata: "Application version: {version}\nBuild ID: {buildId}\nCompose file: {compose}",
+  deploy_bundleOnlyContainer: "Compose bundle generation is supported only by docker-ssh.",
+  deploy_selectedContainerOnly: "Selected-service deployment requires a docker-ssh Compose destination.",
+  deploy_selectionInvalid: "Cannot deploy {service}: check the service name and build its image first.",
+  deploy_imageVersionRequired: "Specify an image version; latest is not allowed: {image}",
+  deploy_bundleRuntimeRequired: "Start local Podman/Docker to export middleware images, or prepare this complete offline bundle on the build machine.",
+  deploy_bundleFailed: "Package preparation or deployment failed: {reason}",
+  deploy_configFileInvalid: "Invalid YAML in {path}, line {line}. Check indentation, colons and quotes.",
+  deploy_configFileUnreadable: "Cannot read configuration file {path}. Check its path and permissions.",
+  deploy_bundleNameInvalid: "Bundle filenames may contain letters, numbers, dots, plus signs, hyphens and underscores; parent directories may contain spaces.",
+  deploy_secretsInvalid: "Middleware credentials are damaged or incomplete: {path}. Restore a backup; passwords are not regenerated because existing data may become inaccessible.",
+  deploy_storageArtifactRequired: "Storage initialization requires the application image. Select a complete artifact containing app with --artifact-dir, or run pnpm build --target docker --images app first."
 };
 
 // ../deploy/messages/zh-CN.json
@@ -19733,7 +19792,6 @@ var zh_CN_default2 = {
   deploy_authRequired: "\u8BF7\u5148\u5B8C\u6210\u8BA4\u8BC1",
   deploy_authFailed: "\u8BA4\u8BC1\u5931\u8D25\uFF1A{error}",
   deploy_projectCreateFailed: "\u9879\u76EE\u521B\u5EFA\u5931\u8D25\uFF1A{error}",
-  deploy_buildFailed: "\u5E94\u7528\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
   deploy_uploadFailed: "\u6784\u5EFA\u4EA7\u7269\u4E0A\u4F20\u5931\u8D25\uFF1A{error}",
   deploy_deployFailed: "\u90E8\u7F72\u5931\u8D25\uFF1A{error}",
   deploy_provisionFailed: "\u57FA\u7840\u8BBE\u65BD\u5F00\u901A\u5931\u8D25\uFF1A{service} - {error}",
@@ -19753,8 +19811,6 @@ var zh_CN_default2 = {
   deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002",
   deploy_commandTimeout: "\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF1A{command}",
   deploy_commandFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF08{command}\uFF09\uFF1A{error}",
-  deploy_containerRuntimeNotFound: "\u672A\u627E\u5230\u53EF\u7528\u7684\u5BB9\u5668\u8FD0\u884C\u65F6\uFF1A{runtime}",
-  deploy_containerBuildFailed: "\u5BB9\u5668\u955C\u50CF\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
   deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
   deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
   deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
@@ -19775,7 +19831,23 @@ var zh_CN_default2 = {
   deploy_purposeLdap: "\u4F01\u4E1A\u76EE\u5F55\u8D26\u53F7\u8BA4\u8BC1\uFF1B\u9ED8\u8BA4\u76EE\u5F55\u4E0D\u5305\u542B\u4E1A\u52A1\u7528\u6237",
   deploy_purposeConsole: "\u6D88\u606F\u8F93\u51FA\u5230\u5E94\u7528\u65E5\u5FD7\uFF0C\u4E0D\u5B9E\u9645\u6295\u9012",
   deploy_purposeEmail: "\u90AE\u4EF6\u6216 HTTP \u901A\u77E5\u6295\u9012\uFF1B\u9ED8\u8BA4 SMTP \u5BB9\u5668\u4EC5\u7528\u4E8E\u6D4B\u8BD5\u63A5\u6536",
-  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6"
+  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6",
+  deploy_webProxyInvalid: "API \u524D\u7F00\u5FC5\u987B\u662F\u4EC5\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u8FDE\u5B57\u7B26\u548C\u659C\u6760\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002",
+  deploy_artifactInvalid: "\u955C\u50CF\u4EA7\u7269\u7F3A\u5931\u6216\u6821\u9A8C\u5931\u8D25\u3002\u8BF7\u5148\u6267\u884C pnpm build --target docker\uFF0C\u6216\u7528 --artifact-dir \u6307\u5B9A\u6709\u6548\u4EA7\u7269\uFF1B\u4E5F\u53EF\u7528 pnpm run deploy --build \u4E00\u6B21\u5B8C\u6210\u3002",
+  deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
+  deploy_bundleInstructions: "\u90E8\u7F72\u5305\uFF1A{file}\n\u5305\u4E2D\u5DF2\u5305\u542B\u672C\u6B21\u9009\u62E9\u670D\u52A1\u9700\u8981\u7684\u955C\u50CF\uFF0C\u5305\u62EC\u81EA\u5EFA\u4E2D\u95F4\u4EF6\u3002\n\u6709 SSH \u8FDE\u63A5\u65F6\uFF0C\u5728\u65C1\u8FB9\u7684\u90E8\u7F72\u76EE\u5F55\u8FD0\u884C deploy.ps1\uFF08Windows\uFF09\u6216 deploy.sh\uFF08Linux/macOS\uFF09\u3002\n\u5B8C\u5168\u9694\u79BB\u65F6\uFF0C\u590D\u5236 tar \u5230 Linux \u670D\u52A1\u5668\uFF0C\u5728\u72EC\u7ACB\u76EE\u5F55\u89E3\u5305\uFF0C\u518D\u6267\u884C sh apply.sh /opt/hai/apps/\u9879\u76EE\u73AF\u5883\u3002\n\u670D\u52A1\u5668\u9700\u8981 Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk \u548C curl\uFF0C\u4EE5\u53CA\u76EE\u5F55\u3001\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002\n\u90E8\u5206\u66F4\u65B0\u8981\u6C42\u670D\u52A1\u5668\u5DF2\u6709\u6210\u529F\u7684\u5B8C\u6574\u90E8\u7F72\uFF0C\u7AEF\u53E3\u53CA\u5E94\u7528\u5E03\u5C40\u4FDD\u6301\u4E00\u81F4\u3002\u6BCF\u6B65\u5931\u8D25\u4F1A\u8FD4\u56DE\u975E\u96F6\u9000\u51FA\u7801\uFF1B\u7ED3\u679C\u8BB0\u5F55\u5728\u90E8\u7F72\u76EE\u5F55 result-\u90E8\u7F72ID.json\u3002\n\u5305\u5305\u542B\u79C1\u6709\u8FD0\u884C\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u4F20\u8F93\u3002\n\u6240\u542B\u955C\u50CF\uFF1A\n{images}",
+  deploy_bundleMetadata: "\u5E94\u7528\u7248\u672C\uFF1A{version}\n\u6784\u5EFA\u7F16\u53F7\uFF1A{buildId}\nCompose \u6587\u4EF6\uFF1A{compose}",
+  deploy_bundleOnlyContainer: "\u4EC5\u751F\u6210 Compose tar \u53EA\u652F\u6301 docker-ssh\u3002",
+  deploy_selectedContainerOnly: "\u6309\u670D\u52A1\u5C40\u90E8\u90E8\u7F72\u4EC5\u9002\u7528\u4E8E docker-ssh Compose \u76EE\u6807\u3002",
+  deploy_selectionInvalid: "\u65E0\u6CD5\u90E8\u7F72\u670D\u52A1 {service}\uFF1A\u8BF7\u68C0\u67E5\u670D\u52A1\u540D\u79F0\uFF0C\u5E76\u5148\u6784\u5EFA\u5BF9\u5E94\u955C\u50CF\u3002",
+  deploy_storageArtifactRequired: "\u5B58\u50A8\u521D\u59CB\u5316\u9700\u8981\u5E94\u7528\u955C\u50CF\u3002\u8BF7\u7528 --artifact-dir \u9009\u62E9\u542B app \u955C\u50CF\u7684\u5B8C\u6574\u5236\u54C1\uFF0C\u6216\u5148\u6267\u884C pnpm build --target docker --images app\u3002",
+  deploy_imageVersionRequired: "\u955C\u50CF\u5FC5\u987B\u6307\u5B9A\u7248\u672C\uFF0C\u4E0D\u80FD\u4F7F\u7528 latest\uFF1A{image}",
+  deploy_bundleRuntimeRequired: "\u5B8C\u6574\u79BB\u7EBF\u5305\u9700\u8981\u5BFC\u51FA\u4E2D\u95F4\u4EF6\u955C\u50CF\u3002\u8BF7\u542F\u52A8\u672C\u5730 Podman/Docker\uFF0C\u6216\u5728\u6784\u5EFA\u673A\u6253\u5305\u3002",
+  deploy_bundleFailed: "\u4EA4\u4ED8\u51C6\u5907\u6216\u90E8\u7F72\u5931\u8D25\uFF1A{reason}",
+  deploy_configFileInvalid: "\u914D\u7F6E\u6587\u4EF6 {path} \u7B2C {line} \u884C\u683C\u5F0F\u6709\u8BEF\u3002\u8BF7\u68C0\u67E5\u7F29\u8FDB\u3001\u5192\u53F7\u548C\u5F15\u53F7\u540E\u91CD\u8BD5\u3002",
+  deploy_configFileUnreadable: "\u65E0\u6CD5\u8BFB\u53D6\u914D\u7F6E\u6587\u4EF6 {path}\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u8DEF\u5F84\u4E0E\u8BFB\u53D6\u6743\u9650\u3002",
+  deploy_bundleNameInvalid: "\u90E8\u7F72\u5305\u6587\u4EF6\u540D\u53EA\u652F\u6301\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u70B9\u3001\u52A0\u53F7\u3001\u77ED\u6A2A\u7EBF\u548C\u4E0B\u5212\u7EBF\uFF1B\u6240\u5728\u76EE\u5F55\u53EF\u4EE5\u5305\u542B\u7A7A\u683C\u3002",
+  deploy_secretsInvalid: "\u4E2D\u95F4\u4EF6\u51ED\u636E\u6587\u4EF6\u635F\u574F\u6216\u7F3A\u5C11\u5B57\u6BB5\uFF1A{path}\u3002\u8BF7\u4ECE\u5907\u4EFD\u6062\u590D\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u66F4\u6362\u5BC6\u7801\uFF0C\u4EE5\u514D\u5DF2\u6709\u6570\u636E\u65E0\u6CD5\u8BBF\u95EE\u3002"
 };
 
 // ../deploy/src/deploy-i18n.ts
@@ -19791,11 +19863,11 @@ var VercelProviderConfigSchema = external_exports.object({
 });
 var SshConfigSchema = external_exports.object({
   /** 远程主机地址或 ~/.ssh/config 中的 Host 别名 */
-  host: external_exports.string().min(1),
+  host: external_exports.string().regex(/^[a-z0-9][a-z0-9.:-]*$/i),
   /** SSH 端口 */
   port: external_exports.number().int().min(1).max(65535).default(22),
   /** SSH 用户名 */
-  username: external_exports.string().min(1),
+  username: external_exports.string().regex(/^[a-z_][\w-]*$/i),
   /** 私钥文件路径（省略时使用 ssh-agent 或 ~/.ssh 默认密钥） */
   identityFile: external_exports.string().min(1).optional(),
   /** known_hosts 文件路径（省略时使用默认；配合 CI/临时环境隔离主机指纹） */
@@ -19816,11 +19888,11 @@ var ExposeSchema = PortExposeSchema;
 var DockerSshProviderConfigSchema = external_exports.object({
   type: external_exports.literal("docker-ssh"),
   /** SSH 连接参数 */
-  ssh: SshConfigSchema,
+  ssh: SshConfigSchema.optional(),
   /** 远程主机运行参数 */
   remote: external_exports.object({
     /** 远程应用根目录 */
-    baseDir: external_exports.string().min(1).default("/opt/hai/apps"),
+    baseDir: external_exports.string().regex(/^\/[\w/. -]+$/).refine((value) => !value.split("/").includes("..")).default("/opt/hai/apps"),
     /** 远程容器运行时（auto 优先 podman） */
     runtime: external_exports.enum(["auto", "docker", "podman"]).default("auto")
   }).default({ baseDir: "/opt/hai/apps", runtime: "auto" }),
@@ -19870,24 +19942,15 @@ var DeployConfigSchema = external_exports.object({
   environment: external_exports.string().regex(/^[a-z0-9][\w-]*$/i).refine((value) => !["local", "example"].includes(value.toLowerCase())).optional(),
   provider: ProviderConfigSchema,
   services: ServicesConfigSchema,
-  /** 本地容器构建参数（docker-ssh 使用；auto 优先 podman） */
+  /** Docker Compose 部署参数；构建配置位于项目 hai.build.json。 */
   container: external_exports.object({
-    runtime: external_exports.enum(["auto", "docker", "podman"]).default("auto"),
-    /** Podman 构建是否继承代理；容器不能访问宿主机 localhost 代理时设为 false。 */
-    httpProxy: external_exports.boolean().default(true),
     /** 自建 S3 服务实现；协议仍为 storage.type=s3。 */
-    s3Engine: external_exports.enum(["rustfs", "minio"]).default("rustfs"),
-    /** SQLite 预编译包镜像根地址；省略时从官方 GitHub Release 下载，不允许嵌入凭据。 */
-    sqlitePrebuildMirror: external_exports.url().refine((value) => {
-      const url2 = new URL(value);
-      return ["http:", "https:"].includes(url2.protocol) && !url2.username && !url2.password && !url2.search && !url2.hash;
-    }).optional()
+    s3Engine: external_exports.enum(["rustfs", "minio"]).default("rustfs")
   }).optional()
 });
 var DeployErrorInfo = {
   DEPLOY_FAILED: "001:500",
   PROJECT_CREATE_FAILED: "002:500",
-  BUILD_FAILED: "003:500",
   UPLOAD_FAILED: "004:500",
   AUTH_REQUIRED: "005:401",
   AUTH_FAILED: "006:401",
@@ -19899,8 +19962,6 @@ var DeployErrorInfo = {
   UNSUPPORTED_TYPE: "012:400",
   CONFIG_ERROR: "013:500",
   CREDENTIAL_ERROR: "014:500",
-  CONTAINER_RUNTIME_NOT_FOUND: "015:500",
-  CONTAINER_BUILD_FAILED: "016:500",
   REMOTE_CONNECT_FAILED: "017:500",
   REMOTE_COMMAND_FAILED: "018:500",
   IMAGE_TRANSFER_FAILED: "019:500",
@@ -19909,9 +19970,16 @@ var DeployErrorInfo = {
 var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
 
 // ../deploy/src/deploy-environment.ts
+function environmentValue(value) {
+  try {
+    return parse$1(value) ?? value;
+  } catch {
+    return value;
+  }
+}
 function resolveConfig(value, prefix, env) {
   if (env[prefix] !== void 0)
-    return parse$1(env[prefix]) ?? env[prefix];
+    return environmentValue(env[prefix]);
   if (Array.isArray(value))
     return value.map((item, index) => resolveConfig(item, `${prefix}_${index}`, env));
   if (value && typeof value === "object")
@@ -19919,14 +19987,20 @@ function resolveConfig(value, prefix, env) {
   if (typeof value !== "string")
     return value;
   const resolved = value.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, name, fallback) => env[name] ?? fallback ?? "");
-  return /^\$\{[^}]+\}$/.test(value) ? parse$1(resolved) ?? resolved : resolved;
+  return /^\$\{[^}]+\}$/.test(value) ? environmentValue(resolved) : resolved;
 }
 function loadDeploymentConfig(name, path, values) {
   try {
-    const config2 = resolveConfig(parse$1(readFileSync(path, "utf8")), `HAI_${name.toUpperCase()}`, values);
+    const lineCounter = new LineCounter();
+    const document = parseDocument(readFileSync(path, "utf8"), { lineCounter, prettyErrors: false });
+    if (document.errors.length)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: String(lineCounter.linePos(document.errors[0].pos[0]).line) } }));
+    const config2 = resolveConfig(document.toJS(), `HAI_${name.toUpperCase()}`, values);
+    if (config2 !== null && (typeof config2 !== "object" || Array.isArray(config2)))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: "1" } }));
     return ok(config2 && typeof config2 === "object" && !Array.isArray(config2) ? config2 : {});
   } catch {
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileUnreadable", { params: { path } }));
   }
 }
 function loadDeploymentEnvironment(options) {
@@ -20187,39 +20261,25 @@ function saveCredentials(entries) {
     );
   }
 }
-var logger2 = core.logger.child({ module: "deploy", scope: "functions" });
+function resolveArtifactDirectory(appDir) {
+  let directory = resolve(appDir);
+  while (true) {
+    if (existsSync(join(directory, "hai.build.json")) || existsSync(join(directory, "pnpm-lock.yaml")))
+      return join(directory, ".hai/build/docker");
+    const parent = dirname(directory);
+    if (parent === directory)
+      return join(appDir, ".hai/build/docker");
+    directory = parent;
+  }
+}
 function usesDefaultMiddleware(scan, service, options) {
   const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
   return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
 }
-function buildApp(appDir, buildCommand, envVars = {}) {
-  logger2.info("Building application", { appDir, buildCommand });
-  try {
-    execSync(buildCommand, {
-      cwd: appDir,
-      stdio: "inherit",
-      env: { ...process2.env, ...envVars }
-    });
-    return ok(void 0);
-  } catch (error62) {
-    return err(
-      HaiDeployError.BUILD_FAILED,
-      deployM("deploy_buildFailed", {
-        params: { error: error62 instanceof Error ? error62.message : String(error62) }
-      }),
-      error62
-    );
-  }
-}
 function resolveOutputDir(appDir, providerType) {
   switch (providerType) {
-    case "vercel": {
-      const vercelOutput = join(appDir, ".vercel", "output");
-      if (existsSync(vercelOutput)) {
-        return vercelOutput;
-      }
-      return join(appDir, "build");
-    }
+    case "vercel":
+      return join(appDir, ".vercel", "output");
     default:
       return join(appDir, "build");
   }
@@ -20250,7 +20310,7 @@ function recoveryFailure(error62, recovery) {
     ext: { recovery }
   });
 }
-var logger3 = core.logger.child({ module: "deploy", scope: "scanner" });
+var logger2 = core.logger.child({ module: "deploy", scope: "scanner" });
 function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -20369,26 +20429,522 @@ async function scanApp(inputDir, options) {
       adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
       nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
       requiredServices: [...new Set(middlewares.map((item) => item.service))],
-      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend])),
-      buildCommand: "pnpm build"
+      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend]))
     };
-    logger3.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
+    logger2.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
     return ok(scan);
   } catch {
     return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
   }
 }
+var logger3 = core.logger.child({ module: "deploy", scope: "command" });
+function maskSecrets(text, secrets) {
+  if (!secrets || secrets.length === 0)
+    return text;
+  let masked = text;
+  for (const secret of secrets) {
+    if (secret && secret.length > 0)
+      masked = masked.split(secret).join("***");
+  }
+  return masked;
+}
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve6) => {
+    const child = spawn(command, args, {
+      windowsHide: true,
+      cwd: options.cwd,
+      env: options.env ? { ...process2.env, ...options.env } : process2.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let timer;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve6(result);
+    };
+    if (options.timeoutMs && options.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        logger3.error("Command timed out", { command, timeoutMs: options.timeoutMs });
+        finish(err(
+          HaiDeployError.REMOTE_COMMAND_FAILED,
+          deployM("deploy_commandTimeout", { params: { command } })
+        ));
+      }, options.timeoutMs);
+    }
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+      options.onOutput?.(maskSecrets(chunk.toString("utf-8"), options.secrets));
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (error62) => {
+      logger3.error("Command failed to start", { command, error: maskSecrets(String(error62), options.secrets) });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(error62.message, options.secrets) }
+        }),
+        error62
+      ));
+    });
+    child.on("close", (code) => {
+      const exitCode = code ?? -1;
+      if (exitCode === 0) {
+        finish(ok({ code: exitCode, stdout, stderr }));
+        return;
+      }
+      logger3.error("Command exited with non-zero code", {
+        command,
+        code: exitCode,
+        stderr: maskSecrets(stderr, options.secrets).slice(-500),
+        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
+      });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
+        })
+      ));
+    });
+    if (options.input !== void 0) {
+      child.stdin.write(options.input);
+      child.stdin.end();
+    } else {
+      child.stdin.end();
+    }
+  });
+}
+
+// ../deploy/src/container/deploy-scripts.ts
+function shellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function createApplyScript(options) {
+  const values = {
+    ID: shellArgument(options.deploymentId),
+    PROJECT: shellArgument(`hai-${options.projectName}`),
+    ENV: shellArgument(options.environment),
+    RUNTIME: shellArgument(options.runtime),
+    PARTIAL: options.partial ? "true" : "false",
+    SELECTED: shellArgument(options.selected.join(" ")),
+    ROOT: shellArgument(options.directory),
+    PORT: String(options.hostPort),
+    HEALTH: options.healthPaths.map(shellArgument).join(" ")
+  };
+  return String.raw`#!/bin/sh
+set -eu
+umask 077
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+destination=@@ROOT@@
+if [ "$#" -gt 0 ]; then destination=$1; fi
+root=$(mkdir -p -- "$destination" && CDPATH= cd -- "$destination" && pwd)
+id=@@ID@@
+project=@@PROJECT@@
+export HAI_DEPLOY_ENVIRONMENT=@@ENV@@
+runtime=@@RUNTIME@@
+partial=@@PARTIAL@@
+orphan_option=''
+if [ "$partial" = false ]; then orphan_option=--remove-orphans; fi
+recreate_option=--force-recreate
+if [ "$partial" = true ]; then recreate_option=--no-recreate; fi
+selected=@@SELECTED@@
+release="$root/releases/$id"
+case "$release/" in "$source_dir/"*) printf 'Extract the package outside the deployment directory before applying it.\n' >&2; exit 1;; esac
+stage=''
+previous=''
+restore=''
+changed=false
+locked=false
+started=$(date +%s)
+step_started=$started
+step() {
+  if [ -n "$stage" ]; then
+    duration=$(( $(date +%s) - step_started ))
+    printf '[PASS] %s (%ss)\n' "$stage" "$duration"
+    printf '{"stage":"%s","status":"passed","durationSeconds":%s}\n' "$stage" "$duration" >> "$root/steps-$id.jsonl"
+  fi
+  stage="$1"
+  step_started=$(date +%s)
+  printf '\n[%s] %s\n' "$stage" "$2"
+}
+compose() {
+  arguments_file="$release/compose-files"
+  if [ -n "$restore" ]; then arguments_file="$root/releases/$restore/compose-files"; fi
+  # -f 按顺序合并，由 Compose 保留未选服务、卷和环境文件，不自行拼装配置。
+  command_args="$release/.compose-command"
+  # 文件列表先反向读取，再向参数头部加入，保留原始合并顺序。
+  awk '{lines[NR]=$0} END {for(i=NR;i>0;i--) print lines[i]}' "$arguments_file" > "$command_args"
+  while IFS= read -r file; do set -- -f "$file" "$@"; done < "$command_args"
+  "$runtime" compose -p "$project" "$@"
+}
+remove_selected() {
+  test "$partial" = true || return 0
+  # 直接替换选中容器，避免 Compose Provider 连带重建依赖它的未选服务；不删除卷。
+  for service in "$@"; do
+    containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service") || return 1
+    for container in $containers; do
+      "$runtime" rm -f "$container" || return 1
+    done
+  done
+}
+finish() {
+  code=$?
+  trap - EXIT HUP INT TERM
+  if [ "$code" -ne 0 ]; then
+    printf '[FAIL] %s (exit %s)\n' "$stage" "$code" >&2
+    if [ "$changed" = true ]; then
+      diagnostics="$root/diagnostics-$id.log"
+      : > "$diagnostics"
+      for service in $selected; do
+        containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service" || true)
+        for container in $containers; do
+          "$runtime" inspect --format '{{.Name}} {{.State.Status}} exit={{.State.ExitCode}}' "$container" >> "$diagnostics" 2>&1 || true
+          "$runtime" logs --tail 80 "$container" >> "$diagnostics" 2>&1 || true
+        done
+      done
+      printf 'Startup diagnostics saved to %s (private server file).\n' "$diagnostics" >&2
+    fi
+    if [ -f "$release/rollback-images" ]; then
+      while IFS=' ' read -r image reference; do
+        test -n "$reference" || continue
+        "$runtime" tag "$image" "$reference" || printf '[FAIL] Cannot restore image %s\n' "$reference" >&2
+      done < "$release/rollback-images"
+    fi
+    if [ "$changed" = true ] && [ -n "$previous" ]; then
+      printf '[RECOVER] Restoring previous selected services\n' >&2
+      recover_selected=$selected
+      if [ "$partial" = false ]; then recover_selected=$(grep -v -- '-init$' "$root/releases/$previous/services"); fi
+      restore="$previous"
+      if remove_selected $recover_selected && compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $recover_selected; then
+        case " $selected " in *' app '*)
+          if grep -qx web "$root/releases/$previous/services"; then compose exec -T web nginx -s reload || true; fi
+          ;;
+        esac
+        printf '[RECOVER] Previous containers restored; verify application health\n' >&2
+      else
+        printf '[FAIL] Recovery failed. Use the previous release and inspect container logs.\n' >&2
+      fi
+    elif [ "$changed" = true ]; then
+      compose stop $selected || true
+      printf '[RECOVER] Failed first installation stopped; data volumes retained\n' >&2
+    fi
+  fi
+  if [ "$locked" = true ]; then
+    elapsed=$(( $(date +%s) - started ))
+    outcome=passed
+    if [ "$code" -ne 0 ]; then outcome=failed; fi
+    printf '{"stage":"%s","status":"%s","durationSeconds":%s}\n' "$stage" "$outcome" "$(( $(date +%s) - step_started ))" >> "$root/steps-$id.jsonl"
+    printf '{"deploymentId":"%s","stage":"%s","exitCode":%s,"durationSeconds":%s}\n' "$id" "$stage" "$code" "$elapsed" > "$root/result-$id.json"
+    rmdir "$root/.deploy-lock" || true
+  fi
+  exit "$code"
+}
+trap finish EXIT
+trap 'exit 130' HUP INT TERM
+step preflight 'Checking deployment tools and package'
+for tool in sha256sum tar awk curl; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s\n' "$tool" >&2; exit 1; }; done
+if [ "$runtime" = auto ]; then
+  if command -v podman >/dev/null 2>&1 && podman version >/dev/null 2>&1; then runtime=podman; else runtime=docker; fi
+fi
+case "$runtime" in docker|podman) ;; *) printf 'Runtime must be docker or podman\n' >&2; exit 1;; esac
+"$runtime" version >/dev/null
+"$runtime" compose version >/dev/null
+"$runtime" compose up --help | grep -q never || { printf 'Compose is too old. Install Docker Compose v2 or podman-compose 1.6.0 or newer (supports --pull never).\n' >&2; exit 1; }
+mkdir "$root/.deploy-lock" 2>/dev/null || { printf 'Another deployment is running. Check %s/.deploy-lock before retrying.\n' "$root" >&2; exit 1; }
+locked=true
+cd "$source_dir"
+sha256sum -c SHA256SUMS
+if [ -f "$root/current" ]; then
+  previous=$(cat "$root/current")
+  case "$previous" in ''|*[!a-zA-Z0-9._-]*) printf 'Invalid deployment state\n' >&2; exit 1;; esac
+  test -f "$root/releases/$previous/compose-files"
+fi
+if [ "$partial" = true ]; then
+  test -n "$previous" || { printf 'Partial deployment requires a successful full installation. Deploy a complete bundle first.\n' >&2; exit 1; }
+  cmp -s layout "$root/releases/$previous/layout" || { printf 'Ports, API routes or application layout changed. Create a full deployment bundle.\n' >&2; exit 1; }
+fi
+test ! -e "$release" || { printf 'This deployment ID was already used. Create a new deployment bundle.\n' >&2; exit 1; }
+mkdir -p "$release"
+cp -R "$source_dir/." "$release/"
+# Nginx 以非 root 用户运行；只开放不含凭据的代理配置读取权限。
+if [ -f "$release/web.conf" ]; then chmod 644 "$release/web.conf"; fi
+: > "$release/compose-files"
+if [ "$partial" = true ]; then
+  cp "$root/releases/$previous/compose-files" "$release/compose-files"
+  cp "$root/releases/$previous/middleware.env" "$release/middleware.env"
+  for service in $selected; do
+    grep -qx "$service" "$root/releases/$previous/services" || { printf 'Service %s has no installed baseline. Use a full deployment.\n' "$service" >&2; exit 1; }
+  done
+fi
+printf '%s\n' "$release/compose-entry.json" >> "$release/compose-files"
+compose config >/dev/null
+compose config --services > "$release/services"
+: > "$release/rollback-images"
+if [ -n "$previous" ]; then
+  for service in $selected; do
+    containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service")
+    for container in $containers; do
+      "$runtime" inspect --format '{{.Image}} {{.Config.Image}}' "$container" >> "$release/rollback-images"
+    done
+  done
+fi
+step images 'Loading packaged images (no registry access)'
+while IFS=' ' read -r archive reference; do
+  test -n "$archive" || continue
+  "$runtime" load -i "$release/images/$archive"
+  "$runtime" image inspect "$reference" >/dev/null
+  architecture=$("$runtime" image inspect --format '{{.Architecture}}' "$reference")
+  host_arch=$(uname -m)
+  case "$host_arch:$architecture" in x86_64:amd64|aarch64:arm64) ;; *) printf 'Image architecture %s does not match server %s\n' "$architecture" "$host_arch" >&2; exit 1;; esac
+done < "$release/image-list"
+step dependencies 'Checking dependencies of selected services'
+if [ "$partial" = true ]; then cat "$release/services" >> "$release/dependencies"; fi
+while IFS= read -r dependency; do
+  test -n "$dependency" || continue
+  case "$dependency" in *-init) continue;; esac
+  case " $selected " in *" $dependency "*) continue;; esac
+  running=$("$runtime" ps -q --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$dependency")
+  test -n "$running" || { printf 'Dependency %s is not running. Include it in a full deployment.\n' "$dependency" >&2; exit 1; }
+  for container in $running; do
+    test "$("$runtime" inspect --format '{{.State.Running}}' "$container")" = true || { printf 'Dependency %s is stopped. Start it before retrying.\n' "$dependency" >&2; exit 1; }
+  done
+done < "$release/dependencies"
+step start 'Updating selected services'
+changed=true
+remove_selected $selected
+if [ -f "$release/initialize-storage" ]; then
+  remove_selected storage-init
+  compose up -d --no-deps --no-build --pull never storage
+  compose up --no-deps --no-build --pull never "$recreate_option" --exit-code-from storage-init storage-init
+fi
+compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $selected
+case " $selected " in
+  *' app '*)
+    case " $selected " in *' web '*) ;; *)
+      if grep -qx web "$release/services"; then compose exec -T web nginx -s reload; fi
+    esac
+    ;;
+esac
+step health 'Checking HTTP access'
+for path in @@HEALTH@@; do
+  ready=false
+  attempt=0
+  while [ "$attempt" -lt 40 ]; do
+    if curl --noproxy '*' -fsS --max-time 5 "http://127.0.0.1:@@PORT@@$path" >/dev/null 2>&1; then ready=true; break; fi
+    attempt=$((attempt + 1))
+    sleep 3
+  done
+  test "$ready" = true || { printf 'HTTP check failed: %s. Inspect compose logs for selected services.\n' "$path" >&2; exit 1; }
+done
+step complete 'Deployment passed all checks'
+printf '%s\n' "$id" > "$root/current.next"
+mv "$root/current.next" "$root/current"
+printf '[PASS] %s\n' "$id"
+`.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]);
+}
+function createUploadScripts(config2, bundle, projectName) {
+  const ssh = config2.ssh;
+  const host = ssh?.host ?? "SERVER_HOST";
+  const user = ssh?.username ?? "deploy";
+  const remote = `${config2.remote.baseDir}/${projectName}`;
+  const port = ssh?.port ?? 22;
+  const sh = String.raw`#!/bin/sh
+set -eu
+cd "$(dirname "$0")"
+host=@@HOST@@
+user=@@USER@@
+port=@@PORT@@
+remote=@@REMOTE@@
+bundle=@@BUNDLE@@
+if [ "$#" -ge 1 ]; then host=$1; fi
+if [ "$#" -ge 2 ]; then port=$2; fi
+if [ "$#" -ge 3 ]; then user=$3; fi
+identity=$(printenv HAI_DEPLOY_IDENTITY_FILE || true)
+if [ -z "$identity" ]; then identity=@@IDENTITY@@; fi
+test "$host" != SERVER_HOST || { printf 'Specify the server: sh deploy.sh SERVER [PORT] [USER].\n' >&2; exit 1; }
+for tool in ssh scp; do command -v "$tool" >/dev/null || { printf 'Install OpenSSH (%s).\n' "$tool" >&2; exit 1; }; done
+set -- -o BatchMode=yes -o StrictHostKeyChecking=@@STRICT@@ -o ConnectTimeout=10
+if [ -n "$identity" ]; then set -- "$@" -i "$identity"; fi
+known_hosts=@@KNOWN@@
+if value=$(printenv HAI_DEPLOY_KNOWN_HOSTS_FILE); then known_hosts=$value; fi
+if [ -n "$known_hosts" ]; then set -- "$@" -o "UserKnownHostsFile=$known_hosts"; fi
+printf '[1/3] Connecting to %s\n' "$host"
+ssh "$@" -p "$port" "$user@$host" "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"
+printf '[2/3] Uploading %s\n' "$bundle"
+scp_host=$host
+case "$host" in *:*) scp_host="[$host]";; esac
+scp "$@" -P "$port" "$bundle" "$user@$scp_host:$remote/incoming/$bundle"
+printf '[3/3] Applying package and checking HTTP access\n'
+ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"
+`;
+  const ps1 = String.raw`param([string]$IdentityFile = $env:HAI_DEPLOY_IDENTITY_FILE)
+$ErrorActionPreference = 'Stop'
+Set-Location -LiteralPath $PSScriptRoot
+$target = Get-Content -LiteralPath './deploy-target.json' -Raw | ConvertFrom-Json
+if ($target.host -eq 'SERVER_HOST') { throw 'Set the server host in deploy-target.json.' }
+if ($target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]+$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar$') { throw 'Invalid deployment target.' }
+$options = @('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new', '-o', 'ConnectTimeout=10')
+if ($target.strictHostKeyChecking -eq $false) { $options[3] = 'StrictHostKeyChecking=no' }
+if (-not $IdentityFile) { $IdentityFile = $target.identityFile }
+if ($IdentityFile) { $options += @('-i', $IdentityFile) }
+if ($target.knownHostsFile) { $options += @('-o', "UserKnownHostsFile=$($target.knownHostsFile)") }
+$destination = "$($target.username)@$($target.host)"
+$scpDestination = if ($target.host.Contains(':')) { "$($target.username)@[$($target.host)]" } else { $destination }
+$remote = $target.directory
+$bundle = $target.bundle
+function Invoke-Step([string]$Name, [string]$Command, [string[]]$Arguments) {
+  Write-Host "[$Name]"
+  & $Command @Arguments
+  if ($LASTEXITCODE -ne 0) { throw "$Name failed (exit $LASTEXITCODE)." }
+}
+try {
+  foreach ($tool in @('ssh', 'scp')) { Get-Command $tool -ErrorAction Stop | Out-Null }
+  Invoke-Step '1/3 Connect' 'ssh' ($options + @('-p', [string]$target.port, $destination, "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"))
+  Invoke-Step '2/3 Upload' 'scp' ($options + @('-P', [string]$target.port, $bundle, "$($scpDestination):$remote/incoming/$bundle"))
+  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$target.port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"))
+} catch { Write-Error $_; exit 1 }
+`;
+  const values = { HOST: shellArgument(host), USER: shellArgument(user), PORT: String(port), REMOTE: shellArgument(remote), BUNDLE: shellArgument(bundle), IDENTITY: shellArgument(ssh?.identityFile ?? ""), KNOWN: shellArgument(ssh?.knownHostsFile ?? ""), STRICT: ssh?.strictHostKeyChecking === false ? "no" : "accept-new" };
+  return { sh: sh.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]), ps1 };
+}
+
+// ../deploy/src/container/deploy-bundle.ts
+async function createDeploymentBundle(options) {
+  const { directory, artifactDir, artifact, projectName, environment, config: config2, selected } = options;
+  const stem = basename(options.output).replace(/\.tar$/i, "");
+  const suffix = `-${artifact.appVersion}`;
+  const output2 = resolve(dirname(options.output), `${stem.endsWith(suffix) ? stem : `${stem}${suffix}`}.tar`);
+  if (!/^[\w.+-]+\.tar$/.test(basename(output2)))
+    throw new Error(deployM("deploy_bundleNameInvalid"));
+  const staging = mkdtempSync(join(directory, ".bundle-"));
+  const temporaryTar = `${output2}.partial`;
+  mkdirSync(dirname(output2), { recursive: true, mode: 448 });
+  chmodSync(staging, 448);
+  const files = [];
+  const put = (file2, content) => {
+    mkdirSync(dirname(join(staging, file2)), { recursive: true });
+    writeFileSync(join(staging, file2), content, { mode: 384 });
+    files.push(file2);
+  };
+  try {
+    mkdirSync(join(staging, "images"));
+    const compose = parse$1(readFileSync(join(directory, `docker-compose-${artifact.appVersion}.yml`), "utf8"));
+    const dependencies = /* @__PURE__ */ new Set();
+    const references = /* @__PURE__ */ new Set();
+    for (const name of selected) {
+      const service = compose.services[name];
+      if (!service)
+        throw new Error(deployM("deploy_selectionInvalid", { params: { service: name } }));
+      if (typeof service.image === "string")
+        references.add(service.image);
+      if (service.depends_on) {
+        for (const dependency of Array.isArray(service.depends_on) ? service.depends_on : Object.keys(service.depends_on))
+          dependencies.add(dependency);
+      }
+      if (service.env_file)
+        service.env_file = [`../${options.deploymentId}/.env.runtime`, `../${options.deploymentId}/middleware.env`];
+      if (Array.isArray(service.volumes))
+        service.volumes = service.volumes.map((mount) => typeof mount === "string" ? mount.replace("./web.conf:", `../${options.deploymentId}/web.conf:`) : mount);
+    }
+    put("compose.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, compose.services[name]])) }));
+    put("compose-entry.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, { extends: { file: `../${options.deploymentId}/compose.json`, service: name } }])) }));
+    let runtime;
+    const imageList = [];
+    for (const reference of references) {
+      if (!/:[^/:]+$/.test(reference) || /:latest$/i.test(reference))
+        throw new Error(deployM("deploy_imageVersionRequired", { params: { image: reference } }));
+      const built = artifact.images.find((image) => image.imageRef === reference);
+      const file2 = built?.file ?? `middleware-${imageList.length + 1}.tar`;
+      if (built) {
+        copyFileSync(join(artifactDir, file2), join(staging, "images", file2));
+      } else {
+        if (!runtime) {
+          const candidates = options.runtime === "auto" ? ["podman", "docker"] : [options.runtime];
+          for (const candidate of candidates) {
+            if ((await runCommand(candidate, ["version"])).success) {
+              runtime = candidate;
+              break;
+            }
+          }
+          if (!runtime)
+            throw new Error(deployM("deploy_bundleRuntimeRequired"));
+        }
+        if (!(await runCommand(runtime, ["image", "inspect", reference])).success) {
+          const pulled = await runCommand(runtime, ["pull", reference], { timeoutMs: 6e5 });
+          if (!pulled.success)
+            throw new Error(pulled.error.message);
+        }
+        const saved = await runCommand(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", join(staging, "images", file2), reference], { timeoutMs: 6e5 });
+        if (!saved.success)
+          throw new Error(saved.error.message);
+      }
+      files.push(`images/${file2}`);
+      imageList.push(`${file2} ${reference}`);
+    }
+    put(".env.runtime", readFileSync(join(directory, ".env.runtime"), "utf8"));
+    put("middleware.env", options.middlewareEnv);
+    if (selected.includes("web"))
+      put("web.conf", readFileSync(join(directory, "web.conf"), "utf8"));
+    put("manifest.json", `${JSON.stringify({ ...artifact, images: artifact.images.filter((image) => references.has(image.imageRef)), deploymentId: options.deploymentId, selectedServices: selected, partial: options.partial }, null, 2)}
+`);
+    put("layout", `${config2.expose.hostPort}:${options.containerPort}:${options.hasWeb}:${options.hasWeb ? await artifactChecksum(join(directory, "web.conf")) : ""}
+`);
+    put("image-list", `${imageList.join("\n")}
+`);
+    put("dependencies", `${[...dependencies].join("\n")}
+`);
+    if (selected.includes("storage-init"))
+      put("initialize-storage", "");
+    put("apply.sh", createApplyScript({ deploymentId: options.deploymentId, projectName, environment, directory: `${config2.remote.baseDir}/${projectName}`, runtime: config2.remote.runtime, partial: options.partial, selected: selected.filter((name) => name !== "storage-init"), hostPort: config2.expose.hostPort, healthPaths: options.healthPaths }));
+    const instructions = deployM("deploy_bundleInstructions", { params: { file: basename(output2), start: "apply.sh", images: [...references].join("\n"), compose: "compose.json" } });
+    put("README.txt", `${deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, compose: "compose.json" } })}
+${instructions}
+`);
+    const checksums = [];
+    for (const file2 of files)
+      checksums.push(`${await artifactChecksum(join(staging, file2))}  ${file2}`);
+    writeFileSync(join(staging, "SHA256SUMS"), `${checksums.join("\n")}
+`);
+    const tar = await runCommand("tar", ["-cf", temporaryTar, "-C", staging, "."]);
+    if (!tar.success)
+      throw new Error(tar.error.message);
+    chmodSync(temporaryTar, 384);
+    renameSync(temporaryTar, output2);
+    const upload = createUploadScripts(config2, basename(output2), projectName);
+    const scripts = `${output2.slice(0, -4)}-deploy`;
+    mkdirSync(scripts, { recursive: true, mode: 448 });
+    writeFileSync(join(scripts, "deploy.sh"), upload.sh.replace('cd "$(dirname "$0")"', 'cd "$(dirname "$0")/.."'), { mode: 448 });
+    writeFileSync(join(scripts, "deploy.ps1"), upload.ps1.replace("Set-Location -LiteralPath $PSScriptRoot", "Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)").replace("'./deploy-target.json'", "(Join-Path $PSScriptRoot 'deploy-target.json')"));
+    writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...config2.ssh, host: config2.ssh?.host ?? "SERVER_HOST", username: config2.ssh?.username ?? "deploy", port: config2.ssh?.port ?? 22, directory: `${config2.remote.baseDir}/${projectName}`, bundle: basename(output2) }, null, 2)}
+`);
+    writeFileSync(join(scripts, "README.txt"), instructions);
+    return { bundlePath: output2, instructions: `${instructions}
+${scripts}`, startName: "apply.sh" };
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+    rmSync(temporaryTar, { force: true });
+  }
+}
 var IMAGES = {
-  postgres: "postgres:16-alpine",
-  mysql: "mysql:8.4",
-  redis: "redis:7-alpine",
+  postgres: "docker.io/library/postgres:16.15-alpine",
+  mysql: "docker.io/library/mysql:8.4.11",
+  redis: "docker.io/library/redis:7.4.11-alpine",
   rustfs: "ghcr.io/rustfs/rustfs:1.0.1",
   minio: "ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z",
-  qdrant: "qdrant/qdrant:v1.12.4",
-  pgvector: "pgvector/pgvector:pg17",
-  chroma: "chromadb/chroma:1.5.5",
+  qdrant: "docker.io/qdrant/qdrant:v1.19.2",
+  pgvector: "docker.io/pgvector/pgvector:0.8.0-pg17",
+  chroma: "docker.io/chromadb/chroma:1.5.5",
   ldap: "docker.io/osixia/openldap:1.5.0",
-  smtp: "axllent/mailpit:v1.27.4"
+  smtp: "docker.io/axllent/mailpit:v1.27.4"
 };
 function generatePassword() {
   return randomBytes(24).toString("base64url");
@@ -20397,8 +20953,12 @@ function resolveSidecarSecrets(appDir, projectName) {
   const secretFile = join(appDir, ".hai", "deploy", "runtime", `${projectName}.secrets.json`);
   if (existsSync(secretFile)) {
     try {
-      return JSON.parse(readFileSync(secretFile, "utf-8"));
+      const saved = JSON.parse(readFileSync(secretFile, "utf-8"));
+      if (!saved || !["dbPassword", "storagePassword", "ldapPassword"].every((key) => typeof saved[key] === "string" && saved[key].length > 0))
+        throw new Error("Invalid credentials");
+      return saved;
     } catch {
+      throw new Error(deployM("deploy_secretsInvalid", { params: { path: secretFile } }));
     }
   }
   const secrets = {
@@ -20566,6 +21126,28 @@ function planChromaVecdb(plan, projectName, net) {
   plan.env.HAI_VECDB = JSON.stringify({ type: "chroma", url: "http://vecdb:8000" });
 }
 function planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine = "rustfs") {
+  const serviceModes = { ...options?.serviceModes };
+  for (const requirement of scan.middlewares ?? []) {
+    if (options?.selectedServices && !options.selectedServices.includes(requirement.service))
+      continue;
+    const mode = serviceModes[requirement.envPrefix] ?? serviceModes[requirement.service];
+    if (mode !== "keep")
+      continue;
+    const endpoint = requirement.config.url ?? requirement.config.endpoint;
+    let host = requirement.config.host;
+    if (typeof endpoint === "string") {
+      try {
+        host = new URL(endpoint).hostname;
+      } catch {
+        continue;
+      }
+    }
+    if (host === requirement.service || ["sqlite", "local", "memory", "lancedb"].includes(requirement.backend)) {
+      serviceModes[requirement.envPrefix] = "default";
+      serviceModes[requirement.service] = "default";
+    }
+  }
+  options = { ...options, serviceModes };
   const plan = {
     services: [],
     composeServices: {},
@@ -20651,6 +21233,7 @@ function generateComposeFile(options) {
   const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
   const app = {
     image: imageRef,
+    labels: { "org.opencontainers.image.version": options.appVersion },
     container_name: `hai-${projectName}-app`,
     restart: "unless-stopped",
     // 镜像已由 load 注入本地，禁止 compose 再从 registry 拉取
@@ -20664,41 +21247,76 @@ function generateComposeFile(options) {
   if (sidecar.dependsOn.length > 0)
     app.depends_on = sidecar.dependsOn;
   const services = { app, ...sidecar.composeServices };
+  if (options.web) {
+    delete app.ports;
+    services.web = {
+      image: options.web.imageRef,
+      labels: { "org.opencontainers.image.version": options.appVersion },
+      container_name: `hai-${projectName}-web`,
+      restart: "unless-stopped",
+      pull_policy: "never",
+      ports: [`${hostPort}:${options.web.containerPort}`],
+      environment: { PUBLIC_API_BASE: "" },
+      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`], interval: "30s", timeout: "5s", retries: 3 },
+      volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
+      depends_on: ["app"],
+      networks: ["hai-app"]
+    };
+  }
   if (services["storage-init"])
     services["storage-init"] = { ...services["storage-init"], image: imageRef };
   const compose = {
+    "x-hai-version": options.appVersion,
     services,
-    networks: {
+    "networks": {
       "hai-app": { name: `hai-${projectName}` }
     }
   };
   if (Object.keys(sidecar.volumes).length > 0)
     compose.volumes = sidecar.volumes;
-  if (options.previousCompose && options.serviceModes) {
-    const previous = parse$1(options.previousCompose);
-    for (const [service, mode] of Object.entries(options.serviceModes)) {
-      if (mode !== "keep")
-        continue;
-      for (const name of [service, `${service}-init`]) {
-        if (previous.services?.[name]) {
-          services[name] = previous.services[name];
-          app.depends_on = [.../* @__PURE__ */ new Set([...app.depends_on ?? [], service])];
-        }
-      }
-    }
-    const previousMounts = previous.services?.app?.volumes;
-    if (Array.isArray(previousMounts) && Object.values(options.serviceModes).includes("keep"))
-      app.volumes = [.../* @__PURE__ */ new Set([...app.volumes ?? [], ...previousMounts])];
-    compose.volumes = { ...previous.volumes, ...sidecar.volumes };
-  }
   if (services["storage-init"]) {
     app.depends_on = {
       ...Object.fromEntries((app.depends_on ?? []).map((name) => [name, { condition: "service_started" }])),
       "storage-init": { condition: "service_completed_successfully" }
     };
   }
+  for (const service of Object.values(services))
+    service.pull_policy = "never";
   return stringify(compose);
 }
+function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
+  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535))
+    throw new Error("Invalid web proxy target");
+  return `server {
+  listen ${webPort};
+  server_name _;
+  root /usr/share/nginx/html;
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  location = /runtime-config.js {
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+    return 200 'globalThis.__HAI_PUBLIC_CONFIG__={apiBase:globalThis.location.origin+"${apiPrefix}"};';
+  }
+  location = /_hai/web-health {
+    access_log off;
+    return 200 'ok';
+  }
+  location = /health {
+    proxy_pass http://app:${port};
+    proxy_set_header Host $http_host;
+  }
+  location ${apiPrefix.replace(/\/$/, "")}/ {
+    proxy_pass http://app:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_buffering off;
+  }
+}
+`;
+}
 function serializeEnvFile(env) {
   return `${Object.entries(env).map(([key, value]) => {
     let literal2 = value;
@@ -20714,194 +21332,7 @@ function serializeEnvFile(env) {
   }).join("\n")}
 `;
 }
-function generateDockerignore() {
-  return `**/node_modules
-**/dist
-**/build
-**/.turbo
-**/.svelte-kit
-**/coverage
-**/test-results
-**/playwright-report
-**/.hai/deploy
-**/.env.local
-**/.env.*.local
-**/.env.runtime
-.git
-`;
-}
-function generateFallbackDockerfile(packageName, containerPort, options = {}) {
-  if (!/^@?[a-z0-9][\w./-]*$/i.test(packageName) || !/^[a-z0-9][\w-]*$/i.test(options.environment ?? "prod"))
-    throw new Error("Invalid container build target");
-  const environment = options.environment ?? "prod";
-  const coreEnv = environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
-  return `# syntax=docker/dockerfile:1.7
-FROM node:24-bookworm-slim AS build
-ARG SQLITE_PREBUILD_MIRROR
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
-ENV PNPM_HOME=/pnpm
-ENV PATH=$PNPM_HOME:$PATH
-ENV CI=true
-ENV HAI_DEPLOY_ENVIRONMENT=${environment}
-ENV HAI_CORE_ENV=${coreEnv}
-WORKDIR /workspace
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY . .
-RUN pnpm install --frozen-lockfile --ignore-scripts
-RUN pnpm --filter ${packageName}... build
-RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
-RUN pnpm pm deploy --filter ${packageName} --prod /prod/app
-
-FROM node:24-bookworm-slim AS runtime
-ENV NODE_ENV=production
-ENV HAI_DEPLOY_ENVIRONMENT=${environment}
-ENV HAI_CORE_ENV=${coreEnv}
-ENV HOST=0.0.0.0
-ENV PORT=${containerPort}
-WORKDIR /app
-COPY --from=build --chown=node:node /prod/app ./
-RUN mkdir -p data && chown node:node data
-USER node
-EXPOSE ${containerPort}
-CMD ["node", ${JSON.stringify(options.entrypoint ?? "build")}]
-`;
-}
-var logger4 = core.logger.child({ module: "deploy", scope: "command" });
-function maskSecrets(text, secrets) {
-  if (!secrets || secrets.length === 0)
-    return text;
-  let masked = text;
-  for (const secret of secrets) {
-    if (secret && secret.length > 0)
-      masked = masked.split(secret).join("***");
-  }
-  return masked;
-}
-function runCommand(command, args, options = {}) {
-  return new Promise((resolve3) => {
-    const child = spawn(command, args, {
-      cwd: options.cwd,
-      env: options.env ? { ...process2.env, ...options.env } : process2.env,
-      shell: false
-    });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    let timer;
-    const finish = (result) => {
-      if (settled)
-        return;
-      settled = true;
-      if (timer)
-        clearTimeout(timer);
-      resolve3(result);
-    };
-    if (options.timeoutMs && options.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        logger4.error("Command timed out", { command, timeoutMs: options.timeoutMs });
-        finish(err(
-          HaiDeployError.REMOTE_COMMAND_FAILED,
-          deployM("deploy_commandTimeout", { params: { command } })
-        ));
-      }, options.timeoutMs);
-    }
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (error62) => {
-      logger4.error("Command failed to start", { command, error: maskSecrets(String(error62), options.secrets) });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(error62.message, options.secrets) }
-        }),
-        error62
-      ));
-    });
-    child.on("close", (code) => {
-      const exitCode = code ?? -1;
-      if (exitCode === 0) {
-        finish(ok({ code: exitCode, stdout, stderr }));
-        return;
-      }
-      logger4.error("Command exited with non-zero code", {
-        command,
-        code: exitCode,
-        stderr: maskSecrets(stderr, options.secrets).slice(-500),
-        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
-      });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
-${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
-        })
-      ));
-    });
-    if (options.input !== void 0) {
-      child.stdin.write(options.input);
-      child.stdin.end();
-    } else {
-      child.stdin.end();
-    }
-  });
-}
-
-// ../deploy/src/container/deploy-container-runtime.ts
-var logger5 = core.logger.child({ module: "deploy", scope: "container-runtime" });
-async function detectLocalRuntime(preferred = "auto") {
-  const candidates = preferred === "auto" ? ["podman", "docker"] : [preferred];
-  for (const runtime of candidates) {
-    const probe = await runCommand(runtime, ["version"], { timeoutMs: 15e3 });
-    if (probe.success) {
-      logger5.info("Local container runtime detected", { runtime });
-      return ok(runtime);
-    }
-  }
-  return err(
-    HaiDeployError.CONTAINER_RUNTIME_NOT_FOUND,
-    deployM("deploy_containerRuntimeNotFound", { params: { runtime: candidates.join(" / ") } })
-  );
-}
-async function buildImage(runtime, options) {
-  const args = ["build", "-f", options.dockerfilePath, "-t", options.imageRef];
-  if (runtime === "podman")
-    args.push("--format", "docker", "--jobs", "1");
-  if (runtime === "podman" && existsSync(`${options.dockerfilePath}.dockerignore`))
-    args.push("--ignorefile", `${options.dockerfilePath}.dockerignore`);
-  if (runtime === "podman" && options.httpProxy === false)
-    args.push("--http-proxy=false");
-  for (const [key, value] of Object.entries(options.buildArgs ?? {}))
-    args.push("--build-arg", `${key}=${value}`);
-  args.push(options.contextDir);
-  logger5.info("Building container image", { runtime, imageRef: options.imageRef });
-  const result = await runCommand(runtime, args, { cwd: options.contextDir });
-  if (!result.success) {
-    return err(
-      HaiDeployError.CONTAINER_BUILD_FAILED,
-      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
-      result.error
-    );
-  }
-  return ok(void 0);
-}
-async function saveImage(runtime, imageRef, tarPath) {
-  logger5.info("Saving container image", { runtime, imageRef, tarPath });
-  const result = await runCommand(runtime, ["save", "-o", tarPath, imageRef], {});
-  if (!result.success) {
-    return err(
-      HaiDeployError.CONTAINER_BUILD_FAILED,
-      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
-      result.error
-    );
-  }
-  return ok(void 0);
-}
-var logger6 = core.logger.child({ module: "deploy", scope: "ssh" });
+var logger4 = core.logger.child({ module: "deploy", scope: "ssh" });
 function buildConnectOptions(config2) {
   const args = ["-o", "BatchMode=yes"];
   args.push("-o", `ConnectTimeout=${config2.connectTimeoutSeconds}`);
@@ -20929,14 +21360,15 @@ function buildScpUploadArgs(config2, localPath, remotePath) {
     "-P",
     String(config2.port),
     localPath,
-    `${config2.username}@${config2.host}:${remotePath}`
+    `${config2.username}@${config2.host.includes(":") ? `[${config2.host}]` : config2.host}:${remotePath}`
   ];
 }
 function createSshExecutor(config2) {
   const exec = async (remoteCommand, options) => {
     return runCommand("ssh", buildSshExecArgs(config2, remoteCommand), {
       timeoutMs: options?.timeoutMs,
-      secrets: options?.secrets
+      secrets: options?.secrets,
+      onOutput: options?.onOutput
     });
   };
   const upload = async (localPath, remotePath) => {
@@ -20952,7 +21384,7 @@ function createSshExecutor(config2) {
     return ok(void 0);
   };
   const ping = async () => {
-    logger6.debug("SSH preflight", { host: config2.host, port: config2.port });
+    logger4.debug("SSH preflight", { host: config2.host, port: config2.port });
     const result = await exec("true", { timeoutMs: 2e4 });
     if (!result.success) {
       return err(
@@ -20967,52 +21399,24 @@ function createSshExecutor(config2) {
 }
 
 // ../deploy/src/providers/deploy-provider-docker-ssh.ts
-var logger7 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
+var logger5 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
 var HEALTH_POLL_INTERVAL = 3e3;
 var HEALTH_MAX_ATTEMPTS = 40;
-function shellArgument(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
 function makeDeploymentId() {
   const now = /* @__PURE__ */ new Date();
   const pad = (n) => String(n).padStart(2, "0");
   const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
   return `${stamp}-${randomBytes(3).toString("hex")}`;
 }
-function parseLoadedImageRef(stdout, fallback) {
-  const match = stdout.match(/Loaded image(?:\(s\))?:\s*(\S+)/);
-  return match ? match[1] : fallback;
-}
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
-}
-function readPackageName(appDir) {
-  try {
-    const pkg = JSON.parse(readFileSync(join(appDir, "package.json"), "utf-8"));
-    return pkg.name ?? "app";
-  } catch {
-    return "app";
-  }
-}
-function resolveWorkspaceRoot(appDir) {
-  if (existsSync(join(appDir, "pnpm-workspace.yaml")))
-    return appDir;
-  let current = appDir;
-  let parent = dirname(current);
-  while (parent !== current) {
-    if (existsSync(join(parent, "pnpm-workspace.yaml")))
-      return parent;
-    current = parent;
-    parent = dirname(parent);
-  }
-  return appDir;
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function createDockerSshProvider(config2, container) {
-  const localRuntimePref = container?.runtime ?? "auto";
-  const httpProxy = container?.httpProxy ?? true;
-  const ssh = createSshExecutor(config2.ssh);
+  const ssh = config2.ssh ? createSshExecutor(config2.ssh) : void 0;
   const baseDir = config2.remote.baseDir;
   async function detectRemoteRuntime() {
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
     const candidates = config2.remote.runtime === "auto" ? ["podman", "docker"] : [config2.remote.runtime];
     for (const runtime of candidates) {
       const versionResult = await ssh.exec(`${runtime} version`, { timeoutMs: 2e4 });
@@ -21020,7 +21424,7 @@ function createDockerSshProvider(config2, container) {
         continue;
       const composeResult = await ssh.exec(`${runtime} compose version`, { timeoutMs: 2e4 });
       if (composeResult.success) {
-        logger7.info("Remote container runtime detected", { runtime });
+        logger5.info("Remote container runtime detected", { runtime });
         return ok(runtime);
       }
     }
@@ -21044,32 +21448,44 @@ function createDockerSshProvider(config2, container) {
   const deploy2 = async (context) => {
     const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
     const deploymentId = makeDeploymentId();
-    const containerPort = config2.expose.containerPort;
     const hostPort = config2.expose.hostPort;
-    const localImageTag = `hai-${projectName}:${deploymentId}`;
-    const runtimeResult = await detectLocalRuntime(localRuntimePref);
-    if (!runtimeResult.success)
-      return err(runtimeResult.error);
-    const localRuntime = runtimeResult.data;
     const artifactDir = join(appDir, ".hai", "deploy", options?.environment ?? "prod");
-    mkdirSync(artifactDir, { recursive: true });
-    const appDockerfile = join(appDir, "Dockerfile");
-    let dockerfilePath;
-    let contextDir;
-    if (existsSync(appDockerfile)) {
-      dockerfilePath = appDockerfile;
-      contextDir = appDir;
-    } else {
-      dockerfilePath = join(artifactDir, "Dockerfile");
-      writeFileSync(dockerfilePath, generateFallbackDockerfile(readPackageName(appDir), containerPort, { environment: options?.environment, entrypoint: scan.isSvelteKit ? "build" : "dist/index.js" }));
-      writeFileSync(`${dockerfilePath}.dockerignore`, generateDockerignore());
-      contextDir = resolveWorkspaceRoot(appDir);
-      logger7.info("Generated fallback Dockerfile", { dockerfilePath, contextDir });
-    }
+    mkdirSync(artifactDir, { recursive: true, mode: 448 });
+    chmodSync(artifactDir, 448);
+    const artifact = context.artifact;
+    const resolvedBuildDir = context.artifactDir;
+    const images = artifact.images;
+    const web = images.find((image) => image.name === "web");
+    const app = images.find((image) => image.name === "app");
+    if (options?.selectedServices) {
+      const available = [...images.map((image) => image.name), ...scan.requiredServices];
+      const invalid = options.selectedServices.find((name) => !available.includes(name));
+      if (!options.selectedServices.length || new Set(options.selectedServices).size !== options.selectedServices.length || invalid)
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: invalid ?? options.selectedServices.join(", ") } }));
+    }
+    const hasWeb = artifact.hasWeb || !!web;
+    const partial2 = artifact.partial || options?.selectedServices !== void 0;
+    const containerPort = app?.containerPort ?? artifact.appContainerPort ?? config2.expose.containerPort;
+    const webContainerPort = web?.containerPort ?? artifact.webContainerPort ?? 8080;
+    const host = config2.ssh?.host;
+    const url2 = host ? `http://${host.includes(":") ? `[${host}]` : host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
     const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
+    if (sidecar.composeServices["storage-init"] && !app && options?.selectedServices?.includes("storage"))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageArtifactRequired"));
+    let webProxy;
+    if (hasWeb) {
+      const server = loadDeploymentConfig("serv", join(appDir, "config", "_serv.yml"), env);
+      if (!server.success)
+        return server;
+      const http = server.data.http;
+      const cors = server.data.cors;
+      const apiPrefix = http?.apiPrefix ?? "/api/v1";
+      if (typeof apiPrefix !== "string" || !/^\/[\w/-]+$/.test(apiPrefix))
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
+      webProxy = generateWebProxyConfig(containerPort, apiPrefix, webContainerPort);
+      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && config2.ssh ? url2 : cors?.origin ?? "*" } });
+    }
     const envPath = join(artifactDir, ".env.runtime");
-    const previousEnv = existsSync(envPath) ? parseEnv(readFileSync(envPath, "utf8")) : {};
-    Object.assign(env, { ...previousEnv, ...env });
     writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
     if (options?.environment) {
       const environment = loadDeploymentEnvironment({ environment: options.environment, envDir: options.envDir ?? scan.envDir ?? appDir });
@@ -21079,88 +21495,83 @@ function createDockerSshProvider(config2, container) {
       if (!saved.success)
         return saved;
     }
-    const buildResult = await buildImage(localRuntime, {
-      contextDir,
-      dockerfilePath,
-      imageRef: localImageTag,
-      buildArgs: { HAI_DEPLOY_ENVIRONMENT: options?.environment ?? "prod", HAI_CORE_ENV: env.HAI_CORE_ENV ?? "production", SQLITE_PREBUILD_MIRROR: container?.sqlitePrebuildMirror ?? "" },
-      httpProxy
-    });
-    if (!buildResult.success)
-      return err(buildResult.error);
-    const tarPath = join(artifactDir, `${projectName}.tar`);
-    const saveResult = await saveImage(localRuntime, localImageTag, tarPath);
-    if (!saveResult.success)
-      return err(saveResult.error);
-    const pingResult = await ssh.ping();
-    if (!pingResult.success)
-      return err(pingResult.error);
-    const remoteRuntimeResult = await detectRemoteRuntime();
-    if (!remoteRuntimeResult.success)
-      return err(remoteRuntimeResult.error);
-    const remoteRuntime = remoteRuntimeResult.data;
-    const remoteDir = `${baseDir}/${projectName}`;
-    const prepareResult = await ssh.exec(`mkdir -p -- ${shellArgument(remoteDir)} && chmod 700 -- ${shellArgument(remoteDir)}`);
-    if (!prepareResult.success)
-      return err(prepareResult.error);
-    const remoteTar = `${remoteDir}/image.tar`;
-    const uploadTarResult = await ssh.upload(tarPath, remoteTar);
-    if (!uploadTarResult.success)
-      return err(uploadTarResult.error);
-    const loadResult = await ssh.exec(`${remoteRuntime} load -i ${shellArgument(remoteTar)}`, { timeoutMs: 3e5 });
-    if (!loadResult.success)
-      return err(loadResult.error);
-    const loadedRef = parseLoadedImageRef(loadResult.data.stdout, localImageTag);
-    const remoteImageRef = remoteRuntime === "podman" ? `localhost/${localImageTag}` : localImageTag;
-    if (loadedRef !== remoteImageRef) {
-      const tagResult = await ssh.exec(`${remoteRuntime} tag ${shellArgument(loadedRef)} ${shellArgument(remoteImageRef)}`);
-      if (!tagResult.success)
-        return err(tagResult.error);
-    }
+    const composeName = `docker-compose-${artifact.appVersion}.yml`;
     const composeContent = generateComposeFile({
       projectName,
-      imageRef: remoteImageRef,
+      appVersion: artifact.appVersion,
+      imageRef: app?.imageRef ?? "localhost/hai-unselected:0",
       hostPort,
       containerPort,
       sidecar,
-      serviceModes: options?.serviceModes,
-      previousCompose: existsSync(join(artifactDir, "compose.yml")) ? readFileSync(join(artifactDir, "compose.yml"), "utf8") : void 0
+      web: hasWeb ? { imageRef: web?.imageRef ?? "localhost/hai-unselected:0", containerPort: webContainerPort } : void 0
     });
-    const composePath = join(artifactDir, "compose.yml");
+    const composePath = join(artifactDir, composeName);
     writeFileSync(composePath, composeContent);
-    const uploadComposeResult = await ssh.upload(composePath, `${remoteDir}/compose.yml`);
-    if (!uploadComposeResult.success)
-      return err(uploadComposeResult.error);
-    const uploadEnvResult = await ssh.upload(envPath, `${remoteDir}/.env.runtime`);
-    if (!uploadEnvResult.success)
-      return err(uploadEnvResult.error);
-    const startScript = `#!/bin/sh
-set -eu
-cd "$(dirname "$0")"
-export HAI_DEPLOY_ENVIRONMENT=${options?.environment ?? "prod"}
-export HAI_CORE_ENV=${shellArgument(env.HAI_CORE_ENV ?? "production")}
-exec ${remoteRuntime} compose --env-file .env.runtime -p hai-${projectName} up -d
-`;
-    const startName = `start-${options?.environment ?? "prod"}.sh`;
-    const startPath = join(artifactDir, startName);
-    writeFileSync(startPath, startScript, { mode: 448 });
-    const uploadStart = await ssh.upload(startPath, `${remoteDir}/${startName}`);
-    if (!uploadStart.success)
-      return uploadStart;
-    const secretMask = sidecar.secrets;
-    const chmodResult = await ssh.exec(`chmod 600 -- ${shellArgument(`${remoteDir}/.env.runtime`)}`, { secrets: secretMask });
-    if (!chmodResult.success)
-      return err(chmodResult.error);
-    const upResult = await ssh.exec(
-      `cd ${shellArgument(remoteDir)} && sh ${shellArgument(startName)}`,
-      { timeoutMs: 3e5, secrets: secretMask }
+    if (webProxy)
+      writeFileSync(join(artifactDir, "web.conf"), webProxy);
+    const selected = options?.selectedServices ? [...options.selectedServices] : artifact.partial ? images.map((image) => image.name) : [...images.map((image) => image.name), ...Object.keys(sidecar.composeServices)];
+    if (!selected.length || selected.some((name) => !/^[a-z][a-z0-9-]*$/.test(name)) || new Set(selected).size !== selected.length)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: selected.join(", ") } }));
+    for (const name of selected) {
+      if (["app", "web"].includes(name) && !images.some((image) => image.name === name))
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: name } }));
+    }
+    if (selected.includes("storage") && sidecar.composeServices["storage-init"] && !selected.includes("storage-init"))
+      selected.push("storage-init");
+    options?.onProgress?.("packaging");
+    const bundle = await createDeploymentBundle({
+      directory: artifactDir,
+      artifactDir: resolvedBuildDir,
+      artifact,
+      projectName,
+      environment: options?.environment ?? "prod",
+      deploymentId,
+      config: config2,
+      runtime: options?.runtime ?? "auto",
+      selected,
+      partial: partial2,
+      hasWeb,
+      containerPort,
+      middlewareEnv: serializeEnvFile(sidecar.env),
+      healthPaths: hasWeb ? ["/health", "/_hai/web-health", "/"] : [scan.isSvelteKit ? "/" : "/health"],
+      output: options?.output ?? join(artifactDir, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar`)
+    });
+    if (options?.bundleOnly)
+      return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet: Object.keys(env), ...bundle });
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
+    const ping = await ssh.ping();
+    if (!ping.success)
+      return ping;
+    const remoteRuntime = await detectRemoteRuntime();
+    if (!remoteRuntime.success)
+      return remoteRuntime;
+    const remoteDir = `${baseDir}/${projectName}`;
+    const remoteTar = `${remoteDir}/incoming/${basename(bundle.bundlePath)}`;
+    const prepared = await ssh.exec(`mkdir -p -- ${shellArgument(`${remoteDir}/incoming`)} && chmod 700 -- ${shellArgument(remoteDir)} ${shellArgument(`${remoteDir}/incoming`)}`);
+    if (!prepared.success)
+      return prepared;
+    const uploaded = await ssh.upload(bundle.bundlePath, remoteTar);
+    if (!uploaded.success)
+      return uploaded;
+    let pendingOutput = "";
+    const started = await ssh.exec(
+      `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)}`,
+      { timeoutMs: 6e5, secrets: sidecar.secrets, onOutput: (output2) => {
+        pendingOutput += output2;
+        const lines = pendingOutput.split("\n");
+        pendingOutput = lines.pop() ?? "";
+        for (const line of lines) {
+          const stage = /^\[(preflight|images|dependencies|start|health|complete)\]/.exec(line)?.[1];
+          if (stage)
+            options?.onProgress?.(stage);
+        }
+      } }
     );
-    if (!upResult.success)
-      return err(upResult.error);
-    await ssh.exec(`rm -f -- ${shellArgument(remoteTar)}`);
-    const url2 = `http://${config2.ssh.host}:${hostPort}`;
-    logger7.info("Running health check", { url: url2 });
-    const healthy = await healthCheck(`${url2}${scan.isSvelteKit ? "/" : "/health"}`);
+    if (!started.success)
+      return started;
+    logger5.info("Running health check", { url: url2 });
+    const healthy = await healthCheck(`${url2}${!hasWeb && scan.isSvelteKit ? "/" : "/health"}`) && (!hasWeb || await healthCheck(`${url2}/_hai/web-health`) && await healthCheck(`${url2}/`));
     if (!healthy) {
       return err(
         HaiDeployError.HEALTH_CHECK_FAILED,
@@ -21173,14 +21584,24 @@ exec ${remoteRuntime} compose --env-file .env.runtime -p hai-${projectName} up -
       status: "ready",
       provider: "docker-ssh",
       healthCheck: "passed",
-      envVarsSet: Object.keys(env)
+      envVarsSet: Object.keys(env),
+      bundlePath: bundle.bundlePath
     };
-    logger7.info("docker-ssh deployment complete", { url: url2, deploymentId });
+    logger5.info("docker-ssh deployment complete", { url: url2, deploymentId });
     return ok(result);
   };
-  return { name: "docker-ssh", deploy: deploy2 };
+  const deploySafely = async (context) => {
+    try {
+      return await deploy2(context);
+    } catch (error62) {
+      logger5.error("Deployment bundle failed", { error: error62 });
+      const reason = error62 instanceof Error ? error62.message : String(error62);
+      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", { params: { reason: maskSecrets(reason, Object.values(context.appEnv ?? {}).filter((value) => value.length > 6)) } }), error62);
+    }
+  };
+  return { name: "docker-ssh", deploy: deploySafely };
 }
-var logger8 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
+var logger6 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
 var VERCEL_API = "https://api.vercel.com";
 var POLL_INTERVAL = 3e3;
 var MAX_POLL_ATTEMPTS = 60;
@@ -21233,7 +21654,7 @@ function createVercelProvider() {
   return {
     name: "vercel",
     async authenticate(apiToken) {
-      logger8.debug("Authenticating with Vercel");
+      logger6.debug("Authenticating with Vercel");
       try {
         const user = await vercelFetch(
           apiToken,
@@ -21241,10 +21662,10 @@ function createVercelProvider() {
         );
         token = apiToken;
         const username = user.user.username || user.user.email;
-        logger8.info("Vercel authenticated", { user: username });
+        logger6.info("Vercel authenticated", { user: username });
         return ok(username);
       } catch (error62) {
-        logger8.error("Vercel authentication failed", { error: error62 });
+        logger6.error("Vercel authentication failed", { error: error62 });
         return err(toDeployError(HaiDeployError.AUTH_FAILED, "deploy_authFailed", error62));
       }
     },
@@ -21255,11 +21676,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Creating Vercel project", { projectName });
+      logger6.debug("Creating Vercel project", { projectName });
       try {
         const existingId = await findExistingProject(token, projectName);
         if (existingId !== null) {
-          logger8.info("Vercel project found", { projectName, projectId: existingId });
+          logger6.info("Vercel project found", { projectName, projectId: existingId });
           return ok(existingId);
         }
         try {
@@ -21274,13 +21695,13 @@ function createVercelProvider() {
               })
             }
           );
-          logger8.info("Vercel project created", { projectName, projectId: project.id });
+          logger6.info("Vercel project created", { projectName, projectId: project.id });
           return ok(project.id);
         } catch (error62) {
           if (error62 instanceof VercelApiError && error62.status === 409) {
             const concurrentProjectId = await findExistingProject(token, projectName);
             if (concurrentProjectId !== null) {
-              logger8.info("Vercel project reused after create conflict", {
+              logger6.info("Vercel project reused after create conflict", {
                 projectName,
                 projectId: concurrentProjectId
               });
@@ -21290,7 +21711,7 @@ function createVercelProvider() {
           throw error62;
         }
       } catch (error62) {
-        logger8.error("Vercel project creation failed", { projectName, error: error62 });
+        logger6.error("Vercel project creation failed", { projectName, error: error62 });
         return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error62));
       }
     },
@@ -21301,7 +21722,7 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
+      logger6.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
       try {
         const envEntries = Object.entries(envVars).map(([key, value]) => ({
           key,
@@ -21317,10 +21738,10 @@ function createVercelProvider() {
             body: JSON.stringify(envEntries)
           }
         );
-        logger8.info("Vercel env vars set", { projectId, count: envEntries.length });
+        logger6.info("Vercel env vars set", { projectId, count: envEntries.length });
         return ok(void 0);
       } catch (error62) {
-        logger8.error("Vercel env vars setup failed", { projectId, error: error62 });
+        logger6.error("Vercel env vars setup failed", { projectId, error: error62 });
         return err(toDeployError(HaiDeployError.ENV_VAR_FAILED, "deploy_envVarFailed", error62));
       }
     },
@@ -21331,8 +21752,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Deploying to Vercel", { projectId, outputDir });
+      logger6.debug("Deploying to Vercel", { projectId, outputDir });
       try {
+        const outputConfig = JSON.parse(readFileSync(join(outputDir, "config.json"), "utf8"));
+        if (outputConfig.version !== 3)
+          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
         const filePaths = collectFiles(outputDir, outputDir);
         const files = [];
         for (const filePath of filePaths) {
@@ -21341,18 +21765,20 @@ function createVercelProvider() {
           const sha = createHash("sha1").update(content).digest("hex");
           const size = statSync(fullPath).size;
           await uploadFile(token, content, sha);
-          files.push({ file: filePath, sha, size });
+          files.push({ file: `.vercel/output/${filePath}`, sha, size });
         }
-        logger8.debug("Files uploaded", { count: files.length });
+        logger6.debug("Files uploaded", { count: files.length });
         const deployment = await vercelFetch(
           token,
-          "/v13/deployments",
+          "/v13/deployments?prebuilt=1",
           {
             method: "POST",
             body: JSON.stringify({
               name: projectId,
               files,
-              projectSettings: { framework: "sveltekit" }
+              version: 2,
+              project: projectId,
+              projectSettings: { framework: null, buildCommand: "", installCommand: "" }
             })
           }
         );
@@ -21363,14 +21789,14 @@ function createVercelProvider() {
           status: finalStatus,
           envVarsSet: []
         };
-        logger8.info("Vercel deployment complete", {
+        logger6.info("Vercel deployment complete", {
           deploymentId: deployment.id,
           url: result.url,
           status: finalStatus
         });
         return ok(result);
       } catch (error62) {
-        logger8.error("Vercel deployment failed", { projectId, error: error62 });
+        logger6.error("Vercel deployment failed", { projectId, error: error62 });
         return err(toDeployError(HaiDeployError.UPLOAD_FAILED, "deploy_uploadFailed", error62));
       }
     }
@@ -21415,11 +21841,11 @@ async function pollDeploymentStatus(token, deploymentId) {
     if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
       return "error";
     }
-    await new Promise((resolve3) => setTimeout(resolve3, POLL_INTERVAL));
+    await new Promise((resolve6) => setTimeout(resolve6, POLL_INTERVAL));
   }
   return "building";
 }
-var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
+var logger7 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
 function createAliyunProvisioner() {
   let accessKey = null;
   let secretKey = null;
@@ -21428,7 +21854,7 @@ function createAliyunProvisioner() {
     name: "aliyun",
     serviceType: "sms",
     async authenticate(credentials) {
-      logger9.debug("Authenticating with Aliyun");
+      logger7.debug("Authenticating with Aliyun");
       try {
         const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
         const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
@@ -21438,10 +21864,10 @@ function createAliyunProvisioner() {
         accessKey = akId;
         secretKey = akSecret;
         signName = credentials.signName;
-        logger9.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
         return ok(akId);
       } catch (error62) {
-        logger9.error("Aliyun authentication failed", { error: error62 });
+        logger7.error("Aliyun authentication failed", { error: error62 });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -21458,7 +21884,7 @@ function createAliyunProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger9.debug("Provisioning Aliyun SMS service");
+      logger7.debug("Provisioning Aliyun SMS service");
       return ok({
         serviceType: "sms",
         provisionerName: "aliyun",
@@ -21471,7 +21897,7 @@ function createAliyunProvisioner() {
     }
   };
 }
-var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
+var logger8 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
 var NEON_API = "https://console.neon.tech/api/v2";
 var DEFAULT_NEON_DATABASE_NAME = "neondb";
 var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
@@ -21530,7 +21956,7 @@ function createNeonProvisioner() {
     name: "neon",
     serviceType: "db",
     async authenticate(credentials) {
-      logger10.debug("Authenticating with Neon");
+      logger8.debug("Authenticating with Neon");
       try {
         const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
         if (!apiToken) {
@@ -21538,10 +21964,10 @@ function createNeonProvisioner() {
         }
         await listNeonProjects(apiToken);
         token = apiToken;
-        logger10.info("Neon authenticated");
+        logger8.info("Neon authenticated");
         return ok("neon-user");
       } catch (error62) {
-        logger10.error("Neon authentication failed", { error: error62 });
+        logger8.error("Neon authentication failed", { error: error62 });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -21558,7 +21984,7 @@ function createNeonProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger10.debug("Provisioning Neon database", { appName });
+      logger8.debug("Provisioning Neon database", { appName });
       let resource;
       try {
         const projectName = `${appName}-db`;
@@ -21566,7 +21992,7 @@ function createNeonProvisioner() {
         if (existingProject !== null) {
           resource = { resourceInfo: `neon-project:${existingProject.id}`, resourceStatus: "reused" };
           const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
-          logger10.info("Neon project reused", {
+          logger8.info("Neon project reused", {
             projectId: existingProject.id,
             projectName
           });
@@ -21588,10 +22014,10 @@ function createNeonProvisioner() {
         if (!projectId || !connectionUri) {
           throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
         }
-        logger10.info("Neon database provisioned", { projectId });
+        logger8.info("Neon database provisioned", { projectId });
         return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
       } catch (error62) {
-        logger10.error("Neon provisioning failed", { appName });
+        logger8.error("Neon provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -21613,7 +22039,7 @@ function createNeonProvisioner() {
     }
   };
 }
-var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
+var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
 var CF_API = "https://api.cloudflare.com/client/v4";
 function createR2Provisioner() {
   let token = null;
@@ -21624,7 +22050,7 @@ function createR2Provisioner() {
     name: "r2",
     serviceType: "storage",
     async authenticate(credentials) {
-      logger11.debug("Authenticating with Cloudflare");
+      logger9.debug("Authenticating with Cloudflare");
       try {
         const acctId = credentials.accountId ?? credentials.account_id ?? "";
         const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
@@ -21641,10 +22067,10 @@ function createR2Provisioner() {
         token = apiTok;
         accessKey = credentials.accessKeyId;
         secretKey = credentials.secretAccessKey;
-        logger11.info("Cloudflare R2 authenticated", { accountId: acctId });
+        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
         return ok(acctId);
       } catch (error62) {
-        logger11.error("Cloudflare R2 authentication failed", { error: error62 });
+        logger9.error("Cloudflare R2 authentication failed", { error: error62 });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -21662,7 +22088,7 @@ function createR2Provisioner() {
         );
       }
       const bucketName = `${appName}-storage`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      logger11.debug("Provisioning R2 bucket", { appName, bucketName });
+      logger9.debug("Provisioning R2 bucket", { appName, bucketName });
       try {
         const createRes = await fetch(
           `${CF_API}/accounts/${accountId}/r2/buckets`,
@@ -21678,7 +22104,7 @@ function createR2Provisioner() {
         if (!createRes.ok && createRes.status !== 409) {
           throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
         }
-        logger11.info("R2 bucket provisioned", { bucketName });
+        logger9.info("R2 bucket provisioned", { bucketName });
         return ok({
           serviceType: "storage",
           provisionerName: "r2",
@@ -21696,7 +22122,7 @@ function createR2Provisioner() {
           resourceInfo: `r2-bucket:${bucketName}`
         });
       } catch (error62) {
-        logger11.error("R2 provisioning failed", { appName, error: error62 });
+        logger9.error("R2 provisioning failed", { appName, error: error62 });
         return err(
           HaiDeployError.PROVISION_FAILED,
           deployM("deploy_provisionFailed", {
@@ -21711,7 +22137,7 @@ function createR2Provisioner() {
     }
   };
 }
-var logger12 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
+var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
 var RESEND_API = "https://api.resend.com";
 function createResendProvisioner() {
   let token = null;
@@ -21720,7 +22146,7 @@ function createResendProvisioner() {
     name: "resend",
     serviceType: "email",
     async authenticate(credentials) {
-      logger12.debug("Authenticating with Resend");
+      logger10.debug("Authenticating with Resend");
       try {
         const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
         if (!apiToken || !credentials.from) {
@@ -21734,10 +22160,10 @@ function createResendProvisioner() {
         }
         token = apiToken;
         from = credentials.from;
-        logger12.info("Resend authenticated");
+        logger10.info("Resend authenticated");
         return ok("resend-user");
       } catch (error62) {
-        logger12.error("Resend authentication failed", { error: error62 });
+        logger10.error("Resend authentication failed", { error: error62 });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -21754,7 +22180,7 @@ function createResendProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger12.debug("Provisioning Resend email service");
+      logger10.debug("Provisioning Resend email service");
       return ok({
         serviceType: "email",
         provisionerName: "resend",
@@ -21767,7 +22193,7 @@ function createResendProvisioner() {
     }
   };
 }
-var logger13 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
+var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
 var UPSTASH_API = "https://api.upstash.com";
 function createUpstashAuthHeader(email3, apiKey) {
   return `Basic ${Buffer.from(`${email3}:${apiKey}`).toString("base64")}`;
@@ -21818,7 +22244,7 @@ function createUpstashProvisioner() {
     name: "upstash",
     serviceType: "cache",
     async authenticate(credentials) {
-      logger13.debug("Authenticating with Upstash");
+      logger11.debug("Authenticating with Upstash");
       try {
         const userEmail = credentials.email ?? "";
         const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
@@ -21828,10 +22254,10 @@ function createUpstashProvisioner() {
         await listUpstashDatabases(userEmail, userKey);
         email3 = userEmail;
         apiKey = userKey;
-        logger13.info("Upstash authenticated", { email: userEmail });
+        logger11.info("Upstash authenticated", { email: userEmail });
         return ok(userEmail);
       } catch (error62) {
-        logger13.error("Upstash authentication failed", { error: error62 });
+        logger11.error("Upstash authentication failed", { error: error62 });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -21848,7 +22274,7 @@ function createUpstashProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger13.debug("Provisioning Upstash Redis", { appName });
+      logger11.debug("Provisioning Upstash Redis", { appName });
       let resource;
       try {
         const databaseName = `${appName}-cache`;
@@ -21860,7 +22286,7 @@ function createUpstashProvisioner() {
           }
           resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
           const detail = await getUpstashDatabase(email3, apiKey, databaseId);
-          logger13.info("Upstash Redis reused", { databaseId, databaseName });
+          logger11.info("Upstash Redis reused", { databaseId, databaseName });
           return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
         }
         const data = await upstashFetch(email3, apiKey, "/v2/redis/database", {
@@ -21873,10 +22299,10 @@ function createUpstashProvisioner() {
         });
         if (data.database_id)
           resource = { resourceInfo: `upstash-db:${data.database_id}`, resourceStatus: "created" };
-        logger13.info("Upstash Redis provisioned", { databaseId: data.database_id });
+        logger11.info("Upstash Redis provisioned", { databaseId: data.database_id });
         return ok(buildUpstashProvisionResult(data, "created"));
       } catch (error62) {
-        logger13.error("Upstash provisioning failed", { appName });
+        logger11.error("Upstash provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -21900,7 +22326,7 @@ function createUpstashProvisioner() {
 }
 
 // ../deploy/src/deploy-main.ts
-var logger14 = core.logger.child({ module: "deploy", scope: "main" });
+var logger12 = core.logger.child({ module: "deploy", scope: "main" });
 var currentConfig = null;
 var currentProvider = null;
 var currentContainerProvider = null;
@@ -21985,7 +22411,7 @@ var deploy = {
   credentials: deployCredentials,
   async init(config2) {
     if (initInProgress) {
-      logger14.warn("Deploy init already in progress, skipping concurrent call");
+      logger12.warn("Deploy init already in progress, skipping concurrent call");
       return err(
         HaiDeployError.CONFIG_ERROR,
         deployM("deploy_configError", { params: { error: "init already in progress" } })
@@ -21994,13 +22420,13 @@ var deploy = {
     initInProgress = true;
     try {
       if (currentProvider || currentContainerProvider) {
-        logger14.warn("Deploy module is already initialized, reinitializing");
+        logger12.warn("Deploy module is already initialized, reinitializing");
         await deploy.close();
       }
-      logger14.info("Initializing deploy module");
+      logger12.info("Initializing deploy module");
       const parseResult = DeployConfigSchema.safeParse(config2);
       if (!parseResult.success) {
-        logger14.error("Deploy config validation failed", { error: parseResult.error.message });
+        logger12.error("Deploy config validation failed", { error: parseResult.error.message });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", { params: { error: parseResult.error.message } }),
@@ -22013,14 +22439,14 @@ var deploy = {
         let containerProvider = null;
         if (parsed.provider.type === "docker-ssh") {
           containerProvider = createDockerSshProvider(parsed.provider, parsed.container);
-          logger14.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh.host });
+          logger12.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh?.host });
         } else {
           provider = createProviderByType(parsed.provider.type);
           const authResult = await provider.authenticate(parsed.provider.token);
           if (!authResult.success) {
             return err(authResult.error);
           }
-          logger14.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
+          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         }
         currentProvisioners.clear();
         if (parsed.services) {
@@ -22032,14 +22458,14 @@ var deploy = {
             const credentials = extractCredentials(serviceConfig);
             const provAuthResult = await provisioner.authenticate(credentials);
             if (!provAuthResult.success) {
-              logger14.error("Provisioner authentication failed", {
+              logger12.error("Provisioner authentication failed", {
                 service: serviceType,
                 provisioner: serviceConfig.provisioner
               });
               currentProvisioners.clear();
               return err(provAuthResult.error);
             }
-            logger14.info("Provisioner authenticated", {
+            logger12.info("Provisioner authenticated", {
               service: serviceType,
               user: provAuthResult.data
             });
@@ -22049,7 +22475,7 @@ var deploy = {
         currentProvider = provider;
         currentContainerProvider = containerProvider;
         currentConfig = parsed;
-        logger14.info("Deploy module initialized", {
+        logger12.info("Deploy module initialized", {
           provider: parsed.provider.type,
           provisioners: [...currentProvisioners.keys()]
         });
@@ -22059,7 +22485,7 @@ var deploy = {
         currentContainerProvider = null;
         currentConfig = null;
         currentProvisioners.clear();
-        logger14.error("Deploy module initialization failed", { error: error62 });
+        logger12.error("Deploy module initialization failed", { error: error62 });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", {
@@ -22074,15 +22500,15 @@ var deploy = {
   },
   async close() {
     if (!currentProvider && !currentContainerProvider) {
-      logger14.info("Deploy module already closed, skipping");
+      logger12.info("Deploy module already closed, skipping");
       return;
     }
-    logger14.info("Closing deploy module");
+    logger12.info("Closing deploy module");
     currentProvider = null;
     currentContainerProvider = null;
     currentConfig = null;
     currentProvisioners.clear();
-    logger14.info("Deploy module closed");
+    logger12.info("Deploy module closed");
   },
   get config() {
     return currentConfig;
@@ -22091,22 +22517,22 @@ var deploy = {
     return currentProvider !== null || currentContainerProvider !== null;
   },
   async scan(appDir, options) {
-    logger14.debug("Scanning application", { appDir });
+    logger12.debug("Scanning application", { appDir });
     return scanApp(appDir, options);
   },
   async provisionAll(projectName, services) {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Provisioning all services", { projectName, count: currentProvisioners.size });
+    logger12.info("Provisioning all services", { projectName, count: currentProvisioners.size });
     const results = [];
     for (const [serviceType, provisioner] of currentProvisioners) {
       if (services && !services.includes(serviceType))
         continue;
-      logger14.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
+      logger12.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
       const provResult = await provisioner.provision(projectName);
       if (!provResult.success) {
-        logger14.error("Service provisioning failed", {
+        logger12.error("Service provisioning failed", {
           serviceType,
           provisioner: provisioner.name,
           code: provResult.error.code
@@ -22123,7 +22549,7 @@ var deploy = {
         });
       }
       results.push(provResult.data);
-      logger14.info("Service provisioned", { serviceType, provisioner: provisioner.name });
+      logger12.info("Service provisioned", { serviceType, provisioner: provisioner.name });
     }
     return ok(results);
   },
@@ -22131,7 +22557,7 @@ var deploy = {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
+    logger12.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
     const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
     const scanResult = await scanApp(appDir, scanOptions);
     if (!scanResult.success) {
@@ -22147,11 +22573,21 @@ var deploy = {
     options = {
       ...options,
       ...scanOptions.environment ? { environment: environment.data.environment } : {},
-      ...options?.skipProvision ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
+      ...options?.skipMiddleware ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
     };
+    if (options.selectedServices) {
+      options.serviceModes = {
+        ...options.serviceModes,
+        ...Object.fromEntries(scan.requiredServices.filter((service) => !options.selectedServices.includes(service)).map((service) => [service, "keep"]))
+      };
+    }
     if (currentContainerProvider) {
       return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options, appEnv);
     }
+    if (options?.bundleOnly)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleOnlyContainer"));
+    if (options.selectedServices)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectedContainerOnly"));
     if (!currentProvider) {
       return notInitialized.result();
     }
@@ -22163,9 +22599,11 @@ var deploy = {
         })
       );
     }
+    if (!existsSync(resolveOutputDir(appDir, "vercel")))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
     let allEnvVars = appEnv;
     const recovery = { projectName, stage: "provision", resources: [] };
-    if (!options?.skipProvision) {
+    if (!options?.skipMiddleware) {
       const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
       if (!provResults.success) {
         return err(provResults.error);
@@ -22190,12 +22628,6 @@ var deploy = {
         return recoveryFailure(envResult.error, { ...recovery, stage: "set-env" });
       }
     }
-    if (!options?.skipBuild) {
-      const buildResult = buildApp(appDir, scan.buildCommand, allEnvVars);
-      if (!buildResult.success) {
-        return recoveryFailure(buildResult.error, { ...recovery, stage: "build" });
-      }
-    }
     const outputDir = resolveOutputDir(appDir, currentConfig?.provider.type ?? "vercel");
     const deployResult = await currentProvider.deploy(projectId, outputDir);
     if (!deployResult.success) {
@@ -22205,7 +22637,7 @@ var deploy = {
       ...deployResult.data,
       envVarsSet: Object.keys(allEnvVars)
     };
-    logger14.info("Deployment completed", {
+    logger12.info("Deployment completed", {
       url: result.url,
       deploymentId: result.deploymentId,
       status: result.status
@@ -22215,21 +22647,41 @@ var deploy = {
 };
 async function deployContainerApp(provider, appDir, scan, rawProjectName, options, appEnv = {}) {
   const projectName = normalizeProjectName(rawProjectName);
-  if (scan.isSvelteKit && !scan.nodeAdapterInstalled) {
-    return err(
-      HaiDeployError.ADAPTER_MISSING,
-      deployM("deploy_adapterMissing", { params: { adapter: "@sveltejs/adapter-node" } })
-    );
+  let artifact;
+  let artifactDir = options?.artifactDir ?? resolveArtifactDirectory(appDir);
+  try {
+    if (existsSync(join(artifactDir, "latest"))) {
+      const latest = readFileSync(join(artifactDir, "latest"), "utf8").trim();
+      if (!/^[a-z0-9][\w.+-]*$/i.test(latest))
+        throw new Error("Invalid artifact pointer");
+      artifactDir = join(artifactDir, latest);
+    }
+    artifact = await readDeploymentArtifact(artifactDir);
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
+  }
+  if (artifact.partial && !options?.selectedServices) {
+    const selectedServices = artifact.images.map((image) => image.name);
+    options = {
+      ...options,
+      selectedServices,
+      serviceModes: {
+        ...options?.serviceModes,
+        ...Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"]))
+      }
+    };
   }
+  if (!options?.bundleOnly && currentConfig?.provider.type === "docker-ssh" && !currentConfig.provider.ssh)
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
   let provisionEnv = {};
-  if (!options?.skipProvision) {
+  if (!options?.skipMiddleware) {
     const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
     if (!provResults.success) {
       return err(provResults.error);
     }
     provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
   }
-  return provider.deploy({ appDir, projectName, scan, provisionEnv, appEnv, options });
+  return provider.deploy({ appDir, artifact, artifactDir, projectName, scan, provisionEnv, appEnv, options });
 }
 
 // ../deploy/src/deploy-middleware.ts
@@ -22277,6 +22729,6 @@ function describeMiddlewareBackend(backend) {
   return deployM(backend.purpose);
 }
 
-export { DEPLOY_MIDDLEWARE, DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, saveDeploymentEnvironment };
-//# sourceMappingURL=src-6PPBKQ6Q.js.map
-//# sourceMappingURL=src-6PPBKQ6Q.js.map
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
+//# sourceMappingURL=src-2V6VP4I5.js.map
+//# sourceMappingURL=src-2V6VP4I5.js.map