@h-ai/cli 0.1.0-alpha.66 → 0.1.0-alpha.68

package/dist/src-DSJJXM2F.js

@@ -0,0 +1,3849 @@
+#!/usr/bin/env node
+import { external_exports } from './chunk-FI56GONY.js';
+import './chunk-2H7UOFLK.js';
+import { createHash, randomBytes, randomUUID } from 'crypto';
+import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, renameSync, rmSync, statSync, readdirSync } from 'fs';
+import { resolve, join, basename, dirname, relative, sep } from 'path';
+import { core, err, ok } from '@h-ai/core';
+import process3 from 'process';
+import { parseEnv } from 'util';
+import { LineCounter, parseDocument, parse, stringify, parseAllDocuments } from 'yaml';
+import { homedir } from 'os';
+import { spawn } from 'child_process';
+import { readdir, readFile } from 'fs/promises';
+import { setTimeout as setTimeout$1 } from 'timers/promises';
+import { Buffer } from 'buffer';
+
+var DeploymentArtifactSchema = external_exports.object({
+  /** 清单格式版本，与应用版本和部署环境无关。 */
+  version: external_exports.literal(3),
+  /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
+  appVersion: external_exports.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
+  /** 本次构建标识；同一应用版本允许重复构建。 */
+  buildId: external_exports.string().regex(/^[a-z0-9][\w.+-]*$/i),
+  /** 只包含所选镜像的构建不能用于首次安装。 */
+  partial: external_exports.boolean().default(false),
+  /** API 单独构建时仍保留工程的 Web 拓扑。 */
+  hasWeb: external_exports.boolean().default(false),
+  /** 工程显式配置的应用端口，部分构建未包含 app 镜像时仍保留；缺省由部署配置决定。 */
+  appContainerPort: external_exports.number().int().min(1).max(65535).optional(),
+  /** 工程显式配置的 Web 端口，部分构建未包含 web 镜像时仍保留；缺省使用部署默认值。 */
+  webContainerPort: external_exports.number().int().min(1).max(65535).optional(),
+  /** 本次构建选择的镜像归档。 */
+  images: external_exports.array(external_exports.object({
+    /** app 为服务或独立应用，web 为同源 API 代理的静态前端。 */
+    name: external_exports.enum(["app", "web"]),
+    /** 相对于清单目录的 tar 文件名。 */
+    file: external_exports.string().regex(/^[\w.+-]+\.tar$/),
+    /** 归档导入后可直接使用的不可变镜像引用。 */
+    imageRef: external_exports.string().regex(/^[a-z0-9][a-z0-9./:_-]*:[a-z0-9_][a-z0-9_.-]*$/).refine((value) => !value.endsWith(":latest")),
+    /** tar 内容的 SHA-256，用于部署前校验。 */
+    sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+    /** 容器内部监听端口；服务器公开端口由部署选择。 */
+    containerPort: external_exports.number().int().min(1).max(65535).optional()
+  })).min(1).max(2).refine((images) => new Set(images.map((image) => image.name)).size === images.length)
+}).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`)).refine((artifact) => artifact.partial || artifact.images.some((image) => image.name === "app")).refine((artifact) => artifact.partial || !artifact.hasWeb || artifact.images.some((image) => image.name === "web"));
+async function artifactChecksum(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file))
+    hash.update(chunk);
+  return hash.digest("hex");
+}
+async function readDeploymentArtifact(directory) {
+  const artifact = DeploymentArtifactSchema.parse(JSON.parse(readFileSync(resolve(directory, "manifest.json"), "utf8")));
+  for (const image of artifact.images) {
+    const file = resolve(directory, image.file);
+    if (!existsSync(file) || !lstatSync(file).isFile() || lstatSync(file).isSymbolicLink() || await artifactChecksum(file) !== image.sha256)
+      throw new Error(`Invalid artifact: ${image.file}`);
+  }
+  return artifact;
+}
+
+// ../deploy/messages/en-US.json
+var en_US_default = {
+  deploy_notInitialized: "Deploy module not initialized, call deploy.init() first",
+  deploy_initFailed: "Deploy module initialization failed: {error}",
+  deploy_unsupportedProviderType: "Unsupported deploy provider type: {type}",
+  deploy_unsupportedProvisionerType: "Unsupported service provisioner type: {type}",
+  deploy_configTokenRequired: "Deploy provider token is required",
+  deploy_authRequired: "Authentication required",
+  deploy_authFailed: "Authentication failed: {error}",
+  deploy_projectCreateFailed: "Project creation failed: {error}",
+  deploy_uploadFailed: "Build output upload failed: {error}",
+  deploy_deployFailed: "Deployment failed: {error}",
+  deploy_provisionFailed: "Service provisioning failed: {service} - {error}",
+  deploy_adapterMissing: "Target platform adapter not found, please install {adapter}",
+  deploy_scanFailed: "Application scan failed: {error}",
+  deploy_envVarFailed: "Environment variable setup failed: {error}",
+  deploy_credentialError: "Credential read/write failed: {error}",
+  deploy_credentialInvalidKey: "Unsupported credential key: {key}. Only HAI_DEPLOY_* keys are allowed",
+  deploy_credentialSaved: "Credentials saved",
+  deploy_credentialLoaded: "Credentials loaded",
+  deploy_configError: "Deploy config error: {error}",
+  deploy_credentialMissing: "Missing credential fields: {fields}",
+  deploy_apiError: "{service} API error ({status})",
+  deploy_fileUploadFailed: "File upload failed ({status})",
+  deploy_provisionNoResult: "No connection info returned from {service}",
+  deploy_recoveryFailure: "Deployment stopped at {stage}; inspect the recovery details.",
+  deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use.",
+  deploy_commandTimeout: "Command timed out: {command}",
+  deploy_commandFailed: "Command failed ({command}): {error}",
+  deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
+  deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
+  deploy_imageTransferFailed: "Image transfer failed: {error}",
+  deploy_healthCheckFailed: "Health check failed, app not ready at {url}",
+  deploy_invalidEnvironment: "Use letters, numbers, underscores or hyphens for the environment; local/example are reserved.",
+  deploy_environmentMissing: "Environment file missing: {path}. Create and configure it before deploying.",
+  deploy_environmentReadFailed: "Cannot read deployment environment files; check syntax and permissions.",
+  deploy_environmentWriteFailed: "Cannot save deployment configuration; check file syntax and permissions.",
+  deploy_multipleApplications: "Multiple service packages found; specify the application directory.",
+  deploy_purposeSqlite: "Local relational database persisted in a volume",
+  deploy_purposeDatabase: "Relational database service for business data",
+  deploy_purposeMemory: "Per-process memory cache; cleared on restart, no external service",
+  deploy_purposeLocal: "Local filesystem storage persisted in a volume",
+  deploy_purposeCache: "Shared cache, sessions and distributed locks",
+  deploy_purposeStorage: "S3-compatible object storage for uploaded files",
+  deploy_purposeVector: "Vector indexing and similarity search",
+  deploy_purposeDisabled: "LDAP login is disabled; no directory service is created",
+  deploy_purposeLdap: "Directory account authentication; the default directory has no business users",
+  deploy_purposeConsole: "Messages go to application logs without delivery",
+  deploy_purposeEmail: "Email/HTTP delivery; the default SMTP container only captures test messages",
+  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota",
+  deploy_webProxyInvalid: "The API prefix must be an absolute path containing only letters, numbers, underscores, hyphens and slashes.",
+  deploy_artifactInvalid: "Image artifacts are missing or invalid. Run pnpm build --target docker, select valid --artifact-dir, or use pnpm run deploy --build.",
+  deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
+  deploy_bundleInstructions: "Bundle: {file}\nIncludes all images needed by selected services, including self-hosted middleware.\nWith SSH access, first edit deploy-target.json in the adjacent deployment directory using its _comments, then run deploy.ps1 (Windows) or deploy.sh (Linux/macOS) there. Both read this JSON; the sh entry also requires local awk.\nFor isolated servers, copy and extract the tar into a separate directory, then run sh apply.sh (uses the configured target directory).\nLinux requires Docker/Podman, Compose, sh, tar, sha256sum, awk, curl, util-linux flock and filesystem/container permissions on a filesystem supporting flock.\nNever delete or replace .deploy.lock; its lock releases after every holder exits or the server restarts. Inspect execution and recovery state after forced termination.\nPartial updates require a successful full installation with matching ports/layout. Steps return nonzero on failure; result-DEPLOYMENT_ID.json records the outcome.\nThe bundle contains private runtime configuration; transfer it securely.\nIncluded images:\n{images}",
+  deploy_bundleMetadata: "Application version: {version}\nBuild ID: {buildId}\nCompose file: {compose}",
+  deploy_targetHost: "Required: Linux server address or SSH alias. Replace SERVER_HOST before running either upload script.",
+  deploy_targetPort: "SSH port, integer 1-65535; default 22.",
+  deploy_targetUsername: "SSH login username; default deploy. Requires write access to directory and container runtime permissions.",
+  deploy_targetIdentityFile: "Optional private key path on the computer running the upload script. Prefer an absolute path; empty uses ssh-agent/default keys. HAI_DEPLOY_IDENTITY_FILE overrides it.",
+  deploy_targetKnownHostsFile: "Optional known_hosts path on the computer running the upload script. Prefer an absolute path; empty uses OpenSSH defaults. HAI_DEPLOY_KNOWN_HOSTS_FILE overrides it.",
+  deploy_targetStrictHostKeyChecking: "Boolean, default true: trust new host keys and reject changed keys. false disables host key checking.",
+  deploy_targetConnectTimeoutSeconds: "SSH connection timeout in seconds, integer 1-2147483647; default 10.",
+  deploy_targetDirectory: "Required absolute application directory on the Linux server; contains incoming packages, releases and successful current state. Parent-directory traversal is forbidden.",
+  deploy_targetBundle: "Required tar filename in the parent of this deployment directory. Keep the tar and this entire directory together when moving them.",
+  deploy_bundleOnlyContainer: "Compose bundle generation is supported only by docker-ssh.",
+  deploy_selectedContainerOnly: "Selected-service deployment requires a docker-ssh Compose destination.",
+  deploy_selectionInvalid: "Cannot deploy {service}: check the service name and build its image first.",
+  deploy_imageVersionRequired: "Specify an image version; latest is not allowed: {image}",
+  deploy_bundleRuntimeRequired: "Start local Podman/Docker to export middleware images, or prepare this complete offline bundle on the build machine.",
+  deploy_bundleFailed: "Package preparation or deployment failed: {reason}",
+  deploy_configFileInvalid: "Invalid YAML in {path}, line {line}. Check indentation, colons and quotes.",
+  deploy_configFileUnreadable: "Cannot read configuration file {path}. Check its path and permissions.",
+  deploy_bundleNameInvalid: "Bundle filenames may contain letters, numbers, dots, plus signs, hyphens and underscores; parent directories may contain spaces.",
+  deploy_secretsInvalid: "Middleware credentials are damaged or incomplete: {path}. Restore a backup; passwords are not regenerated because existing data may become inaccessible.",
+  deploy_storageArtifactRequired: "Storage initialization requires the application image. Select a complete artifact containing app with --artifact-dir, or run pnpm build --target docker --images app first.",
+  deploy_localStopped: "The local command process tree has been confirmed exited.",
+  deploy_localUnknown: "Local process tree termination is unconfirmed; inspect local execution state.",
+  deploy_localNotStarted: "The local command was not started.",
+  deploy_commandOutputFailed: "Command output or callback failed",
+  deploy_commandInputFailed: "Command input failed",
+  deploy_commandTreeActive: "Child processes remain active after the main command exited",
+  deploy_commandExecutionFailed: "Command execution failed",
+  deploy_remoteUnknown: "Remote execution is unknown. Local SSH termination does not prove remote deployment stopped; inspect the server result and actual containers.",
+  deploy_remoteFinished: "A matching server result confirms the deployment script and recovery finished: stage {stage}, exit {code}. Verify actual service health."
+};
+
+// ../deploy/messages/ja-JP.json
+var ja_JP_default = {
+  deploy_notInitialized: "\u30C7\u30D7\u30ED\u30A4\u30E2\u30B8\u30E5\u30FC\u30EB\u304C\u521D\u671F\u5316\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u5148\u306Bdeploy.init()\u3092\u547C\u3073\u51FA\u3057\u3066\u304F\u3060\u3055\u3044",
+  deploy_initFailed: "\u30C7\u30D7\u30ED\u30A4\u30E2\u30B8\u30E5\u30FC\u30EB\u306E\u521D\u671F\u5316\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_unsupportedProviderType: "\u672A\u5BFE\u5FDC\u306E\u30C7\u30D7\u30ED\u30A4\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u7A2E\u985E\u3067\u3059: {type}",
+  deploy_unsupportedProvisionerType: "\u672A\u5BFE\u5FDC\u306E\u30B5\u30FC\u30D3\u30B9\u30D7\u30ED\u30D3\u30B8\u30E7\u30CA\u30FC\u306E\u7A2E\u985E\u3067\u3059: {type}",
+  deploy_configTokenRequired: "\u30C7\u30D7\u30ED\u30A4\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u30C8\u30FC\u30AF\u30F3\u306F\u5FC5\u9808\u3067\u3059",
+  deploy_authRequired: "\u8A8D\u8A3C\u304C\u5FC5\u8981\u3067\u3059",
+  deploy_authFailed: "\u8A8D\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_projectCreateFailed: "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_uploadFailed: "\u30D3\u30EB\u30C9\u6210\u679C\u7269\u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_deployFailed: "\u30C7\u30D7\u30ED\u30A4\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_provisionFailed: "\u30B5\u30FC\u30D3\u30B9\u306E\u6E96\u5099\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {service} - {error}",
+  deploy_adapterMissing: "\u5BFE\u8C61\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u306E\u30A2\u30C0\u30D7\u30BF\u30FC\u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002{adapter}\u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3057\u3066\u304F\u3060\u3055\u3044",
+  deploy_scanFailed: "\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u306E\u30B9\u30AD\u30E3\u30F3\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_envVarFailed: "\u74B0\u5883\u5909\u6570\u306E\u8A2D\u5B9A\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_credentialError: "\u8A8D\u8A3C\u60C5\u5831\u306E\u8AAD\u307F\u66F8\u304D\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_credentialInvalidKey: "\u672A\u5BFE\u5FDC\u306E\u8A8D\u8A3C\u60C5\u5831\u30AD\u30FC\u3067\u3059: {key}\u3002HAI_DEPLOY_*\u30AD\u30FC\u306E\u307F\u4F7F\u7528\u3067\u304D\u307E\u3059",
+  deploy_credentialSaved: "\u8A8D\u8A3C\u60C5\u5831\u3092\u4FDD\u5B58\u3057\u307E\u3057\u305F",
+  deploy_credentialLoaded: "\u8A8D\u8A3C\u60C5\u5831\u3092\u8AAD\u307F\u8FBC\u307F\u307E\u3057\u305F",
+  deploy_configError: "\u30C7\u30D7\u30ED\u30A4\u8A2D\u5B9A\u30A8\u30E9\u30FC: {error}",
+  deploy_credentialMissing: "\u8A8D\u8A3C\u60C5\u5831\u306E\u9805\u76EE\u304C\u4E0D\u8DB3\u3057\u3066\u3044\u307E\u3059: {fields}",
+  deploy_apiError: "{service} API\u30A8\u30E9\u30FC\uFF08{status}\uFF09",
+  deploy_fileUploadFailed: "\u30D5\u30A1\u30A4\u30EB\u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF08{status}\uFF09",
+  deploy_provisionNoResult: "{service}\u304B\u3089\u63A5\u7D9A\u60C5\u5831\u304C\u8FD4\u3055\u308C\u307E\u305B\u3093\u3067\u3057\u305F",
+  deploy_recoveryFailure: "{stage}\u3067\u30C7\u30D7\u30ED\u30A4\u3092\u505C\u6B62\u3057\u307E\u3057\u305F\u3002\u5FA9\u65E7\u60C5\u5831\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_recoverySuggestion: "\u540C\u3058\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u540D\u3067\u518D\u8A66\u884C\u3059\u308B\u524D\u306B\u3001\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u30B3\u30F3\u30BD\u30FC\u30EB\u3067\u8A18\u8F09\u3055\u308C\u305F\u30EA\u30BD\u30FC\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u300C\u4E0D\u660E\u300D\u306F\u3001\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u3088\u3063\u3066\u30EA\u30BD\u30FC\u30B9\u304C\u4F5C\u6210\u3055\u308C\u305F\u53EF\u80FD\u6027\u3092\u793A\u3057\u307E\u3059\u3002\u518D\u5229\u7528\u3057\u305F\u30EA\u30BD\u30FC\u30B9\u306F\u81EA\u52D5\u524A\u9664\u3055\u308C\u307E\u305B\u3093\u3002\u65B0\u898F\u30EA\u30BD\u30FC\u30B9\u306F\u4F7F\u7528\u72B6\u6CC1\u3092\u78BA\u8A8D\u3057\u3066\u304B\u3089\u624B\u52D5\u3067\u524A\u9664\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_commandTimeout: "\u30B3\u30DE\u30F3\u30C9\u304C\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\u3057\u307E\u3057\u305F: {command}",
+  deploy_commandFailed: "\u30B3\u30DE\u30F3\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF08{command}\uFF09: {error}",
+  deploy_remoteConnectFailed: "\u30EA\u30E2\u30FC\u30C8\u30DB\u30B9\u30C8{host}\u306B\u63A5\u7D9A\u3067\u304D\u307E\u305B\u3093: {error}",
+  deploy_remoteRuntimeMissing: "\u30EA\u30E2\u30FC\u30C8\u30DB\u30B9\u30C8\u306B\u30B3\u30F3\u30C6\u30CA\u30FC\u30E9\u30F3\u30BF\u30A4\u30E0\u307E\u305F\u306Fcompose\u304C\u3042\u308A\u307E\u305B\u3093: {runtime}",
+  deploy_imageTransferFailed: "\u30A4\u30E1\u30FC\u30B8\u306E\u8EE2\u9001\u306B\u5931\u6557\u3057\u307E\u3057\u305F: {error}",
+  deploy_healthCheckFailed: "\u30D8\u30EB\u30B9\u30C1\u30A7\u30C3\u30AF\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002{url}\u3067\u30A2\u30D7\u30EA\u306E\u6E96\u5099\u304C\u5B8C\u4E86\u3057\u3066\u3044\u307E\u305B\u3093",
+  deploy_invalidEnvironment: "\u74B0\u5883\u540D\u306B\u306F\u82F1\u6570\u5B57\u3001\u30A2\u30F3\u30C0\u30FC\u30B9\u30B3\u30A2\u3001\u30CF\u30A4\u30D5\u30F3\u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002local/example\u306F\u4E88\u7D04\u3055\u308C\u3066\u3044\u307E\u3059\u3002",
+  deploy_environmentMissing: "\u74B0\u5883\u30D5\u30A1\u30A4\u30EB\u304C\u3042\u308A\u307E\u305B\u3093: {path}\u3002\u30C7\u30D7\u30ED\u30A4\u524D\u306B\u4F5C\u6210\u3057\u3066\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_environmentReadFailed: "\u30C7\u30D7\u30ED\u30A4\u7528\u306E\u74B0\u5883\u30D5\u30A1\u30A4\u30EB\u3092\u8AAD\u307F\u53D6\u308C\u307E\u305B\u3093\u3002\u69CB\u6587\u3068\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_environmentWriteFailed: "\u30C7\u30D7\u30ED\u30A4\u8A2D\u5B9A\u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3002\u30D5\u30A1\u30A4\u30EB\u306E\u69CB\u6587\u3068\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_multipleApplications: "\u30B5\u30FC\u30D3\u30B9\u30D1\u30C3\u30B1\u30FC\u30B8\u304C\u8907\u6570\u898B\u3064\u304B\u308A\u307E\u3057\u305F\u3002\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_purposeSqlite: "\u30DC\u30EA\u30E5\u30FC\u30E0\u306B\u6C38\u7D9A\u5316\u3059\u308B\u30ED\u30FC\u30AB\u30EB\u30EA\u30EC\u30FC\u30B7\u30E7\u30CA\u30EB\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9",
+  deploy_purposeDatabase: "\u696D\u52D9\u30C7\u30FC\u30BF\u7528\u306E\u30EA\u30EC\u30FC\u30B7\u30E7\u30CA\u30EB\u30C7\u30FC\u30BF\u30D9\u30FC\u30B9\u30B5\u30FC\u30D3\u30B9",
+  deploy_purposeMemory: "\u30D7\u30ED\u30BB\u30B9\u5358\u4F4D\u306E\u30E1\u30E2\u30EA\u30FC\u30AD\u30E3\u30C3\u30B7\u30E5\u3002\u518D\u8D77\u52D5\u6642\u306B\u6D88\u53BB\u3055\u308C\u3001\u5916\u90E8\u30B5\u30FC\u30D3\u30B9\u306F\u4F7F\u7528\u3057\u307E\u305B\u3093",
+  deploy_purposeLocal: "\u30DC\u30EA\u30E5\u30FC\u30E0\u306B\u6C38\u7D9A\u5316\u3059\u308B\u30ED\u30FC\u30AB\u30EB\u30D5\u30A1\u30A4\u30EB\u30B9\u30C8\u30EC\u30FC\u30B8",
+  deploy_purposeCache: "\u5171\u6709\u30AD\u30E3\u30C3\u30B7\u30E5\u3001\u30BB\u30C3\u30B7\u30E7\u30F3\u3001\u5206\u6563\u30ED\u30C3\u30AF",
+  deploy_purposeStorage: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30D5\u30A1\u30A4\u30EB\u7528\u306ES3\u4E92\u63DB\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8\u30B9\u30C8\u30EC\u30FC\u30B8",
+  deploy_purposeVector: "\u30D9\u30AF\u30C8\u30EB\u306E\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u4F5C\u6210\u3068\u985E\u4F3C\u691C\u7D22",
+  deploy_purposeDisabled: "LDAP\u30ED\u30B0\u30A4\u30F3\u306F\u7121\u52B9\u3067\u3059\u3002\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30B5\u30FC\u30D3\u30B9\u306F\u4F5C\u6210\u3057\u307E\u305B\u3093",
+  deploy_purposeLdap: "\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u30A2\u30AB\u30A6\u30F3\u30C8\u8A8D\u8A3C\u3002\u65E2\u5B9A\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306B\u306F\u696D\u52D9\u30E6\u30FC\u30B6\u30FC\u306F\u3044\u307E\u305B\u3093",
+  deploy_purposeConsole: "\u914D\u4FE1\u305B\u305A\u3001\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u30ED\u30B0\u306B\u30E1\u30C3\u30BB\u30FC\u30B8\u3092\u51FA\u529B\u3057\u307E\u3059",
+  deploy_purposeEmail: "\u30E1\u30FC\u30EB/HTTP\u914D\u4FE1\u3002\u65E2\u5B9A\u306ESMTP\u30B3\u30F3\u30C6\u30CA\u30FC\u306F\u30C6\u30B9\u30C8\u30E1\u30C3\u30BB\u30FC\u30B8\u306E\u307F\u53D7\u4FE1\u3057\u307E\u3059",
+  deploy_purposeSms: "Aliyun\u306E\u8A8D\u8A3C\u60C5\u5831\u306B\u3088\u308BSMS\u3002\u65E2\u5B58\u306E\u7F72\u540D\u3068\u5229\u7528\u67A0\u304C\u5FC5\u8981\u3067\u3059",
+  deploy_webProxyInvalid: "API\u30D7\u30EC\u30D5\u30A3\u30C3\u30AF\u30B9\u306F\u3001\u82F1\u6570\u5B57\u3001\u30A2\u30F3\u30C0\u30FC\u30B9\u30B3\u30A2\u3001\u30CF\u30A4\u30D5\u30F3\u3001\u30B9\u30E9\u30C3\u30B7\u30E5\u306E\u307F\u3092\u542B\u3080\u7D76\u5BFE\u30D1\u30B9\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_artifactInvalid: "\u30A4\u30E1\u30FC\u30B8\u6210\u679C\u7269\u304C\u5B58\u5728\u3057\u306A\u3044\u304B\u3001\u7121\u52B9\u3067\u3059\u3002pnpm build --target docker \u3092\u5B9F\u884C\u3059\u308B\u304B\u3001--artifact-dir \u3067\u6709\u52B9\u306A\u6210\u679C\u7269\u3092\u9078\u629E\u3059\u308B\u304B\u3001pnpm run deploy --build \u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_sshRequired: "\u81EA\u52D5\u30C7\u30D7\u30ED\u30A4\u306B\u306FSSH\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059\u3002\u30B5\u30FC\u30D0\u30FC\u306B\u63A5\u7D9A\u3067\u304D\u306A\u3044\u5834\u5408\u306F--bundle-only\u3067\u624B\u52D5\u8EE2\u9001\u7528\u306E\u30D0\u30F3\u30C9\u30EB\u3092\u751F\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleInstructions: "\u30D0\u30F3\u30C9\u30EB\uFF1A{file}\n\u9078\u629E\u3057\u305F\u30B5\u30FC\u30D3\u30B9\u306B\u5FC5\u8981\u306A\u3059\u3079\u3066\u306E\u30A4\u30E1\u30FC\u30B8\u3092\u542B\u307F\u307E\u3059\uFF08\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8\u306E\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u3092\u542B\u3080\uFF09\u3002\nSSH \u3092\u4F7F\u7528\u3059\u308B\u5834\u5408\u3001\u96A3\u63A5\u3059\u308B\u30C7\u30D7\u30ED\u30A4\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E deploy-target.json \u3092 _comments \u306B\u5F93\u3063\u3066\u7DE8\u96C6\u3057\u3001\u540C\u3058\u5834\u6240\u3067 deploy.ps1\uFF08Windows\uFF09\u307E\u305F\u306F deploy.sh\uFF08Linux/macOS\uFF09\u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u4E21\u65B9\u3068\u3082\u3053\u306E JSON \u3092\u8AAD\u307F\u8FBC\u307F\u307E\u3059\u3002sh \u306E\u5B9F\u884C\u306B\u306F\u30ED\u30FC\u30AB\u30EB\u306E awk \u3082\u5FC5\u8981\u3067\u3059\u3002\n\u9694\u96E2\u3055\u308C\u305F\u30B5\u30FC\u30D0\u30FC\u3067\u306F\u3001tar \u3092\u5225\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3078\u30B3\u30D4\u30FC\u3057\u3066\u5C55\u958B\u3057\u3001sh apply.sh \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\uFF08\u8A2D\u5B9A\u3055\u308C\u305F\u5BFE\u8C61\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u4F7F\u7528\u3057\u307E\u3059\uFF09\u3002\nLinux \u306B\u306F Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk\u3001curl\u3001util-linux \u306E flock \u304C\u5FC5\u8981\u3067\u3059\u3002flock \u306B\u5BFE\u5FDC\u3057\u305F\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0\u4E0A\u3067\u3001\u30D5\u30A1\u30A4\u30EB\u30B7\u30B9\u30C6\u30E0\u3068\u30B3\u30F3\u30C6\u30CA\u30FC\u306E\u64CD\u4F5C\u6A29\u9650\u3082\u5FC5\u8981\u3067\u3059\u3002\n.deploy.lock \u306F\u524A\u9664\u3082\u7F6E\u63DB\u3082\u3057\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002\u3059\u3079\u3066\u306E\u4FDD\u6301\u30D7\u30ED\u30BB\u30B9\u304C\u7D42\u4E86\u3059\u308B\u304B\u3001\u30B5\u30FC\u30D0\u30FC\u304C\u518D\u8D77\u52D5\u3059\u308B\u3068\u30ED\u30C3\u30AF\u304C\u89E3\u653E\u3055\u308C\u307E\u3059\u3002\u5F37\u5236\u7D42\u4E86\u5F8C\u306F\u5B9F\u884C\u72B6\u614B\u3068\u5FA9\u65E7\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\n\u90E8\u5206\u66F4\u65B0\u306B\u306F\u30DD\u30FC\u30C8\u3068\u69CB\u6210\u304C\u4E00\u81F4\u3059\u308B\u6B63\u5E38\u306A\u5B8C\u5168\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u304C\u5FC5\u8981\u3067\u3059\u3002\u5404\u624B\u9806\u306F\u5931\u6557\u6642\u306B\u975E\u30BC\u30ED\u3067\u7D42\u4E86\u3057\u3001result-DEPLOYMENT_ID.json \u306B\u7D50\u679C\u3092\u8A18\u9332\u3057\u307E\u3059\u3002\n\u30D0\u30F3\u30C9\u30EB\u306B\u306F\u975E\u516C\u958B\u306E\u5B9F\u884C\u6642\u8A2D\u5B9A\u304C\u542B\u307E\u308C\u307E\u3059\u3002\u5B89\u5168\u306B\u8EE2\u9001\u3057\u3066\u304F\u3060\u3055\u3044\u3002\n\u540C\u68B1\u30A4\u30E1\u30FC\u30B8\uFF1A\n{images}",
+  deploy_bundleMetadata: "\u30A2\u30D7\u30EA\u306E\u30D0\u30FC\u30B8\u30E7\u30F3: {version}\n\u30D3\u30EB\u30C9ID: {buildId}\nCompose\u30D5\u30A1\u30A4\u30EB: {compose}",
+  deploy_targetHost: "\u5FC5\u9808\uFF1ALinux \u30B5\u30FC\u30D0\u30FC\u306E\u30A2\u30C9\u30EC\u30B9\u307E\u305F\u306F SSH \u30A8\u30A4\u30EA\u30A2\u30B9\u3002\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u5B9F\u884C\u3059\u308B\u524D\u306B SERVER_HOST \u3092\u7F6E\u304D\u63DB\u3048\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_targetPort: "SSH \u30DD\u30FC\u30C8\u30021\u301C65535\u306E\u6574\u6570\u3002\u65E2\u5B9A\u5024\u306F22\u3067\u3059\u3002",
+  deploy_targetUsername: "SSH \u30ED\u30B0\u30A4\u30F3\u30E6\u30FC\u30B6\u30FC\u540D\u3002\u65E2\u5B9A\u5024\u306F deploy \u3067\u3059\u3002\u5BFE\u8C61\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3078\u306E\u66F8\u304D\u8FBC\u307F\u6A29\u9650\u3068\u30B3\u30F3\u30C6\u30CA\u30FC\u30E9\u30F3\u30BF\u30A4\u30E0\u306E\u64CD\u4F5C\u6A29\u9650\u304C\u5FC5\u8981\u3067\u3059\u3002",
+  deploy_targetIdentityFile: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u5B9F\u884C\u3059\u308B\u7AEF\u672B\u4E0A\u306E\u79D8\u5BC6\u9375\u30D1\u30B9\uFF08\u7701\u7565\u53EF\uFF09\u3002\u7D76\u5BFE\u30D1\u30B9\u3092\u63A8\u5968\u3057\u307E\u3059\u3002\u7A7A\u6B04\u3067\u306F ssh-agent \u307E\u305F\u306F\u65E2\u5B9A\u306E\u9375\u3092\u4F7F\u7528\u3057\u307E\u3059\u3002HAI_DEPLOY_IDENTITY_FILE \u3067\u4E0A\u66F8\u304D\u3067\u304D\u307E\u3059\u3002",
+  deploy_targetKnownHostsFile: "\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u30B9\u30AF\u30EA\u30D7\u30C8\u3092\u5B9F\u884C\u3059\u308B\u7AEF\u672B\u4E0A\u306E known_hosts \u30D1\u30B9\uFF08\u7701\u7565\u53EF\uFF09\u3002\u7D76\u5BFE\u30D1\u30B9\u3092\u63A8\u5968\u3057\u307E\u3059\u3002\u7A7A\u6B04\u3067\u306F OpenSSH \u306E\u65E2\u5B9A\u5024\u3092\u4F7F\u7528\u3057\u307E\u3059\u3002HAI_DEPLOY_KNOWN_HOSTS_FILE \u3067\u4E0A\u66F8\u304D\u3067\u304D\u307E\u3059\u3002",
+  deploy_targetStrictHostKeyChecking: "\u771F\u507D\u5024\u3002\u65E2\u5B9A\u5024\u306E true \u306F\u65B0\u3057\u3044\u30DB\u30B9\u30C8\u9375\u3092\u4FE1\u983C\u3057\u3001\u5909\u66F4\u3055\u308C\u305F\u9375\u3092\u62D2\u5426\u3057\u307E\u3059\u3002false \u306F\u30DB\u30B9\u30C8\u9375\u306E\u691C\u8A3C\u3092\u7121\u52B9\u306B\u3057\u307E\u3059\u3002",
+  deploy_targetConnectTimeoutSeconds: "SSH \u63A5\u7D9A\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8\uFF08\u79D2\uFF09\u30021\u301C2147483647\u306E\u6574\u6570\u3002\u65E2\u5B9A\u5024\u306F10\u3067\u3059\u3002",
+  deploy_targetDirectory: "\u5FC5\u9808\uFF1ALinux \u30B5\u30FC\u30D0\u30FC\u4E0A\u306E\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u306E\u7D76\u5BFE\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3002\u53D7\u4FE1\u30D1\u30C3\u30B1\u30FC\u30B8\u3001\u30EA\u30EA\u30FC\u30B9\u3001\u6210\u529F\u6642\u306E current \u72B6\u614B\u3092\u4FDD\u5B58\u3057\u307E\u3059\u3002\u89AA\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3078\u306E\u79FB\u52D5\u306F\u8A31\u53EF\u3055\u308C\u307E\u305B\u3093\u3002",
+  deploy_targetBundle: "\u5FC5\u9808\uFF1A\u3053\u306E\u30C7\u30D7\u30ED\u30A4\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E\u89AA\u306B\u3042\u308B tar \u30D5\u30A1\u30A4\u30EB\u540D\u3002\u79FB\u52D5\u6642\u306F tar \u3068\u3053\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u5168\u4F53\u3092\u4E00\u7DD2\u306B\u79FB\u52D5\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleOnlyContainer: "Compose\u30D0\u30F3\u30C9\u30EB\u306E\u751F\u6210\u306Fdocker-ssh\u306E\u307F\u3067\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u307E\u3059\u3002",
+  deploy_selectedContainerOnly: "\u30B5\u30FC\u30D3\u30B9\u3092\u9078\u629E\u3057\u305F\u30C7\u30D7\u30ED\u30A4\u306B\u306F docker-ssh Compose \u306E\u30C7\u30D7\u30ED\u30A4\u5148\u304C\u5FC5\u8981\u3067\u3059\u3002",
+  deploy_selectionInvalid: "{service} \u3092\u30C7\u30D7\u30ED\u30A4\u3067\u304D\u307E\u305B\u3093\u3002\u30B5\u30FC\u30D3\u30B9\u540D\u3092\u78BA\u8A8D\u3057\u3001\u5148\u306B\u30A4\u30E1\u30FC\u30B8\u3092\u30D3\u30EB\u30C9\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_imageVersionRequired: "\u30A4\u30E1\u30FC\u30B8\u306E\u30D0\u30FC\u30B8\u30E7\u30F3\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002latest \u306F\u4F7F\u7528\u3067\u304D\u307E\u305B\u3093\uFF1A{image}",
+  deploy_bundleRuntimeRequired: "\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u30A4\u30E1\u30FC\u30B8\u3092\u30A8\u30AF\u30B9\u30DD\u30FC\u30C8\u3059\u308B\u306B\u306F\u30ED\u30FC\u30AB\u30EB\u306E Podman/Docker \u3092\u8D77\u52D5\u3059\u308B\u304B\u3001\u30D3\u30EB\u30C9\u7AEF\u672B\u3067\u5B8C\u5168\u306A\u30AA\u30D5\u30E9\u30A4\u30F3\u30D0\u30F3\u30C9\u30EB\u3092\u4F5C\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleFailed: "\u30D1\u30C3\u30B1\u30FC\u30B8\u306E\u6E96\u5099\u307E\u305F\u306F\u30C7\u30D7\u30ED\u30A4\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF1A{reason}",
+  deploy_configFileInvalid: "{path} \u306E {line} \u884C\u76EE\u306E YAML \u304C\u7121\u52B9\u3067\u3059\u3002\u30A4\u30F3\u30C7\u30F3\u30C8\u3001\u30B3\u30ED\u30F3\u3001\u5F15\u7528\u7B26\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_configFileUnreadable: "\u8A2D\u5B9A\u30D5\u30A1\u30A4\u30EB {path} \u3092\u8AAD\u307F\u8FBC\u3081\u307E\u305B\u3093\u3002\u30D1\u30B9\u3068\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_bundleNameInvalid: "\u30D0\u30F3\u30C9\u30EB\u306E\u30D5\u30A1\u30A4\u30EB\u540D\u306B\u306F\u82F1\u6570\u5B57\u3001\u30C9\u30C3\u30C8\u3001\u30D7\u30E9\u30B9\u3001\u30CF\u30A4\u30D5\u30F3\u3001\u30A2\u30F3\u30C0\u30FC\u30B9\u30B3\u30A2\u3092\u4F7F\u7528\u3067\u304D\u307E\u3059\u3002\u89AA\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306B\u306F\u7A7A\u767D\u3092\u4F7F\u7528\u3067\u304D\u307E\u3059\u3002",
+  deploy_secretsInvalid: "\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u306E\u8A8D\u8A3C\u60C5\u5831\u304C\u7834\u640D\u3057\u3066\u3044\u308B\u304B\u3001\u4E0D\u5B8C\u5168\u3067\u3059\uFF1A{path}\u3002\u30D0\u30C3\u30AF\u30A2\u30C3\u30D7\u3092\u5FA9\u5143\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u65E2\u5B58\u30C7\u30FC\u30BF\u306B\u30A2\u30AF\u30BB\u30B9\u3067\u304D\u306A\u304F\u306A\u308B\u53EF\u80FD\u6027\u304C\u3042\u308B\u305F\u3081\u3001\u30D1\u30B9\u30EF\u30FC\u30C9\u306F\u518D\u751F\u6210\u3057\u307E\u305B\u3093\u3002",
+  deploy_storageArtifactRequired: "\u30B9\u30C8\u30EC\u30FC\u30B8\u306E\u521D\u671F\u5316\u306B\u306F\u30A2\u30D7\u30EA\u30B1\u30FC\u30B7\u30E7\u30F3\u30A4\u30E1\u30FC\u30B8\u304C\u5FC5\u8981\u3067\u3059\u3002--artifact-dir \u3067 app \u3092\u542B\u3080\u5B8C\u5168\u306A\u6210\u679C\u7269\u3092\u9078\u629E\u3059\u308B\u304B\u3001\u5148\u306B pnpm build --target docker --images app \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_localStopped: "\u30ED\u30FC\u30AB\u30EB\u30B3\u30DE\u30F3\u30C9\u306E\u30D7\u30ED\u30BB\u30B9\u30C4\u30EA\u30FC\u306E\u7D42\u4E86\u3092\u78BA\u8A8D\u3057\u307E\u3057\u305F\u3002",
+  deploy_localUnknown: "\u30ED\u30FC\u30AB\u30EB\u30D7\u30ED\u30BB\u30B9\u30C4\u30EA\u30FC\u306E\u7D42\u4E86\u306F\u672A\u78BA\u8A8D\u3067\u3059\u3002\u30ED\u30FC\u30AB\u30EB\u306E\u5B9F\u884C\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_localNotStarted: "\u30ED\u30FC\u30AB\u30EB\u30B3\u30DE\u30F3\u30C9\u306F\u8D77\u52D5\u3057\u3066\u3044\u307E\u305B\u3093\u3002",
+  deploy_commandOutputFailed: "\u30B3\u30DE\u30F3\u30C9\u51FA\u529B\u307E\u305F\u306F\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  deploy_commandInputFailed: "\u30B3\u30DE\u30F3\u30C9\u5165\u529B\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  deploy_commandTreeActive: "\u30E1\u30A4\u30F3\u30B3\u30DE\u30F3\u30C9\u7D42\u4E86\u5F8C\u3082\u5B50\u30D7\u30ED\u30BB\u30B9\u304C\u52D5\u4F5C\u3057\u3066\u3044\u307E\u3059",
+  deploy_commandExecutionFailed: "\u30B3\u30DE\u30F3\u30C9\u306E\u5B9F\u884C\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+  deploy_remoteUnknown: "\u30EA\u30E2\u30FC\u30C8\u306E\u5B9F\u884C\u72B6\u614B\u306F\u4E0D\u660E\u3067\u3059\u3002\u30ED\u30FC\u30AB\u30EB SSH \u306E\u7D42\u4E86\u306F\u30EA\u30E2\u30FC\u30C8\u30C7\u30D7\u30ED\u30A4\u306E\u505C\u6B62\u3092\u610F\u5473\u3057\u307E\u305B\u3093\u3002\u30B5\u30FC\u30D0\u30FC\u306E\u7D50\u679C\u3068\u5B9F\u969B\u306E\u30B3\u30F3\u30C6\u30CA\u30FC\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_remoteFinished: "\u5BFE\u5FDC\u3059\u308B\u30B5\u30FC\u30D0\u30FC\u306E\u7D50\u679C\u306B\u3088\u308A\u3001\u30C7\u30D7\u30ED\u30A4\u30B9\u30AF\u30EA\u30D7\u30C8\u3068\u5FA9\u65E7\u51E6\u7406\u306E\u7D42\u4E86\u3092\u78BA\u8A8D\u3057\u307E\u3057\u305F\uFF1A\u6BB5\u968E {stage}\u3001\u7D42\u4E86\u30B3\u30FC\u30C9 {code}\u3002\u5B9F\u969B\u306E\u30B5\u30FC\u30D3\u30B9\u306E\u7A3C\u50CD\u72B6\u614B\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+};
+
+// ../deploy/messages/zh-CN.json
+var zh_CN_default = {
+  deploy_notInitialized: "Deploy \u6A21\u5757\u5C1A\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 deploy.init()",
+  deploy_initFailed: "Deploy \u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF1A{error}",
+  deploy_unsupportedProviderType: "\u4E0D\u652F\u6301\u7684\u90E8\u7F72\u5E73\u53F0\u7C7B\u578B\uFF1A{type}",
+  deploy_unsupportedProvisionerType: "\u4E0D\u652F\u6301\u7684\u670D\u52A1 Provisioner \u7C7B\u578B\uFF1A{type}",
+  deploy_configTokenRequired: "\u90E8\u7F72\u5E73\u53F0 Token \u4E0D\u80FD\u4E3A\u7A7A",
+  deploy_authRequired: "\u8BF7\u5148\u5B8C\u6210\u8BA4\u8BC1",
+  deploy_authFailed: "\u8BA4\u8BC1\u5931\u8D25\uFF1A{error}",
+  deploy_projectCreateFailed: "\u9879\u76EE\u521B\u5EFA\u5931\u8D25\uFF1A{error}",
+  deploy_uploadFailed: "\u6784\u5EFA\u4EA7\u7269\u4E0A\u4F20\u5931\u8D25\uFF1A{error}",
+  deploy_deployFailed: "\u90E8\u7F72\u5931\u8D25\uFF1A{error}",
+  deploy_provisionFailed: "\u57FA\u7840\u8BBE\u65BD\u5F00\u901A\u5931\u8D25\uFF1A{service} - {error}",
+  deploy_adapterMissing: "\u672A\u68C0\u6D4B\u5230\u76EE\u6807\u5E73\u53F0 adapter\uFF0C\u8BF7\u5B89\u88C5 {adapter}",
+  deploy_scanFailed: "\u5E94\u7528\u626B\u63CF\u5931\u8D25\uFF1A{error}",
+  deploy_envVarFailed: "\u73AF\u5883\u53D8\u91CF\u8BBE\u7F6E\u5931\u8D25\uFF1A{error}",
+  deploy_credentialError: "\u51ED\u8BC1\u8BFB\u5199\u5931\u8D25\uFF1A{error}",
+  deploy_credentialInvalidKey: "\u4E0D\u652F\u6301\u7684\u51ED\u8BC1\u952E\u540D\uFF1A{key}\u3002\u4EC5\u5141\u8BB8 HAI_DEPLOY_*",
+  deploy_credentialSaved: "\u51ED\u8BC1\u5DF2\u4FDD\u5B58",
+  deploy_credentialLoaded: "\u51ED\u8BC1\u5DF2\u52A0\u8F7D",
+  deploy_configError: "\u90E8\u7F72\u914D\u7F6E\u9519\u8BEF\uFF1A{error}",
+  deploy_credentialMissing: "\u7F3A\u5C11\u51ED\u8BC1\u5B57\u6BB5\uFF1A{fields}",
+  deploy_apiError: "{service} API \u8BF7\u6C42\u5931\u8D25\uFF08{status}\uFF09",
+  deploy_fileUploadFailed: "\u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF08{status}\uFF09",
+  deploy_provisionNoResult: "{service} \u672A\u8FD4\u56DE\u8FDE\u63A5\u4FE1\u606F",
+  deploy_recoveryFailure: "\u90E8\u7F72\u5728 {stage} \u9636\u6BB5\u505C\u6B62\uFF0C\u8BF7\u67E5\u770B\u6062\u590D\u6E05\u5355\u3002",
+  deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002",
+  deploy_commandTimeout: "\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF1A{command}",
+  deploy_commandFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF08{command}\uFF09\uFF1A{error}",
+  deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
+  deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
+  deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
+  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA",
+  deploy_invalidEnvironment: "\u73AF\u5883\u540D\u79F0\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26\uFF0C\u4E14\u4E0D\u80FD\u4F7F\u7528 local/example\u3002",
+  deploy_environmentMissing: "\u7F3A\u5C11\u73AF\u5883\u914D\u7F6E {path}\uFF1B\u8BF7\u5148\u521B\u5EFA\u8BE5\u6587\u4EF6\u5E76\u5B8C\u6210\u914D\u7F6E\uFF0C\u518D\u91CD\u65B0\u90E8\u7F72\u3002",
+  deploy_environmentReadFailed: "\u90E8\u7F72\u73AF\u5883\u6587\u4EF6\u8BFB\u53D6\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
+  deploy_environmentWriteFailed: "\u90E8\u7F72\u914D\u7F6E\u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
+  deploy_multipleApplications: "\u53D1\u73B0\u591A\u4E2A\u670D\u52A1\u5305\uFF0C\u8BF7\u6307\u5B9A\u8981\u90E8\u7F72\u7684\u5E94\u7528\u76EE\u5F55\u3002",
+  deploy_purposeSqlite: "\u672C\u5730\u6587\u4EF6\u5173\u7CFB\u6570\u636E\u5E93\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
+  deploy_purposeDatabase: "\u72EC\u7ACB\u5173\u7CFB\u6570\u636E\u5E93\u670D\u52A1\uFF0C\u4FDD\u5B58\u4E1A\u52A1\u6570\u636E",
+  deploy_purposeMemory: "\u5355\u8FDB\u7A0B\u5185\u5B58\u7F13\u5B58\uFF0C\u91CD\u542F\u540E\u6E05\u7A7A\uFF0C\u4E0D\u521B\u5EFA\u5916\u90E8\u670D\u52A1",
+  deploy_purposeLocal: "\u672C\u5730\u6587\u4EF6\u5B58\u50A8\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
+  deploy_purposeCache: "\u5171\u4EAB\u7F13\u5B58\u3001\u4F1A\u8BDD\u4E0E\u5206\u5E03\u5F0F\u9501",
+  deploy_purposeStorage: "S3 \u517C\u5BB9\u5BF9\u8C61\u5B58\u50A8\uFF0C\u4FDD\u5B58\u4E0A\u4F20\u6587\u4EF6",
+  deploy_purposeVector: "\u5411\u91CF\u7D22\u5F15\u4E0E\u76F8\u4F3C\u5EA6\u641C\u7D22",
+  deploy_purposeDisabled: "LDAP \u767B\u5F55\u672A\u542F\u7528\uFF0C\u4E0D\u521B\u5EFA\u76EE\u5F55\u670D\u52A1",
+  deploy_purposeLdap: "\u4F01\u4E1A\u76EE\u5F55\u8D26\u53F7\u8BA4\u8BC1\uFF1B\u9ED8\u8BA4\u76EE\u5F55\u4E0D\u5305\u542B\u4E1A\u52A1\u7528\u6237",
+  deploy_purposeConsole: "\u6D88\u606F\u8F93\u51FA\u5230\u5E94\u7528\u65E5\u5FD7\uFF0C\u4E0D\u5B9E\u9645\u6295\u9012",
+  deploy_purposeEmail: "\u90AE\u4EF6\u6216 HTTP \u901A\u77E5\u6295\u9012\uFF1B\u9ED8\u8BA4 SMTP \u5BB9\u5668\u4EC5\u7528\u4E8E\u6D4B\u8BD5\u63A5\u6536",
+  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6",
+  deploy_webProxyInvalid: "API \u524D\u7F00\u5FC5\u987B\u662F\u4EC5\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u8FDE\u5B57\u7B26\u548C\u659C\u6760\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002",
+  deploy_artifactInvalid: "\u955C\u50CF\u4EA7\u7269\u7F3A\u5931\u6216\u6821\u9A8C\u5931\u8D25\u3002\u8BF7\u5148\u6267\u884C pnpm build --target docker\uFF0C\u6216\u7528 --artifact-dir \u6307\u5B9A\u6709\u6548\u4EA7\u7269\uFF1B\u4E5F\u53EF\u7528 pnpm run deploy --build \u4E00\u6B21\u5B8C\u6210\u3002",
+  deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
+  deploy_bundleInstructions: "\u90E8\u7F72\u5305\uFF1A{file}\n\u5305\u4E2D\u5DF2\u5305\u542B\u672C\u6B21\u9009\u62E9\u670D\u52A1\u9700\u8981\u7684\u955C\u50CF\uFF0C\u5305\u62EC\u81EA\u5EFA\u4E2D\u95F4\u4EF6\u3002\n\u6709 SSH \u8FDE\u63A5\u65F6\uFF0C\u5148\u6309 _comments \u8BF4\u660E\u4FEE\u6539\u65C1\u8FB9\u90E8\u7F72\u76EE\u5F55\u4E2D\u7684 deploy-target.json\uFF0C\u518D\u8FD0\u884C\u540C\u76EE\u5F55\u7684 deploy.ps1\uFF08Windows\uFF09\u6216 deploy.sh\uFF08Linux/macOS\uFF09\uFF1B\u4E24\u8005\u5747\u8BFB\u53D6\u6B64 JSON\uFF0Csh \u5165\u53E3\u8FD8\u9700\u672C\u673A\u5B89\u88C5 awk\u3002\n\u5B8C\u5168\u9694\u79BB\u65F6\uFF0C\u590D\u5236 tar \u5230 Linux \u670D\u52A1\u5668\uFF0C\u5728\u72EC\u7ACB\u76EE\u5F55\u89E3\u5305\uFF0C\u518D\u6267\u884C sh apply.sh\uFF08\u4F7F\u7528\u5305\u4E2D\u914D\u7F6E\u7684\u76EE\u6807\u76EE\u5F55\uFF09\u3002\n\u670D\u52A1\u5668\u9700\u8981 Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk\u3001curl\u3001util-linux flock\uFF0C\u4EE5\u53CA\u652F\u6301 flock \u7684\u6587\u4EF6\u7CFB\u7EDF\u548C\u76EE\u5F55\u3001\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002\n\u56FA\u5B9A\u9501\u6587\u4EF6 .deploy.lock \u7981\u6B62\u5220\u9664\u6216\u66FF\u6362\uFF1B\u5168\u90E8\u6301\u6709\u8FDB\u7A0B\u9000\u51FA\u6216\u91CD\u542F\u540E\u81EA\u52A8\u91CA\u653E\u3002\u5F3A\u6740\u540E\u7684\u6267\u884C\u4E0E\u6062\u590D\u72B6\u6001\u987B\u4EBA\u5DE5\u6838\u5BF9\u3002\n\u90E8\u5206\u66F4\u65B0\u8981\u6C42\u670D\u52A1\u5668\u5DF2\u6709\u6210\u529F\u7684\u5B8C\u6574\u90E8\u7F72\uFF0C\u7AEF\u53E3\u53CA\u5E94\u7528\u5E03\u5C40\u4FDD\u6301\u4E00\u81F4\u3002\u6BCF\u6B65\u5931\u8D25\u4F1A\u8FD4\u56DE\u975E\u96F6\u9000\u51FA\u7801\uFF1B\u7ED3\u679C\u8BB0\u5F55\u5728\u90E8\u7F72\u76EE\u5F55 result-\u90E8\u7F72ID.json\u3002\n\u5305\u5305\u542B\u79C1\u6709\u8FD0\u884C\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u4F20\u8F93\u3002\n\u6240\u542B\u955C\u50CF\uFF1A\n{images}",
+  deploy_bundleMetadata: "\u5E94\u7528\u7248\u672C\uFF1A{version}\n\u6784\u5EFA\u7F16\u53F7\uFF1A{buildId}\nCompose \u6587\u4EF6\uFF1A{compose}",
+  deploy_targetHost: "\u5FC5\u586B\uFF1ALinux \u670D\u52A1\u5668\u5730\u5740\u6216 SSH \u522B\u540D\u3002\u6267\u884C\u4EFB\u4E00\u4E0A\u4F20\u811A\u672C\u524D\uFF0C\u5C06 SERVER_HOST \u6539\u4E3A\u5B9E\u9645\u5730\u5740\u3002",
+  deploy_targetPort: "SSH \u7AEF\u53E3\uFF0C1-65535 \u7684\u6574\u6570\uFF0C\u9ED8\u8BA4 22\u3002",
+  deploy_targetUsername: "SSH \u767B\u5F55\u7528\u6237\u540D\uFF0C\u9ED8\u8BA4 deploy\uFF1B\u9700\u8981\u76EE\u6807\u76EE\u5F55\u5199\u5165\u6743\u9650\u53CA\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002",
+  deploy_targetIdentityFile: "\u53EF\u9009\uFF1A\u8FD0\u884C\u4E0A\u4F20\u811A\u672C\u7684\u7535\u8111\u4E0A\u7684\u79C1\u94A5\u8DEF\u5F84\uFF0C\u5EFA\u8BAE\u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u7559\u7A7A\u4F7F\u7528 ssh-agent \u6216\u9ED8\u8BA4\u5BC6\u94A5\u3002HAI_DEPLOY_IDENTITY_FILE \u53EF\u8986\u76D6\u3002",
+  deploy_targetKnownHostsFile: "\u53EF\u9009\uFF1A\u8FD0\u884C\u4E0A\u4F20\u811A\u672C\u7684\u7535\u8111\u4E0A\u7684 known_hosts \u8DEF\u5F84\uFF0C\u5EFA\u8BAE\u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u7559\u7A7A\u4F7F\u7528 OpenSSH \u9ED8\u8BA4\u6587\u4EF6\u3002HAI_DEPLOY_KNOWN_HOSTS_FILE \u53EF\u8986\u76D6\u3002",
+  deploy_targetStrictHostKeyChecking: "\u5E03\u5C14\u503C\uFF0C\u9ED8\u8BA4 true\uFF1A\u9996\u6B21\u4FE1\u4EFB\u65B0\u4E3B\u673A\u5BC6\u94A5\uFF0C\u62D2\u7EDD\u5DF2\u53D8\u66F4\u5BC6\u94A5\uFF1Bfalse \u5173\u95ED\u4E3B\u673A\u5BC6\u94A5\u68C0\u67E5\u3002",
+  deploy_targetConnectTimeoutSeconds: "SSH \u8FDE\u63A5\u8D85\u65F6\u79D2\u6570\uFF0C1-2147483647 \u7684\u6574\u6570\uFF0C\u9ED8\u8BA4 10\u3002",
+  deploy_targetDirectory: "\u5FC5\u586B\uFF1ALinux \u670D\u52A1\u5668\u4E0A\u7684\u5E94\u7528\u7EDD\u5BF9\u76EE\u5F55\uFF0C\u4FDD\u5B58 incoming \u90E8\u7F72\u5305\u3001releases \u53CA\u6210\u529F\u72B6\u6001 current\uFF1B\u7981\u6B62 .. \u7236\u76EE\u5F55\u8DF3\u8F6C\u3002",
+  deploy_targetBundle: "\u5FC5\u586B\uFF1A\u672C\u90E8\u7F72\u64CD\u4F5C\u76EE\u5F55\u4E0A\u4E00\u7EA7\u7684 tar \u6587\u4EF6\u540D\uFF1B\u642C\u8FD0\u65F6\u8BF7\u5C06 tar \u548C\u672C\u76EE\u5F55\u5B8C\u6574\u653E\u5728\u4E00\u8D77\u3002",
+  deploy_bundleOnlyContainer: "\u4EC5\u751F\u6210 Compose tar \u53EA\u652F\u6301 docker-ssh\u3002",
+  deploy_selectedContainerOnly: "\u6309\u670D\u52A1\u5C40\u90E8\u90E8\u7F72\u4EC5\u9002\u7528\u4E8E docker-ssh Compose \u76EE\u6807\u3002",
+  deploy_selectionInvalid: "\u65E0\u6CD5\u90E8\u7F72\u670D\u52A1 {service}\uFF1A\u8BF7\u68C0\u67E5\u670D\u52A1\u540D\u79F0\uFF0C\u5E76\u5148\u6784\u5EFA\u5BF9\u5E94\u955C\u50CF\u3002",
+  deploy_storageArtifactRequired: "\u5B58\u50A8\u521D\u59CB\u5316\u9700\u8981\u5E94\u7528\u955C\u50CF\u3002\u8BF7\u7528 --artifact-dir \u9009\u62E9\u542B app \u955C\u50CF\u7684\u5B8C\u6574\u5236\u54C1\uFF0C\u6216\u5148\u6267\u884C pnpm build --target docker --images app\u3002",
+  deploy_imageVersionRequired: "\u955C\u50CF\u5FC5\u987B\u6307\u5B9A\u7248\u672C\uFF0C\u4E0D\u80FD\u4F7F\u7528 latest\uFF1A{image}",
+  deploy_bundleRuntimeRequired: "\u5B8C\u6574\u79BB\u7EBF\u5305\u9700\u8981\u5BFC\u51FA\u4E2D\u95F4\u4EF6\u955C\u50CF\u3002\u8BF7\u542F\u52A8\u672C\u5730 Podman/Docker\uFF0C\u6216\u5728\u6784\u5EFA\u673A\u6253\u5305\u3002",
+  deploy_bundleFailed: "\u4EA4\u4ED8\u51C6\u5907\u6216\u90E8\u7F72\u5931\u8D25\uFF1A{reason}",
+  deploy_configFileInvalid: "\u914D\u7F6E\u6587\u4EF6 {path} \u7B2C {line} \u884C\u683C\u5F0F\u6709\u8BEF\u3002\u8BF7\u68C0\u67E5\u7F29\u8FDB\u3001\u5192\u53F7\u548C\u5F15\u53F7\u540E\u91CD\u8BD5\u3002",
+  deploy_configFileUnreadable: "\u65E0\u6CD5\u8BFB\u53D6\u914D\u7F6E\u6587\u4EF6 {path}\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u8DEF\u5F84\u4E0E\u8BFB\u53D6\u6743\u9650\u3002",
+  deploy_bundleNameInvalid: "\u90E8\u7F72\u5305\u6587\u4EF6\u540D\u53EA\u652F\u6301\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u70B9\u3001\u52A0\u53F7\u3001\u77ED\u6A2A\u7EBF\u548C\u4E0B\u5212\u7EBF\uFF1B\u6240\u5728\u76EE\u5F55\u53EF\u4EE5\u5305\u542B\u7A7A\u683C\u3002",
+  deploy_secretsInvalid: "\u4E2D\u95F4\u4EF6\u51ED\u636E\u6587\u4EF6\u635F\u574F\u6216\u7F3A\u5C11\u5B57\u6BB5\uFF1A{path}\u3002\u8BF7\u4ECE\u5907\u4EFD\u6062\u590D\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u66F4\u6362\u5BC6\u7801\uFF0C\u4EE5\u514D\u5DF2\u6709\u6570\u636E\u65E0\u6CD5\u8BBF\u95EE\u3002",
+  deploy_localStopped: "\u5DF2\u786E\u8BA4\u672C\u5730\u547D\u4EE4\u8FDB\u7A0B\u6811\u5168\u90E8\u9000\u51FA\u3002",
+  deploy_localUnknown: "\u65E0\u6CD5\u786E\u8BA4\u672C\u5730\u547D\u4EE4\u8FDB\u7A0B\u6811\u5DF2\u5168\u90E8\u9000\u51FA\uFF1B\u8BF7\u68C0\u67E5\u672C\u673A\u6267\u884C\u72B6\u6001\u3002",
+  deploy_localNotStarted: "\u672C\u5730\u547D\u4EE4\u5C1A\u672A\u542F\u52A8\u3002",
+  deploy_commandOutputFailed: "\u547D\u4EE4\u8F93\u51FA\u6216\u56DE\u8C03\u5931\u8D25",
+  deploy_commandInputFailed: "\u547D\u4EE4\u8F93\u5165\u5931\u8D25",
+  deploy_commandTreeActive: "\u4E3B\u547D\u4EE4\u9000\u51FA\u540E\u4ECD\u6709\u6D3B\u8DC3\u7684\u5B50\u8FDB\u7A0B",
+  deploy_commandExecutionFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25",
+  deploy_remoteUnknown: "\u8FDC\u7AEF\u6267\u884C\u72B6\u6001\u672A\u77E5\uFF1B\u672C\u5730 SSH \u7ED3\u675F\u4E0D\u8BC1\u660E\u8FDC\u7AEF\u90E8\u7F72\u5DF2\u505C\u6B62\uFF0C\u8BF7\u6838\u5BF9\u670D\u52A1\u5668\u7ED3\u679C\u4E0E\u5B9E\u9645\u5BB9\u5668\u72B6\u6001\u3002",
+  deploy_remoteFinished: "\u5339\u914D\u7684\u670D\u52A1\u5668\u7ED3\u679C\u786E\u8BA4\u90E8\u7F72\u811A\u672C\u53CA\u6062\u590D\u5DF2\u7ED3\u675F\uFF1A\u9636\u6BB5 {stage}\uFF0C\u9000\u51FA\u7801 {code}\u3002\u8BF7\u6838\u5BF9\u5B9E\u9645\u670D\u52A1\u5065\u5EB7\u72B6\u6001\u3002"
+};
+
+// ../deploy/src/deploy-i18n.ts
+var deployM = core.i18n.createMessageGetter({
+  "zh-CN": zh_CN_default,
+  "en-US": en_US_default,
+  "ja-JP": ja_JP_default
+});
+
+// ../deploy/src/deploy-config.ts
+var VercelProviderConfigSchema = external_exports.object({
+  type: external_exports.literal("vercel"),
+  token: external_exports.string().min(1, deployM("deploy_configTokenRequired"))
+});
+var SshConfigSchema = external_exports.object({
+  /** 远程主机地址或 ~/.ssh/config 中的 Host 别名 */
+  host: external_exports.string().regex(/^[a-z0-9][a-z0-9.:-]*$/i),
+  /** SSH 端口 */
+  port: external_exports.number().int().min(1).max(65535).default(22),
+  /** SSH 用户名 */
+  username: external_exports.string().regex(/^[a-z_][\w-]*$/i),
+  /** 私钥文件路径（省略时使用 ssh-agent 或 ~/.ssh 默认密钥） */
+  identityFile: external_exports.string().min(1).optional(),
+  /** known_hosts 文件路径（省略时使用默认；配合 CI/临时环境隔离主机指纹） */
+  knownHostsFile: external_exports.string().min(1).optional(),
+  /** 严格主机密钥校验，默认开启（true→accept-new 首次信任并拒绝变更；false→关闭校验） */
+  strictHostKeyChecking: external_exports.boolean().default(true),
+  /** 连接超时（秒） */
+  connectTimeoutSeconds: external_exports.number().int().positive().default(10)
+});
+var PortExposeSchema = external_exports.object({
+  type: external_exports.literal("port").default("port"),
+  /** 容器内监听端口（adapter-node 默认 3000） */
+  containerPort: external_exports.number().int().min(1).max(65535).default(3e3),
+  /** 宿主机映射端口 */
+  hostPort: external_exports.number().int().min(1).max(65535)
+});
+var ExposeSchema = PortExposeSchema;
+var DockerSshProviderConfigSchema = external_exports.object({
+  type: external_exports.literal("docker-ssh"),
+  /** SSH 连接参数 */
+  ssh: SshConfigSchema.optional(),
+  /** 远程主机运行参数 */
+  remote: external_exports.object({
+    /** 远程应用根目录 */
+    baseDir: external_exports.string().regex(/^\/[\w/. -]+$/).refine((value) => !value.split("/").includes("..")).default("/opt/hai/apps"),
+    /** 远程容器运行时（auto 优先 podman） */
+    runtime: external_exports.enum(["auto", "docker", "podman"]).default("auto")
+  }).default({ baseDir: "/opt/hai/apps", runtime: "auto" }),
+  /** 应用暴露方式 */
+  expose: ExposeSchema
+});
+var ProviderConfigSchema = external_exports.discriminatedUnion("type", [
+  VercelProviderConfigSchema,
+  DockerSshProviderConfigSchema
+]);
+var NeonServiceSchema = external_exports.object({
+  provisioner: external_exports.literal("neon"),
+  apiKey: external_exports.string().min(1)
+});
+var UpstashServiceSchema = external_exports.object({
+  provisioner: external_exports.literal("upstash"),
+  email: external_exports.string().email(),
+  apiKey: external_exports.string().min(1)
+});
+var R2ServiceSchema = external_exports.object({
+  provisioner: external_exports.literal("cloudflare-r2"),
+  accessKeyId: external_exports.string().min(1),
+  secretAccessKey: external_exports.string().min(1),
+  accountId: external_exports.string().min(1),
+  apiToken: external_exports.string().min(1)
+});
+var ResendServiceSchema = external_exports.object({
+  provisioner: external_exports.literal("resend"),
+  from: external_exports.string().email(),
+  apiKey: external_exports.string().min(1)
+});
+var AliyunSmsServiceSchema = external_exports.object({
+  provisioner: external_exports.literal("aliyun"),
+  signName: external_exports.string().min(1),
+  accessKeyId: external_exports.string().min(1),
+  accessKeySecret: external_exports.string().min(1)
+});
+var ServicesConfigSchema = external_exports.object({
+  db: external_exports.discriminatedUnion("provisioner", [NeonServiceSchema]).optional(),
+  cache: external_exports.discriminatedUnion("provisioner", [UpstashServiceSchema]).optional(),
+  storage: external_exports.discriminatedUnion("provisioner", [R2ServiceSchema]).optional(),
+  email: external_exports.discriminatedUnion("provisioner", [ResendServiceSchema]).optional(),
+  sms: external_exports.discriminatedUnion("provisioner", [AliyunSmsServiceSchema]).optional()
+}).optional();
+var DeployConfigSchema = external_exports.object({
+  /** 部署环境文件模式；dev/test/prod 或自定义模式，禁止 local/example。 */
+  environment: external_exports.string().regex(/^[a-z0-9][\w-]*$/i).refine((value) => !["local", "example"].includes(value.toLowerCase())).optional(),
+  provider: ProviderConfigSchema,
+  services: ServicesConfigSchema,
+  /** Docker Compose 部署参数；构建配置位于项目 hai.build.json。 */
+  container: external_exports.object({
+    /** 自建 S3 服务实现；协议仍为 storage.type=s3。 */
+    s3Engine: external_exports.enum(["rustfs", "minio"]).default("rustfs")
+  }).optional()
+});
+var DeployErrorInfo = {
+  DEPLOY_FAILED: "001:500",
+  PROJECT_CREATE_FAILED: "002:500",
+  UPLOAD_FAILED: "004:500",
+  AUTH_REQUIRED: "005:401",
+  AUTH_FAILED: "006:401",
+  PROVISION_FAILED: "007:500",
+  ADAPTER_MISSING: "008:500",
+  SCAN_FAILED: "009:500",
+  NOT_INITIALIZED: "010:500",
+  ENV_VAR_FAILED: "011:500",
+  UNSUPPORTED_TYPE: "012:400",
+  CONFIG_ERROR: "013:500",
+  CREDENTIAL_ERROR: "014:500",
+  REMOTE_CONNECT_FAILED: "017:500",
+  REMOTE_COMMAND_FAILED: "018:500",
+  IMAGE_TRANSFER_FAILED: "019:500",
+  HEALTH_CHECK_FAILED: "020:500"
+};
+var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
+
+// ../deploy/src/deploy-environment.ts
+function environmentValue(value) {
+  try {
+    return parse(value) ?? value;
+  } catch {
+    return value;
+  }
+}
+function resolveConfig(value, prefix, env) {
+  if (env[prefix] !== void 0)
+    return environmentValue(env[prefix]);
+  if (Array.isArray(value))
+    return value.map((item, index) => resolveConfig(item, `${prefix}_${index}`, env));
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, resolveConfig(nested, `${prefix}_${key.toUpperCase()}`, env)]));
+  if (typeof value !== "string")
+    return value;
+  const resolved = value.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, name, fallback) => env[name] ?? fallback ?? "");
+  return /^\$\{[^}]+\}$/.test(value) ? environmentValue(resolved) : resolved;
+}
+function loadDeploymentConfig(name, path, values) {
+  try {
+    const lineCounter = new LineCounter();
+    const document = parseDocument(readFileSync(path, "utf8"), { lineCounter, prettyErrors: false });
+    if (document.errors.length)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: String(lineCounter.linePos(document.errors[0].pos[0]).line) } }));
+    const config = resolveConfig(document.toJS(), `HAI_${name.toUpperCase()}`, values);
+    if (config !== null && (typeof config !== "object" || Array.isArray(config)))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: "1" } }));
+    return ok(config && typeof config === "object" && !Array.isArray(config) ? config : {});
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileUnreadable", { params: { path } }));
+  }
+}
+function loadDeploymentEnvironment(options) {
+  const environment = options.environment === "production" ? "prod" : options.environment === "development" ? "dev" : options.environment;
+  if (!/^[a-z0-9][\w-]*$/i.test(environment) || ["local", "example"].includes(environment.toLowerCase()))
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_invalidEnvironment"));
+  const envDir = resolve(options.envDir);
+  const target = join(envDir, `.env.${environment}`);
+  if (options.requireFile !== false && !existsSync(target))
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentMissing", { params: { path: target } }));
+  const loaded = core.config.loadEnvFiles({ mode: environment, envDir });
+  if (!loaded.success)
+    return loaded;
+  try {
+    const values = { ...loaded.data };
+    for (const [name, value] of Object.entries(process3.env)) {
+      if (/^(?:HAI_|PUBLIC_|VITE_)/.test(name) && value !== void 0)
+        values[name] = value;
+    }
+    values.HAI_DEPLOY_ENVIRONMENT = environment;
+    values.HAI_CORE_ENV ??= environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
+    const targetValues = {};
+    if (existsSync(target)) {
+      for (const [name, value] of Object.entries(parseEnv(readFileSync(target, "utf8")))) {
+        if (value !== void 0)
+          targetValues[name] = value;
+      }
+    }
+    return ok({ environment, envDir, values, targetValues });
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
+  }
+}
+function isSecret(name, value) {
+  if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
+    return true;
+  try {
+    const url = new URL(value);
+    if (url.username || url.password || [...url.searchParams.keys()].some((key) => /password|secret|token|key|authorization/i.test(key)))
+      return true;
+  } catch {
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object")
+      return Object.entries(parsed).some(([key, nested]) => isSecret(key, typeof nested === "string" ? nested : JSON.stringify(nested)));
+  } catch {
+  }
+  return false;
+}
+function publicConfig(value) {
+  if (Array.isArray(value))
+    return value.map(publicConfig);
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).filter(([name, item]) => !isSecret(name, typeof item === "string" ? item : "")).map(([name, item]) => [name, publicConfig(item)]));
+  return value;
+}
+function quoteEnv(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object")
+      return `'${JSON.stringify(parsed).replaceAll("'", "\\u0027")}'`;
+  } catch {
+  }
+  if (!value.includes("'"))
+    return `'${value}'`;
+  if (!value.includes('"'))
+    return `"${value}"`;
+  if (!value.includes("`"))
+    return `\`${value}\``;
+  if (!/[\r\n#]/.test(value))
+    return value;
+  throw new Error("Unsupported dotenv value");
+}
+function updateFile(path, values, privateFile) {
+  let content = existsSync(path) ? readFileSync(path, "utf8") : "# Local private deployment configuration; do not commit.\n";
+  for (const [name, value] of Object.entries(values)) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
+      throw new Error("Invalid environment variable name");
+    const line = `${name}=${quoteEnv(value)}`;
+    const pattern = new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*`, "gm");
+    if (pattern.test(content))
+      content = content.replace(pattern, () => line);
+    else
+      content = `${content.trimEnd()}
+${line}
+`;
+  }
+  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
+  if (privateFile)
+    chmodSync(path, 384);
+}
+function removeOverrides(path, names, privateFile = true) {
+  if (!existsSync(path) || names.length === 0)
+    return;
+  let content = readFileSync(path, "utf8");
+  for (const name of names)
+    content = content.replace(new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
+  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
+  chmodSync(path, privateFile ? 384 : 420);
+}
+function saveDeploymentEnvironment(environment, values, options = {}) {
+  try {
+    const shared = {};
+    const privateValues = {};
+    for (const [name, value] of Object.entries(values)) {
+      if (options.private) {
+        privateValues[name] = value;
+      } else if (isSecret(name, value)) {
+        privateValues[name] = value;
+        try {
+          const parsed = JSON.parse(value);
+          if (parsed && typeof parsed === "object")
+            shared[name] = JSON.stringify(publicConfig(parsed));
+        } catch {
+        }
+      } else {
+        shared[name] = value;
+      }
+    }
+    if (Object.keys(shared).length)
+      updateFile(join(environment.envDir, `.env.${environment.environment}`), shared, false);
+    if (Object.keys(privateValues).length)
+      updateFile(join(environment.envDir, ".env.local"), privateValues, true);
+    removeOverrides(join(environment.envDir, `.env.${environment.environment}`), Object.keys(privateValues).filter((name) => !(name in shared)), false);
+    removeOverrides(join(environment.envDir, ".env.local"), Object.keys(shared).filter((name) => !(name in privateValues)));
+    if (Object.keys(privateValues).length) {
+      const ignorePath = join(environment.envDir, ".gitignore");
+      const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
+      if (!ignore.split(/\r?\n/).includes(".env.local"))
+        writeFileSync(ignorePath, `${ignore.trimEnd()}
+.env.local
+.hai/deploy/
+`);
+    }
+    return ok(Object.keys(values));
+  } catch {
+    return err(HaiDeployError.ENV_VAR_FAILED, deployM("deploy_environmentWriteFailed"));
+  }
+}
+var logger = core.logger.child({ module: "deploy", scope: "credentials" });
+var DEPLOY_CREDENTIAL_KEY_PATTERN = /^HAI_DEPLOY_[A-Z0-9_]+$/;
+function isAllowedCredentialKey(key) {
+  return DEPLOY_CREDENTIAL_KEY_PATTERN.test(key);
+}
+function normalizeCredentialEntries(entries) {
+  const normalized = {};
+  for (const [key, value] of Object.entries(entries)) {
+    if (!isAllowedCredentialKey(key)) {
+      logger.warn("Ignoring unsupported deploy credential key", { key });
+      continue;
+    }
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      normalized[key] = String(value);
+      continue;
+    }
+    logger.warn("Ignoring deploy credential with non-scalar value", { key });
+  }
+  return normalized;
+}
+function assertAllowedCredentialKey(key) {
+  if (!isAllowedCredentialKey(key)) {
+    throw new Error(deployM("deploy_credentialInvalidKey", { params: { key } }));
+  }
+}
+function assertAllowedCredentialEntries(entries) {
+  for (const key of Object.keys(entries)) {
+    assertAllowedCredentialKey(key);
+  }
+}
+function getCredentialsPath() {
+  return join(homedir(), ".hai", "credentials.yml");
+}
+function ensureDir(filePath) {
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
+function readCredentialsFile() {
+  const filePath = getCredentialsPath();
+  if (!existsSync(filePath)) {
+    return {};
+  }
+  const content = readFileSync(filePath, "utf-8");
+  const parsed = parse(content);
+  if (parsed === null || parsed === void 0 || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return {};
+  }
+  return normalizeCredentialEntries(parsed);
+}
+function writeCredentialsFile(data) {
+  const filePath = getCredentialsPath();
+  ensureDir(filePath);
+  const header = "# Managed by hai cli - do not edit manually\n";
+  const content = header + stringify(data);
+  writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
+}
+function loadCredentials() {
+  try {
+    const data = readCredentialsFile();
+    const keys = Object.keys(data);
+    for (const key of keys) {
+      process3.env[key] = String(data[key]);
+    }
+    logger.debug("Credentials loaded", { count: keys.length });
+    return ok(keys);
+  } catch (error) {
+    logger.error("Failed to load credentials", { error });
+    return err(
+      HaiDeployError.CREDENTIAL_ERROR,
+      deployM("deploy_credentialError", {
+        params: { error: error instanceof Error ? error.message : String(error) }
+      }),
+      error
+    );
+  }
+}
+function saveCredential(key, value) {
+  try {
+    assertAllowedCredentialKey(key);
+    const data = readCredentialsFile();
+    data[key] = value;
+    writeCredentialsFile(data);
+    process3.env[key] = value;
+    logger.debug("Credential saved", { key });
+    return ok(void 0);
+  } catch (error) {
+    logger.error("Failed to save credential", { key, error });
+    return err(
+      HaiDeployError.CREDENTIAL_ERROR,
+      deployM("deploy_credentialError", {
+        params: { error: error instanceof Error ? error.message : String(error) }
+      }),
+      error
+    );
+  }
+}
+function saveCredentials(entries) {
+  try {
+    assertAllowedCredentialEntries(entries);
+    const data = readCredentialsFile();
+    for (const [key, value] of Object.entries(entries)) {
+      data[key] = value;
+      process3.env[key] = value;
+    }
+    writeCredentialsFile(data);
+    logger.debug("Credentials saved", { count: Object.keys(entries).length });
+    return ok(void 0);
+  } catch (error) {
+    logger.error("Failed to save credentials", { error });
+    return err(
+      HaiDeployError.CREDENTIAL_ERROR,
+      deployM("deploy_credentialError", {
+        params: { error: error instanceof Error ? error.message : String(error) }
+      }),
+      error
+    );
+  }
+}
+function resolveProjectDirectory(appDir) {
+  let directory = resolve(appDir);
+  while (true) {
+    if (existsSync(join(directory, "hai.build.json")) || existsSync(join(directory, "pnpm-lock.yaml")))
+      return directory;
+    const parent = dirname(directory);
+    if (parent === directory)
+      return resolve(appDir);
+    directory = parent;
+  }
+}
+function resolveArtifactDirectory(appDir) {
+  return join(resolveProjectDirectory(appDir), ".hai/build/docker");
+}
+function usesDefaultMiddleware(scan, service, options) {
+  const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
+  return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
+}
+function resolveOutputDir(appDir, providerType) {
+  switch (providerType) {
+    case "vercel":
+      return join(appDir, ".vercel", "output");
+    default:
+      return join(appDir, "build");
+  }
+}
+var RecoverySchema = external_exports.object({
+  projectName: external_exports.string(),
+  stage: external_exports.string(),
+  platformProjectId: external_exports.string().optional(),
+  resources: external_exports.array(external_exports.object({
+    serviceType: external_exports.enum(["db", "cache", "storage", "email", "sms"]),
+    provisionerName: external_exports.string(),
+    resourceInfo: external_exports.string(),
+    resourceStatus: external_exports.enum(["created", "reused", "unknown"])
+  }))
+});
+var CommandStateSchema = external_exports.object({
+  reason: external_exports.enum(["timeout", "output", "input", "spawn", "exit", "configuration"]),
+  localTermination: external_exports.enum(["confirmed", "unknown", "not-started"]),
+  remoteExecution: external_exports.enum(["unknown", "finished"]).optional(),
+  deploymentId: external_exports.string().optional(),
+  resultFile: external_exports.string().optional(),
+  remoteExitCode: external_exports.number().int().optional(),
+  remoteStage: external_exports.string().optional()
+});
+function getDeployCommandState(error) {
+  const parsed = CommandStateSchema.safeParse(error.ext?.commandExecution);
+  return parsed.success ? parsed.data : void 0;
+}
+function getDeployRecovery(error) {
+  const parsed = RecoverySchema.safeParse(error.ext?.recovery);
+  return parsed.success ? parsed.data : void 0;
+}
+function recoveryFailure(error, recovery) {
+  return err({
+    code: error.code,
+    httpStatus: error.httpStatus,
+    system: error.system,
+    module: error.module,
+    message: deployM("deploy_recoveryFailure", { params: { stage: recovery.stage } }),
+    suggestion: deployM("deploy_recoverySuggestion"),
+    ext: { recovery }
+  });
+}
+var logger2 = core.logger.child({ module: "deploy", scope: "scanner" });
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function runtimeDependencies(appDir) {
+  let root = appDir;
+  while (!existsSync(join(root, "pnpm-lock.yaml"))) {
+    const parent = dirname(root);
+    if (parent === root)
+      throw new Error("Missing pnpm lockfile; run pnpm install");
+    root = parent;
+  }
+  const importerKey = relative(root, appDir).replaceAll("\\", "/") || ".";
+  const documents = parseAllDocuments(readFileSync(join(root, "pnpm-lock.yaml"), "utf8"));
+  if (documents.some((document) => document.errors.length))
+    throw new Error("Invalid pnpm lockfile");
+  const lock = documents.map((document) => record(document.toJS())).reverse().find((document) => importerKey in record(document.importers));
+  if (!lock)
+    throw new Error("Application is missing from pnpm lockfile; run pnpm install");
+  const importers = record(lock.importers);
+  const packages = record(lock.packages);
+  const snapshots = record(lock.snapshots);
+  const names = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (id, node, importer) => {
+    if (visited.has(id))
+      return;
+    visited.add(id);
+    const metadata = importer === void 0 ? record(packages[id.split("(")[0]]) : {};
+    const peers = record(metadata.peerDependencies);
+    for (const [name, reference] of Object.entries({ ...record(node.dependencies), ...record(node.optionalDependencies) })) {
+      if (name in peers)
+        continue;
+      const version = typeof reference === "string" ? reference : record(reference).version;
+      if (typeof version !== "string")
+        throw new Error("Invalid pnpm dependency reference");
+      if (version.startsWith("link:")) {
+        if (importer === void 0)
+          throw new Error("Invalid workspace dependency");
+        const target = relative(root, resolve(root, importer, version.slice(5))).replaceAll("\\", "/") || ".";
+        const linked = record(importers[target]);
+        if (!Object.keys(linked).length)
+          throw new Error("Missing linked workspace importer");
+        names.add(name);
+        visit(`workspace:${target}`, linked, target);
+        continue;
+      }
+      const key = version in snapshots || version in packages ? version : `${name}@${version}`;
+      names.add(key.match(/^(@[^/]+\/[^@]+|[^@]+)@/)?.[1] ?? name);
+      const snapshot = record(snapshots[key] ?? packages[key]);
+      if (!Object.keys(snapshot).length && !(key in snapshots) && !(key in packages))
+        throw new Error("Missing pnpm dependency snapshot");
+      visit(key, snapshot);
+    }
+  };
+  visit(`workspace:${importerKey}`, record(importers[importerKey]), importerKey);
+  return { runtime: names, build: /* @__PURE__ */ new Set([...names, ...Object.keys(record(record(importers[importerKey]).devDependencies))]), root };
+}
+async function scanApp(inputDir, options) {
+  try {
+    const appDir = resolve(inputDir);
+    const graph = runtimeDependencies(appDir);
+    const envDir = options?.envDir ? resolve(options.envDir) : existsSync(join(appDir, ".env")) ? appDir : graph.root;
+    const loaded = loadDeploymentEnvironment({ environment: options?.environment ?? "prod", envDir, requireFile: options?.environment !== void 0 });
+    if (!loaded.success)
+      return loaded;
+    const env = loaded.data.values;
+    const deps = graph.runtime;
+    const configs = {};
+    for (const [name, owner] of Object.entries({ db: "reldb", cache: "cache", storage: "storage", vecdb: "vecdb", iam: "iam", reach: "reach" })) {
+      configs[name] = {};
+      if (!deps.has(`@h-ai/${owner}`))
+        continue;
+      const configFile = ["yml", "yaml"].map((ext) => join(appDir, "config", `_${name}.${ext}`)).find(existsSync);
+      const config = configFile ? loadDeploymentConfig(name, configFile, env) : void 0;
+      if (config && !config.success)
+        return config;
+      configs[name] = config?.data ?? {};
+    }
+    const middlewares = [];
+    const add = (service, backend, configName = service, configPath = [], config = configs[configName] ?? {}, source = `_${configName}.yml`) => {
+      middlewares.push({ service, backend, source, configName, configPath, envPrefix: ["HAI", configName, ...configPath].map((part) => part.toUpperCase()).join("_"), config });
+    };
+    const iam = deps.has("@h-ai/iam");
+    if (deps.has("@h-ai/reldb"))
+      add("db", String(configs.db.type ?? "sqlite"), "db", [], configs.db, "@h-ai/reldb / _db.yml");
+    if (deps.has("@h-ai/cache"))
+      add("cache", String(configs.cache.type ?? "memory"), "cache", [], configs.cache, "@h-ai/cache / _cache.yml");
+    if (deps.has("@h-ai/storage"))
+      add("storage", String(configs.storage.type ?? "local"));
+    if (deps.has("@h-ai/vecdb"))
+      add("vecdb", String(configs.vecdb.type ?? "lancedb"));
+    if (iam) {
+      const ldap = record(configs.iam.ldap);
+      add("ldap", record(configs.iam.login).ldap === true ? "ldap" : "disabled", "iam", ["ldap"], ldap, "@h-ai/iam (LDAP)");
+    }
+    const providers = configs.reach.providers;
+    if (deps.has("@h-ai/reach") && Array.isArray(providers)) {
+      for (const [index, item] of providers.entries()) {
+        const provider = record(item);
+        const type = String(provider.type ?? "");
+        const service = type === "aliyun-sms" || ["console", "api"].includes(type) && provider.name === "sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
+        if (service)
+          add(service, type, "reach", ["providers", String(index)], provider, "@h-ai/reach");
+      }
+    }
+    if (deps.has("@h-ai/reach") && !middlewares.some((item) => item.configName === "reach"))
+      add("email", "console", "reach", ["providers", "0"], { name: "email", type: "console" }, "@h-ai/reach");
+    const isSvelteKit = graph.build.has("@sveltejs/kit");
+    const scan = {
+      appDir,
+      envDir,
+      middlewares,
+      haiModules: [...deps].filter((name) => name.startsWith("@h-ai/")).sort(),
+      appName: basename(appDir),
+      isSvelteKit,
+      adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
+      nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
+      requiredServices: [...new Set(middlewares.map((item) => item.service))],
+      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend]))
+    };
+    logger2.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
+    return ok(scan);
+  } catch {
+    return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
+  }
+}
+var nativeJob = String.raw`
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+
+public static class HaiCommandJob {
+  [StructLayout(LayoutKind.Sequential)] struct BasicLimits {
+    public long ProcessTime, JobTime;
+    public uint Flags;
+    public UIntPtr MinimumWorkingSet, MaximumWorkingSet;
+    public uint ActiveProcessLimit;
+    public UIntPtr Affinity;
+    public uint PriorityClass, SchedulingClass;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct IoCounters {
+    public ulong ReadOperations, WriteOperations, OtherOperations, ReadBytes, WriteBytes, OtherBytes;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct ExtendedLimits {
+    public BasicLimits Basic;
+    public IoCounters Io;
+    public UIntPtr ProcessMemory, JobMemory, PeakProcessMemory, PeakJobMemory;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct Accounting {
+    public long UserTime, KernelTime, PeriodUserTime, PeriodKernelTime;
+    public uint Faults, Total, Active, Terminated;
+  }
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] struct Startup {
+    public uint Size;
+    public string Reserved, Desktop, Title;
+    public uint X, Y, Width, Height, XChars, YChars, Fill, Flags;
+    public ushort Show, ReservedSize;
+    public IntPtr ReservedData, Input, Output, Error;
+  }
+  [StructLayout(LayoutKind.Sequential)] struct ProcessInfo {
+    public IntPtr Process, Thread;
+    public uint ProcessId, ThreadId;
+  }
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] static extern IntPtr CreateJobObject(IntPtr attributes, string name);
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] static extern IntPtr OpenJobObject(uint access, bool inherit, string name);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool SetInformationJobObject(IntPtr job, int kind, ref ExtendedLimits information, uint size);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool QueryInformationJobObject(IntPtr job, int kind, out Accounting information, uint size, IntPtr length);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool AssignProcessToJobObject(IntPtr job, IntPtr process);
+  [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] static extern bool CreateProcess(string application, StringBuilder command, IntPtr processAttributes, IntPtr threadAttributes, bool inherit, uint flags, IntPtr environment, string directory, ref Startup startup, out ProcessInfo information);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern uint ResumeThread(IntPtr thread);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool TerminateProcess(IntPtr process, uint code);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool TerminateJobObject(IntPtr job, uint code);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool GetExitCodeProcess(IntPtr process, out uint code);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool CloseHandle(IntPtr handle);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern IntPtr GetStdHandle(int kind);
+  [DllImport("kernel32.dll", SetLastError = true)] static extern bool SetHandleInformation(IntPtr handle, uint mask, uint flags);
+
+  static void Check(bool success) { if (!success) throw new Win32Exception(Marshal.GetLastWin32Error()); }
+  static uint Active(IntPtr job) {
+    Accounting information;
+    Check(QueryInformationJobObject(job, 1, out information, (uint)Marshal.SizeOf(typeof(Accounting)), IntPtr.Zero));
+    return information.Active;
+  }
+  // Windows argv 编码：引号前与结尾的反斜杠加倍，其余字符原样传递，不经过命令 shell。
+  static string Quote(string value) {
+    StringBuilder result = new StringBuilder("\"");
+    int slashes = 0;
+    foreach (char current in value) {
+      if (current == '\\') { slashes++; continue; }
+      if (current == '"') result.Append('\\', slashes * 2 + 1);
+      else result.Append('\\', slashes);
+      result.Append(current);
+      slashes = 0;
+    }
+    result.Append('\\', slashes * 2).Append('"');
+    return result.ToString();
+  }
+  public static int Run(string name, string command, string[] arguments) {
+    IntPtr job = CreateJobObject(IntPtr.Zero, name);
+    if (job == IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error());
+    ProcessInfo process = new ProcessInfo();
+    bool assigned = false;
+    try {
+      ExtendedLimits limits = new ExtendedLimits();
+      limits.Basic.Flags = 0x2000; // JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE；不允许 breakaway。
+      Check(SetInformationJobObject(job, 9, ref limits, (uint)Marshal.SizeOf(typeof(ExtendedLimits))));
+      StringBuilder line = new StringBuilder(Quote(command));
+      foreach (string argument in arguments) line.Append(' ').Append(Quote(argument));
+      Startup startup = new Startup();
+      startup.Size = (uint)Marshal.SizeOf(typeof(Startup));
+      startup.Flags = 0x100;
+      startup.Input = GetStdHandle(-10); startup.Output = GetStdHandle(-11); startup.Error = GetStdHandle(-12);
+      Check(SetHandleInformation(startup.Input, 1, 1));
+      Check(SetHandleInformation(startup.Output, 1, 1));
+      Check(SetHandleInformation(startup.Error, 1, 1));
+      Check(CreateProcess(null, line, IntPtr.Zero, IntPtr.Zero, true, 0x08000004, IntPtr.Zero, null, ref startup, out process));
+      Check(AssignProcessToJobObject(job, process.Process));
+      assigned = true;
+      if (ResumeThread(process.Thread) == 0xFFFFFFFF) throw new Win32Exception(Marshal.GetLastWin32Error());
+      if (WaitForSingleObject(process.Process, 0xFFFFFFFF) != 0) throw new Win32Exception(Marshal.GetLastWin32Error());
+      uint code;
+      Check(GetExitCodeProcess(process.Process, out code));
+      while (Active(job) != 0) Thread.Sleep(20);
+      return unchecked((int)code);
+    }
+    finally {
+      if (process.Process != IntPtr.Zero) {
+        // 分配失败时进程仍挂起，直接终止，不允许裸进程恢复；Job 在其他异常时同样清空。
+        if (!assigned) TerminateProcess(process.Process, 125);
+        else TerminateJobObject(job, 125);
+        WaitForSingleObject(process.Process, 5000);
+      }
+      if (process.Thread != IntPtr.Zero) CloseHandle(process.Thread);
+      if (process.Process != IntPtr.Zero) CloseHandle(process.Process);
+      CloseHandle(job);
+    }
+  }
+  public static bool Empty(string name) {
+    IntPtr job = OpenJobObject(4, false, name); // JOB_OBJECT_QUERY
+    if (job == IntPtr.Zero) {
+      if (Marshal.GetLastWin32Error() == 2) return true;
+      throw new Win32Exception(Marshal.GetLastWin32Error());
+    }
+    try { return Active(job) == 0; }
+    finally { CloseHandle(job); }
+  }
+}
+`;
+function powershell(script) {
+  return ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")];
+}
+function windowsCommand(command, args) {
+  const name = `Local\\hai-deploy-${randomUUID()}`;
+  const key = `__HAI_DEPLOY_JOB_${randomUUID().replaceAll("-", "")}`;
+  const script = `$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $InformationPreference='SilentlyContinue'
+try {
+  Add-Type -TypeDefinition @'
+${nativeJob}
+'@
+  $inputConfig = [Environment]::GetEnvironmentVariable('${key}') | ConvertFrom-Json
+  [Environment]::SetEnvironmentVariable('${key}', $null)
+  exit ([HaiCommandJob]::Run([string]$inputConfig.name, [string]$inputConfig.command, [string[]]$inputConfig.args))
+} catch { [Console]::Error.WriteLine('Windows command job failed'); exit 125 }`;
+  return { name, args: powershell(script), env: { [key]: JSON.stringify({ name, command, args }) } };
+}
+function windowsJobProbe(name) {
+  return powershell(`$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $InformationPreference='SilentlyContinue'
+try {
+  Add-Type -TypeDefinition @'
+${nativeJob}
+'@
+  if ([HaiCommandJob]::Empty('${name}')) { exit 0 } else { exit 1 }
+} catch { exit 2 }`);
+}
+
+// ../deploy/src/container/deploy-command-process.ts
+async function groupExited(pid) {
+  try {
+    process3.kill(-pid, 0);
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "ESRCH";
+  }
+  if (process3.platform !== "linux")
+    return false;
+  try {
+    for (const entry of await readdir("/proc")) {
+      if (!/^\d+$/.test(entry))
+        continue;
+      let stat;
+      try {
+        stat = await readFile(`/proc/${entry}/stat`, "utf8");
+      } catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+          continue;
+        return false;
+      }
+      const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+      if (Number(fields[2]) === pid && fields[0] !== "Z" && fields[0] !== "X")
+        return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function helper(command, args, timeoutMs) {
+  if (timeoutMs <= 0)
+    return false;
+  return new Promise((resolve6) => {
+    const child = spawn(command, args, { windowsHide: true, shell: false, stdio: "ignore" });
+    let settled = false;
+    let timer;
+    const finish = (success) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve6(success);
+    };
+    timer = globalThis.setTimeout(() => {
+      child.kill("SIGKILL");
+      child.unref();
+      finish(false);
+    }, timeoutMs);
+    child.once("error", () => finish(false));
+    child.once("close", (code) => finish(code === 0));
+  });
+}
+function spawnCommand(command, args, options) {
+  const job = process3.platform === "win32" ? windowsCommand(command, args) : void 0;
+  const child = spawn(job ? "powershell.exe" : command, job?.args ?? args, {
+    ...options,
+    env: job ? { ...options.env, ...job.env } : options.env,
+    windowsHide: true,
+    shell: false,
+    detached: !job
+  });
+  let exited = false;
+  child.once("exit", () => {
+    exited = true;
+  });
+  child.once("close", () => {
+    exited = true;
+  });
+  let termination;
+  const treeExited = async () => {
+    if (!child.pid)
+      return true;
+    if (job)
+      return exited && helper("powershell.exe", windowsJobProbe(job.name), 5e3);
+    return groupExited(child.pid);
+  };
+  const terminate = (timeoutMs) => {
+    termination ??= (async () => {
+      const deadline = performance.now() + timeoutMs;
+      let windowsKillConfirmed = !job || exited;
+      if (child.pid) {
+        if (job) {
+          if (!exited) {
+            windowsKillConfirmed = await helper("taskkill", ["/pid", String(child.pid), "/t", "/f"], Math.max(1, deadline - performance.now()));
+            child.kill("SIGKILL");
+          }
+        } else {
+          try {
+            process3.kill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        }
+      }
+      while (performance.now() < deadline) {
+        if (exited)
+          break;
+        await setTimeout$1(20);
+      }
+      let verified = false;
+      if (exited && job) {
+        verified = await helper("powershell.exe", windowsJobProbe(job.name), deadline - performance.now());
+        verified &&= windowsKillConfirmed || child.exitCode !== null;
+      } else if (exited) {
+        while (performance.now() < deadline) {
+          if (await treeExited()) {
+            verified = true;
+            break;
+          }
+          await setTimeout$1(20);
+        }
+      }
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      if (!verified)
+        child.unref();
+      return verified ? "confirmed" : "unknown";
+    })();
+    return termination;
+  };
+  return { child, treeExited, terminate };
+}
+
+// ../deploy/src/container/deploy-secret-masker.ts
+function createSecretMasker(secrets = []) {
+  const values = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
+  if (values.reduce((total, value) => total + value.length, 0) > 1048576)
+    throw new RangeError("Secret redaction input is too large");
+  const pattern = values.length ? new RegExp(values.map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g") : void 0;
+  const tailLength = Math.max(0, (values[0]?.length ?? 1) - 1);
+  let pending = "";
+  let ended = false;
+  function drain(final) {
+    let end = final ? pending.length : Math.max(0, pending.length - tailLength);
+    if (end > 0 && end < pending.length && /[\uD800-\uDBFF]/.test(pending[end - 1]) && /[\uDC00-\uDFFF]/.test(pending[end]))
+      end--;
+    if (end === 0)
+      return "";
+    let cursor = 0;
+    let output = "";
+    if (pattern) {
+      pattern.lastIndex = 0;
+      let match = pattern.exec(pending);
+      while (match && match.index < end) {
+        output += `${pending.slice(cursor, match.index)}***`;
+        cursor = pattern.lastIndex;
+        end = Math.max(end, cursor);
+        match = pattern.exec(pending);
+      }
+    }
+    output += pending.slice(cursor, end);
+    pending = pending.slice(end);
+    return output;
+  }
+  return {
+    write(text) {
+      if (ended)
+        throw new Error("Secret masker has ended");
+      pending += text;
+      return drain(false);
+    },
+    end() {
+      if (ended)
+        return "";
+      ended = true;
+      return drain(true);
+    }
+  };
+}
+
+// ../deploy/src/container/deploy-command.ts
+var logger3 = core.logger.child({ module: "deploy", scope: "command" });
+function maskSecrets(text, secrets = []) {
+  const masker = createSecretMasker(secrets);
+  return masker.write(text) + masker.end();
+}
+async function runCommand(command, args, options = {}) {
+  const failure = (message, state) => err({
+    ...HaiDeployError.REMOTE_COMMAND_FAILED,
+    message: `${message}
+${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state.localTermination === "not-started" ? "deploy_localNotStarted" : "deploy_localUnknown")}`,
+    ext: { commandExecution: state }
+  });
+  try {
+    return await new Promise((resolve6) => {
+      if (typeof command !== "string" || !command || command.includes("\0") || args.some((argument) => typeof argument !== "string" || argument.includes("\0")))
+        throw new TypeError("Invalid command arguments");
+      if (options.input !== void 0 && typeof options.input !== "string")
+        throw new TypeError("Invalid command input");
+      const maxCapture = options.maxCaptureChars ?? 1048576;
+      if (!Number.isSafeInteger(maxCapture) || maxCapture <= 0 || maxCapture > 16777216)
+        throw new RangeError("Invalid command capture limit");
+      const terminationTimeout = options.terminationTimeoutMs ?? 1e4;
+      if (!Number.isSafeInteger(terminationTimeout) || terminationTimeout <= 0 || terminationTimeout > 6e4)
+        throw new RangeError("Invalid command termination timeout");
+      if (options.timeoutMs !== void 0 && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 2147483647))
+        throw new RangeError("Invalid command timeout");
+      const secrets = [...options.secrets ?? []];
+      const safeCommand = maskSecrets(command, secrets);
+      const outputMasker = createSecretMasker(secrets);
+      const errorMasker = createSecretMasker(secrets);
+      const control = spawnCommand(command, args, { cwd: options.cwd, env: options.env ? { ...process3.env, ...options.env } : process3.env });
+      const child = control.child;
+      child.stdout.setEncoding("utf8");
+      child.stderr.setEncoding("utf8");
+      let stdout = "";
+      let stderr = "";
+      let stdoutTruncated = false;
+      let stderrTruncated = false;
+      let settled = false;
+      let interrupted = false;
+      let interruption;
+      let timer;
+      const finish = (result) => {
+        if (settled)
+          return;
+        settled = true;
+        if (timer)
+          clearTimeout(timer);
+        resolve6(result);
+      };
+      const interrupt = (reason, message) => {
+        interrupted = true;
+        interruption ??= (async () => {
+          if (timer)
+            clearTimeout(timer);
+          const localTermination = child.pid ? await control.terminate(terminationTimeout) : "not-started";
+          logger3.error("Command termination checked", { command: safeCommand, reason, localTermination });
+          finish(failure(message, { reason, localTermination }));
+        })();
+        return interruption;
+      };
+      const publish = async (text) => {
+        if (!text || settled || interrupted)
+          return;
+        stdoutTruncated ||= stdout.length + text.length > maxCapture;
+        stdout = (stdout + text).slice(-maxCapture);
+        try {
+          await options.onOutput?.(text);
+        } catch {
+          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+        }
+      };
+      const captureError = (text) => {
+        stderrTruncated ||= stderr.length + text.length > maxCapture;
+        stderr = (stderr + text).slice(-maxCapture);
+      };
+      if (options.timeoutMs && options.timeoutMs > 0) {
+        timer = setTimeout(() => {
+          logger3.error("Command timed out", { command: safeCommand, timeoutMs: options.timeoutMs });
+          void interrupt("timeout", deployM("deploy_commandTimeout", { params: { command: safeCommand } }));
+        }, options.timeoutMs);
+      }
+      const outputTask = (async () => {
+        try {
+          for await (const chunk of child.stdout) {
+            if (settled || interrupted)
+              return;
+            if (typeof chunk !== "string")
+              throw new TypeError("Command output must be UTF-8 decoded");
+            await publish(outputMasker.write(chunk));
+          }
+          if (!settled && !interrupted)
+            await publish(outputMasker.end());
+        } catch {
+          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+        }
+      })();
+      const errorTask = (async () => {
+        try {
+          for await (const chunk of child.stderr) {
+            if (settled || interrupted)
+              return;
+            if (typeof chunk !== "string")
+              throw new TypeError("Command error output must be UTF-8 decoded");
+            captureError(errorMasker.write(chunk));
+          }
+          if (!settled && !interrupted)
+            captureError(errorMasker.end());
+        } catch {
+          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+        }
+      })();
+      child.stdin.on("error", () => {
+        void interrupt("input", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandInputFailed") } }));
+      });
+      child.on("error", (error) => {
+        const safeError = maskSecrets(error.message, secrets);
+        logger3.error("Command failed to start", { command: safeCommand, error: safeError });
+        void interrupt("spawn", deployM("deploy_commandFailed", { params: { command: safeCommand, error: safeError } }));
+      });
+      child.on("close", async (code) => {
+        await Promise.all([outputTask, errorTask]);
+        if (settled || interrupted)
+          return;
+        if (timer)
+          clearTimeout(timer);
+        if (!await control.treeExited()) {
+          await interrupt("exit", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandTreeActive") } }));
+          return;
+        }
+        const exitCode = code ?? -1;
+        if (exitCode === 0) {
+          finish(ok({ code: exitCode, stdout, stderr, stdoutTruncated, stderrTruncated }));
+          return;
+        }
+        logger3.error("Command exited with non-zero code", { command: safeCommand, code: exitCode, stderr: maskSecrets(stderr, secrets).slice(-500), stdout: maskSecrets(stdout, secrets).slice(-3e3), stdoutTruncated, stderrTruncated });
+        finish(failure(deployM("deploy_commandFailed", { params: { command: safeCommand, error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, secrets).slice(-3e3) } }), { reason: "exit", localTermination: "confirmed" }));
+      });
+      if (options.input !== void 0)
+        child.stdin.write(options.input);
+      child.stdin.end();
+    });
+  } catch {
+    return failure(deployM("deploy_commandFailed", { params: { command: "<command>", error: deployM("deploy_commandExecutionFailed") } }), { reason: "configuration", localTermination: "not-started" });
+  }
+}
+
+// ../deploy/src/container/deploy-target.ts
+function createTargetReader() {
+  return String.raw`function fail(message) {
+  print "Invalid deploy-target.json: " message > "/dev/stderr"
+  exit 2
+}
+function whitespace() {
+  while (substr(input, position, 1) ~ /^[ \t\r\n]$/) position++
+}
+function hexadecimal(text,    result, offset, digit) {
+  result = 0
+  if (length(text) != 4) fail("invalid Unicode escape")
+  for (offset = 1; offset <= 4; offset++) {
+    digit = index("0123456789abcdef", tolower(substr(text, offset, 1))) - 1
+    if (digit < 0) fail("invalid Unicode escape")
+    result = result * 16 + digit
+  }
+  return result
+}
+function utf8(code) {
+  if (code < 128) return sprintf("%c", code)
+  if (code < 2048) return sprintf("%c%c", 192 + int(code / 64), 128 + code % 64)
+  if (code < 65536) return sprintf("%c%c%c", 224 + int(code / 4096), 128 + int(code / 64) % 64, 128 + code % 64)
+  return sprintf("%c%c%c%c", 240 + int(code / 262144), 128 + int(code / 4096) % 64, 128 + int(code / 64) % 64, 128 + code % 64)
+}
+function string_value(    result, character, escaped, code, low) {
+  if (substr(input, position++, 1) != "\"") fail("expected string")
+  result = ""
+  while (position <= length(input)) {
+    character = substr(input, position++, 1)
+    if (character == "\"") return result
+    if (character ~ /[[:cntrl:]]/) fail("control character in string")
+    if (character != "\\") { result = result character; continue }
+    escaped = substr(input, position++, 1)
+    if (escaped == "\"" || escaped == "\\" || escaped == "/") result = result escaped
+    else if (escaped == "b") result = result sprintf("%c", 8)
+    else if (escaped == "f") result = result sprintf("%c", 12)
+    else if (escaped == "n") result = result "\n"
+    else if (escaped == "r") result = result "\r"
+    else if (escaped == "t") result = result "\t"
+    else if (escaped == "u") {
+      code = hexadecimal(substr(input, position, 4)); position += 4
+      if (code >= 55296 && code <= 56319) {
+        if (substr(input, position, 2) != "\\u") fail("missing low surrogate")
+        position += 2
+        low = hexadecimal(substr(input, position, 4)); position += 4
+        if (low < 56320 || low > 57343) fail("invalid low surrogate")
+        code = 65536 + (code - 55296) * 1024 + low - 56320
+      } else if (code >= 56320 && code <= 57343) fail("unexpected low surrogate")
+      if (code == 0) fail("NUL is not allowed")
+      result = result utf8(code)
+    } else fail("invalid escape")
+  }
+  fail("unterminated string")
+}
+function object_value(depth,    key, character, value, kind) {
+  if (depth > 16) fail("nesting is too deep")
+  position++
+  whitespace()
+  if (substr(input, position, 1) == "}") { position++; return }
+  while (position <= length(input)) {
+    whitespace(); key = string_value(); whitespace()
+    if (substr(input, position++, 1) != ":") fail("expected colon")
+    whitespace(); character = substr(input, position, 1)
+    if (character == "{") { object_value(depth + 1); value = ""; kind = "object" }
+    else if (character == "\"") { value = string_value(); kind = "string" }
+    else if (substr(input, position, 4) == "true") { value = "true"; kind = "boolean"; position += 4 }
+    else if (substr(input, position, 5) == "false") { value = "false"; kind = "boolean"; position += 5 }
+    else if (substr(input, position, 4) == "null") { value = ""; kind = "null"; position += 4 }
+    else if (match(substr(input, position), /^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/)) {
+      value = substr(input, position, RLENGTH); position += RLENGTH; kind = "number"
+    } else fail("unsupported value")
+    if (depth == 1) {
+      if (key in values) fail("duplicate field: " key)
+      values[key] = value; kinds[key] = kind
+    }
+    whitespace(); character = substr(input, position++, 1)
+    if (character == "}") return
+    if (character != ",") fail("expected comma or closing brace")
+  }
+  fail("unterminated object")
+}
+{ input = input $0 "\n" }
+END {
+  position = 1
+  if (substr(input, 1, 3) == sprintf("%c%c%c", 239, 187, 191)) position = 4
+  whitespace()
+  if (substr(input, position, 1) != "{") fail("expected object")
+  object_value(1); whitespace()
+  if (position <= length(input)) fail("trailing content")
+  if (!(field in values) || kinds[field] == "null") { print fallback; exit }
+  if (kinds[field] != expected) fail("wrong type for " field)
+  if (values[field] ~ /[[:cntrl:]]/) fail("control character in " field)
+  print values[field]
+}
+`;
+}
+
+// ../deploy/src/container/deploy-scripts.ts
+function shellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function createApplyScript(options) {
+  const values = {
+    ID: shellArgument(options.deploymentId),
+    PROJECT: shellArgument(`hai-${options.projectName}`),
+    ENV: shellArgument(options.environment),
+    RUNTIME: shellArgument(options.runtime),
+    PARTIAL: options.partial ? "true" : "false",
+    SELECTED: shellArgument(options.selected.join(" ")),
+    ROOT: shellArgument(options.directory),
+    PORT: String(options.hostPort),
+    HEALTH: options.healthPaths.map(shellArgument).join(" ")
+  };
+  return String.raw`#!/bin/sh
+set -eu
+umask 077
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+destination=@@ROOT@@
+if [ "$#" -gt 0 ]; then destination=$1; fi
+root=$(mkdir -p -- "$destination" && CDPATH= cd -- "$destination" && pwd)
+id=@@ID@@
+project=@@PROJECT@@
+export HAI_DEPLOY_ENVIRONMENT=@@ENV@@
+runtime=@@RUNTIME@@
+partial=@@PARTIAL@@
+orphan_option=''
+if [ "$partial" = false ]; then orphan_option=--remove-orphans; fi
+recreate_option=--force-recreate
+if [ "$partial" = true ]; then recreate_option=--no-recreate; fi
+selected=@@SELECTED@@
+release="$root/releases/$id"
+case "$release/" in "$source_dir/"*) printf 'Extract the package outside the deployment directory before applying it.\n' >&2; exit 1;; esac
+stage=''
+previous=''
+restore=''
+changed=false
+locked=false
+interrupted=false
+started=$(date +%s)
+step_started=$started
+step() {
+  if [ -n "$stage" ]; then
+    duration=$(( $(date +%s) - step_started ))
+    printf '[PASS] %s (%ss)\n' "$stage" "$duration"
+    printf '{"stage":"%s","status":"passed","durationSeconds":%s}\n' "$stage" "$duration" >> "$root/steps-$id.jsonl"
+  fi
+  stage="$1"
+  step_started=$(date +%s)
+  printf '\n[%s] %s\n' "$stage" "$2"
+}
+compose() {
+  arguments_file="$release/compose-files"
+  if [ -n "$restore" ]; then arguments_file="$root/releases/$restore/compose-files"; fi
+  # -f 按顺序合并，由 Compose 保留未选服务、卷和环境文件，不自行拼装配置。
+  command_args="$release/.compose-command"
+  # 文件列表先反向读取，再向参数头部加入，保留原始合并顺序。
+  awk '{lines[NR]=$0} END {for(i=NR;i>0;i--) print lines[i]}' "$arguments_file" > "$command_args"
+  while IFS= read -r file; do set -- -f "$file" "$@"; done < "$command_args"
+  "$runtime" compose -p "$project" "$@"
+}
+remove_selected() {
+  test "$partial" = true || return 0
+  # 直接替换选中容器，避免 Compose Provider 连带重建依赖它的未选服务；不删除卷。
+  for service in "$@"; do
+    containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service") || return 1
+    for container in $containers; do
+      "$runtime" rm -f "$container" || return 1
+    done
+  done
+}
+finish() {
+  code=$?
+  trap - EXIT HUP INT TERM
+  if [ "$code" -ne 0 ]; then
+    printf '[FAIL] %s (exit %s)\n' "$stage" "$code" >&2
+    if [ "$changed" = true ]; then
+      diagnostics="$root/diagnostics-$id.log"
+      : > "$diagnostics"
+      for service in $selected; do
+        containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service" || true)
+        for container in $containers; do
+          "$runtime" inspect --format '{{.Name}} {{.State.Status}} exit={{.State.ExitCode}}' "$container" >> "$diagnostics" 2>&1 || true
+          "$runtime" logs --tail 80 "$container" >> "$diagnostics" 2>&1 || true
+        done
+      done
+      printf 'Startup diagnostics saved to %s (private server file).\n' "$diagnostics" >&2
+    fi
+    if [ -f "$release/rollback-images" ]; then
+      while IFS=' ' read -r image reference; do
+        test -n "$reference" || continue
+        "$runtime" tag "$image" "$reference" || printf '[FAIL] Cannot restore image %s\n' "$reference" >&2
+      done < "$release/rollback-images"
+    fi
+    if [ "$changed" = true ] && [ -n "$previous" ]; then
+      printf '[RECOVER] Restoring previous selected services\n' >&2
+      recover_selected=$selected
+      if [ "$partial" = false ]; then recover_selected=$(grep -v -- '-init$' "$root/releases/$previous/services"); fi
+      restore="$previous"
+      if remove_selected $recover_selected && compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $recover_selected; then
+        case " $selected " in *' app '*)
+          if grep -qx web "$root/releases/$previous/services"; then compose exec -T web nginx -s reload || true; fi
+          ;;
+        esac
+        printf '[RECOVER] Previous containers restored; verify application health\n' >&2
+      else
+        printf '[FAIL] Recovery failed. Use the previous release and inspect container logs.\n' >&2
+      fi
+    elif [ "$changed" = true ]; then
+      compose stop $selected || true
+      printf '[RECOVER] Failed first installation stopped; data volumes retained\n' >&2
+    fi
+  fi
+  if [ "$locked" = true ]; then
+    elapsed=$(( $(date +%s) - started ))
+    outcome=passed
+    if [ "$code" -ne 0 ]; then outcome=failed; fi
+    printf '{"stage":"%s","status":"%s","durationSeconds":%s}\n' "$stage" "$outcome" "$(( $(date +%s) - step_started ))" >> "$root/steps-$id.jsonl"
+    # 先完整写入再同目录原子发布，SSH 重连核对不能读取到半份终态结果。
+    printf '{"deploymentId":"%s","stage":"%s","exitCode":%s,"durationSeconds":%s}\n' "$id" "$stage" "$code" "$elapsed" > "$root/result-$id.json.next"
+    mv "$root/result-$id.json.next" "$root/result-$id.json"
+    # 前台命令及同步恢复已结束；后台服务可继续运行，但不能使成功终态永久占锁。
+    # 中断时仍可能有活跃子命令，必须由全部描述符持有者退出后释放。
+    if [ "$interrupted" = false ]; then
+      flock -u 9
+      exec 9>&-
+    fi
+  fi
+  exit "$code"
+}
+trap finish EXIT
+trap 'interrupted=true; exit 130' HUP INT TERM
+step preflight 'Checking deployment tools and package'
+for tool in sha256sum tar awk curl flock; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s\n' "$tool" >&2; exit 1; }; done
+if [ "$runtime" = auto ]; then
+  if command -v podman >/dev/null 2>&1 && podman version >/dev/null 2>&1; then runtime=podman; else runtime=docker; fi
+fi
+case "$runtime" in docker|podman) ;; *) printf 'Runtime must be docker or podman\n' >&2; exit 1;; esac
+"$runtime" version >/dev/null
+"$runtime" compose version >/dev/null
+"$runtime" compose up --help | grep -q never || { printf 'Compose is too old. Install Docker Compose v2 or podman-compose 1.6.0 or newer (supports --pull never).\n' >&2; exit 1; }
+# 内核锁绑定同一文件描述符；绝不删除/替换锁文件，避免新 inode 绕过活跃部署。
+# 子命令继承 FD 9：即使父 shell 被强杀，仍执行的命令继续持锁；全部退出或重启后自动释放。
+exec 9>"$root/.deploy.lock"
+if flock -n 9; then
+  :
+else
+  lock_code=$?
+  if [ "$lock_code" -eq 1 ]; then
+    printf 'Another deployment is running. Wait for its commands to finish; do not remove %s/.deploy.lock.\n' "$root" >&2
+  else
+    printf 'Cannot acquire deployment lock (exit %s). Check filesystem flock support and permissions.\n' "$lock_code" >&2
+  fi
+  exit "$lock_code"
+fi
+locked=true
+cd "$source_dir"
+sha256sum -c SHA256SUMS
+if [ -f "$root/current" ]; then
+  previous=$(cat "$root/current")
+  case "$previous" in ''|*[!a-zA-Z0-9._-]*) printf 'Invalid deployment state\n' >&2; exit 1;; esac
+  test -f "$root/releases/$previous/compose-files"
+fi
+if [ "$partial" = true ]; then
+  test -n "$previous" || { printf 'Partial deployment requires a successful full installation. Deploy a complete bundle first.\n' >&2; exit 1; }
+  cmp -s layout "$root/releases/$previous/layout" || { printf 'Ports, API routes or application layout changed. Create a full deployment bundle.\n' >&2; exit 1; }
+fi
+test ! -e "$release" || { printf 'This deployment ID was already used. Create a new deployment bundle.\n' >&2; exit 1; }
+mkdir -p "$release"
+cp -R "$source_dir/." "$release/"
+# Nginx 以非 root 用户运行；只开放不含凭据的代理配置读取权限。
+if [ -f "$release/web.conf" ]; then chmod 644 "$release/web.conf"; fi
+: > "$release/compose-files"
+if [ "$partial" = true ]; then
+  cp "$root/releases/$previous/compose-files" "$release/compose-files"
+  cp "$root/releases/$previous/middleware.env" "$release/middleware.env"
+  for service in $selected; do
+    grep -qx "$service" "$root/releases/$previous/services" || { printf 'Service %s has no installed baseline. Use a full deployment.\n' "$service" >&2; exit 1; }
+  done
+fi
+printf '%s\n' "$release/compose-entry.json" >> "$release/compose-files"
+compose config >/dev/null
+compose config --services > "$release/services"
+: > "$release/rollback-images"
+if [ -n "$previous" ]; then
+  for service in $selected; do
+    containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service")
+    for container in $containers; do
+      "$runtime" inspect --format '{{.Image}} {{.Config.Image}}' "$container" >> "$release/rollback-images"
+    done
+  done
+fi
+step images 'Loading packaged images (no registry access)'
+while IFS=' ' read -r archive reference; do
+  test -n "$archive" || continue
+  "$runtime" load -i "$release/images/$archive"
+  "$runtime" image inspect "$reference" >/dev/null
+  architecture=$("$runtime" image inspect --format '{{.Architecture}}' "$reference")
+  host_arch=$(uname -m)
+  case "$host_arch:$architecture" in x86_64:amd64|aarch64:arm64) ;; *) printf 'Image architecture %s does not match server %s\n' "$architecture" "$host_arch" >&2; exit 1;; esac
+done < "$release/image-list"
+step dependencies 'Checking dependencies of selected services'
+if [ "$partial" = true ]; then cat "$release/services" >> "$release/dependencies"; fi
+while IFS= read -r dependency; do
+  test -n "$dependency" || continue
+  case "$dependency" in *-init) continue;; esac
+  case " $selected " in *" $dependency "*) continue;; esac
+  running=$("$runtime" ps -q --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$dependency")
+  test -n "$running" || { printf 'Dependency %s is not running. Include it in a full deployment.\n' "$dependency" >&2; exit 1; }
+  for container in $running; do
+    test "$("$runtime" inspect --format '{{.State.Running}}' "$container")" = true || { printf 'Dependency %s is stopped. Start it before retrying.\n' "$dependency" >&2; exit 1; }
+  done
+done < "$release/dependencies"
+step start 'Updating selected services'
+changed=true
+remove_selected $selected
+if [ -f "$release/initialize-storage" ]; then
+  remove_selected storage-init
+  compose up -d --no-deps --no-build --pull never storage
+  compose up --no-deps --no-build --pull never "$recreate_option" --exit-code-from storage-init storage-init
+fi
+compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $selected
+case " $selected " in
+  *' app '*)
+    case " $selected " in *' web '*) ;; *)
+      if grep -qx web "$release/services"; then compose exec -T web nginx -s reload; fi
+    esac
+    ;;
+esac
+step health 'Checking HTTP access'
+for path in @@HEALTH@@; do
+  ready=false
+  attempt=0
+  while [ "$attempt" -lt 40 ]; do
+    if curl --noproxy '*' -fsS --max-time 5 "http://127.0.0.1:@@PORT@@$path" >/dev/null 2>&1; then ready=true; break; fi
+    attempt=$((attempt + 1))
+    sleep 3
+  done
+  test "$ready" = true || { printf 'HTTP check failed: %s. Inspect compose logs for selected services.\n' "$path" >&2; exit 1; }
+done
+step complete 'Deployment passed all checks'
+printf '%s\n' "$id" > "$root/current.next"
+mv "$root/current.next" "$root/current"
+printf '[PASS] %s\n' "$id"
+`.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]);
+}
+function createUploadScripts() {
+  const sh = String.raw`#!/bin/sh
+set -eu
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+cd "$source_dir/.."
+command -v awk >/dev/null || { printf 'Install POSIX awk to read deploy-target.json.\n' >&2; exit 1; }
+read_target() {
+  LC_ALL=C awk -v field="$1" -v expected="$2" -v fallback="$3" -f "$source_dir/read-target.awk" "$source_dir/deploy-target.json"
+}
+host=$(read_target host string SERVER_HOST)
+user=$(read_target username string deploy)
+port=$(read_target port number 22)
+remote=$(read_target directory string '')
+bundle=$(read_target bundle string '')
+identity=$(read_target identityFile string '')
+known_hosts=$(read_target knownHostsFile string '')
+strict=$(read_target strictHostKeyChecking boolean true)
+timeout=$(read_target connectTimeoutSeconds number 10)
+if [ "$#" -ge 1 ]; then host=$1; fi
+if [ "$#" -ge 2 ]; then port=$2; fi
+if [ "$#" -ge 3 ]; then user=$3; fi
+if value=$(printenv HAI_DEPLOY_IDENTITY_FILE) && [ -n "$value" ]; then identity=$value; fi
+if value=$(printenv HAI_DEPLOY_KNOWN_HOSTS_FILE) && [ -n "$value" ]; then known_hosts=$value; fi
+invalid_target() { printf 'Invalid deployment target. Edit deploy-target.json before running this script.\n' >&2; exit 1; }
+test "$host" != SERVER_HOST || { printf 'Specify the server: sh deploy.sh SERVER [PORT] [USER].\n' >&2; exit 1; }
+case "$host" in ''|*[!a-zA-Z0-9.:-]*|[!a-zA-Z0-9]*) invalid_target;; esac
+case "$user" in ''|*[!a-zA-Z0-9_-]*|[!a-zA-Z_]*) invalid_target;; esac
+case "$port" in ''|*[!0-9]*|???????????*) invalid_target;; esac
+test "$port" -ge 1 && test "$port" -le 65535 || invalid_target
+case "$timeout" in ''|*[!0-9]*|???????????*) invalid_target;; esac
+test "$timeout" -ge 1 && test "$timeout" -le 2147483647 || invalid_target
+case "$remote" in /*) ;; *) invalid_target;; esac
+case "$remote" in *[!a-zA-Z0-9/_.\ -]*|*/../*|*/..|/..) invalid_target;; esac
+case "$bundle" in *.tar) ;; *) invalid_target;; esac
+case "$bundle" in ''|*[!a-zA-Z0-9_.+-]*) invalid_target;; esac
+case "$strict" in true) strict=accept-new;; false) strict=no;; *) invalid_target;; esac
+test -f "./$bundle" || { printf 'Bundle missing: %s\n' "$bundle" >&2; exit 1; }
+for tool in ssh scp; do command -v "$tool" >/dev/null || { printf 'Install OpenSSH (%s).\n' "$tool" >&2; exit 1; }; done
+set -- -o BatchMode=yes -o "StrictHostKeyChecking=$strict" -o "ConnectTimeout=$timeout"
+if [ -n "$identity" ]; then set -- "$@" -i "$identity" -o IdentitiesOnly=yes; fi
+if [ -n "$known_hosts" ]; then
+  known_hosts=$(printf '%s' "$known_hosts" | sed 's/[\\"]/\\&/g')
+  set -- "$@" -o "UserKnownHostsFile=\"$known_hosts\""
+fi
+printf '[1/3] Connecting to %s\n' "$host"
+ssh "$@" -p "$port" "$user@$host" "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"
+printf '[2/3] Uploading %s\n' "$bundle"
+scp_host=$host
+case "$host" in *:*) scp_host="[$host]";; esac
+scp "$@" -P "$port" "./$bundle" "$user@$scp_host:$remote/incoming/$bundle"
+printf '[3/3] Applying package and checking HTTP access\n'
+if ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"; then
+  :
+else
+  code=$?
+  printf '[UNKNOWN] Remote execution may continue. Inspect %s/result-<deploymentId>.json (ID in manifest.json), current and containers before retrying.\n' "$remote" >&2
+  exit "$code"
+fi
+`;
+  const ps1 = String.raw`param([string]$IdentityFile = $env:HAI_DEPLOY_IDENTITY_FILE)
+$ErrorActionPreference = 'Stop'
+Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)
+$target = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'deploy-target.json') -Raw -Encoding UTF8 | ConvertFrom-Json
+if ($target.host -eq 'SERVER_HOST') { throw 'Set the server host in deploy-target.json.' }
+if ($target.host -isnot [string] -or $target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -isnot [string] -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -isnot [string] -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]*$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -isnot [string] -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar$') { throw 'Invalid deployment target.' }
+$port = if ($null -eq $target.port) { 22 } else { $target.port }
+$timeout = if ($null -eq $target.connectTimeoutSeconds) { 10 } else { $target.connectTimeoutSeconds }
+if ($port -is [string] -or [string]$port -notmatch '^[0-9]+$' -or $port -lt 1 -or $port -gt 65535 -or $timeout -is [string] -or [string]$timeout -notmatch '^[0-9]+$' -or $timeout -lt 1 -or $timeout -gt 2147483647) { throw 'Invalid deployment port or timeout.' }
+if ($null -ne $target.strictHostKeyChecking -and $target.strictHostKeyChecking -isnot [bool]) { throw 'Invalid host key policy.' }
+if (($null -ne $target.identityFile -and $target.identityFile -isnot [string]) -or ($null -ne $target.knownHostsFile -and $target.knownHostsFile -isnot [string])) { throw 'Invalid SSH file path.' }
+$strict = if ($target.strictHostKeyChecking -eq $false) { 'no' } else { 'accept-new' }
+$options = @('-o', 'BatchMode=yes', '-o', "StrictHostKeyChecking=$strict", '-o', "ConnectTimeout=$timeout")
+if (-not $IdentityFile) { $IdentityFile = $target.identityFile }
+if ($IdentityFile) { $options += @('-i', $IdentityFile, '-o', 'IdentitiesOnly=yes') }
+$knownHosts = if ($env:HAI_DEPLOY_KNOWN_HOSTS_FILE) { $env:HAI_DEPLOY_KNOWN_HOSTS_FILE } else { $target.knownHostsFile }
+if ($knownHosts) {
+  $knownHosts = $knownHosts.Replace('\', '\\').Replace('"', '\"')
+  $options += @('-o', ('UserKnownHostsFile="' + $knownHosts + '"'))
+}
+$destination = "$($target.username)@$($target.host)"
+$scpDestination = if ($target.host.Contains(':')) { "$($target.username)@[$($target.host)]" } else { $destination }
+$remote = $target.directory
+$bundle = $target.bundle
+if (-not (Test-Path -LiteralPath "./$bundle" -PathType Leaf)) { throw "Bundle missing: $bundle" }
+function ConvertTo-NativeArgument([string]$Value) {
+  if ($Value.Length -gt 0 -and $Value -notmatch '[\s"]') { return $Value }
+  $escaped = [regex]::Replace($Value, '(\\*)"', '$1$1\"')
+  $escaped = [regex]::Replace($escaped, '(\\+)$', '$1$1')
+  return '"' + $escaped + '"'
+}
+function Invoke-Step([string]$Name, [string]$Command, [string[]]$Arguments) {
+  Write-Host "[$Name]"
+  $nativeCommand = Get-Command $Command -ErrorAction Stop
+  if ($PSVersionTable.PSVersion.Major -lt 6 -and $nativeCommand.CommandType -eq 'Application') {
+    $start = New-Object System.Diagnostics.ProcessStartInfo
+    $start.FileName = $nativeCommand.Source
+    $start.WorkingDirectory = (Get-Location).ProviderPath
+    $start.UseShellExecute = $false
+    $start.CreateNoWindow = $true
+    $start.Arguments = ($Arguments | ForEach-Object { ConvertTo-NativeArgument $_ }) -join ' '
+    $child = [System.Diagnostics.Process]::Start($start)
+    try { $child.WaitForExit(); $code = $child.ExitCode } finally { $child.Dispose() }
+  } else {
+    & $Command @Arguments
+    $code = $LASTEXITCODE
+  }
+  $global:LASTEXITCODE = $code
+  if ($code -ne 0) { throw "$Name failed (exit $code)." }
+}
+$applying = $false
+try {
+  foreach ($tool in @('ssh', 'scp')) { Get-Command $tool -ErrorAction Stop | Out-Null }
+  Invoke-Step '1/3 Connect' 'ssh' ($options + @('-p', [string]$port, $destination, "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"))
+  Invoke-Step '2/3 Upload' 'scp' ($options + @('-P', [string]$port, "./$bundle", "$($scpDestination):$remote/incoming/$bundle"))
+  $applying = $true
+  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"))
+} catch {
+  if ($applying) { [Console]::Error.WriteLine("[UNKNOWN] Remote execution may continue. Inspect $remote/result-<deploymentId>.json (ID in manifest.json), current and containers before retrying.") }
+  Write-Error $_
+  exit 1
+}
+`;
+  return { sh, ps1, reader: createTargetReader() };
+}
+
+// ../deploy/src/container/deploy-bundle.ts
+async function createDeploymentBundle(options) {
+  const { directory, artifactDir, artifact, projectName, environment, config, selected } = options;
+  const stem = basename(options.output).replace(/\.tar$/i, "");
+  const suffix = `-${artifact.appVersion}`;
+  const output = resolve(dirname(options.output), `${stem.endsWith(suffix) ? stem : `${stem}${suffix}`}.tar`);
+  if (!/^[\w.+-]+\.tar$/.test(basename(output)))
+    throw new Error(deployM("deploy_bundleNameInvalid"));
+  const staging = mkdtempSync(join(directory, ".bundle-"));
+  const temporaryTar = `${output}.partial`;
+  mkdirSync(dirname(output), { recursive: true, mode: 448 });
+  chmodSync(staging, 448);
+  const files = [];
+  const put = (file, content) => {
+    mkdirSync(dirname(join(staging, file)), { recursive: true });
+    writeFileSync(join(staging, file), content, { mode: 384 });
+    files.push(file);
+  };
+  try {
+    mkdirSync(join(staging, "images"));
+    const compose = parse(readFileSync(join(directory, `docker-compose-${artifact.appVersion}.yml`), "utf8"));
+    const dependencies = /* @__PURE__ */ new Set();
+    const references = /* @__PURE__ */ new Set();
+    for (const name of selected) {
+      const service = compose.services[name];
+      if (!service)
+        throw new Error(deployM("deploy_selectionInvalid", { params: { service: name } }));
+      if (typeof service.image === "string")
+        references.add(service.image);
+      if (service.depends_on) {
+        for (const dependency of Array.isArray(service.depends_on) ? service.depends_on : Object.keys(service.depends_on))
+          dependencies.add(dependency);
+      }
+      if (service.env_file)
+        service.env_file = [`../${options.deploymentId}/.env.runtime`, `../${options.deploymentId}/middleware.env`];
+      if (Array.isArray(service.volumes))
+        service.volumes = service.volumes.map((mount) => typeof mount === "string" ? mount.replace("./web.conf:", `../${options.deploymentId}/web.conf:`) : mount);
+    }
+    put("compose.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, compose.services[name]])) }));
+    put("compose-entry.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, { extends: { file: `../${options.deploymentId}/compose.json`, service: name } }])) }));
+    let runtime;
+    const imageList = [];
+    for (const reference of references) {
+      if (!/:[^/:]+$/.test(reference) || /:latest$/i.test(reference))
+        throw new Error(deployM("deploy_imageVersionRequired", { params: { image: reference } }));
+      const built = artifact.images.find((image) => image.imageRef === reference);
+      const file = built?.file ?? `middleware-${imageList.length + 1}.tar`;
+      if (built) {
+        copyFileSync(join(artifactDir, file), join(staging, "images", file));
+      } else {
+        if (!runtime) {
+          const candidates = options.runtime === "auto" ? ["podman", "docker"] : [options.runtime];
+          for (const candidate of candidates) {
+            if ((await runCommand(candidate, ["version"])).success) {
+              runtime = candidate;
+              break;
+            }
+          }
+          if (!runtime)
+            throw new Error(deployM("deploy_bundleRuntimeRequired"));
+        }
+        if (!(await runCommand(runtime, ["image", "inspect", reference])).success) {
+          const pulled = await runCommand(runtime, ["pull", reference], { timeoutMs: 6e5 });
+          if (!pulled.success)
+            throw new Error(pulled.error.message);
+        }
+        const saved = await runCommand(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", join(staging, "images", file), reference], { timeoutMs: 6e5 });
+        if (!saved.success)
+          throw new Error(saved.error.message);
+      }
+      files.push(`images/${file}`);
+      imageList.push(`${file} ${reference}`);
+    }
+    put(".env.runtime", readFileSync(join(directory, ".env.runtime"), "utf8"));
+    put("middleware.env", options.middlewareEnv);
+    if (selected.includes("web"))
+      put("web.conf", readFileSync(join(directory, "web.conf"), "utf8"));
+    put("manifest.json", `${JSON.stringify({ ...artifact, images: artifact.images.filter((image) => references.has(image.imageRef)), deploymentId: options.deploymentId, selectedServices: selected, partial: options.partial }, null, 2)}
+`);
+    put("layout", `${config.expose.hostPort}:${options.containerPort}:${options.hasWeb}:${options.hasWeb ? await artifactChecksum(join(directory, "web.conf")) : ""}
+`);
+    put("image-list", `${imageList.join("\n")}
+`);
+    put("dependencies", `${[...dependencies].join("\n")}
+`);
+    if (selected.includes("storage-init"))
+      put("initialize-storage", "");
+    put("apply.sh", createApplyScript({ deploymentId: options.deploymentId, projectName, environment, directory: `${config.remote.baseDir}/${projectName}`, runtime: config.remote.runtime, partial: options.partial, selected: selected.filter((name) => name !== "storage-init"), hostPort: config.expose.hostPort, healthPaths: options.healthPaths }));
+    const instructionParams = { file: basename(output), start: "apply.sh", images: [...references].join("\n"), compose: "compose.json" };
+    const instructions = deployM("deploy_bundleInstructions", { params: instructionParams });
+    put("README.txt", `${deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, compose: "compose.json" } })}
+${instructions}
+`);
+    const checksums = [];
+    for (const file of files)
+      checksums.push(`${await artifactChecksum(join(staging, file))}  ${file}`);
+    writeFileSync(join(staging, "SHA256SUMS"), `${checksums.join("\n")}
+`);
+    const tar = await runCommand("tar", ["-cf", temporaryTar, "-C", staging, "."]);
+    if (!tar.success)
+      throw new Error(tar.error.message);
+    chmodSync(temporaryTar, 384);
+    renameSync(temporaryTar, output);
+    const upload = createUploadScripts();
+    const scripts = `${output.slice(0, -4)}-deploy`;
+    mkdirSync(scripts, { recursive: true, mode: 448 });
+    writeFileSync(join(scripts, "deploy.sh"), upload.sh, { mode: 448 });
+    writeFileSync(join(scripts, "deploy.ps1"), upload.ps1);
+    writeFileSync(join(scripts, "read-target.awk"), upload.reader);
+    const target = {
+      host: config.ssh?.host ?? "SERVER_HOST",
+      port: config.ssh?.port ?? 22,
+      username: config.ssh?.username ?? "deploy",
+      identityFile: config.ssh?.identityFile ?? "",
+      knownHostsFile: config.ssh?.knownHostsFile ?? "",
+      strictHostKeyChecking: config.ssh?.strictHostKeyChecking ?? true,
+      connectTimeoutSeconds: config.ssh?.connectTimeoutSeconds ?? 10,
+      directory: `${config.remote.baseDir}/${projectName}`,
+      bundle: basename(output)
+    };
+    const comments = {
+      host: deployM("deploy_targetHost"),
+      port: deployM("deploy_targetPort"),
+      username: deployM("deploy_targetUsername"),
+      identityFile: deployM("deploy_targetIdentityFile"),
+      knownHostsFile: deployM("deploy_targetKnownHostsFile"),
+      strictHostKeyChecking: deployM("deploy_targetStrictHostKeyChecking"),
+      connectTimeoutSeconds: deployM("deploy_targetConnectTimeoutSeconds"),
+      directory: deployM("deploy_targetDirectory"),
+      bundle: deployM("deploy_targetBundle")
+    };
+    writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...target, _comments: comments }, null, 2)}
+`);
+    writeFileSync(join(scripts, "README.txt"), instructions);
+    return { bundlePath: output, instructions: `${deployM("deploy_bundleInstructions", { params: { ...instructionParams, file: output } })}
+${scripts}`, startName: "apply.sh" };
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+    rmSync(temporaryTar, { force: true });
+  }
+}
+var IMAGES = {
+  postgres: "docker.io/library/postgres:16.15-alpine",
+  mysql: "docker.io/library/mysql:8.4.11",
+  redis: "docker.io/library/redis:7.4.11-alpine",
+  rustfs: "ghcr.io/rustfs/rustfs:1.0.1",
+  minio: "ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z",
+  qdrant: "docker.io/qdrant/qdrant:v1.19.2",
+  pgvector: "docker.io/pgvector/pgvector:0.8.0-pg17",
+  chroma: "docker.io/chromadb/chroma:1.5.5",
+  ldap: "docker.io/osixia/openldap:1.5.0",
+  smtp: "docker.io/axllent/mailpit:v1.27.4"
+};
+function generatePassword() {
+  return randomBytes(24).toString("base64url");
+}
+function resolveSidecarSecrets(appDir, projectName) {
+  const secretFile = join(appDir, ".hai", "deploy", "runtime", `${projectName}.secrets.json`);
+  if (existsSync(secretFile)) {
+    try {
+      const saved = JSON.parse(readFileSync(secretFile, "utf-8"));
+      if (!saved || !["dbPassword", "storagePassword", "ldapPassword"].every((key) => typeof saved[key] === "string" && saved[key].length > 0))
+        throw new Error("Invalid credentials");
+      return saved;
+    } catch {
+      throw new Error(deployM("deploy_secretsInvalid", { params: { path: secretFile } }));
+    }
+  }
+  const secrets = {
+    dbPassword: generatePassword(),
+    storagePassword: generatePassword(),
+    ldapPassword: generatePassword()
+  };
+  mkdirSync(dirname(secretFile), { recursive: true });
+  writeFileSync(secretFile, JSON.stringify(secrets), { mode: 384 });
+  return secrets;
+}
+function addAppDataVolume(plan, projectName) {
+  const mount = `${projectName}-data:/app/data`;
+  if (!plan.appVolumes.includes(mount)) {
+    plan.appVolumes.push(mount);
+    plan.volumes[`${projectName}-data`] = null;
+  }
+}
+function planPostgresDb(plan, projectName, password, net) {
+  plan.services.push("db");
+  plan.dependsOn.push("db");
+  plan.composeServices.db = {
+    image: IMAGES.postgres,
+    container_name: `hai-${projectName}-db`,
+    restart: "unless-stopped",
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-db-data:/var/lib/postgresql/data`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-db-data`] = null;
+  plan.env.POSTGRES_USER = "hai";
+  plan.env.POSTGRES_PASSWORD = password;
+  plan.env.POSTGRES_DB = "hai";
+  plan.env.HAI_DB = JSON.stringify({ type: "postgresql", url: `postgresql://hai:${password}@db:5432/hai`, database: "hai" });
+  plan.secrets.push(password);
+}
+function planMysqlDb(plan, projectName, password, net) {
+  plan.services.push("db");
+  plan.dependsOn.push("db");
+  plan.composeServices.db = {
+    image: IMAGES.mysql,
+    container_name: `hai-${projectName}-db`,
+    restart: "unless-stopped",
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-db-data:/var/lib/mysql`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-db-data`] = null;
+  plan.env.MYSQL_ROOT_PASSWORD = password;
+  plan.env.MYSQL_DATABASE = "hai";
+  plan.env.MYSQL_USER = "hai";
+  plan.env.MYSQL_PASSWORD = password;
+  plan.env.HAI_DB = JSON.stringify({ type: "mysql", url: `mysql://hai:${password}@db:3306/hai`, database: "hai" });
+  plan.secrets.push(password);
+}
+function planRedisCache(plan, projectName, net) {
+  plan.services.push("cache");
+  plan.dependsOn.push("cache");
+  plan.composeServices.cache = {
+    image: IMAGES.redis,
+    container_name: `hai-${projectName}-cache`,
+    restart: "unless-stopped",
+    networks: net
+  };
+  plan.env.HAI_CACHE = JSON.stringify({ type: "redis", url: "redis://cache:6379" });
+}
+function planS3Storage(plan, projectName, password, net, engine) {
+  plan.services.push("storage");
+  plan.dependsOn.push("storage");
+  plan.composeServices.storage = {
+    image: IMAGES[engine],
+    container_name: `hai-${projectName}-storage`,
+    restart: "unless-stopped",
+    ...engine === "minio" ? { command: ["server", "/data"] } : {},
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-storage-data:/data`],
+    networks: net
+  };
+  plan.composeServices["storage-init"] = {
+    depends_on: ["storage"],
+    env_file: [".env.runtime"],
+    entrypoint: [
+      "node",
+      "--input-type=module",
+      "-e",
+      // 复用应用 @h-ai/storage 已依赖的 SDK；不额外拉取失效的 mc 镜像，不把密钥拼进命令。
+      `import { S3Client, HeadBucketCommand, CreateBucketCommand } from '@aws-sdk/client-s3';
+const config = JSON.parse(process.env.HAI_STORAGE);
+const client = new S3Client({ endpoint: config.endpoint, region: config.region, forcePathStyle: config.forcePathStyle, credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } });
+let ready = false;
+for (let attempt = 0; attempt < 120; attempt++) {
+  try {
+    try { await client.send(new HeadBucketCommand({ Bucket: config.bucket })); }
+    catch (error) {
+      if (error.$$metadata?.httpStatusCode !== 404) throw error;
+      await client.send(new CreateBucketCommand({ Bucket: config.bucket }));
+    }
+    ready = true; break;
+  } catch { await new Promise(resolve => setTimeout(resolve, 1000)); }
+}
+client.destroy();
+if (!ready) throw new Error('S3 bucket initialization failed');`
+    ],
+    networks: net
+  };
+  plan.volumes[`${projectName}-storage-data`] = null;
+  if (engine === "rustfs") {
+    Object.assign(plan.env, { RUSTFS_ACCESS_KEY: "hai-storage", RUSTFS_SECRET_KEY: password, RUSTFS_ADDRESS: "0.0.0.0:9000", RUSTFS_VOLUMES: "/data", RUSTFS_CONSOLE_ENABLE: "false" });
+  } else {
+    Object.assign(plan.env, { MINIO_ROOT_USER: "hai-storage", MINIO_ROOT_PASSWORD: password });
+  }
+  plan.env.HAI_STORAGE = JSON.stringify({
+    type: "s3",
+    endpoint: "http://storage:9000",
+    bucket: "hai",
+    region: "us-east-1",
+    accessKeyId: "hai-storage",
+    secretAccessKey: password,
+    forcePathStyle: true
+  });
+  plan.secrets.push(password);
+}
+function planQdrantVecdb(plan, projectName, net) {
+  plan.services.push("vecdb");
+  plan.dependsOn.push("vecdb");
+  plan.composeServices.vecdb = {
+    image: IMAGES.qdrant,
+    container_name: `hai-${projectName}-vecdb`,
+    restart: "unless-stopped",
+    volumes: [`${projectName}-vecdb-data:/qdrant/storage`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-vecdb-data`] = null;
+  plan.env.HAI_VECDB = JSON.stringify({ type: "qdrant", url: "http://vecdb:6333" });
+}
+function planPgvectorVecdb(plan, projectName, password, net) {
+  plan.services.push("vecdb");
+  plan.dependsOn.push("vecdb");
+  plan.composeServices.vecdb = {
+    image: IMAGES.pgvector,
+    container_name: `hai-${projectName}-vecdb`,
+    restart: "unless-stopped",
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-vecdb-data:/var/lib/postgresql/data`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-vecdb-data`] = null;
+  plan.env.POSTGRES_USER = "hai";
+  plan.env.POSTGRES_PASSWORD = password;
+  plan.env.POSTGRES_DB = "hai";
+  plan.env.HAI_VECDB = JSON.stringify({ type: "pgvector", url: `postgresql://hai:${password}@vecdb:5432/hai`, database: "hai" });
+  plan.secrets.push(password);
+}
+function planChromaVecdb(plan, projectName, net) {
+  plan.services.push("vecdb");
+  plan.dependsOn.push("vecdb");
+  plan.composeServices.vecdb = {
+    image: IMAGES.chroma,
+    container_name: `hai-${projectName}-vecdb`,
+    restart: "unless-stopped",
+    volumes: [`${projectName}-vecdb-data:/data`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-vecdb-data`] = null;
+  plan.env.HAI_VECDB = JSON.stringify({ type: "chroma", url: "http://vecdb:8000" });
+}
+function planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine = "rustfs") {
+  const serviceModes = { ...options?.serviceModes };
+  for (const requirement of scan.middlewares ?? []) {
+    if (options?.selectedServices && !options.selectedServices.includes(requirement.service))
+      continue;
+    const mode = serviceModes[requirement.envPrefix] ?? serviceModes[requirement.service];
+    if (mode !== "keep")
+      continue;
+    const endpoint = requirement.config.url ?? requirement.config.endpoint;
+    let host = requirement.config.host;
+    if (typeof endpoint === "string") {
+      try {
+        host = new URL(endpoint).hostname;
+      } catch {
+        continue;
+      }
+    }
+    if (host === requirement.service || ["sqlite", "local", "memory", "lancedb"].includes(requirement.backend)) {
+      serviceModes[requirement.envPrefix] = "default";
+      serviceModes[requirement.service] = "default";
+    }
+  }
+  options = { ...options, serviceModes };
+  const plan = {
+    services: [],
+    composeServices: {},
+    volumes: {},
+    appVolumes: [],
+    env: {},
+    dependsOn: [],
+    secrets: []
+  };
+  if (!scan.requiredServices.some((service) => usesDefaultMiddleware(scan, service, options)))
+    return plan;
+  const secrets = resolveSidecarSecrets(appDir, projectName);
+  const net = ["hai-app"];
+  const backends = scan.serviceBackends;
+  for (const service of scan.requiredServices) {
+    if (!usesDefaultMiddleware(scan, service, options))
+      continue;
+    if (service === "db" && !provisionEnv.HAI_DB) {
+      const backend = backends.db ?? "postgresql";
+      if (backend === "mysql")
+        planMysqlDb(plan, projectName, secrets.dbPassword, net);
+      else if (backend === "sqlite")
+        addAppDataVolume(plan, projectName);
+      else
+        planPostgresDb(plan, projectName, secrets.dbPassword, net);
+    } else if (service === "cache" && !provisionEnv.HAI_CACHE) {
+      if ((backends.cache ?? "redis") === "redis")
+        planRedisCache(plan, projectName, net);
+    } else if (service === "storage" && !provisionEnv.HAI_STORAGE) {
+      if ((backends.storage ?? "s3") === "s3")
+        planS3Storage(plan, projectName, secrets.storagePassword, net, s3Engine);
+      else
+        addAppDataVolume(plan, projectName);
+    } else if (service === "vecdb" && !provisionEnv.HAI_VECDB) {
+      const backend = backends.vecdb ?? "qdrant";
+      if (backend === "pgvector")
+        planPgvectorVecdb(plan, projectName, secrets.dbPassword, net);
+      else if (backend === "chroma")
+        planChromaVecdb(plan, projectName, net);
+      else if (backend === "lancedb")
+        addAppDataVolume(plan, projectName);
+      else
+        planQdrantVecdb(plan, projectName, net);
+    } else if (service === "ldap" && backends.ldap === "ldap" && !provisionEnv.HAI_IAM_LDAP) {
+      const password = secrets.ldapPassword ?? secrets.dbPassword;
+      plan.services.push("ldap");
+      plan.dependsOn.push("ldap");
+      plan.composeServices.ldap = { image: IMAGES.ldap, restart: "unless-stopped", env_file: [".env.runtime"], networks: net, volumes: [`${projectName}-ldap-data:/var/lib/ldap`, `${projectName}-ldap-config:/etc/ldap/slapd.d`] };
+      plan.volumes[`${projectName}-ldap-data`] = null;
+      plan.volumes[`${projectName}-ldap-config`] = null;
+      Object.assign(plan.env, { LDAP_DOMAIN: "example.org", LDAP_ORGANISATION: "HAI", LDAP_ADMIN_PASSWORD: password, LDAP_TLS: "false", HAI_IAM_LOGIN_LDAP: "true", HAI_IAM_LDAP: JSON.stringify({ url: "ldap://ldap:389", bindDn: "cn=admin,dc=example,dc=org", bindPassword: password, searchBase: "dc=example,dc=org" }) });
+      plan.secrets.push(password);
+    } else if (service === "email" && (scan.middlewares ? scan.middlewares.some((item) => item.service === "email" && item.backend === "smtp" && (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email ?? "default") === "default") : backends.email === "smtp") && !provisionEnv.HAI_REACH_PROVIDERS) {
+      plan.services.push("email");
+      plan.dependsOn.push("email");
+      plan.composeServices.email = { image: IMAGES.smtp, restart: "unless-stopped", networks: net };
+      const requirements = scan.middlewares?.filter((item) => item.service === "email" && item.backend === "smtp" && ["default", void 0].includes(options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email));
+      if (requirements?.length) {
+        for (const requirement of requirements)
+          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+      } else if (!scan.middlewares) {
+        plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({ name: "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+      }
+    }
+  }
+  return plan;
+}
+function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv = {}, s3Engine = "rustfs") {
+  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine);
+  const env = {
+    NODE_ENV: "production",
+    HOST: "0.0.0.0",
+    PORT: String(containerPort),
+    HAI_SERV_SERVER_HOST: "0.0.0.0",
+    HAI_SERV_SERVER_PORT: String(containerPort),
+    ...appEnv,
+    ...sidecar.env,
+    ...provisionEnv
+  };
+  return { env, sidecar };
+}
+function generateComposeFile(options) {
+  const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
+  const app = {
+    image: imageRef,
+    labels: { "org.opencontainers.image.version": options.appVersion },
+    container_name: `hai-${projectName}-app`,
+    restart: "unless-stopped",
+    // 镜像已由 load 注入本地，禁止 compose 再从 registry 拉取
+    pull_policy: "never",
+    env_file: [".env.runtime"],
+    ports: [`${hostPort}:${containerPort}`],
+    networks: ["hai-app"]
+  };
+  if (sidecar.appVolumes.length > 0)
+    app.volumes = sidecar.appVolumes;
+  if (sidecar.dependsOn.length > 0)
+    app.depends_on = sidecar.dependsOn;
+  const services = { app, ...sidecar.composeServices };
+  if (options.web) {
+    delete app.ports;
+    services.web = {
+      image: options.web.imageRef,
+      labels: { "org.opencontainers.image.version": options.appVersion },
+      container_name: `hai-${projectName}-web`,
+      restart: "unless-stopped",
+      pull_policy: "never",
+      ports: [`${hostPort}:${options.web.containerPort}`],
+      environment: { PUBLIC_API_BASE: "" },
+      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`], interval: "30s", timeout: "5s", retries: 3 },
+      volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
+      depends_on: ["app"],
+      networks: ["hai-app"]
+    };
+  }
+  if (services["storage-init"])
+    services["storage-init"] = { ...services["storage-init"], image: imageRef };
+  const compose = {
+    "x-hai-version": options.appVersion,
+    services,
+    "networks": {
+      "hai-app": { name: `hai-${projectName}` }
+    }
+  };
+  if (Object.keys(sidecar.volumes).length > 0)
+    compose.volumes = sidecar.volumes;
+  if (services["storage-init"]) {
+    app.depends_on = {
+      ...Object.fromEntries((app.depends_on ?? []).map((name) => [name, { condition: "service_started" }])),
+      "storage-init": { condition: "service_completed_successfully" }
+    };
+  }
+  for (const service of Object.values(services))
+    service.pull_policy = "never";
+  return stringify(compose);
+}
+function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
+  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535))
+    throw new Error("Invalid web proxy target");
+  return `server {
+  listen ${webPort};
+  server_name _;
+  root /usr/share/nginx/html;
+  large_client_header_buffers 4 32k;
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  location = /runtime-config.js {
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+    return 200 'globalThis.__HAI_PUBLIC_CONFIG__={apiBase:globalThis.location.origin+"${apiPrefix}"};';
+  }
+  location = /_hai/web-health {
+    access_log off;
+    return 200 'ok';
+  }
+  location = /health {
+    proxy_pass http://app:${port};
+    proxy_set_header Host $http_host;
+  }
+  location ${apiPrefix.replace(/\/$/, "")}/ {
+    client_max_body_size 2129920;
+    proxy_pass http://app:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_request_buffering off;
+    proxy_buffering off;
+    proxy_buffer_size 32k;
+    proxy_buffers 8 32k;
+  }
+}
+`;
+}
+function serializeEnvFile(env) {
+  return `${Object.entries(env).map(([key, value]) => {
+    let literal = value;
+    if (/[\s#$'"]/.test(value)) {
+      if (value.startsWith("{") || value.startsWith("["))
+        literal = `'${value.replaceAll("'", "\\u0027")}'`;
+      else if (!value.includes("'"))
+        literal = `'${value}'`;
+      else
+        literal = JSON.stringify(value).replaceAll("$", "$$");
+    }
+    return `${key}=${literal}`;
+  }).join("\n")}
+`;
+}
+var logger4 = core.logger.child({ module: "deploy", scope: "ssh" });
+function buildConnectOptions(config) {
+  const args = ["-o", "BatchMode=yes"];
+  args.push("-o", `ConnectTimeout=${config.connectTimeoutSeconds}`);
+  args.push("-o", `StrictHostKeyChecking=${config.strictHostKeyChecking ? "accept-new" : "no"}`);
+  if (config.knownHostsFile) {
+    const path = config.knownHostsFile.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+    args.push("-o", `UserKnownHostsFile="${path}"`);
+  }
+  if (config.identityFile) {
+    args.push("-i", config.identityFile);
+    args.push("-o", "IdentitiesOnly=yes");
+  }
+  return args;
+}
+function buildSshExecArgs(config, remoteCommand) {
+  return [
+    ...buildConnectOptions(config),
+    "-p",
+    String(config.port),
+    `${config.username}@${config.host}`,
+    remoteCommand
+  ];
+}
+function buildScpUploadArgs(config, localPath, remotePath) {
+  return [
+    ...buildConnectOptions(config),
+    "-P",
+    String(config.port),
+    localPath,
+    `${config.username}@${config.host.includes(":") ? `[${config.host}]` : config.host}:${remotePath}`
+  ];
+}
+function createSshExecutor(config) {
+  const exec = async (remoteCommand, options) => {
+    const result = await runCommand("ssh", buildSshExecArgs(config, remoteCommand), {
+      timeoutMs: options?.timeoutMs,
+      terminationTimeoutMs: options?.terminationTimeoutMs,
+      maxCaptureChars: options?.maxCaptureChars,
+      secrets: options?.secrets,
+      onOutput: options?.onOutput
+    });
+    if (result.success)
+      return result;
+    const state = getDeployCommandState(result.error);
+    return err({ ...result.error, suggestion: deployM("deploy_remoteUnknown"), ext: { ...result.error.ext, commandExecution: { ...state, reason: state?.reason ?? "exit", localTermination: state?.localTermination ?? "unknown", remoteExecution: "unknown" } } });
+  };
+  const upload = async (localPath, remotePath) => {
+    const args = buildScpUploadArgs(config, localPath, remotePath);
+    const result = await runCommand("scp", args, { timeoutMs: 6e5 });
+    if (!result.success) {
+      return err({ ...HaiDeployError.IMAGE_TRANSFER_FAILED, message: deployM("deploy_imageTransferFailed", { params: { error: result.error.message } }), ext: result.error.ext });
+    }
+    return ok(void 0);
+  };
+  const ping = async () => {
+    logger4.debug("SSH preflight", { host: config.host, port: config.port });
+    const result = await exec("true", { timeoutMs: 2e4 });
+    if (!result.success) {
+      return err({ ...HaiDeployError.REMOTE_CONNECT_FAILED, message: deployM("deploy_remoteConnectFailed", { params: { host: config.host, error: result.error.message } }), ext: result.error.ext });
+    }
+    return ok(void 0);
+  };
+  return { exec, upload, ping };
+}
+
+// ../deploy/src/providers/deploy-provider-docker-ssh.ts
+var logger5 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
+var HEALTH_POLL_INTERVAL = 3e3;
+var HEALTH_MAX_ATTEMPTS = 40;
+var ServerResultSchema = external_exports.object({
+  deploymentId: external_exports.string(),
+  stage: external_exports.enum(["preflight", "images", "dependencies", "start", "health", "complete"]),
+  exitCode: external_exports.number().int().min(0).max(255),
+  durationSeconds: external_exports.number().int().nonnegative()
+});
+function makeDeploymentId() {
+  const now = /* @__PURE__ */ new Date();
+  const pad = (n) => String(n).padStart(2, "0");
+  const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+  return `${stamp}-${randomBytes(3).toString("hex")}`;
+}
+function sleep(ms) {
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
+}
+function createDockerSshProvider(config, container) {
+  const ssh = config.ssh ? createSshExecutor(config.ssh) : void 0;
+  const baseDir = config.remote.baseDir;
+  async function detectRemoteRuntime() {
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
+    const candidates = config.remote.runtime === "auto" ? ["podman", "docker"] : [config.remote.runtime];
+    for (const runtime of candidates) {
+      const versionResult = await ssh.exec(`${runtime} version`, { timeoutMs: 2e4 });
+      if (!versionResult.success)
+        continue;
+      const composeResult = await ssh.exec(`${runtime} compose version`, { timeoutMs: 2e4 });
+      if (composeResult.success) {
+        logger5.info("Remote container runtime detected", { runtime });
+        return ok(runtime);
+      }
+    }
+    return err(
+      HaiDeployError.REMOTE_COMMAND_FAILED,
+      deployM("deploy_remoteRuntimeMissing", { params: { runtime: candidates.join(" / ") } })
+    );
+  }
+  async function healthCheck(url) {
+    for (let attempt = 0; attempt < HEALTH_MAX_ATTEMPTS; attempt++) {
+      try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+        if (response.ok)
+          return true;
+      } catch {
+      }
+      await sleep(HEALTH_POLL_INTERVAL);
+    }
+    return false;
+  }
+  const deploy2 = async (context) => {
+    const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
+    const deploymentId = makeDeploymentId();
+    const hostPort = config.expose.hostPort;
+    const artifactDir = join(resolveProjectDirectory(appDir), ".hai", "deploy", options?.environment ?? "prod");
+    mkdirSync(artifactDir, { recursive: true, mode: 448 });
+    chmodSync(artifactDir, 448);
+    const artifact = context.artifact;
+    const resolvedBuildDir = context.artifactDir;
+    const images = artifact.images;
+    const web = images.find((image) => image.name === "web");
+    const app = images.find((image) => image.name === "app");
+    if (options?.selectedServices) {
+      const available = [...images.map((image) => image.name), ...scan.requiredServices];
+      const invalid = options.selectedServices.find((name) => !available.includes(name));
+      if (!options.selectedServices.length || new Set(options.selectedServices).size !== options.selectedServices.length || invalid)
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: invalid ?? options.selectedServices.join(", ") } }));
+    }
+    const hasWeb = artifact.hasWeb || !!web;
+    const partial = artifact.partial || options?.selectedServices !== void 0;
+    const containerPort = app?.containerPort ?? artifact.appContainerPort ?? config.expose.containerPort;
+    const webContainerPort = web?.containerPort ?? artifact.webContainerPort ?? 8080;
+    const host = config.ssh?.host;
+    const url = host ? `http://${host.includes(":") ? `[${host}]` : host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
+    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
+    if (sidecar.composeServices["storage-init"] && !app && options?.selectedServices?.includes("storage"))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageArtifactRequired"));
+    let webProxy;
+    if (hasWeb) {
+      const server = loadDeploymentConfig("serv", join(appDir, "config", "_serv.yml"), env);
+      if (!server.success)
+        return server;
+      const http = server.data.http;
+      const cors = server.data.cors;
+      const apiPrefix = http?.apiPrefix ?? "/api/v1";
+      if (typeof apiPrefix !== "string" || !/^\/[\w/-]+$/.test(apiPrefix))
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
+      webProxy = generateWebProxyConfig(containerPort, apiPrefix, webContainerPort);
+      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && config.ssh ? url : cors?.origin ?? "*" } });
+    }
+    const envPath = join(artifactDir, ".env.runtime");
+    writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
+    if (options?.environment) {
+      const environment = loadDeploymentEnvironment({ environment: options.environment, envDir: options.envDir ?? scan.envDir ?? appDir });
+      if (!environment.success)
+        return environment;
+      const saved = saveDeploymentEnvironment(environment.data, { HAI_DEPLOY_ENVIRONMENT: environment.data.environment, HAI_CORE_ENV: environment.data.values.HAI_CORE_ENV, ...sidecar.env, ...provisionEnv });
+      if (!saved.success)
+        return saved;
+    }
+    const composeName = `docker-compose-${artifact.appVersion}.yml`;
+    const composeContent = generateComposeFile({
+      projectName,
+      appVersion: artifact.appVersion,
+      imageRef: app?.imageRef ?? "localhost/hai-unselected:0",
+      hostPort,
+      containerPort,
+      sidecar,
+      web: hasWeb ? { imageRef: web?.imageRef ?? "localhost/hai-unselected:0", containerPort: webContainerPort } : void 0
+    });
+    const composePath = join(artifactDir, composeName);
+    writeFileSync(composePath, composeContent);
+    if (webProxy)
+      writeFileSync(join(artifactDir, "web.conf"), webProxy);
+    const selected = options?.selectedServices ? [...options.selectedServices] : artifact.partial ? images.map((image) => image.name) : [...images.map((image) => image.name), ...Object.keys(sidecar.composeServices)];
+    if (!selected.length || selected.some((name) => !/^[a-z][a-z0-9-]*$/.test(name)) || new Set(selected).size !== selected.length)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: selected.join(", ") } }));
+    for (const name of selected) {
+      if (["app", "web"].includes(name) && !images.some((image) => image.name === name))
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: name } }));
+    }
+    if (selected.includes("storage") && sidecar.composeServices["storage-init"] && !selected.includes("storage-init"))
+      selected.push("storage-init");
+    options?.onProgress?.("packaging");
+    const bundle = await createDeploymentBundle({
+      directory: artifactDir,
+      artifactDir: resolvedBuildDir,
+      artifact,
+      projectName,
+      environment: options?.environment ?? "prod",
+      deploymentId,
+      config,
+      runtime: options?.runtime ?? "auto",
+      selected,
+      partial,
+      hasWeb,
+      containerPort,
+      middlewareEnv: serializeEnvFile(sidecar.env),
+      healthPaths: hasWeb ? ["/health", "/_hai/web-health", "/"] : [scan.isSvelteKit ? "/" : "/health"],
+      output: options?.output ?? join(artifactDir, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar`)
+    });
+    if (options?.bundleOnly)
+      return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet: Object.keys(env), ...bundle });
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
+    const ping = await ssh.ping();
+    if (!ping.success)
+      return ping;
+    const remoteRuntime = await detectRemoteRuntime();
+    if (!remoteRuntime.success)
+      return remoteRuntime;
+    const remoteDir = `${baseDir}/${projectName}`;
+    const remoteTar = `${remoteDir}/incoming/${basename(bundle.bundlePath)}`;
+    const prepared = await ssh.exec(`mkdir -p -- ${shellArgument(`${remoteDir}/incoming`)} && chmod 700 -- ${shellArgument(remoteDir)} ${shellArgument(`${remoteDir}/incoming`)}`);
+    if (!prepared.success)
+      return prepared;
+    const uploaded = await ssh.upload(bundle.bundlePath, remoteTar);
+    if (!uploaded.success)
+      return uploaded;
+    let pendingOutput = "";
+    const started = await ssh.exec(
+      `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)}`,
+      { timeoutMs: 6e5, secrets: sidecar.secrets, onOutput: (output) => {
+        const parts = output.split("\n");
+        for (let index = 0; index < parts.length; index++) {
+          pendingOutput += parts[index].slice(0, 512 - pendingOutput.length);
+          if (index === parts.length - 1)
+            break;
+          const line = pendingOutput;
+          pendingOutput = "";
+          const stage = /^\[(preflight|images|dependencies|start|health|complete)\]/.exec(line)?.[1];
+          if (stage)
+            options?.onProgress?.(stage);
+        }
+      } }
+    );
+    if (!started.success) {
+      const resultFile = `${remoteDir}/result-${deploymentId}.json`;
+      const state = getDeployCommandState(started.error);
+      const checked = await ssh.exec(`if [ -f ${shellArgument(resultFile)} ]; then cat -- ${shellArgument(resultFile)}; fi`, { timeoutMs: 2e4, maxCaptureChars: 8192 });
+      let terminal;
+      if (checked.success && !checked.data.stdoutTruncated) {
+        try {
+          const parsed = ServerResultSchema.safeParse(JSON.parse(checked.data.stdout));
+          if (parsed.success && parsed.data.deploymentId === deploymentId)
+            terminal = parsed.data;
+        } catch {
+        }
+      }
+      return err({ ...started.error, message: `${started.error.message}
+${terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage, code: String(terminal.exitCode) } }) : deployM("deploy_remoteUnknown")}`, suggestion: terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage, code: String(terminal.exitCode) } }) : deployM("deploy_remoteUnknown"), ext: { ...started.error.ext, commandExecution: {
+        ...state,
+        reason: state?.reason ?? "exit",
+        localTermination: state?.localTermination ?? "unknown",
+        remoteExecution: terminal ? "finished" : "unknown",
+        deploymentId,
+        resultFile,
+        ...terminal ? { remoteExitCode: terminal.exitCode, remoteStage: terminal.stage } : {}
+      } } });
+    }
+    logger5.info("Running health check", { url });
+    const healthy = await healthCheck(`${url}${!hasWeb && scan.isSvelteKit ? "/" : "/health"}`) && (!hasWeb || await healthCheck(`${url}/_hai/web-health`) && await healthCheck(`${url}/`));
+    if (!healthy) {
+      return err(
+        HaiDeployError.HEALTH_CHECK_FAILED,
+        deployM("deploy_healthCheckFailed", { params: { url } })
+      );
+    }
+    const result = {
+      url,
+      deploymentId,
+      status: "ready",
+      provider: "docker-ssh",
+      healthCheck: "passed",
+      envVarsSet: Object.keys(env),
+      bundlePath: bundle.bundlePath
+    };
+    logger5.info("docker-ssh deployment complete", { url, deploymentId });
+    return ok(result);
+  };
+  const deploySafely = async (context) => {
+    try {
+      return await deploy2(context);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      let safeReason = "Deployment bundle failed";
+      try {
+        safeReason = maskSecrets(reason, Object.values(context.appEnv ?? {}).filter(Boolean));
+      } catch {
+      }
+      logger5.error("Deployment bundle failed", { reason: safeReason });
+      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", { params: { reason: safeReason } }));
+    }
+  };
+  return { name: "docker-ssh", deploy: deploySafely };
+}
+var logger6 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
+var VERCEL_API = "https://api.vercel.com";
+var POLL_INTERVAL = 3e3;
+var MAX_POLL_ATTEMPTS = 60;
+var VercelApiError = class extends Error {
+  constructor(status) {
+    super(deployM("deploy_apiError", { params: { service: "Vercel", status: String(status) } }));
+    this.status = status;
+  }
+  status;
+};
+function toDeployError(codeDef, messageKey, error) {
+  return {
+    ...codeDef,
+    message: deployM(messageKey, {
+      params: { error: error instanceof Error ? error.message : String(error) }
+    }),
+    cause: error
+  };
+}
+async function vercelFetch(token, path, options) {
+  const url = `${VERCEL_API}${path}`;
+  const response = await fetch(url, {
+    ...options,
+    headers: {
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...options?.headers
+    }
+  });
+  if (!response.ok) {
+    throw new VercelApiError(response.status);
+  }
+  return response.json();
+}
+function collectFiles(dir, baseDir) {
+  const results = [];
+  const entries = readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectFiles(fullPath, baseDir));
+    } else {
+      results.push(relative(baseDir, fullPath).split(sep).join("/"));
+    }
+  }
+  return results;
+}
+function createVercelProvider() {
+  let token = null;
+  return {
+    name: "vercel",
+    async authenticate(apiToken) {
+      logger6.debug("Authenticating with Vercel");
+      try {
+        const user = await vercelFetch(
+          apiToken,
+          "/v2/user"
+        );
+        token = apiToken;
+        const username = user.user.username || user.user.email;
+        logger6.info("Vercel authenticated", { user: username });
+        return ok(username);
+      } catch (error) {
+        logger6.error("Vercel authentication failed", { error });
+        return err(toDeployError(HaiDeployError.AUTH_FAILED, "deploy_authFailed", error));
+      }
+    },
+    async createProject(projectName) {
+      if (!token) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger6.debug("Creating Vercel project", { projectName });
+      try {
+        const existingId = await findExistingProject(token, projectName);
+        if (existingId !== null) {
+          logger6.info("Vercel project found", { projectName, projectId: existingId });
+          return ok(existingId);
+        }
+        try {
+          const project = await vercelFetch(
+            token,
+            "/v11/projects",
+            {
+              method: "POST",
+              body: JSON.stringify({
+                name: projectName,
+                framework: "sveltekit"
+              })
+            }
+          );
+          logger6.info("Vercel project created", { projectName, projectId: project.id });
+          return ok(project.id);
+        } catch (error) {
+          if (error instanceof VercelApiError && error.status === 409) {
+            const concurrentProjectId = await findExistingProject(token, projectName);
+            if (concurrentProjectId !== null) {
+              logger6.info("Vercel project reused after create conflict", {
+                projectName,
+                projectId: concurrentProjectId
+              });
+              return ok(concurrentProjectId);
+            }
+          }
+          throw error;
+        }
+      } catch (error) {
+        logger6.error("Vercel project creation failed", { projectName, error });
+        return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error));
+      }
+    },
+    async setEnvVars(projectId, envVars) {
+      if (!token) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger6.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
+      try {
+        const envEntries = Object.entries(envVars).map(([key, value]) => ({
+          key,
+          value,
+          type: "encrypted",
+          target: ["production", "preview", "development"]
+        }));
+        await vercelFetch(
+          token,
+          `/v10/projects/${projectId}/env?upsert=true`,
+          {
+            method: "POST",
+            body: JSON.stringify(envEntries)
+          }
+        );
+        logger6.info("Vercel env vars set", { projectId, count: envEntries.length });
+        return ok(void 0);
+      } catch (error) {
+        logger6.error("Vercel env vars setup failed", { projectId, error });
+        return err(toDeployError(HaiDeployError.ENV_VAR_FAILED, "deploy_envVarFailed", error));
+      }
+    },
+    async deploy(projectId, outputDir) {
+      if (!token) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger6.debug("Deploying to Vercel", { projectId, outputDir });
+      try {
+        const outputConfig = JSON.parse(readFileSync(join(outputDir, "config.json"), "utf8"));
+        if (outputConfig.version !== 3)
+          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
+        const filePaths = collectFiles(outputDir, outputDir);
+        const files = [];
+        for (const filePath of filePaths) {
+          const fullPath = join(outputDir, filePath);
+          const content = readFileSync(fullPath);
+          const sha = createHash("sha1").update(content).digest("hex");
+          const size = statSync(fullPath).size;
+          await uploadFile(token, content, sha);
+          files.push({ file: `.vercel/output/${filePath}`, sha, size });
+        }
+        logger6.debug("Files uploaded", { count: files.length });
+        const deployment = await vercelFetch(
+          token,
+          "/v13/deployments?prebuilt=1",
+          {
+            method: "POST",
+            body: JSON.stringify({
+              name: projectId,
+              files,
+              version: 2,
+              project: projectId,
+              projectSettings: { framework: null, buildCommand: "", installCommand: "" }
+            })
+          }
+        );
+        const finalStatus = await pollDeploymentStatus(token, deployment.id);
+        const result = {
+          url: `https://${deployment.url}`,
+          deploymentId: deployment.id,
+          status: finalStatus,
+          envVarsSet: []
+        };
+        logger6.info("Vercel deployment complete", {
+          deploymentId: deployment.id,
+          url: result.url,
+          status: finalStatus
+        });
+        return ok(result);
+      } catch (error) {
+        logger6.error("Vercel deployment failed", { projectId, error });
+        return err(toDeployError(HaiDeployError.UPLOAD_FAILED, "deploy_uploadFailed", error));
+      }
+    }
+  };
+}
+async function findExistingProject(token, projectName) {
+  try {
+    const project = await vercelFetch(token, `/v10/projects/${projectName}`);
+    return project.id;
+  } catch (error) {
+    if (error instanceof VercelApiError && error.status === 404) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function uploadFile(token, content, sha) {
+  const url = `${VERCEL_API}/v2/files`;
+  const uploadContent = new Uint8Array(content);
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/octet-stream",
+      "x-vercel-digest": sha
+    },
+    body: new Blob([uploadContent])
+  });
+  if (!response.ok && response.status !== 409) {
+    throw new Error(deployM("deploy_fileUploadFailed", { params: { status: String(response.status) } }));
+  }
+}
+async function pollDeploymentStatus(token, deploymentId) {
+  for (let i = 0; i < MAX_POLL_ATTEMPTS; i++) {
+    const deployment = await vercelFetch(
+      token,
+      `/v13/deployments/${deploymentId}`
+    );
+    if (deployment.readyState === "READY") {
+      return "ready";
+    }
+    if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
+      return "error";
+    }
+    await new Promise((resolve6) => setTimeout(resolve6, POLL_INTERVAL));
+  }
+  return "building";
+}
+var logger7 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
+function createAliyunProvisioner() {
+  let accessKey = null;
+  let secretKey = null;
+  let signName = "";
+  return {
+    name: "aliyun",
+    serviceType: "sms",
+    async authenticate(credentials) {
+      logger7.debug("Authenticating with Aliyun");
+      try {
+        const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
+        const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
+        if (!akId || !akSecret || !credentials.signName) {
+          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "accessKeyId, accessKeySecret, signName" } }));
+        }
+        accessKey = akId;
+        secretKey = akSecret;
+        signName = credentials.signName;
+        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        return ok(akId);
+      } catch (error) {
+        logger7.error("Aliyun authentication failed", { error });
+        return err(
+          HaiDeployError.AUTH_FAILED,
+          deployM("deploy_authFailed", {
+            params: { error: error instanceof Error ? error.message : String(error) }
+          }),
+          error
+        );
+      }
+    },
+    async provision(_appName) {
+      if (!accessKey || !secretKey) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger7.debug("Provisioning Aliyun SMS service");
+      return ok({
+        serviceType: "sms",
+        provisionerName: "aliyun",
+        resourceStatus: "reused",
+        envVars: {
+          HAI_REACH_PROVIDERS: JSON.stringify([{ name: "sms", type: "aliyun-sms", accessKeyId: accessKey, accessKeySecret: secretKey, signName }])
+        },
+        resourceInfo: "aliyun:verify-only"
+      });
+    }
+  };
+}
+var logger8 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
+var NEON_API = "https://console.neon.tech/api/v2";
+var DEFAULT_NEON_DATABASE_NAME = "neondb";
+var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
+async function neonFetch(token, path, options) {
+  const response = await fetch(`${NEON_API}${path}`, {
+    ...options,
+    headers: {
+      "Accept": "application/json",
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...options?.headers
+    }
+  });
+  if (!response.ok) {
+    throw new Error(deployM("deploy_apiError", { params: { service: "Neon", status: String(response.status) } }));
+  }
+  return response.json();
+}
+async function listNeonProjects(token) {
+  const data = await neonFetch(token, "/projects");
+  return data.projects ?? [];
+}
+async function findExistingNeonProject(token, projectName) {
+  const projects = await listNeonProjects(token);
+  return projects.find((project) => project.name === projectName) ?? null;
+}
+async function getNeonConnectionUri(token, projectId) {
+  const query = new URLSearchParams({
+    database_name: DEFAULT_NEON_DATABASE_NAME,
+    role_name: DEFAULT_NEON_ROLE_NAME
+  });
+  const data = await neonFetch(
+    token,
+    `/projects/${projectId}/connection_uri?${query.toString()}`,
+    { headers: { "Content-Type": "application/json" } }
+  );
+  if (!data.uri) {
+    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
+  }
+  return data.uri;
+}
+function buildNeonProvisionResult(projectId, connectionUri, resourceStatus) {
+  return {
+    serviceType: "db",
+    provisionerName: "neon",
+    resourceStatus,
+    envVars: {
+      HAI_DB: JSON.stringify({ type: "postgresql", url: connectionUri, database: decodeURIComponent(new URL(connectionUri).pathname.slice(1)) })
+    },
+    resourceInfo: `neon-project:${projectId}`
+  };
+}
+function createNeonProvisioner() {
+  let token = null;
+  return {
+    name: "neon",
+    serviceType: "db",
+    async authenticate(credentials) {
+      logger8.debug("Authenticating with Neon");
+      try {
+        const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
+        if (!apiToken) {
+          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "token" } }));
+        }
+        await listNeonProjects(apiToken);
+        token = apiToken;
+        logger8.info("Neon authenticated");
+        return ok("neon-user");
+      } catch (error) {
+        logger8.error("Neon authentication failed", { error });
+        return err(
+          HaiDeployError.AUTH_FAILED,
+          deployM("deploy_authFailed", {
+            params: { error: error instanceof Error ? error.message : String(error) }
+          }),
+          error
+        );
+      }
+    },
+    async provision(appName) {
+      if (!token) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger8.debug("Provisioning Neon database", { appName });
+      let resource;
+      try {
+        const projectName = `${appName}-db`;
+        const existingProject = await findExistingNeonProject(token, projectName);
+        if (existingProject !== null) {
+          resource = { resourceInfo: `neon-project:${existingProject.id}`, resourceStatus: "reused" };
+          const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
+          logger8.info("Neon project reused", {
+            projectId: existingProject.id,
+            projectName
+          });
+          return ok(buildNeonProvisionResult(existingProject.id, connectionUri2, "reused"));
+        }
+        const data = await neonFetch(token, "/projects", {
+          method: "POST",
+          body: JSON.stringify({
+            project: {
+              name: projectName,
+              pg_version: 16
+            }
+          })
+        });
+        const projectId = data.project?.id ?? "";
+        if (projectId)
+          resource = { resourceInfo: `neon-project:${projectId}`, resourceStatus: "created" };
+        const connectionUri = data.connection_uris?.[0]?.connection_uri ?? "";
+        if (!projectId || !connectionUri) {
+          throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
+        }
+        logger8.info("Neon database provisioned", { projectId });
+        return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
+      } catch (error) {
+        logger8.error("Neon provisioning failed", { appName });
+        if (resource) {
+          return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
+            projectName: appName,
+            stage: "provision:db",
+            resources: [{ serviceType: "db", provisionerName: "neon", ...resource }]
+          });
+        }
+        return err(
+          HaiDeployError.PROVISION_FAILED,
+          deployM("deploy_provisionFailed", {
+            params: {
+              service: "neon",
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
+          error
+        );
+      }
+    }
+  };
+}
+var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
+var CF_API = "https://api.cloudflare.com/client/v4";
+function createR2Provisioner() {
+  let token = null;
+  let accountId = null;
+  let accessKey = "";
+  let secretKey = "";
+  return {
+    name: "r2",
+    serviceType: "storage",
+    async authenticate(credentials) {
+      logger9.debug("Authenticating with Cloudflare");
+      try {
+        const acctId = credentials.accountId ?? credentials.account_id ?? "";
+        const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
+        if (!acctId || !apiTok || !credentials.accessKeyId || !credentials.secretAccessKey) {
+          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "accountId, apiToken, accessKeyId, secretAccessKey" } }));
+        }
+        const res = await fetch(`${CF_API}/accounts/${acctId}/r2/buckets`, {
+          headers: { Authorization: `Bearer ${apiTok}` }
+        });
+        if (!res.ok) {
+          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(res.status) } }));
+        }
+        accountId = acctId;
+        token = apiTok;
+        accessKey = credentials.accessKeyId;
+        secretKey = credentials.secretAccessKey;
+        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
+        return ok(acctId);
+      } catch (error) {
+        logger9.error("Cloudflare R2 authentication failed", { error });
+        return err(
+          HaiDeployError.AUTH_FAILED,
+          deployM("deploy_authFailed", {
+            params: { error: error instanceof Error ? error.message : String(error) }
+          }),
+          error
+        );
+      }
+    },
+    async provision(appName) {
+      if (!token || !accountId) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      const bucketName = `${appName}-storage`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+      logger9.debug("Provisioning R2 bucket", { appName, bucketName });
+      try {
+        const createRes = await fetch(
+          `${CF_API}/accounts/${accountId}/r2/buckets`,
+          {
+            method: "POST",
+            headers: {
+              "Authorization": `Bearer ${token}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({ name: bucketName })
+          }
+        );
+        if (!createRes.ok && createRes.status !== 409) {
+          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
+        }
+        logger9.info("R2 bucket provisioned", { bucketName });
+        return ok({
+          serviceType: "storage",
+          provisionerName: "r2",
+          resourceStatus: createRes.status === 409 ? "reused" : "created",
+          envVars: {
+            HAI_STORAGE: JSON.stringify({
+              type: "s3",
+              endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
+              bucket: bucketName,
+              region: "auto",
+              accessKeyId: accessKey,
+              secretAccessKey: secretKey
+            })
+          },
+          resourceInfo: `r2-bucket:${bucketName}`
+        });
+      } catch (error) {
+        logger9.error("R2 provisioning failed", { appName, error });
+        return err(
+          HaiDeployError.PROVISION_FAILED,
+          deployM("deploy_provisionFailed", {
+            params: {
+              service: "r2",
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
+          error
+        );
+      }
+    }
+  };
+}
+var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
+var RESEND_API = "https://api.resend.com";
+function createResendProvisioner() {
+  let token = null;
+  let from = "";
+  return {
+    name: "resend",
+    serviceType: "email",
+    async authenticate(credentials) {
+      logger10.debug("Authenticating with Resend");
+      try {
+        const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
+        if (!apiToken || !credentials.from) {
+          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "apiKey, from" } }));
+        }
+        const res = await fetch(`${RESEND_API}/domains`, {
+          headers: { Authorization: `Bearer ${apiToken}` }
+        });
+        if (!res.ok) {
+          throw new Error(deployM("deploy_apiError", { params: { service: "Resend", status: String(res.status) } }));
+        }
+        token = apiToken;
+        from = credentials.from;
+        logger10.info("Resend authenticated");
+        return ok("resend-user");
+      } catch (error) {
+        logger10.error("Resend authentication failed", { error });
+        return err(
+          HaiDeployError.AUTH_FAILED,
+          deployM("deploy_authFailed", {
+            params: { error: error instanceof Error ? error.message : String(error) }
+          }),
+          error
+        );
+      }
+    },
+    async provision(_appName) {
+      if (!token) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger10.debug("Provisioning Resend email service");
+      return ok({
+        serviceType: "email",
+        provisionerName: "resend",
+        resourceStatus: "reused",
+        envVars: {
+          HAI_REACH_PROVIDERS: JSON.stringify([{ name: "email", type: "smtp", host: "smtp.resend.com", port: 465, secure: true, user: "resend", pass: token, from }])
+        },
+        resourceInfo: "resend:verify-only"
+      });
+    }
+  };
+}
+var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
+var UPSTASH_API = "https://api.upstash.com";
+function createUpstashAuthHeader(email, apiKey) {
+  return `Basic ${Buffer.from(`${email}:${apiKey}`).toString("base64")}`;
+}
+async function upstashFetch(email, apiKey, path, options) {
+  const response = await fetch(`${UPSTASH_API}${path}`, {
+    ...options,
+    headers: {
+      "Authorization": createUpstashAuthHeader(email, apiKey),
+      "Content-Type": "application/json",
+      ...options?.headers
+    }
+  });
+  if (!response.ok) {
+    throw new Error(deployM("deploy_apiError", { params: { service: "Upstash", status: String(response.status) } }));
+  }
+  return response.json();
+}
+async function listUpstashDatabases(email, apiKey) {
+  return upstashFetch(email, apiKey, "/v2/redis/databases");
+}
+async function findExistingUpstashDatabase(email, apiKey, databaseName) {
+  const databases = await listUpstashDatabases(email, apiKey);
+  return databases.find((database) => database.database_name === databaseName) ?? null;
+}
+async function getUpstashDatabase(email, apiKey, databaseId) {
+  return upstashFetch(email, apiKey, `/v2/redis/database/${databaseId}`);
+}
+function buildUpstashProvisionResult(database, resourceStatus) {
+  const databaseId = database.database_id ?? "";
+  if (!databaseId || !database.endpoint || !database.password || !database.port) {
+    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
+  }
+  return {
+    serviceType: "cache",
+    provisionerName: "upstash",
+    resourceStatus,
+    envVars: {
+      HAI_CACHE: JSON.stringify({ type: "redis", url: `rediss://default:${encodeURIComponent(database.password)}@${database.endpoint}:${database.port}` })
+    },
+    resourceInfo: `upstash-db:${databaseId}`
+  };
+}
+function createUpstashProvisioner() {
+  let apiKey = null;
+  let email = null;
+  return {
+    name: "upstash",
+    serviceType: "cache",
+    async authenticate(credentials) {
+      logger11.debug("Authenticating with Upstash");
+      try {
+        const userEmail = credentials.email ?? "";
+        const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
+        if (!userEmail || !userKey) {
+          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "email, api_key" } }));
+        }
+        await listUpstashDatabases(userEmail, userKey);
+        email = userEmail;
+        apiKey = userKey;
+        logger11.info("Upstash authenticated", { email: userEmail });
+        return ok(userEmail);
+      } catch (error) {
+        logger11.error("Upstash authentication failed", { error });
+        return err(
+          HaiDeployError.AUTH_FAILED,
+          deployM("deploy_authFailed", {
+            params: { error: error instanceof Error ? error.message : String(error) }
+          }),
+          error
+        );
+      }
+    },
+    async provision(appName) {
+      if (!apiKey || !email) {
+        return err(
+          HaiDeployError.AUTH_REQUIRED,
+          deployM("deploy_authRequired")
+        );
+      }
+      logger11.debug("Provisioning Upstash Redis", { appName });
+      let resource;
+      try {
+        const databaseName = `${appName}-cache`;
+        const existingDatabase = await findExistingUpstashDatabase(email, apiKey, databaseName);
+        if (existingDatabase !== null) {
+          const databaseId = existingDatabase.database_id ?? "";
+          if (!databaseId) {
+            throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
+          }
+          resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
+          const detail = await getUpstashDatabase(email, apiKey, databaseId);
+          logger11.info("Upstash Redis reused", { databaseId, databaseName });
+          return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
+        }
+        const data = await upstashFetch(email, apiKey, "/v2/redis/database", {
+          method: "POST",
+          body: JSON.stringify({
+            name: databaseName,
+            region: "global",
+            tls: true
+          })
+        });
+        if (data.database_id)
+          resource = { resourceInfo: `upstash-db:${data.database_id}`, resourceStatus: "created" };
+        logger11.info("Upstash Redis provisioned", { databaseId: data.database_id });
+        return ok(buildUpstashProvisionResult(data, "created"));
+      } catch (error) {
+        logger11.error("Upstash provisioning failed", { appName });
+        if (resource) {
+          return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
+            projectName: appName,
+            stage: "provision:cache",
+            resources: [{ serviceType: "cache", provisionerName: "upstash", ...resource }]
+          });
+        }
+        return err(
+          HaiDeployError.PROVISION_FAILED,
+          deployM("deploy_provisionFailed", {
+            params: {
+              service: "upstash",
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
+          error
+        );
+      }
+    }
+  };
+}
+
+// ../deploy/src/deploy-main.ts
+var logger12 = core.logger.child({ module: "deploy", scope: "main" });
+var currentConfig = null;
+var currentProvider = null;
+var currentContainerProvider = null;
+var currentProvisioners = /* @__PURE__ */ new Map();
+var initInProgress = false;
+var notInitialized = core.module.createNotInitializedKit(
+  HaiDeployError.NOT_INITIALIZED,
+  () => deployM("deploy_notInitialized")
+);
+function createProviderByType(type) {
+  switch (type) {
+    case "vercel":
+      return createVercelProvider();
+    default:
+      throw new Error(deployM("deploy_unsupportedProviderType", { params: { type } }));
+  }
+}
+function createProvisionerByName(provisioner) {
+  switch (provisioner) {
+    case "neon":
+      return createNeonProvisioner();
+    case "upstash":
+      return createUpstashProvisioner();
+    case "cloudflare-r2":
+      return createR2Provisioner();
+    case "resend":
+      return createResendProvisioner();
+    case "aliyun":
+      return createAliyunProvisioner();
+    default:
+      throw new Error(deployM("deploy_unsupportedProvisionerType", { params: { type: provisioner } }));
+  }
+}
+function extractCredentials(serviceConfig) {
+  const result = {};
+  for (const [key, value] of Object.entries(serviceConfig)) {
+    if (key !== "provisioner" && typeof value === "string") {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+var deployCredentials = {
+  getPath: () => getCredentialsPath(),
+  load: () => loadCredentials(),
+  save: (key, value) => saveCredential(key, value),
+  saveAll: (entries) => saveCredentials(entries)
+};
+function normalizeProjectName(name) {
+  const normalized = name.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || "app";
+}
+function mergeProvisionEnv(results, scan, options) {
+  let env = {};
+  const reachRequirements = scan?.middlewares?.filter((item) => item.configName === "reach") ?? [];
+  const reachProviders = reachRequirements.map((item) => item.config);
+  let hasReachOutput = false;
+  for (const prov of results) {
+    if (prov.envVars.HAI_REACH_PROVIDERS) {
+      hasReachOutput = true;
+      const supplied = JSON.parse(prov.envVars.HAI_REACH_PROVIDERS);
+      for (const provider of supplied) {
+        const targets = reachRequirements.filter((item) => {
+          const mode = options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[item.service];
+          return item.service === prov.serviceType && (!mode || mode === "default");
+        });
+        if (targets.length) {
+          for (const target of targets)
+            reachProviders[reachRequirements.indexOf(target)] = { ...provider, name: target.config.name ?? provider.name };
+        } else {
+          reachProviders.push(provider);
+        }
+      }
+    }
+    env = { ...env, ...prov.envVars };
+  }
+  if (hasReachOutput)
+    env.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
+  return env;
+}
+var deploy = {
+  credentials: deployCredentials,
+  async init(config) {
+    if (initInProgress) {
+      logger12.warn("Deploy init already in progress, skipping concurrent call");
+      return err(
+        HaiDeployError.CONFIG_ERROR,
+        deployM("deploy_configError", { params: { error: "init already in progress" } })
+      );
+    }
+    initInProgress = true;
+    try {
+      if (currentProvider || currentContainerProvider) {
+        logger12.warn("Deploy module is already initialized, reinitializing");
+        await deploy.close();
+      }
+      logger12.info("Initializing deploy module");
+      const parseResult = DeployConfigSchema.safeParse(config);
+      if (!parseResult.success) {
+        logger12.error("Deploy config validation failed", { error: parseResult.error.message });
+        return err(
+          HaiDeployError.CONFIG_ERROR,
+          deployM("deploy_configError", { params: { error: parseResult.error.message } }),
+          parseResult.error
+        );
+      }
+      const parsed = parseResult.data;
+      try {
+        let provider = null;
+        let containerProvider = null;
+        if (parsed.provider.type === "docker-ssh") {
+          containerProvider = createDockerSshProvider(parsed.provider, parsed.container);
+          logger12.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh?.host });
+        } else {
+          provider = createProviderByType(parsed.provider.type);
+          const authResult = await provider.authenticate(parsed.provider.token);
+          if (!authResult.success) {
+            return err(authResult.error);
+          }
+          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
+        }
+        currentProvisioners.clear();
+        if (parsed.services) {
+          const serviceEntries = Object.entries(parsed.services);
+          for (const [serviceType, serviceConfig] of serviceEntries) {
+            if (!serviceConfig)
+              continue;
+            const provisioner = createProvisionerByName(serviceConfig.provisioner);
+            const credentials = extractCredentials(serviceConfig);
+            const provAuthResult = await provisioner.authenticate(credentials);
+            if (!provAuthResult.success) {
+              logger12.error("Provisioner authentication failed", {
+                service: serviceType,
+                provisioner: serviceConfig.provisioner
+              });
+              currentProvisioners.clear();
+              return err(provAuthResult.error);
+            }
+            logger12.info("Provisioner authenticated", {
+              service: serviceType,
+              user: provAuthResult.data
+            });
+            currentProvisioners.set(serviceType, provisioner);
+          }
+        }
+        currentProvider = provider;
+        currentContainerProvider = containerProvider;
+        currentConfig = parsed;
+        logger12.info("Deploy module initialized", {
+          provider: parsed.provider.type,
+          provisioners: [...currentProvisioners.keys()]
+        });
+        return ok(void 0);
+      } catch (error) {
+        currentProvider = null;
+        currentContainerProvider = null;
+        currentConfig = null;
+        currentProvisioners.clear();
+        logger12.error("Deploy module initialization failed", { error });
+        return err(
+          HaiDeployError.CONFIG_ERROR,
+          deployM("deploy_configError", {
+            params: { error: error instanceof Error ? error.message : String(error) }
+          }),
+          error
+        );
+      }
+    } finally {
+      initInProgress = false;
+    }
+  },
+  async close() {
+    if (!currentProvider && !currentContainerProvider) {
+      logger12.info("Deploy module already closed, skipping");
+      return;
+    }
+    logger12.info("Closing deploy module");
+    currentProvider = null;
+    currentContainerProvider = null;
+    currentConfig = null;
+    currentProvisioners.clear();
+    logger12.info("Deploy module closed");
+  },
+  get config() {
+    return currentConfig;
+  },
+  get isInitialized() {
+    return currentProvider !== null || currentContainerProvider !== null;
+  },
+  async scan(appDir, options) {
+    logger12.debug("Scanning application", { appDir });
+    return scanApp(appDir, options);
+  },
+  async provisionAll(projectName, services) {
+    if (!currentProvider && !currentContainerProvider) {
+      return notInitialized.result();
+    }
+    logger12.info("Provisioning all services", { projectName, count: currentProvisioners.size });
+    const results = [];
+    for (const [serviceType, provisioner] of currentProvisioners) {
+      if (services && !services.includes(serviceType))
+        continue;
+      logger12.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
+      const provResult = await provisioner.provision(projectName);
+      if (!provResult.success) {
+        logger12.error("Service provisioning failed", {
+          serviceType,
+          provisioner: provisioner.name,
+          code: provResult.error.code
+        });
+        return recoveryFailure(provResult.error, {
+          projectName,
+          stage: `provision:${serviceType}`,
+          resources: [
+            ...results.map(({ envVars: _envVars, ...resource }) => resource),
+            ...getDeployRecovery(provResult.error)?.resources ?? [
+              { serviceType, provisionerName: provisioner.name, resourceInfo: projectName, resourceStatus: "unknown" }
+            ]
+          ]
+        });
+      }
+      results.push(provResult.data);
+      logger12.info("Service provisioned", { serviceType, provisioner: provisioner.name });
+    }
+    return ok(results);
+  },
+  async deployApp(appDir, options) {
+    if (!currentProvider && !currentContainerProvider) {
+      return notInitialized.result();
+    }
+    logger12.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
+    const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
+    const scanResult = await scanApp(appDir, scanOptions);
+    if (!scanResult.success) {
+      return err(scanResult.error);
+    }
+    const scan = scanResult.data;
+    appDir = scan.appDir ?? appDir;
+    const environment = loadDeploymentEnvironment({ environment: scanOptions.environment ?? "prod", envDir: scan.envDir ?? appDir, requireFile: scanOptions.environment !== void 0 });
+    if (!environment.success)
+      return environment;
+    const appEnv = Object.fromEntries(Object.entries(environment.data.values).filter(([key]) => !key.startsWith("HAI_CLI_") && (!key.startsWith("HAI_DEPLOY_") || key === "HAI_DEPLOY_ENVIRONMENT")));
+    const projectName = `${options?.projectName ?? scan.appName}${scanOptions.environment ? `-${environment.data.environment}` : ""}`;
+    options = {
+      ...options,
+      ...scanOptions.environment ? { environment: environment.data.environment } : {},
+      ...options?.skipMiddleware ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
+    };
+    if (options.selectedServices) {
+      options.serviceModes = {
+        ...options.serviceModes,
+        ...Object.fromEntries(scan.requiredServices.filter((service) => !options.selectedServices.includes(service)).map((service) => [service, "keep"]))
+      };
+    }
+    if (currentContainerProvider) {
+      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options, appEnv);
+    }
+    if (options?.bundleOnly)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleOnlyContainer"));
+    if (options.selectedServices)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectedContainerOnly"));
+    if (!currentProvider) {
+      return notInitialized.result();
+    }
+    if (scan.isSvelteKit && !scan.adapterInstalled) {
+      return err(
+        HaiDeployError.ADAPTER_MISSING,
+        deployM("deploy_adapterMissing", {
+          params: { adapter: "@sveltejs/adapter-vercel" }
+        })
+      );
+    }
+    if (!existsSync(resolveOutputDir(appDir, "vercel")))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
+    let allEnvVars = appEnv;
+    const recovery = { projectName, stage: "provision", resources: [] };
+    if (!options?.skipMiddleware) {
+      const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
+      if (!provResults.success) {
+        return err(provResults.error);
+      }
+      recovery.resources = provResults.data.map(({ envVars: _envVars, ...resource }) => resource);
+      allEnvVars = { ...allEnvVars, ...mergeProvisionEnv(provResults.data, scan, options) };
+      if (options?.environment) {
+        const saved = saveDeploymentEnvironment(environment.data, mergeProvisionEnv(provResults.data, scan, options));
+        if (!saved.success)
+          return recoveryFailure(saved.error, { ...recovery, stage: "save-env" });
+      }
+    }
+    const projectResult = await currentProvider.createProject(projectName);
+    if (!projectResult.success) {
+      return recoveryFailure(projectResult.error, { ...recovery, stage: "create-project" });
+    }
+    const projectId = projectResult.data;
+    recovery.platformProjectId = projectId;
+    if (Object.keys(allEnvVars).length > 0) {
+      const envResult = await currentProvider.setEnvVars(projectId, allEnvVars);
+      if (!envResult.success) {
+        return recoveryFailure(envResult.error, { ...recovery, stage: "set-env" });
+      }
+    }
+    const outputDir = resolveOutputDir(appDir, currentConfig?.provider.type ?? "vercel");
+    const deployResult = await currentProvider.deploy(projectId, outputDir);
+    if (!deployResult.success) {
+      return recoveryFailure(deployResult.error, { ...recovery, stage: "deploy" });
+    }
+    const result = {
+      ...deployResult.data,
+      envVarsSet: Object.keys(allEnvVars)
+    };
+    logger12.info("Deployment completed", {
+      url: result.url,
+      deploymentId: result.deploymentId,
+      status: result.status
+    });
+    return ok(result);
+  }
+};
+async function deployContainerApp(provider, appDir, scan, rawProjectName, options, appEnv = {}) {
+  const projectName = normalizeProjectName(rawProjectName);
+  let artifact;
+  let artifactDir = options?.artifactDir ?? resolveArtifactDirectory(appDir);
+  try {
+    if (existsSync(join(artifactDir, "latest"))) {
+      const latest = readFileSync(join(artifactDir, "latest"), "utf8").trim();
+      if (!/^[a-z0-9][\w.+-]*$/i.test(latest))
+        throw new Error("Invalid artifact pointer");
+      artifactDir = join(artifactDir, latest);
+    }
+    artifact = await readDeploymentArtifact(artifactDir);
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
+  }
+  if (artifact.partial && !options?.selectedServices) {
+    const selectedServices = artifact.images.map((image) => image.name);
+    options = {
+      ...options,
+      selectedServices,
+      serviceModes: {
+        ...options?.serviceModes,
+        ...Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"]))
+      }
+    };
+  }
+  if (!options?.bundleOnly && currentConfig?.provider.type === "docker-ssh" && !currentConfig.provider.ssh)
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
+  let provisionEnv = {};
+  if (!options?.skipMiddleware) {
+    const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
+    if (!provResults.success) {
+      return err(provResults.error);
+    }
+    provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
+  }
+  return provider.deploy({ appDir, artifact, artifactDir, projectName, scan, provisionEnv, appEnv, options });
+}
+
+// ../deploy/src/deploy-middleware.ts
+var field = (name, defaultValue, kind, secret = false) => ({ name, defaultValue, kind, secret });
+var required = (name, defaultValue, kind) => ({ ...field(name, defaultValue, kind), required: true });
+var DEPLOY_MIDDLEWARE = {
+  db: [
+    { backend: "sqlite", label: "SQLite", purpose: "deploy_purposeSqlite", fields: [required("database", "./data/app.db")] },
+    ...["postgresql", "mysql"].map((backend) => ({
+      backend,
+      label: backend === "mysql" ? "MySQL" : "PostgreSQL",
+      purpose: "deploy_purposeDatabase",
+      provisioner: backend === "postgresql" ? "neon" : void 0,
+      fields: [field("url", "", "url", true), required("host", "localhost"), required("port", backend === "mysql" ? "3306" : "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true), field("ssl", "false")]
+    }))
+  ],
+  cache: [
+    { backend: "memory", label: "Memory", purpose: "deploy_purposeMemory", fields: [] },
+    { backend: "redis", label: "Redis", purpose: "deploy_purposeCache", provisioner: "upstash", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "6379", "port"), field("password", "", void 0, true), { ...field("db", "0", "number"), maximum: 15 }, field("tls", "false", "boolean"), field("keyPrefix"), field("connectTimeout", "10000", "number"), field("commandTimeout", "5000", "number")] }
+  ],
+  storage: [
+    { backend: "local", label: "Local filesystem", purpose: "deploy_purposeLocal", fields: [required("root", "./data/storage")] },
+    { backend: "s3", label: "S3 / RustFS / MinIO / Cloudflare R2", purpose: "deploy_purposeStorage", provisioner: "cloudflare-r2", fields: [field("endpoint", "", "url"), required("bucket", "hai"), required("region", "us-east-1"), required("accessKeyId"), { ...required("secretAccessKey"), secret: true }, field("forcePathStyle", "true", "boolean")] }
+  ],
+  vecdb: [
+    { backend: "lancedb", label: "LanceDB", purpose: "deploy_purposeLocal", fields: [required("path", "./data/vectors")] },
+    { backend: "qdrant", label: "Qdrant", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:6333", "url"), field("apiKey", "", void 0, true)] },
+    { backend: "pgvector", label: "PostgreSQL / pgvector", purpose: "deploy_purposeVector", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true)] },
+    { backend: "chroma", label: "Chroma", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:8000", "url")] }
+  ],
+  ldap: [
+    { backend: "disabled", label: "Disabled", purpose: "deploy_purposeDisabled", fields: [] },
+    { backend: "ldap", label: "LDAP / OpenLDAP", purpose: "deploy_purposeLdap", fields: [required("url", "ldap://localhost:389", "url"), required("bindDn", "cn=admin,dc=example,dc=org"), { ...required("bindPassword"), secret: true }, required("searchBase", "dc=example,dc=org"), field("searchFilter", "(uid={{username}})"), field("usernameAttribute", "uid"), field("emailAttribute", "mail"), field("displayNameAttribute", "cn"), field("useTls", "false", "boolean"), { ...field("connectTimeout", "5000", "number"), minimum: 1e3 }] }
+  ],
+  email: [
+    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
+    { backend: "smtp", label: "SMTP", purpose: "deploy_purposeEmail", provisioner: "resend", fields: [required("host", "localhost"), required("port", "465", "port"), field("secure", "true", "boolean"), field("user"), field("pass", "", void 0, true), required("from", "noreply@example.com")] },
+    { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeEmail", fields: [required("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
+  ],
+  sms: [
+    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
+    { backend: "aliyun-sms", label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", fields: [required("accessKeyId"), { ...required("accessKeySecret"), secret: true }, required("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] },
+    { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeSms", fields: [required("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
+  ]
+};
+function describeMiddlewareBackend(backend) {
+  return deployM(backend.purpose);
+}
+
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
+//# sourceMappingURL=src-DSJJXM2F.js.map
+//# sourceMappingURL=src-DSJJXM2F.js.map