@h-ai/cli 0.1.0-alpha.67 → 0.1.0-alpha.68

package/dist/{src-2V6VP4I5.js → chunk-FI56GONY.js}

@@ -1,15 +1,5 @@
 #!/usr/bin/env node
 import { __export } from './chunk-2H7UOFLK.js';
-import { createHash, randomBytes } from 'crypto';
-import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, renameSync, rmSync, statSync, readdirSync } from 'fs';
-import { resolve, join, basename, dirname, relative, sep } from 'path';
-import { core, err, ok } from '@h-ai/core';
-import process2 from 'process';
-import { parseEnv } from 'util';
-import { LineCounter, parseDocument, parse as parse$1, stringify, parseAllDocuments } from 'yaml';
-import { homedir } from 'os';
-import { spawn } from 'child_process';
-import { Buffer } from 'buffer';
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -1398,10 +1388,10 @@ function defineLazyInternal(inst, key, compute) {
           Object.defineProperty(this, key, { configurable: true, writable: true, value });
         broke = broke || outer;
         return value;
-      } catch (err15) {
+      } catch (err) {
         delete this[key];
         broke = broke || outer;
-        throw err15;
+        throw err;
       }
     },
     set(value) {
@@ -1856,18 +1846,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse6 = _parse(_Err);
+  const parse3 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse6(schema, value, ctx, finalizeParams(fn, _params));
+    return parse3(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse6 = _parse(_Err);
+  const parse3 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse6(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse3(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -3521,14 +3511,14 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     const shape = zod.def.shape;
     const propValues = {};
     for (const key in shape) {
-      const field2 = shape[key]._zod;
-      if (field2.values) {
+      const field = shape[key]._zod;
+      if (field.values) {
         if (!Object.prototype.hasOwnProperty.call(propValues, key)) {
           assignProp(propValues, key, /* @__PURE__ */ new Set());
         }
-        for (const v of field2.values)
+        for (const v of field.values)
           propValues[key].add(v);
-        if (field2.optin !== void 0)
+        if (field.optin !== void 0)
           propValues[key].add(void 0);
       }
     }
@@ -5037,7 +5027,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve6) {
+function isRecursive(inst, stack, resolve) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5047,7 +5037,7 @@ function isRecursive(inst, stack, resolve6) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve6);
+      const answer = isRecursive(child, stack, resolve);
       if (answer > result)
         result = answer;
     }
@@ -5058,7 +5048,7 @@ function isRecursive(inst, stack, resolve6) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (!desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve6) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5122,7 +5112,7 @@ function isRecursive(inst, stack, resolve6) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -12940,9 +12930,9 @@ function compile(schema, options) {
     const clone2 = withParser(schema, parser);
     clone2._zod.bag.validator = compileValidator(schema, parser);
     return clone2;
-  } catch (err15) {
+  } catch (err) {
     if (options?.strict)
-      throw err15;
+      throw err;
     return schema;
   }
 }
@@ -13032,8 +13022,8 @@ ${code}
   try {
     const factory = new F(...constantNames, factoryCode);
     fn = factory(...constantValues);
-  } catch (err15) {
-    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err15.message})`);
+  } catch (err) {
+    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err.message})`);
   }
   if (options?.debug) {
     fn.code = fullCode;
@@ -13071,9 +13061,9 @@ function compileChild(doc, ctx, schema, accessor, needsValue = true) {
   const varCounter = ctx.varCounter;
   try {
     return generateCheck(doc, ctx, schema, accessor, needsValue);
-  } catch (err15) {
-    if (!(err15 instanceof ZodCompileUnsupportedError) || !err15.islandable)
-      throw err15;
+  } catch (err) {
+    if (!(err instanceof ZodCompileUnsupportedError) || !err.islandable)
+      throw err;
     doc.content.length = contentLen;
     if (ctx.constants.size > constantCount) {
       const trailing = Array.from(ctx.constants.keys()).slice(constantCount);
@@ -15807,7 +15797,7 @@ function foldObjects(members2) {
     objects.push(member);
   }
   const properties = {};
-  const required3 = /* @__PURE__ */ new Set();
+  const required2 = /* @__PURE__ */ new Set();
   for (const object2 of objects) {
     for (const key in object2.properties) {
       if (Object.prototype.hasOwnProperty.call(properties, key))
@@ -15824,11 +15814,11 @@ function foldObjects(members2) {
       assignProp(properties, key, merged);
     }
     for (const key of object2.required ?? [])
-      required3.add(key);
+      required2.add(key);
   }
   const folded = { type: "object", properties };
-  if (required3.size)
-    folded.required = [...required3];
+  if (required2.size)
+    folded.required = [...required2];
   if (objects.every((object2) => object2.additionalProperties === false)) {
     folded.additionalProperties = false;
   } else {
@@ -16446,8 +16436,8 @@ var objectProcessor = (schema, ctx, _json, params) => {
   }
   const requiredKeys = [];
   for (const key of Object.keys(shape)) {
-    const field2 = def.shape[key];
-    if (ctx.io === "input" ? inputOptin(field2) === void 0 : field2._zod.optout === void 0) {
+    const field = def.shape[key];
+    if (ctx.io === "input" ? inputOptin(field) === void 0 : field._zod.optout === void 0) {
       requiredKeys.push(key);
     }
   }
@@ -16605,8 +16595,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = /* @__PURE__ */ new Map();
-  for (const record3 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record3);
+  for (const record2 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record2);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -19668,3067 +19658,6 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// ../deploy/src/deploy-artifact.ts
-var DeploymentArtifactSchema = external_exports.object({
-  /** 清单格式版本，与应用版本和部署环境无关。 */
-  version: external_exports.literal(3),
-  /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
-  appVersion: external_exports.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
-  /** 本次构建标识；同一应用版本允许重复构建。 */
-  buildId: external_exports.string().regex(/^[a-z0-9][\w.+-]*$/i),
-  /** 只包含所选镜像的构建不能用于首次安装。 */
-  partial: external_exports.boolean().default(false),
-  /** API 单独构建时仍保留工程的 Web 拓扑。 */
-  hasWeb: external_exports.boolean().default(false),
-  /** 工程显式配置的应用端口，部分构建未包含 app 镜像时仍保留；缺省由部署配置决定。 */
-  appContainerPort: external_exports.number().int().min(1).max(65535).optional(),
-  /** 工程显式配置的 Web 端口，部分构建未包含 web 镜像时仍保留；缺省使用部署默认值。 */
-  webContainerPort: external_exports.number().int().min(1).max(65535).optional(),
-  /** 本次构建选择的镜像归档。 */
-  images: external_exports.array(external_exports.object({
-    /** app 为服务或独立应用，web 为同源 API 代理的静态前端。 */
-    name: external_exports.enum(["app", "web"]),
-    /** 相对于清单目录的 tar 文件名。 */
-    file: external_exports.string().regex(/^[\w.+-]+\.tar$/),
-    /** 归档导入后可直接使用的不可变镜像引用。 */
-    imageRef: external_exports.string().regex(/^[a-z0-9][a-z0-9./:_-]*:[a-z0-9_][a-z0-9_.-]*$/).refine((value) => !value.endsWith(":latest")),
-    /** tar 内容的 SHA-256，用于部署前校验。 */
-    sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
-    /** 容器内部监听端口；服务器公开端口由部署选择。 */
-    containerPort: external_exports.number().int().min(1).max(65535).optional()
-  })).min(1).max(2).refine((images) => new Set(images.map((image) => image.name)).size === images.length)
-}).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`)).refine((artifact) => artifact.partial || artifact.images.some((image) => image.name === "app")).refine((artifact) => artifact.partial || !artifact.hasWeb || artifact.images.some((image) => image.name === "web"));
-async function artifactChecksum(file2) {
-  const hash2 = createHash("sha256");
-  for await (const chunk of createReadStream(file2))
-    hash2.update(chunk);
-  return hash2.digest("hex");
-}
-async function readDeploymentArtifact(directory) {
-  const artifact = DeploymentArtifactSchema.parse(JSON.parse(readFileSync(resolve(directory, "manifest.json"), "utf8")));
-  for (const image of artifact.images) {
-    const file2 = resolve(directory, image.file);
-    if (!existsSync(file2) || !lstatSync(file2).isFile() || lstatSync(file2).isSymbolicLink() || await artifactChecksum(file2) !== image.sha256)
-      throw new Error(`Invalid artifact: ${image.file}`);
-  }
-  return artifact;
-}
-
-// ../deploy/messages/en-US.json
-var en_US_default = {
-  deploy_notInitialized: "Deploy module not initialized, call deploy.init() first",
-  deploy_initFailed: "Deploy module initialization failed: {error}",
-  deploy_unsupportedProviderType: "Unsupported deploy provider type: {type}",
-  deploy_unsupportedProvisionerType: "Unsupported service provisioner type: {type}",
-  deploy_configTokenRequired: "Deploy provider token is required",
-  deploy_authRequired: "Authentication required",
-  deploy_authFailed: "Authentication failed: {error}",
-  deploy_projectCreateFailed: "Project creation failed: {error}",
-  deploy_uploadFailed: "Build output upload failed: {error}",
-  deploy_deployFailed: "Deployment failed: {error}",
-  deploy_provisionFailed: "Service provisioning failed: {service} - {error}",
-  deploy_adapterMissing: "Target platform adapter not found, please install {adapter}",
-  deploy_scanFailed: "Application scan failed: {error}",
-  deploy_envVarFailed: "Environment variable setup failed: {error}",
-  deploy_credentialError: "Credential read/write failed: {error}",
-  deploy_credentialInvalidKey: "Unsupported credential key: {key}. Only HAI_DEPLOY_* keys are allowed",
-  deploy_credentialSaved: "Credentials saved",
-  deploy_credentialLoaded: "Credentials loaded",
-  deploy_configError: "Deploy config error: {error}",
-  deploy_credentialMissing: "Missing credential fields: {fields}",
-  deploy_apiError: "{service} API error ({status})",
-  deploy_fileUploadFailed: "File upload failed ({status})",
-  deploy_provisionNoResult: "No connection info returned from {service}",
-  deploy_recoveryFailure: "Deployment stopped at {stage}; inspect the recovery details.",
-  deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use.",
-  deploy_commandTimeout: "Command timed out: {command}",
-  deploy_commandFailed: "Command failed ({command}): {error}",
-  deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
-  deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
-  deploy_imageTransferFailed: "Image transfer failed: {error}",
-  deploy_healthCheckFailed: "Health check failed, app not ready at {url}",
-  deploy_invalidEnvironment: "Use letters, numbers, underscores or hyphens for the environment; local/example are reserved.",
-  deploy_environmentMissing: "Environment file missing: {path}. Create and configure it before deploying.",
-  deploy_environmentReadFailed: "Cannot read deployment environment files; check syntax and permissions.",
-  deploy_environmentWriteFailed: "Cannot save deployment configuration; check file syntax and permissions.",
-  deploy_multipleApplications: "Multiple service packages found; specify the application directory.",
-  deploy_purposeSqlite: "Local relational database persisted in a volume",
-  deploy_purposeDatabase: "Relational database service for business data",
-  deploy_purposeMemory: "Per-process memory cache; cleared on restart, no external service",
-  deploy_purposeLocal: "Local filesystem storage persisted in a volume",
-  deploy_purposeCache: "Shared cache, sessions and distributed locks",
-  deploy_purposeStorage: "S3-compatible object storage for uploaded files",
-  deploy_purposeVector: "Vector indexing and similarity search",
-  deploy_purposeDisabled: "LDAP login is disabled; no directory service is created",
-  deploy_purposeLdap: "Directory account authentication; the default directory has no business users",
-  deploy_purposeConsole: "Messages go to application logs without delivery",
-  deploy_purposeEmail: "Email/HTTP delivery; the default SMTP container only captures test messages",
-  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota",
-  deploy_webProxyInvalid: "The API prefix must be an absolute path containing only letters, numbers, underscores, hyphens and slashes.",
-  deploy_artifactInvalid: "Image artifacts are missing or invalid. Run pnpm build --target docker, select valid --artifact-dir, or use pnpm run deploy --build.",
-  deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
-  deploy_bundleInstructions: "Bundle: {file}\nIncludes all images needed by selected services, including self-hosted middleware.\nWith SSH access, run deploy.ps1 (Windows) or deploy.sh (Linux/macOS) from the adjacent deployment directory.\nFor isolated servers, copy and extract the tar into a separate directory, then run sh apply.sh /opt/hai/apps/project-environment.\nLinux requires Docker/Podman, Compose, sh, tar, sha256sum, awk, curl and filesystem/container permissions.\nPartial updates require a successful full installation with matching ports/layout. Steps return nonzero on failure; result-DEPLOYMENT_ID.json records the outcome.\nThe bundle contains private runtime configuration; transfer it securely.\nIncluded images:\n{images}",
-  deploy_bundleMetadata: "Application version: {version}\nBuild ID: {buildId}\nCompose file: {compose}",
-  deploy_bundleOnlyContainer: "Compose bundle generation is supported only by docker-ssh.",
-  deploy_selectedContainerOnly: "Selected-service deployment requires a docker-ssh Compose destination.",
-  deploy_selectionInvalid: "Cannot deploy {service}: check the service name and build its image first.",
-  deploy_imageVersionRequired: "Specify an image version; latest is not allowed: {image}",
-  deploy_bundleRuntimeRequired: "Start local Podman/Docker to export middleware images, or prepare this complete offline bundle on the build machine.",
-  deploy_bundleFailed: "Package preparation or deployment failed: {reason}",
-  deploy_configFileInvalid: "Invalid YAML in {path}, line {line}. Check indentation, colons and quotes.",
-  deploy_configFileUnreadable: "Cannot read configuration file {path}. Check its path and permissions.",
-  deploy_bundleNameInvalid: "Bundle filenames may contain letters, numbers, dots, plus signs, hyphens and underscores; parent directories may contain spaces.",
-  deploy_secretsInvalid: "Middleware credentials are damaged or incomplete: {path}. Restore a backup; passwords are not regenerated because existing data may become inaccessible.",
-  deploy_storageArtifactRequired: "Storage initialization requires the application image. Select a complete artifact containing app with --artifact-dir, or run pnpm build --target docker --images app first."
-};
-
-// ../deploy/messages/zh-CN.json
-var zh_CN_default2 = {
-  deploy_notInitialized: "Deploy \u6A21\u5757\u5C1A\u672A\u521D\u59CB\u5316\uFF0C\u8BF7\u5148\u8C03\u7528 deploy.init()",
-  deploy_initFailed: "Deploy \u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF1A{error}",
-  deploy_unsupportedProviderType: "\u4E0D\u652F\u6301\u7684\u90E8\u7F72\u5E73\u53F0\u7C7B\u578B\uFF1A{type}",
-  deploy_unsupportedProvisionerType: "\u4E0D\u652F\u6301\u7684\u670D\u52A1 Provisioner \u7C7B\u578B\uFF1A{type}",
-  deploy_configTokenRequired: "\u90E8\u7F72\u5E73\u53F0 Token \u4E0D\u80FD\u4E3A\u7A7A",
-  deploy_authRequired: "\u8BF7\u5148\u5B8C\u6210\u8BA4\u8BC1",
-  deploy_authFailed: "\u8BA4\u8BC1\u5931\u8D25\uFF1A{error}",
-  deploy_projectCreateFailed: "\u9879\u76EE\u521B\u5EFA\u5931\u8D25\uFF1A{error}",
-  deploy_uploadFailed: "\u6784\u5EFA\u4EA7\u7269\u4E0A\u4F20\u5931\u8D25\uFF1A{error}",
-  deploy_deployFailed: "\u90E8\u7F72\u5931\u8D25\uFF1A{error}",
-  deploy_provisionFailed: "\u57FA\u7840\u8BBE\u65BD\u5F00\u901A\u5931\u8D25\uFF1A{service} - {error}",
-  deploy_adapterMissing: "\u672A\u68C0\u6D4B\u5230\u76EE\u6807\u5E73\u53F0 adapter\uFF0C\u8BF7\u5B89\u88C5 {adapter}",
-  deploy_scanFailed: "\u5E94\u7528\u626B\u63CF\u5931\u8D25\uFF1A{error}",
-  deploy_envVarFailed: "\u73AF\u5883\u53D8\u91CF\u8BBE\u7F6E\u5931\u8D25\uFF1A{error}",
-  deploy_credentialError: "\u51ED\u8BC1\u8BFB\u5199\u5931\u8D25\uFF1A{error}",
-  deploy_credentialInvalidKey: "\u4E0D\u652F\u6301\u7684\u51ED\u8BC1\u952E\u540D\uFF1A{key}\u3002\u4EC5\u5141\u8BB8 HAI_DEPLOY_*",
-  deploy_credentialSaved: "\u51ED\u8BC1\u5DF2\u4FDD\u5B58",
-  deploy_credentialLoaded: "\u51ED\u8BC1\u5DF2\u52A0\u8F7D",
-  deploy_configError: "\u90E8\u7F72\u914D\u7F6E\u9519\u8BEF\uFF1A{error}",
-  deploy_credentialMissing: "\u7F3A\u5C11\u51ED\u8BC1\u5B57\u6BB5\uFF1A{fields}",
-  deploy_apiError: "{service} API \u8BF7\u6C42\u5931\u8D25\uFF08{status}\uFF09",
-  deploy_fileUploadFailed: "\u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF08{status}\uFF09",
-  deploy_provisionNoResult: "{service} \u672A\u8FD4\u56DE\u8FDE\u63A5\u4FE1\u606F",
-  deploy_recoveryFailure: "\u90E8\u7F72\u5728 {stage} \u9636\u6BB5\u505C\u6B62\uFF0C\u8BF7\u67E5\u770B\u6062\u590D\u6E05\u5355\u3002",
-  deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002",
-  deploy_commandTimeout: "\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF1A{command}",
-  deploy_commandFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF08{command}\uFF09\uFF1A{error}",
-  deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
-  deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
-  deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
-  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA",
-  deploy_invalidEnvironment: "\u73AF\u5883\u540D\u79F0\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26\uFF0C\u4E14\u4E0D\u80FD\u4F7F\u7528 local/example\u3002",
-  deploy_environmentMissing: "\u7F3A\u5C11\u73AF\u5883\u914D\u7F6E {path}\uFF1B\u8BF7\u5148\u521B\u5EFA\u8BE5\u6587\u4EF6\u5E76\u5B8C\u6210\u914D\u7F6E\uFF0C\u518D\u91CD\u65B0\u90E8\u7F72\u3002",
-  deploy_environmentReadFailed: "\u90E8\u7F72\u73AF\u5883\u6587\u4EF6\u8BFB\u53D6\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
-  deploy_environmentWriteFailed: "\u90E8\u7F72\u914D\u7F6E\u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
-  deploy_multipleApplications: "\u53D1\u73B0\u591A\u4E2A\u670D\u52A1\u5305\uFF0C\u8BF7\u6307\u5B9A\u8981\u90E8\u7F72\u7684\u5E94\u7528\u76EE\u5F55\u3002",
-  deploy_purposeSqlite: "\u672C\u5730\u6587\u4EF6\u5173\u7CFB\u6570\u636E\u5E93\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
-  deploy_purposeDatabase: "\u72EC\u7ACB\u5173\u7CFB\u6570\u636E\u5E93\u670D\u52A1\uFF0C\u4FDD\u5B58\u4E1A\u52A1\u6570\u636E",
-  deploy_purposeMemory: "\u5355\u8FDB\u7A0B\u5185\u5B58\u7F13\u5B58\uFF0C\u91CD\u542F\u540E\u6E05\u7A7A\uFF0C\u4E0D\u521B\u5EFA\u5916\u90E8\u670D\u52A1",
-  deploy_purposeLocal: "\u672C\u5730\u6587\u4EF6\u5B58\u50A8\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
-  deploy_purposeCache: "\u5171\u4EAB\u7F13\u5B58\u3001\u4F1A\u8BDD\u4E0E\u5206\u5E03\u5F0F\u9501",
-  deploy_purposeStorage: "S3 \u517C\u5BB9\u5BF9\u8C61\u5B58\u50A8\uFF0C\u4FDD\u5B58\u4E0A\u4F20\u6587\u4EF6",
-  deploy_purposeVector: "\u5411\u91CF\u7D22\u5F15\u4E0E\u76F8\u4F3C\u5EA6\u641C\u7D22",
-  deploy_purposeDisabled: "LDAP \u767B\u5F55\u672A\u542F\u7528\uFF0C\u4E0D\u521B\u5EFA\u76EE\u5F55\u670D\u52A1",
-  deploy_purposeLdap: "\u4F01\u4E1A\u76EE\u5F55\u8D26\u53F7\u8BA4\u8BC1\uFF1B\u9ED8\u8BA4\u76EE\u5F55\u4E0D\u5305\u542B\u4E1A\u52A1\u7528\u6237",
-  deploy_purposeConsole: "\u6D88\u606F\u8F93\u51FA\u5230\u5E94\u7528\u65E5\u5FD7\uFF0C\u4E0D\u5B9E\u9645\u6295\u9012",
-  deploy_purposeEmail: "\u90AE\u4EF6\u6216 HTTP \u901A\u77E5\u6295\u9012\uFF1B\u9ED8\u8BA4 SMTP \u5BB9\u5668\u4EC5\u7528\u4E8E\u6D4B\u8BD5\u63A5\u6536",
-  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6",
-  deploy_webProxyInvalid: "API \u524D\u7F00\u5FC5\u987B\u662F\u4EC5\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u8FDE\u5B57\u7B26\u548C\u659C\u6760\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002",
-  deploy_artifactInvalid: "\u955C\u50CF\u4EA7\u7269\u7F3A\u5931\u6216\u6821\u9A8C\u5931\u8D25\u3002\u8BF7\u5148\u6267\u884C pnpm build --target docker\uFF0C\u6216\u7528 --artifact-dir \u6307\u5B9A\u6709\u6548\u4EA7\u7269\uFF1B\u4E5F\u53EF\u7528 pnpm run deploy --build \u4E00\u6B21\u5B8C\u6210\u3002",
-  deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
-  deploy_bundleInstructions: "\u90E8\u7F72\u5305\uFF1A{file}\n\u5305\u4E2D\u5DF2\u5305\u542B\u672C\u6B21\u9009\u62E9\u670D\u52A1\u9700\u8981\u7684\u955C\u50CF\uFF0C\u5305\u62EC\u81EA\u5EFA\u4E2D\u95F4\u4EF6\u3002\n\u6709 SSH \u8FDE\u63A5\u65F6\uFF0C\u5728\u65C1\u8FB9\u7684\u90E8\u7F72\u76EE\u5F55\u8FD0\u884C deploy.ps1\uFF08Windows\uFF09\u6216 deploy.sh\uFF08Linux/macOS\uFF09\u3002\n\u5B8C\u5168\u9694\u79BB\u65F6\uFF0C\u590D\u5236 tar \u5230 Linux \u670D\u52A1\u5668\uFF0C\u5728\u72EC\u7ACB\u76EE\u5F55\u89E3\u5305\uFF0C\u518D\u6267\u884C sh apply.sh /opt/hai/apps/\u9879\u76EE\u73AF\u5883\u3002\n\u670D\u52A1\u5668\u9700\u8981 Docker/Podman\u3001Compose\u3001sh\u3001tar\u3001sha256sum\u3001awk \u548C curl\uFF0C\u4EE5\u53CA\u76EE\u5F55\u3001\u5BB9\u5668\u8FD0\u884C\u6743\u9650\u3002\n\u90E8\u5206\u66F4\u65B0\u8981\u6C42\u670D\u52A1\u5668\u5DF2\u6709\u6210\u529F\u7684\u5B8C\u6574\u90E8\u7F72\uFF0C\u7AEF\u53E3\u53CA\u5E94\u7528\u5E03\u5C40\u4FDD\u6301\u4E00\u81F4\u3002\u6BCF\u6B65\u5931\u8D25\u4F1A\u8FD4\u56DE\u975E\u96F6\u9000\u51FA\u7801\uFF1B\u7ED3\u679C\u8BB0\u5F55\u5728\u90E8\u7F72\u76EE\u5F55 result-\u90E8\u7F72ID.json\u3002\n\u5305\u5305\u542B\u79C1\u6709\u8FD0\u884C\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u4F20\u8F93\u3002\n\u6240\u542B\u955C\u50CF\uFF1A\n{images}",
-  deploy_bundleMetadata: "\u5E94\u7528\u7248\u672C\uFF1A{version}\n\u6784\u5EFA\u7F16\u53F7\uFF1A{buildId}\nCompose \u6587\u4EF6\uFF1A{compose}",
-  deploy_bundleOnlyContainer: "\u4EC5\u751F\u6210 Compose tar \u53EA\u652F\u6301 docker-ssh\u3002",
-  deploy_selectedContainerOnly: "\u6309\u670D\u52A1\u5C40\u90E8\u90E8\u7F72\u4EC5\u9002\u7528\u4E8E docker-ssh Compose \u76EE\u6807\u3002",
-  deploy_selectionInvalid: "\u65E0\u6CD5\u90E8\u7F72\u670D\u52A1 {service}\uFF1A\u8BF7\u68C0\u67E5\u670D\u52A1\u540D\u79F0\uFF0C\u5E76\u5148\u6784\u5EFA\u5BF9\u5E94\u955C\u50CF\u3002",
-  deploy_storageArtifactRequired: "\u5B58\u50A8\u521D\u59CB\u5316\u9700\u8981\u5E94\u7528\u955C\u50CF\u3002\u8BF7\u7528 --artifact-dir \u9009\u62E9\u542B app \u955C\u50CF\u7684\u5B8C\u6574\u5236\u54C1\uFF0C\u6216\u5148\u6267\u884C pnpm build --target docker --images app\u3002",
-  deploy_imageVersionRequired: "\u955C\u50CF\u5FC5\u987B\u6307\u5B9A\u7248\u672C\uFF0C\u4E0D\u80FD\u4F7F\u7528 latest\uFF1A{image}",
-  deploy_bundleRuntimeRequired: "\u5B8C\u6574\u79BB\u7EBF\u5305\u9700\u8981\u5BFC\u51FA\u4E2D\u95F4\u4EF6\u955C\u50CF\u3002\u8BF7\u542F\u52A8\u672C\u5730 Podman/Docker\uFF0C\u6216\u5728\u6784\u5EFA\u673A\u6253\u5305\u3002",
-  deploy_bundleFailed: "\u4EA4\u4ED8\u51C6\u5907\u6216\u90E8\u7F72\u5931\u8D25\uFF1A{reason}",
-  deploy_configFileInvalid: "\u914D\u7F6E\u6587\u4EF6 {path} \u7B2C {line} \u884C\u683C\u5F0F\u6709\u8BEF\u3002\u8BF7\u68C0\u67E5\u7F29\u8FDB\u3001\u5192\u53F7\u548C\u5F15\u53F7\u540E\u91CD\u8BD5\u3002",
-  deploy_configFileUnreadable: "\u65E0\u6CD5\u8BFB\u53D6\u914D\u7F6E\u6587\u4EF6 {path}\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u8DEF\u5F84\u4E0E\u8BFB\u53D6\u6743\u9650\u3002",
-  deploy_bundleNameInvalid: "\u90E8\u7F72\u5305\u6587\u4EF6\u540D\u53EA\u652F\u6301\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u70B9\u3001\u52A0\u53F7\u3001\u77ED\u6A2A\u7EBF\u548C\u4E0B\u5212\u7EBF\uFF1B\u6240\u5728\u76EE\u5F55\u53EF\u4EE5\u5305\u542B\u7A7A\u683C\u3002",
-  deploy_secretsInvalid: "\u4E2D\u95F4\u4EF6\u51ED\u636E\u6587\u4EF6\u635F\u574F\u6216\u7F3A\u5C11\u5B57\u6BB5\uFF1A{path}\u3002\u8BF7\u4ECE\u5907\u4EFD\u6062\u590D\uFF1B\u4E0D\u4F1A\u81EA\u52A8\u66F4\u6362\u5BC6\u7801\uFF0C\u4EE5\u514D\u5DF2\u6709\u6570\u636E\u65E0\u6CD5\u8BBF\u95EE\u3002"
-};
-
-// ../deploy/src/deploy-i18n.ts
-var deployM = core.i18n.createMessageGetter({
-  "zh-CN": zh_CN_default2,
-  "en-US": en_US_default
-});
-
-// ../deploy/src/deploy-config.ts
-var VercelProviderConfigSchema = external_exports.object({
-  type: external_exports.literal("vercel"),
-  token: external_exports.string().min(1, deployM("deploy_configTokenRequired"))
-});
-var SshConfigSchema = external_exports.object({
-  /** 远程主机地址或 ~/.ssh/config 中的 Host 别名 */
-  host: external_exports.string().regex(/^[a-z0-9][a-z0-9.:-]*$/i),
-  /** SSH 端口 */
-  port: external_exports.number().int().min(1).max(65535).default(22),
-  /** SSH 用户名 */
-  username: external_exports.string().regex(/^[a-z_][\w-]*$/i),
-  /** 私钥文件路径（省略时使用 ssh-agent 或 ~/.ssh 默认密钥） */
-  identityFile: external_exports.string().min(1).optional(),
-  /** known_hosts 文件路径（省略时使用默认；配合 CI/临时环境隔离主机指纹） */
-  knownHostsFile: external_exports.string().min(1).optional(),
-  /** 严格主机密钥校验，默认开启（true→accept-new 首次信任并拒绝变更；false→关闭校验） */
-  strictHostKeyChecking: external_exports.boolean().default(true),
-  /** 连接超时（秒） */
-  connectTimeoutSeconds: external_exports.number().int().positive().default(10)
-});
-var PortExposeSchema = external_exports.object({
-  type: external_exports.literal("port").default("port"),
-  /** 容器内监听端口（adapter-node 默认 3000） */
-  containerPort: external_exports.number().int().min(1).max(65535).default(3e3),
-  /** 宿主机映射端口 */
-  hostPort: external_exports.number().int().min(1).max(65535)
-});
-var ExposeSchema = PortExposeSchema;
-var DockerSshProviderConfigSchema = external_exports.object({
-  type: external_exports.literal("docker-ssh"),
-  /** SSH 连接参数 */
-  ssh: SshConfigSchema.optional(),
-  /** 远程主机运行参数 */
-  remote: external_exports.object({
-    /** 远程应用根目录 */
-    baseDir: external_exports.string().regex(/^\/[\w/. -]+$/).refine((value) => !value.split("/").includes("..")).default("/opt/hai/apps"),
-    /** 远程容器运行时（auto 优先 podman） */
-    runtime: external_exports.enum(["auto", "docker", "podman"]).default("auto")
-  }).default({ baseDir: "/opt/hai/apps", runtime: "auto" }),
-  /** 应用暴露方式 */
-  expose: ExposeSchema
-});
-var ProviderConfigSchema = external_exports.discriminatedUnion("type", [
-  VercelProviderConfigSchema,
-  DockerSshProviderConfigSchema
-]);
-var NeonServiceSchema = external_exports.object({
-  provisioner: external_exports.literal("neon"),
-  apiKey: external_exports.string().min(1)
-});
-var UpstashServiceSchema = external_exports.object({
-  provisioner: external_exports.literal("upstash"),
-  email: external_exports.string().email(),
-  apiKey: external_exports.string().min(1)
-});
-var R2ServiceSchema = external_exports.object({
-  provisioner: external_exports.literal("cloudflare-r2"),
-  accessKeyId: external_exports.string().min(1),
-  secretAccessKey: external_exports.string().min(1),
-  accountId: external_exports.string().min(1),
-  apiToken: external_exports.string().min(1)
-});
-var ResendServiceSchema = external_exports.object({
-  provisioner: external_exports.literal("resend"),
-  from: external_exports.string().email(),
-  apiKey: external_exports.string().min(1)
-});
-var AliyunSmsServiceSchema = external_exports.object({
-  provisioner: external_exports.literal("aliyun"),
-  signName: external_exports.string().min(1),
-  accessKeyId: external_exports.string().min(1),
-  accessKeySecret: external_exports.string().min(1)
-});
-var ServicesConfigSchema = external_exports.object({
-  db: external_exports.discriminatedUnion("provisioner", [NeonServiceSchema]).optional(),
-  cache: external_exports.discriminatedUnion("provisioner", [UpstashServiceSchema]).optional(),
-  storage: external_exports.discriminatedUnion("provisioner", [R2ServiceSchema]).optional(),
-  email: external_exports.discriminatedUnion("provisioner", [ResendServiceSchema]).optional(),
-  sms: external_exports.discriminatedUnion("provisioner", [AliyunSmsServiceSchema]).optional()
-}).optional();
-var DeployConfigSchema = external_exports.object({
-  /** 部署环境文件模式；dev/test/prod 或自定义模式，禁止 local/example。 */
-  environment: external_exports.string().regex(/^[a-z0-9][\w-]*$/i).refine((value) => !["local", "example"].includes(value.toLowerCase())).optional(),
-  provider: ProviderConfigSchema,
-  services: ServicesConfigSchema,
-  /** Docker Compose 部署参数；构建配置位于项目 hai.build.json。 */
-  container: external_exports.object({
-    /** 自建 S3 服务实现；协议仍为 storage.type=s3。 */
-    s3Engine: external_exports.enum(["rustfs", "minio"]).default("rustfs")
-  }).optional()
-});
-var DeployErrorInfo = {
-  DEPLOY_FAILED: "001:500",
-  PROJECT_CREATE_FAILED: "002:500",
-  UPLOAD_FAILED: "004:500",
-  AUTH_REQUIRED: "005:401",
-  AUTH_FAILED: "006:401",
-  PROVISION_FAILED: "007:500",
-  ADAPTER_MISSING: "008:500",
-  SCAN_FAILED: "009:500",
-  NOT_INITIALIZED: "010:500",
-  ENV_VAR_FAILED: "011:500",
-  UNSUPPORTED_TYPE: "012:400",
-  CONFIG_ERROR: "013:500",
-  CREDENTIAL_ERROR: "014:500",
-  REMOTE_CONNECT_FAILED: "017:500",
-  REMOTE_COMMAND_FAILED: "018:500",
-  IMAGE_TRANSFER_FAILED: "019:500",
-  HEALTH_CHECK_FAILED: "020:500"
-};
-var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
-
-// ../deploy/src/deploy-environment.ts
-function environmentValue(value) {
-  try {
-    return parse$1(value) ?? value;
-  } catch {
-    return value;
-  }
-}
-function resolveConfig(value, prefix, env) {
-  if (env[prefix] !== void 0)
-    return environmentValue(env[prefix]);
-  if (Array.isArray(value))
-    return value.map((item, index) => resolveConfig(item, `${prefix}_${index}`, env));
-  if (value && typeof value === "object")
-    return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, resolveConfig(nested, `${prefix}_${key.toUpperCase()}`, env)]));
-  if (typeof value !== "string")
-    return value;
-  const resolved = value.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, name, fallback) => env[name] ?? fallback ?? "");
-  return /^\$\{[^}]+\}$/.test(value) ? environmentValue(resolved) : resolved;
-}
-function loadDeploymentConfig(name, path, values) {
-  try {
-    const lineCounter = new LineCounter();
-    const document = parseDocument(readFileSync(path, "utf8"), { lineCounter, prettyErrors: false });
-    if (document.errors.length)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: String(lineCounter.linePos(document.errors[0].pos[0]).line) } }));
-    const config2 = resolveConfig(document.toJS(), `HAI_${name.toUpperCase()}`, values);
-    if (config2 !== null && (typeof config2 !== "object" || Array.isArray(config2)))
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: "1" } }));
-    return ok(config2 && typeof config2 === "object" && !Array.isArray(config2) ? config2 : {});
-  } catch {
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileUnreadable", { params: { path } }));
-  }
-}
-function loadDeploymentEnvironment(options) {
-  const environment = options.environment === "production" ? "prod" : options.environment === "development" ? "dev" : options.environment;
-  if (!/^[a-z0-9][\w-]*$/i.test(environment) || ["local", "example"].includes(environment.toLowerCase()))
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_invalidEnvironment"));
-  const envDir = resolve(options.envDir);
-  const target = join(envDir, `.env.${environment}`);
-  if (options.requireFile !== false && !existsSync(target))
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentMissing", { params: { path: target } }));
-  const loaded = core.config.loadEnvFiles({ mode: environment, envDir });
-  if (!loaded.success)
-    return loaded;
-  try {
-    const values = { ...loaded.data };
-    for (const [name, value] of Object.entries(process2.env)) {
-      if (/^(?:HAI_|PUBLIC_|VITE_)/.test(name) && value !== void 0)
-        values[name] = value;
-    }
-    values.HAI_DEPLOY_ENVIRONMENT = environment;
-    values.HAI_CORE_ENV ??= environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
-    const targetValues = {};
-    if (existsSync(target)) {
-      for (const [name, value] of Object.entries(parseEnv(readFileSync(target, "utf8")))) {
-        if (value !== void 0)
-          targetValues[name] = value;
-      }
-    }
-    return ok({ environment, envDir, values, targetValues });
-  } catch {
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
-  }
-}
-function isSecret(name, value) {
-  if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
-    return true;
-  try {
-    const url2 = new URL(value);
-    if (url2.username || url2.password || [...url2.searchParams.keys()].some((key) => /password|secret|token|key|authorization/i.test(key)))
-      return true;
-  } catch {
-  }
-  try {
-    const parsed = JSON.parse(value);
-    if (parsed && typeof parsed === "object")
-      return Object.entries(parsed).some(([key, nested]) => isSecret(key, typeof nested === "string" ? nested : JSON.stringify(nested)));
-  } catch {
-  }
-  return false;
-}
-function publicConfig(value) {
-  if (Array.isArray(value))
-    return value.map(publicConfig);
-  if (value && typeof value === "object")
-    return Object.fromEntries(Object.entries(value).filter(([name, item]) => !isSecret(name, typeof item === "string" ? item : "")).map(([name, item]) => [name, publicConfig(item)]));
-  return value;
-}
-function quoteEnv(value) {
-  try {
-    const parsed = JSON.parse(value);
-    if (parsed && typeof parsed === "object")
-      return `'${JSON.stringify(parsed).replaceAll("'", "\\u0027")}'`;
-  } catch {
-  }
-  if (!value.includes("'"))
-    return `'${value}'`;
-  if (!value.includes('"'))
-    return `"${value}"`;
-  if (!value.includes("`"))
-    return `\`${value}\``;
-  if (!/[\r\n#]/.test(value))
-    return value;
-  throw new Error("Unsupported dotenv value");
-}
-function updateFile(path, values, privateFile) {
-  let content = existsSync(path) ? readFileSync(path, "utf8") : "# Local private deployment configuration; do not commit.\n";
-  for (const [name, value] of Object.entries(values)) {
-    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
-      throw new Error("Invalid environment variable name");
-    const line = `${name}=${quoteEnv(value)}`;
-    const pattern = new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*`, "gm");
-    if (pattern.test(content))
-      content = content.replace(pattern, () => line);
-    else
-      content = `${content.trimEnd()}
-${line}
-`;
-  }
-  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
-  if (privateFile)
-    chmodSync(path, 384);
-}
-function removeOverrides(path, names, privateFile = true) {
-  if (!existsSync(path) || names.length === 0)
-    return;
-  let content = readFileSync(path, "utf8");
-  for (const name of names)
-    content = content.replace(new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
-  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
-  chmodSync(path, privateFile ? 384 : 420);
-}
-function saveDeploymentEnvironment(environment, values, options = {}) {
-  try {
-    const shared = {};
-    const privateValues = {};
-    for (const [name, value] of Object.entries(values)) {
-      if (options.private) {
-        privateValues[name] = value;
-      } else if (isSecret(name, value)) {
-        privateValues[name] = value;
-        try {
-          const parsed = JSON.parse(value);
-          if (parsed && typeof parsed === "object")
-            shared[name] = JSON.stringify(publicConfig(parsed));
-        } catch {
-        }
-      } else {
-        shared[name] = value;
-      }
-    }
-    if (Object.keys(shared).length)
-      updateFile(join(environment.envDir, `.env.${environment.environment}`), shared, false);
-    if (Object.keys(privateValues).length)
-      updateFile(join(environment.envDir, ".env.local"), privateValues, true);
-    removeOverrides(join(environment.envDir, `.env.${environment.environment}`), Object.keys(privateValues).filter((name) => !(name in shared)), false);
-    removeOverrides(join(environment.envDir, ".env.local"), Object.keys(shared).filter((name) => !(name in privateValues)));
-    if (Object.keys(privateValues).length) {
-      const ignorePath = join(environment.envDir, ".gitignore");
-      const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
-      if (!ignore.split(/\r?\n/).includes(".env.local"))
-        writeFileSync(ignorePath, `${ignore.trimEnd()}
-.env.local
-.hai/deploy/
-`);
-    }
-    return ok(Object.keys(values));
-  } catch {
-    return err(HaiDeployError.ENV_VAR_FAILED, deployM("deploy_environmentWriteFailed"));
-  }
-}
-var logger = core.logger.child({ module: "deploy", scope: "credentials" });
-var DEPLOY_CREDENTIAL_KEY_PATTERN = /^HAI_DEPLOY_[A-Z0-9_]+$/;
-function isAllowedCredentialKey(key) {
-  return DEPLOY_CREDENTIAL_KEY_PATTERN.test(key);
-}
-function normalizeCredentialEntries(entries) {
-  const normalized = {};
-  for (const [key, value] of Object.entries(entries)) {
-    if (!isAllowedCredentialKey(key)) {
-      logger.warn("Ignoring unsupported deploy credential key", { key });
-      continue;
-    }
-    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      normalized[key] = String(value);
-      continue;
-    }
-    logger.warn("Ignoring deploy credential with non-scalar value", { key });
-  }
-  return normalized;
-}
-function assertAllowedCredentialKey(key) {
-  if (!isAllowedCredentialKey(key)) {
-    throw new Error(deployM("deploy_credentialInvalidKey", { params: { key } }));
-  }
-}
-function assertAllowedCredentialEntries(entries) {
-  for (const key of Object.keys(entries)) {
-    assertAllowedCredentialKey(key);
-  }
-}
-function getCredentialsPath() {
-  return join(homedir(), ".hai", "credentials.yml");
-}
-function ensureDir(filePath) {
-  const dir = dirname(filePath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-}
-function readCredentialsFile() {
-  const filePath = getCredentialsPath();
-  if (!existsSync(filePath)) {
-    return {};
-  }
-  const content = readFileSync(filePath, "utf-8");
-  const parsed = parse$1(content);
-  if (parsed === null || parsed === void 0 || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return {};
-  }
-  return normalizeCredentialEntries(parsed);
-}
-function writeCredentialsFile(data) {
-  const filePath = getCredentialsPath();
-  ensureDir(filePath);
-  const header = "# Managed by hai cli - do not edit manually\n";
-  const content = header + stringify(data);
-  writeFileSync(filePath, content, { encoding: "utf-8", mode: 384 });
-}
-function loadCredentials() {
-  try {
-    const data = readCredentialsFile();
-    const keys = Object.keys(data);
-    for (const key of keys) {
-      process2.env[key] = String(data[key]);
-    }
-    logger.debug("Credentials loaded", { count: keys.length });
-    return ok(keys);
-  } catch (error62) {
-    logger.error("Failed to load credentials", { error: error62 });
-    return err(
-      HaiDeployError.CREDENTIAL_ERROR,
-      deployM("deploy_credentialError", {
-        params: { error: error62 instanceof Error ? error62.message : String(error62) }
-      }),
-      error62
-    );
-  }
-}
-function saveCredential(key, value) {
-  try {
-    assertAllowedCredentialKey(key);
-    const data = readCredentialsFile();
-    data[key] = value;
-    writeCredentialsFile(data);
-    process2.env[key] = value;
-    logger.debug("Credential saved", { key });
-    return ok(void 0);
-  } catch (error62) {
-    logger.error("Failed to save credential", { key, error: error62 });
-    return err(
-      HaiDeployError.CREDENTIAL_ERROR,
-      deployM("deploy_credentialError", {
-        params: { error: error62 instanceof Error ? error62.message : String(error62) }
-      }),
-      error62
-    );
-  }
-}
-function saveCredentials(entries) {
-  try {
-    assertAllowedCredentialEntries(entries);
-    const data = readCredentialsFile();
-    for (const [key, value] of Object.entries(entries)) {
-      data[key] = value;
-      process2.env[key] = value;
-    }
-    writeCredentialsFile(data);
-    logger.debug("Credentials saved", { count: Object.keys(entries).length });
-    return ok(void 0);
-  } catch (error62) {
-    logger.error("Failed to save credentials", { error: error62 });
-    return err(
-      HaiDeployError.CREDENTIAL_ERROR,
-      deployM("deploy_credentialError", {
-        params: { error: error62 instanceof Error ? error62.message : String(error62) }
-      }),
-      error62
-    );
-  }
-}
-function resolveArtifactDirectory(appDir) {
-  let directory = resolve(appDir);
-  while (true) {
-    if (existsSync(join(directory, "hai.build.json")) || existsSync(join(directory, "pnpm-lock.yaml")))
-      return join(directory, ".hai/build/docker");
-    const parent = dirname(directory);
-    if (parent === directory)
-      return join(appDir, ".hai/build/docker");
-    directory = parent;
-  }
-}
-function usesDefaultMiddleware(scan, service, options) {
-  const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
-  return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
-}
-function resolveOutputDir(appDir, providerType) {
-  switch (providerType) {
-    case "vercel":
-      return join(appDir, ".vercel", "output");
-    default:
-      return join(appDir, "build");
-  }
-}
-var RecoverySchema = external_exports.object({
-  projectName: external_exports.string(),
-  stage: external_exports.string(),
-  platformProjectId: external_exports.string().optional(),
-  resources: external_exports.array(external_exports.object({
-    serviceType: external_exports.enum(["db", "cache", "storage", "email", "sms"]),
-    provisionerName: external_exports.string(),
-    resourceInfo: external_exports.string(),
-    resourceStatus: external_exports.enum(["created", "reused", "unknown"])
-  }))
-});
-function getDeployRecovery(error62) {
-  const parsed = RecoverySchema.safeParse(error62.ext?.recovery);
-  return parsed.success ? parsed.data : void 0;
-}
-function recoveryFailure(error62, recovery) {
-  return err({
-    code: error62.code,
-    httpStatus: error62.httpStatus,
-    system: error62.system,
-    module: error62.module,
-    message: deployM("deploy_recoveryFailure", { params: { stage: recovery.stage } }),
-    suggestion: deployM("deploy_recoverySuggestion"),
-    ext: { recovery }
-  });
-}
-var logger2 = core.logger.child({ module: "deploy", scope: "scanner" });
-function record2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function runtimeDependencies(appDir) {
-  let root = appDir;
-  while (!existsSync(join(root, "pnpm-lock.yaml"))) {
-    const parent = dirname(root);
-    if (parent === root)
-      throw new Error("Missing pnpm lockfile; run pnpm install");
-    root = parent;
-  }
-  const importerKey = relative(root, appDir).replaceAll("\\", "/") || ".";
-  const documents = parseAllDocuments(readFileSync(join(root, "pnpm-lock.yaml"), "utf8"));
-  if (documents.some((document) => document.errors.length))
-    throw new Error("Invalid pnpm lockfile");
-  const lock = documents.map((document) => record2(document.toJS())).reverse().find((document) => importerKey in record2(document.importers));
-  if (!lock)
-    throw new Error("Application is missing from pnpm lockfile; run pnpm install");
-  const importers = record2(lock.importers);
-  const packages = record2(lock.packages);
-  const snapshots = record2(lock.snapshots);
-  const names = /* @__PURE__ */ new Set();
-  const visited = /* @__PURE__ */ new Set();
-  const visit2 = (id, node2, importer) => {
-    if (visited.has(id))
-      return;
-    visited.add(id);
-    const metadata = importer === void 0 ? record2(packages[id.split("(")[0]]) : {};
-    const peers = record2(metadata.peerDependencies);
-    for (const [name, reference] of Object.entries({ ...record2(node2.dependencies), ...record2(node2.optionalDependencies) })) {
-      if (name in peers)
-        continue;
-      const version2 = typeof reference === "string" ? reference : record2(reference).version;
-      if (typeof version2 !== "string")
-        throw new Error("Invalid pnpm dependency reference");
-      if (version2.startsWith("link:")) {
-        if (importer === void 0)
-          throw new Error("Invalid workspace dependency");
-        const target = relative(root, resolve(root, importer, version2.slice(5))).replaceAll("\\", "/") || ".";
-        const linked = record2(importers[target]);
-        if (!Object.keys(linked).length)
-          throw new Error("Missing linked workspace importer");
-        names.add(name);
-        visit2(`workspace:${target}`, linked, target);
-        continue;
-      }
-      const key = version2 in snapshots || version2 in packages ? version2 : `${name}@${version2}`;
-      names.add(key.match(/^(@[^/]+\/[^@]+|[^@]+)@/)?.[1] ?? name);
-      const snapshot = record2(snapshots[key] ?? packages[key]);
-      if (!Object.keys(snapshot).length && !(key in snapshots) && !(key in packages))
-        throw new Error("Missing pnpm dependency snapshot");
-      visit2(key, snapshot);
-    }
-  };
-  visit2(`workspace:${importerKey}`, record2(importers[importerKey]), importerKey);
-  return { runtime: names, build: /* @__PURE__ */ new Set([...names, ...Object.keys(record2(record2(importers[importerKey]).devDependencies))]), root };
-}
-async function scanApp(inputDir, options) {
-  try {
-    const appDir = resolve(inputDir);
-    const graph = runtimeDependencies(appDir);
-    const envDir = options?.envDir ? resolve(options.envDir) : existsSync(join(appDir, ".env")) ? appDir : graph.root;
-    const loaded = loadDeploymentEnvironment({ environment: options?.environment ?? "prod", envDir, requireFile: options?.environment !== void 0 });
-    if (!loaded.success)
-      return loaded;
-    const env = loaded.data.values;
-    const deps = graph.runtime;
-    const configs = {};
-    for (const [name, owner] of Object.entries({ db: "reldb", cache: "cache", storage: "storage", vecdb: "vecdb", iam: "iam", reach: "reach" })) {
-      configs[name] = {};
-      if (!deps.has(`@h-ai/${owner}`))
-        continue;
-      const configFile = ["yml", "yaml"].map((ext) => join(appDir, "config", `_${name}.${ext}`)).find(existsSync);
-      const config2 = configFile ? loadDeploymentConfig(name, configFile, env) : void 0;
-      if (config2 && !config2.success)
-        return config2;
-      configs[name] = config2?.data ?? {};
-    }
-    const middlewares = [];
-    const add = (service, backend, configName = service, configPath = [], config2 = configs[configName] ?? {}, source = `_${configName}.yml`) => {
-      middlewares.push({ service, backend, source, configName, configPath, envPrefix: ["HAI", configName, ...configPath].map((part) => part.toUpperCase()).join("_"), config: config2 });
-    };
-    const iam = deps.has("@h-ai/iam");
-    if (deps.has("@h-ai/reldb"))
-      add("db", String(configs.db.type ?? "sqlite"), "db", [], configs.db, "@h-ai/reldb / _db.yml");
-    if (deps.has("@h-ai/cache"))
-      add("cache", String(configs.cache.type ?? "memory"), "cache", [], configs.cache, "@h-ai/cache / _cache.yml");
-    if (deps.has("@h-ai/storage"))
-      add("storage", String(configs.storage.type ?? "local"));
-    if (deps.has("@h-ai/vecdb"))
-      add("vecdb", String(configs.vecdb.type ?? "lancedb"));
-    if (iam) {
-      const ldap = record2(configs.iam.ldap);
-      add("ldap", record2(configs.iam.login).ldap === true ? "ldap" : "disabled", "iam", ["ldap"], ldap, "@h-ai/iam (LDAP)");
-    }
-    const providers = configs.reach.providers;
-    if (deps.has("@h-ai/reach") && Array.isArray(providers)) {
-      for (const [index, item] of providers.entries()) {
-        const provider = record2(item);
-        const type = String(provider.type ?? "");
-        const service = type === "aliyun-sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
-        if (service)
-          add(service, type, "reach", ["providers", String(index)], provider, "@h-ai/reach");
-      }
-    }
-    if (deps.has("@h-ai/reach") && !middlewares.some((item) => item.configName === "reach"))
-      add("email", "console", "reach", ["providers", "0"], { name: "email", type: "console" }, "@h-ai/reach");
-    const isSvelteKit = graph.build.has("@sveltejs/kit");
-    const scan = {
-      appDir,
-      envDir,
-      middlewares,
-      haiModules: [...deps].filter((name) => name.startsWith("@h-ai/")).sort(),
-      appName: basename(appDir),
-      isSvelteKit,
-      adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
-      nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
-      requiredServices: [...new Set(middlewares.map((item) => item.service))],
-      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend]))
-    };
-    logger2.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
-    return ok(scan);
-  } catch {
-    return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
-  }
-}
-var logger3 = core.logger.child({ module: "deploy", scope: "command" });
-function maskSecrets(text, secrets) {
-  if (!secrets || secrets.length === 0)
-    return text;
-  let masked = text;
-  for (const secret of secrets) {
-    if (secret && secret.length > 0)
-      masked = masked.split(secret).join("***");
-  }
-  return masked;
-}
-function runCommand(command, args, options = {}) {
-  return new Promise((resolve6) => {
-    const child = spawn(command, args, {
-      windowsHide: true,
-      cwd: options.cwd,
-      env: options.env ? { ...process2.env, ...options.env } : process2.env,
-      shell: false
-    });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    let timer;
-    const finish = (result) => {
-      if (settled)
-        return;
-      settled = true;
-      if (timer)
-        clearTimeout(timer);
-      resolve6(result);
-    };
-    if (options.timeoutMs && options.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        logger3.error("Command timed out", { command, timeoutMs: options.timeoutMs });
-        finish(err(
-          HaiDeployError.REMOTE_COMMAND_FAILED,
-          deployM("deploy_commandTimeout", { params: { command } })
-        ));
-      }, options.timeoutMs);
-    }
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-      options.onOutput?.(maskSecrets(chunk.toString("utf-8"), options.secrets));
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (error62) => {
-      logger3.error("Command failed to start", { command, error: maskSecrets(String(error62), options.secrets) });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(error62.message, options.secrets) }
-        }),
-        error62
-      ));
-    });
-    child.on("close", (code) => {
-      const exitCode = code ?? -1;
-      if (exitCode === 0) {
-        finish(ok({ code: exitCode, stdout, stderr }));
-        return;
-      }
-      logger3.error("Command exited with non-zero code", {
-        command,
-        code: exitCode,
-        stderr: maskSecrets(stderr, options.secrets).slice(-500),
-        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
-      });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
-${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
-        })
-      ));
-    });
-    if (options.input !== void 0) {
-      child.stdin.write(options.input);
-      child.stdin.end();
-    } else {
-      child.stdin.end();
-    }
-  });
-}
-
-// ../deploy/src/container/deploy-scripts.ts
-function shellArgument(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function createApplyScript(options) {
-  const values = {
-    ID: shellArgument(options.deploymentId),
-    PROJECT: shellArgument(`hai-${options.projectName}`),
-    ENV: shellArgument(options.environment),
-    RUNTIME: shellArgument(options.runtime),
-    PARTIAL: options.partial ? "true" : "false",
-    SELECTED: shellArgument(options.selected.join(" ")),
-    ROOT: shellArgument(options.directory),
-    PORT: String(options.hostPort),
-    HEALTH: options.healthPaths.map(shellArgument).join(" ")
-  };
-  return String.raw`#!/bin/sh
-set -eu
-umask 077
-source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-destination=@@ROOT@@
-if [ "$#" -gt 0 ]; then destination=$1; fi
-root=$(mkdir -p -- "$destination" && CDPATH= cd -- "$destination" && pwd)
-id=@@ID@@
-project=@@PROJECT@@
-export HAI_DEPLOY_ENVIRONMENT=@@ENV@@
-runtime=@@RUNTIME@@
-partial=@@PARTIAL@@
-orphan_option=''
-if [ "$partial" = false ]; then orphan_option=--remove-orphans; fi
-recreate_option=--force-recreate
-if [ "$partial" = true ]; then recreate_option=--no-recreate; fi
-selected=@@SELECTED@@
-release="$root/releases/$id"
-case "$release/" in "$source_dir/"*) printf 'Extract the package outside the deployment directory before applying it.\n' >&2; exit 1;; esac
-stage=''
-previous=''
-restore=''
-changed=false
-locked=false
-started=$(date +%s)
-step_started=$started
-step() {
-  if [ -n "$stage" ]; then
-    duration=$(( $(date +%s) - step_started ))
-    printf '[PASS] %s (%ss)\n' "$stage" "$duration"
-    printf '{"stage":"%s","status":"passed","durationSeconds":%s}\n' "$stage" "$duration" >> "$root/steps-$id.jsonl"
-  fi
-  stage="$1"
-  step_started=$(date +%s)
-  printf '\n[%s] %s\n' "$stage" "$2"
-}
-compose() {
-  arguments_file="$release/compose-files"
-  if [ -n "$restore" ]; then arguments_file="$root/releases/$restore/compose-files"; fi
-  # -f 按顺序合并，由 Compose 保留未选服务、卷和环境文件，不自行拼装配置。
-  command_args="$release/.compose-command"
-  # 文件列表先反向读取，再向参数头部加入，保留原始合并顺序。
-  awk '{lines[NR]=$0} END {for(i=NR;i>0;i--) print lines[i]}' "$arguments_file" > "$command_args"
-  while IFS= read -r file; do set -- -f "$file" "$@"; done < "$command_args"
-  "$runtime" compose -p "$project" "$@"
-}
-remove_selected() {
-  test "$partial" = true || return 0
-  # 直接替换选中容器，避免 Compose Provider 连带重建依赖它的未选服务；不删除卷。
-  for service in "$@"; do
-    containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service") || return 1
-    for container in $containers; do
-      "$runtime" rm -f "$container" || return 1
-    done
-  done
-}
-finish() {
-  code=$?
-  trap - EXIT HUP INT TERM
-  if [ "$code" -ne 0 ]; then
-    printf '[FAIL] %s (exit %s)\n' "$stage" "$code" >&2
-    if [ "$changed" = true ]; then
-      diagnostics="$root/diagnostics-$id.log"
-      : > "$diagnostics"
-      for service in $selected; do
-        containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service" || true)
-        for container in $containers; do
-          "$runtime" inspect --format '{{.Name}} {{.State.Status}} exit={{.State.ExitCode}}' "$container" >> "$diagnostics" 2>&1 || true
-          "$runtime" logs --tail 80 "$container" >> "$diagnostics" 2>&1 || true
-        done
-      done
-      printf 'Startup diagnostics saved to %s (private server file).\n' "$diagnostics" >&2
-    fi
-    if [ -f "$release/rollback-images" ]; then
-      while IFS=' ' read -r image reference; do
-        test -n "$reference" || continue
-        "$runtime" tag "$image" "$reference" || printf '[FAIL] Cannot restore image %s\n' "$reference" >&2
-      done < "$release/rollback-images"
-    fi
-    if [ "$changed" = true ] && [ -n "$previous" ]; then
-      printf '[RECOVER] Restoring previous selected services\n' >&2
-      recover_selected=$selected
-      if [ "$partial" = false ]; then recover_selected=$(grep -v -- '-init$' "$root/releases/$previous/services"); fi
-      restore="$previous"
-      if remove_selected $recover_selected && compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $recover_selected; then
-        case " $selected " in *' app '*)
-          if grep -qx web "$root/releases/$previous/services"; then compose exec -T web nginx -s reload || true; fi
-          ;;
-        esac
-        printf '[RECOVER] Previous containers restored; verify application health\n' >&2
-      else
-        printf '[FAIL] Recovery failed. Use the previous release and inspect container logs.\n' >&2
-      fi
-    elif [ "$changed" = true ]; then
-      compose stop $selected || true
-      printf '[RECOVER] Failed first installation stopped; data volumes retained\n' >&2
-    fi
-  fi
-  if [ "$locked" = true ]; then
-    elapsed=$(( $(date +%s) - started ))
-    outcome=passed
-    if [ "$code" -ne 0 ]; then outcome=failed; fi
-    printf '{"stage":"%s","status":"%s","durationSeconds":%s}\n' "$stage" "$outcome" "$(( $(date +%s) - step_started ))" >> "$root/steps-$id.jsonl"
-    printf '{"deploymentId":"%s","stage":"%s","exitCode":%s,"durationSeconds":%s}\n' "$id" "$stage" "$code" "$elapsed" > "$root/result-$id.json"
-    rmdir "$root/.deploy-lock" || true
-  fi
-  exit "$code"
-}
-trap finish EXIT
-trap 'exit 130' HUP INT TERM
-step preflight 'Checking deployment tools and package'
-for tool in sha256sum tar awk curl; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s\n' "$tool" >&2; exit 1; }; done
-if [ "$runtime" = auto ]; then
-  if command -v podman >/dev/null 2>&1 && podman version >/dev/null 2>&1; then runtime=podman; else runtime=docker; fi
-fi
-case "$runtime" in docker|podman) ;; *) printf 'Runtime must be docker or podman\n' >&2; exit 1;; esac
-"$runtime" version >/dev/null
-"$runtime" compose version >/dev/null
-"$runtime" compose up --help | grep -q never || { printf 'Compose is too old. Install Docker Compose v2 or podman-compose 1.6.0 or newer (supports --pull never).\n' >&2; exit 1; }
-mkdir "$root/.deploy-lock" 2>/dev/null || { printf 'Another deployment is running. Check %s/.deploy-lock before retrying.\n' "$root" >&2; exit 1; }
-locked=true
-cd "$source_dir"
-sha256sum -c SHA256SUMS
-if [ -f "$root/current" ]; then
-  previous=$(cat "$root/current")
-  case "$previous" in ''|*[!a-zA-Z0-9._-]*) printf 'Invalid deployment state\n' >&2; exit 1;; esac
-  test -f "$root/releases/$previous/compose-files"
-fi
-if [ "$partial" = true ]; then
-  test -n "$previous" || { printf 'Partial deployment requires a successful full installation. Deploy a complete bundle first.\n' >&2; exit 1; }
-  cmp -s layout "$root/releases/$previous/layout" || { printf 'Ports, API routes or application layout changed. Create a full deployment bundle.\n' >&2; exit 1; }
-fi
-test ! -e "$release" || { printf 'This deployment ID was already used. Create a new deployment bundle.\n' >&2; exit 1; }
-mkdir -p "$release"
-cp -R "$source_dir/." "$release/"
-# Nginx 以非 root 用户运行；只开放不含凭据的代理配置读取权限。
-if [ -f "$release/web.conf" ]; then chmod 644 "$release/web.conf"; fi
-: > "$release/compose-files"
-if [ "$partial" = true ]; then
-  cp "$root/releases/$previous/compose-files" "$release/compose-files"
-  cp "$root/releases/$previous/middleware.env" "$release/middleware.env"
-  for service in $selected; do
-    grep -qx "$service" "$root/releases/$previous/services" || { printf 'Service %s has no installed baseline. Use a full deployment.\n' "$service" >&2; exit 1; }
-  done
-fi
-printf '%s\n' "$release/compose-entry.json" >> "$release/compose-files"
-compose config >/dev/null
-compose config --services > "$release/services"
-: > "$release/rollback-images"
-if [ -n "$previous" ]; then
-  for service in $selected; do
-    containers=$("$runtime" ps -aq --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$service")
-    for container in $containers; do
-      "$runtime" inspect --format '{{.Image}} {{.Config.Image}}' "$container" >> "$release/rollback-images"
-    done
-  done
-fi
-step images 'Loading packaged images (no registry access)'
-while IFS=' ' read -r archive reference; do
-  test -n "$archive" || continue
-  "$runtime" load -i "$release/images/$archive"
-  "$runtime" image inspect "$reference" >/dev/null
-  architecture=$("$runtime" image inspect --format '{{.Architecture}}' "$reference")
-  host_arch=$(uname -m)
-  case "$host_arch:$architecture" in x86_64:amd64|aarch64:arm64) ;; *) printf 'Image architecture %s does not match server %s\n' "$architecture" "$host_arch" >&2; exit 1;; esac
-done < "$release/image-list"
-step dependencies 'Checking dependencies of selected services'
-if [ "$partial" = true ]; then cat "$release/services" >> "$release/dependencies"; fi
-while IFS= read -r dependency; do
-  test -n "$dependency" || continue
-  case "$dependency" in *-init) continue;; esac
-  case " $selected " in *" $dependency "*) continue;; esac
-  running=$("$runtime" ps -q --filter "label=com.docker.compose.project=$project" --filter "label=com.docker.compose.service=$dependency")
-  test -n "$running" || { printf 'Dependency %s is not running. Include it in a full deployment.\n' "$dependency" >&2; exit 1; }
-  for container in $running; do
-    test "$("$runtime" inspect --format '{{.State.Running}}' "$container")" = true || { printf 'Dependency %s is stopped. Start it before retrying.\n' "$dependency" >&2; exit 1; }
-  done
-done < "$release/dependencies"
-step start 'Updating selected services'
-changed=true
-remove_selected $selected
-if [ -f "$release/initialize-storage" ]; then
-  remove_selected storage-init
-  compose up -d --no-deps --no-build --pull never storage
-  compose up --no-deps --no-build --pull never "$recreate_option" --exit-code-from storage-init storage-init
-fi
-compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $selected
-case " $selected " in
-  *' app '*)
-    case " $selected " in *' web '*) ;; *)
-      if grep -qx web "$release/services"; then compose exec -T web nginx -s reload; fi
-    esac
-    ;;
-esac
-step health 'Checking HTTP access'
-for path in @@HEALTH@@; do
-  ready=false
-  attempt=0
-  while [ "$attempt" -lt 40 ]; do
-    if curl --noproxy '*' -fsS --max-time 5 "http://127.0.0.1:@@PORT@@$path" >/dev/null 2>&1; then ready=true; break; fi
-    attempt=$((attempt + 1))
-    sleep 3
-  done
-  test "$ready" = true || { printf 'HTTP check failed: %s. Inspect compose logs for selected services.\n' "$path" >&2; exit 1; }
-done
-step complete 'Deployment passed all checks'
-printf '%s\n' "$id" > "$root/current.next"
-mv "$root/current.next" "$root/current"
-printf '[PASS] %s\n' "$id"
-`.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]);
-}
-function createUploadScripts(config2, bundle, projectName) {
-  const ssh = config2.ssh;
-  const host = ssh?.host ?? "SERVER_HOST";
-  const user = ssh?.username ?? "deploy";
-  const remote = `${config2.remote.baseDir}/${projectName}`;
-  const port = ssh?.port ?? 22;
-  const sh = String.raw`#!/bin/sh
-set -eu
-cd "$(dirname "$0")"
-host=@@HOST@@
-user=@@USER@@
-port=@@PORT@@
-remote=@@REMOTE@@
-bundle=@@BUNDLE@@
-if [ "$#" -ge 1 ]; then host=$1; fi
-if [ "$#" -ge 2 ]; then port=$2; fi
-if [ "$#" -ge 3 ]; then user=$3; fi
-identity=$(printenv HAI_DEPLOY_IDENTITY_FILE || true)
-if [ -z "$identity" ]; then identity=@@IDENTITY@@; fi
-test "$host" != SERVER_HOST || { printf 'Specify the server: sh deploy.sh SERVER [PORT] [USER].\n' >&2; exit 1; }
-for tool in ssh scp; do command -v "$tool" >/dev/null || { printf 'Install OpenSSH (%s).\n' "$tool" >&2; exit 1; }; done
-set -- -o BatchMode=yes -o StrictHostKeyChecking=@@STRICT@@ -o ConnectTimeout=10
-if [ -n "$identity" ]; then set -- "$@" -i "$identity"; fi
-known_hosts=@@KNOWN@@
-if value=$(printenv HAI_DEPLOY_KNOWN_HOSTS_FILE); then known_hosts=$value; fi
-if [ -n "$known_hosts" ]; then set -- "$@" -o "UserKnownHostsFile=$known_hosts"; fi
-printf '[1/3] Connecting to %s\n' "$host"
-ssh "$@" -p "$port" "$user@$host" "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"
-printf '[2/3] Uploading %s\n' "$bundle"
-scp_host=$host
-case "$host" in *:*) scp_host="[$host]";; esac
-scp "$@" -P "$port" "$bundle" "$user@$scp_host:$remote/incoming/$bundle"
-printf '[3/3] Applying package and checking HTTP access\n'
-ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"
-`;
-  const ps1 = String.raw`param([string]$IdentityFile = $env:HAI_DEPLOY_IDENTITY_FILE)
-$ErrorActionPreference = 'Stop'
-Set-Location -LiteralPath $PSScriptRoot
-$target = Get-Content -LiteralPath './deploy-target.json' -Raw | ConvertFrom-Json
-if ($target.host -eq 'SERVER_HOST') { throw 'Set the server host in deploy-target.json.' }
-if ($target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]+$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar$') { throw 'Invalid deployment target.' }
-$options = @('-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new', '-o', 'ConnectTimeout=10')
-if ($target.strictHostKeyChecking -eq $false) { $options[3] = 'StrictHostKeyChecking=no' }
-if (-not $IdentityFile) { $IdentityFile = $target.identityFile }
-if ($IdentityFile) { $options += @('-i', $IdentityFile) }
-if ($target.knownHostsFile) { $options += @('-o', "UserKnownHostsFile=$($target.knownHostsFile)") }
-$destination = "$($target.username)@$($target.host)"
-$scpDestination = if ($target.host.Contains(':')) { "$($target.username)@[$($target.host)]" } else { $destination }
-$remote = $target.directory
-$bundle = $target.bundle
-function Invoke-Step([string]$Name, [string]$Command, [string[]]$Arguments) {
-  Write-Host "[$Name]"
-  & $Command @Arguments
-  if ($LASTEXITCODE -ne 0) { throw "$Name failed (exit $LASTEXITCODE)." }
-}
-try {
-  foreach ($tool in @('ssh', 'scp')) { Get-Command $tool -ErrorAction Stop | Out-Null }
-  Invoke-Step '1/3 Connect' 'ssh' ($options + @('-p', [string]$target.port, $destination, "mkdir -p '$remote/incoming' && chmod 700 '$remote' '$remote/incoming'"))
-  Invoke-Step '2/3 Upload' 'scp' ($options + @('-P', [string]$target.port, $bundle, "$($scpDestination):$remote/incoming/$bundle"))
-  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$target.port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"))
-} catch { Write-Error $_; exit 1 }
-`;
-  const values = { HOST: shellArgument(host), USER: shellArgument(user), PORT: String(port), REMOTE: shellArgument(remote), BUNDLE: shellArgument(bundle), IDENTITY: shellArgument(ssh?.identityFile ?? ""), KNOWN: shellArgument(ssh?.knownHostsFile ?? ""), STRICT: ssh?.strictHostKeyChecking === false ? "no" : "accept-new" };
-  return { sh: sh.replace(/@@([A-Z]+)@@/g, (_match, name) => values[name]), ps1 };
-}
-
-// ../deploy/src/container/deploy-bundle.ts
-async function createDeploymentBundle(options) {
-  const { directory, artifactDir, artifact, projectName, environment, config: config2, selected } = options;
-  const stem = basename(options.output).replace(/\.tar$/i, "");
-  const suffix = `-${artifact.appVersion}`;
-  const output2 = resolve(dirname(options.output), `${stem.endsWith(suffix) ? stem : `${stem}${suffix}`}.tar`);
-  if (!/^[\w.+-]+\.tar$/.test(basename(output2)))
-    throw new Error(deployM("deploy_bundleNameInvalid"));
-  const staging = mkdtempSync(join(directory, ".bundle-"));
-  const temporaryTar = `${output2}.partial`;
-  mkdirSync(dirname(output2), { recursive: true, mode: 448 });
-  chmodSync(staging, 448);
-  const files = [];
-  const put = (file2, content) => {
-    mkdirSync(dirname(join(staging, file2)), { recursive: true });
-    writeFileSync(join(staging, file2), content, { mode: 384 });
-    files.push(file2);
-  };
-  try {
-    mkdirSync(join(staging, "images"));
-    const compose = parse$1(readFileSync(join(directory, `docker-compose-${artifact.appVersion}.yml`), "utf8"));
-    const dependencies = /* @__PURE__ */ new Set();
-    const references = /* @__PURE__ */ new Set();
-    for (const name of selected) {
-      const service = compose.services[name];
-      if (!service)
-        throw new Error(deployM("deploy_selectionInvalid", { params: { service: name } }));
-      if (typeof service.image === "string")
-        references.add(service.image);
-      if (service.depends_on) {
-        for (const dependency of Array.isArray(service.depends_on) ? service.depends_on : Object.keys(service.depends_on))
-          dependencies.add(dependency);
-      }
-      if (service.env_file)
-        service.env_file = [`../${options.deploymentId}/.env.runtime`, `../${options.deploymentId}/middleware.env`];
-      if (Array.isArray(service.volumes))
-        service.volumes = service.volumes.map((mount) => typeof mount === "string" ? mount.replace("./web.conf:", `../${options.deploymentId}/web.conf:`) : mount);
-    }
-    put("compose.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, compose.services[name]])) }));
-    put("compose-entry.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, { extends: { file: `../${options.deploymentId}/compose.json`, service: name } }])) }));
-    let runtime;
-    const imageList = [];
-    for (const reference of references) {
-      if (!/:[^/:]+$/.test(reference) || /:latest$/i.test(reference))
-        throw new Error(deployM("deploy_imageVersionRequired", { params: { image: reference } }));
-      const built = artifact.images.find((image) => image.imageRef === reference);
-      const file2 = built?.file ?? `middleware-${imageList.length + 1}.tar`;
-      if (built) {
-        copyFileSync(join(artifactDir, file2), join(staging, "images", file2));
-      } else {
-        if (!runtime) {
-          const candidates = options.runtime === "auto" ? ["podman", "docker"] : [options.runtime];
-          for (const candidate of candidates) {
-            if ((await runCommand(candidate, ["version"])).success) {
-              runtime = candidate;
-              break;
-            }
-          }
-          if (!runtime)
-            throw new Error(deployM("deploy_bundleRuntimeRequired"));
-        }
-        if (!(await runCommand(runtime, ["image", "inspect", reference])).success) {
-          const pulled = await runCommand(runtime, ["pull", reference], { timeoutMs: 6e5 });
-          if (!pulled.success)
-            throw new Error(pulled.error.message);
-        }
-        const saved = await runCommand(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", join(staging, "images", file2), reference], { timeoutMs: 6e5 });
-        if (!saved.success)
-          throw new Error(saved.error.message);
-      }
-      files.push(`images/${file2}`);
-      imageList.push(`${file2} ${reference}`);
-    }
-    put(".env.runtime", readFileSync(join(directory, ".env.runtime"), "utf8"));
-    put("middleware.env", options.middlewareEnv);
-    if (selected.includes("web"))
-      put("web.conf", readFileSync(join(directory, "web.conf"), "utf8"));
-    put("manifest.json", `${JSON.stringify({ ...artifact, images: artifact.images.filter((image) => references.has(image.imageRef)), deploymentId: options.deploymentId, selectedServices: selected, partial: options.partial }, null, 2)}
-`);
-    put("layout", `${config2.expose.hostPort}:${options.containerPort}:${options.hasWeb}:${options.hasWeb ? await artifactChecksum(join(directory, "web.conf")) : ""}
-`);
-    put("image-list", `${imageList.join("\n")}
-`);
-    put("dependencies", `${[...dependencies].join("\n")}
-`);
-    if (selected.includes("storage-init"))
-      put("initialize-storage", "");
-    put("apply.sh", createApplyScript({ deploymentId: options.deploymentId, projectName, environment, directory: `${config2.remote.baseDir}/${projectName}`, runtime: config2.remote.runtime, partial: options.partial, selected: selected.filter((name) => name !== "storage-init"), hostPort: config2.expose.hostPort, healthPaths: options.healthPaths }));
-    const instructions = deployM("deploy_bundleInstructions", { params: { file: basename(output2), start: "apply.sh", images: [...references].join("\n"), compose: "compose.json" } });
-    put("README.txt", `${deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, compose: "compose.json" } })}
-${instructions}
-`);
-    const checksums = [];
-    for (const file2 of files)
-      checksums.push(`${await artifactChecksum(join(staging, file2))}  ${file2}`);
-    writeFileSync(join(staging, "SHA256SUMS"), `${checksums.join("\n")}
-`);
-    const tar = await runCommand("tar", ["-cf", temporaryTar, "-C", staging, "."]);
-    if (!tar.success)
-      throw new Error(tar.error.message);
-    chmodSync(temporaryTar, 384);
-    renameSync(temporaryTar, output2);
-    const upload = createUploadScripts(config2, basename(output2), projectName);
-    const scripts = `${output2.slice(0, -4)}-deploy`;
-    mkdirSync(scripts, { recursive: true, mode: 448 });
-    writeFileSync(join(scripts, "deploy.sh"), upload.sh.replace('cd "$(dirname "$0")"', 'cd "$(dirname "$0")/.."'), { mode: 448 });
-    writeFileSync(join(scripts, "deploy.ps1"), upload.ps1.replace("Set-Location -LiteralPath $PSScriptRoot", "Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)").replace("'./deploy-target.json'", "(Join-Path $PSScriptRoot 'deploy-target.json')"));
-    writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...config2.ssh, host: config2.ssh?.host ?? "SERVER_HOST", username: config2.ssh?.username ?? "deploy", port: config2.ssh?.port ?? 22, directory: `${config2.remote.baseDir}/${projectName}`, bundle: basename(output2) }, null, 2)}
-`);
-    writeFileSync(join(scripts, "README.txt"), instructions);
-    return { bundlePath: output2, instructions: `${instructions}
-${scripts}`, startName: "apply.sh" };
-  } finally {
-    rmSync(staging, { recursive: true, force: true });
-    rmSync(temporaryTar, { force: true });
-  }
-}
-var IMAGES = {
-  postgres: "docker.io/library/postgres:16.15-alpine",
-  mysql: "docker.io/library/mysql:8.4.11",
-  redis: "docker.io/library/redis:7.4.11-alpine",
-  rustfs: "ghcr.io/rustfs/rustfs:1.0.1",
-  minio: "ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z",
-  qdrant: "docker.io/qdrant/qdrant:v1.19.2",
-  pgvector: "docker.io/pgvector/pgvector:0.8.0-pg17",
-  chroma: "docker.io/chromadb/chroma:1.5.5",
-  ldap: "docker.io/osixia/openldap:1.5.0",
-  smtp: "docker.io/axllent/mailpit:v1.27.4"
-};
-function generatePassword() {
-  return randomBytes(24).toString("base64url");
-}
-function resolveSidecarSecrets(appDir, projectName) {
-  const secretFile = join(appDir, ".hai", "deploy", "runtime", `${projectName}.secrets.json`);
-  if (existsSync(secretFile)) {
-    try {
-      const saved = JSON.parse(readFileSync(secretFile, "utf-8"));
-      if (!saved || !["dbPassword", "storagePassword", "ldapPassword"].every((key) => typeof saved[key] === "string" && saved[key].length > 0))
-        throw new Error("Invalid credentials");
-      return saved;
-    } catch {
-      throw new Error(deployM("deploy_secretsInvalid", { params: { path: secretFile } }));
-    }
-  }
-  const secrets = {
-    dbPassword: generatePassword(),
-    storagePassword: generatePassword(),
-    ldapPassword: generatePassword()
-  };
-  mkdirSync(dirname(secretFile), { recursive: true });
-  writeFileSync(secretFile, JSON.stringify(secrets), { mode: 384 });
-  return secrets;
-}
-function addAppDataVolume(plan, projectName) {
-  const mount = `${projectName}-data:/app/data`;
-  if (!plan.appVolumes.includes(mount)) {
-    plan.appVolumes.push(mount);
-    plan.volumes[`${projectName}-data`] = null;
-  }
-}
-function planPostgresDb(plan, projectName, password, net) {
-  plan.services.push("db");
-  plan.dependsOn.push("db");
-  plan.composeServices.db = {
-    image: IMAGES.postgres,
-    container_name: `hai-${projectName}-db`,
-    restart: "unless-stopped",
-    env_file: [".env.runtime"],
-    volumes: [`${projectName}-db-data:/var/lib/postgresql/data`],
-    networks: net
-  };
-  plan.volumes[`${projectName}-db-data`] = null;
-  plan.env.POSTGRES_USER = "hai";
-  plan.env.POSTGRES_PASSWORD = password;
-  plan.env.POSTGRES_DB = "hai";
-  plan.env.HAI_DB = JSON.stringify({ type: "postgresql", url: `postgresql://hai:${password}@db:5432/hai`, database: "hai" });
-  plan.secrets.push(password);
-}
-function planMysqlDb(plan, projectName, password, net) {
-  plan.services.push("db");
-  plan.dependsOn.push("db");
-  plan.composeServices.db = {
-    image: IMAGES.mysql,
-    container_name: `hai-${projectName}-db`,
-    restart: "unless-stopped",
-    env_file: [".env.runtime"],
-    volumes: [`${projectName}-db-data:/var/lib/mysql`],
-    networks: net
-  };
-  plan.volumes[`${projectName}-db-data`] = null;
-  plan.env.MYSQL_ROOT_PASSWORD = password;
-  plan.env.MYSQL_DATABASE = "hai";
-  plan.env.MYSQL_USER = "hai";
-  plan.env.MYSQL_PASSWORD = password;
-  plan.env.HAI_DB = JSON.stringify({ type: "mysql", url: `mysql://hai:${password}@db:3306/hai`, database: "hai" });
-  plan.secrets.push(password);
-}
-function planRedisCache(plan, projectName, net) {
-  plan.services.push("cache");
-  plan.dependsOn.push("cache");
-  plan.composeServices.cache = {
-    image: IMAGES.redis,
-    container_name: `hai-${projectName}-cache`,
-    restart: "unless-stopped",
-    networks: net
-  };
-  plan.env.HAI_CACHE = JSON.stringify({ type: "redis", url: "redis://cache:6379" });
-}
-function planS3Storage(plan, projectName, password, net, engine) {
-  plan.services.push("storage");
-  plan.dependsOn.push("storage");
-  plan.composeServices.storage = {
-    image: IMAGES[engine],
-    container_name: `hai-${projectName}-storage`,
-    restart: "unless-stopped",
-    ...engine === "minio" ? { command: ["server", "/data"] } : {},
-    env_file: [".env.runtime"],
-    volumes: [`${projectName}-storage-data:/data`],
-    networks: net
-  };
-  plan.composeServices["storage-init"] = {
-    depends_on: ["storage"],
-    env_file: [".env.runtime"],
-    entrypoint: [
-      "node",
-      "--input-type=module",
-      "-e",
-      // 复用应用 @h-ai/storage 已依赖的 SDK；不额外拉取失效的 mc 镜像，不把密钥拼进命令。
-      `import { S3Client, HeadBucketCommand, CreateBucketCommand } from '@aws-sdk/client-s3';
-const config = JSON.parse(process.env.HAI_STORAGE);
-const client = new S3Client({ endpoint: config.endpoint, region: config.region, forcePathStyle: config.forcePathStyle, credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } });
-let ready = false;
-for (let attempt = 0; attempt < 120; attempt++) {
-  try {
-    try { await client.send(new HeadBucketCommand({ Bucket: config.bucket })); }
-    catch (error) {
-      if (error.$$metadata?.httpStatusCode !== 404) throw error;
-      await client.send(new CreateBucketCommand({ Bucket: config.bucket }));
-    }
-    ready = true; break;
-  } catch { await new Promise(resolve => setTimeout(resolve, 1000)); }
-}
-client.destroy();
-if (!ready) throw new Error('S3 bucket initialization failed');`
-    ],
-    networks: net
-  };
-  plan.volumes[`${projectName}-storage-data`] = null;
-  if (engine === "rustfs") {
-    Object.assign(plan.env, { RUSTFS_ACCESS_KEY: "hai-storage", RUSTFS_SECRET_KEY: password, RUSTFS_ADDRESS: "0.0.0.0:9000", RUSTFS_VOLUMES: "/data", RUSTFS_CONSOLE_ENABLE: "false" });
-  } else {
-    Object.assign(plan.env, { MINIO_ROOT_USER: "hai-storage", MINIO_ROOT_PASSWORD: password });
-  }
-  plan.env.HAI_STORAGE = JSON.stringify({
-    type: "s3",
-    endpoint: "http://storage:9000",
-    bucket: "hai",
-    region: "us-east-1",
-    accessKeyId: "hai-storage",
-    secretAccessKey: password,
-    forcePathStyle: true
-  });
-  plan.secrets.push(password);
-}
-function planQdrantVecdb(plan, projectName, net) {
-  plan.services.push("vecdb");
-  plan.dependsOn.push("vecdb");
-  plan.composeServices.vecdb = {
-    image: IMAGES.qdrant,
-    container_name: `hai-${projectName}-vecdb`,
-    restart: "unless-stopped",
-    volumes: [`${projectName}-vecdb-data:/qdrant/storage`],
-    networks: net
-  };
-  plan.volumes[`${projectName}-vecdb-data`] = null;
-  plan.env.HAI_VECDB = JSON.stringify({ type: "qdrant", url: "http://vecdb:6333" });
-}
-function planPgvectorVecdb(plan, projectName, password, net) {
-  plan.services.push("vecdb");
-  plan.dependsOn.push("vecdb");
-  plan.composeServices.vecdb = {
-    image: IMAGES.pgvector,
-    container_name: `hai-${projectName}-vecdb`,
-    restart: "unless-stopped",
-    env_file: [".env.runtime"],
-    volumes: [`${projectName}-vecdb-data:/var/lib/postgresql/data`],
-    networks: net
-  };
-  plan.volumes[`${projectName}-vecdb-data`] = null;
-  plan.env.POSTGRES_USER = "hai";
-  plan.env.POSTGRES_PASSWORD = password;
-  plan.env.POSTGRES_DB = "hai";
-  plan.env.HAI_VECDB = JSON.stringify({ type: "pgvector", url: `postgresql://hai:${password}@vecdb:5432/hai`, database: "hai" });
-  plan.secrets.push(password);
-}
-function planChromaVecdb(plan, projectName, net) {
-  plan.services.push("vecdb");
-  plan.dependsOn.push("vecdb");
-  plan.composeServices.vecdb = {
-    image: IMAGES.chroma,
-    container_name: `hai-${projectName}-vecdb`,
-    restart: "unless-stopped",
-    volumes: [`${projectName}-vecdb-data:/data`],
-    networks: net
-  };
-  plan.volumes[`${projectName}-vecdb-data`] = null;
-  plan.env.HAI_VECDB = JSON.stringify({ type: "chroma", url: "http://vecdb:8000" });
-}
-function planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine = "rustfs") {
-  const serviceModes = { ...options?.serviceModes };
-  for (const requirement of scan.middlewares ?? []) {
-    if (options?.selectedServices && !options.selectedServices.includes(requirement.service))
-      continue;
-    const mode = serviceModes[requirement.envPrefix] ?? serviceModes[requirement.service];
-    if (mode !== "keep")
-      continue;
-    const endpoint = requirement.config.url ?? requirement.config.endpoint;
-    let host = requirement.config.host;
-    if (typeof endpoint === "string") {
-      try {
-        host = new URL(endpoint).hostname;
-      } catch {
-        continue;
-      }
-    }
-    if (host === requirement.service || ["sqlite", "local", "memory", "lancedb"].includes(requirement.backend)) {
-      serviceModes[requirement.envPrefix] = "default";
-      serviceModes[requirement.service] = "default";
-    }
-  }
-  options = { ...options, serviceModes };
-  const plan = {
-    services: [],
-    composeServices: {},
-    volumes: {},
-    appVolumes: [],
-    env: {},
-    dependsOn: [],
-    secrets: []
-  };
-  if (!scan.requiredServices.some((service) => usesDefaultMiddleware(scan, service, options)))
-    return plan;
-  const secrets = resolveSidecarSecrets(appDir, projectName);
-  const net = ["hai-app"];
-  const backends = scan.serviceBackends;
-  for (const service of scan.requiredServices) {
-    if (!usesDefaultMiddleware(scan, service, options))
-      continue;
-    if (service === "db" && !provisionEnv.HAI_DB) {
-      const backend = backends.db ?? "postgresql";
-      if (backend === "mysql")
-        planMysqlDb(plan, projectName, secrets.dbPassword, net);
-      else if (backend === "sqlite")
-        addAppDataVolume(plan, projectName);
-      else
-        planPostgresDb(plan, projectName, secrets.dbPassword, net);
-    } else if (service === "cache" && !provisionEnv.HAI_CACHE) {
-      if ((backends.cache ?? "redis") === "redis")
-        planRedisCache(plan, projectName, net);
-    } else if (service === "storage" && !provisionEnv.HAI_STORAGE) {
-      if ((backends.storage ?? "s3") === "s3")
-        planS3Storage(plan, projectName, secrets.storagePassword, net, s3Engine);
-      else
-        addAppDataVolume(plan, projectName);
-    } else if (service === "vecdb" && !provisionEnv.HAI_VECDB) {
-      const backend = backends.vecdb ?? "qdrant";
-      if (backend === "pgvector")
-        planPgvectorVecdb(plan, projectName, secrets.dbPassword, net);
-      else if (backend === "chroma")
-        planChromaVecdb(plan, projectName, net);
-      else if (backend === "lancedb")
-        addAppDataVolume(plan, projectName);
-      else
-        planQdrantVecdb(plan, projectName, net);
-    } else if (service === "ldap" && backends.ldap === "ldap" && !provisionEnv.HAI_IAM_LDAP) {
-      const password = secrets.ldapPassword ?? secrets.dbPassword;
-      plan.services.push("ldap");
-      plan.dependsOn.push("ldap");
-      plan.composeServices.ldap = { image: IMAGES.ldap, restart: "unless-stopped", env_file: [".env.runtime"], networks: net, volumes: [`${projectName}-ldap-data:/var/lib/ldap`, `${projectName}-ldap-config:/etc/ldap/slapd.d`] };
-      plan.volumes[`${projectName}-ldap-data`] = null;
-      plan.volumes[`${projectName}-ldap-config`] = null;
-      Object.assign(plan.env, { LDAP_DOMAIN: "example.org", LDAP_ORGANISATION: "HAI", LDAP_ADMIN_PASSWORD: password, LDAP_TLS: "false", HAI_IAM_LOGIN_LDAP: "true", HAI_IAM_LDAP: JSON.stringify({ url: "ldap://ldap:389", bindDn: "cn=admin,dc=example,dc=org", bindPassword: password, searchBase: "dc=example,dc=org" }) });
-      plan.secrets.push(password);
-    } else if (service === "email" && (scan.middlewares ? scan.middlewares.some((item) => item.service === "email" && item.backend === "smtp" && (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email ?? "default") === "default") : backends.email === "smtp") && !provisionEnv.HAI_REACH_PROVIDERS) {
-      plan.services.push("email");
-      plan.dependsOn.push("email");
-      plan.composeServices.email = { image: IMAGES.smtp, restart: "unless-stopped", networks: net };
-      const requirements = scan.middlewares?.filter((item) => item.service === "email" && item.backend === "smtp" && ["default", void 0].includes(options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email));
-      if (requirements?.length) {
-        for (const requirement of requirements)
-          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
-      } else if (!scan.middlewares) {
-        plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({ name: "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
-      }
-    }
-  }
-  return plan;
-}
-function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv = {}, s3Engine = "rustfs") {
-  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine);
-  const env = {
-    NODE_ENV: "production",
-    HOST: "0.0.0.0",
-    PORT: String(containerPort),
-    HAI_SERV_SERVER_HOST: "0.0.0.0",
-    HAI_SERV_SERVER_PORT: String(containerPort),
-    ...appEnv,
-    ...sidecar.env,
-    ...provisionEnv
-  };
-  return { env, sidecar };
-}
-function generateComposeFile(options) {
-  const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
-  const app = {
-    image: imageRef,
-    labels: { "org.opencontainers.image.version": options.appVersion },
-    container_name: `hai-${projectName}-app`,
-    restart: "unless-stopped",
-    // 镜像已由 load 注入本地，禁止 compose 再从 registry 拉取
-    pull_policy: "never",
-    env_file: [".env.runtime"],
-    ports: [`${hostPort}:${containerPort}`],
-    networks: ["hai-app"]
-  };
-  if (sidecar.appVolumes.length > 0)
-    app.volumes = sidecar.appVolumes;
-  if (sidecar.dependsOn.length > 0)
-    app.depends_on = sidecar.dependsOn;
-  const services = { app, ...sidecar.composeServices };
-  if (options.web) {
-    delete app.ports;
-    services.web = {
-      image: options.web.imageRef,
-      labels: { "org.opencontainers.image.version": options.appVersion },
-      container_name: `hai-${projectName}-web`,
-      restart: "unless-stopped",
-      pull_policy: "never",
-      ports: [`${hostPort}:${options.web.containerPort}`],
-      environment: { PUBLIC_API_BASE: "" },
-      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`], interval: "30s", timeout: "5s", retries: 3 },
-      volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
-      depends_on: ["app"],
-      networks: ["hai-app"]
-    };
-  }
-  if (services["storage-init"])
-    services["storage-init"] = { ...services["storage-init"], image: imageRef };
-  const compose = {
-    "x-hai-version": options.appVersion,
-    services,
-    "networks": {
-      "hai-app": { name: `hai-${projectName}` }
-    }
-  };
-  if (Object.keys(sidecar.volumes).length > 0)
-    compose.volumes = sidecar.volumes;
-  if (services["storage-init"]) {
-    app.depends_on = {
-      ...Object.fromEntries((app.depends_on ?? []).map((name) => [name, { condition: "service_started" }])),
-      "storage-init": { condition: "service_completed_successfully" }
-    };
-  }
-  for (const service of Object.values(services))
-    service.pull_policy = "never";
-  return stringify(compose);
-}
-function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
-  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535))
-    throw new Error("Invalid web proxy target");
-  return `server {
-  listen ${webPort};
-  server_name _;
-  root /usr/share/nginx/html;
-  location / {
-    try_files $uri $uri/ /index.html;
-  }
-  location = /runtime-config.js {
-    add_header Cache-Control "no-store";
-    default_type application/javascript;
-    return 200 'globalThis.__HAI_PUBLIC_CONFIG__={apiBase:globalThis.location.origin+"${apiPrefix}"};';
-  }
-  location = /_hai/web-health {
-    access_log off;
-    return 200 'ok';
-  }
-  location = /health {
-    proxy_pass http://app:${port};
-    proxy_set_header Host $http_host;
-  }
-  location ${apiPrefix.replace(/\/$/, "")}/ {
-    proxy_pass http://app:${port};
-    proxy_http_version 1.1;
-    proxy_set_header Host $http_host;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_buffering off;
-  }
-}
-`;
-}
-function serializeEnvFile(env) {
-  return `${Object.entries(env).map(([key, value]) => {
-    let literal2 = value;
-    if (/[\s#$'"]/.test(value)) {
-      if (value.startsWith("{") || value.startsWith("["))
-        literal2 = `'${value.replaceAll("'", "\\u0027")}'`;
-      else if (!value.includes("'"))
-        literal2 = `'${value}'`;
-      else
-        literal2 = JSON.stringify(value).replaceAll("$", "$$");
-    }
-    return `${key}=${literal2}`;
-  }).join("\n")}
-`;
-}
-var logger4 = core.logger.child({ module: "deploy", scope: "ssh" });
-function buildConnectOptions(config2) {
-  const args = ["-o", "BatchMode=yes"];
-  args.push("-o", `ConnectTimeout=${config2.connectTimeoutSeconds}`);
-  args.push("-o", `StrictHostKeyChecking=${config2.strictHostKeyChecking ? "accept-new" : "no"}`);
-  if (config2.knownHostsFile)
-    args.push("-o", `UserKnownHostsFile=${config2.knownHostsFile}`);
-  if (config2.identityFile) {
-    args.push("-i", config2.identityFile);
-    args.push("-o", "IdentitiesOnly=yes");
-  }
-  return args;
-}
-function buildSshExecArgs(config2, remoteCommand) {
-  return [
-    ...buildConnectOptions(config2),
-    "-p",
-    String(config2.port),
-    `${config2.username}@${config2.host}`,
-    remoteCommand
-  ];
-}
-function buildScpUploadArgs(config2, localPath, remotePath) {
-  return [
-    ...buildConnectOptions(config2),
-    "-P",
-    String(config2.port),
-    localPath,
-    `${config2.username}@${config2.host.includes(":") ? `[${config2.host}]` : config2.host}:${remotePath}`
-  ];
-}
-function createSshExecutor(config2) {
-  const exec = async (remoteCommand, options) => {
-    return runCommand("ssh", buildSshExecArgs(config2, remoteCommand), {
-      timeoutMs: options?.timeoutMs,
-      secrets: options?.secrets,
-      onOutput: options?.onOutput
-    });
-  };
-  const upload = async (localPath, remotePath) => {
-    const args = buildScpUploadArgs(config2, localPath, remotePath);
-    const result = await runCommand("scp", args, {});
-    if (!result.success) {
-      return err(
-        HaiDeployError.IMAGE_TRANSFER_FAILED,
-        deployM("deploy_imageTransferFailed", { params: { error: result.error.message } }),
-        result.error
-      );
-    }
-    return ok(void 0);
-  };
-  const ping = async () => {
-    logger4.debug("SSH preflight", { host: config2.host, port: config2.port });
-    const result = await exec("true", { timeoutMs: 2e4 });
-    if (!result.success) {
-      return err(
-        HaiDeployError.REMOTE_CONNECT_FAILED,
-        deployM("deploy_remoteConnectFailed", { params: { host: config2.host, error: result.error.message } }),
-        result.error
-      );
-    }
-    return ok(void 0);
-  };
-  return { exec, upload, ping };
-}
-
-// ../deploy/src/providers/deploy-provider-docker-ssh.ts
-var logger5 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
-var HEALTH_POLL_INTERVAL = 3e3;
-var HEALTH_MAX_ATTEMPTS = 40;
-function makeDeploymentId() {
-  const now = /* @__PURE__ */ new Date();
-  const pad = (n) => String(n).padStart(2, "0");
-  const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
-  return `${stamp}-${randomBytes(3).toString("hex")}`;
-}
-function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
-}
-function createDockerSshProvider(config2, container) {
-  const ssh = config2.ssh ? createSshExecutor(config2.ssh) : void 0;
-  const baseDir = config2.remote.baseDir;
-  async function detectRemoteRuntime() {
-    if (!ssh)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
-    const candidates = config2.remote.runtime === "auto" ? ["podman", "docker"] : [config2.remote.runtime];
-    for (const runtime of candidates) {
-      const versionResult = await ssh.exec(`${runtime} version`, { timeoutMs: 2e4 });
-      if (!versionResult.success)
-        continue;
-      const composeResult = await ssh.exec(`${runtime} compose version`, { timeoutMs: 2e4 });
-      if (composeResult.success) {
-        logger5.info("Remote container runtime detected", { runtime });
-        return ok(runtime);
-      }
-    }
-    return err(
-      HaiDeployError.REMOTE_COMMAND_FAILED,
-      deployM("deploy_remoteRuntimeMissing", { params: { runtime: candidates.join(" / ") } })
-    );
-  }
-  async function healthCheck(url2) {
-    for (let attempt = 0; attempt < HEALTH_MAX_ATTEMPTS; attempt++) {
-      try {
-        const response = await fetch(url2, { signal: AbortSignal.timeout(5e3) });
-        if (response.ok)
-          return true;
-      } catch {
-      }
-      await sleep(HEALTH_POLL_INTERVAL);
-    }
-    return false;
-  }
-  const deploy2 = async (context) => {
-    const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
-    const deploymentId = makeDeploymentId();
-    const hostPort = config2.expose.hostPort;
-    const artifactDir = join(appDir, ".hai", "deploy", options?.environment ?? "prod");
-    mkdirSync(artifactDir, { recursive: true, mode: 448 });
-    chmodSync(artifactDir, 448);
-    const artifact = context.artifact;
-    const resolvedBuildDir = context.artifactDir;
-    const images = artifact.images;
-    const web = images.find((image) => image.name === "web");
-    const app = images.find((image) => image.name === "app");
-    if (options?.selectedServices) {
-      const available = [...images.map((image) => image.name), ...scan.requiredServices];
-      const invalid = options.selectedServices.find((name) => !available.includes(name));
-      if (!options.selectedServices.length || new Set(options.selectedServices).size !== options.selectedServices.length || invalid)
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: invalid ?? options.selectedServices.join(", ") } }));
-    }
-    const hasWeb = artifact.hasWeb || !!web;
-    const partial2 = artifact.partial || options?.selectedServices !== void 0;
-    const containerPort = app?.containerPort ?? artifact.appContainerPort ?? config2.expose.containerPort;
-    const webContainerPort = web?.containerPort ?? artifact.webContainerPort ?? 8080;
-    const host = config2.ssh?.host;
-    const url2 = host ? `http://${host.includes(":") ? `[${host}]` : host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
-    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
-    if (sidecar.composeServices["storage-init"] && !app && options?.selectedServices?.includes("storage"))
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageArtifactRequired"));
-    let webProxy;
-    if (hasWeb) {
-      const server = loadDeploymentConfig("serv", join(appDir, "config", "_serv.yml"), env);
-      if (!server.success)
-        return server;
-      const http = server.data.http;
-      const cors = server.data.cors;
-      const apiPrefix = http?.apiPrefix ?? "/api/v1";
-      if (typeof apiPrefix !== "string" || !/^\/[\w/-]+$/.test(apiPrefix))
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
-      webProxy = generateWebProxyConfig(containerPort, apiPrefix, webContainerPort);
-      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && config2.ssh ? url2 : cors?.origin ?? "*" } });
-    }
-    const envPath = join(artifactDir, ".env.runtime");
-    writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
-    if (options?.environment) {
-      const environment = loadDeploymentEnvironment({ environment: options.environment, envDir: options.envDir ?? scan.envDir ?? appDir });
-      if (!environment.success)
-        return environment;
-      const saved = saveDeploymentEnvironment(environment.data, { HAI_DEPLOY_ENVIRONMENT: environment.data.environment, HAI_CORE_ENV: environment.data.values.HAI_CORE_ENV, ...sidecar.env, ...provisionEnv });
-      if (!saved.success)
-        return saved;
-    }
-    const composeName = `docker-compose-${artifact.appVersion}.yml`;
-    const composeContent = generateComposeFile({
-      projectName,
-      appVersion: artifact.appVersion,
-      imageRef: app?.imageRef ?? "localhost/hai-unselected:0",
-      hostPort,
-      containerPort,
-      sidecar,
-      web: hasWeb ? { imageRef: web?.imageRef ?? "localhost/hai-unselected:0", containerPort: webContainerPort } : void 0
-    });
-    const composePath = join(artifactDir, composeName);
-    writeFileSync(composePath, composeContent);
-    if (webProxy)
-      writeFileSync(join(artifactDir, "web.conf"), webProxy);
-    const selected = options?.selectedServices ? [...options.selectedServices] : artifact.partial ? images.map((image) => image.name) : [...images.map((image) => image.name), ...Object.keys(sidecar.composeServices)];
-    if (!selected.length || selected.some((name) => !/^[a-z][a-z0-9-]*$/.test(name)) || new Set(selected).size !== selected.length)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: selected.join(", ") } }));
-    for (const name of selected) {
-      if (["app", "web"].includes(name) && !images.some((image) => image.name === name))
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: name } }));
-    }
-    if (selected.includes("storage") && sidecar.composeServices["storage-init"] && !selected.includes("storage-init"))
-      selected.push("storage-init");
-    options?.onProgress?.("packaging");
-    const bundle = await createDeploymentBundle({
-      directory: artifactDir,
-      artifactDir: resolvedBuildDir,
-      artifact,
-      projectName,
-      environment: options?.environment ?? "prod",
-      deploymentId,
-      config: config2,
-      runtime: options?.runtime ?? "auto",
-      selected,
-      partial: partial2,
-      hasWeb,
-      containerPort,
-      middlewareEnv: serializeEnvFile(sidecar.env),
-      healthPaths: hasWeb ? ["/health", "/_hai/web-health", "/"] : [scan.isSvelteKit ? "/" : "/health"],
-      output: options?.output ?? join(artifactDir, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar`)
-    });
-    if (options?.bundleOnly)
-      return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet: Object.keys(env), ...bundle });
-    if (!ssh)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
-    const ping = await ssh.ping();
-    if (!ping.success)
-      return ping;
-    const remoteRuntime = await detectRemoteRuntime();
-    if (!remoteRuntime.success)
-      return remoteRuntime;
-    const remoteDir = `${baseDir}/${projectName}`;
-    const remoteTar = `${remoteDir}/incoming/${basename(bundle.bundlePath)}`;
-    const prepared = await ssh.exec(`mkdir -p -- ${shellArgument(`${remoteDir}/incoming`)} && chmod 700 -- ${shellArgument(remoteDir)} ${shellArgument(`${remoteDir}/incoming`)}`);
-    if (!prepared.success)
-      return prepared;
-    const uploaded = await ssh.upload(bundle.bundlePath, remoteTar);
-    if (!uploaded.success)
-      return uploaded;
-    let pendingOutput = "";
-    const started = await ssh.exec(
-      `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)}`,
-      { timeoutMs: 6e5, secrets: sidecar.secrets, onOutput: (output2) => {
-        pendingOutput += output2;
-        const lines = pendingOutput.split("\n");
-        pendingOutput = lines.pop() ?? "";
-        for (const line of lines) {
-          const stage = /^\[(preflight|images|dependencies|start|health|complete)\]/.exec(line)?.[1];
-          if (stage)
-            options?.onProgress?.(stage);
-        }
-      } }
-    );
-    if (!started.success)
-      return started;
-    logger5.info("Running health check", { url: url2 });
-    const healthy = await healthCheck(`${url2}${!hasWeb && scan.isSvelteKit ? "/" : "/health"}`) && (!hasWeb || await healthCheck(`${url2}/_hai/web-health`) && await healthCheck(`${url2}/`));
-    if (!healthy) {
-      return err(
-        HaiDeployError.HEALTH_CHECK_FAILED,
-        deployM("deploy_healthCheckFailed", { params: { url: url2 } })
-      );
-    }
-    const result = {
-      url: url2,
-      deploymentId,
-      status: "ready",
-      provider: "docker-ssh",
-      healthCheck: "passed",
-      envVarsSet: Object.keys(env),
-      bundlePath: bundle.bundlePath
-    };
-    logger5.info("docker-ssh deployment complete", { url: url2, deploymentId });
-    return ok(result);
-  };
-  const deploySafely = async (context) => {
-    try {
-      return await deploy2(context);
-    } catch (error62) {
-      logger5.error("Deployment bundle failed", { error: error62 });
-      const reason = error62 instanceof Error ? error62.message : String(error62);
-      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", { params: { reason: maskSecrets(reason, Object.values(context.appEnv ?? {}).filter((value) => value.length > 6)) } }), error62);
-    }
-  };
-  return { name: "docker-ssh", deploy: deploySafely };
-}
-var logger6 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
-var VERCEL_API = "https://api.vercel.com";
-var POLL_INTERVAL = 3e3;
-var MAX_POLL_ATTEMPTS = 60;
-var VercelApiError = class extends Error {
-  constructor(status) {
-    super(deployM("deploy_apiError", { params: { service: "Vercel", status: String(status) } }));
-    this.status = status;
-  }
-  status;
-};
-function toDeployError(codeDef, messageKey, error62) {
-  return {
-    ...codeDef,
-    message: deployM(messageKey, {
-      params: { error: error62 instanceof Error ? error62.message : String(error62) }
-    }),
-    cause: error62
-  };
-}
-async function vercelFetch(token, path, options) {
-  const url2 = `${VERCEL_API}${path}`;
-  const response = await fetch(url2, {
-    ...options,
-    headers: {
-      "Authorization": `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-  if (!response.ok) {
-    throw new VercelApiError(response.status);
-  }
-  return response.json();
-}
-function collectFiles(dir, baseDir) {
-  const results = [];
-  const entries = readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...collectFiles(fullPath, baseDir));
-    } else {
-      results.push(relative(baseDir, fullPath).split(sep).join("/"));
-    }
-  }
-  return results;
-}
-function createVercelProvider() {
-  let token = null;
-  return {
-    name: "vercel",
-    async authenticate(apiToken) {
-      logger6.debug("Authenticating with Vercel");
-      try {
-        const user = await vercelFetch(
-          apiToken,
-          "/v2/user"
-        );
-        token = apiToken;
-        const username = user.user.username || user.user.email;
-        logger6.info("Vercel authenticated", { user: username });
-        return ok(username);
-      } catch (error62) {
-        logger6.error("Vercel authentication failed", { error: error62 });
-        return err(toDeployError(HaiDeployError.AUTH_FAILED, "deploy_authFailed", error62));
-      }
-    },
-    async createProject(projectName) {
-      if (!token) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger6.debug("Creating Vercel project", { projectName });
-      try {
-        const existingId = await findExistingProject(token, projectName);
-        if (existingId !== null) {
-          logger6.info("Vercel project found", { projectName, projectId: existingId });
-          return ok(existingId);
-        }
-        try {
-          const project = await vercelFetch(
-            token,
-            "/v11/projects",
-            {
-              method: "POST",
-              body: JSON.stringify({
-                name: projectName,
-                framework: "sveltekit"
-              })
-            }
-          );
-          logger6.info("Vercel project created", { projectName, projectId: project.id });
-          return ok(project.id);
-        } catch (error62) {
-          if (error62 instanceof VercelApiError && error62.status === 409) {
-            const concurrentProjectId = await findExistingProject(token, projectName);
-            if (concurrentProjectId !== null) {
-              logger6.info("Vercel project reused after create conflict", {
-                projectName,
-                projectId: concurrentProjectId
-              });
-              return ok(concurrentProjectId);
-            }
-          }
-          throw error62;
-        }
-      } catch (error62) {
-        logger6.error("Vercel project creation failed", { projectName, error: error62 });
-        return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error62));
-      }
-    },
-    async setEnvVars(projectId, envVars) {
-      if (!token) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger6.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
-      try {
-        const envEntries = Object.entries(envVars).map(([key, value]) => ({
-          key,
-          value,
-          type: "encrypted",
-          target: ["production", "preview", "development"]
-        }));
-        await vercelFetch(
-          token,
-          `/v10/projects/${projectId}/env?upsert=true`,
-          {
-            method: "POST",
-            body: JSON.stringify(envEntries)
-          }
-        );
-        logger6.info("Vercel env vars set", { projectId, count: envEntries.length });
-        return ok(void 0);
-      } catch (error62) {
-        logger6.error("Vercel env vars setup failed", { projectId, error: error62 });
-        return err(toDeployError(HaiDeployError.ENV_VAR_FAILED, "deploy_envVarFailed", error62));
-      }
-    },
-    async deploy(projectId, outputDir) {
-      if (!token) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger6.debug("Deploying to Vercel", { projectId, outputDir });
-      try {
-        const outputConfig = JSON.parse(readFileSync(join(outputDir, "config.json"), "utf8"));
-        if (outputConfig.version !== 3)
-          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
-        const filePaths = collectFiles(outputDir, outputDir);
-        const files = [];
-        for (const filePath of filePaths) {
-          const fullPath = join(outputDir, filePath);
-          const content = readFileSync(fullPath);
-          const sha = createHash("sha1").update(content).digest("hex");
-          const size = statSync(fullPath).size;
-          await uploadFile(token, content, sha);
-          files.push({ file: `.vercel/output/${filePath}`, sha, size });
-        }
-        logger6.debug("Files uploaded", { count: files.length });
-        const deployment = await vercelFetch(
-          token,
-          "/v13/deployments?prebuilt=1",
-          {
-            method: "POST",
-            body: JSON.stringify({
-              name: projectId,
-              files,
-              version: 2,
-              project: projectId,
-              projectSettings: { framework: null, buildCommand: "", installCommand: "" }
-            })
-          }
-        );
-        const finalStatus = await pollDeploymentStatus(token, deployment.id);
-        const result = {
-          url: `https://${deployment.url}`,
-          deploymentId: deployment.id,
-          status: finalStatus,
-          envVarsSet: []
-        };
-        logger6.info("Vercel deployment complete", {
-          deploymentId: deployment.id,
-          url: result.url,
-          status: finalStatus
-        });
-        return ok(result);
-      } catch (error62) {
-        logger6.error("Vercel deployment failed", { projectId, error: error62 });
-        return err(toDeployError(HaiDeployError.UPLOAD_FAILED, "deploy_uploadFailed", error62));
-      }
-    }
-  };
-}
-async function findExistingProject(token, projectName) {
-  try {
-    const project = await vercelFetch(token, `/v10/projects/${projectName}`);
-    return project.id;
-  } catch (error62) {
-    if (error62 instanceof VercelApiError && error62.status === 404) {
-      return null;
-    }
-    throw error62;
-  }
-}
-async function uploadFile(token, content, sha) {
-  const url2 = `${VERCEL_API}/v2/files`;
-  const uploadContent = new Uint8Array(content);
-  const response = await fetch(url2, {
-    method: "POST",
-    headers: {
-      "Authorization": `Bearer ${token}`,
-      "Content-Type": "application/octet-stream",
-      "x-vercel-digest": sha
-    },
-    body: new Blob([uploadContent])
-  });
-  if (!response.ok && response.status !== 409) {
-    throw new Error(deployM("deploy_fileUploadFailed", { params: { status: String(response.status) } }));
-  }
-}
-async function pollDeploymentStatus(token, deploymentId) {
-  for (let i = 0; i < MAX_POLL_ATTEMPTS; i++) {
-    const deployment = await vercelFetch(
-      token,
-      `/v13/deployments/${deploymentId}`
-    );
-    if (deployment.readyState === "READY") {
-      return "ready";
-    }
-    if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
-      return "error";
-    }
-    await new Promise((resolve6) => setTimeout(resolve6, POLL_INTERVAL));
-  }
-  return "building";
-}
-var logger7 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
-function createAliyunProvisioner() {
-  let accessKey = null;
-  let secretKey = null;
-  let signName = "";
-  return {
-    name: "aliyun",
-    serviceType: "sms",
-    async authenticate(credentials) {
-      logger7.debug("Authenticating with Aliyun");
-      try {
-        const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
-        const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
-        if (!akId || !akSecret || !credentials.signName) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "accessKeyId, accessKeySecret, signName" } }));
-        }
-        accessKey = akId;
-        secretKey = akSecret;
-        signName = credentials.signName;
-        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
-        return ok(akId);
-      } catch (error62) {
-        logger7.error("Aliyun authentication failed", { error: error62 });
-        return err(
-          HaiDeployError.AUTH_FAILED,
-          deployM("deploy_authFailed", {
-            params: { error: error62 instanceof Error ? error62.message : String(error62) }
-          }),
-          error62
-        );
-      }
-    },
-    async provision(_appName) {
-      if (!accessKey || !secretKey) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger7.debug("Provisioning Aliyun SMS service");
-      return ok({
-        serviceType: "sms",
-        provisionerName: "aliyun",
-        resourceStatus: "reused",
-        envVars: {
-          HAI_REACH_PROVIDERS: JSON.stringify([{ name: "sms", type: "aliyun-sms", accessKeyId: accessKey, accessKeySecret: secretKey, signName }])
-        },
-        resourceInfo: "aliyun:verify-only"
-      });
-    }
-  };
-}
-var logger8 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
-var NEON_API = "https://console.neon.tech/api/v2";
-var DEFAULT_NEON_DATABASE_NAME = "neondb";
-var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
-async function neonFetch(token, path, options) {
-  const response = await fetch(`${NEON_API}${path}`, {
-    ...options,
-    headers: {
-      "Accept": "application/json",
-      "Authorization": `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-  if (!response.ok) {
-    throw new Error(deployM("deploy_apiError", { params: { service: "Neon", status: String(response.status) } }));
-  }
-  return response.json();
-}
-async function listNeonProjects(token) {
-  const data = await neonFetch(token, "/projects");
-  return data.projects ?? [];
-}
-async function findExistingNeonProject(token, projectName) {
-  const projects = await listNeonProjects(token);
-  return projects.find((project) => project.name === projectName) ?? null;
-}
-async function getNeonConnectionUri(token, projectId) {
-  const query = new URLSearchParams({
-    database_name: DEFAULT_NEON_DATABASE_NAME,
-    role_name: DEFAULT_NEON_ROLE_NAME
-  });
-  const data = await neonFetch(
-    token,
-    `/projects/${projectId}/connection_uri?${query.toString()}`,
-    { headers: { "Content-Type": "application/json" } }
-  );
-  if (!data.uri) {
-    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
-  }
-  return data.uri;
-}
-function buildNeonProvisionResult(projectId, connectionUri, resourceStatus) {
-  return {
-    serviceType: "db",
-    provisionerName: "neon",
-    resourceStatus,
-    envVars: {
-      HAI_DB: JSON.stringify({ type: "postgresql", url: connectionUri, database: decodeURIComponent(new URL(connectionUri).pathname.slice(1)) })
-    },
-    resourceInfo: `neon-project:${projectId}`
-  };
-}
-function createNeonProvisioner() {
-  let token = null;
-  return {
-    name: "neon",
-    serviceType: "db",
-    async authenticate(credentials) {
-      logger8.debug("Authenticating with Neon");
-      try {
-        const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
-        if (!apiToken) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "token" } }));
-        }
-        await listNeonProjects(apiToken);
-        token = apiToken;
-        logger8.info("Neon authenticated");
-        return ok("neon-user");
-      } catch (error62) {
-        logger8.error("Neon authentication failed", { error: error62 });
-        return err(
-          HaiDeployError.AUTH_FAILED,
-          deployM("deploy_authFailed", {
-            params: { error: error62 instanceof Error ? error62.message : String(error62) }
-          }),
-          error62
-        );
-      }
-    },
-    async provision(appName) {
-      if (!token) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger8.debug("Provisioning Neon database", { appName });
-      let resource;
-      try {
-        const projectName = `${appName}-db`;
-        const existingProject = await findExistingNeonProject(token, projectName);
-        if (existingProject !== null) {
-          resource = { resourceInfo: `neon-project:${existingProject.id}`, resourceStatus: "reused" };
-          const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
-          logger8.info("Neon project reused", {
-            projectId: existingProject.id,
-            projectName
-          });
-          return ok(buildNeonProvisionResult(existingProject.id, connectionUri2, "reused"));
-        }
-        const data = await neonFetch(token, "/projects", {
-          method: "POST",
-          body: JSON.stringify({
-            project: {
-              name: projectName,
-              pg_version: 16
-            }
-          })
-        });
-        const projectId = data.project?.id ?? "";
-        if (projectId)
-          resource = { resourceInfo: `neon-project:${projectId}`, resourceStatus: "created" };
-        const connectionUri = data.connection_uris?.[0]?.connection_uri ?? "";
-        if (!projectId || !connectionUri) {
-          throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
-        }
-        logger8.info("Neon database provisioned", { projectId });
-        return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
-      } catch (error62) {
-        logger8.error("Neon provisioning failed", { appName });
-        if (resource) {
-          return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
-            projectName: appName,
-            stage: "provision:db",
-            resources: [{ serviceType: "db", provisionerName: "neon", ...resource }]
-          });
-        }
-        return err(
-          HaiDeployError.PROVISION_FAILED,
-          deployM("deploy_provisionFailed", {
-            params: {
-              service: "neon",
-              error: error62 instanceof Error ? error62.message : String(error62)
-            }
-          }),
-          error62
-        );
-      }
-    }
-  };
-}
-var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
-var CF_API = "https://api.cloudflare.com/client/v4";
-function createR2Provisioner() {
-  let token = null;
-  let accountId = null;
-  let accessKey = "";
-  let secretKey = "";
-  return {
-    name: "r2",
-    serviceType: "storage",
-    async authenticate(credentials) {
-      logger9.debug("Authenticating with Cloudflare");
-      try {
-        const acctId = credentials.accountId ?? credentials.account_id ?? "";
-        const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
-        if (!acctId || !apiTok || !credentials.accessKeyId || !credentials.secretAccessKey) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "accountId, apiToken, accessKeyId, secretAccessKey" } }));
-        }
-        const res = await fetch(`${CF_API}/accounts/${acctId}/r2/buckets`, {
-          headers: { Authorization: `Bearer ${apiTok}` }
-        });
-        if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(res.status) } }));
-        }
-        accountId = acctId;
-        token = apiTok;
-        accessKey = credentials.accessKeyId;
-        secretKey = credentials.secretAccessKey;
-        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
-        return ok(acctId);
-      } catch (error62) {
-        logger9.error("Cloudflare R2 authentication failed", { error: error62 });
-        return err(
-          HaiDeployError.AUTH_FAILED,
-          deployM("deploy_authFailed", {
-            params: { error: error62 instanceof Error ? error62.message : String(error62) }
-          }),
-          error62
-        );
-      }
-    },
-    async provision(appName) {
-      if (!token || !accountId) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      const bucketName = `${appName}-storage`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      logger9.debug("Provisioning R2 bucket", { appName, bucketName });
-      try {
-        const createRes = await fetch(
-          `${CF_API}/accounts/${accountId}/r2/buckets`,
-          {
-            method: "POST",
-            headers: {
-              "Authorization": `Bearer ${token}`,
-              "Content-Type": "application/json"
-            },
-            body: JSON.stringify({ name: bucketName })
-          }
-        );
-        if (!createRes.ok && createRes.status !== 409) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
-        }
-        logger9.info("R2 bucket provisioned", { bucketName });
-        return ok({
-          serviceType: "storage",
-          provisionerName: "r2",
-          resourceStatus: createRes.status === 409 ? "reused" : "created",
-          envVars: {
-            HAI_STORAGE: JSON.stringify({
-              type: "s3",
-              endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
-              bucket: bucketName,
-              region: "auto",
-              accessKeyId: accessKey,
-              secretAccessKey: secretKey
-            })
-          },
-          resourceInfo: `r2-bucket:${bucketName}`
-        });
-      } catch (error62) {
-        logger9.error("R2 provisioning failed", { appName, error: error62 });
-        return err(
-          HaiDeployError.PROVISION_FAILED,
-          deployM("deploy_provisionFailed", {
-            params: {
-              service: "r2",
-              error: error62 instanceof Error ? error62.message : String(error62)
-            }
-          }),
-          error62
-        );
-      }
-    }
-  };
-}
-var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
-var RESEND_API = "https://api.resend.com";
-function createResendProvisioner() {
-  let token = null;
-  let from = "";
-  return {
-    name: "resend",
-    serviceType: "email",
-    async authenticate(credentials) {
-      logger10.debug("Authenticating with Resend");
-      try {
-        const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
-        if (!apiToken || !credentials.from) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "apiKey, from" } }));
-        }
-        const res = await fetch(`${RESEND_API}/domains`, {
-          headers: { Authorization: `Bearer ${apiToken}` }
-        });
-        if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Resend", status: String(res.status) } }));
-        }
-        token = apiToken;
-        from = credentials.from;
-        logger10.info("Resend authenticated");
-        return ok("resend-user");
-      } catch (error62) {
-        logger10.error("Resend authentication failed", { error: error62 });
-        return err(
-          HaiDeployError.AUTH_FAILED,
-          deployM("deploy_authFailed", {
-            params: { error: error62 instanceof Error ? error62.message : String(error62) }
-          }),
-          error62
-        );
-      }
-    },
-    async provision(_appName) {
-      if (!token) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger10.debug("Provisioning Resend email service");
-      return ok({
-        serviceType: "email",
-        provisionerName: "resend",
-        resourceStatus: "reused",
-        envVars: {
-          HAI_REACH_PROVIDERS: JSON.stringify([{ name: "email", type: "smtp", host: "smtp.resend.com", port: 465, secure: true, user: "resend", pass: token, from }])
-        },
-        resourceInfo: "resend:verify-only"
-      });
-    }
-  };
-}
-var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
-var UPSTASH_API = "https://api.upstash.com";
-function createUpstashAuthHeader(email3, apiKey) {
-  return `Basic ${Buffer.from(`${email3}:${apiKey}`).toString("base64")}`;
-}
-async function upstashFetch(email3, apiKey, path, options) {
-  const response = await fetch(`${UPSTASH_API}${path}`, {
-    ...options,
-    headers: {
-      "Authorization": createUpstashAuthHeader(email3, apiKey),
-      "Content-Type": "application/json",
-      ...options?.headers
-    }
-  });
-  if (!response.ok) {
-    throw new Error(deployM("deploy_apiError", { params: { service: "Upstash", status: String(response.status) } }));
-  }
-  return response.json();
-}
-async function listUpstashDatabases(email3, apiKey) {
-  return upstashFetch(email3, apiKey, "/v2/redis/databases");
-}
-async function findExistingUpstashDatabase(email3, apiKey, databaseName) {
-  const databases = await listUpstashDatabases(email3, apiKey);
-  return databases.find((database) => database.database_name === databaseName) ?? null;
-}
-async function getUpstashDatabase(email3, apiKey, databaseId) {
-  return upstashFetch(email3, apiKey, `/v2/redis/database/${databaseId}`);
-}
-function buildUpstashProvisionResult(database, resourceStatus) {
-  const databaseId = database.database_id ?? "";
-  if (!databaseId || !database.endpoint || !database.password || !database.port) {
-    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
-  }
-  return {
-    serviceType: "cache",
-    provisionerName: "upstash",
-    resourceStatus,
-    envVars: {
-      HAI_CACHE: JSON.stringify({ type: "redis", url: `rediss://default:${encodeURIComponent(database.password)}@${database.endpoint}:${database.port}` })
-    },
-    resourceInfo: `upstash-db:${databaseId}`
-  };
-}
-function createUpstashProvisioner() {
-  let apiKey = null;
-  let email3 = null;
-  return {
-    name: "upstash",
-    serviceType: "cache",
-    async authenticate(credentials) {
-      logger11.debug("Authenticating with Upstash");
-      try {
-        const userEmail = credentials.email ?? "";
-        const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
-        if (!userEmail || !userKey) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "email, api_key" } }));
-        }
-        await listUpstashDatabases(userEmail, userKey);
-        email3 = userEmail;
-        apiKey = userKey;
-        logger11.info("Upstash authenticated", { email: userEmail });
-        return ok(userEmail);
-      } catch (error62) {
-        logger11.error("Upstash authentication failed", { error: error62 });
-        return err(
-          HaiDeployError.AUTH_FAILED,
-          deployM("deploy_authFailed", {
-            params: { error: error62 instanceof Error ? error62.message : String(error62) }
-          }),
-          error62
-        );
-      }
-    },
-    async provision(appName) {
-      if (!apiKey || !email3) {
-        return err(
-          HaiDeployError.AUTH_REQUIRED,
-          deployM("deploy_authRequired")
-        );
-      }
-      logger11.debug("Provisioning Upstash Redis", { appName });
-      let resource;
-      try {
-        const databaseName = `${appName}-cache`;
-        const existingDatabase = await findExistingUpstashDatabase(email3, apiKey, databaseName);
-        if (existingDatabase !== null) {
-          const databaseId = existingDatabase.database_id ?? "";
-          if (!databaseId) {
-            throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
-          }
-          resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
-          const detail = await getUpstashDatabase(email3, apiKey, databaseId);
-          logger11.info("Upstash Redis reused", { databaseId, databaseName });
-          return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
-        }
-        const data = await upstashFetch(email3, apiKey, "/v2/redis/database", {
-          method: "POST",
-          body: JSON.stringify({
-            name: databaseName,
-            region: "global",
-            tls: true
-          })
-        });
-        if (data.database_id)
-          resource = { resourceInfo: `upstash-db:${data.database_id}`, resourceStatus: "created" };
-        logger11.info("Upstash Redis provisioned", { databaseId: data.database_id });
-        return ok(buildUpstashProvisionResult(data, "created"));
-      } catch (error62) {
-        logger11.error("Upstash provisioning failed", { appName });
-        if (resource) {
-          return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
-            projectName: appName,
-            stage: "provision:cache",
-            resources: [{ serviceType: "cache", provisionerName: "upstash", ...resource }]
-          });
-        }
-        return err(
-          HaiDeployError.PROVISION_FAILED,
-          deployM("deploy_provisionFailed", {
-            params: {
-              service: "upstash",
-              error: error62 instanceof Error ? error62.message : String(error62)
-            }
-          }),
-          error62
-        );
-      }
-    }
-  };
-}
-
-// ../deploy/src/deploy-main.ts
-var logger12 = core.logger.child({ module: "deploy", scope: "main" });
-var currentConfig = null;
-var currentProvider = null;
-var currentContainerProvider = null;
-var currentProvisioners = /* @__PURE__ */ new Map();
-var initInProgress = false;
-var notInitialized = core.module.createNotInitializedKit(
-  HaiDeployError.NOT_INITIALIZED,
-  () => deployM("deploy_notInitialized")
-);
-function createProviderByType(type) {
-  switch (type) {
-    case "vercel":
-      return createVercelProvider();
-    default:
-      throw new Error(deployM("deploy_unsupportedProviderType", { params: { type } }));
-  }
-}
-function createProvisionerByName(provisioner) {
-  switch (provisioner) {
-    case "neon":
-      return createNeonProvisioner();
-    case "upstash":
-      return createUpstashProvisioner();
-    case "cloudflare-r2":
-      return createR2Provisioner();
-    case "resend":
-      return createResendProvisioner();
-    case "aliyun":
-      return createAliyunProvisioner();
-    default:
-      throw new Error(deployM("deploy_unsupportedProvisionerType", { params: { type: provisioner } }));
-  }
-}
-function extractCredentials(serviceConfig) {
-  const result = {};
-  for (const [key, value] of Object.entries(serviceConfig)) {
-    if (key !== "provisioner" && typeof value === "string") {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-var deployCredentials = {
-  getPath: () => getCredentialsPath(),
-  load: () => loadCredentials(),
-  save: (key, value) => saveCredential(key, value),
-  saveAll: (entries) => saveCredentials(entries)
-};
-function normalizeProjectName(name) {
-  const normalized = name.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
-  return normalized || "app";
-}
-function mergeProvisionEnv(results, scan, options) {
-  let env = {};
-  const reachRequirements = scan?.middlewares?.filter((item) => item.configName === "reach") ?? [];
-  const reachProviders = reachRequirements.map((item) => item.config);
-  let hasReachOutput = false;
-  for (const prov of results) {
-    if (prov.envVars.HAI_REACH_PROVIDERS) {
-      hasReachOutput = true;
-      const supplied = JSON.parse(prov.envVars.HAI_REACH_PROVIDERS);
-      for (const provider of supplied) {
-        const targets = reachRequirements.filter((item) => {
-          const mode = options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[item.service];
-          return item.service === prov.serviceType && (!mode || mode === "default");
-        });
-        if (targets.length) {
-          for (const target of targets)
-            reachProviders[reachRequirements.indexOf(target)] = { ...provider, name: target.config.name ?? provider.name };
-        } else {
-          reachProviders.push(provider);
-        }
-      }
-    }
-    env = { ...env, ...prov.envVars };
-  }
-  if (hasReachOutput)
-    env.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
-  return env;
-}
-var deploy = {
-  credentials: deployCredentials,
-  async init(config2) {
-    if (initInProgress) {
-      logger12.warn("Deploy init already in progress, skipping concurrent call");
-      return err(
-        HaiDeployError.CONFIG_ERROR,
-        deployM("deploy_configError", { params: { error: "init already in progress" } })
-      );
-    }
-    initInProgress = true;
-    try {
-      if (currentProvider || currentContainerProvider) {
-        logger12.warn("Deploy module is already initialized, reinitializing");
-        await deploy.close();
-      }
-      logger12.info("Initializing deploy module");
-      const parseResult = DeployConfigSchema.safeParse(config2);
-      if (!parseResult.success) {
-        logger12.error("Deploy config validation failed", { error: parseResult.error.message });
-        return err(
-          HaiDeployError.CONFIG_ERROR,
-          deployM("deploy_configError", { params: { error: parseResult.error.message } }),
-          parseResult.error
-        );
-      }
-      const parsed = parseResult.data;
-      try {
-        let provider = null;
-        let containerProvider = null;
-        if (parsed.provider.type === "docker-ssh") {
-          containerProvider = createDockerSshProvider(parsed.provider, parsed.container);
-          logger12.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh?.host });
-        } else {
-          provider = createProviderByType(parsed.provider.type);
-          const authResult = await provider.authenticate(parsed.provider.token);
-          if (!authResult.success) {
-            return err(authResult.error);
-          }
-          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
-        }
-        currentProvisioners.clear();
-        if (parsed.services) {
-          const serviceEntries = Object.entries(parsed.services);
-          for (const [serviceType, serviceConfig] of serviceEntries) {
-            if (!serviceConfig)
-              continue;
-            const provisioner = createProvisionerByName(serviceConfig.provisioner);
-            const credentials = extractCredentials(serviceConfig);
-            const provAuthResult = await provisioner.authenticate(credentials);
-            if (!provAuthResult.success) {
-              logger12.error("Provisioner authentication failed", {
-                service: serviceType,
-                provisioner: serviceConfig.provisioner
-              });
-              currentProvisioners.clear();
-              return err(provAuthResult.error);
-            }
-            logger12.info("Provisioner authenticated", {
-              service: serviceType,
-              user: provAuthResult.data
-            });
-            currentProvisioners.set(serviceType, provisioner);
-          }
-        }
-        currentProvider = provider;
-        currentContainerProvider = containerProvider;
-        currentConfig = parsed;
-        logger12.info("Deploy module initialized", {
-          provider: parsed.provider.type,
-          provisioners: [...currentProvisioners.keys()]
-        });
-        return ok(void 0);
-      } catch (error62) {
-        currentProvider = null;
-        currentContainerProvider = null;
-        currentConfig = null;
-        currentProvisioners.clear();
-        logger12.error("Deploy module initialization failed", { error: error62 });
-        return err(
-          HaiDeployError.CONFIG_ERROR,
-          deployM("deploy_configError", {
-            params: { error: error62 instanceof Error ? error62.message : String(error62) }
-          }),
-          error62
-        );
-      }
-    } finally {
-      initInProgress = false;
-    }
-  },
-  async close() {
-    if (!currentProvider && !currentContainerProvider) {
-      logger12.info("Deploy module already closed, skipping");
-      return;
-    }
-    logger12.info("Closing deploy module");
-    currentProvider = null;
-    currentContainerProvider = null;
-    currentConfig = null;
-    currentProvisioners.clear();
-    logger12.info("Deploy module closed");
-  },
-  get config() {
-    return currentConfig;
-  },
-  get isInitialized() {
-    return currentProvider !== null || currentContainerProvider !== null;
-  },
-  async scan(appDir, options) {
-    logger12.debug("Scanning application", { appDir });
-    return scanApp(appDir, options);
-  },
-  async provisionAll(projectName, services) {
-    if (!currentProvider && !currentContainerProvider) {
-      return notInitialized.result();
-    }
-    logger12.info("Provisioning all services", { projectName, count: currentProvisioners.size });
-    const results = [];
-    for (const [serviceType, provisioner] of currentProvisioners) {
-      if (services && !services.includes(serviceType))
-        continue;
-      logger12.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
-      const provResult = await provisioner.provision(projectName);
-      if (!provResult.success) {
-        logger12.error("Service provisioning failed", {
-          serviceType,
-          provisioner: provisioner.name,
-          code: provResult.error.code
-        });
-        return recoveryFailure(provResult.error, {
-          projectName,
-          stage: `provision:${serviceType}`,
-          resources: [
-            ...results.map(({ envVars: _envVars, ...resource }) => resource),
-            ...getDeployRecovery(provResult.error)?.resources ?? [
-              { serviceType, provisionerName: provisioner.name, resourceInfo: projectName, resourceStatus: "unknown" }
-            ]
-          ]
-        });
-      }
-      results.push(provResult.data);
-      logger12.info("Service provisioned", { serviceType, provisioner: provisioner.name });
-    }
-    return ok(results);
-  },
-  async deployApp(appDir, options) {
-    if (!currentProvider && !currentContainerProvider) {
-      return notInitialized.result();
-    }
-    logger12.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
-    const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
-    const scanResult = await scanApp(appDir, scanOptions);
-    if (!scanResult.success) {
-      return err(scanResult.error);
-    }
-    const scan = scanResult.data;
-    appDir = scan.appDir ?? appDir;
-    const environment = loadDeploymentEnvironment({ environment: scanOptions.environment ?? "prod", envDir: scan.envDir ?? appDir, requireFile: scanOptions.environment !== void 0 });
-    if (!environment.success)
-      return environment;
-    const appEnv = Object.fromEntries(Object.entries(environment.data.values).filter(([key]) => !key.startsWith("HAI_CLI_") && (!key.startsWith("HAI_DEPLOY_") || key === "HAI_DEPLOY_ENVIRONMENT")));
-    const projectName = `${options?.projectName ?? scan.appName}${scanOptions.environment ? `-${environment.data.environment}` : ""}`;
-    options = {
-      ...options,
-      ...scanOptions.environment ? { environment: environment.data.environment } : {},
-      ...options?.skipMiddleware ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
-    };
-    if (options.selectedServices) {
-      options.serviceModes = {
-        ...options.serviceModes,
-        ...Object.fromEntries(scan.requiredServices.filter((service) => !options.selectedServices.includes(service)).map((service) => [service, "keep"]))
-      };
-    }
-    if (currentContainerProvider) {
-      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options, appEnv);
-    }
-    if (options?.bundleOnly)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleOnlyContainer"));
-    if (options.selectedServices)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectedContainerOnly"));
-    if (!currentProvider) {
-      return notInitialized.result();
-    }
-    if (scan.isSvelteKit && !scan.adapterInstalled) {
-      return err(
-        HaiDeployError.ADAPTER_MISSING,
-        deployM("deploy_adapterMissing", {
-          params: { adapter: "@sveltejs/adapter-vercel" }
-        })
-      );
-    }
-    if (!existsSync(resolveOutputDir(appDir, "vercel")))
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
-    let allEnvVars = appEnv;
-    const recovery = { projectName, stage: "provision", resources: [] };
-    if (!options?.skipMiddleware) {
-      const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
-      if (!provResults.success) {
-        return err(provResults.error);
-      }
-      recovery.resources = provResults.data.map(({ envVars: _envVars, ...resource }) => resource);
-      allEnvVars = { ...allEnvVars, ...mergeProvisionEnv(provResults.data, scan, options) };
-      if (options?.environment) {
-        const saved = saveDeploymentEnvironment(environment.data, mergeProvisionEnv(provResults.data, scan, options));
-        if (!saved.success)
-          return recoveryFailure(saved.error, { ...recovery, stage: "save-env" });
-      }
-    }
-    const projectResult = await currentProvider.createProject(projectName);
-    if (!projectResult.success) {
-      return recoveryFailure(projectResult.error, { ...recovery, stage: "create-project" });
-    }
-    const projectId = projectResult.data;
-    recovery.platformProjectId = projectId;
-    if (Object.keys(allEnvVars).length > 0) {
-      const envResult = await currentProvider.setEnvVars(projectId, allEnvVars);
-      if (!envResult.success) {
-        return recoveryFailure(envResult.error, { ...recovery, stage: "set-env" });
-      }
-    }
-    const outputDir = resolveOutputDir(appDir, currentConfig?.provider.type ?? "vercel");
-    const deployResult = await currentProvider.deploy(projectId, outputDir);
-    if (!deployResult.success) {
-      return recoveryFailure(deployResult.error, { ...recovery, stage: "deploy" });
-    }
-    const result = {
-      ...deployResult.data,
-      envVarsSet: Object.keys(allEnvVars)
-    };
-    logger12.info("Deployment completed", {
-      url: result.url,
-      deploymentId: result.deploymentId,
-      status: result.status
-    });
-    return ok(result);
-  }
-};
-async function deployContainerApp(provider, appDir, scan, rawProjectName, options, appEnv = {}) {
-  const projectName = normalizeProjectName(rawProjectName);
-  let artifact;
-  let artifactDir = options?.artifactDir ?? resolveArtifactDirectory(appDir);
-  try {
-    if (existsSync(join(artifactDir, "latest"))) {
-      const latest = readFileSync(join(artifactDir, "latest"), "utf8").trim();
-      if (!/^[a-z0-9][\w.+-]*$/i.test(latest))
-        throw new Error("Invalid artifact pointer");
-      artifactDir = join(artifactDir, latest);
-    }
-    artifact = await readDeploymentArtifact(artifactDir);
-  } catch {
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
-  }
-  if (artifact.partial && !options?.selectedServices) {
-    const selectedServices = artifact.images.map((image) => image.name);
-    options = {
-      ...options,
-      selectedServices,
-      serviceModes: {
-        ...options?.serviceModes,
-        ...Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"]))
-      }
-    };
-  }
-  if (!options?.bundleOnly && currentConfig?.provider.type === "docker-ssh" && !currentConfig.provider.ssh)
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
-  let provisionEnv = {};
-  if (!options?.skipMiddleware) {
-    const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
-    if (!provResults.success) {
-      return err(provResults.error);
-    }
-    provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
-  }
-  return provider.deploy({ appDir, artifact, artifactDir, projectName, scan, provisionEnv, appEnv, options });
-}
-
-// ../deploy/src/deploy-middleware.ts
-var field = (name, defaultValue, kind, secret = false) => ({ name, defaultValue, kind, secret });
-var required2 = (name, defaultValue, kind) => ({ ...field(name, defaultValue, kind), required: true });
-var DEPLOY_MIDDLEWARE = {
-  db: [
-    { backend: "sqlite", label: "SQLite", purpose: "deploy_purposeSqlite", fields: [required2("database", "./data/app.db")] },
-    ...["postgresql", "mysql"].map((backend) => ({
-      backend,
-      label: backend === "mysql" ? "MySQL" : "PostgreSQL",
-      purpose: "deploy_purposeDatabase",
-      provisioner: backend === "postgresql" ? "neon" : void 0,
-      fields: [field("url", "", "url", true), required2("host", "localhost"), required2("port", backend === "mysql" ? "3306" : "5432", "port"), required2("database", "hai"), field("user", "hai"), field("password", "", void 0, true), field("ssl", "false")]
-    }))
-  ],
-  cache: [
-    { backend: "memory", label: "Memory", purpose: "deploy_purposeMemory", fields: [] },
-    { backend: "redis", label: "Redis", purpose: "deploy_purposeCache", provisioner: "upstash", fields: [field("url", "", "url", true), required2("host", "localhost"), required2("port", "6379", "port"), field("password", "", void 0, true), { ...field("db", "0", "number"), maximum: 15 }, field("tls", "false", "boolean"), field("keyPrefix"), field("connectTimeout", "10000", "number"), field("commandTimeout", "5000", "number")] }
-  ],
-  storage: [
-    { backend: "local", label: "Local filesystem", purpose: "deploy_purposeLocal", fields: [required2("root", "./data/storage")] },
-    { backend: "s3", label: "S3 / RustFS / MinIO / Cloudflare R2", purpose: "deploy_purposeStorage", provisioner: "cloudflare-r2", fields: [field("endpoint", "", "url"), required2("bucket", "hai"), required2("region", "us-east-1"), required2("accessKeyId"), { ...required2("secretAccessKey"), secret: true }, field("forcePathStyle", "true", "boolean")] }
-  ],
-  vecdb: [
-    { backend: "lancedb", label: "LanceDB", purpose: "deploy_purposeLocal", fields: [required2("path", "./data/vectors")] },
-    { backend: "qdrant", label: "Qdrant", purpose: "deploy_purposeVector", fields: [required2("url", "http://localhost:6333", "url"), field("apiKey", "", void 0, true)] },
-    { backend: "pgvector", label: "PostgreSQL / pgvector", purpose: "deploy_purposeVector", fields: [field("url", "", "url", true), required2("host", "localhost"), required2("port", "5432", "port"), required2("database", "hai"), field("user", "hai"), field("password", "", void 0, true)] },
-    { backend: "chroma", label: "Chroma", purpose: "deploy_purposeVector", fields: [required2("url", "http://localhost:8000", "url")] }
-  ],
-  ldap: [
-    { backend: "disabled", label: "Disabled", purpose: "deploy_purposeDisabled", fields: [] },
-    { backend: "ldap", label: "LDAP / OpenLDAP", purpose: "deploy_purposeLdap", fields: [required2("url", "ldap://localhost:389", "url"), required2("bindDn", "cn=admin,dc=example,dc=org"), { ...required2("bindPassword"), secret: true }, required2("searchBase", "dc=example,dc=org"), field("searchFilter", "(uid={{username}})"), field("usernameAttribute", "uid"), field("emailAttribute", "mail"), field("displayNameAttribute", "cn"), field("useTls", "false", "boolean"), { ...field("connectTimeout", "5000", "number"), minimum: 1e3 }] }
-  ],
-  email: [
-    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
-    { backend: "smtp", label: "SMTP", purpose: "deploy_purposeEmail", provisioner: "resend", fields: [required2("host", "localhost"), required2("port", "465", "port"), field("secure", "true", "boolean"), field("user"), field("pass", "", void 0, true), required2("from", "noreply@example.com")] },
-    { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeEmail", fields: [required2("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
-  ],
-  sms: [
-    { backend: "aliyun-sms", label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", fields: [required2("accessKeyId"), { ...required2("accessKeySecret"), secret: true }, required2("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] }
-  ]
-};
-function describeMiddlewareBackend(backend) {
-  return deployM(backend.purpose);
-}
-
-export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
-//# sourceMappingURL=src-2V6VP4I5.js.map
-//# sourceMappingURL=src-2V6VP4I5.js.map
+export { external_exports };
+//# sourceMappingURL=chunk-FI56GONY.js.map
+//# sourceMappingURL=chunk-FI56GONY.js.map