@h-ai/cli 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { generateConfigFile, runtimeEnvironmentVariables, renderEnvironment, generateProductionEnvironment, moduleEnvironmentVariables, documentConfig, parameterizeConfig } from './chunk-YVNNMC4H.js';
-import { cliM } from './chunk-SWEU7KUE.js';
-import { external_exports, normalizeProjectName } from './chunk-K6RWTTHD.js';
+import { generateConfigFile, runtimeEnvironmentVariables, renderEnvironment, generateProductionEnvironment, moduleEnvironmentVariables, documentConfig, parameterizeConfig } from './chunk-STWZQ3IP.js';
+import { cliM } from './chunk-7DNIMG2H.js';
+import { normalizeProjectName, resolveImageReference, resolveDownloadProxy } from './chunk-4XVCGFBA.js';
 import './chunk-ZSDEVXZ7.js';
-import process4 from 'process';
+import process5 from 'process';
 import { cac } from 'cac';
 import chalk from 'chalk';
 import path2, { resolve, dirname, join, relative, isAbsolute } from 'path';
@@ -14,11 +14,15 @@ import Handlebars2 from 'handlebars';
 import { parseEnv } from 'util';
 import ora from 'ora';
 import prompts from 'prompts';
-import { parse, stringify, parseAllDocuments, parseDocument } from 'yaml';
+import { parse, stringify, parseAllDocuments } from 'yaml';
 import { Buffer } from 'buffer';
 import { execSync, execFileSync, spawn } from 'child_process';
 import { randomBytes, createECDH, randomUUID, createHash } from 'crypto';
 import { readFileSync, existsSync, mkdirSync, mkdtempSync, appendFileSync, createReadStream, writeFileSync, renameSync, rmSync, realpathSync, readdirSync, statSync, copyFileSync } from 'fs';
+import { connect } from 'net';
+import { Writable, Transform } from 'stream';
+import { pipeline } from 'stream/promises';
+import { StringDecoder } from 'string_decoder';
 import { createRequire, findPackageJSON } from 'module';
 import { core, ok, err as err$1, HaiCommonError } from '@h-ai/core';
 import { stat, readFile, glob } from 'fs/promises';
@@ -28,20 +32,20 @@ import { gunzipSync } from 'zlib';
 var CAMEL_CASE_SEPARATOR_REGEX = /[-_\s]+(.)?/g;
 var LEADING_CHAR_REGEX = /^./;
 function writeCliMessage(message) {
-  process4.stdout.write(`${message}
+  process5.stdout.write(`${message}
 `);
 }
 function writeCliError(message, error) {
-  process4.stderr.write(`${message}
+  process5.stderr.write(`${message}
 `);
   if (error && typeof error === "object" && "error" in error)
     error = error.error;
   if (error !== void 0)
-    process4.stderr.write(`${error instanceof Error ? error.message : String(error)}
+    process5.stderr.write(`${error instanceof Error ? error.message : String(error)}
 `);
 }
 function formatPromptDescription(description) {
-  return wrapAnsi(description, Math.max(1, (process4.stdout.columns || 80) - 32), { hard: true });
+  return wrapAnsi(description, Math.max(1, (process5.stdout.columns || 80) - 32), { hard: true });
 }
 function toCamelCase(str) {
   return str.replace(CAMEL_CASE_SEPARATOR_REGEX, (_, c) => c ? c.toUpperCase() : "").replace(LEADING_CHAR_REGEX, (c) => c.toLowerCase());
@@ -828,6 +832,7 @@ async function generateFromTemplates(projectPath, context) {
   }
   await renderDynamicFiles(root, projectPath, context);
   await fse.copy(path2.join(root, "shared", "run-e2e.mjs"), path2.join(projectPath, "scripts", "run-e2e.mjs"));
+  await fse.copy(path2.join(root, "shared", "run-node.mjs"), path2.join(projectPath, "scripts", "run-node.mjs"));
   await fse.copy(path2.join(root, "shared", "e2e-env.ts"), path2.join(projectPath, "scripts", "e2e-env.ts"));
   await fse.copy(path2.join(root, "shared", "build-metadata.ts"), path2.join(projectPath, "scripts", "build-metadata.ts"));
   await fse.copy(path2.join(root, "shared", "public-base-path.mjs"), path2.join(projectPath, "scripts", "public-base-path.mjs"));
@@ -1266,7 +1271,7 @@ async function createProject(options) {
     });
     await generateFromTemplates(projectPath, context);
     {
-      const { generateConfigFile: generateConfigFile2, generateEnvExample, generateProductionEnvironment: generateProductionEnvironment2 } = await import('./cli-config-templates-LUJGDQNW.js');
+      const { generateConfigFile: generateConfigFile2, generateEnvExample, generateProductionEnvironment: generateProductionEnvironment2 } = await import('./cli-config-templates-YGPVNRX5.js');
       const configs = resolvedOptions.moduleConfigs;
       const isApiWorkspace = resolvedOptions.appType === "api";
       const isFullstack = resolvedOptions.appType === "fullstack";
@@ -1333,13 +1338,14 @@ ${runtimeExample.split("\n").map((line) => line && !line.startsWith("#") ? `# ${
 ${sharedVariables.join("\n")}
 `);
       for (const [mode, environment] of [["dev", "development"], ["test", "test"], ["prod", "production"]]) {
-        let values = mode === "prod" ? generateProductionEnvironment2(envFeatures, configs) : `# \u516C\u5171 ${mode} \u73AF\u5883\u914D\u7F6E\uFF1B\u672C\u673A\u79C1\u6709\u503C\u653E .env.local\uFF0C\u8FDB\u7A0B\u73AF\u5883\u53D8\u91CF\u4F18\u5148\u3002
+        let privateValues = "# \u6A21\u5F0F\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u63D0\u4EA4 Git\uFF1B\u5404\u8282\u70B9\u901A\u8FC7\u53D7\u7BA1\u914D\u7F6E\u5171\u4EAB\u5BF9\u5E94\u79D8\u5BC6\u3002\n";
+        const values = mode === "prod" ? generateProductionEnvironment2(envFeatures, configs) : `# \u516C\u5171 ${mode} \u73AF\u5883\u914D\u7F6E\uFF1B\u672C\u673A\u79C1\u6709\u503C\u653E .env.local\uFF0C\u8FDB\u7A0B\u73AF\u5883\u53D8\u91CF\u4F18\u5148\u3002
 HAI_CORE_ENV=${environment}
 HAI_CORE_LOGGING_LEVEL=${mode === "test" ? "warn" : "debug"}
 `;
         if (isFullstack) {
           for (const name of ["HAI_ADMIN_DEFAULT_PASSWORD", "HAI_AUDIT_ADMIN_PASSWORD", "HAI_CONFIG_ADMIN_PASSWORD", "HAI_BUSINESS_OPERATOR_PASSWORD"])
-            values += `
+            privateValues += `
 ${name}=Aa1!${randomBytes(24).toString("base64url")}
 `;
         }
@@ -1348,15 +1354,16 @@ ${name}=Aa1!${randomBytes(24).toString("base64url")}
           key.generateKeys();
           const id = `${mode}-${randomBytes(6).toString("hex")}`;
           const ring = { activeKeyId: id, keys: { [id]: { publicKey: key.getPublicKey("hex"), privateKey: key.getPrivateKey("hex").padStart(64, "0") } } };
-          values += `
+          privateValues += `
 HAI_CRYPTO_TRANSPORT_SERVERKEYRING='${JSON.stringify(ring)}'
 `;
         }
         await writeFile(path2.join(envDirectory, `.env.${mode}`), values);
+        await fse.writeFile(path2.join(envDirectory, `.env.${mode}.local`), privateValues, { mode: 384 });
       }
-      await fse.writeFile(path2.join(envDirectory, ".env.local"), "# \u672C\u673A\u79C1\u6709\u8986\u76D6\uFF0C\u4E0D\u63D0\u4EA4 Git\uFF1B\u521D\u59CB\u7BA1\u7406\u5458\u5BC6\u7801\u548C\u4F20\u8F93\u5BC6\u94A5\u73AF\u89C1 .env.dev / .env.test / .env.prod\u3002\n", { mode: 384 });
+      await fse.writeFile(path2.join(envDirectory, ".env.local"), "# \u672C\u673A\u901A\u7528\u79C1\u6709\u8986\u76D6\uFF0C\u4E0D\u63D0\u4EA4 Git\uFF1B\u521D\u59CB\u5BC6\u7801\u548C\u4F20\u8F93\u5BC6\u94A5\u73AF\u5206\u522B\u4F4D\u4E8E .env.dev.local / .env.test.local / .env.prod.local\u3002\n", { mode: 384 });
     }
-    const { generateSkillFiles } = await import('./cli-skill-templates-VV2XWYON.js');
+    const { generateSkillFiles } = await import('./cli-skill-templates-S2YH642Z.js');
     await generateSkillFiles(
       projectPath,
       resolvedOptions.features,
@@ -1403,7 +1410,7 @@ async function resolveOptions(options) {
   writeCliMessage("");
   const onCancel = () => {
     writeCliMessage(chalk.red(cliM("cli_cancelledLine")));
-    process4.exit(1);
+    process5.exit(1);
   };
   let projectName = options.name;
   if (!projectName && useDefaults) {
@@ -1607,7 +1614,7 @@ async function promptModuleConfigs(features, projectName) {
   const configs = {};
   const onCancel = () => {
     writeCliMessage(chalk.red(cliM("cli_cancelledLine")));
-    process4.exit(1);
+    process5.exit(1);
   };
   writeCliMessage("");
   writeCliMessage(chalk.bold(cliM("cli_createModuleConfig")));
@@ -1848,7 +1855,7 @@ function generateAiDevelopmentReadme() {
 function generateEnvironmentReadme() {
   return `### \u5206\u73AF\u5883\u914D\u7F6E
 
-\u8FD0\u884C\u53C2\u6570\u5728 \`.env.example\` \u4E2D\u9010\u9879\u8BF4\u660E\u7528\u9014\u3001\u679A\u4E3E\u548C\u8303\u56F4\u3002\`.env\` \u4E3A\u516C\u5171\u57FA\u7840\uFF0C\`.env.dev\` / \`.env.test\` / \`.env.prod\` \u4E3A\u73AF\u5883\u8986\u76D6\uFF0C\u5747\u63D0\u4EA4 Git\uFF1B\`.env.local\` \u4E3A\u672C\u673A\u79C1\u6709\u8986\u76D6\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002\u4F18\u5148\u7EA7\u4E3A\u8FDB\u7A0B\u73AF\u5883 > \`.env.local\` > \u73AF\u5883\u6587\u4EF6 > \`.env\`\u3002YAML \u663E\u5F0F\u5F15\u7528 \`HAI_<\u914D\u7F6E\u540D>_<\u8DEF\u5F84>\` \u5E76\u4FDD\u7559\u672C\u5730\u56DE\u9000\uFF0CcamelCase \u4E0D\u62C6\u8BCD\u3002\u5B8C\u6574\u547D\u4EE4\u3001\u52A0\u8F7D\u4F18\u5148\u7EA7\u548C Provider \u5207\u6362\u89C1 [\u73AF\u5883\u914D\u7F6E](.agents/skills/hai-app-create/development.md#\u73AF\u5883\u914D\u7F6E)\u3002
+\u8FD0\u884C\u53C2\u6570\u5728 \`.env.example\` \u4E2D\u9010\u9879\u8BF4\u660E\u7528\u9014\u3001\u679A\u4E3E\u548C\u8303\u56F4\u3002\`.env\` \u4E3A\u516C\u5171\u57FA\u7840\uFF0C\`.env.dev\` / \`.env.test\` / \`.env.prod\` \u4E3A\u73AF\u5883\u8986\u76D6\uFF0C\u5747\u63D0\u4EA4 Git\uFF1B\`.env.local\` \u4E3A\u672C\u673A\u79C1\u6709\u8986\u76D6\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002\u4F18\u5148\u7EA7\u4E3A\u8FDB\u7A0B > \`.env.<mode>.local\` > \`.env.local\` > \`.env.<mode>\` > \`.env\` > YAML\u3002\u540C\u6765\u6E90\u5148\u7236 JSON \u540E\u7EC6\u9879\uFF0C\u9AD8\u6765\u6E90\u6574\u6BB5\u66FF\u6362\u5148\u6E05\u9664\u4F4E\u6765\u6E90\u7EC6\u9879\u3002YAML \u663E\u5F0F\u5F15\u7528 \`HAI_<\u914D\u7F6E\u540D>_<\u8DEF\u5F84>\` \u5E76\u4FDD\u7559\u672C\u5730\u56DE\u9000\uFF0CcamelCase \u4E0D\u62C6\u8BCD\u3002\u5B8C\u6574\u547D\u4EE4\u3001\u52A0\u8F7D\u4F18\u5148\u7EA7\u548C Provider \u5207\u6362\u89C1 [\u73AF\u5883\u914D\u7F6E](.agents/skills/hai-app-create/development.md#\u73AF\u5883\u914D\u7F6E)\u3002
 
 \u751F\u4EA7 .env.prod \u6309\u5DF2\u542F\u7528\u6A21\u5757\u9009\u62E9\u5171\u4EAB PostgreSQL\uFF08\u660E\u786E\u9009\u62E9 MySQL \u65F6\u4FDD\u7559\uFF09\u3001Redis\u3001S3\u3001Qdrant\uFF0C\u9ED8\u8BA4\u4F7F\u7528 Compose \u5185\u90E8\u670D\u52A1\u540D db/cache/storage/vecdb\u3002\u5BC6\u7801\u3001S3 \u51ED\u636E\u3001\u6A21\u578B Key \u4E0E\u53D7\u4FDD\u62A4 Qdrant \u7684 Key \u53EA\u7531\u79C1\u6709\u73AF\u5883\u6CE8\u5165\uFF1B\u5BB9\u5668\u5916\u8FD0\u884C\u8986\u76D6\u5185\u90E8\u8FDE\u63A5\u5730\u5740\u3002\u751F\u4EA7 Reach \u5FC5\u987B\u6CE8\u5165\u771F\u5B9E HAI_REACH_PROVIDERS JSON\uFF0C\u516C\u5171\u7A7A\u6570\u7EC4\u4F1A\u62D2\u7EDD\u542F\u52A8\u3002AI \u81EA\u52A8\u8865\u5168 db+vecdb \u4F9D\u8D56\uFF0C\u5E76\u5728\u4E8C\u8005\u5C31\u7EEA\u540E\u521D\u59CB\u5316\uFF0C\u5931\u8D25\u9006\u5E8F\u6E05\u7406\u3002
 
@@ -1873,6 +1880,7 @@ function generateBuildDeploymentReadme(pm, appDir) {
 
 \u81EA\u5EFAS3\u7684\u5185\u90E8endpoint\u4E0E\u6D4F\u89C8\u5668publicEndpoint\u5206\u5F00\u3002publicEndpoint\u53EF\u8BBE\u7F6E\u4E3Ahttps://example.com/delivery/files\u7B49\u5E26\u76EE\u5F55\u5730\u5740\uFF0C\u4E0D\u542B\u6876\u540D\u3001\u51ED\u636E\u6216\u67E5\u8BE2\uFF1B\u8FD4\u56DEURL\u4FDD\u7559\u6876\u540D\uFF0CWeb Nginx\u6216SSR/API gateway\u53BB\u6389\u5165\u53E3\u524D\u7F00\uFF0C\u4FDD\u7559\u539F\u59CBS3\u8DEF\u5F84\u3001Host\u4E0E\u67E5\u8BE2\u540E\u76F4\u63A5\u8F6C\u53D1storage\uFF0C\u5927\u6587\u4EF6\u4E0D\u7ECF\u8FC7Serv\u3002\u5916\u5C42\u4EE3\u7406\u4FDD\u7559\u5B8C\u6574\u5165\u53E3\u8DEF\u5F84\uFF0C\u4E0D\u91CD\u590D\u53BB\u524D\u7F00\uFF1B\u5916\u90E8S3/CORS\u6309\u5B9E\u9645\u670D\u52A1\u914D\u7F6E\uFF0CLocal\u4E0D\u516C\u5F00\u79C1\u6709\u76EE\u5F55\u3002\u589E\u52A0\u7F51\u5173\u3001\u6539\u53D8\u6876\u6216\u516C\u5F00\u5730\u5740\u65F6\u5168\u91CF\u90E8\u7F72\uFF0C\u5E94\u7528\u589E\u91CF\u4E0E\u56DE\u6EDA\u4FDD\u6301\u539F\u914D\u7F6E\uFF1B\u8BE6\u89C1[\u5B58\u50A8\u4F7F\u7528\u89C4\u8303](.agents/skills/hai-storage/SKILL.md)\u3002
 \u6BCF\u4E2A\u955C\u50CF\u5BF9\u5E94 images/ \u4E2D\u4E00\u4E2A Dockerfile\uFF0C\u6839 hai.json \u7684 build \u5206\u533A\u6307\u5B9A\u6587\u4EF6\uFF0Cdeploy \u5206\u533A\u4FDD\u5B58\u6574\u4E2A\u9879\u76EE\u7684\u90E8\u7F72\u914D\u7F6E\u3002
+\u955C\u50CF\u6784\u5EFA\u53EF\u52A0 --image-source cn --npm-source cn\uFF0C\u5206\u522B\u9009\u62E9\u4E2D\u56FD\u5927\u9646\u955C\u50CF\u6E90\u4E0E npm \u6E90\uFF1B\u8FD8\u652F\u6301 official/custom\u3002\u9996\u6B21\u4EA4\u4E92\u9009\u62E9\u4FDD\u5B58\u5230 hai.json.build.sources\uFF0C--yes \u590D\u7528\u914D\u7F6E\uFF0C\u672A\u914D\u7F6E\u65F6\u4F7F\u7528\u5B98\u65B9\u6E90\u3002\u4EE3\u7406\u7528 --proxy-mode inherit|system|custom|none\uFF0C\u81EA\u5B9A\u4E49\u914D\u5408 --proxy-url\uFF1BDocker/Podman \u5F15\u64CE\u62C9\u53D6\u4EE3\u7406\u9700\u5728\u5F15\u64CE\u4FA7\u8BBE\u7F6E\uFF0C\u6784\u5EFA\u5BB9\u5668\u4F1A\u5355\u72EC\u68C0\u67E5\u4EE3\u7406\u53EF\u8FBE\u6027\u3002\u81EA\u5B9A\u4E49\u6E90\u548C\u65E7\u5DE5\u7A0B Dockerfile \u66F4\u65B0\u89C1 .agents/skills/hai-build/reference.md \u7684\u4E0B\u8F7D\u6E90\u4E0E\u4EE3\u7406\u8BF4\u660E\u3002
 \u4E0B\u8F7D\u3001\u5B89\u88C5\u548C\u6574\u7406\u751F\u4EA7\u4F9D\u8D56\u590D\u7528\u540C\u4E00\u4EFD\u5305\u7F13\u5B58\u4E0E SQLite \u9A71\u52A8\u7F13\u5B58\uFF0C\u4F9D\u8D56\u5B89\u88C5\u5148\u4E8E\u6E90\u7801\u590D\u5236\u3002\u524D\u540E\u7AEF\u9ED8\u8BA4\u6700\u591A\u5E76\u884C\u6784\u5EFA\u4E24\u9879\uFF0C--concurrency 1\u53EF\u964D\u4F4E\u8D44\u6E90\u5360\u7528\u3002\u8FD0\u884C\u955C\u50CF\u53BB\u9664\u5E94\u7528\u81EA\u8EAB\u7684\u58F0\u660E\u6587\u4EF6\u3001\u6E90\u7801\u6620\u5C04\u548C\u8BF4\u660E\u6587\u4EF6\u3002
 \u9ED8\u8BA4\u5BB9\u5668\u7528\u4E8E CPU \u8FD0\u884C\u6216\u8FDE\u63A5\u8FDC\u7A0B AI \u670D\u52A1\uFF0C\u4E0D\u989D\u5916\u4E0B\u8F7D GPU \u8FD0\u884C\u5E93\uFF1B\u9700\u8981\u4F7F\u7528\u90E8\u7F72\u673A\u5668\u4E0A\u7684 GPU \u65F6\uFF0C\u81EA\u884C\u5B9A\u5236\u955C\u50CF\u548C\u5BB9\u5668\u8FD0\u884C\u53C2\u6570\u3002
 
@@ -1896,7 +1904,7 @@ ${pm} exec hai deploy ${appDir} --env prod --services web
 \u6BCF\u6B21\u79BB\u7EBF\u4EA4\u4ED8\u751F\u6210\u72EC\u7ACB\u76EE\u5F55\uFF0C\u9ED8\u8BA4tar.gz\uFF08\u663E\u5F0F--output release.tar\u53EF\u4FDD\u7559\u672A\u538B\u7F29\uFF09\uFF0C\u5916\u5C42\u4EC5\u542B\u5F52\u6863\u3001deploy.ps1\uFF08Windows\uFF09\u3001deploy.sh\uFF08Linux/macOS\uFF09\u3001deploy-target.json\u3001read-target.awk\u3001deploy-local.sh \u548C README.txt\uFF1BCompose\u3001\u8FD0\u884C\u73AF\u5883\u548C\u6E05\u5355\u4EC5\u5728\u5F52\u6863\u5185\uFF0CREADME\u4E0D\u91CD\u590D\u3002\u4E2D\u95F4\u4EF6\u5F52\u6863\u6309\u955C\u50CF\u5185\u5BB9ID\u7F13\u5B58\u5E76\u5728\u590D\u7528\u524D\u9A8C\u8BC1\u6458\u8981\u3002\u6210\u529F\u540E\u6E05\u7406\u672C\u6B21incoming\u4E0A\u4F20\u4E0E\u89E3\u5305\u76EE\u5F55\uFF0Crelease\u4FDD\u7559\u6062\u590D\u914D\u7F6E\u548C\u72B6\u6001\uFF0C\u955C\u50CF\u7531\u5F15\u64CE\u4FDD\u5B58\u3002\u4EA4\u4E92\u5F0F\u6253\u5305\u5728\u6784\u5EFA\u548C\u4E2D\u95F4\u4EF6\u914D\u7F6E\u540E\u6700\u540E\u8BE2\u95EE\u662F\u5426\u4FDD\u5B58\u6216\u4FEE\u6539 SSH \u4FE1\u606F\uFF0C\u5199\u5165 .env.<\u73AF\u5883>.local \u5E76\u7528\u4E8E\u672C\u6B21\u548C\u540E\u7EED target\uFF1B--yes \u590D\u7528\u5DF2\u6709\u914D\u7F6E\uFF0C\u590D\u5236\u6574\u4E2A\u76EE\u5F55\u5373\u53EF\u3002\u811A\u672C\u6309\u5DF2\u4FDD\u5B58\u7684 SSH \u53C2\u6570\u4E0A\u4F20\u3001\u5BFC\u5165\u3001\u542F\u52A8\u5E76\u9A8C\u8BC1 HTTP\u6216HTTPS\u3002
 \u90E8\u7F72\u5411\u5BFC\u53EF\u9009\u5DF2\u6709PEM\u8BC1\u4E66\u4E0E\u79C1\u94A5\u8DEF\u5F84\uFF08\u76F8\u5BF9\u5DE5\u7A0B\u6839\uFF0C\u6821\u9A8C\u540E\u590D\u5236\u5230\u79C1\u6709\u5305\uFF09\u6216Let\u2019s Encrypt\u3002\u5B98\u65B9Certbot\u7533\u8BF7\u5E76\u6BCF12\u5C0F\u65F6\u68C0\u67E5\u7EED\u671F\uFF0CNginx\u81EA\u52A8\u91CD\u8F7D\uFF1B\u9700\u8981\u6761\u6B3E\u786E\u8BA4\u3001\u771F\u5B9E\u90AE\u7BB1\u3001\u516C\u7F51DNS\u300180\u7AEF\u53E3\u53CACA\u7F51\u7EDC\u3002HTTPS\u9ED8\u8BA4443\u3001HTTP\u8DF3\u8F6C\u5F00\u542F\uFF0C\u672A\u914D\u7F6E\u4ECD\u4E3AHTTP\uFF1B\u542F\u505C\u6216\u6539\u6A21\u5F0F/\u57DF\u540D/\u7AEF\u53E3/\u672C\u5730\u8BC1\u4E66\u987B\u5168\u91CF\u3002\u8BC1\u4E66\u72B6\u6001\u4FDD\u7559\u5728\u670D\u52A1\u5668\u5E76\u5907\u4EFD\uFF0C\u9694\u79BB\u76EE\u6807\u4F7F\u7528\u5DF2\u6709\u8BC1\u4E66\u3002--plan\u4E2D\u7684root\u8868\u793A\u5DE5\u7A0B\u6839\uFF0CserviceDir\u8868\u793A\u90E8\u7F72\u670D\u52A1\u6E90\u7801\u4E0E\u914D\u7F6E\u76EE\u5F55\u3002
 \u5B8C\u5168\u9694\u79BB\u65F6\u590D\u5236\u6574\u4E2A\u4EA4\u4ED8\u76EE\u5F55\uFF0C\u8FD0\u884C sh deploy-local.sh \u81EA\u52A8\u89E3\u5305\u5E76\u90E8\u7F72\uFF1B\u53EF\u4F20\u5165\u90E8\u7F72\u76EE\u5F55\u8986\u76D6\u9ED8\u8BA4\u4F4D\u7F6E\u3002
-Node\u540E\u7AEF\u9ED8\u8BA4\u5728\u542F\u52A8\u65F6\u91CD\u8BFB\u5B9E\u9645\u6302\u8F7D\u7684releases/<\u540E\u7AEF\u53D1\u5E03ID>/.env.runtime\uFF0C\u4FEE\u6539\u540Erestart\u5BB9\u5668\u5373\u53EF\uFF1B\u65E0\u9700\u65B0\u5F00\u5173\u6216override\uFF0C\u65E7\u90E8\u7F72\u5148\u7528\u65B0\u7248CLI\u53D1\u5E03\u4E00\u6B21\u3002\u4EC5\u66F4\u65B0Web/\u4E2D\u95F4\u4EF6\u540E\uFF0C\u6309\u540E\u7AEF\u5BB9\u5668Mounts\u786E\u8BA4\u6E90\u6587\u4EF6\uFF0C\u4E0D\u80FD\u6839\u636Ecurrent\u731C\u8DEF\u5F84\u3002\u6258\u7BA1\u8FDE\u63A5middleware.env\u4ECD\u4F18\u5148\uFF1B\u7AEF\u53E3/\u6302\u8F7D/Node\u542F\u52A8\u53C2\u6570\u3001\u9759\u6001Web\u548C\u4E2D\u95F4\u4EF6\u6309\u539F\u6D41\u7A0B\u66F4\u65B0\u3002\u624B\u5DE5\u4FEE\u6539\u5148\u5907\u4EFD\uFF0C\u957F\u671F\u914D\u7F6E\u540C\u6B65\u6E90\u73AF\u5883\uFF0C\u4E0B\u6B21\u540E\u7AEF\u53D1\u5E03\u4F1A\u91CD\u65B0\u751F\u6210\u3002
+Node \u540E\u7AEF\u542F\u52A8\u65F6\u8BFB\u53D6\u670D\u52A1\u5668 config/.env.runtime\uFF0C\u5E94\u7528\u914D\u7F6E\u548C\u6258\u7BA1\u8FDE\u63A5\u5408\u5E76\u5728\u6B64\uFF1B\u4FEE\u6539\u7EC6\u9879\u540E\u91CD\u542F\u540E\u7AEF\u5373\u53EF\u3002\u540C\u6E90\u7EC6\u9879\u8986\u76D6 JSON\uFF0C\u914D\u7F6E\u76EE\u5F55\u53EA\u8BFB\u6302\u8F7D\u5230 /run/hai/config\uFF0C\u539F\u5B50\u66FF\u6362\u6587\u4EF6\u4E5F\u80FD\u8BFB\u53D6\u3002\u5F52\u6863\u4EC5\u6709 apply.sh\u3001manifest.json\u3001config/\u3001images/\u3001.hai/ \u4E94\u4E2A\u9876\u5C42\u5165\u53E3\uFF1B\u5B8C\u6574 Compose\u3001\u52A0\u8F7D\u5668\u3001\u539F\u751F\u73AF\u5883\u3001\u4EE3\u7406/TLS\u3001\u7B56\u7565\u548C\u6821\u9A8C\u548C\u4F4D\u4E8E .hai/\uFF0C\u8F85\u52A9\u811A\u672C\u5185\u5D4C apply.sh\u3002Web/\u4E2D\u95F4\u4EF6\u5C40\u90E8\u66F4\u65B0\u4FDD\u7559\u5E94\u7528\u6587\u4EF6\uFF0C\u5931\u8D25\u5148\u6062\u590D\u5E94\u7528\u914D\u7F6E\u518D\u6062\u590D\u670D\u52A1\uFF1B\u957F\u671F\u4FEE\u6539\u540C\u6B65\u6E90\u73AF\u5883\u3002\u7AEF\u53E3\u3001\u6302\u8F7D\u3001Node \u542F\u52A8\u53C2\u6570\u548C\u4EE3\u7406\u53D8\u66F4\u9700\u90E8\u7F72\u3002
 \u90E8\u5206\u66F4\u65B0\u8981\u6C42\u5DF2\u6709\u6210\u529F\u7684\u5B8C\u6574\u90E8\u7F72\uFF0C\u4FDD\u7559\u672A\u9009\u670D\u52A1\u53CA\u6570\u636E\u5377\uFF1B\u5931\u8D25\u8FD4\u56DE\u975E\u96F6\u9000\u51FA\u7801\uFF0C\u5DF2\u6709\u90E8\u7F72\u5C1D\u8BD5\u6062\u590D\u9009\u4E2D\u670D\u52A1\u3002
 \u4E2D\u95F4\u4EF6\u8FDE\u63A5\u9F50\u5168\u65F6\u4F7F\u7528 --skip-middleware \u8DF3\u8FC7\u914D\u7F6E\u5411\u5BFC\u3002\u5305\u4E2D\u5305\u542B\u79C1\u6709\u914D\u7F6E\uFF0C\u4E0D\u63D0\u4EA4 Git\u3002
 `;
@@ -2079,7 +2087,7 @@ Web/App/Desktop \u5171\u4EAB AppShell \u7684 header/footer\u3002\u65B0\u589E\u98
 
 ${hasFeedback ? "\u666E\u901A\u6210\u5458\u548C\u4E1A\u52A1\u64CD\u4F5C\u5458\u53EF\u4ECE\u9876\u90E8\u201C\u95EE\u9898\u53CD\u9988\u201D\u63D0\u4EA4\u8BF4\u660E\u3001\u622A\u56FE\u4E0E\u65E5\u5FD7\uFF1B\u53EA\u6709 business_operator \u663E\u793A\u53CD\u9988\u7BA1\u7406\u83DC\u5355\u5E76\u80FD\u67E5\u770B\u3001\u5904\u7406\u3001\u64A4\u9500\u548C\u5BFC\u51FA\u95EE\u9898\u5305\u3002\u670D\u52A1\u7AEF\u7EE7\u7EED\u6309\u53EF\u4FE1\u8EAB\u4EFD\u4E0E\u5E94\u7528\u8303\u56F4\u6388\u6743\u3002\u5F00\u53D1\u901A\u77E5\u4F7F\u7528 Console\uFF0C\u751F\u4EA7\u987B\u5728 _feedback.yml \u4E0E _reach.yml \u914D\u7F6E\u6536\u4EF6\u4EBA\u548C\u771F\u5B9E\u90AE\u4EF6\u3002" : ""}
 
-CLI \u5728\u6839\u76EE\u5F55 .env.dev\u3001.env.test\u3001.env.prod \u4E2D\u4E3A admin\u3001audit_admin\u3001config_admin\u3001business_operator \u5206\u522B\u751F\u6210\u72EC\u7ACB\u968F\u673A\u5F3A\u5BC6\u7801\uFF0C\u5BF9\u5E94 HAI_ADMIN_DEFAULT_PASSWORD\u3001HAI_AUDIT_ADMIN_PASSWORD\u3001HAI_CONFIG_ADMIN_PASSWORD\u3001HAI_BUSINESS_OPERATOR_PASSWORD\u3002\u540C\u4E00\u73AF\u5883\u7684\u914D\u7F6E\u968F\u9879\u76EE\u63D0\u4EA4\u4F9B\u514B\u9686\u540E\u5171\u4EAB\uFF1B\u88AB\u5FFD\u7565\u7684 .env.local \u6216\u540C\u540D\u8FDB\u7A0B\u73AF\u5883\u53EF\u8986\u76D6\u3002\u5DF2\u6709\u8D26\u53F7\u4E0D\u6539\u5BC6\u3001\u4E0D\u91CD\u65B0\u5206\u914D\u804C\u8D23\uFF1B\u672A\u914D\u7F6E\u5BC6\u7801\u7684\u72EC\u7ACB\u804C\u8D23\u8D26\u53F7\u4E0D\u521B\u5EFA\u3002\u5BC6\u7801\u987B\u7B26\u5408 _iam.yml \u7B56\u7565\uFF1B\u542F\u52A8\u5931\u8D25\u4FDD\u7559\u6A21\u5757\u3001\u914D\u7F6E\u5B57\u6BB5\u3001\u9519\u8BEF\u7801\u548C\u7AEF\u53E3\u5360\u7528\u8BCA\u65AD\u3002
+CLI \u5728\u6839\u76EE\u5F55 .env.dev.local\u3001.env.test.local\u3001.env.prod.local \u4E2D\u4E3A admin\u3001audit_admin\u3001config_admin\u3001business_operator \u5206\u522B\u751F\u6210\u72EC\u7ACB\u968F\u673A\u5F3A\u5BC6\u7801\uFF0C\u5BF9\u5E94 HAI_ADMIN_DEFAULT_PASSWORD\u3001HAI_AUDIT_ADMIN_PASSWORD\u3001HAI_CONFIG_ADMIN_PASSWORD\u3001HAI_BUSINESS_OPERATOR_PASSWORD\u3002\u8FD9\u4E9B\u79C1\u6709\u6587\u4EF6\u4E0D\u63D0\u4EA4 Git\uFF1B\u514B\u9686\u540E\u901A\u8FC7\u53D7\u4FDD\u62A4\u914D\u7F6E\u6216 Secret Manager \u5206\u53D1\u5BF9\u5E94\u73AF\u5883\u79D8\u5BC6\uFF0C\u540C\u4E00\u73AF\u5883\u5404\u8282\u70B9\u5171\u4EAB\u3002\u5171\u4EAB .env.local \u6216\u8FDB\u7A0B\u53D8\u91CF\u53EF\u8986\u76D6\u516C\u5171\u503C\uFF0C\u6A21\u5F0F\u79C1\u6709\u6587\u4EF6\u4F18\u5148\u4E8E\u5171\u4EAB\u79C1\u6709\u6587\u4EF6\u3002\u5DF2\u6709\u8D26\u53F7\u4E0D\u6539\u5BC6\u3001\u4E0D\u91CD\u65B0\u5206\u914D\u804C\u8D23\uFF1B\u672A\u914D\u7F6E\u5BC6\u7801\u7684\u72EC\u7ACB\u804C\u8D23\u8D26\u53F7\u4E0D\u521B\u5EFA\u3002\u5BC6\u7801\u987B\u7B26\u5408 _iam.yml \u7B56\u7565\uFF1B\u542F\u52A8\u5931\u8D25\u4FDD\u7559\u6A21\u5757\u3001\u914D\u7F6E\u5B57\u6BB5\u3001\u9519\u8BEF\u7801\u548C\u7AEF\u53E3\u5360\u7528\u8BCA\u65AD\u3002
 
 \`_iam.yml\` \u53EF\u6309\u4E1A\u52A1\u542F\u7528\u8D26\u53F7\u95F2\u7F6E\u626B\u63CF\u3001\u5BC6\u7801\u590D\u6742\u5EA6/\u671F\u9650\u3001ALTCHA \u6311\u6218\u3001\u5931\u8D25\u7A97\u53E3\u9501\u5B9A\u3001\u4E00\u6B21\u6027\u9080\u8BF7\u3001\u9996\u6B21\u6539\u5BC6\u3001\u654F\u611F\u64CD\u4F5C\u518D\u8BA4\u8BC1\u3001\u767B\u5F55\u65F6\u95F4/IP \u548C\u4F1A\u8BDD\u671F\u9650/\u5E76\u53D1\u7B56\u7565\u3002\u654F\u611F\u64CD\u4F5C\u6E05\u5355\u4F7F\u7528\u670D\u52A1\u7AEF\u64CD\u4F5C\u6807\u8BC6\uFF1B\u754C\u9762\u901A\u8FC7\u77ED\u671F\u5355\u6B21\u7968\u636E\u5B8C\u6210\u518D\u8BA4\u8BC1\u3002\`session.endOnPageHide\` \u9ED8\u8BA4\u5173\u95ED\uFF0C\u5F00\u542F\u65F6\u9875\u9762\u79BB\u5F00\u5C1D\u8BD5\u64A4\u9500\uFF0C\u4F46\u6D4F\u89C8\u5668\u901A\u77E5\u4EC5\u6700\u4F73\u52AA\u529B\uFF0C\u9700\u914D\u5408\u670D\u52A1\u7AEF\u95F2\u7F6E/\u7EDD\u5BF9\u671F\u9650\u3002\`_audit.yml\` \u914D\u7F6E\u4FDD\u7559\u4FDD\u62A4\u3001\u79C1\u6709\u5907\u4EFD\u53CA Reach \u544A\u8B66\uFF1B\u624B\u52A8\u5907\u4EFD\u5931\u8D25\u590D\u7528\u540C\u4E00\u7F16\u53F7\u91CD\u8BD5\uFF0C\u56DE\u6267\u542B key/\u8BB0\u5F55\u6570/SHA-256\uFF0C\u4E0D\u516C\u5F00\u4E0B\u8F7D\u3002\u5F52\u6863\u4E0D\u662F\u539F\u5B50\u6570\u636E\u5E93\u5FEB\u7167\uFF0C\u4E25\u683C\u6062\u590D\u987B\u6682\u505C\u5199\u5165/\u6E05\u7406\u6216\u4F7F\u7528\u539F\u751F\u5907\u4EFD\uFF0C\u5728\u72EC\u7ACB\u73AF\u5883\u6838\u9A8C\u6062\u590D\u3002
 
@@ -2087,7 +2095,7 @@ CLI \u5728\u6839\u76EE\u5F55 .env.dev\u3001.env.test\u3001.env.prod \u4E2D\u4E3A
 
 \u672C\u5730\u5F00\u53D1\u9ED8\u8BA4 \`PUBLIC_API_BASE=http://127.0.0.1:3000\`\uFF0CVite \u4F7F\u7528\u540C\u6E90\u4EE3\u7406\uFF1B\u90E8\u7F72\u65F6\u6539\u4E3A\u5B9E\u9645\u516C\u7F51 API Origin\uFF0CAndroid \u6A21\u62DF\u5668\u8BBF\u95EE\u5BBF\u4E3B\u673A\u65F6\u4F7F\u7528 \`http://10.0.2.2:3000\`\u3002\u4E0D\u8981\u5C06\u5BC6\u94A5\u653E\u5165\u4EFB\u4F55 \`PUBLIC_\` \u6216 \`VITE_\` \u53D8\u91CF\u3002
 
-\u670D\u52A1\u7AEF\u7248\u672C\u5316\u4F20\u8F93\u5BC6\u94A5\u73AF\u5728\u521B\u5EFA\u65F6\u5206\u522B\u5199\u5165 \`.env.dev\`\u3001\`.env.test\`\u3001\`.env.prod\`\uFF0C\u53D8\u91CF\u4E3A \`HAI_CRYPTO_TRANSPORT_SERVERKEYRING\`\uFF0C\u5404\u73AF\u5883\u5BC6\u94A5\u4E0D\u540C\uFF1B\u8FD0\u884C\u65F6\u4E0D\u751F\u6210\u5BC6\u94A5\u3002\u540C\u4E00\u73AF\u5883\u7684\u6240\u6709\u8282\u70B9\u4F7F\u7528\u540C\u4E00 ring \u548C\u5171\u4EAB registry\uFF0C\u4E5F\u53EF\u901A\u8FC7\u8FDB\u7A0B\u73AF\u5883\u6216 Secret Manager \u8986\u76D6\u3002\u79C1\u94A5\u4E0D\u8FDB\u5165 PUBLIC_/VITE_\u3001\u65E5\u5FD7\u6216\u6D4F\u89C8\u5668\u3002
+\u670D\u52A1\u7AEF\u7248\u672C\u5316\u4F20\u8F93\u5BC6\u94A5\u73AF\u5728\u521B\u5EFA\u65F6\u5206\u522B\u5199\u5165\u4E0D\u63D0\u4EA4 Git \u7684 \`.env.dev.local\`\u3001\`.env.test.local\`\u3001\`.env.prod.local\`\uFF0C\u53D8\u91CF\u4E3A \`HAI_CRYPTO_TRANSPORT_SERVERKEYRING\`\uFF0C\u5404\u73AF\u5883\u5BC6\u94A5\u4E0D\u540C\uFF1B\u8FD0\u884C\u65F6\u4E0D\u751F\u6210\u5BC6\u94A5\u3002\u540C\u4E00\u73AF\u5883\u7684\u6240\u6709\u8282\u70B9\u4F7F\u7528\u540C\u4E00 ring \u548C\u5171\u4EAB registry\uFF0C\u4E5F\u53EF\u901A\u8FC7\u8FDB\u7A0B\u73AF\u5883\u6216 Secret Manager \u8986\u76D6\u3002\u79C1\u94A5\u4E0D\u8FDB\u5165 PUBLIC_/VITE_\u3001\u65E5\u5FD7\u6216\u6D4F\u89C8\u5668\u3002
 
 \u6240\u6709\u4E1A\u52A1 JSON \u8BF7\u6C42\u548C\u54CD\u5E94\u9ED8\u8BA4\u901A\u8FC7 \`@h-ai/crypto\` transport \u53CC\u5411\u52A0\u5BC6\uFF08\u542B\u767B\u5F55\u3001\u5237\u65B0\u3001\u5934\u50CF\u4E0A\u4F20\uFF09\uFF1B\u524D\u7AEF\u7EDF\u4E00\u4F7F\u7528\u5171\u4EAB typed API client\u3002Web \u8BBF\u95EE\u4EE4\u724C\u4EC5\u5B58\u5185\u5B58\u3001\u5237\u65B0\u4EE4\u724C\u7531 HttpOnly Cookie \u4FDD\u5B58\uFF1B\u53D7\u4FE1\u539F\u751F\u7AEF\u4F7F\u7528\u5E73\u53F0\u5B89\u5168\u5B58\u50A8\u6216\u5185\u5B58\u3002\u5934\u50CF\u4E3A\u968F\u673A\u8DEF\u5F84\u53EA\u8BFB\u56FE\u7247\u8D44\u6E90\uFF0C\u652F\u6301 PNG/JPEG/WebP\uFF0C\u6700\u5927 512 KiB\u3002\u5065\u5EB7\u68C0\u67E5\u548C\u53EA\u8BFB\u5934\u50CF\u56FE\u7247\u53EF\u76F4\u63A5\u8BBF\u95EE\u3002
 
@@ -2332,7 +2340,7 @@ async function addModule(options) {
       writeCliMessage(cliM("cli_addAvailableModules", { params: { modules: Object.keys(MODULE_MAP).join(", ") } }));
       return;
     }
-    const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-VV2XWYON.js');
+    const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-S2YH642Z.js');
     if (moduleDef.packages.every((p) => project.haiPackages.includes(p))) {
       if (moduleName === "deploy")
         await ensureDeployConfig(cwd);
@@ -2454,7 +2462,7 @@ ${production.join("\n")}`);
   }
 }
 async function buildMobileApp(root, directories, platform, run2) {
-  if (!directories.length || platform === "ios" && process4.platform !== "darwin")
+  if (!directories.length || platform === "ios" && process5.platform !== "darwin")
     throw new Error(cliM("cli_build_app_platform"));
   const outputs = [];
   for (const item of directories) {
@@ -2492,31 +2500,240 @@ async function buildMobileApp(root, directories, platform, run2) {
   }
   return outputs;
 }
+function object(value) {
+  if (value === void 0)
+    return {};
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(cliM("cli_download_invalid"));
+  return value;
+}
+function registryUrl(value) {
+  try {
+    if (typeof value !== "string")
+      throw new Error("Missing registry");
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+      throw new Error("Invalid registry");
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    throw new Error(cliM("cli_download_invalid"));
+  }
+}
+async function resolveBuildDownloads(directory, options) {
+  const path10 = projectConfigPath(directory);
+  const project = readProjectConfig(path10);
+  const build = object(project.build);
+  const sources = object(build.sources);
+  const savedImage = object(sources.image);
+  const savedNpm = object(sources.npm);
+  const savedProxy = object(build.proxy);
+  const interactive = !!process5.stdin.isTTY && !options.yes;
+  const choose = async (message, values) => {
+    const answer = await prompts({ type: "select", name: "value", message, choices: values.map((value) => ({ title: cliM(`cli_download_${value}`), value })) });
+    if (typeof answer.value !== "string")
+      throw new Error(cliM("cli_deploy_cancelled"));
+    return answer.value;
+  };
+  const mirrorEntries = options.imageMirrors?.split(",").map((entry) => {
+    const separator = entry.indexOf("=");
+    if (separator <= 0 || separator === entry.length - 1)
+      throw new Error(cliM("cli_download_invalid"));
+    return [entry.slice(0, separator).trim(), entry.slice(separator + 1).trim()];
+  });
+  if (mirrorEntries && new Set(mirrorEntries.map(([key]) => key)).size !== mirrorEntries.length)
+    throw new Error(cliM("cli_download_invalid"));
+  let imageType = options.imageSource ?? (mirrorEntries ? "custom" : savedImage.type);
+  let npmType = options.npmSource ?? (options.npmRegistry ? "custom" : savedNpm.type);
+  const saveImage = imageType === void 0 && interactive;
+  const saveNpm = npmType === void 0 && interactive;
+  if (saveImage)
+    imageType = await choose(cliM("cli_download_choose_image"), ["official", "cn", "custom"]);
+  if (saveNpm)
+    npmType = await choose(cliM("cli_download_choose_npm"), ["official", "cn", "custom"]);
+  imageType ??= "official";
+  npmType ??= "official";
+  if (typeof imageType !== "string" || !["official", "cn", "custom"].includes(imageType) || typeof npmType !== "string" || !["official", "cn", "custom"].includes(npmType))
+    throw new Error(cliM("cli_download_invalid"));
+  let registries = mirrorEntries ? Object.fromEntries(mirrorEntries) : savedImage.registries;
+  if (imageType === "custom" && !registries && interactive) {
+    const answer = await prompts({ type: "text", name: "value", message: cliM("cli_download_image_mirrors") });
+    if (typeof answer.value !== "string" || !answer.value.trim())
+      throw new Error(cliM("cli_deploy_cancelled"));
+    registries = Object.fromEntries(answer.value.split(",").map((entry) => {
+      const index = entry.indexOf("=");
+      if (index <= 0)
+        throw new Error(cliM("cli_download_invalid"));
+      return [entry.slice(0, index).trim(), entry.slice(index + 1).trim()];
+    }));
+  }
+  const mappings = registries === void 0 ? void 0 : object(registries);
+  if (mappings && Object.entries(mappings).some(([key, value]) => !/^[\w.-]+(?::\d+)?$/.test(key) || typeof value !== "string"))
+    throw new Error(cliM("cli_download_invalid"));
+  const imageSource = { type: imageType, ...imageType === "custom" ? { registries: mappings } : {} };
+  if (mirrorEntries && imageType !== "custom")
+    throw new Error(cliM("cli_download_invalid"));
+  if (imageType === "custom") {
+    if (!mappings || !Object.keys(mappings).length)
+      throw new Error(cliM("cli_download_invalid"));
+    for (const key of Object.keys(mappings)) resolveImageReference(`${key}/hai-source-check:1`, imageSource);
+  }
+  let customRegistry = options.npmRegistry ?? savedNpm.registry;
+  if (npmType === "custom" && !customRegistry && interactive) {
+    const answer = await prompts({ type: "text", name: "value", message: cliM("cli_download_npm_registry") });
+    if (typeof answer.value !== "string" || !answer.value.trim())
+      throw new Error(cliM("cli_deploy_cancelled"));
+    customRegistry = answer.value;
+  }
+  if (options.npmRegistry && npmType !== "custom")
+    throw new Error(cliM("cli_download_invalid"));
+  const npmRegistry = npmType === "cn" ? "https://registry.npmmirror.com" : npmType === "official" ? "https://registry.npmjs.org" : registryUrl(customRegistry);
+  const npmSource = { type: npmType, ...npmType === "custom" ? { registry: npmRegistry } : {} };
+  let proxyMode = options.proxyMode ?? (options.proxyUrl ? "custom" : savedProxy.mode);
+  const saveProxy = proxyMode === void 0 && interactive && options.httpProxy !== false;
+  if (saveProxy)
+    proxyMode = await choose(cliM("cli_download_choose_proxy"), ["inherit", "system", "custom", "none"]);
+  proxyMode ??= "inherit";
+  if (options.proxyUrl !== void 0 && proxyMode !== "custom")
+    throw new Error(cliM("cli_download_invalid"));
+  if (typeof proxyMode !== "string" || !["inherit", "system", "custom", "none"].includes(proxyMode))
+    throw new Error(cliM("cli_download_invalid"));
+  if (options.httpProxy === false && (options.proxyUrl !== void 0 || options.proxyMode !== void 0 && options.proxyMode !== "none"))
+    throw new Error(cliM("cli_download_invalid"));
+  let proxyUrl = options.proxyUrl ?? savedProxy.url;
+  if (proxyMode === "custom" && !proxyUrl && interactive) {
+    const answer = await prompts({ type: "text", name: "value", message: cliM("cli_download_proxy_url") });
+    if (typeof answer.value !== "string" || !answer.value.trim())
+      throw new Error(cliM("cli_deploy_cancelled"));
+    proxyUrl = answer.value;
+  }
+  const bypass = options.proxyBypass ?? savedProxy.bypass;
+  if (proxyUrl !== void 0 && typeof proxyUrl !== "string" || bypass !== void 0 && typeof bypass !== "string")
+    throw new Error(cliM("cli_download_invalid"));
+  const proxy = { mode: options.httpProxy === false ? "none" : proxyMode, ...proxyMode === "custom" && options.httpProxy !== false ? { url: proxyUrl } : {}, ...bypass !== void 0 ? { bypass } : {} };
+  resolveDownloadProxy(proxy);
+  if (saveImage || saveNpm || saveProxy) {
+    project.build = { ...build, sources: { ...sources, ...saveImage ? { image: imageSource } : {}, ...saveNpm ? { npm: npmSource } : {} }, ...saveProxy ? { proxy } : {} };
+    writeFileSync(path10, `${JSON.stringify(project, null, 2)}
+`);
+  }
+  return { imageSource, npmRegistry, npmSource, proxy };
+}
+function buildProxyArguments(proxy, runtime, network) {
+  const environment = resolveDownloadProxy(proxy);
+  for (const key of ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "ALL_PROXY", "all_proxy"]) {
+    if (!environment[key])
+      continue;
+    const url = new URL(environment[key]);
+    if (network !== "host" && (runtime === "docker" || network !== void 0) && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+      url.hostname = runtime === "podman" ? "host.containers.internal" : "host.docker.internal";
+      environment[key] = url.toString().replace(/\/$/, "");
+    }
+  }
+  return Object.entries(environment).flatMap(([key, value]) => ["--build-arg", `${key}=${value}`]);
+}
+async function preflightDownloadProxy(runtime, proxy) {
+  const environment = resolveDownloadProxy(proxy);
+  for (const value of new Set([environment.HTTP_PROXY, environment.HTTPS_PROXY].filter(Boolean))) {
+    const url = new URL(value);
+    await new Promise((resolve7, reject) => {
+      const socket = connect({ host: url.hostname.replace(/^\[|\]$/g, ""), port: Number(url.port || (url.protocol === "https:" ? 443 : 80)) });
+      socket.setTimeout(3e3);
+      socket.once("connect", () => {
+        socket.destroy();
+        resolve7();
+      });
+      const fail = () => {
+        socket.destroy();
+        reject(new Error(cliM("cli_download_proxy_unreachable")));
+      };
+      socket.once("error", fail);
+      socket.once("timeout", fail);
+    });
+  }
+  if (!environment.HTTP_PROXY && !environment.HTTPS_PROXY)
+    return;
+  for (const candidate of runtime === "auto" ? ["podman", "docker"] : [runtime]) {
+    try {
+      const data = JSON.parse(execFileSync(candidate, ["info", "--format", "{{json .}}"], { encoding: "utf8", windowsHide: true, timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }));
+      writeCliMessage(cliM(candidate === "docker" && (data.HTTPProxy || data.HTTPSProxy) ? "cli_download_engine_proxy_configured" : candidate === "podman" && !data.host?.serviceIsRemote ? "cli_download_engine_proxy_local" : "cli_download_engine_proxy_hint", { params: { runtime: candidate } }));
+      return;
+    } catch {
+    }
+  }
+  writeCliMessage(cliM("cli_download_engine_proxy_hint", { params: { runtime } }));
+}
+function validateDownloadDockerfile(file, downloads) {
+  const content = readFileSync(file, "utf8");
+  if (downloads.imageSource.type !== "official" && !/^ARG HAI_NODE_IMAGE=/m.test(content) || downloads.npmSource.type !== "official" && !/^ARG HAI_NPM_REGISTRY[=\s]/m.test(content)) {
+    throw new Error(cliM("cli_download_template_required", { params: { path: file } }));
+  }
+}
+function createWindowsBuildOutput() {
+  const decoder = new StringDecoder("utf8");
+  let previousCarriageReturn = false;
+  const normalize = (value) => {
+    const result = value.replace(/\n/g, (newline, offset) => (offset === 0 ? previousCarriageReturn : value[offset - 1] === "\r") ? newline : "\r\n");
+    if (value.length)
+      previousCarriageReturn = value.endsWith("\r");
+    return result;
+  };
+  return new Transform({
+    transform(chunk, _encoding, callback) {
+      callback(null, normalize(decoder.write(chunk)));
+    },
+    flush(callback) {
+      callback(null, normalize(decoder.end()));
+    }
+  });
+}
+async function forwardWindowsBuildOutput(source, destination) {
+  const forwarding = new Writable({
+    write(chunk, encoding, callback) {
+      destination.write(chunk, encoding, callback);
+    }
+  });
+  await pipeline(source, createWindowsBuildOutput(), forwarding);
+}
 
 // src/commands/cli-build.ts
 async function run(command, args, cwd, quiet = false, identity, compileEnvironment) {
   await new Promise((resolve7, reject) => {
-    const env = Object.fromEntries(Object.entries(process4.env).filter(([key]) => !/^(?:HAI_|PUBLIC_|VITE_)/.test(key)));
+    const env = Object.fromEntries(Object.entries(process5.env).filter(([key]) => !/^(?:HAI_|PUBLIC_|VITE_)/.test(key)));
     Object.assign(env, compileEnvironment);
     if (identity) {
       env.HAI_BUILD_ID = identity.buildId;
       env.HAI_BUILD_COMMIT = identity.commit;
     }
     env.NODE_ENV = "production";
+    if (process5.platform === "win32") {
+      env.npm_config_reporter = "append-only";
+      env.pnpm_config_reporter = "append-only";
+    }
     delete env.CAPACITOR_SERVER_URL;
     if (env.CI === "1" || env.CI === "0")
       env.CI = env.CI === "1" ? "true" : "false";
-    const child = spawn(command, args, { cwd, env, windowsHide: true, stdio: quiet ? "ignore" : "inherit", shell: false });
+    const windowsOutput = !quiet && process5.platform === "win32";
+    const child = spawn(command, args, { cwd, env, windowsHide: true, stdio: quiet ? "ignore" : windowsOutput ? ["inherit", "pipe", "pipe"] : "inherit", shell: false });
+    let output = Promise.resolve();
+    if (windowsOutput && child.stdout && child.stderr) {
+      output = Promise.all([
+        forwardWindowsBuildOutput(child.stdout, process5.stdout),
+        forwardWindowsBuildOutput(child.stderr, process5.stderr)
+      ]).then(() => void 0);
+      void output.catch(() => child.kill());
+    }
     child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? resolve7() : reject(new Error(cliM("cli_build_failed", { params: { command, code: String(code) } }))));
+    child.once(windowsOutput && child.stdout && child.stderr ? "close" : "exit", (code) => {
+      void output.then(() => code === 0 ? resolve7() : reject(new Error(cliM("cli_build_failed", { params: { command, code: String(code) } }))), reject);
+    });
   });
 }
 async function pnpm(args, cwd, identity, compileEnvironment) {
-  const entry = process4.env.npm_execpath;
+  const entry = process5.env.npm_execpath;
   if (entry && /(?:^|[/\\])pnpm(?:-native)?(?:\.exe|\.[cm]?js)?$/i.test(entry))
-    return /\.[cm]?js$/i.test(entry) ? run(process4.execPath, [entry, ...args], cwd, false, identity, compileEnvironment) : run(entry, args, cwd, false, identity, compileEnvironment);
-  if (process4.platform === "win32") {
-    const directories = (process4.env.PATH ?? "").split(";");
+    return /\.[cm]?js$/i.test(entry) ? run(process5.execPath, [entry, ...args], cwd, false, identity, compileEnvironment) : run(entry, args, cwd, false, identity, compileEnvironment);
+  if (process5.platform === "win32") {
+    const directories = (process5.env.PATH ?? "").split(";");
     for (const directory of directories) {
       const executable = join(directory, "pnpm.exe");
       if (existsSync(executable))
@@ -2524,7 +2741,7 @@ async function pnpm(args, cwd, identity, compileEnvironment) {
       for (const relative4 of ["node_modules/pnpm/bin/pnpm.cjs", "pnpm.cjs"]) {
         const candidate = join(directory, relative4);
         if (existsSync(candidate))
-          return run(process4.execPath, [candidate, ...args], cwd, false, identity, compileEnvironment);
+          return run(process5.execPath, [candidate, ...args], cwd, false, identity, compileEnvironment);
       }
     }
     throw new Error(cliM("cli_build_use_pnpm"));
@@ -2532,8 +2749,8 @@ async function pnpm(args, cwd, identity, compileEnvironment) {
   return run("pnpm", args, cwd, false, identity, compileEnvironment);
 }
 function staticCompileEnvironment(target) {
-  const flag = process4.env.HAI_BUILD_STATIC;
-  const base = process4.env.PUBLIC_BASE_PATH;
+  const flag = process5.env.HAI_BUILD_STATIC;
+  const base = process5.env.PUBLIC_BASE_PATH;
   if (flag !== void 0 && flag !== "" && flag !== "0" && flag !== "1")
     throw new Error(cliM("cli_build_static_flag"));
   if (base && (!/^\/[\w.-]+(?:\/[\w.-]+)*$/.test(base) || base.split("/").some((segment) => segment === "." || segment === "..")))
@@ -2560,7 +2777,7 @@ function sourceCommit(cwd) {
   }
 }
 async function buildCommand(options) {
-  const directory = resolve(options.cwd ?? process4.cwd());
+  const directory = resolve(options.cwd ?? process5.cwd());
   const target = options.target ?? "compile";
   const concurrency = Number(options.concurrency ?? 2);
   if (![1, 2].includes(concurrency))
@@ -2569,7 +2786,7 @@ async function buildCommand(options) {
   if (!["compile", "image", "desktop", "app"].includes(target))
     throw new Error(cliM("cli_build_target_invalid"));
   const compileEnvironment = staticCompileEnvironment(target);
-  if (target !== "image" && (options.images !== void 0 || options.concurrency !== void 0 || options.runtime !== void 0 || options.network !== void 0 || options.sqlitePrebuildMirror !== void 0 || options.httpProxy === false) || !["desktop", "app"].includes(target) && (options.platform !== void 0 || options.arch !== void 0) || target === "app" && options.arch !== void 0) {
+  if (target !== "image" && (options.images !== void 0 || options.concurrency !== void 0 || options.runtime !== void 0 || options.network !== void 0 || options.sqlitePrebuildMirror !== void 0 || options.httpProxy === false || options.imageSource !== void 0 || options.imageMirrors !== void 0 || options.npmSource !== void 0 || options.npmRegistry !== void 0 || options.proxyMode !== void 0 || options.proxyUrl !== void 0 || options.proxyBypass !== void 0) || !["desktop", "app"].includes(target) && (options.platform !== void 0 || options.arch !== void 0) || target === "app" && options.arch !== void 0) {
     throw new Error(cliM("cli_build_options_invalid"));
   }
   if (target === "compile") {
@@ -2592,9 +2809,9 @@ async function buildCommand(options) {
   }
   if (target === "desktop") {
     const platforms = { win32: "windows", linux: "linux", darwin: "macos" };
-    const host = platforms[process4.platform];
+    const host = platforms[process5.platform];
     const platform = options.platform ?? host;
-    const arch = options.arch ?? process4.arch;
+    const arch = options.arch ?? process5.arch;
     if (!platform || platform !== host || !["x64", "arm64"].includes(arch))
       throw new Error(cliM("cli_build_native_host"));
     if (!config.desktop?.length)
@@ -2624,6 +2841,8 @@ async function buildCommand(options) {
     if (!existsSync(resolve(cwd, image.dockerfile)))
       throw new Error(cliM("cli_build_dockerfile_missing", { params: { path: image.dockerfile } }));
   }
+  const downloads = await resolveBuildDownloads(cwd, options);
+  for (const image of images) validateDownloadDockerfile(resolve(cwd, image.dockerfile), downloads);
   const candidates = options.runtime && options.runtime !== "auto" ? [options.runtime] : ["podman", "docker"];
   if (candidates.some((runtime2) => !["podman", "docker"].includes(runtime2)))
     throw new Error(cliM("cli_build_runtime_missing"));
@@ -2638,6 +2857,7 @@ async function buildCommand(options) {
   }
   if (!runtime)
     throw new Error(cliM("cli_build_runtime_missing"));
+  await preflightDownloadProxy(runtime, downloads.proxy);
   if (options.sqlitePrebuildMirror) {
     const url = new URL(options.sqlitePrebuildMirror);
     if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
@@ -2667,8 +2887,8 @@ async function buildCommand(options) {
       const context = resolve(cwd, image.context ?? ".");
       const imageRef = `localhost/hai-${projectName}-${image.name}:${buildId.toLowerCase().replaceAll("+", "_")}`;
       const args = ["build", "-f", resolve(cwd, image.dockerfile), "-t", imageRef];
-      const testRun = process4.env.HAI_TEST_IMAGE_RUN;
-      const testLedger = process4.env.HAI_TEST_IMAGE_LEDGER;
+      const testRun = process5.env.HAI_TEST_IMAGE_RUN;
+      const testLedger = process5.env.HAI_TEST_IMAGE_LEDGER;
       if (testLedger && /^[a-f0-9-]{36}$/.test(testRun ?? "")) {
         const label = `org.h-ai.test.image-run=${testRun}`;
         args.push("--label", label);
@@ -2678,19 +2898,19 @@ async function buildCommand(options) {
 `);
       }
       args.push("--build-arg", `HAI_BUILD_ID=${buildId}`, "--build-arg", `HAI_BUILD_COMMIT=${commit}`);
+      const dockerfile = readFileSync(resolve(cwd, image.dockerfile), "utf8");
+      for (const match of dockerfile.matchAll(/^ARG (HAI_(?:NODE|NGINX)_IMAGE)=(\S+)\s*$/gm))
+        args.push("--build-arg", `${match[1]}=${resolveImageReference(match[2], downloads.imageSource)}`);
+      args.push("--build-arg", `HAI_NPM_REGISTRY=${downloads.npmRegistry}`, ...buildProxyArguments(downloads.proxy, runtime, options.network));
+      if (runtime === "docker" && process5.platform === "linux" && options.network !== "host")
+        args.push("--add-host", "host.docker.internal:host-gateway");
       if (options.network !== void 0)
         args.push("--network", options.network);
       const ignore = `${resolve(cwd, image.dockerfile)}.dockerignore`;
       if (runtime === "podman" && existsSync(ignore))
         args.push("--ignorefile", ignore);
       if (runtime === "podman") {
-        args.push("--format", "docker", "--jobs", "1", ...options.httpProxy === false ? ["--http-proxy=false"] : []);
-        if (options.httpProxy !== false) {
-          for (const key of ["HTTP_PROXY", "HTTPS_PROXY", "FTP_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "ftp_proxy", "no_proxy"]) {
-            if (process4.env[key])
-              args.push("--build-arg", `${key}=${process4.env[key]}`);
-          }
-        }
+        args.push("--format", "docker", "--jobs", "1", ...downloads.proxy.mode === "none" ? ["--http-proxy=false"] : []);
       }
       if (options.sqlitePrebuildMirror)
         args.push("--build-arg", `SQLITE_PREBUILD_MIRROR=${options.sqlitePrebuildMirror}`);
@@ -2772,7 +2992,7 @@ function prepareDependencyInputs(cwd) {
 async function deploySecretsCommand(directory, options) {
   if (!options.import || !["docker", "podman"].includes(options.runtime ?? "docker"))
     throw new Error(cliM("cli_deploy_secrets_options"));
-  const cwd = resolve(options.cwd ?? process4.cwd());
+  const cwd = resolve(options.cwd ?? process5.cwd());
   const local = createRequire(resolve(cwd, "package.json"));
   let module;
   try {
@@ -2788,237 +3008,12 @@ ${JSON.stringify({ phase: context?.phase, state: context?.state })}`);
   }
   writeCliMessage(JSON.stringify(result.data, null, 2));
 }
-
-// ../reldb/dist/chunk-SDS2ZT3V.js
-external_exports.enum(["sqlite", "postgresql", "mysql"]);
-var ReldbOperationLogConfigSchema = external_exports.object({
-  read: external_exports.boolean().default(false),
-  write: external_exports.boolean().default(false),
-  /** 安全数量摘要的最大字符数；0 表示省略摘要，永不记录 SQL 原文或参数值。 */
-  maxLength: external_exports.number().int().min(0).default(1e3),
-  level: external_exports.enum(["info", "debug", "trace"]).default("debug")
-});
-var OperationLogConfigFieldSchema = {
-  operationLog: ReldbOperationLogConfigSchema.optional()
-};
-var PoolConfigSchema = external_exports.object({
-  /** PostgreSQL 已建立连接的最小保留数（默认 1，不主动预建） */
-  min: external_exports.number().int().min(0).default(1),
-  /** 最大连接数（默认 10） */
-  max: external_exports.number().int().min(1).default(10),
-  /** PostgreSQL 空闲连接超时，毫秒（默认 30000；0 禁用） */
-  idleTimeout: external_exports.number().int().min(0).default(3e4),
-  /** 获取连接超时，毫秒（默认10000）；PostgreSQL >=0，0禁用；MySQL排队+建连总期限为1–2147483647 */
-  acquireTimeout: external_exports.number().int().min(0).default(1e4)
-});
-var MysqlPoolConfigSchema = external_exports.object({
-  /** 最大连接数（默认 10） */
-  max: external_exports.number().int().min(1).default(10),
-  /** 获取连接超时，毫秒（默认10000）；PostgreSQL >=0，0禁用；MySQL排队+建连总期限为1–2147483647 */
-  acquireTimeout: external_exports.number().int().min(1).max(2147483647).default(1e4),
-  /** MySQL 等待队列最大请求数（默认 1000；正整数，不支持无限队列） */
-  queueLimit: external_exports.number().int().min(1).default(1e3)
-}).strict();
-var SslConfigSchema = external_exports.union([
-  external_exports.boolean(),
-  external_exports.enum(["require", "prefer", "allow", "disable"]),
-  external_exports.record(external_exports.string(), external_exports.unknown())
-]);
-var MysqlSslConfigSchema = external_exports.union([
-  external_exports.literal(false),
-  external_exports.object({
-    /** MySQL 是否校验证书链（默认 true）；false 明确放弃服务端认证 */
-    rejectUnauthorized: external_exports.boolean().default(true),
-    /** MySQL 是否验证 DNS 主机身份（默认 true）；仅证书链验证开启时有效 */
-    verifyIdentity: external_exports.boolean().default(true),
-    /** MySQL 信任的 CA，PEM 内容；省略时使用 Node 信任库 */
-    ca: external_exports.string().min(1).optional(),
-    /** MySQL 客户端证书，PEM 内容；必须同时提供 key */
-    cert: external_exports.string().min(1).optional(),
-    /** MySQL 客户端私钥，PEM 内容；必须同时提供 cert */
-    key: external_exports.string().min(1).optional()
-  }).strict().refine((ssl) => Boolean(ssl.cert) === Boolean(ssl.key), { path: ["key"] })
-]);
-var SqliteOptionsSchema = external_exports.object({
-  /** 是否启用 WAL 模式（默认 true），可提高并发读写性能 */
-  walMode: external_exports.boolean().default(true),
-  /** 是否只读模式（默认 false） */
-  readonly: external_exports.boolean().default(false),
-  /**
-   * 执行方式（默认 sync）。
-   *
-   * - `sync`：主线程直接执行 better-sqlite3（同步阻塞主线程事件循环）。
-   * - `worker`：在专用 worker 线程持有唯一连接执行，把阻塞移出主线程。
-   *   注意 WAL 只改善数据库锁并发，无法避免 better-sqlite3 同步调用占用调用线程。
-   */
-  executor: external_exports.enum(["sync", "worker"]).default("sync"),
-  /** worker 执行方式下等待连接打开的超时（毫秒，默认 10000） */
-  workerConnectTimeoutMs: external_exports.number().int().positive().default(1e4)
-});
-var MysqlOptionsSchema = external_exports.object({
-  /** 字符集（默认 utf8mb4），推荐使用 utf8mb4 支持完整 Unicode */
-  charset: external_exports.string().default("utf8mb4")
-}).strict();
-var NetworkConfigSchema = external_exports.object({
-  /**
-   * 连接字符串（可选）
-   * 如果提供 url，将优先使用，忽略 host/port 等字段
-   */
-  url: external_exports.string().optional(),
-  /** 数据库主机地址（默认 localhost） */
-  host: external_exports.string().default("localhost"),
-  /**
-   * 数据库端口
-   * - PostgreSQL 默认 5432
-   * - MySQL 默认 3306
-   */
-  port: external_exports.number().int().min(1).max(65535).optional(),
-  /** 数据库名称 */
-  database: external_exports.string(),
-  /** 数据库用户名 */
-  user: external_exports.string().optional(),
-  /** 数据库密码 */
-  password: external_exports.string().optional(),
-  /** SSL/TLS 连接配置 */
-  ssl: SslConfigSchema.optional(),
-  /** 连接池配置 */
-  pool: PoolConfigSchema.optional()
-});
-var SqliteConfigSchema = external_exports.object({
-  type: external_exports.literal("sqlite"),
-  /** 数据库文件路径（如 './data.db'）或 ':memory:'（内存数据库） */
-  database: external_exports.string(),
-  /** SQLite 特定选项 */
-  sqlite: SqliteOptionsSchema.optional(),
-  ...OperationLogConfigFieldSchema
-});
-var PostgresqlConfigSchema = NetworkConfigSchema.extend({
-  type: external_exports.literal("postgresql"),
-  ...OperationLogConfigFieldSchema
-});
-var MysqlConfigSchema = NetworkConfigSchema.extend({
-  type: external_exports.literal("mysql"),
-  /** 网络数据库URL；MySQL空串表示使用分字段，非空仅mysql://且拒绝query/fragment，优先于host/port/database/user/password */
-  url: external_exports.union([external_exports.literal("").transform(() => void 0), external_exports.url({ protocol: /^mysql$/ }).refine((value) => !value.includes("?") && !value.includes("#"))]).optional(),
-  /** 数据库：SQLite文件路径或:memory:；PostgreSQL必填名称；MySQL无URL时必填，URL模式从URL读取 */
-  database: external_exports.string().min(1).optional(),
-  /** TLS：PostgreSQL使用其模式；MySQL仅false或严格对象，空对象默认校验证书链和DNS身份 */
-  ssl: MysqlSslConfigSchema.optional(),
-  /** 连接池配置：PostgreSQL支持min/idleTimeout；MySQL仅max/acquireTimeout/queueLimit，拒绝其他字段 */
-  pool: MysqlPoolConfigSchema.optional(),
-  /** MySQL 特定选项 */
-  mysql: MysqlOptionsSchema.optional(),
-  ...OperationLogConfigFieldSchema
-}).refine((config) => Boolean(config.url) || Boolean(config.database), { path: ["database"] });
-var ReldbConfigSchema = external_exports.discriminatedUnion("type", [
-  SqliteConfigSchema,
-  PostgresqlConfigSchema,
-  MysqlConfigSchema
-]);
-var CLOUD_FIELDS = {
-  "neon": ["apiKey"],
-  "upstash": ["email", "apiKey"],
-  "cloudflare-r2": ["accountId", "apiToken", "accessKeyId", "secretAccessKey"],
-  "resend": ["apiKey", "from"],
-  "aliyun": ["accessKeyId", "accessKeySecret", "signName"]
-};
-function targetConfig(requirement, environment) {
-  const result = {};
-  const parent = environment.targetValues[requirement.envPrefix];
-  if (parent) {
-    try {
-      Object.assign(result, JSON.parse(parent));
-    } catch {
-      return {};
-    }
-  }
-  for (const [key, value] of Object.entries(environment.targetValues)) {
-    if (key.startsWith(`${requirement.envPrefix}_`))
-      result[key.slice(requirement.envPrefix.length + 1).toLowerCase()] = value;
-  }
-  return result;
-}
-function canKeepMiddleware(requirement, backend, environment) {
-  const target = targetConfig(requirement, environment);
-  if (requirement.service === "ldap" && backend.backend === "disabled")
-    return environment.targetValues.HAI_IAM_LOGIN_LDAP === "false";
-  if (requirement.service === "ldap") {
-    if (!Object.keys(target).length)
-      return false;
-  } else if (target.type !== backend.backend) {
-    return false;
-  }
-  return backend.fields.filter((field) => field.required && !field.secret).every((field) => {
-    if ((target.url || requirement.config.url && Object.keys(target).length) && ["host", "port"].includes(field.name))
-      return true;
-    return target[field.name] !== void 0 && target[field.name] !== "" || target[field.name.toLowerCase()] !== void 0 && target[field.name.toLowerCase()] !== "";
-  }) && backend.fields.filter((field) => field.required && field.secret).every((field) => Boolean(requirement.config[field.name] || environment.values[`${requirement.envPrefix}_${field.name.toUpperCase()}`]));
-}
 async function ask(question) {
   const answer = await prompts({ ...question, name: "value" });
   if (answer.value === void 0)
     throw new Error(cliM("cli_deploy_cancelled"));
   return answer.value;
 }
-function validateField(value, field, backend) {
-  if (value === "")
-    return field.required ? cliM("cli_deploy_required") : true;
-  if (field.kind === "port")
-    return /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 || cliM("cli_deploy_invalid_value");
-  if (field.kind === "number")
-    return /^\d+$/.test(value) && Number(value) >= (field.minimum ?? 0) && Number(value) <= (field.maximum ?? Number.MAX_SAFE_INTEGER) || cliM("cli_deploy_invalid_value");
-  if (field.kind === "boolean")
-    return ["true", "false"].includes(value) || cliM("cli_deploy_invalid_value");
-  if (field.kind === "url") {
-    try {
-      return Boolean(new URL(value).protocol);
-    } catch {
-      return cliM("cli_deploy_invalid_value");
-    }
-  }
-  if (field.name === "ssl") {
-    const parsed2 = parseDocument(value);
-    const schema = backend === "mysql" ? MysqlSslConfigSchema : SslConfigSchema;
-    return parsed2.errors.length === 0 && schema.safeParse(parsed2.toJS()).success || cliM("cli_deploy_invalid_value");
-  }
-  if (field.name === "headers") {
-    try {
-      const headers = JSON.parse(value);
-      return headers !== null && typeof headers === "object" && !Array.isArray(headers) && Object.values(headers).every((item) => typeof item === "string") || cliM("cli_deploy_invalid_value");
-    } catch {
-      return cliM("cli_deploy_invalid_value");
-    }
-  }
-  if (field.name === "method")
-    return ["POST", "PUT"].includes(value) || cliM("cli_deploy_invalid_value");
-  return true;
-}
-function ensureConfigNode(appDir, requirement, backend) {
-  if (requirement.service === "ldap" && backend === "disabled")
-    return;
-  const directory = join(appDir, "config");
-  mkdirSync(directory, { recursive: true });
-  const path10 = join(directory, `_${requirement.configName}.yml`);
-  const document = parseDocument(existsSync(path10) ? readFileSync(path10, "utf8") : "{}\n");
-  if (document.errors.length)
-    throw new Error(cliM("cli_deploy_invalid_value"));
-  if (requirement.configPath.length && !document.hasIn(requirement.configPath))
-    document.setIn(requirement.configPath, document.createNode(requirement.configName === "reach" ? { name: requirement.config.name ?? requirement.service, type: backend } : {}));
-  if (requirement.service === "ldap") {
-    if (!document.hasIn(["login"]))
-      document.set("login", document.createNode({}));
-    if (!document.hasIn(["login", "ldap"]))
-      document.setIn(["login", "ldap"], `\${HAI_IAM_LOGIN_LDAP:false}`);
-  }
-  const content = document.toString();
-  if (!existsSync(path10) || readFileSync(path10, "utf8") !== content)
-    writeFileSync(path10, content);
-}
-function connectionEnv(requirement, backend, config) {
-  if (requirement.service === "ldap")
-    return backend === "disabled" ? { HAI_IAM_LOGIN_LDAP: "false" } : { HAI_IAM_LOGIN_LDAP: "true", [requirement.envPrefix]: JSON.stringify(config) };
-  return { [requirement.envPrefix]: JSON.stringify({ ...config, type: backend }) };
-}
 async function configureDeployMiddleware(module, scan, environment, config, yes = false) {
   const modes = {};
   const services = {};
@@ -3030,7 +3025,7 @@ async function configureDeployMiddleware(module, scan, environment, config, yes
     if (!current)
       throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: requirement.backend } }));
     writeCliMessage(cliM("cli_deploy_middleware", { params: { service: requirement.service, backend: current.label, purpose: module.describeMiddlewareBackend(current), source: requirement.source } }));
-    const canKeep = canKeepMiddleware(requirement, current, environment);
+    const canKeep = module.canKeepMiddleware(requirement, current, environment);
     const mode = yes ? canKeep ? "keep" : "default" : await ask({
       type: "select",
       name: "value",
@@ -3055,22 +3050,23 @@ async function configureDeployMiddleware(module, scan, environment, config, yes
       throw new Error(cliM("cli_deploy_invalid_value"));
     requirement.backend = backendName;
     const updates = {};
-    if (mode === "default" && backendName === "s3" && provider?.type === "docker-ssh") {
+    let configuration;
+    for (const option of mode === "default" && provider?.type === "docker-ssh" ? backend.containerOptions ?? [] : []) {
       const container = config.container && typeof config.container === "object" ? config.container : {};
-      const currentEngine = container.s3Engine === "minio" ? "minio" : "rustfs";
-      const engine = yes ? currentEngine : String(await ask({ type: "select", name: "value", message: cliM("cli_deploy_s3_engine"), initial: currentEngine === "rustfs" ? 0 : 1, choices: [{ title: "RustFS", value: "rustfs" }, { title: "MinIO", value: "minio" }] }));
-      if (!["rustfs", "minio"].includes(engine))
+      const currentValue = String(container[option.field] ?? option.defaultValue);
+      const selected = yes ? currentValue : String(await ask({ type: "select", name: "value", message: module.describeMiddlewareBackend(option), initial: Math.max(0, option.choices.findIndex((item) => item.value === currentValue)), choices: option.choices.map((item) => ({ title: item.label, value: item.value })) }));
+      if (!option.choices.some((item) => item.value === selected))
         throw new Error(cliM("cli_deploy_invalid_value"));
-      config.container = { ...container, s3Engine: engine };
-      updates.HAI_DEPLOY_CONTAINER_S3ENGINE = engine;
+      config.container = { ...container, [option.field]: selected };
+      updates[option.variable] = selected;
       const deploymentFile = projectConfigPath(scan.appDir ?? environment.envDir);
       const project = readProjectConfig(deploymentFile);
       project.deploy ??= {};
       if (project.deploy.container != null && (typeof project.deploy.container !== "object" || Array.isArray(project.deploy.container)))
         throw new Error(cliM("cli_deploy_config_node", { params: { path: deploymentFile, field: "deploy.container" } }));
       project.deploy.container ??= {};
-      if (!("s3Engine" in project.deploy.container)) {
-        project.deploy.container.s3Engine = `\${HAI_DEPLOY_CONTAINER_S3ENGINE:rustfs}`;
+      if (!(option.field in project.deploy.container)) {
+        project.deploy.container[option.field] = `\${${option.variable}:${option.defaultValue}}`;
         writeFileSync(deploymentFile, `${JSON.stringify(project, null, 2)}
 `);
       }
@@ -3081,7 +3077,7 @@ async function configureDeployMiddleware(module, scan, environment, config, yes
       const prior = existingServices[requirement.service];
       const priorConfig = prior && typeof prior === "object" ? prior : {};
       const cloud = { provisioner: backend.provisioner };
-      for (const name of CLOUD_FIELDS[backend.provisioner]) {
+      for (const name of backend.cloudFields ?? []) {
         const key = `HAI_DEPLOY_SERVICES_${requirement.service.toUpperCase()}_${name.toUpperCase()}`;
         const initial = String(priorConfig[name] ?? environment.values[key] ?? "");
         const label = `${backend.label} \u2014 ${cliM(`cli_deploy_cloud_input_${name}`)}`;
@@ -3093,32 +3089,25 @@ async function configureDeployMiddleware(module, scan, environment, config, yes
       }
       services[requirement.service] = cloud;
     } else {
-      if (mode === "default" && ["aliyun-sms", "api"].includes(backendName))
+      if (mode === "default" && backend.containerSupported === false)
         throw new Error(cliM("cli_deploy_cloud_unsupported", { params: { backend: backend.label } }));
-      const connection = backendName === current.backend ? { ...requirement.config } : requirement.configName === "reach" ? { name: requirement.config.name ?? requirement.service } : {};
+      const connection = backendName === current.backend ? { ...requirement.config } : requirement.config.name === void 0 ? {} : { name: requirement.config.name };
       for (const field of backend.fields) {
         const previous2 = backendName === current.backend ? requirement.config[field.name] : void 0;
         const initial = previous2 === void 0 ? field.defaultValue ?? "" : typeof previous2 === "object" ? JSON.stringify(previous2) : String(previous2);
         const variable = `${requirement.envPrefix}_${field.name.toUpperCase()}`;
         const info = moduleEnvironmentVariables(requirement.configName).find((item) => item.name === variable);
-        const value = mode === "custom" && !yes ? String(await ask({ type: field.secret ? "password" : "text", name: "value", message: cliM("cli_deploy_field", { params: { description: info?.description ?? field.name, constraint: info?.constraint ?? field.kind ?? "string" } }), initial, validate: (input) => validateField(String(input), field, backendName) })) : initial;
-        if (field.name === "ssl" && validateField(value, field, backendName) !== true)
-          throw new Error(cliM("cli_deploy_invalid_value"));
-        if (value !== "") {
-          connection[field.name] = field.kind === "number" || field.kind === "port" ? Number(value) : field.kind === "boolean" ? value === "true" : field.name === "headers" || field.name === "ssl" ? parseDocument(value).toJS() : value;
-        } else {
+        const value = mode === "custom" && !yes ? String(await ask({ type: field.secret ? "password" : "text", name: "value", message: cliM("cli_deploy_field", { params: { description: info?.description ?? field.name, constraint: info?.constraint ?? field.kind ?? "string" } }), initial, validate: (input) => module.validateMiddlewareField({ value: String(input), field, backend: backendName }) || cliM("cli_deploy_invalid_value") })) : initial;
+        const parsed2 = module.parseMiddlewareField({ value, field, backend: backendName, managed: mode === "default" });
+        if (!parsed2.success)
+          throw new Error(parsed2.error.message);
+        if (parsed2.data === void 0)
           delete connection[field.name];
-        }
+        else connection[field.name] = parsed2.data;
       }
-      if (requirement.service === "db") {
-        const validated = ReldbConfigSchema.safeParse({ ...connection, type: backendName });
-        if (!validated.success)
-          throw new Error(cliM("cli_deploy_config_invalid", { params: { path: join(scan.appDir ?? ".", "config", "_db.yml"), fields: validated.error.issues.map((issue) => issue.path.join(".")).join(", ") } }));
-      }
-      Object.assign(updates, connectionEnv(requirement, backendName, connection));
+      configuration = connection;
     }
-    ensureConfigNode(scan.appDir ?? ".", requirement, backendName);
-    const saved = module.saveDeploymentEnvironment(environment, updates);
+    const saved = module.saveMiddlewareEnvironment(environment, { appDir: scan.appDir ?? ".", requirement, backend: backendName, configuration, updates });
     if (!saved.success)
       throw new Error(saved.error.message);
     writeCliMessage(cliM("cli_deploy_saved", { params: { service: requirement.service } }));
@@ -3222,7 +3211,7 @@ async function configureDeployTarget(module, config, environment, nonInteractive
   const validated = module.ProviderConfigSchema.safeParse(provider);
   if (!validated.success)
     throw new Error(cliM("cli_deploy_invalid_value"));
-  const saved = module.saveDeploymentEnvironment(environment, { HAI_DEPLOY_PROVIDER: JSON.stringify(validated.data) }, { private: true });
+  const saved = module.saveDeploymentEnvironment(environment, { HAI_DEPLOY_PROVIDER: validated.data }, { private: true });
   if (!saved.success)
     throw new Error(saved.error.message);
   config.provider = validated.data;
@@ -3273,7 +3262,7 @@ async function configureDeployHttps(module, config, environment, nonInteractive,
   const parsed2 = module.ProviderConfigSchema.safeParse({ ...provider, expose: { ...expose, ...https?.type === "letsencrypt" ? { hostPort: 80 } : {}, https } });
   if (!parsed2.success)
     throw new Error(cliM("cli_deploy_invalid_value"));
-  const saved = module.saveDeploymentEnvironment(environment, { HAI_DEPLOY_PROVIDER: JSON.stringify(parsed2.data) }, { private: true });
+  const saved = module.saveDeploymentEnvironment(environment, { HAI_DEPLOY_PROVIDER: parsed2.data }, { private: true });
   if (!saved.success)
     throw new Error(saved.error.message);
   config.provider = parsed2.data;
@@ -3281,11 +3270,11 @@ async function configureDeployHttps(module, config, environment, nonInteractive,
 }
 async function deployCommand(options) {
   const spinner = ora();
-  const cwd = options.cwd ?? process4.cwd();
+  const cwd = options.cwd ?? process5.cwd();
   let appDir = resolve(cwd, options.appDir ?? ".");
   let closeDeploy = null;
   let restoreProjectLogger;
-  const originalEnv = { ...process4.env };
+  const originalEnv = { ...process5.env };
   const previousLogLevel = core.logger.getLevel();
   core.logger.setLevel("fatal");
   try {
@@ -3295,21 +3284,21 @@ async function deployCommand(options) {
       throw new Error(cliM("cli_build_runtime_missing"));
     if (options.artifactDir && options.build)
       throw new Error(cliM("cli_deploy_build_artifact_conflict"));
-    if (!options.build && (options.concurrency !== void 0 || options.network !== void 0 || options.sqlitePrebuildMirror !== void 0 || options.httpProxy === false))
+    if (!options.build && (options.concurrency !== void 0 || options.network !== void 0 || options.sqlitePrebuildMirror !== void 0 || options.npmSource !== void 0 || options.npmRegistry !== void 0))
       throw new Error(cliM("cli_deploy_build_options_required"));
     let selectedServices = options.services?.split(",").map((name) => name.trim());
     if (selectedServices && (!selectedServices.length || selectedServices.some((name) => !/^[a-z][a-z0-9-]*$/.test(name)) || new Set(selectedServices).size !== selectedServices.length))
       throw new Error(cliM("cli_build_selection_invalid"));
     let environmentName = options.env;
     if (!environmentName) {
-      if (!process4.stdin.isTTY)
+      if (!process5.stdin.isTTY)
         throw new Error(cliM("cli_deploy_environment_hint"));
       const answer = await prompts({ type: "text", name: "environment", message: cliM("cli_deploy_environment"), initial: "prod" });
       environmentName = answer.environment;
       if (!environmentName)
         throw new Error(cliM("cli_deploy_cancelled"));
     }
-    if (!options.plan && !options.yes && !process4.stdin.isTTY)
+    if (!options.plan && !options.yes && !process5.stdin.isTTY)
       throw new Error(cliM("cli_deploy_environment_hint"));
     let deployModule;
     try {
@@ -3328,7 +3317,7 @@ async function deployCommand(options) {
         localModule = localRequire.resolve("@h-ai/deploy");
       } catch {
       }
-      deployModule = localModule ? await import(pathToFileURL(localModule).href) : await import('./src-IR5AU43K.js');
+      deployModule = localModule ? await import(pathToFileURL(localModule).href) : await import('./src-NXCCU6GO.js');
     } catch {
       writeCliError(chalk.red(cliM("cli_deploy_module_missing")));
       writeCliMessage(chalk.cyan("  pnpm add -D @h-ai/deploy"));
@@ -3356,9 +3345,9 @@ async function deployCommand(options) {
     if (!environment.success)
       throw new Error(environment.error.message);
     if (options.plan) {
-      if (options.build || options.bundleOnly || options.output)
+      if (options.build || options.bundleOnly || options.output || options.imageSource !== void 0 || options.imageMirrors !== void 0 || options.npmSource !== void 0 || options.npmRegistry !== void 0 || options.proxyMode !== void 0 || options.proxyUrl !== void 0 || options.proxyBypass !== void 0 || options.httpProxy === false)
         throw new Error(cliM("cli_deploy_plan_options"));
-      const loaded = deployModule.loadDeploymentConfig("deploy", buildFile, { ...process4.env, ...environment.data.values });
+      const loaded = deployModule.loadDeploymentConfig("deploy", buildFile, { ...process5.env, ...environment.data.values });
       if (!loaded.success)
         throw new Error(loaded.error.message);
       const validated = deployModule.DeployConfigSchema.safeParse(loaded.data);
@@ -3370,7 +3359,7 @@ async function deployCommand(options) {
       writeCliMessage(JSON.stringify(plan.data, null, 2));
       return;
     }
-    Object.assign(process4.env, environment.data.values);
+    Object.assign(process5.env, environment.data.values);
     spinner.start(cliM("cli_deploy_load_credentials"));
     const credResult = deploy.credentials.load();
     if (!credResult.success) {
@@ -3384,7 +3373,7 @@ async function deployCommand(options) {
       writeCliMessage(chalk.cyan(cliM("cli_deploy_config_hint")));
       throw new Error(cliM("cli_deploy_config_missing", { params: { path: configPath } }));
     }
-    const loadedConfig = deployModule.loadDeploymentConfig("deploy", configPath, process4.env);
+    const loadedConfig = deployModule.loadDeploymentConfig("deploy", configPath, process5.env);
     if (!loadedConfig.success)
       throw new Error(loadedConfig.error.message);
     const deployConfig = loadedConfig.data;
@@ -3429,13 +3418,16 @@ async function deployCommand(options) {
       }
     }
     spinner.succeed(cliM("cli_deploy_scanned", { params: { name: scan.appName, sveltekit: String(scan.isSvelteKit), services: scan.requiredServices.join(", ") || cliM("cli_deploy_none") } }));
+    const downloads = configObject(deployConfig.provider).type === "docker-ssh" ? await resolveBuildDownloads(buildRoot, options) : void 0;
+    let builtImages = false;
     if (options.build) {
       if (!existsSync(buildFile))
         throw new Error(cliM("cli_build_images_missing"));
       const imageNames2 = selectedServices?.filter((name) => ["serv", "web"].includes(name));
       if (!selectedServices || imageNames2?.length) {
         writeCliMessage(cliM("cli_deploy_build_started"));
-        await buildCommand({ cwd: buildRoot, target: "image", images: imageNames2?.join(","), concurrency: options.concurrency, runtime: options.runtime, network: options.network, sqlitePrebuildMirror: options.sqlitePrebuildMirror, httpProxy: options.httpProxy });
+        builtImages = true;
+        await buildCommand({ ...options, cwd: buildRoot, target: "image", images: imageNames2?.join(","), yes: true, imageSource: downloads?.imageSource.type, imageMirrors: downloads?.imageSource.registries ? Object.entries(downloads.imageSource.registries).map(([key, value]) => `${key}=${value}`).join(",") : void 0, npmSource: downloads?.npmSource.type, npmRegistry: downloads?.npmSource.registry, proxyMode: downloads?.proxy.mode, proxyUrl: downloads?.proxy.url, proxyBypass: downloads?.proxy.bypass });
       }
     }
     if (selectedServices)
@@ -3460,15 +3452,15 @@ async function deployCommand(options) {
     if (options.bundleOnly)
       await configureDeployTarget(deployModule, deployConfig, environment.data, options.yes, true);
     await configureDeployHttps(deployModule, deployConfig, environment.data, options.yes, selectedServices !== void 0);
-    for (const key of Object.keys(process4.env)) {
+    for (const key of Object.keys(process5.env)) {
       if (originalEnv[key] === void 0)
-        delete process4.env[key];
+        delete process5.env[key];
     }
-    Object.assign(process4.env, originalEnv);
+    Object.assign(process5.env, originalEnv);
     const refreshed = deployModule.loadDeploymentEnvironment({ environment: environment.data.environment, envDir: environment.data.envDir });
     if (!refreshed.success)
       throw new Error(refreshed.error.message);
-    Object.assign(process4.env, refreshed.data.values);
+    Object.assign(process5.env, refreshed.data.values);
     spinner.start(cliM("cli_deploy_initializing"));
     const validatedConfig = deployModule.DeployConfigSchema.safeParse(deployConfig);
     if (!validatedConfig.success)
@@ -3480,7 +3472,11 @@ async function deployCommand(options) {
     closeDeploy = () => deploy.close();
     spinner.succeed(cliM("cli_deploy_initialized"));
     spinner.start(cliM("cli_deploy_deploying"));
+    if (downloads && !builtImages && (!selectedServices || selectedServices.some((name) => !["serv", "web"].includes(name))))
+      await preflightDownloadProxy(options.runtime ?? "auto", downloads.proxy);
     const deployResult = await deploy.deployApp(appDir, {
+      imageSource: downloads?.imageSource,
+      proxy: downloads?.proxy,
       selectedServices,
       runtime: options.runtime,
       onProgress: (stage) => writeCliMessage(cliM(`cli_deploy_stage_${stage}`)),
@@ -3542,14 +3538,14 @@ async function deployCommand(options) {
         await closeDeploy();
       } catch (error) {
         writeCliError("Failed to close deploy module", error);
-        process4.exitCode = 1;
+        process5.exitCode = 1;
       }
     }
-    for (const key of Object.keys(process4.env)) {
+    for (const key of Object.keys(process5.env)) {
       if (originalEnv[key] === void 0)
-        delete process4.env[key];
+        delete process5.env[key];
     }
-    Object.assign(process4.env, originalEnv);
+    Object.assign(process5.env, originalEnv);
     core.logger.setLevel(previousLogLevel);
     restoreProjectLogger?.();
   }
@@ -4383,7 +4379,7 @@ async function startFeedbackViewer(bundle, options = {}) {
 async function feedbackCommand(action, bundlePath, options = {}) {
   if (!["inspect", "summary", "evidence", "view"].includes(action))
     throw new Error(cliM("cli_feedback_invalidAction"));
-  const filePath = path2.resolve(options.cwd ?? process4.cwd(), bundlePath);
+  const filePath = path2.resolve(options.cwd ?? process5.cwd(), bundlePath);
   const metadata = await stat(filePath);
   if (!metadata.isFile() || metadata.size > 64 * 1024 * 1024)
     throw new Error(cliM("cli_feedback_invalidBundle"));
@@ -4417,12 +4413,12 @@ async function feedbackCommand(action, bundlePath, options = {}) {
   writeCliMessage(cliM("cli_feedback_viewerStarted", { params: { url: viewer.url } }));
   await new Promise((resolve7, reject) => {
     const stop = () => {
-      process4.off("SIGINT", stop);
-      process4.off("SIGTERM", stop);
+      process5.off("SIGINT", stop);
+      process5.off("SIGTERM", stop);
       viewer.close().then(resolve7, reject);
     };
-    process4.once("SIGINT", stop);
-    process4.once("SIGTERM", stop);
+    process5.once("SIGINT", stop);
+    process5.once("SIGTERM", stop);
   });
 }
 function appendAt(source, marker, entry) {
@@ -5042,7 +5038,7 @@ async function initProject(options) {
     const { project, existing, missing } = result;
     spinner.succeed(cliM("cli_initDetected", { params: { name: chalk.cyan(project.name) } }));
     if (project.isHaiProject) {
-      const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-VV2XWYON.js');
+      const { generateProjectAiSupport, resolveSkillNamesForPackages } = await import('./cli-skill-templates-S2YH642Z.js');
       const generatedFiles = await generateProjectAiSupport(cwd, resolveSkillNamesForPackages(project.haiPackages), {
         overwriteSkills: false,
         overwriteBridgeFiles: false
@@ -5120,7 +5116,7 @@ async function initProject(options) {
     throw error;
   }
 }
-function object(value) {
+function object2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function declaresValueExport(source, name) {
@@ -5153,9 +5149,9 @@ async function inspectFrameworkUpgrade(directory, version) {
     throw new Error(cliM("cli_upgrade_exact_version"));
   const root = realpathSync(resolve(directory));
   const workspaceFile = join(root, "pnpm-workspace.yaml");
-  const workspace = existsSync(workspaceFile) ? object(parse(readFileSync(workspaceFile, "utf8"))) : {};
-  const rootManifest = object(JSON.parse(readFileSync(join(root, "package.json"), "utf8")));
-  const patterns = Array.isArray(workspace.packages) ? workspace.packages : Array.isArray(rootManifest.workspaces) ? rootManifest.workspaces : Array.isArray(object(rootManifest.workspaces).packages) ? object(rootManifest.workspaces).packages : [];
+  const workspace = existsSync(workspaceFile) ? object2(parse(readFileSync(workspaceFile, "utf8"))) : {};
+  const rootManifest = object2(JSON.parse(readFileSync(join(root, "package.json"), "utf8")));
+  const patterns = Array.isArray(workspace.packages) ? workspace.packages : Array.isArray(rootManifest.workspaces) ? rootManifest.workspaces : Array.isArray(object2(rootManifest.workspaces).packages) ? object2(rootManifest.workspaces).packages : [];
   const directories = /* @__PURE__ */ new Set([root]);
   const safePatterns = patterns.filter((pattern) => typeof pattern === "string" && !isAbsolute(pattern.replace(/^!/, "")) && !pattern.split(/[\\/]/).includes(".."));
   const exclude = ["**/node_modules/**", ...safePatterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => `${pattern.slice(1)}/package.json`)];
@@ -5163,29 +5159,29 @@ async function inspectFrameworkUpgrade(directory, version) {
     for await (const manifest of glob(`${pattern}/package.json`, { cwd: root, exclude })) {
       const location = realpathSync(dirname(join(root, manifest)));
       const fromRoot = relative(root, location);
-      if (!isAbsolute(fromRoot) && fromRoot !== ".." && !fromRoot.startsWith(`..${process4.platform === "win32" ? "\\" : "/"}`))
+      if (!isAbsolute(fromRoot) && fromRoot !== ".." && !fromRoot.startsWith(`..${process5.platform === "win32" ? "\\" : "/"}`))
         directories.add(location);
     }
   }
   const packages = /* @__PURE__ */ new Set(["@h-ai/cli", "@h-ai/deploy"]);
   const drift = [];
-  const catalog = object(workspace.catalog);
+  const catalog = object2(workspace.catalog);
   const lockPath = join(root, "pnpm-lock.yaml");
   const lock = existsSync(lockPath) ? parseAllDocuments(readFileSync(lockPath, "utf8")).reduce((all, document) => {
     if (document.errors.length)
       throw new Error(cliM("cli_upgrade_lock_invalid"));
-    const part = object(document.toJS());
-    return { ...all, ...part, importers: { ...object(all.importers), ...object(part.importers) } };
+    const part = object2(document.toJS());
+    return { ...all, ...part, importers: { ...object2(all.importers), ...object2(part.importers) } };
   }, {}) : {};
   for (const location of directories) {
-    const manifest = object(JSON.parse(readFileSync(join(location, "package.json"), "utf8")));
-    const dependencies = { ...object(manifest.dependencies), ...object(manifest.devDependencies), ...object(manifest.optionalDependencies) };
-    const importer = object(object(lock.importers)[relative(root, location).replaceAll("\\", "/") || "."]);
+    const manifest = object2(JSON.parse(readFileSync(join(location, "package.json"), "utf8")));
+    const dependencies = { ...object2(manifest.dependencies), ...object2(manifest.devDependencies), ...object2(manifest.optionalDependencies) };
+    const importer = object2(object2(lock.importers)[relative(root, location).replaceAll("\\", "/") || "."]);
     for (const [name, specifier] of Object.entries(dependencies)) {
       if (!/^@h-ai\/[\w-]+$/.test(name) || typeof specifier !== "string")
         continue;
       packages.add(name);
-      const declared = specifier.startsWith("catalog:") ? String(object(specifier === "catalog:" ? catalog : object(workspace.catalogs)[specifier.slice(8)])[name] ?? "") : specifier;
+      const declared = specifier.startsWith("catalog:") ? String(object2(specifier === "catalog:" ? catalog : object2(workspace.catalogs)[specifier.slice(8)])[name] ?? "") : specifier;
       const issues = [];
       if (declared !== version && !declared.startsWith("workspace:"))
         issues.push("declared-version-drift");
@@ -5193,7 +5189,7 @@ async function inspectFrameworkUpgrade(directory, version) {
       try {
         const path10 = findPackageJSON(name, pathToFileURL(join(location, "package.json")));
         if (path10) {
-          const candidate = object(JSON.parse(readFileSync(path10, "utf8")));
+          const candidate = object2(JSON.parse(readFileSync(path10, "utf8")));
           if (candidate.name === name && typeof candidate.version === "string")
             installed = candidate.version;
         }
@@ -5201,13 +5197,13 @@ async function inspectFrameworkUpgrade(directory, version) {
       }
       if (installed !== version)
         issues.push(installed ? "installed-version-drift" : "not-installed");
-      const locked = object(object(importer.dependencies)[name] ?? object(importer.devDependencies)[name] ?? object(importer.optionalDependencies)[name]);
+      const locked = object2(object2(importer.dependencies)[name] ?? object2(importer.devDependencies)[name] ?? object2(importer.optionalDependencies)[name]);
       if (typeof locked.version !== "string" || !locked.version.startsWith("link:") && locked.version.split("(")[0] !== version)
         issues.push("lock-version-drift");
       drift.push({ package: name, source: relative(root, join(location, "package.json")).replaceAll("\\", "/"), declared, installed, issues });
     }
   }
-  const registry = new URL(process4.env.npm_config_registry ?? "https://registry.npmjs.org/");
+  const registry = new URL(process5.env.npm_config_registry ?? "https://registry.npmjs.org/");
   if (registry.username || registry.password || registry.protocol !== "https:")
     throw new Error(cliM("cli_upgrade_registry"));
   const releases = [];
@@ -5222,11 +5218,11 @@ async function inspectFrameworkUpgrade(directory, version) {
       const response = await fetch(new URL(`${encodeURIComponent(name)}/${encodeURIComponent(version)}`, registry), { signal: AbortSignal.timeout(2e4) });
       if (!response.ok)
         throw new Error("Release missing");
-      const metadata = object(await response.json());
-      const dist = object(metadata.dist);
+      const metadata = object2(await response.json());
+      const dist = object2(metadata.dist);
       if (metadata.version !== version || typeof dist.tarball !== "string" || typeof dist.integrity !== "string")
         throw new Error("Invalid metadata");
-      for (const dependency of Object.keys(object(metadata.dependencies))) {
+      for (const dependency of Object.keys(object2(metadata.dependencies))) {
         if (/^@h-ai\/[\w-]+$/.test(dependency) && !packages.has(dependency)) {
           packages.add(dependency);
           pending.push(dependency);
@@ -5250,7 +5246,7 @@ async function inspectFrameworkUpgrade(directory, version) {
           throw new Error("Integrity mismatch");
         const files = tarFiles(bytes);
         const manifest = files.get("package/package.json");
-        if (!manifest || object(JSON.parse(new TextDecoder().decode(manifest))).version !== version || !files.has("package/dist/index.js"))
+        if (!manifest || object2(JSON.parse(new TextDecoder().decode(manifest))).version !== version || !files.has("package/dist/index.js"))
           throw new Error("Incomplete artifact");
         const migration = { "@h-ai/iam": "migrateIam", "@h-ai/reach": "migrateReach", "@h-ai/scheduler": "migrateScheduler", "@h-ai/audit": "migrateAudit" }[name];
         if (migration && declaresValueExport(new TextDecoder().decode(files.get("package/dist/index.d.ts")), migration) && declaresValueExport(new TextDecoder().decode(files.get("package/dist/index.js")), migration))
@@ -5277,13 +5273,13 @@ async function inspectFrameworkUpgrade(directory, version) {
     dirtyFiles = execFileSync("git", ["status", "--porcelain", "--", "."], { cwd: root, encoding: "utf8", windowsHide: true, stdio: "pipe" }).trim().split("\n").filter(Boolean);
   } catch {
   }
-  return { version, releaseComplete: releases.every((item) => item.available), modified: false, releases, drift, skills, dirtyFiles, customizations: { overrides: [.../* @__PURE__ */ new Set([...Object.keys(object(workspace.overrides)), ...Object.keys(object(rootManifest.overrides)), ...Object.keys(object(object(rootManifest.pnpm).overrides))])], patches: [.../* @__PURE__ */ new Set([...Object.keys(object(workspace.patchedDependencies)), ...Object.keys(object(object(rootManifest.pnpm).patchedDependencies))])] }, migration: { preflight: migrationPreflight, inspectModuleReadmes: true, exclusiveAccess: true, backup: ["database", "shared-session-cache"], rollback: "restore-compatible-database-and-binaries", sessions: "legacy-credential-sessions-require-login" } };
+  return { version, releaseComplete: releases.every((item) => item.available), modified: false, releases, drift, skills, dirtyFiles, customizations: { overrides: [.../* @__PURE__ */ new Set([...Object.keys(object2(workspace.overrides)), ...Object.keys(object2(rootManifest.overrides)), ...Object.keys(object2(object2(rootManifest.pnpm).overrides))])], patches: [.../* @__PURE__ */ new Set([...Object.keys(object2(workspace.patchedDependencies)), ...Object.keys(object2(object2(rootManifest.pnpm).patchedDependencies))])] }, migration: { preflight: migrationPreflight, inspectModuleReadmes: true, exclusiveAccess: true, backup: ["database", "shared-session-cache"], rollback: "restore-compatible-database-and-binaries", sessions: "legacy-credential-sessions-require-login" } };
 }
 async function upgradeCommand(version, options = {}) {
-  const report = await inspectFrameworkUpgrade(options.cwd ?? process4.cwd(), version);
+  const report = await inspectFrameworkUpgrade(options.cwd ?? process5.cwd(), version);
   writeCliMessage(JSON.stringify(report, null, 2));
   if (!report.releaseComplete)
-    process4.exitCode = 1;
+    process5.exitCode = 1;
 }
 
 // src/cli-main.ts
@@ -5308,7 +5304,7 @@ cli.command("create [name]", cliM("cli_help_create")).option("--type <type>", cl
       cwd: options.cwd
     });
   } catch {
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   }
 });
 cli.command("add [module]", cliM("cli_help_add")).option("--no-install", cliM("cli_help_noInstall")).action(async (module, options) => {
@@ -5320,7 +5316,7 @@ cli.command("add [module]", cliM("cli_help_add")).option("--no-install", cliM("c
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process5.exit(1);
   }
 });
 cli.command("init", cliM("cli_help_init")).option("-f, --force", cliM("cli_help_forceConfig")).action(async (options) => {
@@ -5331,7 +5327,7 @@ cli.command("init", cliM("cli_help_init")).option("-f, --force", cliM("cli_help_
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process5.exit(1);
   }
 });
 cli.command("generate [type] [name]", cliM("cli_help_generate")).option("-w, --workspace <name>", cliM("cli_help_workspace")).alias("g").option("-o, --output <path>", cliM("cli_help_output")).option("-f, --force", cliM("cli_help_force")).action(async (type, name, options) => {
@@ -5346,15 +5342,15 @@ cli.command("generate [type] [name]", cliM("cli_help_generate")).option("-w, --w
       cwd: options.cwd
     });
   } catch {
-    process4.exit(1);
+    process5.exit(1);
   }
 });
-cli.command("build", cliM("cli_help_build")).option("--target <target>", cliM("cli_help_target")).option("--images <names>", cliM("cli_help_images")).option("--concurrency <count>", cliM("cli_help_buildConcurrency")).option("--runtime <runtime>", cliM("cli_help_buildRuntime")).option("--network <network>", cliM("cli_help_buildNetwork")).option("--platform <platform>", cliM("cli_help_platform")).option("--arch <arch>", cliM("cli_help_arch")).option("--sqlite-prebuild-mirror <url>", cliM("cli_help_sqliteMirror")).option("--no-http-proxy", cliM("cli_help_noHttpProxy")).action(async (options) => {
+cli.command("build", cliM("cli_help_build")).option("--target <target>", cliM("cli_help_target")).option("--images <names>", cliM("cli_help_images")).option("--concurrency <count>", cliM("cli_help_buildConcurrency")).option("--runtime <runtime>", cliM("cli_help_buildRuntime")).option("--network <network>", cliM("cli_help_buildNetwork")).option("--platform <platform>", cliM("cli_help_platform")).option("--arch <arch>", cliM("cli_help_arch")).option("--sqlite-prebuild-mirror <url>", cliM("cli_help_sqliteMirror")).option("--no-http-proxy", cliM("cli_help_noHttpProxy")).option("-y, --yes", cliM("cli_help_deployYes")).option("--image-source <source>", cliM("cli_help_imageSource")).option("--image-mirrors <mappings>", cliM("cli_help_imageMirrors")).option("--npm-source <source>", cliM("cli_help_npmSource")).option("--npm-registry <url>", cliM("cli_help_npmRegistry")).option("--proxy-mode <mode>", cliM("cli_help_proxyMode")).option("--proxy-url <url>", cliM("cli_help_proxyUrl")).option("--proxy-bypass <hosts>", cliM("cli_help_proxyBypass")).action(async (options) => {
   try {
     await buildCommand(options);
   } catch (error) {
     writeCliMessage(error instanceof Error ? error.message : String(error));
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   }
 });
 cli.command("upgrade <version>", cliM("cli_help_upgrade")).action(async (version, options) => {
@@ -5362,10 +5358,10 @@ cli.command("upgrade <version>", cliM("cli_help_upgrade")).action(async (version
     await upgradeCommand(version, options);
   } catch (error) {
     writeCliMessage(error instanceof Error ? error.message : String(error));
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   }
 });
-cli.command("deploy [appDir]", cliM("cli_help_deploy")).option("--plan", cliM("cli_help_deployPlan")).option("--inspect-remote", cliM("cli_help_inspectRemote")).option("--env <environment>", cliM("cli_help_environment")).option("--env-dir <path>", cliM("cli_help_envDir")).option("-y, --yes", cliM("cli_help_deployYes")).option("--skip-middleware", cliM("cli_help_skipMiddleware")).option("--artifact-dir <path>", cliM("cli_help_artifactDir")).option("--services <names>", cliM("cli_help_services")).option("--build", cliM("cli_help_deployBuild")).option("--concurrency <count>", cliM("cli_help_buildConcurrency")).option("--network <network>", cliM("cli_help_deployNetwork")).option("--sqlite-prebuild-mirror <url>", cliM("cli_help_deploySqliteMirror")).option("--no-http-proxy", cliM("cli_help_deployNoProxy")).option("--runtime <runtime>", cliM("cli_help_deployRuntime")).option("--bundle-only", cliM("cli_help_bundleOnly")).option("--output <path>", cliM("cli_help_bundleOutput")).action(async (appDir, options) => {
+cli.command("deploy [appDir]", cliM("cli_help_deploy")).option("--plan", cliM("cli_help_deployPlan")).option("--inspect-remote", cliM("cli_help_inspectRemote")).option("--env <environment>", cliM("cli_help_environment")).option("--env-dir <path>", cliM("cli_help_envDir")).option("-y, --yes", cliM("cli_help_deployYes")).option("--skip-middleware", cliM("cli_help_skipMiddleware")).option("--artifact-dir <path>", cliM("cli_help_artifactDir")).option("--services <names>", cliM("cli_help_services")).option("--build", cliM("cli_help_deployBuild")).option("--concurrency <count>", cliM("cli_help_buildConcurrency")).option("--network <network>", cliM("cli_help_deployNetwork")).option("--sqlite-prebuild-mirror <url>", cliM("cli_help_deploySqliteMirror")).option("--no-http-proxy", cliM("cli_help_deployNoProxy")).option("--image-source <source>", cliM("cli_help_imageSource")).option("--image-mirrors <mappings>", cliM("cli_help_imageMirrors")).option("--npm-source <source>", cliM("cli_help_npmSource")).option("--npm-registry <url>", cliM("cli_help_npmRegistry")).option("--proxy-mode <mode>", cliM("cli_help_proxyMode")).option("--proxy-url <url>", cliM("cli_help_proxyUrl")).option("--proxy-bypass <hosts>", cliM("cli_help_proxyBypass")).option("--runtime <runtime>", cliM("cli_help_deployRuntime")).option("--bundle-only", cliM("cli_help_bundleOnly")).option("--output <path>", cliM("cli_help_bundleOutput")).action(async (appDir, options) => {
   try {
     await deployCommand({
       appDir,
@@ -5382,6 +5378,13 @@ cli.command("deploy [appDir]", cliM("cli_help_deploy")).option("--plan", cliM("c
       network: options.network,
       sqlitePrebuildMirror: options.sqlitePrebuildMirror,
       httpProxy: options.httpProxy,
+      imageSource: options.imageSource,
+      imageMirrors: options.imageMirrors,
+      npmSource: options.npmSource,
+      npmRegistry: options.npmRegistry,
+      proxyMode: options.proxyMode,
+      proxyUrl: options.proxyUrl,
+      proxyBypass: options.proxyBypass,
       runtime: options.runtime,
       bundleOnly: options.bundleOnly,
       output: options.output,
@@ -5389,7 +5392,7 @@ cli.command("deploy [appDir]", cliM("cli_help_deploy")).option("--plan", cliM("c
       cwd: options.cwd
     });
   } catch {
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   }
 });
 cli.command("deploy-secrets <directory>", cliM("cli_help_deploySecrets")).option("--import <file>", cliM("cli_help_secretImport")).option("--apply", cliM("cli_help_secretApply")).option("--runtime <runtime>", cliM("cli_help_deployRuntime")).action(async (directory, options) => {
@@ -5397,7 +5400,7 @@ cli.command("deploy-secrets <directory>", cliM("cli_help_deploySecrets")).option
     await deploySecretsCommand(directory, options);
   } catch (error) {
     writeCliMessage(error instanceof Error ? error.message : String(error));
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   }
 });
 cli.command("feedback <action> <bundle>", cliM("cli_help_feedback")).option("--page <number>", cliM("cli_feedback_page")).option("--page-size <number>", cliM("cli_feedback_pageSize")).option("--kind <kind>", cliM("cli_feedback_kind")).option("--request-id <id>", cliM("cli_feedback_requestId")).option("--error-id <id>", cliM("cli_feedback_errorId")).option("--from <timestamp>", cliM("cli_feedback_from")).option("--to <timestamp>", cliM("cli_feedback_to")).option("--port <number>", cliM("cli_feedback_port")).action(async (action, bundle, options) => {
@@ -5416,7 +5419,7 @@ cli.command("feedback <action> <bundle>", cliM("cli_help_feedback")).option("--p
     });
   } catch (error) {
     writeCliMessage(error instanceof Error ? error.message : String(error));
-    process4.exitCode = 1;
+    process5.exitCode = 1;
   }
 });
 cli.command("g:page <name>", cliM("cli_help_generatePage")).option("-w, --workspace <name>", cliM("cli_help_workspace")).action(async (name, options) => {