@h-ai/deploy 0.1.0-alpha.54 → 0.1.0-alpha.56

package/dist/index.js

@@ -5,8 +5,8 @@ import { homedir } from 'os';
 import { join, dirname, relative, sep } from 'path';
 import process from 'process';
 import { parse, stringify } from 'yaml';
-import { execSync } from 'child_process';
-import { createHash } from 'crypto';
+import { execSync, spawn } from 'child_process';
+import { randomBytes, createHash } from 'crypto';
 import { Buffer } from 'buffer';
 
 // src/deploy-config.ts
@@ -38,7 +38,15 @@ var en_US_default = {
   deploy_fileUploadFailed: "File upload failed ({status})",
   deploy_provisionNoResult: "No connection info returned from {service}",
   deploy_recoveryFailure: "Deployment stopped at {stage}; inspect the recovery details.",
-  deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use."
+  deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use.",
+  deploy_commandTimeout: "Command timed out: {command}",
+  deploy_commandFailed: "Command failed ({command}): {error}",
+  deploy_containerRuntimeNotFound: "No usable container runtime found: {runtime}",
+  deploy_containerBuildFailed: "Container image build failed: {error}",
+  deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
+  deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
+  deploy_imageTransferFailed: "Image transfer failed: {error}",
+  deploy_healthCheckFailed: "Health check failed, app not ready at {url}"
 };
 
 // messages/zh-CN.json
@@ -68,7 +76,15 @@ var zh_CN_default = {
   deploy_fileUploadFailed: "\u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF08{status}\uFF09",
   deploy_provisionNoResult: "{service} \u672A\u8FD4\u56DE\u8FDE\u63A5\u4FE1\u606F",
   deploy_recoveryFailure: "\u90E8\u7F72\u5728 {stage} \u9636\u6BB5\u505C\u6B62\uFF0C\u8BF7\u67E5\u770B\u6062\u590D\u6E05\u5355\u3002",
-  deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002"
+  deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002",
+  deploy_commandTimeout: "\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF1A{command}",
+  deploy_commandFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF08{command}\uFF09\uFF1A{error}",
+  deploy_containerRuntimeNotFound: "\u672A\u627E\u5230\u53EF\u7528\u7684\u5BB9\u5668\u8FD0\u884C\u65F6\uFF1A{runtime}",
+  deploy_containerBuildFailed: "\u5BB9\u5668\u955C\u50CF\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
+  deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
+  deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
+  deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
+  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA"
 };
 
 // src/deploy-i18n.ts
@@ -82,8 +98,47 @@ var VercelProviderConfigSchema = z.object({
   type: z.literal("vercel"),
   token: z.string().min(1, deployM("deploy_configTokenRequired"))
 });
+var SshConfigSchema = z.object({
+  /** 远程主机地址或 ~/.ssh/config 中的 Host 别名 */
+  host: z.string().min(1),
+  /** SSH 端口 */
+  port: z.number().int().min(1).max(65535).default(22),
+  /** SSH 用户名 */
+  username: z.string().min(1),
+  /** 私钥文件路径（省略时使用 ssh-agent 或 ~/.ssh 默认密钥） */
+  identityFile: z.string().min(1).optional(),
+  /** known_hosts 文件路径（省略时使用默认；配合 CI/临时环境隔离主机指纹） */
+  knownHostsFile: z.string().min(1).optional(),
+  /** 严格主机密钥校验，默认开启（true→accept-new 首次信任并拒绝变更；false→关闭校验） */
+  strictHostKeyChecking: z.boolean().default(true),
+  /** 连接超时（秒） */
+  connectTimeoutSeconds: z.number().int().positive().default(10)
+});
+var PortExposeSchema = z.object({
+  type: z.literal("port").default("port"),
+  /** 容器内监听端口（adapter-node 默认 3000） */
+  containerPort: z.number().int().positive().default(3e3),
+  /** 宿主机映射端口 */
+  hostPort: z.number().int().positive()
+});
+var ExposeSchema = PortExposeSchema;
+var DockerSshProviderConfigSchema = z.object({
+  type: z.literal("docker-ssh"),
+  /** SSH 连接参数 */
+  ssh: SshConfigSchema,
+  /** 远程主机运行参数 */
+  remote: z.object({
+    /** 远程应用根目录 */
+    baseDir: z.string().min(1).default("/opt/hai/apps"),
+    /** 远程容器运行时（auto 优先 podman） */
+    runtime: z.enum(["auto", "docker", "podman"]).default("auto")
+  }).default({ baseDir: "/opt/hai/apps", runtime: "auto" }),
+  /** 应用暴露方式 */
+  expose: ExposeSchema
+});
 var ProviderConfigSchema = z.discriminatedUnion("type", [
-  VercelProviderConfigSchema
+  VercelProviderConfigSchema,
+  DockerSshProviderConfigSchema
 ]);
 var NeonServiceSchema = z.object({
   provisioner: z.literal("neon"),
@@ -121,7 +176,11 @@ var ServicesConfigSchema = z.object({
 }).optional();
 var DeployConfigSchema = z.object({
   provider: ProviderConfigSchema,
-  services: ServicesConfigSchema
+  services: ServicesConfigSchema,
+  /** 本地容器构建参数（docker-ssh 使用；auto 优先 podman） */
+  container: z.object({
+    runtime: z.enum(["auto", "docker", "podman"]).default("auto")
+  }).optional()
 });
 var DeployErrorInfo = {
   DEPLOY_FAILED: "001:500",
@@ -137,7 +196,13 @@ var DeployErrorInfo = {
   ENV_VAR_FAILED: "011:500",
   UNSUPPORTED_TYPE: "012:400",
   CONFIG_ERROR: "013:500",
-  CREDENTIAL_ERROR: "014:500"
+  CREDENTIAL_ERROR: "014:500",
+  CONTAINER_RUNTIME_NOT_FOUND: "015:500",
+  CONTAINER_BUILD_FAILED: "016:500",
+  REMOTE_CONNECT_FAILED: "017:500",
+  REMOTE_COMMAND_FAILED: "018:500",
+  IMAGE_TRANSFER_FAILED: "019:500",
+  HEALTH_CHECK_FAILED: "020:500"
 };
 var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
 
@@ -355,55 +420,61 @@ function hasDependency(pkg, name) {
 }
 function detectRequiredServices(configDir) {
   const services = [];
+  const backends = {};
   if (!existsSync(configDir)) {
-    return services;
+    return { services, backends };
   }
   const files = readdirSync(configDir);
-  if (files.includes("_db.yml") || files.includes("_db.yaml")) {
-    const dbConfig = readYaml(join(configDir, files.find((f) => f.startsWith("_db."))));
+  const dbFile = files.find((f) => f.startsWith("_db."));
+  if (dbFile) {
+    const dbConfig = readYaml(join(configDir, dbFile));
     if (dbConfig !== null) {
       services.push("db");
+      backends.db = dbConfig.type ?? "postgresql";
     }
   }
-  if (files.includes("_cache.yml") || files.includes("_cache.yaml")) {
-    const cacheConfig = readYaml(join(configDir, files.find((f) => f.startsWith("_cache."))));
-    if (cacheConfig !== null) {
-      const cacheType = cacheConfig.type;
-      if (cacheType === "redis") {
-        services.push("cache");
-      }
+  const cacheFile = files.find((f) => f.startsWith("_cache."));
+  if (cacheFile) {
+    const cacheConfig = readYaml(join(configDir, cacheFile));
+    if (cacheConfig !== null && cacheConfig.type === "redis") {
+      services.push("cache");
+      backends.cache = "redis";
+    }
+  }
+  const storageFile = files.find((f) => f.startsWith("_storage."));
+  if (storageFile) {
+    const storageConfig = readYaml(join(configDir, storageFile));
+    if (storageConfig !== null && detectStorageIsS3(storageConfig)) {
+      services.push("storage");
+      backends.storage = "s3";
     }
   }
-  if (files.includes("_storage.yml") || files.includes("_storage.yaml")) {
-    const storageConfig = readYaml(join(configDir, files.find((f) => f.startsWith("_storage."))));
-    if (storageConfig !== null) {
-      detectStorageServices(storageConfig, services);
+  const vecdbFile = files.find((f) => f.startsWith("_vecdb."));
+  if (vecdbFile) {
+    const vecdbConfig = readYaml(join(configDir, vecdbFile));
+    if (vecdbConfig !== null) {
+      services.push("vecdb");
+      backends.vecdb = vecdbConfig.type ?? "qdrant";
     }
   }
-  if (files.includes("_reach.yml") || files.includes("_reach.yaml")) {
-    const reachConfig = readYaml(join(configDir, files.find((f) => f.startsWith("_reach."))));
+  const reachFile = files.find((f) => f.startsWith("_reach."));
+  if (reachFile) {
+    const reachConfig = readYaml(join(configDir, reachFile));
     if (reachConfig !== null) {
       detectReachServices(reachConfig, services);
     }
   }
-  return services;
+  return { services, backends };
 }
-function detectStorageServices(config, services) {
+function detectStorageIsS3(config) {
   if (config.type === "s3") {
-    services.push("storage");
-    return;
+    return true;
   }
   const providers = config.providers;
   if (providers === void 0) {
-    return;
-  }
-  for (const providerConfig of Object.values(providers)) {
-    const typed = providerConfig;
-    if (typed?.type === "s3") {
-      services.push("storage");
-      return;
-    }
+    return false;
   }
+  return Object.values(providers).some((p) => p?.type === "s3");
 }
 function detectReachServices(config, services) {
   const providers = config.providers;
@@ -437,24 +508,29 @@ async function scanApp(appDir) {
     const appName = extractAppName(pkg);
     const isSvelteKit = existsSync(join(appDir, "svelte.config.js")) || existsSync(join(appDir, "svelte.config.ts"));
     const adapterInstalled = hasDependency(pkg, "@sveltejs/adapter-vercel");
+    const nodeAdapterInstalled = hasDependency(pkg, "@sveltejs/adapter-node");
     const configDir = join(appDir, "config");
-    const configServices = detectRequiredServices(configDir);
+    const configDetection = detectRequiredServices(configDir);
     const depServices = detectServicesFromDependencies(pkg);
-    const requiredServices = Array.from(/* @__PURE__ */ new Set([...configServices, ...depServices]));
+    const requiredServices = Array.from(/* @__PURE__ */ new Set([...configDetection.services, ...depServices]));
     const scripts = pkg.scripts;
     const buildCommand = scripts?.build ?? "pnpm build";
     const scanResult = {
       appName,
       isSvelteKit,
       adapterInstalled,
+      nodeAdapterInstalled,
       requiredServices,
+      serviceBackends: configDetection.backends,
       buildCommand
     };
     logger3.info("Application scanned", {
       appName,
       isSvelteKit,
       adapterInstalled,
-      requiredServices
+      nodeAdapterInstalled,
+      requiredServices,
+      serviceBackends: configDetection.backends
     });
     return ok(scanResult);
   } catch (error) {
@@ -472,7 +548,8 @@ function detectServicesFromDependencies(pkg) {
   const depMap = {
     "@h-ai/reldb": "db",
     "@h-ai/cache": "cache",
-    "@h-ai/storage": "storage"
+    "@h-ai/storage": "storage",
+    "@h-ai/vecdb": "vecdb"
   };
   const services = [];
   for (const [depName, serviceType] of Object.entries(depMap)) {
@@ -490,7 +567,667 @@ function extractAppName(pkg) {
   }
   return name;
 }
-var logger4 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
+var IMAGES = {
+  postgres: "postgres:16-alpine",
+  mysql: "mysql:8.4",
+  redis: "redis:7-alpine",
+  minio: "minio/minio:RELEASE.2025-09-07T16-13-09Z",
+  mc: "minio/mc:RELEASE.2025-08-13T08-35-41Z",
+  qdrant: "qdrant/qdrant:v1.12.4",
+  pgvector: "pgvector/pgvector:pg17",
+  chroma: "chromadb/chroma:0.5.23"
+};
+function generatePassword() {
+  return randomBytes(24).toString("base64url");
+}
+function resolveSidecarSecrets(appDir, projectName) {
+  const secretFile = join(appDir, ".hai", "deploy", "runtime", `${projectName}.secrets.json`);
+  if (existsSync(secretFile)) {
+    try {
+      return JSON.parse(readFileSync(secretFile, "utf-8"));
+    } catch {
+    }
+  }
+  const secrets = {
+    dbPassword: generatePassword(),
+    storagePassword: generatePassword()
+  };
+  mkdirSync(dirname(secretFile), { recursive: true });
+  writeFileSync(secretFile, JSON.stringify(secrets), { mode: 384 });
+  return secrets;
+}
+function addAppDataVolume(plan, projectName) {
+  const mount = `${projectName}-data:/app/data`;
+  if (!plan.appVolumes.includes(mount)) {
+    plan.appVolumes.push(mount);
+    plan.volumes[`${projectName}-data`] = null;
+  }
+}
+function planPostgresDb(plan, projectName, password, net) {
+  plan.services.push("db");
+  plan.dependsOn.push("db");
+  plan.composeServices.db = {
+    image: IMAGES.postgres,
+    container_name: `hai-${projectName}-db`,
+    restart: "unless-stopped",
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-db-data:/var/lib/postgresql/data`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-db-data`] = null;
+  plan.env.POSTGRES_USER = "hai";
+  plan.env.POSTGRES_PASSWORD = password;
+  plan.env.POSTGRES_DB = "hai";
+  plan.env.HAI_DB = JSON.stringify({ type: "postgresql", url: `postgresql://hai:${password}@db:5432/hai`, database: "hai" });
+  plan.secrets.push(password);
+}
+function planMysqlDb(plan, projectName, password, net) {
+  plan.services.push("db");
+  plan.dependsOn.push("db");
+  plan.composeServices.db = {
+    image: IMAGES.mysql,
+    container_name: `hai-${projectName}-db`,
+    restart: "unless-stopped",
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-db-data:/var/lib/mysql`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-db-data`] = null;
+  plan.env.MYSQL_ROOT_PASSWORD = password;
+  plan.env.MYSQL_DATABASE = "hai";
+  plan.env.MYSQL_USER = "hai";
+  plan.env.MYSQL_PASSWORD = password;
+  plan.env.HAI_DB = JSON.stringify({ type: "mysql", url: `mysql://hai:${password}@db:3306/hai`, database: "hai" });
+  plan.secrets.push(password);
+}
+function planRedisCache(plan, projectName, net) {
+  plan.services.push("cache");
+  plan.dependsOn.push("cache");
+  plan.composeServices.cache = {
+    image: IMAGES.redis,
+    container_name: `hai-${projectName}-cache`,
+    restart: "unless-stopped",
+    networks: net
+  };
+  plan.env.HAI_CACHE = JSON.stringify({ type: "redis", url: "redis://cache:6379" });
+}
+function planMinioStorage(plan, projectName, password, net) {
+  plan.services.push("storage");
+  plan.dependsOn.push("storage");
+  plan.composeServices.storage = {
+    image: IMAGES.minio,
+    container_name: `hai-${projectName}-storage`,
+    restart: "unless-stopped",
+    command: ["server", "/data"],
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-storage-data:/data`],
+    networks: net
+  };
+  plan.composeServices["storage-init"] = {
+    image: IMAGES.mc,
+    depends_on: ["storage"],
+    env_file: [".env.runtime"],
+    entrypoint: [
+      "sh",
+      "-c",
+      'until mc alias set s3 http://storage:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"; do sleep 1; done; mc mb -p s3/hai; exit 0'
+    ],
+    networks: net
+  };
+  plan.volumes[`${projectName}-storage-data`] = null;
+  plan.env.MINIO_ROOT_USER = "hai";
+  plan.env.MINIO_ROOT_PASSWORD = password;
+  plan.env.HAI_STORAGE = JSON.stringify({
+    type: "s3",
+    endpoint: "http://storage:9000",
+    bucket: "hai",
+    region: "us-east-1",
+    accessKeyId: "hai",
+    secretAccessKey: password,
+    forcePathStyle: true
+  });
+  plan.secrets.push(password);
+}
+function planQdrantVecdb(plan, projectName, net) {
+  plan.services.push("vecdb");
+  plan.dependsOn.push("vecdb");
+  plan.composeServices.vecdb = {
+    image: IMAGES.qdrant,
+    container_name: `hai-${projectName}-vecdb`,
+    restart: "unless-stopped",
+    volumes: [`${projectName}-vecdb-data:/qdrant/storage`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-vecdb-data`] = null;
+  plan.env.HAI_VECDB = JSON.stringify({ type: "qdrant", url: "http://vecdb:6333" });
+}
+function planPgvectorVecdb(plan, projectName, password, net) {
+  plan.services.push("vecdb");
+  plan.dependsOn.push("vecdb");
+  plan.composeServices.vecdb = {
+    image: IMAGES.pgvector,
+    container_name: `hai-${projectName}-vecdb`,
+    restart: "unless-stopped",
+    env_file: [".env.runtime"],
+    volumes: [`${projectName}-vecdb-data:/var/lib/postgresql/data`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-vecdb-data`] = null;
+  plan.env.POSTGRES_USER = "hai";
+  plan.env.POSTGRES_PASSWORD = password;
+  plan.env.POSTGRES_DB = "hai";
+  plan.env.HAI_VECDB = JSON.stringify({ type: "pgvector", url: `postgresql://hai:${password}@vecdb:5432/hai`, database: "hai" });
+  plan.secrets.push(password);
+}
+function planChromaVecdb(plan, projectName, net) {
+  plan.services.push("vecdb");
+  plan.dependsOn.push("vecdb");
+  plan.composeServices.vecdb = {
+    image: IMAGES.chroma,
+    container_name: `hai-${projectName}-vecdb`,
+    restart: "unless-stopped",
+    volumes: [`${projectName}-vecdb-data:/data`],
+    networks: net
+  };
+  plan.volumes[`${projectName}-vecdb-data`] = null;
+  plan.env.HAI_VECDB = JSON.stringify({ type: "chroma", url: "http://vecdb:8000" });
+}
+function planSidecars(appDir, projectName, scan, provisionEnv) {
+  const plan = {
+    services: [],
+    composeServices: {},
+    volumes: {},
+    appVolumes: [],
+    env: {},
+    dependsOn: [],
+    secrets: []
+  };
+  const secrets = resolveSidecarSecrets(appDir, projectName);
+  const net = ["hai-app"];
+  const backends = scan.serviceBackends;
+  for (const service of scan.requiredServices) {
+    if (service === "db" && !provisionEnv.HAI_DB) {
+      const backend = backends.db ?? "postgresql";
+      if (backend === "mysql")
+        planMysqlDb(plan, projectName, secrets.dbPassword, net);
+      else if (backend === "sqlite")
+        addAppDataVolume(plan, projectName);
+      else
+        planPostgresDb(plan, projectName, secrets.dbPassword, net);
+    } else if (service === "cache" && !provisionEnv.HAI_CACHE) {
+      planRedisCache(plan, projectName, net);
+    } else if (service === "storage" && !provisionEnv.HAI_STORAGE) {
+      planMinioStorage(plan, projectName, secrets.storagePassword, net);
+    } else if (service === "vecdb" && !provisionEnv.HAI_VECDB) {
+      const backend = backends.vecdb ?? "qdrant";
+      if (backend === "pgvector")
+        planPgvectorVecdb(plan, projectName, secrets.dbPassword, net);
+      else if (backend === "chroma")
+        planChromaVecdb(plan, projectName, net);
+      else if (backend === "lancedb")
+        addAppDataVolume(plan, projectName);
+      else
+        planQdrantVecdb(plan, projectName, net);
+    }
+  }
+  return plan;
+}
+function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort) {
+  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv);
+  const env = {
+    NODE_ENV: "production",
+    HOST: "0.0.0.0",
+    PORT: String(containerPort),
+    ...sidecar.env,
+    ...provisionEnv
+  };
+  return { env, sidecar };
+}
+function generateComposeFile(options) {
+  const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
+  const app = {
+    image: imageRef,
+    container_name: `hai-${projectName}-app`,
+    restart: "unless-stopped",
+    // 镜像已由 load 注入本地，禁止 compose 再从 registry 拉取
+    pull_policy: "never",
+    env_file: [".env.runtime"],
+    ports: [`${hostPort}:${containerPort}`],
+    networks: ["hai-app"]
+  };
+  if (sidecar.appVolumes.length > 0)
+    app.volumes = sidecar.appVolumes;
+  if (sidecar.dependsOn.length > 0)
+    app.depends_on = sidecar.dependsOn;
+  const compose = {
+    services: {
+      app,
+      ...sidecar.composeServices
+    },
+    networks: {
+      "hai-app": { name: `hai-${projectName}` }
+    }
+  };
+  if (Object.keys(sidecar.volumes).length > 0)
+    compose.volumes = sidecar.volumes;
+  return stringify(compose);
+}
+function serializeEnvFile(env) {
+  return `${Object.entries(env).map(([key, value]) => `${key}=${value}`).join("\n")}
+`;
+}
+function generateDockerignore() {
+  return `**/node_modules
+**/dist
+**/build
+**/.turbo
+**/.svelte-kit
+**/coverage
+**/test-results
+**/playwright-report
+**/.hai/deploy
+.git
+`;
+}
+function generateFallbackDockerfile(packageName, containerPort) {
+  return `# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS build
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+ENV CI=true
+WORKDIR /workspace
+RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
+COPY . .
+RUN pnpm install --frozen-lockfile --ignore-scripts
+RUN pnpm --filter ${packageName} build
+RUN pnpm --filter ${packageName} --prod deploy /prod/app
+
+FROM node:22-bookworm-slim AS runtime
+ENV NODE_ENV=production
+ENV HOST=0.0.0.0
+ENV PORT=${containerPort}
+WORKDIR /app
+COPY --from=build --chown=node:node /prod/app ./
+USER node
+EXPOSE ${containerPort}
+CMD ["node", "build"]
+`;
+}
+var logger4 = core.logger.child({ module: "deploy", scope: "command" });
+function maskSecrets(text, secrets) {
+  if (!secrets || secrets.length === 0)
+    return text;
+  let masked = text;
+  for (const secret of secrets) {
+    if (secret && secret.length > 0)
+      masked = masked.split(secret).join("***");
+  }
+  return masked;
+}
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env ? { ...process.env, ...options.env } : process.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let timer;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve(result);
+    };
+    if (options.timeoutMs && options.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        logger4.error("Command timed out", { command, timeoutMs: options.timeoutMs });
+        finish(err(
+          HaiDeployError.REMOTE_COMMAND_FAILED,
+          deployM("deploy_commandTimeout", { params: { command } })
+        ));
+      }, options.timeoutMs);
+    }
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (error) => {
+      logger4.error("Command failed to start", { command, error: maskSecrets(String(error), options.secrets) });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(error.message, options.secrets) }
+        }),
+        error
+      ));
+    });
+    child.on("close", (code) => {
+      const exitCode = code ?? -1;
+      if (exitCode === 0) {
+        finish(ok({ code: exitCode, stdout, stderr }));
+        return;
+      }
+      logger4.error("Command exited with non-zero code", {
+        command,
+        code: exitCode,
+        stderr: maskSecrets(stderr, options.secrets).slice(-500)
+      });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(stderr || `exit ${exitCode}`, options.secrets).slice(-500) }
+        })
+      ));
+    });
+    if (options.input !== void 0) {
+      child.stdin.write(options.input);
+      child.stdin.end();
+    } else {
+      child.stdin.end();
+    }
+  });
+}
+
+// src/container/deploy-container-runtime.ts
+var logger5 = core.logger.child({ module: "deploy", scope: "container-runtime" });
+async function detectLocalRuntime(preferred = "auto") {
+  const candidates = preferred === "auto" ? ["podman", "docker"] : [preferred];
+  for (const runtime of candidates) {
+    const probe = await runCommand(runtime, ["version"], { timeoutMs: 15e3 });
+    if (probe.success) {
+      logger5.info("Local container runtime detected", { runtime });
+      return ok(runtime);
+    }
+  }
+  return err(
+    HaiDeployError.CONTAINER_RUNTIME_NOT_FOUND,
+    deployM("deploy_containerRuntimeNotFound", { params: { runtime: candidates.join(" / ") } })
+  );
+}
+async function buildImage(runtime, options) {
+  const args = ["build", "-f", options.dockerfilePath, "-t", options.imageRef];
+  if (runtime === "podman")
+    args.push("--format", "docker", "--jobs", "1");
+  args.push(options.contextDir);
+  logger5.info("Building container image", { runtime, imageRef: options.imageRef });
+  const result = await runCommand(runtime, args, { cwd: options.contextDir });
+  if (!result.success) {
+    return err(
+      HaiDeployError.CONTAINER_BUILD_FAILED,
+      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
+      result.error
+    );
+  }
+  return ok(void 0);
+}
+async function saveImage(runtime, imageRef, tarPath) {
+  logger5.info("Saving container image", { runtime, imageRef, tarPath });
+  const result = await runCommand(runtime, ["save", "-o", tarPath, imageRef], {});
+  if (!result.success) {
+    return err(
+      HaiDeployError.CONTAINER_BUILD_FAILED,
+      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
+      result.error
+    );
+  }
+  return ok(void 0);
+}
+var logger6 = core.logger.child({ module: "deploy", scope: "ssh" });
+function buildConnectOptions(config) {
+  const args = ["-o", "BatchMode=yes"];
+  args.push("-o", `ConnectTimeout=${config.connectTimeoutSeconds}`);
+  args.push("-o", `StrictHostKeyChecking=${config.strictHostKeyChecking ? "accept-new" : "no"}`);
+  if (config.knownHostsFile)
+    args.push("-o", `UserKnownHostsFile=${config.knownHostsFile}`);
+  if (config.identityFile) {
+    args.push("-i", config.identityFile);
+    args.push("-o", "IdentitiesOnly=yes");
+  }
+  return args;
+}
+function buildSshExecArgs(config, remoteCommand) {
+  return [
+    ...buildConnectOptions(config),
+    "-p",
+    String(config.port),
+    `${config.username}@${config.host}`,
+    remoteCommand
+  ];
+}
+function buildScpUploadArgs(config, localPath, remotePath) {
+  return [
+    ...buildConnectOptions(config),
+    "-P",
+    String(config.port),
+    localPath,
+    `${config.username}@${config.host}:${remotePath}`
+  ];
+}
+function createSshExecutor(config) {
+  const exec = async (remoteCommand, options) => {
+    return runCommand("ssh", buildSshExecArgs(config, remoteCommand), {
+      timeoutMs: options?.timeoutMs,
+      secrets: options?.secrets
+    });
+  };
+  const upload = async (localPath, remotePath) => {
+    const args = buildScpUploadArgs(config, localPath, remotePath);
+    const result = await runCommand("scp", args, {});
+    if (!result.success) {
+      return err(
+        HaiDeployError.IMAGE_TRANSFER_FAILED,
+        deployM("deploy_imageTransferFailed", { params: { error: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(void 0);
+  };
+  const ping = async () => {
+    logger6.debug("SSH preflight", { host: config.host, port: config.port });
+    const result = await exec("true", { timeoutMs: 2e4 });
+    if (!result.success) {
+      return err(
+        HaiDeployError.REMOTE_CONNECT_FAILED,
+        deployM("deploy_remoteConnectFailed", { params: { host: config.host, error: result.error.message } }),
+        result.error
+      );
+    }
+    return ok(void 0);
+  };
+  return { exec, upload, ping };
+}
+
+// src/providers/deploy-provider-docker-ssh.ts
+var logger7 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
+var HEALTH_POLL_INTERVAL = 3e3;
+var HEALTH_MAX_ATTEMPTS = 40;
+function makeDeploymentId() {
+  const now = /* @__PURE__ */ new Date();
+  const pad = (n) => String(n).padStart(2, "0");
+  const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+  return `${stamp}-${randomBytes(3).toString("hex")}`;
+}
+function parseLoadedImageRef(stdout, fallback) {
+  const match = stdout.match(/Loaded image(?:\(s\))?:\s*(\S+)/);
+  return match ? match[1] : fallback;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function readPackageName(appDir) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(appDir, "package.json"), "utf-8"));
+    return pkg.name ?? "app";
+  } catch {
+    return "app";
+  }
+}
+function resolveWorkspaceRoot(appDir) {
+  if (existsSync(join(appDir, "pnpm-workspace.yaml")))
+    return appDir;
+  let current = appDir;
+  let parent = dirname(current);
+  while (parent !== current) {
+    if (existsSync(join(parent, "pnpm-workspace.yaml")))
+      return parent;
+    current = parent;
+    parent = dirname(parent);
+  }
+  return appDir;
+}
+function createDockerSshProvider(config, localRuntimePref = "auto") {
+  const ssh = createSshExecutor(config.ssh);
+  const baseDir = config.remote.baseDir;
+  async function detectRemoteRuntime() {
+    const candidates = config.remote.runtime === "auto" ? ["podman", "docker"] : [config.remote.runtime];
+    for (const runtime of candidates) {
+      const versionResult = await ssh.exec(`${runtime} version`, { timeoutMs: 2e4 });
+      if (!versionResult.success)
+        continue;
+      const composeResult = await ssh.exec(`${runtime} compose version`, { timeoutMs: 2e4 });
+      if (composeResult.success) {
+        logger7.info("Remote container runtime detected", { runtime });
+        return ok(runtime);
+      }
+    }
+    return err(
+      HaiDeployError.REMOTE_COMMAND_FAILED,
+      deployM("deploy_remoteRuntimeMissing", { params: { runtime: candidates.join(" / ") } })
+    );
+  }
+  async function healthCheck(url) {
+    for (let attempt = 0; attempt < HEALTH_MAX_ATTEMPTS; attempt++) {
+      try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+        if (response.ok)
+          return true;
+      } catch {
+      }
+      await sleep(HEALTH_POLL_INTERVAL);
+    }
+    return false;
+  }
+  const deploy2 = async (context) => {
+    const { appDir, projectName, scan, provisionEnv } = context;
+    const deploymentId = makeDeploymentId();
+    const containerPort = config.expose.containerPort;
+    const hostPort = config.expose.hostPort;
+    const localImageTag = `hai-${projectName}:${deploymentId}`;
+    const runtimeResult = await detectLocalRuntime(localRuntimePref);
+    if (!runtimeResult.success)
+      return err(runtimeResult.error);
+    const localRuntime = runtimeResult.data;
+    const artifactDir = join(appDir, ".hai", "deploy");
+    mkdirSync(artifactDir, { recursive: true });
+    const appDockerfile = join(appDir, "Dockerfile");
+    let dockerfilePath;
+    let contextDir;
+    if (existsSync(appDockerfile)) {
+      dockerfilePath = appDockerfile;
+      contextDir = appDir;
+    } else {
+      dockerfilePath = join(artifactDir, "Dockerfile");
+      writeFileSync(dockerfilePath, generateFallbackDockerfile(readPackageName(appDir), containerPort));
+      writeFileSync(`${dockerfilePath}.dockerignore`, generateDockerignore());
+      contextDir = resolveWorkspaceRoot(appDir);
+      logger7.info("Generated fallback Dockerfile", { dockerfilePath, contextDir });
+    }
+    const buildResult = await buildImage(localRuntime, {
+      contextDir,
+      dockerfilePath,
+      imageRef: localImageTag
+    });
+    if (!buildResult.success)
+      return err(buildResult.error);
+    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort);
+    const envPath = join(artifactDir, ".env.runtime");
+    writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
+    const tarPath = join(artifactDir, `${projectName}.tar`);
+    const saveResult = await saveImage(localRuntime, localImageTag, tarPath);
+    if (!saveResult.success)
+      return err(saveResult.error);
+    const pingResult = await ssh.ping();
+    if (!pingResult.success)
+      return err(pingResult.error);
+    const remoteRuntimeResult = await detectRemoteRuntime();
+    if (!remoteRuntimeResult.success)
+      return err(remoteRuntimeResult.error);
+    const remoteRuntime = remoteRuntimeResult.data;
+    const remoteDir = `${baseDir}/${projectName}`;
+    const prepareResult = await ssh.exec(`mkdir -p ${remoteDir} && chmod 700 ${remoteDir}`);
+    if (!prepareResult.success)
+      return err(prepareResult.error);
+    const remoteTar = `${remoteDir}/image.tar`;
+    const uploadTarResult = await ssh.upload(tarPath, remoteTar);
+    if (!uploadTarResult.success)
+      return err(uploadTarResult.error);
+    const loadResult = await ssh.exec(`${remoteRuntime} load -i ${remoteTar}`, { timeoutMs: 3e5 });
+    if (!loadResult.success)
+      return err(loadResult.error);
+    const loadedRef = parseLoadedImageRef(loadResult.data.stdout, localImageTag);
+    const remoteImageRef = remoteRuntime === "podman" ? `localhost/${localImageTag}` : localImageTag;
+    if (loadedRef !== remoteImageRef) {
+      const tagResult = await ssh.exec(`${remoteRuntime} tag ${loadedRef} ${remoteImageRef}`);
+      if (!tagResult.success)
+        return err(tagResult.error);
+    }
+    const composeContent = generateComposeFile({
+      projectName,
+      imageRef: remoteImageRef,
+      hostPort,
+      containerPort,
+      sidecar
+    });
+    const composePath = join(artifactDir, "compose.yml");
+    writeFileSync(composePath, composeContent);
+    const uploadComposeResult = await ssh.upload(composePath, `${remoteDir}/compose.yml`);
+    if (!uploadComposeResult.success)
+      return err(uploadComposeResult.error);
+    const uploadEnvResult = await ssh.upload(envPath, `${remoteDir}/.env.runtime`);
+    if (!uploadEnvResult.success)
+      return err(uploadEnvResult.error);
+    const secretMask = sidecar.secrets;
+    const chmodResult = await ssh.exec(`chmod 600 ${remoteDir}/.env.runtime`, { secrets: secretMask });
+    if (!chmodResult.success)
+      return err(chmodResult.error);
+    const upResult = await ssh.exec(
+      `cd ${remoteDir} && ${remoteRuntime} compose -p hai-${projectName} up -d`,
+      { timeoutMs: 3e5, secrets: secretMask }
+    );
+    if (!upResult.success)
+      return err(upResult.error);
+    await ssh.exec(`rm -f ${remoteTar}`);
+    const url = `http://${config.ssh.host}:${hostPort}`;
+    logger7.info("Running health check", { url });
+    const healthy = await healthCheck(`${url}/`);
+    if (!healthy) {
+      return err(
+        HaiDeployError.HEALTH_CHECK_FAILED,
+        deployM("deploy_healthCheckFailed", { params: { url } })
+      );
+    }
+    const result = {
+      url,
+      deploymentId,
+      status: "ready",
+      provider: "docker-ssh",
+      healthCheck: "passed",
+      envVarsSet: Object.keys(env)
+    };
+    logger7.info("docker-ssh deployment complete", { url, deploymentId });
+    return ok(result);
+  };
+  return { name: "docker-ssh", deploy: deploy2 };
+}
+var logger8 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
 var VERCEL_API = "https://api.vercel.com";
 var POLL_INTERVAL = 3e3;
 var MAX_POLL_ATTEMPTS = 60;
@@ -542,7 +1279,7 @@ function createVercelProvider() {
   return {
     name: "vercel",
     async authenticate(apiToken) {
-      logger4.debug("Authenticating with Vercel");
+      logger8.debug("Authenticating with Vercel");
       try {
         const user = await vercelFetch(
           apiToken,
@@ -550,10 +1287,10 @@ function createVercelProvider() {
         );
         token = apiToken;
         const username = user.user.username || user.user.email;
-        logger4.info("Vercel authenticated", { user: username });
+        logger8.info("Vercel authenticated", { user: username });
         return ok(username);
       } catch (error) {
-        logger4.error("Vercel authentication failed", { error });
+        logger8.error("Vercel authentication failed", { error });
         return err(toDeployError(HaiDeployError.AUTH_FAILED, "deploy_authFailed", error));
       }
     },
@@ -564,11 +1301,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger4.debug("Creating Vercel project", { projectName });
+      logger8.debug("Creating Vercel project", { projectName });
       try {
         const existingId = await findExistingProject(token, projectName);
         if (existingId !== null) {
-          logger4.info("Vercel project found", { projectName, projectId: existingId });
+          logger8.info("Vercel project found", { projectName, projectId: existingId });
           return ok(existingId);
         }
         try {
@@ -583,13 +1320,13 @@ function createVercelProvider() {
               })
             }
           );
-          logger4.info("Vercel project created", { projectName, projectId: project.id });
+          logger8.info("Vercel project created", { projectName, projectId: project.id });
           return ok(project.id);
         } catch (error) {
           if (error instanceof VercelApiError && error.status === 409) {
             const concurrentProjectId = await findExistingProject(token, projectName);
             if (concurrentProjectId !== null) {
-              logger4.info("Vercel project reused after create conflict", {
+              logger8.info("Vercel project reused after create conflict", {
                 projectName,
                 projectId: concurrentProjectId
               });
@@ -599,7 +1336,7 @@ function createVercelProvider() {
           throw error;
         }
       } catch (error) {
-        logger4.error("Vercel project creation failed", { projectName, error });
+        logger8.error("Vercel project creation failed", { projectName, error });
         return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error));
       }
     },
@@ -610,7 +1347,7 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger4.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
+      logger8.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
       try {
         const envEntries = Object.entries(envVars).map(([key, value]) => ({
           key,
@@ -626,10 +1363,10 @@ function createVercelProvider() {
             body: JSON.stringify(envEntries)
           }
         );
-        logger4.info("Vercel env vars set", { projectId, count: envEntries.length });
+        logger8.info("Vercel env vars set", { projectId, count: envEntries.length });
         return ok(void 0);
       } catch (error) {
-        logger4.error("Vercel env vars setup failed", { projectId, error });
+        logger8.error("Vercel env vars setup failed", { projectId, error });
         return err(toDeployError(HaiDeployError.ENV_VAR_FAILED, "deploy_envVarFailed", error));
       }
     },
@@ -640,7 +1377,7 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger4.debug("Deploying to Vercel", { projectId, outputDir });
+      logger8.debug("Deploying to Vercel", { projectId, outputDir });
       try {
         const filePaths = collectFiles(outputDir, outputDir);
         const files = [];
@@ -652,7 +1389,7 @@ function createVercelProvider() {
           await uploadFile(token, content, sha);
           files.push({ file: filePath, sha, size });
         }
-        logger4.debug("Files uploaded", { count: files.length });
+        logger8.debug("Files uploaded", { count: files.length });
         const deployment = await vercelFetch(
           token,
           "/v13/deployments",
@@ -672,14 +1409,14 @@ function createVercelProvider() {
           status: finalStatus,
           envVarsSet: []
         };
-        logger4.info("Vercel deployment complete", {
+        logger8.info("Vercel deployment complete", {
           deploymentId: deployment.id,
           url: result.url,
           status: finalStatus
         });
         return ok(result);
       } catch (error) {
-        logger4.error("Vercel deployment failed", { projectId, error });
+        logger8.error("Vercel deployment failed", { projectId, error });
         return err(toDeployError(HaiDeployError.UPLOAD_FAILED, "deploy_uploadFailed", error));
       }
     }
@@ -728,7 +1465,7 @@ async function pollDeploymentStatus(token, deploymentId) {
   }
   return "building";
 }
-var logger5 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
+var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
 function createAliyunProvisioner() {
   let accessKey = null;
   let secretKey = null;
@@ -737,7 +1474,7 @@ function createAliyunProvisioner() {
     name: "aliyun",
     serviceType: "sms",
     async authenticate(credentials) {
-      logger5.debug("Authenticating with Aliyun");
+      logger9.debug("Authenticating with Aliyun");
       try {
         const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
         const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
@@ -747,10 +1484,10 @@ function createAliyunProvisioner() {
         accessKey = akId;
         secretKey = akSecret;
         signName = credentials.signName;
-        logger5.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        logger9.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
         return ok(akId);
       } catch (error) {
-        logger5.error("Aliyun authentication failed", { error });
+        logger9.error("Aliyun authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -767,7 +1504,7 @@ function createAliyunProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger5.debug("Provisioning Aliyun SMS service");
+      logger9.debug("Provisioning Aliyun SMS service");
       return ok({
         serviceType: "sms",
         provisionerName: "aliyun",
@@ -780,7 +1517,7 @@ function createAliyunProvisioner() {
     }
   };
 }
-var logger6 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
+var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
 var NEON_API = "https://console.neon.tech/api/v2";
 var DEFAULT_NEON_DATABASE_NAME = "neondb";
 var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
@@ -839,7 +1576,7 @@ function createNeonProvisioner() {
     name: "neon",
     serviceType: "db",
     async authenticate(credentials) {
-      logger6.debug("Authenticating with Neon");
+      logger10.debug("Authenticating with Neon");
       try {
         const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
         if (!apiToken) {
@@ -847,10 +1584,10 @@ function createNeonProvisioner() {
         }
         await listNeonProjects(apiToken);
         token = apiToken;
-        logger6.info("Neon authenticated");
+        logger10.info("Neon authenticated");
         return ok("neon-user");
       } catch (error) {
-        logger6.error("Neon authentication failed", { error });
+        logger10.error("Neon authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -867,7 +1604,7 @@ function createNeonProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger6.debug("Provisioning Neon database", { appName });
+      logger10.debug("Provisioning Neon database", { appName });
       let resource;
       try {
         const projectName = `${appName}-db`;
@@ -875,7 +1612,7 @@ function createNeonProvisioner() {
         if (existingProject !== null) {
           resource = { resourceInfo: `neon-project:${existingProject.id}`, resourceStatus: "reused" };
           const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
-          logger6.info("Neon project reused", {
+          logger10.info("Neon project reused", {
             projectId: existingProject.id,
             projectName
           });
@@ -897,10 +1634,10 @@ function createNeonProvisioner() {
         if (!projectId || !connectionUri) {
           throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
         }
-        logger6.info("Neon database provisioned", { projectId });
+        logger10.info("Neon database provisioned", { projectId });
         return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
       } catch (error) {
-        logger6.error("Neon provisioning failed", { appName });
+        logger10.error("Neon provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -922,7 +1659,7 @@ function createNeonProvisioner() {
     }
   };
 }
-var logger7 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
+var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
 var CF_API = "https://api.cloudflare.com/client/v4";
 function createR2Provisioner() {
   let token = null;
@@ -933,7 +1670,7 @@ function createR2Provisioner() {
     name: "r2",
     serviceType: "storage",
     async authenticate(credentials) {
-      logger7.debug("Authenticating with Cloudflare");
+      logger11.debug("Authenticating with Cloudflare");
       try {
         const acctId = credentials.accountId ?? credentials.account_id ?? "";
         const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
@@ -950,10 +1687,10 @@ function createR2Provisioner() {
         token = apiTok;
         accessKey = credentials.accessKeyId;
         secretKey = credentials.secretAccessKey;
-        logger7.info("Cloudflare R2 authenticated", { accountId: acctId });
+        logger11.info("Cloudflare R2 authenticated", { accountId: acctId });
         return ok(acctId);
       } catch (error) {
-        logger7.error("Cloudflare R2 authentication failed", { error });
+        logger11.error("Cloudflare R2 authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -971,7 +1708,7 @@ function createR2Provisioner() {
         );
       }
       const bucketName = `${appName}-storage`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      logger7.debug("Provisioning R2 bucket", { appName, bucketName });
+      logger11.debug("Provisioning R2 bucket", { appName, bucketName });
       try {
         const createRes = await fetch(
           `${CF_API}/accounts/${accountId}/r2/buckets`,
@@ -987,7 +1724,7 @@ function createR2Provisioner() {
         if (!createRes.ok && createRes.status !== 409) {
           throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
         }
-        logger7.info("R2 bucket provisioned", { bucketName });
+        logger11.info("R2 bucket provisioned", { bucketName });
         return ok({
           serviceType: "storage",
           provisionerName: "r2",
@@ -1005,7 +1742,7 @@ function createR2Provisioner() {
           resourceInfo: `r2-bucket:${bucketName}`
         });
       } catch (error) {
-        logger7.error("R2 provisioning failed", { appName, error });
+        logger11.error("R2 provisioning failed", { appName, error });
         return err(
           HaiDeployError.PROVISION_FAILED,
           deployM("deploy_provisionFailed", {
@@ -1020,7 +1757,7 @@ function createR2Provisioner() {
     }
   };
 }
-var logger8 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
+var logger12 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
 var RESEND_API = "https://api.resend.com";
 function createResendProvisioner() {
   let token = null;
@@ -1029,7 +1766,7 @@ function createResendProvisioner() {
     name: "resend",
     serviceType: "email",
     async authenticate(credentials) {
-      logger8.debug("Authenticating with Resend");
+      logger12.debug("Authenticating with Resend");
       try {
         const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
         if (!apiToken || !credentials.from) {
@@ -1043,10 +1780,10 @@ function createResendProvisioner() {
         }
         token = apiToken;
         from = credentials.from;
-        logger8.info("Resend authenticated");
+        logger12.info("Resend authenticated");
         return ok("resend-user");
       } catch (error) {
-        logger8.error("Resend authentication failed", { error });
+        logger12.error("Resend authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1063,7 +1800,7 @@ function createResendProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Provisioning Resend email service");
+      logger12.debug("Provisioning Resend email service");
       return ok({
         serviceType: "email",
         provisionerName: "resend",
@@ -1076,7 +1813,7 @@ function createResendProvisioner() {
     }
   };
 }
-var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
+var logger13 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
 var UPSTASH_API = "https://api.upstash.com";
 function createUpstashAuthHeader(email, apiKey) {
   return `Basic ${Buffer.from(`${email}:${apiKey}`).toString("base64")}`;
@@ -1127,7 +1864,7 @@ function createUpstashProvisioner() {
     name: "upstash",
     serviceType: "cache",
     async authenticate(credentials) {
-      logger9.debug("Authenticating with Upstash");
+      logger13.debug("Authenticating with Upstash");
       try {
         const userEmail = credentials.email ?? "";
         const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
@@ -1137,10 +1874,10 @@ function createUpstashProvisioner() {
         await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
         apiKey = userKey;
-        logger9.info("Upstash authenticated", { email: userEmail });
+        logger13.info("Upstash authenticated", { email: userEmail });
         return ok(userEmail);
       } catch (error) {
-        logger9.error("Upstash authentication failed", { error });
+        logger13.error("Upstash authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1157,7 +1894,7 @@ function createUpstashProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger9.debug("Provisioning Upstash Redis", { appName });
+      logger13.debug("Provisioning Upstash Redis", { appName });
       let resource;
       try {
         const databaseName = `${appName}-cache`;
@@ -1169,7 +1906,7 @@ function createUpstashProvisioner() {
           }
           resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
           const detail = await getUpstashDatabase(email, apiKey, databaseId);
-          logger9.info("Upstash Redis reused", { databaseId, databaseName });
+          logger13.info("Upstash Redis reused", { databaseId, databaseName });
           return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
         }
         const data = await upstashFetch(email, apiKey, "/v2/redis/database", {
@@ -1182,10 +1919,10 @@ function createUpstashProvisioner() {
         });
         if (data.database_id)
           resource = { resourceInfo: `upstash-db:${data.database_id}`, resourceStatus: "created" };
-        logger9.info("Upstash Redis provisioned", { databaseId: data.database_id });
+        logger13.info("Upstash Redis provisioned", { databaseId: data.database_id });
         return ok(buildUpstashProvisionResult(data, "created"));
       } catch (error) {
-        logger9.error("Upstash provisioning failed", { appName });
+        logger13.error("Upstash provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -1209,9 +1946,10 @@ function createUpstashProvisioner() {
 }
 
 // src/deploy-main.ts
-var logger10 = core.logger.child({ module: "deploy", scope: "main" });
+var logger14 = core.logger.child({ module: "deploy", scope: "main" });
 var currentConfig = null;
 var currentProvider = null;
+var currentContainerProvider = null;
 var currentProvisioners = /* @__PURE__ */ new Map();
 var initInProgress = false;
 var notInitialized = core.module.createNotInitializedKit(
@@ -1257,11 +1995,27 @@ var deployCredentials = {
   save: (key, value) => saveCredential(key, value),
   saveAll: (entries) => saveCredentials(entries)
 };
+function normalizeProjectName(name) {
+  const normalized = name.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || "app";
+}
+function mergeProvisionEnv(results) {
+  let env = {};
+  const reachProviders = [];
+  for (const prov of results) {
+    if (prov.envVars.HAI_REACH_PROVIDERS)
+      reachProviders.push(...JSON.parse(prov.envVars.HAI_REACH_PROVIDERS));
+    env = { ...env, ...prov.envVars };
+  }
+  if (reachProviders.length > 0)
+    env.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
+  return env;
+}
 var deploy = {
   credentials: deployCredentials,
   async init(config) {
     if (initInProgress) {
-      logger10.warn("Deploy init already in progress, skipping concurrent call");
+      logger14.warn("Deploy init already in progress, skipping concurrent call");
       return err(
         HaiDeployError.CONFIG_ERROR,
         deployM("deploy_configError", { params: { error: "init already in progress" } })
@@ -1269,14 +2023,14 @@ var deploy = {
     }
     initInProgress = true;
     try {
-      if (currentProvider) {
-        logger10.warn("Deploy module is already initialized, reinitializing");
+      if (currentProvider || currentContainerProvider) {
+        logger14.warn("Deploy module is already initialized, reinitializing");
         await deploy.close();
       }
-      logger10.info("Initializing deploy module");
+      logger14.info("Initializing deploy module");
       const parseResult = DeployConfigSchema.safeParse(config);
       if (!parseResult.success) {
-        logger10.error("Deploy config validation failed", { error: parseResult.error.message });
+        logger14.error("Deploy config validation failed", { error: parseResult.error.message });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", { params: { error: parseResult.error.message } }),
@@ -1285,12 +2039,19 @@ var deploy = {
       }
       const parsed = parseResult.data;
       try {
-        const provider = createProviderByType(parsed.provider.type);
-        const authResult = await provider.authenticate(parsed.provider.token);
-        if (!authResult.success) {
-          return err(authResult.error);
+        let provider = null;
+        let containerProvider = null;
+        if (parsed.provider.type === "docker-ssh") {
+          containerProvider = createDockerSshProvider(parsed.provider, parsed.container?.runtime);
+          logger14.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh.host });
+        } else {
+          provider = createProviderByType(parsed.provider.type);
+          const authResult = await provider.authenticate(parsed.provider.token);
+          if (!authResult.success) {
+            return err(authResult.error);
+          }
+          logger14.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         }
-        logger10.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         currentProvisioners.clear();
         if (parsed.services) {
           const serviceEntries = Object.entries(parsed.services);
@@ -1301,14 +2062,14 @@ var deploy = {
             const credentials = extractCredentials(serviceConfig);
             const provAuthResult = await provisioner.authenticate(credentials);
             if (!provAuthResult.success) {
-              logger10.error("Provisioner authentication failed", {
+              logger14.error("Provisioner authentication failed", {
                 service: serviceType,
                 provisioner: serviceConfig.provisioner
               });
               currentProvisioners.clear();
               return err(provAuthResult.error);
             }
-            logger10.info("Provisioner authenticated", {
+            logger14.info("Provisioner authenticated", {
               service: serviceType,
               user: provAuthResult.data
             });
@@ -1316,17 +2077,19 @@ var deploy = {
           }
         }
         currentProvider = provider;
+        currentContainerProvider = containerProvider;
         currentConfig = parsed;
-        logger10.info("Deploy module initialized", {
+        logger14.info("Deploy module initialized", {
           provider: parsed.provider.type,
           provisioners: [...currentProvisioners.keys()]
         });
         return ok(void 0);
       } catch (error) {
         currentProvider = null;
+        currentContainerProvider = null;
         currentConfig = null;
         currentProvisioners.clear();
-        logger10.error("Deploy module initialization failed", { error });
+        logger14.error("Deploy module initialization failed", { error });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", {
@@ -1340,37 +2103,38 @@ var deploy = {
     }
   },
   async close() {
-    if (!currentProvider) {
-      logger10.info("Deploy module already closed, skipping");
+    if (!currentProvider && !currentContainerProvider) {
+      logger14.info("Deploy module already closed, skipping");
       return;
     }
-    logger10.info("Closing deploy module");
+    logger14.info("Closing deploy module");
     currentProvider = null;
+    currentContainerProvider = null;
     currentConfig = null;
     currentProvisioners.clear();
-    logger10.info("Deploy module closed");
+    logger14.info("Deploy module closed");
   },
   get config() {
     return currentConfig;
   },
   get isInitialized() {
-    return currentProvider !== null;
+    return currentProvider !== null || currentContainerProvider !== null;
   },
   async scan(appDir) {
-    logger10.debug("Scanning application", { appDir });
+    logger14.debug("Scanning application", { appDir });
     return scanApp(appDir);
   },
   async provisionAll(projectName) {
-    if (!currentProvider) {
+    if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger10.info("Provisioning all services", { projectName, count: currentProvisioners.size });
+    logger14.info("Provisioning all services", { projectName, count: currentProvisioners.size });
     const results = [];
     for (const [serviceType, provisioner] of currentProvisioners) {
-      logger10.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
+      logger14.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
       const provResult = await provisioner.provision(projectName);
       if (!provResult.success) {
-        logger10.error("Service provisioning failed", {
+        logger14.error("Service provisioning failed", {
           serviceType,
           provisioner: provisioner.name,
           code: provResult.error.code
@@ -1387,21 +2151,27 @@ var deploy = {
         });
       }
       results.push(provResult.data);
-      logger10.info("Service provisioned", { serviceType, provisioner: provisioner.name });
+      logger14.info("Service provisioned", { serviceType, provisioner: provisioner.name });
     }
     return ok(results);
   },
   async deployApp(appDir, options) {
-    if (!currentProvider) {
+    if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger10.info("Starting deployment", { appDir, options });
+    logger14.info("Starting deployment", { appDir, options });
     const scanResult = await scanApp(appDir);
     if (!scanResult.success) {
       return err(scanResult.error);
     }
     const scan = scanResult.data;
     const projectName = options?.projectName ?? scan.appName;
+    if (currentContainerProvider) {
+      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options);
+    }
+    if (!currentProvider) {
+      return notInitialized.result();
+    }
     if (scan.isSvelteKit && !scan.adapterInstalled) {
       return err(
         HaiDeployError.ADAPTER_MISSING,
@@ -1418,14 +2188,7 @@ var deploy = {
         return err(provResults.error);
       }
       recovery.resources = provResults.data.map(({ envVars: _envVars, ...resource }) => resource);
-      const reachProviders = [];
-      for (const prov of provResults.data) {
-        if (prov.envVars.HAI_REACH_PROVIDERS)
-          reachProviders.push(...JSON.parse(prov.envVars.HAI_REACH_PROVIDERS));
-        allEnvVars = { ...allEnvVars, ...prov.envVars };
-      }
-      if (reachProviders.length > 0)
-        allEnvVars.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
+      allEnvVars = mergeProvisionEnv(provResults.data);
     }
     const projectResult = await currentProvider.createProject(projectName);
     if (!projectResult.success) {
@@ -1454,7 +2217,7 @@ var deploy = {
       ...deployResult.data,
       envVarsSet: Object.keys(allEnvVars)
     };
-    logger10.info("Deployment completed", {
+    logger14.info("Deployment completed", {
       url: result.url,
       deploymentId: result.deploymentId,
       status: result.status
@@ -1462,6 +2225,24 @@ var deploy = {
     return ok(result);
   }
 };
+async function deployContainerApp(provider, appDir, scan, rawProjectName, options) {
+  const projectName = normalizeProjectName(rawProjectName);
+  if (scan.isSvelteKit && !scan.nodeAdapterInstalled) {
+    return err(
+      HaiDeployError.ADAPTER_MISSING,
+      deployM("deploy_adapterMissing", { params: { adapter: "@sveltejs/adapter-node" } })
+    );
+  }
+  let provisionEnv = {};
+  if (!options?.skipProvision) {
+    const provResults = await deploy.provisionAll(projectName);
+    if (!provResults.success) {
+      return err(provResults.error);
+    }
+    provisionEnv = mergeProvisionEnv(provResults.data);
+  }
+  return provider.deploy({ appDir, projectName, scan, provisionEnv });
+}
 
 export { DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, getDeployRecovery };
 //# sourceMappingURL=index.js.map