@h-ai/deploy 0.1.0-alpha.63 → 0.1.0-alpha.65

package/dist/index.js

@@ -1,10 +1,11 @@
 import { z } from 'zod';
-import { core, err, ok } from '@h-ai/core';
-import { existsSync, readFileSync, writeFileSync, readdirSync, mkdirSync, statSync } from 'fs';
+import { core, ok, err } from '@h-ai/core';
+import { readFileSync, existsSync, writeFileSync, chmodSync, mkdirSync, statSync, readdirSync } from 'fs';
+import { resolve, join, basename, dirname, relative, sep } from 'path';
+import process2 from 'process';
+import { parseEnv } from 'util';
+import { parse, stringify, parseAllDocuments } from 'yaml';
 import { homedir } from 'os';
-import { join, dirname, relative, sep } from 'path';
-import process from 'process';
-import { parse, stringify } from 'yaml';
 import { execSync, spawn } from 'child_process';
 import { randomBytes, createHash } from 'crypto';
 import { Buffer } from 'buffer';
@@ -46,7 +47,24 @@ var en_US_default = {
   deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
   deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
   deploy_imageTransferFailed: "Image transfer failed: {error}",
-  deploy_healthCheckFailed: "Health check failed, app not ready at {url}"
+  deploy_healthCheckFailed: "Health check failed, app not ready at {url}",
+  deploy_invalidEnvironment: "Use letters, numbers, underscores or hyphens for the environment; local/example are reserved.",
+  deploy_environmentMissing: "Environment file missing: {path}. Create and configure it before deploying.",
+  deploy_environmentReadFailed: "Cannot read deployment environment files; check syntax and permissions.",
+  deploy_environmentWriteFailed: "Cannot save deployment configuration; check file syntax and permissions.",
+  deploy_multipleApplications: "Multiple service packages found; specify the application directory.",
+  deploy_purposeSqlite: "Local relational database persisted in a volume",
+  deploy_purposeDatabase: "Relational database service for business data",
+  deploy_purposeMemory: "Per-process memory cache; cleared on restart, no external service",
+  deploy_purposeLocal: "Local filesystem storage persisted in a volume",
+  deploy_purposeCache: "Shared cache, sessions and distributed locks",
+  deploy_purposeStorage: "S3-compatible object storage for uploaded files",
+  deploy_purposeVector: "Vector indexing and similarity search",
+  deploy_purposeDisabled: "LDAP login is disabled; no directory service is created",
+  deploy_purposeLdap: "Directory account authentication; the default directory has no business users",
+  deploy_purposeConsole: "Messages go to application logs without delivery",
+  deploy_purposeEmail: "Email/HTTP delivery; the default SMTP container only captures test messages",
+  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota"
 };
 
 // messages/zh-CN.json
@@ -84,7 +102,24 @@ var zh_CN_default = {
   deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
   deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
   deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
-  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA"
+  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA",
+  deploy_invalidEnvironment: "\u73AF\u5883\u540D\u79F0\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26\uFF0C\u4E14\u4E0D\u80FD\u4F7F\u7528 local/example\u3002",
+  deploy_environmentMissing: "\u7F3A\u5C11\u73AF\u5883\u914D\u7F6E {path}\uFF1B\u8BF7\u5148\u521B\u5EFA\u8BE5\u6587\u4EF6\u5E76\u5B8C\u6210\u914D\u7F6E\uFF0C\u518D\u91CD\u65B0\u90E8\u7F72\u3002",
+  deploy_environmentReadFailed: "\u90E8\u7F72\u73AF\u5883\u6587\u4EF6\u8BFB\u53D6\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
+  deploy_environmentWriteFailed: "\u90E8\u7F72\u914D\u7F6E\u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
+  deploy_multipleApplications: "\u53D1\u73B0\u591A\u4E2A\u670D\u52A1\u5305\uFF0C\u8BF7\u6307\u5B9A\u8981\u90E8\u7F72\u7684\u5E94\u7528\u76EE\u5F55\u3002",
+  deploy_purposeSqlite: "\u672C\u5730\u6587\u4EF6\u5173\u7CFB\u6570\u636E\u5E93\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
+  deploy_purposeDatabase: "\u72EC\u7ACB\u5173\u7CFB\u6570\u636E\u5E93\u670D\u52A1\uFF0C\u4FDD\u5B58\u4E1A\u52A1\u6570\u636E",
+  deploy_purposeMemory: "\u5355\u8FDB\u7A0B\u5185\u5B58\u7F13\u5B58\uFF0C\u91CD\u542F\u540E\u6E05\u7A7A\uFF0C\u4E0D\u521B\u5EFA\u5916\u90E8\u670D\u52A1",
+  deploy_purposeLocal: "\u672C\u5730\u6587\u4EF6\u5B58\u50A8\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
+  deploy_purposeCache: "\u5171\u4EAB\u7F13\u5B58\u3001\u4F1A\u8BDD\u4E0E\u5206\u5E03\u5F0F\u9501",
+  deploy_purposeStorage: "S3 \u517C\u5BB9\u5BF9\u8C61\u5B58\u50A8\uFF0C\u4FDD\u5B58\u4E0A\u4F20\u6587\u4EF6",
+  deploy_purposeVector: "\u5411\u91CF\u7D22\u5F15\u4E0E\u76F8\u4F3C\u5EA6\u641C\u7D22",
+  deploy_purposeDisabled: "LDAP \u767B\u5F55\u672A\u542F\u7528\uFF0C\u4E0D\u521B\u5EFA\u76EE\u5F55\u670D\u52A1",
+  deploy_purposeLdap: "\u4F01\u4E1A\u76EE\u5F55\u8D26\u53F7\u8BA4\u8BC1\uFF1B\u9ED8\u8BA4\u76EE\u5F55\u4E0D\u5305\u542B\u4E1A\u52A1\u7528\u6237",
+  deploy_purposeConsole: "\u6D88\u606F\u8F93\u51FA\u5230\u5E94\u7528\u65E5\u5FD7\uFF0C\u4E0D\u5B9E\u9645\u6295\u9012",
+  deploy_purposeEmail: "\u90AE\u4EF6\u6216 HTTP \u901A\u77E5\u6295\u9012\uFF1B\u9ED8\u8BA4 SMTP \u5BB9\u5668\u4EC5\u7528\u4E8E\u6D4B\u8BD5\u63A5\u6536",
+  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6"
 };
 
 // src/deploy-i18n.ts
@@ -117,9 +152,9 @@ var SshConfigSchema = z.object({
 var PortExposeSchema = z.object({
   type: z.literal("port").default("port"),
   /** 容器内监听端口（adapter-node 默认 3000） */
-  containerPort: z.number().int().positive().default(3e3),
+  containerPort: z.number().int().min(1).max(65535).default(3e3),
   /** 宿主机映射端口 */
-  hostPort: z.number().int().positive()
+  hostPort: z.number().int().min(1).max(65535)
 });
 var ExposeSchema = PortExposeSchema;
 var DockerSshProviderConfigSchema = z.object({
@@ -175,11 +210,22 @@ var ServicesConfigSchema = z.object({
   sms: z.discriminatedUnion("provisioner", [AliyunSmsServiceSchema]).optional()
 }).optional();
 var DeployConfigSchema = z.object({
+  /** 部署环境文件模式；dev/test/prod 或自定义模式，禁止 local/example。 */
+  environment: z.string().regex(/^[a-z0-9][\w-]*$/i).refine((value) => !["local", "example"].includes(value.toLowerCase())).optional(),
   provider: ProviderConfigSchema,
   services: ServicesConfigSchema,
   /** 本地容器构建参数（docker-ssh 使用；auto 优先 podman） */
   container: z.object({
-    runtime: z.enum(["auto", "docker", "podman"]).default("auto")
+    runtime: z.enum(["auto", "docker", "podman"]).default("auto"),
+    /** Podman 构建是否继承代理；容器不能访问宿主机 localhost 代理时设为 false。 */
+    httpProxy: z.boolean().default(true),
+    /** 自建 S3 服务实现；协议仍为 storage.type=s3。 */
+    s3Engine: z.enum(["rustfs", "minio"]).default("rustfs"),
+    /** SQLite 预编译包镜像根地址；省略时从官方 GitHub Release 下载，不允许嵌入凭据。 */
+    sqlitePrebuildMirror: z.url().refine((value) => {
+      const url = new URL(value);
+      return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
+    }).optional()
   }).optional()
 });
 var DeployErrorInfo = {
@@ -206,7 +252,165 @@ var DeployErrorInfo = {
 };
 var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
 
-// src/deploy-credentials.ts
+// src/deploy-environment.ts
+function resolveConfig(value, prefix, env) {
+  if (env[prefix] !== void 0)
+    return parse(env[prefix]) ?? env[prefix];
+  if (Array.isArray(value))
+    return value.map((item, index) => resolveConfig(item, `${prefix}_${index}`, env));
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, resolveConfig(nested, `${prefix}_${key.toUpperCase()}`, env)]));
+  if (typeof value !== "string")
+    return value;
+  const resolved = value.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, name, fallback) => env[name] ?? fallback ?? "");
+  return /^\$\{[^}]+\}$/.test(value) ? parse(resolved) ?? resolved : resolved;
+}
+function loadDeploymentConfig(name, path, values) {
+  try {
+    const config = resolveConfig(parse(readFileSync(path, "utf8")), `HAI_${name.toUpperCase()}`, values);
+    return ok(config && typeof config === "object" && !Array.isArray(config) ? config : {});
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
+  }
+}
+function loadDeploymentEnvironment(options) {
+  const environment = options.environment === "production" ? "prod" : options.environment === "development" ? "dev" : options.environment;
+  if (!/^[a-z0-9][\w-]*$/i.test(environment) || ["local", "example"].includes(environment.toLowerCase()))
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_invalidEnvironment"));
+  const envDir = resolve(options.envDir);
+  const target = join(envDir, `.env.${environment}`);
+  if (options.requireFile !== false && !existsSync(target))
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentMissing", { params: { path: target } }));
+  const loaded = core.config.loadEnvFiles({ mode: environment, envDir });
+  if (!loaded.success)
+    return loaded;
+  try {
+    const values = { ...loaded.data };
+    for (const [name, value] of Object.entries(process2.env)) {
+      if (/^(?:HAI_|PUBLIC_|VITE_)/.test(name) && value !== void 0)
+        values[name] = value;
+    }
+    values.HAI_DEPLOY_ENVIRONMENT = environment;
+    values.HAI_CORE_ENV ??= environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
+    const targetValues = {};
+    if (existsSync(target)) {
+      for (const [name, value] of Object.entries(parseEnv(readFileSync(target, "utf8")))) {
+        if (value !== void 0)
+          targetValues[name] = value;
+      }
+    }
+    return ok({ environment, envDir, values, targetValues });
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
+  }
+}
+function isSecret(name, value) {
+  if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
+    return true;
+  try {
+    const url = new URL(value);
+    if (url.username || url.password || [...url.searchParams.keys()].some((key) => /password|secret|token|key|authorization/i.test(key)))
+      return true;
+  } catch {
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object")
+      return Object.entries(parsed).some(([key, nested]) => isSecret(key, typeof nested === "string" ? nested : JSON.stringify(nested)));
+  } catch {
+  }
+  return false;
+}
+function publicConfig(value) {
+  if (Array.isArray(value))
+    return value.map(publicConfig);
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).filter(([name, item]) => !isSecret(name, typeof item === "string" ? item : "")).map(([name, item]) => [name, publicConfig(item)]));
+  return value;
+}
+function quoteEnv(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object")
+      return `'${JSON.stringify(parsed).replaceAll("'", "\\u0027")}'`;
+  } catch {
+  }
+  if (!value.includes("'"))
+    return `'${value}'`;
+  if (!value.includes('"'))
+    return `"${value}"`;
+  if (!value.includes("`"))
+    return `\`${value}\``;
+  if (!/[\r\n#]/.test(value))
+    return value;
+  throw new Error("Unsupported dotenv value");
+}
+function updateFile(path, values, privateFile) {
+  let content = existsSync(path) ? readFileSync(path, "utf8") : "# Local private deployment configuration; do not commit.\n";
+  for (const [name, value] of Object.entries(values)) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
+      throw new Error("Invalid environment variable name");
+    const line = `${name}=${quoteEnv(value)}`;
+    const pattern = new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*`, "gm");
+    if (pattern.test(content))
+      content = content.replace(pattern, () => line);
+    else
+      content = `${content.trimEnd()}
+${line}
+`;
+  }
+  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
+  if (privateFile)
+    chmodSync(path, 384);
+}
+function removeOverrides(path, names, privateFile = true) {
+  if (!existsSync(path) || names.length === 0)
+    return;
+  let content = readFileSync(path, "utf8");
+  for (const name of names)
+    content = content.replace(new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
+  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
+  chmodSync(path, privateFile ? 384 : 420);
+}
+function saveDeploymentEnvironment(environment, values, options = {}) {
+  try {
+    const shared = {};
+    const privateValues = {};
+    for (const [name, value] of Object.entries(values)) {
+      if (options.private) {
+        privateValues[name] = value;
+      } else if (isSecret(name, value)) {
+        privateValues[name] = value;
+        try {
+          const parsed = JSON.parse(value);
+          if (parsed && typeof parsed === "object")
+            shared[name] = JSON.stringify(publicConfig(parsed));
+        } catch {
+        }
+      } else {
+        shared[name] = value;
+      }
+    }
+    if (Object.keys(shared).length)
+      updateFile(join(environment.envDir, `.env.${environment.environment}`), shared, false);
+    if (Object.keys(privateValues).length)
+      updateFile(join(environment.envDir, ".env.local"), privateValues, true);
+    removeOverrides(join(environment.envDir, `.env.${environment.environment}`), Object.keys(privateValues).filter((name) => !(name in shared)), false);
+    removeOverrides(join(environment.envDir, ".env.local"), Object.keys(shared).filter((name) => !(name in privateValues)));
+    if (Object.keys(privateValues).length) {
+      const ignorePath = join(environment.envDir, ".gitignore");
+      const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
+      if (!ignore.split(/\r?\n/).includes(".env.local"))
+        writeFileSync(ignorePath, `${ignore.trimEnd()}
+.env.local
+.hai/deploy/
+`);
+    }
+    return ok(Object.keys(values));
+  } catch {
+    return err(HaiDeployError.ENV_VAR_FAILED, deployM("deploy_environmentWriteFailed"));
+  }
+}
 var logger = core.logger.child({ module: "deploy", scope: "credentials" });
 var DEPLOY_CREDENTIAL_KEY_PATTERN = /^HAI_DEPLOY_[A-Z0-9_]+$/;
 function isAllowedCredentialKey(key) {
@@ -270,7 +474,7 @@ function loadCredentials() {
     const data = readCredentialsFile();
     const keys = Object.keys(data);
     for (const key of keys) {
-      process.env[key] = String(data[key]);
+      process2.env[key] = String(data[key]);
     }
     logger.debug("Credentials loaded", { count: keys.length });
     return ok(keys);
@@ -291,7 +495,7 @@ function saveCredential(key, value) {
     const data = readCredentialsFile();
     data[key] = value;
     writeCredentialsFile(data);
-    process.env[key] = value;
+    process2.env[key] = value;
     logger.debug("Credential saved", { key });
     return ok(void 0);
   } catch (error) {
@@ -311,7 +515,7 @@ function saveCredentials(entries) {
     const data = readCredentialsFile();
     for (const [key, value] of Object.entries(entries)) {
       data[key] = value;
-      process.env[key] = value;
+      process2.env[key] = value;
     }
     writeCredentialsFile(data);
     logger.debug("Credentials saved", { count: Object.keys(entries).length });
@@ -328,13 +532,17 @@ function saveCredentials(entries) {
   }
 }
 var logger2 = core.logger.child({ module: "deploy", scope: "functions" });
+function usesDefaultMiddleware(scan, service, options) {
+  const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
+  return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
+}
 function buildApp(appDir, buildCommand, envVars = {}) {
   logger2.info("Building application", { appDir, buildCommand });
   try {
     execSync(buildCommand, {
       cwd: appDir,
       stdio: "inherit",
-      env: { ...process.env, ...envVars }
+      env: { ...process2.env, ...envVars }
     });
     return ok(void 0);
   } catch (error) {
@@ -387,195 +595,144 @@ function recoveryFailure(error, recovery) {
   });
 }
 var logger3 = core.logger.child({ module: "deploy", scope: "scanner" });
-function readYaml(filePath) {
-  if (!existsSync(filePath)) {
-    return null;
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function runtimeDependencies(appDir) {
+  let root = appDir;
+  while (!existsSync(join(root, "pnpm-lock.yaml"))) {
+    const parent = dirname(root);
+    if (parent === root)
+      throw new Error("Missing pnpm lockfile; run pnpm install");
+    root = parent;
   }
-  try {
-    const content = readFileSync(filePath, "utf-8");
-    const parsed = parse(content);
-    if (parsed === null || parsed === void 0 || typeof parsed !== "object") {
-      return null;
+  const importerKey = relative(root, appDir).replaceAll("\\", "/") || ".";
+  const documents = parseAllDocuments(readFileSync(join(root, "pnpm-lock.yaml"), "utf8"));
+  if (documents.some((document) => document.errors.length))
+    throw new Error("Invalid pnpm lockfile");
+  const lock = documents.map((document) => record(document.toJS())).reverse().find((document) => importerKey in record(document.importers));
+  if (!lock)
+    throw new Error("Application is missing from pnpm lockfile; run pnpm install");
+  const importers = record(lock.importers);
+  const packages = record(lock.packages);
+  const snapshots = record(lock.snapshots);
+  const names = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (id, node, importer) => {
+    if (visited.has(id))
+      return;
+    visited.add(id);
+    const metadata = importer === void 0 ? record(packages[id.split("(")[0]]) : {};
+    const peers = record(metadata.peerDependencies);
+    for (const [name, reference] of Object.entries({ ...record(node.dependencies), ...record(node.optionalDependencies) })) {
+      if (name in peers)
+        continue;
+      const version = typeof reference === "string" ? reference : record(reference).version;
+      if (typeof version !== "string")
+        throw new Error("Invalid pnpm dependency reference");
+      if (version.startsWith("link:")) {
+        if (importer === void 0)
+          throw new Error("Invalid workspace dependency");
+        const target = relative(root, resolve(root, importer, version.slice(5))).replaceAll("\\", "/") || ".";
+        const linked = record(importers[target]);
+        if (!Object.keys(linked).length)
+          throw new Error("Missing linked workspace importer");
+        names.add(name);
+        visit(`workspace:${target}`, linked, target);
+        continue;
+      }
+      const key = version in snapshots || version in packages ? version : `${name}@${version}`;
+      names.add(key.match(/^(@[^/]+\/[^@]+|[^@]+)@/)?.[1] ?? name);
+      const snapshot = record(snapshots[key] ?? packages[key]);
+      if (!Object.keys(snapshot).length && !(key in snapshots) && !(key in packages))
+        throw new Error("Missing pnpm dependency snapshot");
+      visit(key, snapshot);
     }
-    return parsed;
-  } catch {
-    return null;
-  }
+  };
+  visit(`workspace:${importerKey}`, record(importers[importerKey]), importerKey);
+  return { runtime: names, build: /* @__PURE__ */ new Set([...names, ...Object.keys(record(record(importers[importerKey]).devDependencies))]), root };
 }
-function readJson(filePath) {
-  if (!existsSync(filePath)) {
-    return null;
-  }
+async function scanApp(inputDir, options) {
   try {
-    const content = readFileSync(filePath, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-function hasDependency(pkg, name) {
-  const deps = pkg.dependencies;
-  const devDeps = pkg.devDependencies;
-  return deps !== void 0 && name in deps || devDeps !== void 0 && name in devDeps;
-}
-function detectRequiredServices(configDir) {
-  const services = [];
-  const backends = {};
-  if (!existsSync(configDir)) {
-    return { services, backends };
-  }
-  const files = readdirSync(configDir);
-  const dbFile = files.find((f) => f.startsWith("_db."));
-  if (dbFile) {
-    const dbConfig = readYaml(join(configDir, dbFile));
-    if (dbConfig !== null) {
-      services.push("db");
-      backends.db = dbConfig.type ?? "postgresql";
-    }
-  }
-  const cacheFile = files.find((f) => f.startsWith("_cache."));
-  if (cacheFile) {
-    const cacheConfig = readYaml(join(configDir, cacheFile));
-    if (cacheConfig !== null && cacheConfig.type === "redis") {
-      services.push("cache");
-      backends.cache = "redis";
-    }
-  }
-  const storageFile = files.find((f) => f.startsWith("_storage."));
-  if (storageFile) {
-    const storageConfig = readYaml(join(configDir, storageFile));
-    if (storageConfig !== null && detectStorageIsS3(storageConfig)) {
-      services.push("storage");
-      backends.storage = "s3";
-    }
-  }
-  const vecdbFile = files.find((f) => f.startsWith("_vecdb."));
-  if (vecdbFile) {
-    const vecdbConfig = readYaml(join(configDir, vecdbFile));
-    if (vecdbConfig !== null) {
-      services.push("vecdb");
-      backends.vecdb = vecdbConfig.type ?? "qdrant";
-    }
-  }
-  const reachFile = files.find((f) => f.startsWith("_reach."));
-  if (reachFile) {
-    const reachConfig = readYaml(join(configDir, reachFile));
-    if (reachConfig !== null) {
-      detectReachServices(reachConfig, services);
-    }
-  }
-  return { services, backends };
-}
-function detectStorageIsS3(config) {
-  if (config.type === "s3") {
-    return true;
-  }
-  const providers = config.providers;
-  if (providers === void 0) {
-    return false;
-  }
-  return Object.values(providers).some((p) => p?.type === "s3");
-}
-function detectReachServices(config, services) {
-  const providers = config.providers;
-  if (!Array.isArray(providers)) {
-    return;
-  }
-  let hasEmail = false;
-  let hasSms = false;
-  for (const provider of providers) {
-    const providerType = provider.type;
-    if (!hasEmail && (providerType === "smtp" || providerType === "api")) {
-      hasEmail = true;
-      services.push("email");
+    const appDir = resolve(inputDir);
+    const graph = runtimeDependencies(appDir);
+    const envDir = options?.envDir ? resolve(options.envDir) : existsSync(join(appDir, ".env")) ? appDir : graph.root;
+    const loaded = loadDeploymentEnvironment({ environment: options?.environment ?? "prod", envDir, requireFile: options?.environment !== void 0 });
+    if (!loaded.success)
+      return loaded;
+    const env = loaded.data.values;
+    const deps = graph.runtime;
+    const configs = {};
+    for (const [name, owner] of Object.entries({ db: "reldb", cache: "cache", storage: "storage", vecdb: "vecdb", iam: "iam", reach: "reach" })) {
+      configs[name] = {};
+      if (!deps.has(`@h-ai/${owner}`))
+        continue;
+      const configFile = ["yml", "yaml"].map((ext) => join(appDir, "config", `_${name}.${ext}`)).find(existsSync);
+      const config = configFile ? loadDeploymentConfig(name, configFile, env) : void 0;
+      if (config && !config.success)
+        return config;
+      configs[name] = config?.data ?? {};
     }
-    if (!hasSms && providerType === "aliyun-sms") {
-      hasSms = true;
-      services.push("sms");
+    const middlewares = [];
+    const add = (service, backend, configName = service, configPath = [], config = configs[configName] ?? {}, source = `_${configName}.yml`) => {
+      middlewares.push({ service, backend, source, configName, configPath, envPrefix: ["HAI", configName, ...configPath].map((part) => part.toUpperCase()).join("_"), config });
+    };
+    const iam = deps.has("@h-ai/iam");
+    if (deps.has("@h-ai/reldb"))
+      add("db", String(configs.db.type ?? "sqlite"), "db", [], configs.db, "@h-ai/reldb / _db.yml");
+    if (deps.has("@h-ai/cache"))
+      add("cache", String(configs.cache.type ?? "memory"), "cache", [], configs.cache, "@h-ai/cache / _cache.yml");
+    if (deps.has("@h-ai/storage"))
+      add("storage", String(configs.storage.type ?? "local"));
+    if (deps.has("@h-ai/vecdb"))
+      add("vecdb", String(configs.vecdb.type ?? "lancedb"));
+    if (iam) {
+      const ldap = record(configs.iam.ldap);
+      add("ldap", record(configs.iam.login).ldap === true ? "ldap" : "disabled", "iam", ["ldap"], ldap, "@h-ai/iam (LDAP)");
     }
-  }
-}
-async function scanApp(appDir) {
-  logger3.debug("Scanning application", { appDir });
-  try {
-    const pkg = readJson(join(appDir, "package.json"));
-    if (pkg === null) {
-      return err(
-        HaiDeployError.SCAN_FAILED,
-        deployM("deploy_scanFailed", { params: { error: "package.json not found" } })
-      );
+    const providers = configs.reach.providers;
+    if (deps.has("@h-ai/reach") && Array.isArray(providers)) {
+      for (const [index, item] of providers.entries()) {
+        const provider = record(item);
+        const type = String(provider.type ?? "");
+        const service = type === "aliyun-sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
+        if (service)
+          add(service, type, "reach", ["providers", String(index)], provider, "@h-ai/reach");
+      }
     }
-    const appName = extractAppName(pkg);
-    const isSvelteKit = existsSync(join(appDir, "svelte.config.js")) || existsSync(join(appDir, "svelte.config.ts"));
-    const adapterInstalled = hasDependency(pkg, "@sveltejs/adapter-vercel");
-    const nodeAdapterInstalled = hasDependency(pkg, "@sveltejs/adapter-node");
-    const configDir = join(appDir, "config");
-    const configDetection = detectRequiredServices(configDir);
-    const depServices = detectServicesFromDependencies(pkg);
-    const requiredServices = Array.from(/* @__PURE__ */ new Set([...configDetection.services, ...depServices]));
-    const scripts = pkg.scripts;
-    const buildCommand = scripts?.build ?? "pnpm build";
-    const scanResult = {
-      appName,
+    if (deps.has("@h-ai/reach") && !middlewares.some((item) => item.configName === "reach"))
+      add("email", "console", "reach", ["providers", "0"], { name: "email", type: "console" }, "@h-ai/reach");
+    const isSvelteKit = graph.build.has("@sveltejs/kit");
+    const scan = {
+      appDir,
+      envDir,
+      middlewares,
+      haiModules: [...deps].filter((name) => name.startsWith("@h-ai/")).sort(),
+      appName: basename(appDir),
       isSvelteKit,
-      adapterInstalled,
-      nodeAdapterInstalled,
-      requiredServices,
-      serviceBackends: configDetection.backends,
-      buildCommand
+      adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
+      nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
+      requiredServices: [...new Set(middlewares.map((item) => item.service))],
+      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend])),
+      buildCommand: "pnpm build"
     };
-    logger3.info("Application scanned", {
-      appName,
-      isSvelteKit,
-      adapterInstalled,
-      nodeAdapterInstalled,
-      requiredServices,
-      serviceBackends: configDetection.backends
-    });
-    return ok(scanResult);
-  } catch (error) {
-    logger3.error("Application scan failed", { appDir, error });
-    return err(
-      HaiDeployError.SCAN_FAILED,
-      deployM("deploy_scanFailed", {
-        params: { error: error instanceof Error ? error.message : String(error) }
-      }),
-      error
-    );
-  }
-}
-function detectServicesFromDependencies(pkg) {
-  const depMap = {
-    "@h-ai/reldb": "db",
-    "@h-ai/cache": "cache",
-    "@h-ai/storage": "storage",
-    "@h-ai/vecdb": "vecdb"
-  };
-  const services = [];
-  for (const [depName, serviceType] of Object.entries(depMap)) {
-    if (hasDependency(pkg, depName)) {
-      services.push(serviceType);
-    }
-  }
-  return services;
-}
-function extractAppName(pkg) {
-  const name = pkg.name ?? "app";
-  const slashIndex = name.indexOf("/");
-  if (slashIndex >= 0) {
-    return name.slice(slashIndex + 1);
+    logger3.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
+    return ok(scan);
+  } catch {
+    return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
   }
-  return name;
 }
 var IMAGES = {
   postgres: "postgres:16-alpine",
   mysql: "mysql:8.4",
   redis: "redis:7-alpine",
-  minio: "minio/minio:RELEASE.2025-09-07T16-13-09Z",
-  mc: "minio/mc:RELEASE.2025-08-13T08-35-41Z",
+  rustfs: "ghcr.io/rustfs/rustfs:1.0.1",
+  minio: "ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z",
   qdrant: "qdrant/qdrant:v1.12.4",
   pgvector: "pgvector/pgvector:pg17",
-  chroma: "chromadb/chroma:0.5.23"
+  chroma: "chromadb/chroma:1.5.5",
+  ldap: "docker.io/osixia/openldap:1.5.0",
+  smtp: "axllent/mailpit:v1.27.4"
 };
 function generatePassword() {
   return randomBytes(24).toString("base64url");
@@ -590,7 +747,8 @@ function resolveSidecarSecrets(appDir, projectName) {
   }
   const secrets = {
     dbPassword: generatePassword(),
-    storagePassword: generatePassword()
+    storagePassword: generatePassword(),
+    ldapPassword: generatePassword()
   };
   mkdirSync(dirname(secretFile), { recursive: true });
   writeFileSync(secretFile, JSON.stringify(secrets), { mode: 384 });
@@ -651,38 +809,57 @@ function planRedisCache(plan, projectName, net) {
   };
   plan.env.HAI_CACHE = JSON.stringify({ type: "redis", url: "redis://cache:6379" });
 }
-function planMinioStorage(plan, projectName, password, net) {
+function planS3Storage(plan, projectName, password, net, engine) {
   plan.services.push("storage");
   plan.dependsOn.push("storage");
   plan.composeServices.storage = {
-    image: IMAGES.minio,
+    image: IMAGES[engine],
     container_name: `hai-${projectName}-storage`,
     restart: "unless-stopped",
-    command: ["server", "/data"],
+    ...engine === "minio" ? { command: ["server", "/data"] } : {},
     env_file: [".env.runtime"],
     volumes: [`${projectName}-storage-data:/data`],
     networks: net
   };
   plan.composeServices["storage-init"] = {
-    image: IMAGES.mc,
     depends_on: ["storage"],
     env_file: [".env.runtime"],
     entrypoint: [
-      "sh",
-      "-c",
-      'until mc alias set s3 http://storage:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"; do sleep 1; done; mc mb -p s3/hai; exit 0'
+      "node",
+      "--input-type=module",
+      "-e",
+      // 复用应用 @h-ai/storage 已依赖的 SDK；不额外拉取失效的 mc 镜像，不把密钥拼进命令。
+      `import { S3Client, HeadBucketCommand, CreateBucketCommand } from '@aws-sdk/client-s3';
+const config = JSON.parse(process.env.HAI_STORAGE);
+const client = new S3Client({ endpoint: config.endpoint, region: config.region, forcePathStyle: config.forcePathStyle, credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } });
+let ready = false;
+for (let attempt = 0; attempt < 120; attempt++) {
+  try {
+    try { await client.send(new HeadBucketCommand({ Bucket: config.bucket })); }
+    catch (error) {
+      if (error.$$metadata?.httpStatusCode !== 404) throw error;
+      await client.send(new CreateBucketCommand({ Bucket: config.bucket }));
+    }
+    ready = true; break;
+  } catch { await new Promise(resolve => setTimeout(resolve, 1000)); }
+}
+client.destroy();
+if (!ready) throw new Error('S3 bucket initialization failed');`
     ],
     networks: net
   };
   plan.volumes[`${projectName}-storage-data`] = null;
-  plan.env.MINIO_ROOT_USER = "hai";
-  plan.env.MINIO_ROOT_PASSWORD = password;
+  if (engine === "rustfs") {
+    Object.assign(plan.env, { RUSTFS_ACCESS_KEY: "hai-storage", RUSTFS_SECRET_KEY: password, RUSTFS_ADDRESS: "0.0.0.0:9000", RUSTFS_VOLUMES: "/data", RUSTFS_CONSOLE_ENABLE: "false" });
+  } else {
+    Object.assign(plan.env, { MINIO_ROOT_USER: "hai-storage", MINIO_ROOT_PASSWORD: password });
+  }
   plan.env.HAI_STORAGE = JSON.stringify({
     type: "s3",
     endpoint: "http://storage:9000",
     bucket: "hai",
     region: "us-east-1",
-    accessKeyId: "hai",
+    accessKeyId: "hai-storage",
     secretAccessKey: password,
     forcePathStyle: true
   });
@@ -732,7 +909,7 @@ function planChromaVecdb(plan, projectName, net) {
   plan.volumes[`${projectName}-vecdb-data`] = null;
   plan.env.HAI_VECDB = JSON.stringify({ type: "chroma", url: "http://vecdb:8000" });
 }
-function planSidecars(appDir, projectName, scan, provisionEnv) {
+function planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine = "rustfs") {
   const plan = {
     services: [],
     composeServices: {},
@@ -742,10 +919,14 @@ function planSidecars(appDir, projectName, scan, provisionEnv) {
     dependsOn: [],
     secrets: []
   };
+  if (!scan.requiredServices.some((service) => usesDefaultMiddleware(scan, service, options)))
+    return plan;
   const secrets = resolveSidecarSecrets(appDir, projectName);
   const net = ["hai-app"];
   const backends = scan.serviceBackends;
   for (const service of scan.requiredServices) {
+    if (!usesDefaultMiddleware(scan, service, options))
+      continue;
     if (service === "db" && !provisionEnv.HAI_DB) {
       const backend = backends.db ?? "postgresql";
       if (backend === "mysql")
@@ -755,9 +936,13 @@ function planSidecars(appDir, projectName, scan, provisionEnv) {
       else
         planPostgresDb(plan, projectName, secrets.dbPassword, net);
     } else if (service === "cache" && !provisionEnv.HAI_CACHE) {
-      planRedisCache(plan, projectName, net);
+      if ((backends.cache ?? "redis") === "redis")
+        planRedisCache(plan, projectName, net);
     } else if (service === "storage" && !provisionEnv.HAI_STORAGE) {
-      planMinioStorage(plan, projectName, secrets.storagePassword, net);
+      if ((backends.storage ?? "s3") === "s3")
+        planS3Storage(plan, projectName, secrets.storagePassword, net, s3Engine);
+      else
+        addAppDataVolume(plan, projectName);
     } else if (service === "vecdb" && !provisionEnv.HAI_VECDB) {
       const backend = backends.vecdb ?? "qdrant";
       if (backend === "pgvector")
@@ -768,16 +953,39 @@ function planSidecars(appDir, projectName, scan, provisionEnv) {
         addAppDataVolume(plan, projectName);
       else
         planQdrantVecdb(plan, projectName, net);
+    } else if (service === "ldap" && backends.ldap === "ldap" && !provisionEnv.HAI_IAM_LDAP) {
+      const password = secrets.ldapPassword ?? secrets.dbPassword;
+      plan.services.push("ldap");
+      plan.dependsOn.push("ldap");
+      plan.composeServices.ldap = { image: IMAGES.ldap, restart: "unless-stopped", env_file: [".env.runtime"], networks: net, volumes: [`${projectName}-ldap-data:/var/lib/ldap`, `${projectName}-ldap-config:/etc/ldap/slapd.d`] };
+      plan.volumes[`${projectName}-ldap-data`] = null;
+      plan.volumes[`${projectName}-ldap-config`] = null;
+      Object.assign(plan.env, { LDAP_DOMAIN: "example.org", LDAP_ORGANISATION: "HAI", LDAP_ADMIN_PASSWORD: password, LDAP_TLS: "false", HAI_IAM_LOGIN_LDAP: "true", HAI_IAM_LDAP: JSON.stringify({ url: "ldap://ldap:389", bindDn: "cn=admin,dc=example,dc=org", bindPassword: password, searchBase: "dc=example,dc=org" }) });
+      plan.secrets.push(password);
+    } else if (service === "email" && (scan.middlewares ? scan.middlewares.some((item) => item.service === "email" && item.backend === "smtp" && (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email ?? "default") === "default") : backends.email === "smtp") && !provisionEnv.HAI_REACH_PROVIDERS) {
+      plan.services.push("email");
+      plan.dependsOn.push("email");
+      plan.composeServices.email = { image: IMAGES.smtp, restart: "unless-stopped", networks: net };
+      const requirements = scan.middlewares?.filter((item) => item.service === "email" && item.backend === "smtp" && ["default", void 0].includes(options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email));
+      if (requirements?.length) {
+        for (const requirement of requirements)
+          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+      } else if (!scan.middlewares) {
+        plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({ name: "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+      }
     }
   }
   return plan;
 }
-function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort) {
-  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv);
+function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv = {}, s3Engine = "rustfs") {
+  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine);
   const env = {
     NODE_ENV: "production",
     HOST: "0.0.0.0",
     PORT: String(containerPort),
+    HAI_SERV_SERVER_HOST: "0.0.0.0",
+    HAI_SERV_SERVER_PORT: String(containerPort),
+    ...appEnv,
     ...sidecar.env,
     ...provisionEnv
   };
@@ -799,21 +1007,55 @@ function generateComposeFile(options) {
     app.volumes = sidecar.appVolumes;
   if (sidecar.dependsOn.length > 0)
     app.depends_on = sidecar.dependsOn;
+  const services = { app, ...sidecar.composeServices };
+  if (services["storage-init"])
+    services["storage-init"] = { ...services["storage-init"], image: imageRef };
   const compose = {
-    services: {
-      app,
-      ...sidecar.composeServices
-    },
+    services,
     networks: {
       "hai-app": { name: `hai-${projectName}` }
     }
   };
   if (Object.keys(sidecar.volumes).length > 0)
     compose.volumes = sidecar.volumes;
+  if (options.previousCompose && options.serviceModes) {
+    const previous = parse(options.previousCompose);
+    for (const [service, mode] of Object.entries(options.serviceModes)) {
+      if (mode !== "keep")
+        continue;
+      for (const name of [service, `${service}-init`]) {
+        if (previous.services?.[name]) {
+          services[name] = previous.services[name];
+          app.depends_on = [.../* @__PURE__ */ new Set([...app.depends_on ?? [], service])];
+        }
+      }
+    }
+    const previousMounts = previous.services?.app?.volumes;
+    if (Array.isArray(previousMounts) && Object.values(options.serviceModes).includes("keep"))
+      app.volumes = [.../* @__PURE__ */ new Set([...app.volumes ?? [], ...previousMounts])];
+    compose.volumes = { ...previous.volumes, ...sidecar.volumes };
+  }
+  if (services["storage-init"]) {
+    app.depends_on = {
+      ...Object.fromEntries((app.depends_on ?? []).map((name) => [name, { condition: "service_started" }])),
+      "storage-init": { condition: "service_completed_successfully" }
+    };
+  }
   return stringify(compose);
 }
 function serializeEnvFile(env) {
-  return `${Object.entries(env).map(([key, value]) => `${key}=${value}`).join("\n")}
+  return `${Object.entries(env).map(([key, value]) => {
+    let literal = value;
+    if (/[\s#$'"]/.test(value)) {
+      if (value.startsWith("{") || value.startsWith("["))
+        literal = `'${value.replaceAll("'", "\\u0027")}'`;
+      else if (!value.includes("'"))
+        literal = `'${value}'`;
+      else
+        literal = JSON.stringify(value).replaceAll("$", "$$");
+    }
+    return `${key}=${literal}`;
+  }).join("\n")}
 `;
 }
 function generateDockerignore() {
@@ -826,31 +1068,46 @@ function generateDockerignore() {
 **/test-results
 **/playwright-report
 **/.hai/deploy
+**/.env.local
+**/.env.*.local
+**/.env.runtime
 .git
 `;
 }
-function generateFallbackDockerfile(packageName, containerPort) {
+function generateFallbackDockerfile(packageName, containerPort, options = {}) {
+  if (!/^@?[a-z0-9][\w./-]*$/i.test(packageName) || !/^[a-z0-9][\w-]*$/i.test(options.environment ?? "prod"))
+    throw new Error("Invalid container build target");
+  const environment = options.environment ?? "prod";
+  const coreEnv = environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
   return `# syntax=docker/dockerfile:1.7
 FROM node:24-bookworm-slim AS build
+ARG SQLITE_PREBUILD_MIRROR
+ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 ENV CI=true
+ENV HAI_DEPLOY_ENVIRONMENT=${environment}
+ENV HAI_CORE_ENV=${coreEnv}
 WORKDIR /workspace
 RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
 COPY . .
 RUN pnpm install --frozen-lockfile --ignore-scripts
-RUN pnpm --filter ${packageName} build
+RUN pnpm --filter ${packageName}... build
+RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
 RUN pnpm pm deploy --filter ${packageName} --prod /prod/app
 
 FROM node:24-bookworm-slim AS runtime
 ENV NODE_ENV=production
+ENV HAI_DEPLOY_ENVIRONMENT=${environment}
+ENV HAI_CORE_ENV=${coreEnv}
 ENV HOST=0.0.0.0
 ENV PORT=${containerPort}
 WORKDIR /app
 COPY --from=build --chown=node:node /prod/app ./
+RUN mkdir -p data && chown node:node data
 USER node
 EXPOSE ${containerPort}
-CMD ["node", "build"]
+CMD ["node", ${JSON.stringify(options.entrypoint ?? "build")}]
 `;
 }
 var logger4 = core.logger.child({ module: "deploy", scope: "command" });
@@ -865,10 +1122,10 @@ function maskSecrets(text, secrets) {
   return masked;
 }
 function runCommand(command, args, options = {}) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const child = spawn(command, args, {
       cwd: options.cwd,
-      env: options.env ? { ...process.env, ...options.env } : process.env,
+      env: options.env ? { ...process2.env, ...options.env } : process2.env,
       shell: false
     });
     let stdout = "";
@@ -881,7 +1138,7 @@ function runCommand(command, args, options = {}) {
       settled = true;
       if (timer)
         clearTimeout(timer);
-      resolve(result);
+      resolve3(result);
     };
     if (options.timeoutMs && options.timeoutMs > 0) {
       timer = setTimeout(() => {
@@ -918,12 +1175,14 @@ function runCommand(command, args, options = {}) {
       logger4.error("Command exited with non-zero code", {
         command,
         code: exitCode,
-        stderr: maskSecrets(stderr, options.secrets).slice(-500)
+        stderr: maskSecrets(stderr, options.secrets).slice(-500),
+        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
       });
       finish(err(
         HaiDeployError.REMOTE_COMMAND_FAILED,
         deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(stderr || `exit ${exitCode}`, options.secrets).slice(-500) }
+          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
         })
       ));
     });
@@ -956,6 +1215,12 @@ async function buildImage(runtime, options) {
   const args = ["build", "-f", options.dockerfilePath, "-t", options.imageRef];
   if (runtime === "podman")
     args.push("--format", "docker", "--jobs", "1");
+  if (runtime === "podman" && existsSync(`${options.dockerfilePath}.dockerignore`))
+    args.push("--ignorefile", `${options.dockerfilePath}.dockerignore`);
+  if (runtime === "podman" && options.httpProxy === false)
+    args.push("--http-proxy=false");
+  for (const [key, value] of Object.entries(options.buildArgs ?? {}))
+    args.push("--build-arg", `${key}=${value}`);
   args.push(options.contextDir);
   logger5.info("Building container image", { runtime, imageRef: options.imageRef });
   const result = await runCommand(runtime, args, { cwd: options.contextDir });
@@ -1049,6 +1314,9 @@ function createSshExecutor(config) {
 var logger7 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
 var HEALTH_POLL_INTERVAL = 3e3;
 var HEALTH_MAX_ATTEMPTS = 40;
+function shellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
 function makeDeploymentId() {
   const now = /* @__PURE__ */ new Date();
   const pad = (n) => String(n).padStart(2, "0");
@@ -1060,7 +1328,7 @@ function parseLoadedImageRef(stdout, fallback) {
   return match ? match[1] : fallback;
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function readPackageName(appDir) {
   try {
@@ -1083,7 +1351,9 @@ function resolveWorkspaceRoot(appDir) {
   }
   return appDir;
 }
-function createDockerSshProvider(config, localRuntimePref = "auto") {
+function createDockerSshProvider(config, container) {
+  const localRuntimePref = container?.runtime ?? "auto";
+  const httpProxy = container?.httpProxy ?? true;
   const ssh = createSshExecutor(config.ssh);
   const baseDir = config.remote.baseDir;
   async function detectRemoteRuntime() {
@@ -1116,7 +1386,7 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
     return false;
   }
   const deploy2 = async (context) => {
-    const { appDir, projectName, scan, provisionEnv } = context;
+    const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
     const deploymentId = makeDeploymentId();
     const containerPort = config.expose.containerPort;
     const hostPort = config.expose.hostPort;
@@ -1125,7 +1395,7 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
     if (!runtimeResult.success)
       return err(runtimeResult.error);
     const localRuntime = runtimeResult.data;
-    const artifactDir = join(appDir, ".hai", "deploy");
+    const artifactDir = join(appDir, ".hai", "deploy", options?.environment ?? "prod");
     mkdirSync(artifactDir, { recursive: true });
     const appDockerfile = join(appDir, "Dockerfile");
     let dockerfilePath;
@@ -1135,21 +1405,33 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
       contextDir = appDir;
     } else {
       dockerfilePath = join(artifactDir, "Dockerfile");
-      writeFileSync(dockerfilePath, generateFallbackDockerfile(readPackageName(appDir), containerPort));
+      writeFileSync(dockerfilePath, generateFallbackDockerfile(readPackageName(appDir), containerPort, { environment: options?.environment, entrypoint: scan.isSvelteKit ? "build" : "dist/index.js" }));
       writeFileSync(`${dockerfilePath}.dockerignore`, generateDockerignore());
       contextDir = resolveWorkspaceRoot(appDir);
       logger7.info("Generated fallback Dockerfile", { dockerfilePath, contextDir });
     }
+    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
+    const envPath = join(artifactDir, ".env.runtime");
+    const previousEnv = existsSync(envPath) ? parseEnv(readFileSync(envPath, "utf8")) : {};
+    Object.assign(env, { ...previousEnv, ...env });
+    writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
+    if (options?.environment) {
+      const environment = loadDeploymentEnvironment({ environment: options.environment, envDir: options.envDir ?? scan.envDir ?? appDir });
+      if (!environment.success)
+        return environment;
+      const saved = saveDeploymentEnvironment(environment.data, { HAI_DEPLOY_ENVIRONMENT: environment.data.environment, HAI_CORE_ENV: environment.data.values.HAI_CORE_ENV, ...sidecar.env, ...provisionEnv });
+      if (!saved.success)
+        return saved;
+    }
     const buildResult = await buildImage(localRuntime, {
       contextDir,
       dockerfilePath,
-      imageRef: localImageTag
+      imageRef: localImageTag,
+      buildArgs: { HAI_DEPLOY_ENVIRONMENT: options?.environment ?? "prod", HAI_CORE_ENV: env.HAI_CORE_ENV ?? "production", SQLITE_PREBUILD_MIRROR: container?.sqlitePrebuildMirror ?? "" },
+      httpProxy
     });
     if (!buildResult.success)
       return err(buildResult.error);
-    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort);
-    const envPath = join(artifactDir, ".env.runtime");
-    writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
     const tarPath = join(artifactDir, `${projectName}.tar`);
     const saveResult = await saveImage(localRuntime, localImageTag, tarPath);
     if (!saveResult.success)
@@ -1162,20 +1444,20 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
       return err(remoteRuntimeResult.error);
     const remoteRuntime = remoteRuntimeResult.data;
     const remoteDir = `${baseDir}/${projectName}`;
-    const prepareResult = await ssh.exec(`mkdir -p ${remoteDir} && chmod 700 ${remoteDir}`);
+    const prepareResult = await ssh.exec(`mkdir -p -- ${shellArgument(remoteDir)} && chmod 700 -- ${shellArgument(remoteDir)}`);
     if (!prepareResult.success)
       return err(prepareResult.error);
     const remoteTar = `${remoteDir}/image.tar`;
     const uploadTarResult = await ssh.upload(tarPath, remoteTar);
     if (!uploadTarResult.success)
       return err(uploadTarResult.error);
-    const loadResult = await ssh.exec(`${remoteRuntime} load -i ${remoteTar}`, { timeoutMs: 3e5 });
+    const loadResult = await ssh.exec(`${remoteRuntime} load -i ${shellArgument(remoteTar)}`, { timeoutMs: 3e5 });
     if (!loadResult.success)
       return err(loadResult.error);
     const loadedRef = parseLoadedImageRef(loadResult.data.stdout, localImageTag);
     const remoteImageRef = remoteRuntime === "podman" ? `localhost/${localImageTag}` : localImageTag;
     if (loadedRef !== remoteImageRef) {
-      const tagResult = await ssh.exec(`${remoteRuntime} tag ${loadedRef} ${remoteImageRef}`);
+      const tagResult = await ssh.exec(`${remoteRuntime} tag ${shellArgument(loadedRef)} ${shellArgument(remoteImageRef)}`);
       if (!tagResult.success)
         return err(tagResult.error);
     }
@@ -1184,7 +1466,9 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
       imageRef: remoteImageRef,
       hostPort,
       containerPort,
-      sidecar
+      sidecar,
+      serviceModes: options?.serviceModes,
+      previousCompose: existsSync(join(artifactDir, "compose.yml")) ? readFileSync(join(artifactDir, "compose.yml"), "utf8") : void 0
     });
     const composePath = join(artifactDir, "compose.yml");
     writeFileSync(composePath, composeContent);
@@ -1194,20 +1478,33 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
     const uploadEnvResult = await ssh.upload(envPath, `${remoteDir}/.env.runtime`);
     if (!uploadEnvResult.success)
       return err(uploadEnvResult.error);
+    const startScript = `#!/bin/sh
+set -eu
+cd "$(dirname "$0")"
+export HAI_DEPLOY_ENVIRONMENT=${options?.environment ?? "prod"}
+export HAI_CORE_ENV=${shellArgument(env.HAI_CORE_ENV ?? "production")}
+exec ${remoteRuntime} compose --env-file .env.runtime -p hai-${projectName} up -d
+`;
+    const startName = `start-${options?.environment ?? "prod"}.sh`;
+    const startPath = join(artifactDir, startName);
+    writeFileSync(startPath, startScript, { mode: 448 });
+    const uploadStart = await ssh.upload(startPath, `${remoteDir}/${startName}`);
+    if (!uploadStart.success)
+      return uploadStart;
     const secretMask = sidecar.secrets;
-    const chmodResult = await ssh.exec(`chmod 600 ${remoteDir}/.env.runtime`, { secrets: secretMask });
+    const chmodResult = await ssh.exec(`chmod 600 -- ${shellArgument(`${remoteDir}/.env.runtime`)}`, { secrets: secretMask });
     if (!chmodResult.success)
       return err(chmodResult.error);
     const upResult = await ssh.exec(
-      `cd ${remoteDir} && ${remoteRuntime} compose -p hai-${projectName} up -d`,
+      `cd ${shellArgument(remoteDir)} && sh ${shellArgument(startName)}`,
       { timeoutMs: 3e5, secrets: secretMask }
     );
     if (!upResult.success)
       return err(upResult.error);
-    await ssh.exec(`rm -f ${remoteTar}`);
+    await ssh.exec(`rm -f -- ${shellArgument(remoteTar)}`);
     const url = `http://${config.ssh.host}:${hostPort}`;
     logger7.info("Running health check", { url });
-    const healthy = await healthCheck(`${url}/`);
+    const healthy = await healthCheck(`${url}${scan.isSvelteKit ? "/" : "/health"}`);
     if (!healthy) {
       return err(
         HaiDeployError.HEALTH_CHECK_FAILED,
@@ -1462,7 +1759,7 @@ async function pollDeploymentStatus(token, deploymentId) {
     if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
       return "error";
     }
-    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL));
+    await new Promise((resolve3) => setTimeout(resolve3, POLL_INTERVAL));
   }
   return "building";
 }
@@ -2000,15 +2297,31 @@ function normalizeProjectName(name) {
   const normalized = name.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   return normalized || "app";
 }
-function mergeProvisionEnv(results) {
+function mergeProvisionEnv(results, scan, options) {
   let env = {};
-  const reachProviders = [];
+  const reachRequirements = scan?.middlewares?.filter((item) => item.configName === "reach") ?? [];
+  const reachProviders = reachRequirements.map((item) => item.config);
+  let hasReachOutput = false;
   for (const prov of results) {
-    if (prov.envVars.HAI_REACH_PROVIDERS)
-      reachProviders.push(...JSON.parse(prov.envVars.HAI_REACH_PROVIDERS));
+    if (prov.envVars.HAI_REACH_PROVIDERS) {
+      hasReachOutput = true;
+      const supplied = JSON.parse(prov.envVars.HAI_REACH_PROVIDERS);
+      for (const provider of supplied) {
+        const targets = reachRequirements.filter((item) => {
+          const mode = options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[item.service];
+          return item.service === prov.serviceType && (!mode || mode === "default");
+        });
+        if (targets.length) {
+          for (const target of targets)
+            reachProviders[reachRequirements.indexOf(target)] = { ...provider, name: target.config.name ?? provider.name };
+        } else {
+          reachProviders.push(provider);
+        }
+      }
+    }
     env = { ...env, ...prov.envVars };
   }
-  if (reachProviders.length > 0)
+  if (hasReachOutput)
     env.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
   return env;
 }
@@ -2043,7 +2356,7 @@ var deploy = {
         let provider = null;
         let containerProvider = null;
         if (parsed.provider.type === "docker-ssh") {
-          containerProvider = createDockerSshProvider(parsed.provider, parsed.container?.runtime);
+          containerProvider = createDockerSshProvider(parsed.provider, parsed.container);
           logger14.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh.host });
         } else {
           provider = createProviderByType(parsed.provider.type);
@@ -2121,17 +2434,19 @@ var deploy = {
   get isInitialized() {
     return currentProvider !== null || currentContainerProvider !== null;
   },
-  async scan(appDir) {
+  async scan(appDir, options) {
     logger14.debug("Scanning application", { appDir });
-    return scanApp(appDir);
+    return scanApp(appDir, options);
   },
-  async provisionAll(projectName) {
+  async provisionAll(projectName, services) {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
     logger14.info("Provisioning all services", { projectName, count: currentProvisioners.size });
     const results = [];
     for (const [serviceType, provisioner] of currentProvisioners) {
+      if (services && !services.includes(serviceType))
+        continue;
       logger14.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
       const provResult = await provisioner.provision(projectName);
       if (!provResult.success) {
@@ -2160,15 +2475,26 @@ var deploy = {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Starting deployment", { appDir, options });
-    const scanResult = await scanApp(appDir);
+    logger14.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
+    const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
+    const scanResult = await scanApp(appDir, scanOptions);
     if (!scanResult.success) {
       return err(scanResult.error);
     }
     const scan = scanResult.data;
-    const projectName = options?.projectName ?? scan.appName;
+    appDir = scan.appDir ?? appDir;
+    const environment = loadDeploymentEnvironment({ environment: scanOptions.environment ?? "prod", envDir: scan.envDir ?? appDir, requireFile: scanOptions.environment !== void 0 });
+    if (!environment.success)
+      return environment;
+    const appEnv = Object.fromEntries(Object.entries(environment.data.values).filter(([key]) => !key.startsWith("HAI_CLI_") && (!key.startsWith("HAI_DEPLOY_") || key === "HAI_DEPLOY_ENVIRONMENT")));
+    const projectName = `${options?.projectName ?? scan.appName}${scanOptions.environment ? `-${environment.data.environment}` : ""}`;
+    options = {
+      ...options,
+      ...scanOptions.environment ? { environment: environment.data.environment } : {},
+      ...options?.skipProvision ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
+    };
     if (currentContainerProvider) {
-      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options);
+      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options, appEnv);
     }
     if (!currentProvider) {
       return notInitialized.result();
@@ -2181,15 +2507,20 @@ var deploy = {
         })
       );
     }
-    let allEnvVars = {};
+    let allEnvVars = appEnv;
     const recovery = { projectName, stage: "provision", resources: [] };
     if (!options?.skipProvision) {
-      const provResults = await deploy.provisionAll(projectName);
+      const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
       if (!provResults.success) {
         return err(provResults.error);
       }
       recovery.resources = provResults.data.map(({ envVars: _envVars, ...resource }) => resource);
-      allEnvVars = mergeProvisionEnv(provResults.data);
+      allEnvVars = { ...allEnvVars, ...mergeProvisionEnv(provResults.data, scan, options) };
+      if (options?.environment) {
+        const saved = saveDeploymentEnvironment(environment.data, mergeProvisionEnv(provResults.data, scan, options));
+        if (!saved.success)
+          return recoveryFailure(saved.error, { ...recovery, stage: "save-env" });
+      }
     }
     const projectResult = await currentProvider.createProject(projectName);
     if (!projectResult.success) {
@@ -2226,7 +2557,7 @@ var deploy = {
     return ok(result);
   }
 };
-async function deployContainerApp(provider, appDir, scan, rawProjectName, options) {
+async function deployContainerApp(provider, appDir, scan, rawProjectName, options, appEnv = {}) {
   const projectName = normalizeProjectName(rawProjectName);
   if (scan.isSvelteKit && !scan.nodeAdapterInstalled) {
     return err(
@@ -2236,15 +2567,60 @@ async function deployContainerApp(provider, appDir, scan, rawProjectName, option
   }
   let provisionEnv = {};
   if (!options?.skipProvision) {
-    const provResults = await deploy.provisionAll(projectName);
+    const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
     if (!provResults.success) {
       return err(provResults.error);
     }
-    provisionEnv = mergeProvisionEnv(provResults.data);
+    provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
   }
-  return provider.deploy({ appDir, projectName, scan, provisionEnv });
+  return provider.deploy({ appDir, projectName, scan, provisionEnv, appEnv, options });
+}
+
+// src/deploy-middleware.ts
+var field = (name, defaultValue, kind, secret = false) => ({ name, defaultValue, kind, secret });
+var required = (name, defaultValue, kind) => ({ ...field(name, defaultValue, kind), required: true });
+var DEPLOY_MIDDLEWARE = {
+  db: [
+    { backend: "sqlite", label: "SQLite", purpose: "deploy_purposeSqlite", fields: [required("database", "./data/app.db")] },
+    ...["postgresql", "mysql"].map((backend) => ({
+      backend,
+      label: backend === "mysql" ? "MySQL" : "PostgreSQL",
+      purpose: "deploy_purposeDatabase",
+      provisioner: backend === "postgresql" ? "neon" : void 0,
+      fields: [field("url", "", "url", true), required("host", "localhost"), required("port", backend === "mysql" ? "3306" : "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true), field("ssl", "false")]
+    }))
+  ],
+  cache: [
+    { backend: "memory", label: "Memory", purpose: "deploy_purposeMemory", fields: [] },
+    { backend: "redis", label: "Redis", purpose: "deploy_purposeCache", provisioner: "upstash", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "6379", "port"), field("password", "", void 0, true), { ...field("db", "0", "number"), maximum: 15 }, field("tls", "false", "boolean"), field("keyPrefix"), field("connectTimeout", "10000", "number"), field("commandTimeout", "5000", "number")] }
+  ],
+  storage: [
+    { backend: "local", label: "Local filesystem", purpose: "deploy_purposeLocal", fields: [required("root", "./data/storage")] },
+    { backend: "s3", label: "S3 / RustFS / MinIO / Cloudflare R2", purpose: "deploy_purposeStorage", provisioner: "cloudflare-r2", fields: [field("endpoint", "", "url"), required("bucket", "hai"), required("region", "us-east-1"), required("accessKeyId"), { ...required("secretAccessKey"), secret: true }, field("forcePathStyle", "true", "boolean")] }
+  ],
+  vecdb: [
+    { backend: "lancedb", label: "LanceDB", purpose: "deploy_purposeLocal", fields: [required("path", "./data/vectors")] },
+    { backend: "qdrant", label: "Qdrant", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:6333", "url"), field("apiKey", "", void 0, true)] },
+    { backend: "pgvector", label: "PostgreSQL / pgvector", purpose: "deploy_purposeVector", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true)] },
+    { backend: "chroma", label: "Chroma", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:8000", "url")] }
+  ],
+  ldap: [
+    { backend: "disabled", label: "Disabled", purpose: "deploy_purposeDisabled", fields: [] },
+    { backend: "ldap", label: "LDAP / OpenLDAP", purpose: "deploy_purposeLdap", fields: [required("url", "ldap://localhost:389", "url"), required("bindDn", "cn=admin,dc=example,dc=org"), { ...required("bindPassword"), secret: true }, required("searchBase", "dc=example,dc=org"), field("searchFilter", "(uid={{username}})"), field("usernameAttribute", "uid"), field("emailAttribute", "mail"), field("displayNameAttribute", "cn"), field("useTls", "false", "boolean"), { ...field("connectTimeout", "5000", "number"), minimum: 1e3 }] }
+  ],
+  email: [
+    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
+    { backend: "smtp", label: "SMTP", purpose: "deploy_purposeEmail", provisioner: "resend", fields: [required("host", "localhost"), required("port", "465", "port"), field("secure", "true", "boolean"), field("user"), field("pass", "", void 0, true), required("from", "noreply@example.com")] },
+    { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeEmail", fields: [required("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
+  ],
+  sms: [
+    { backend: "aliyun-sms", label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", fields: [required("accessKeyId"), { ...required("accessKeySecret"), secret: true }, required("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] }
+  ]
+};
+function describeMiddlewareBackend(backend) {
+  return deployM(backend.purpose);
 }
 
-export { DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, getDeployRecovery };
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, saveDeploymentEnvironment };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map