@h-ai/deploy 0.1.0-alpha.64 → 0.1.0-alpha.66

package/dist/index.js

@@ -1,15 +1,52 @@
+import { createHash, randomBytes } from 'crypto';
+import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, rmSync, statSync, readdirSync } from 'fs';
+import { resolve, join, basename, dirname, relative, sep } from 'path';
 import { z } from 'zod';
-import { core, err, ok } from '@h-ai/core';
-import { existsSync, readFileSync, writeFileSync, readdirSync, mkdirSync, statSync } from 'fs';
+import { core, ok, err } from '@h-ai/core';
+import process2 from 'process';
+import { parseEnv } from 'util';
+import { parse, stringify, parseAllDocuments } from 'yaml';
 import { homedir } from 'os';
-import { join, dirname, relative, sep } from 'path';
-import process from 'process';
-import { parse, stringify } from 'yaml';
-import { execSync, spawn } from 'child_process';
-import { randomBytes, createHash } from 'crypto';
+import { spawn } from 'child_process';
 import { Buffer } from 'buffer';
 
-// src/deploy-config.ts
+// src/deploy-artifact.ts
+var DeploymentArtifactSchema = z.object({
+  /** 清单格式版本，与应用版本和部署环境无关。 */
+  version: z.literal(2),
+  /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
+  appVersion: z.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
+  /** 一次完整构建的标识，app/web 必须来自同一份清单。 */
+  buildId: z.string().regex(/^[a-z0-9][\w.+-]*$/i),
+  /** API/独立应用和可选 Web 的镜像归档，至少包含一个 app。 */
+  images: z.array(z.object({
+    /** app 为服务或独立应用，web 为同源 API 代理的静态前端。 */
+    name: z.enum(["app", "web"]),
+    /** 相对于清单目录的 tar 文件名。 */
+    file: z.string().regex(/^[\w.+-]+\.tar$/),
+    /** 归档导入后可直接使用的不可变镜像引用。 */
+    imageRef: z.string().regex(/^[a-z0-9][a-z0-9./:_-]+$/),
+    /** tar 内容的 SHA-256，用于部署前校验。 */
+    sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    /** 容器内部监听端口；服务器公开端口由部署选择。 */
+    containerPort: z.number().int().min(1).max(65535).optional()
+  })).min(1).max(2).refine((images) => images.filter((image) => image.name === "app").length === 1 && new Set(images.map((image) => image.name)).size === images.length)
+}).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`));
+async function artifactChecksum(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file))
+    hash.update(chunk);
+  return hash.digest("hex");
+}
+async function readDeploymentArtifact(directory) {
+  const artifact = DeploymentArtifactSchema.parse(JSON.parse(readFileSync(resolve(directory, "manifest.json"), "utf8")));
+  for (const image of artifact.images) {
+    const file = resolve(directory, image.file);
+    if (!existsSync(file) || !lstatSync(file).isFile() || lstatSync(file).isSymbolicLink() || await artifactChecksum(file) !== image.sha256)
+      throw new Error(`Invalid artifact: ${image.file}`);
+  }
+  return artifact;
+}
 
 // messages/en-US.json
 var en_US_default = {
@@ -21,7 +58,6 @@ var en_US_default = {
   deploy_authRequired: "Authentication required",
   deploy_authFailed: "Authentication failed: {error}",
   deploy_projectCreateFailed: "Project creation failed: {error}",
-  deploy_buildFailed: "Application build failed: {error}",
   deploy_uploadFailed: "Build output upload failed: {error}",
   deploy_deployFailed: "Deployment failed: {error}",
   deploy_provisionFailed: "Service provisioning failed: {service} - {error}",
@@ -41,12 +77,33 @@ var en_US_default = {
   deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use.",
   deploy_commandTimeout: "Command timed out: {command}",
   deploy_commandFailed: "Command failed ({command}): {error}",
-  deploy_containerRuntimeNotFound: "No usable container runtime found: {runtime}",
-  deploy_containerBuildFailed: "Container image build failed: {error}",
   deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
   deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
   deploy_imageTransferFailed: "Image transfer failed: {error}",
-  deploy_healthCheckFailed: "Health check failed, app not ready at {url}"
+  deploy_healthCheckFailed: "Health check failed, app not ready at {url}",
+  deploy_invalidEnvironment: "Use letters, numbers, underscores or hyphens for the environment; local/example are reserved.",
+  deploy_environmentMissing: "Environment file missing: {path}. Create and configure it before deploying.",
+  deploy_environmentReadFailed: "Cannot read deployment environment files; check syntax and permissions.",
+  deploy_environmentWriteFailed: "Cannot save deployment configuration; check file syntax and permissions.",
+  deploy_multipleApplications: "Multiple service packages found; specify the application directory.",
+  deploy_purposeSqlite: "Local relational database persisted in a volume",
+  deploy_purposeDatabase: "Relational database service for business data",
+  deploy_purposeMemory: "Per-process memory cache; cleared on restart, no external service",
+  deploy_purposeLocal: "Local filesystem storage persisted in a volume",
+  deploy_purposeCache: "Shared cache, sessions and distributed locks",
+  deploy_purposeStorage: "S3-compatible object storage for uploaded files",
+  deploy_purposeVector: "Vector indexing and similarity search",
+  deploy_purposeDisabled: "LDAP login is disabled; no directory service is created",
+  deploy_purposeLdap: "Directory account authentication; the default directory has no business users",
+  deploy_purposeConsole: "Messages go to application logs without delivery",
+  deploy_purposeEmail: "Email/HTTP delivery; the default SMTP container only captures test messages",
+  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota",
+  deploy_webProxyInvalid: "The API prefix must be an absolute path containing only letters, numbers, underscores, hyphens and slashes.",
+  deploy_artifactInvalid: "Build artifacts are missing, corrupt, or could not be packaged. Run pnpm build --target docker at the project root and point --artifact-dir to a complete build directory.",
+  deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
+  deploy_bundleInstructions: "This bundle contains private configuration. Transfer it securely and restrict access.\n1. Copy {file} to Linux using removable media, a private network or scp.\n2. Install Docker/Podman with compose, tar, sha256sum and sh. Load middleware images using docker load/podman load with the exact tags below.\n3. Create a private release directory: mkdir -p release && chmod 700 release\n4. From the bundle directory run tar -xf {file} -C release\n5. Run cd release && sh {start}. Set HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME=docker or podman to select the runtime explicitly.\n6. Check docker compose -f {compose} --env-file .env.runtime ps (or logs; use podman instead of docker for Podman), Web and /health after startup. Bundle generation does not perform server health checks.\nRequired images (app/web are included; prepare middleware separately):\n{images}\nBuilt images can be reused across environments; this bundle contains configuration for the selected environment only.",
+  deploy_bundleMetadata: "Application version: {version}\nBuild ID: {buildId}\nCompose file: {compose}",
+  deploy_bundleOnlyContainer: "Compose bundle generation is supported only by docker-ssh."
 };
 
 // messages/zh-CN.json
@@ -59,7 +116,6 @@ var zh_CN_default = {
   deploy_authRequired: "\u8BF7\u5148\u5B8C\u6210\u8BA4\u8BC1",
   deploy_authFailed: "\u8BA4\u8BC1\u5931\u8D25\uFF1A{error}",
   deploy_projectCreateFailed: "\u9879\u76EE\u521B\u5EFA\u5931\u8D25\uFF1A{error}",
-  deploy_buildFailed: "\u5E94\u7528\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
   deploy_uploadFailed: "\u6784\u5EFA\u4EA7\u7269\u4E0A\u4F20\u5931\u8D25\uFF1A{error}",
   deploy_deployFailed: "\u90E8\u7F72\u5931\u8D25\uFF1A{error}",
   deploy_provisionFailed: "\u57FA\u7840\u8BBE\u65BD\u5F00\u901A\u5931\u8D25\uFF1A{service} - {error}",
@@ -79,12 +135,33 @@ var zh_CN_default = {
   deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002",
   deploy_commandTimeout: "\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF1A{command}",
   deploy_commandFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF08{command}\uFF09\uFF1A{error}",
-  deploy_containerRuntimeNotFound: "\u672A\u627E\u5230\u53EF\u7528\u7684\u5BB9\u5668\u8FD0\u884C\u65F6\uFF1A{runtime}",
-  deploy_containerBuildFailed: "\u5BB9\u5668\u955C\u50CF\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
   deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
   deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
   deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
-  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA"
+  deploy_healthCheckFailed: "\u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0C\u5E94\u7528\u672A\u5728 {url} \u5C31\u7EEA",
+  deploy_invalidEnvironment: "\u73AF\u5883\u540D\u79F0\u4EC5\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26\uFF0C\u4E14\u4E0D\u80FD\u4F7F\u7528 local/example\u3002",
+  deploy_environmentMissing: "\u7F3A\u5C11\u73AF\u5883\u914D\u7F6E {path}\uFF1B\u8BF7\u5148\u521B\u5EFA\u8BE5\u6587\u4EF6\u5E76\u5B8C\u6210\u914D\u7F6E\uFF0C\u518D\u91CD\u65B0\u90E8\u7F72\u3002",
+  deploy_environmentReadFailed: "\u90E8\u7F72\u73AF\u5883\u6587\u4EF6\u8BFB\u53D6\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
+  deploy_environmentWriteFailed: "\u90E8\u7F72\u914D\u7F6E\u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u6587\u4EF6\u683C\u5F0F\u4E0E\u6743\u9650\u3002",
+  deploy_multipleApplications: "\u53D1\u73B0\u591A\u4E2A\u670D\u52A1\u5305\uFF0C\u8BF7\u6307\u5B9A\u8981\u90E8\u7F72\u7684\u5E94\u7528\u76EE\u5F55\u3002",
+  deploy_purposeSqlite: "\u672C\u5730\u6587\u4EF6\u5173\u7CFB\u6570\u636E\u5E93\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
+  deploy_purposeDatabase: "\u72EC\u7ACB\u5173\u7CFB\u6570\u636E\u5E93\u670D\u52A1\uFF0C\u4FDD\u5B58\u4E1A\u52A1\u6570\u636E",
+  deploy_purposeMemory: "\u5355\u8FDB\u7A0B\u5185\u5B58\u7F13\u5B58\uFF0C\u91CD\u542F\u540E\u6E05\u7A7A\uFF0C\u4E0D\u521B\u5EFA\u5916\u90E8\u670D\u52A1",
+  deploy_purposeLocal: "\u672C\u5730\u6587\u4EF6\u5B58\u50A8\uFF0C\u4F7F\u7528\u6301\u4E45\u5316\u5377",
+  deploy_purposeCache: "\u5171\u4EAB\u7F13\u5B58\u3001\u4F1A\u8BDD\u4E0E\u5206\u5E03\u5F0F\u9501",
+  deploy_purposeStorage: "S3 \u517C\u5BB9\u5BF9\u8C61\u5B58\u50A8\uFF0C\u4FDD\u5B58\u4E0A\u4F20\u6587\u4EF6",
+  deploy_purposeVector: "\u5411\u91CF\u7D22\u5F15\u4E0E\u76F8\u4F3C\u5EA6\u641C\u7D22",
+  deploy_purposeDisabled: "LDAP \u767B\u5F55\u672A\u542F\u7528\uFF0C\u4E0D\u521B\u5EFA\u76EE\u5F55\u670D\u52A1",
+  deploy_purposeLdap: "\u4F01\u4E1A\u76EE\u5F55\u8D26\u53F7\u8BA4\u8BC1\uFF1B\u9ED8\u8BA4\u76EE\u5F55\u4E0D\u5305\u542B\u4E1A\u52A1\u7528\u6237",
+  deploy_purposeConsole: "\u6D88\u606F\u8F93\u51FA\u5230\u5E94\u7528\u65E5\u5FD7\uFF0C\u4E0D\u5B9E\u9645\u6295\u9012",
+  deploy_purposeEmail: "\u90AE\u4EF6\u6216 HTTP \u901A\u77E5\u6295\u9012\uFF1B\u9ED8\u8BA4 SMTP \u5BB9\u5668\u4EC5\u7528\u4E8E\u6D4B\u8BD5\u63A5\u6536",
+  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6",
+  deploy_webProxyInvalid: "API \u524D\u7F00\u5FC5\u987B\u662F\u4EC5\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u8FDE\u5B57\u7B26\u548C\u659C\u6760\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002",
+  deploy_artifactInvalid: "\u6784\u5EFA\u4EA7\u7269\u7F3A\u5931\u3001\u635F\u574F\u6216\u90E8\u7F72\u6253\u5305\u5931\u8D25\u3002\u8BF7\u5148\u5728\u5DE5\u7A0B\u6839\u8FD0\u884C pnpm build --target docker\uFF0C\u5E76\u68C0\u67E5 --artifact-dir \u6307\u5411\u5B8C\u6574\u7684\u6784\u5EFA\u76EE\u5F55\u3002",
+  deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
+  deploy_bundleInstructions: "\u6B64\u5305\u5305\u542B\u79C1\u6709\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u642C\u8FD0\u5E76\u9650\u5236\u8BBF\u95EE\u6743\u9650\u3002\n1. \u5C06 {file} \u590D\u5236\u5230 Linux \u670D\u52A1\u5668\uFF08U \u76D8\u3001\u5185\u7F51\u4F20\u8F93\u6216 scp \u5747\u53EF\uFF09\u3002\n2. \u51C6\u5907 Docker/Podman\u3001\u5BF9\u5E94 compose \u547D\u4EE4\u3001tar\u3001sha256sum \u548C sh\uFF1B\u5C06\u6240\u9700\u4E2D\u95F4\u4EF6\u955C\u50CF\u7528 docker load/podman load \u5BFC\u5165\uFF0C\u955C\u50CF\u6807\u7B7E\u987B\u4E0E\u4E0B\u5217\u6E05\u5355\u5B8C\u5168\u4E00\u81F4\u3002\n3. \u65B0\u5EFA\u4EC5\u90E8\u7F72\u7528\u6237\u53EF\u8BBF\u95EE\u7684\u76EE\u5F55\uFF1Amkdir -p release && chmod 700 release\n4. \u5728\u5305\u6240\u5728\u76EE\u5F55\u6267\u884C tar -xf {file} -C release\n5. \u6267\u884C cd release && sh {start}\uFF1B\u53EF\u7528 HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME=docker \u6216 podman \u663E\u5F0F\u9009\u62E9\u8FD0\u884C\u65F6\u3002\n6. \u542F\u52A8\u540E\u7528 docker compose -f {compose} --env-file .env.runtime ps\uFF08\u6216 logs\uFF1BPodman \u5C06 docker \u6362\u4E3A podman\uFF09\u68C0\u67E5\u72B6\u6001\u5E76\u9A8C\u8BC1 Web\u3001/health\uFF1B\u4EC5\u6253\u5305\u4E0D\u4F1A\u6267\u884C\u670D\u52A1\u5668\u5065\u5EB7\u68C0\u67E5\u3002\n\u6240\u9700\u955C\u50CF\uFF08app/web \u5DF2\u542B\u5728\u5305\u4E2D\uFF0C\u4E2D\u95F4\u4EF6\u9700\u53E6\u884C\u51C6\u5907\uFF09\uFF1A\n{images}\n\u6784\u5EFA\u955C\u50CF\u53EF\u7528\u4E8E\u591A\u73AF\u5883\uFF1B\u6B64\u5305\u7684\u73AF\u5883\u914D\u7F6E\u4EC5\u7528\u4E8E\u672C\u6B21\u6240\u9009\u73AF\u5883\u3002",
+  deploy_bundleMetadata: "\u5E94\u7528\u7248\u672C\uFF1A{version}\n\u6784\u5EFA\u7F16\u53F7\uFF1A{buildId}\nCompose \u6587\u4EF6\uFF1A{compose}",
+  deploy_bundleOnlyContainer: "\u4EC5\u751F\u6210 Compose tar \u53EA\u652F\u6301 docker-ssh\u3002"
 };
 
 // src/deploy-i18n.ts
@@ -117,15 +194,15 @@ var SshConfigSchema = z.object({
 var PortExposeSchema = z.object({
   type: z.literal("port").default("port"),
   /** 容器内监听端口（adapter-node 默认 3000） */
-  containerPort: z.number().int().positive().default(3e3),
+  containerPort: z.number().int().min(1).max(65535).default(3e3),
   /** 宿主机映射端口 */
-  hostPort: z.number().int().positive()
+  hostPort: z.number().int().min(1).max(65535)
 });
 var ExposeSchema = PortExposeSchema;
 var DockerSshProviderConfigSchema = z.object({
   type: z.literal("docker-ssh"),
   /** SSH 连接参数 */
-  ssh: SshConfigSchema,
+  ssh: SshConfigSchema.optional(),
   /** 远程主机运行参数 */
   remote: z.object({
     /** 远程应用根目录 */
@@ -175,17 +252,19 @@ var ServicesConfigSchema = z.object({
   sms: z.discriminatedUnion("provisioner", [AliyunSmsServiceSchema]).optional()
 }).optional();
 var DeployConfigSchema = z.object({
+  /** 部署环境文件模式；dev/test/prod 或自定义模式，禁止 local/example。 */
+  environment: z.string().regex(/^[a-z0-9][\w-]*$/i).refine((value) => !["local", "example"].includes(value.toLowerCase())).optional(),
   provider: ProviderConfigSchema,
   services: ServicesConfigSchema,
-  /** 本地容器构建参数（docker-ssh 使用；auto 优先 podman） */
+  /** Docker Compose 部署参数；构建配置位于项目 hai.build.json。 */
   container: z.object({
-    runtime: z.enum(["auto", "docker", "podman"]).default("auto")
+    /** 自建 S3 服务实现；协议仍为 storage.type=s3。 */
+    s3Engine: z.enum(["rustfs", "minio"]).default("rustfs")
   }).optional()
 });
 var DeployErrorInfo = {
   DEPLOY_FAILED: "001:500",
   PROJECT_CREATE_FAILED: "002:500",
-  BUILD_FAILED: "003:500",
   UPLOAD_FAILED: "004:500",
   AUTH_REQUIRED: "005:401",
   AUTH_FAILED: "006:401",
@@ -197,8 +276,6 @@ var DeployErrorInfo = {
   UNSUPPORTED_TYPE: "012:400",
   CONFIG_ERROR: "013:500",
   CREDENTIAL_ERROR: "014:500",
-  CONTAINER_RUNTIME_NOT_FOUND: "015:500",
-  CONTAINER_BUILD_FAILED: "016:500",
   REMOTE_CONNECT_FAILED: "017:500",
   REMOTE_COMMAND_FAILED: "018:500",
   IMAGE_TRANSFER_FAILED: "019:500",
@@ -206,7 +283,172 @@ var DeployErrorInfo = {
 };
 var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
 
-// src/deploy-credentials.ts
+// src/deploy-environment.ts
+function environmentValue(value) {
+  try {
+    return parse(value) ?? value;
+  } catch {
+    return value;
+  }
+}
+function resolveConfig(value, prefix, env) {
+  if (env[prefix] !== void 0)
+    return environmentValue(env[prefix]);
+  if (Array.isArray(value))
+    return value.map((item, index) => resolveConfig(item, `${prefix}_${index}`, env));
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, resolveConfig(nested, `${prefix}_${key.toUpperCase()}`, env)]));
+  if (typeof value !== "string")
+    return value;
+  const resolved = value.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, name, fallback) => env[name] ?? fallback ?? "");
+  return /^\$\{[^}]+\}$/.test(value) ? environmentValue(resolved) : resolved;
+}
+function loadDeploymentConfig(name, path, values) {
+  try {
+    const config = resolveConfig(parse(readFileSync(path, "utf8")), `HAI_${name.toUpperCase()}`, values);
+    return ok(config && typeof config === "object" && !Array.isArray(config) ? config : {});
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
+  }
+}
+function loadDeploymentEnvironment(options) {
+  const environment = options.environment === "production" ? "prod" : options.environment === "development" ? "dev" : options.environment;
+  if (!/^[a-z0-9][\w-]*$/i.test(environment) || ["local", "example"].includes(environment.toLowerCase()))
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_invalidEnvironment"));
+  const envDir = resolve(options.envDir);
+  const target = join(envDir, `.env.${environment}`);
+  if (options.requireFile !== false && !existsSync(target))
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentMissing", { params: { path: target } }));
+  const loaded = core.config.loadEnvFiles({ mode: environment, envDir });
+  if (!loaded.success)
+    return loaded;
+  try {
+    const values = { ...loaded.data };
+    for (const [name, value] of Object.entries(process2.env)) {
+      if (/^(?:HAI_|PUBLIC_|VITE_)/.test(name) && value !== void 0)
+        values[name] = value;
+    }
+    values.HAI_DEPLOY_ENVIRONMENT = environment;
+    values.HAI_CORE_ENV ??= environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
+    const targetValues = {};
+    if (existsSync(target)) {
+      for (const [name, value] of Object.entries(parseEnv(readFileSync(target, "utf8")))) {
+        if (value !== void 0)
+          targetValues[name] = value;
+      }
+    }
+    return ok({ environment, envDir, values, targetValues });
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
+  }
+}
+function isSecret(name, value) {
+  if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
+    return true;
+  try {
+    const url = new URL(value);
+    if (url.username || url.password || [...url.searchParams.keys()].some((key) => /password|secret|token|key|authorization/i.test(key)))
+      return true;
+  } catch {
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object")
+      return Object.entries(parsed).some(([key, nested]) => isSecret(key, typeof nested === "string" ? nested : JSON.stringify(nested)));
+  } catch {
+  }
+  return false;
+}
+function publicConfig(value) {
+  if (Array.isArray(value))
+    return value.map(publicConfig);
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).filter(([name, item]) => !isSecret(name, typeof item === "string" ? item : "")).map(([name, item]) => [name, publicConfig(item)]));
+  return value;
+}
+function quoteEnv(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed && typeof parsed === "object")
+      return `'${JSON.stringify(parsed).replaceAll("'", "\\u0027")}'`;
+  } catch {
+  }
+  if (!value.includes("'"))
+    return `'${value}'`;
+  if (!value.includes('"'))
+    return `"${value}"`;
+  if (!value.includes("`"))
+    return `\`${value}\``;
+  if (!/[\r\n#]/.test(value))
+    return value;
+  throw new Error("Unsupported dotenv value");
+}
+function updateFile(path, values, privateFile) {
+  let content = existsSync(path) ? readFileSync(path, "utf8") : "# Local private deployment configuration; do not commit.\n";
+  for (const [name, value] of Object.entries(values)) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
+      throw new Error("Invalid environment variable name");
+    const line = `${name}=${quoteEnv(value)}`;
+    const pattern = new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*`, "gm");
+    if (pattern.test(content))
+      content = content.replace(pattern, () => line);
+    else
+      content = `${content.trimEnd()}
+${line}
+`;
+  }
+  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
+  if (privateFile)
+    chmodSync(path, 384);
+}
+function removeOverrides(path, names, privateFile = true) {
+  if (!existsSync(path) || names.length === 0)
+    return;
+  let content = readFileSync(path, "utf8");
+  for (const name of names)
+    content = content.replace(new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"[^"]*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
+  writeFileSync(path, content, { mode: privateFile ? 384 : 420 });
+  chmodSync(path, privateFile ? 384 : 420);
+}
+function saveDeploymentEnvironment(environment, values, options = {}) {
+  try {
+    const shared = {};
+    const privateValues = {};
+    for (const [name, value] of Object.entries(values)) {
+      if (options.private) {
+        privateValues[name] = value;
+      } else if (isSecret(name, value)) {
+        privateValues[name] = value;
+        try {
+          const parsed = JSON.parse(value);
+          if (parsed && typeof parsed === "object")
+            shared[name] = JSON.stringify(publicConfig(parsed));
+        } catch {
+        }
+      } else {
+        shared[name] = value;
+      }
+    }
+    if (Object.keys(shared).length)
+      updateFile(join(environment.envDir, `.env.${environment.environment}`), shared, false);
+    if (Object.keys(privateValues).length)
+      updateFile(join(environment.envDir, ".env.local"), privateValues, true);
+    removeOverrides(join(environment.envDir, `.env.${environment.environment}`), Object.keys(privateValues).filter((name) => !(name in shared)), false);
+    removeOverrides(join(environment.envDir, ".env.local"), Object.keys(shared).filter((name) => !(name in privateValues)));
+    if (Object.keys(privateValues).length) {
+      const ignorePath = join(environment.envDir, ".gitignore");
+      const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
+      if (!ignore.split(/\r?\n/).includes(".env.local"))
+        writeFileSync(ignorePath, `${ignore.trimEnd()}
+.env.local
+.hai/deploy/
+`);
+    }
+    return ok(Object.keys(values));
+  } catch {
+    return err(HaiDeployError.ENV_VAR_FAILED, deployM("deploy_environmentWriteFailed"));
+  }
+}
 var logger = core.logger.child({ module: "deploy", scope: "credentials" });
 var DEPLOY_CREDENTIAL_KEY_PATTERN = /^HAI_DEPLOY_[A-Z0-9_]+$/;
 function isAllowedCredentialKey(key) {
@@ -270,7 +512,7 @@ function loadCredentials() {
     const data = readCredentialsFile();
     const keys = Object.keys(data);
     for (const key of keys) {
-      process.env[key] = String(data[key]);
+      process2.env[key] = String(data[key]);
     }
     logger.debug("Credentials loaded", { count: keys.length });
     return ok(keys);
@@ -291,7 +533,7 @@ function saveCredential(key, value) {
     const data = readCredentialsFile();
     data[key] = value;
     writeCredentialsFile(data);
-    process.env[key] = value;
+    process2.env[key] = value;
     logger.debug("Credential saved", { key });
     return ok(void 0);
   } catch (error) {
@@ -311,7 +553,7 @@ function saveCredentials(entries) {
     const data = readCredentialsFile();
     for (const [key, value] of Object.entries(entries)) {
       data[key] = value;
-      process.env[key] = value;
+      process2.env[key] = value;
     }
     writeCredentialsFile(data);
     logger.debug("Credentials saved", { count: Object.keys(entries).length });
@@ -327,35 +569,25 @@ function saveCredentials(entries) {
     );
   }
 }
-var logger2 = core.logger.child({ module: "deploy", scope: "functions" });
-function buildApp(appDir, buildCommand, envVars = {}) {
-  logger2.info("Building application", { appDir, buildCommand });
-  try {
-    execSync(buildCommand, {
-      cwd: appDir,
-      stdio: "inherit",
-      env: { ...process.env, ...envVars }
-    });
-    return ok(void 0);
-  } catch (error) {
-    return err(
-      HaiDeployError.BUILD_FAILED,
-      deployM("deploy_buildFailed", {
-        params: { error: error instanceof Error ? error.message : String(error) }
-      }),
-      error
-    );
+function resolveArtifactDirectory(appDir) {
+  let directory = resolve(appDir);
+  while (true) {
+    if (existsSync(join(directory, "hai.build.json")) || existsSync(join(directory, "pnpm-lock.yaml")))
+      return join(directory, ".hai/build/docker");
+    const parent = dirname(directory);
+    if (parent === directory)
+      return join(appDir, ".hai/build/docker");
+    directory = parent;
   }
 }
+function usesDefaultMiddleware(scan, service, options) {
+  const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
+  return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
+}
 function resolveOutputDir(appDir, providerType) {
   switch (providerType) {
-    case "vercel": {
-      const vercelOutput = join(appDir, ".vercel", "output");
-      if (existsSync(vercelOutput)) {
-        return vercelOutput;
-      }
-      return join(appDir, "build");
-    }
+    case "vercel":
+      return join(appDir, ".vercel", "output");
     default:
       return join(appDir, "build");
   }
@@ -386,196 +618,300 @@ function recoveryFailure(error, recovery) {
     ext: { recovery }
   });
 }
-var logger3 = core.logger.child({ module: "deploy", scope: "scanner" });
-function readYaml(filePath) {
-  if (!existsSync(filePath)) {
-    return null;
+var logger2 = core.logger.child({ module: "deploy", scope: "scanner" });
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function runtimeDependencies(appDir) {
+  let root = appDir;
+  while (!existsSync(join(root, "pnpm-lock.yaml"))) {
+    const parent = dirname(root);
+    if (parent === root)
+      throw new Error("Missing pnpm lockfile; run pnpm install");
+    root = parent;
   }
-  try {
-    const content = readFileSync(filePath, "utf-8");
-    const parsed = parse(content);
-    if (parsed === null || parsed === void 0 || typeof parsed !== "object") {
-      return null;
+  const importerKey = relative(root, appDir).replaceAll("\\", "/") || ".";
+  const documents = parseAllDocuments(readFileSync(join(root, "pnpm-lock.yaml"), "utf8"));
+  if (documents.some((document) => document.errors.length))
+    throw new Error("Invalid pnpm lockfile");
+  const lock = documents.map((document) => record(document.toJS())).reverse().find((document) => importerKey in record(document.importers));
+  if (!lock)
+    throw new Error("Application is missing from pnpm lockfile; run pnpm install");
+  const importers = record(lock.importers);
+  const packages = record(lock.packages);
+  const snapshots = record(lock.snapshots);
+  const names = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (id, node, importer) => {
+    if (visited.has(id))
+      return;
+    visited.add(id);
+    const metadata = importer === void 0 ? record(packages[id.split("(")[0]]) : {};
+    const peers = record(metadata.peerDependencies);
+    for (const [name, reference] of Object.entries({ ...record(node.dependencies), ...record(node.optionalDependencies) })) {
+      if (name in peers)
+        continue;
+      const version = typeof reference === "string" ? reference : record(reference).version;
+      if (typeof version !== "string")
+        throw new Error("Invalid pnpm dependency reference");
+      if (version.startsWith("link:")) {
+        if (importer === void 0)
+          throw new Error("Invalid workspace dependency");
+        const target = relative(root, resolve(root, importer, version.slice(5))).replaceAll("\\", "/") || ".";
+        const linked = record(importers[target]);
+        if (!Object.keys(linked).length)
+          throw new Error("Missing linked workspace importer");
+        names.add(name);
+        visit(`workspace:${target}`, linked, target);
+        continue;
+      }
+      const key = version in snapshots || version in packages ? version : `${name}@${version}`;
+      names.add(key.match(/^(@[^/]+\/[^@]+|[^@]+)@/)?.[1] ?? name);
+      const snapshot = record(snapshots[key] ?? packages[key]);
+      if (!Object.keys(snapshot).length && !(key in snapshots) && !(key in packages))
+        throw new Error("Missing pnpm dependency snapshot");
+      visit(key, snapshot);
     }
-    return parsed;
-  } catch {
-    return null;
-  }
+  };
+  visit(`workspace:${importerKey}`, record(importers[importerKey]), importerKey);
+  return { runtime: names, build: /* @__PURE__ */ new Set([...names, ...Object.keys(record(record(importers[importerKey]).devDependencies))]), root };
 }
-function readJson(filePath) {
-  if (!existsSync(filePath)) {
-    return null;
-  }
+async function scanApp(inputDir, options) {
   try {
-    const content = readFileSync(filePath, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-function hasDependency(pkg, name) {
-  const deps = pkg.dependencies;
-  const devDeps = pkg.devDependencies;
-  return deps !== void 0 && name in deps || devDeps !== void 0 && name in devDeps;
-}
-function detectRequiredServices(configDir) {
-  const services = [];
-  const backends = {};
-  if (!existsSync(configDir)) {
-    return { services, backends };
-  }
-  const files = readdirSync(configDir);
-  const dbFile = files.find((f) => f.startsWith("_db."));
-  if (dbFile) {
-    const dbConfig = readYaml(join(configDir, dbFile));
-    if (dbConfig !== null) {
-      services.push("db");
-      backends.db = dbConfig.type ?? "postgresql";
-    }
-  }
-  const cacheFile = files.find((f) => f.startsWith("_cache."));
-  if (cacheFile) {
-    const cacheConfig = readYaml(join(configDir, cacheFile));
-    if (cacheConfig !== null && cacheConfig.type === "redis") {
-      services.push("cache");
-      backends.cache = "redis";
-    }
-  }
-  const storageFile = files.find((f) => f.startsWith("_storage."));
-  if (storageFile) {
-    const storageConfig = readYaml(join(configDir, storageFile));
-    if (storageConfig !== null && detectStorageIsS3(storageConfig)) {
-      services.push("storage");
-      backends.storage = "s3";
+    const appDir = resolve(inputDir);
+    const graph = runtimeDependencies(appDir);
+    const envDir = options?.envDir ? resolve(options.envDir) : existsSync(join(appDir, ".env")) ? appDir : graph.root;
+    const loaded = loadDeploymentEnvironment({ environment: options?.environment ?? "prod", envDir, requireFile: options?.environment !== void 0 });
+    if (!loaded.success)
+      return loaded;
+    const env = loaded.data.values;
+    const deps = graph.runtime;
+    const configs = {};
+    for (const [name, owner] of Object.entries({ db: "reldb", cache: "cache", storage: "storage", vecdb: "vecdb", iam: "iam", reach: "reach" })) {
+      configs[name] = {};
+      if (!deps.has(`@h-ai/${owner}`))
+        continue;
+      const configFile = ["yml", "yaml"].map((ext) => join(appDir, "config", `_${name}.${ext}`)).find(existsSync);
+      const config = configFile ? loadDeploymentConfig(name, configFile, env) : void 0;
+      if (config && !config.success)
+        return config;
+      configs[name] = config?.data ?? {};
     }
-  }
-  const vecdbFile = files.find((f) => f.startsWith("_vecdb."));
-  if (vecdbFile) {
-    const vecdbConfig = readYaml(join(configDir, vecdbFile));
-    if (vecdbConfig !== null) {
-      services.push("vecdb");
-      backends.vecdb = vecdbConfig.type ?? "qdrant";
+    const middlewares = [];
+    const add = (service, backend, configName = service, configPath = [], config = configs[configName] ?? {}, source = `_${configName}.yml`) => {
+      middlewares.push({ service, backend, source, configName, configPath, envPrefix: ["HAI", configName, ...configPath].map((part) => part.toUpperCase()).join("_"), config });
+    };
+    const iam = deps.has("@h-ai/iam");
+    if (deps.has("@h-ai/reldb"))
+      add("db", String(configs.db.type ?? "sqlite"), "db", [], configs.db, "@h-ai/reldb / _db.yml");
+    if (deps.has("@h-ai/cache"))
+      add("cache", String(configs.cache.type ?? "memory"), "cache", [], configs.cache, "@h-ai/cache / _cache.yml");
+    if (deps.has("@h-ai/storage"))
+      add("storage", String(configs.storage.type ?? "local"));
+    if (deps.has("@h-ai/vecdb"))
+      add("vecdb", String(configs.vecdb.type ?? "lancedb"));
+    if (iam) {
+      const ldap = record(configs.iam.ldap);
+      add("ldap", record(configs.iam.login).ldap === true ? "ldap" : "disabled", "iam", ["ldap"], ldap, "@h-ai/iam (LDAP)");
     }
-  }
-  const reachFile = files.find((f) => f.startsWith("_reach."));
-  if (reachFile) {
-    const reachConfig = readYaml(join(configDir, reachFile));
-    if (reachConfig !== null) {
-      detectReachServices(reachConfig, services);
+    const providers = configs.reach.providers;
+    if (deps.has("@h-ai/reach") && Array.isArray(providers)) {
+      for (const [index, item] of providers.entries()) {
+        const provider = record(item);
+        const type = String(provider.type ?? "");
+        const service = type === "aliyun-sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
+        if (service)
+          add(service, type, "reach", ["providers", String(index)], provider, "@h-ai/reach");
+      }
     }
+    if (deps.has("@h-ai/reach") && !middlewares.some((item) => item.configName === "reach"))
+      add("email", "console", "reach", ["providers", "0"], { name: "email", type: "console" }, "@h-ai/reach");
+    const isSvelteKit = graph.build.has("@sveltejs/kit");
+    const scan = {
+      appDir,
+      envDir,
+      middlewares,
+      haiModules: [...deps].filter((name) => name.startsWith("@h-ai/")).sort(),
+      appName: basename(appDir),
+      isSvelteKit,
+      adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
+      nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
+      requiredServices: [...new Set(middlewares.map((item) => item.service))],
+      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend]))
+    };
+    logger2.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
+    return ok(scan);
+  } catch {
+    return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
   }
-  return { services, backends };
-}
-function detectStorageIsS3(config) {
-  if (config.type === "s3") {
-    return true;
-  }
-  const providers = config.providers;
-  if (providers === void 0) {
-    return false;
-  }
-  return Object.values(providers).some((p) => p?.type === "s3");
 }
-function detectReachServices(config, services) {
-  const providers = config.providers;
-  if (!Array.isArray(providers)) {
-    return;
-  }
-  let hasEmail = false;
-  let hasSms = false;
-  for (const provider of providers) {
-    const providerType = provider.type;
-    if (!hasEmail && (providerType === "smtp" || providerType === "api")) {
-      hasEmail = true;
-      services.push("email");
-    }
-    if (!hasSms && providerType === "aliyun-sms") {
-      hasSms = true;
-      services.push("sms");
-    }
+var logger3 = core.logger.child({ module: "deploy", scope: "command" });
+function maskSecrets(text, secrets) {
+  if (!secrets || secrets.length === 0)
+    return text;
+  let masked = text;
+  for (const secret of secrets) {
+    if (secret && secret.length > 0)
+      masked = masked.split(secret).join("***");
   }
+  return masked;
 }
-async function scanApp(appDir) {
-  logger3.debug("Scanning application", { appDir });
-  try {
-    const pkg = readJson(join(appDir, "package.json"));
-    if (pkg === null) {
-      return err(
-        HaiDeployError.SCAN_FAILED,
-        deployM("deploy_scanFailed", { params: { error: "package.json not found" } })
-      );
-    }
-    const appName = extractAppName(pkg);
-    const isSvelteKit = existsSync(join(appDir, "svelte.config.js")) || existsSync(join(appDir, "svelte.config.ts"));
-    const adapterInstalled = hasDependency(pkg, "@sveltejs/adapter-vercel");
-    const nodeAdapterInstalled = hasDependency(pkg, "@sveltejs/adapter-node");
-    const configDir = join(appDir, "config");
-    const configDetection = detectRequiredServices(configDir);
-    const depServices = detectServicesFromDependencies(pkg);
-    const requiredServices = Array.from(/* @__PURE__ */ new Set([...configDetection.services, ...depServices]));
-    const scripts = pkg.scripts;
-    const buildCommand = scripts?.build ?? "pnpm build";
-    const scanResult = {
-      appName,
-      isSvelteKit,
-      adapterInstalled,
-      nodeAdapterInstalled,
-      requiredServices,
-      serviceBackends: configDetection.backends,
-      buildCommand
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve6) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env ? { ...process2.env, ...options.env } : process2.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let timer;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve6(result);
     };
-    logger3.info("Application scanned", {
-      appName,
-      isSvelteKit,
-      adapterInstalled,
-      nodeAdapterInstalled,
-      requiredServices,
-      serviceBackends: configDetection.backends
+    if (options.timeoutMs && options.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        logger3.error("Command timed out", { command, timeoutMs: options.timeoutMs });
+        finish(err(
+          HaiDeployError.REMOTE_COMMAND_FAILED,
+          deployM("deploy_commandTimeout", { params: { command } })
+        ));
+      }, options.timeoutMs);
+    }
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
     });
-    return ok(scanResult);
-  } catch (error) {
-    logger3.error("Application scan failed", { appDir, error });
-    return err(
-      HaiDeployError.SCAN_FAILED,
-      deployM("deploy_scanFailed", {
-        params: { error: error instanceof Error ? error.message : String(error) }
-      }),
-      error
-    );
-  }
-}
-function detectServicesFromDependencies(pkg) {
-  const depMap = {
-    "@h-ai/reldb": "db",
-    "@h-ai/cache": "cache",
-    "@h-ai/storage": "storage",
-    "@h-ai/vecdb": "vecdb"
-  };
-  const services = [];
-  for (const [depName, serviceType] of Object.entries(depMap)) {
-    if (hasDependency(pkg, depName)) {
-      services.push(serviceType);
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (error) => {
+      logger3.error("Command failed to start", { command, error: maskSecrets(String(error), options.secrets) });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(error.message, options.secrets) }
+        }),
+        error
+      ));
+    });
+    child.on("close", (code) => {
+      const exitCode = code ?? -1;
+      if (exitCode === 0) {
+        finish(ok({ code: exitCode, stdout, stderr }));
+        return;
+      }
+      logger3.error("Command exited with non-zero code", {
+        command,
+        code: exitCode,
+        stderr: maskSecrets(stderr, options.secrets).slice(-500),
+        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
+      });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
+        })
+      ));
+    });
+    if (options.input !== void 0) {
+      child.stdin.write(options.input);
+      child.stdin.end();
+    } else {
+      child.stdin.end();
     }
-  }
-  return services;
+  });
 }
-function extractAppName(pkg) {
-  const name = pkg.name ?? "app";
-  const slashIndex = name.indexOf("/");
-  if (slashIndex >= 0) {
-    return name.slice(slashIndex + 1);
+
+// src/container/deploy-bundle.ts
+function shellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+async function createDeploymentBundle(options) {
+  const { directory, artifactDir, artifact, projectName, environment, runtime, coreEnv } = options;
+  const stem = basename(options.output).replace(/\.tar$/i, "");
+  const versionSuffix = `-${artifact.appVersion}`;
+  const output = resolve(dirname(options.output), `${stem.endsWith(versionSuffix) ? stem : `${stem}${versionSuffix}`}.tar`);
+  const composeName = `docker-compose-${artifact.appVersion}.yml`;
+  mkdirSync(dirname(output), { recursive: true, mode: 448 });
+  const staging = mkdtempSync(join(directory, ".bundle-"));
+  chmodSync(staging, 448);
+  const temporaryTar = `${output}.partial`;
+  const startName = `start-${environment}.sh`;
+  try {
+    mkdirSync(join(staging, "images"));
+    for (const image of artifact.images)
+      copyFileSync(join(artifactDir, image.file), join(staging, "images", image.file));
+    for (const file of [composeName, ".env.runtime", ...artifact.images.some((image) => image.name === "web") ? ["web.conf"] : []])
+      copyFileSync(join(directory, file), join(staging, file));
+    const compose = parse(readFileSync(join(directory, composeName), "utf8"));
+    const images = [...new Set(Object.values(compose.services).flatMap((service) => service.image ? [service.image] : []))];
+    const start = `#!/bin/sh
+set -eu
+cd "$(dirname "$0")"
+umask 077
+export HAI_DEPLOY_ENVIRONMENT=${shellArgument(environment)}
+export HAI_CORE_ENV=${shellArgument(coreEnv)}
+runtime=${shellArgument(runtime)}
+if [ -n "\${HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME:-}" ]; then runtime="$HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME"; fi
+if [ "$runtime" = auto ]; then
+  if command -v podman >/dev/null 2>&1 && podman version >/dev/null 2>&1; then runtime=podman; else runtime=docker; fi
+fi
+case "$runtime" in docker|podman) ;; *) echo 'HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME must be docker or podman' >&2; exit 1;; esac
+"$runtime" version >/dev/null
+"$runtime" compose version >/dev/null
+sha256sum -c SHA256SUMS
+chmod 600 .env.runtime
+${artifact.images.map((image) => `"$runtime" load -i ${shellArgument(`images/${image.file}`)}`).join("\n")}
+# \u79BB\u7EBF\u670D\u52A1\u5668\u5E94\u5148\u5BFC\u5165\u5168\u90E8\u4E2D\u95F4\u4EF6\u955C\u50CF\uFF1B\u7981\u6B62\u9759\u9ED8\u5C1D\u8BD5\u8054\u7F51\u3002
+for image in ${images.map(shellArgument).join(" ")}; do
+  "$runtime" image inspect "$image" >/dev/null 2>&1 || { echo "Missing image: $image. Load the matching image archive before retrying." >&2; exit 1; }
+done
+exec "$runtime" compose -f ${shellArgument(composeName)} --env-file .env.runtime -p ${shellArgument(`hai-${projectName}`)} up -d
+`;
+    writeFileSync(join(directory, startName), start, { mode: 448 });
+    writeFileSync(join(staging, startName), start, { mode: 448 });
+    const instructions = deployM("deploy_bundleInstructions", { params: { file: basename(output), start: startName, images: images.join("\n"), compose: composeName } });
+    const metadata = deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, compose: composeName } });
+    writeFileSync(join(staging, "README.txt"), `${metadata}
+${instructions}
+`);
+    copyFileSync(join(artifactDir, "manifest.json"), join(staging, "manifest.json"));
+    const checksums = [];
+    for (const file of [composeName, "manifest.json", ".env.runtime", startName, ...artifact.images.some((image) => image.name === "web") ? ["web.conf"] : [], ...artifact.images.map((image) => `images/${image.file}`)])
+      checksums.push(`${await artifactChecksum(join(staging, file))}  ${file}`);
+    writeFileSync(join(staging, "SHA256SUMS"), `${checksums.join("\n")}
+`);
+    const tar = await runCommand("tar", ["-cf", temporaryTar, "-C", staging, "."]);
+    if (!tar.success)
+      throw new Error(tar.error.message);
+    chmodSync(temporaryTar, 384);
+    const { renameSync } = await import('fs');
+    renameSync(temporaryTar, output);
+    return { bundlePath: output, instructions, startName };
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+    rmSync(temporaryTar, { force: true });
   }
-  return name;
 }
 var IMAGES = {
   postgres: "postgres:16-alpine",
   mysql: "mysql:8.4",
   redis: "redis:7-alpine",
-  minio: "minio/minio:RELEASE.2025-09-07T16-13-09Z",
-  mc: "minio/mc:RELEASE.2025-08-13T08-35-41Z",
+  rustfs: "ghcr.io/rustfs/rustfs:1.0.1",
+  minio: "ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z",
   qdrant: "qdrant/qdrant:v1.12.4",
   pgvector: "pgvector/pgvector:pg17",
-  chroma: "chromadb/chroma:0.5.23"
+  chroma: "chromadb/chroma:1.5.5",
+  ldap: "docker.io/osixia/openldap:1.5.0",
+  smtp: "axllent/mailpit:v1.27.4"
 };
 function generatePassword() {
   return randomBytes(24).toString("base64url");
@@ -590,7 +926,8 @@ function resolveSidecarSecrets(appDir, projectName) {
   }
   const secrets = {
     dbPassword: generatePassword(),
-    storagePassword: generatePassword()
+    storagePassword: generatePassword(),
+    ldapPassword: generatePassword()
   };
   mkdirSync(dirname(secretFile), { recursive: true });
   writeFileSync(secretFile, JSON.stringify(secrets), { mode: 384 });
@@ -651,38 +988,57 @@ function planRedisCache(plan, projectName, net) {
   };
   plan.env.HAI_CACHE = JSON.stringify({ type: "redis", url: "redis://cache:6379" });
 }
-function planMinioStorage(plan, projectName, password, net) {
+function planS3Storage(plan, projectName, password, net, engine) {
   plan.services.push("storage");
   plan.dependsOn.push("storage");
   plan.composeServices.storage = {
-    image: IMAGES.minio,
+    image: IMAGES[engine],
     container_name: `hai-${projectName}-storage`,
     restart: "unless-stopped",
-    command: ["server", "/data"],
+    ...engine === "minio" ? { command: ["server", "/data"] } : {},
     env_file: [".env.runtime"],
     volumes: [`${projectName}-storage-data:/data`],
     networks: net
   };
   plan.composeServices["storage-init"] = {
-    image: IMAGES.mc,
     depends_on: ["storage"],
     env_file: [".env.runtime"],
     entrypoint: [
-      "sh",
-      "-c",
-      'until mc alias set s3 http://storage:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"; do sleep 1; done; mc mb -p s3/hai; exit 0'
+      "node",
+      "--input-type=module",
+      "-e",
+      // 复用应用 @h-ai/storage 已依赖的 SDK；不额外拉取失效的 mc 镜像，不把密钥拼进命令。
+      `import { S3Client, HeadBucketCommand, CreateBucketCommand } from '@aws-sdk/client-s3';
+const config = JSON.parse(process.env.HAI_STORAGE);
+const client = new S3Client({ endpoint: config.endpoint, region: config.region, forcePathStyle: config.forcePathStyle, credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey } });
+let ready = false;
+for (let attempt = 0; attempt < 120; attempt++) {
+  try {
+    try { await client.send(new HeadBucketCommand({ Bucket: config.bucket })); }
+    catch (error) {
+      if (error.$$metadata?.httpStatusCode !== 404) throw error;
+      await client.send(new CreateBucketCommand({ Bucket: config.bucket }));
+    }
+    ready = true; break;
+  } catch { await new Promise(resolve => setTimeout(resolve, 1000)); }
+}
+client.destroy();
+if (!ready) throw new Error('S3 bucket initialization failed');`
     ],
     networks: net
   };
   plan.volumes[`${projectName}-storage-data`] = null;
-  plan.env.MINIO_ROOT_USER = "hai";
-  plan.env.MINIO_ROOT_PASSWORD = password;
+  if (engine === "rustfs") {
+    Object.assign(plan.env, { RUSTFS_ACCESS_KEY: "hai-storage", RUSTFS_SECRET_KEY: password, RUSTFS_ADDRESS: "0.0.0.0:9000", RUSTFS_VOLUMES: "/data", RUSTFS_CONSOLE_ENABLE: "false" });
+  } else {
+    Object.assign(plan.env, { MINIO_ROOT_USER: "hai-storage", MINIO_ROOT_PASSWORD: password });
+  }
   plan.env.HAI_STORAGE = JSON.stringify({
     type: "s3",
     endpoint: "http://storage:9000",
     bucket: "hai",
     region: "us-east-1",
-    accessKeyId: "hai",
+    accessKeyId: "hai-storage",
     secretAccessKey: password,
     forcePathStyle: true
   });
@@ -732,7 +1088,7 @@ function planChromaVecdb(plan, projectName, net) {
   plan.volumes[`${projectName}-vecdb-data`] = null;
   plan.env.HAI_VECDB = JSON.stringify({ type: "chroma", url: "http://vecdb:8000" });
 }
-function planSidecars(appDir, projectName, scan, provisionEnv) {
+function planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine = "rustfs") {
   const plan = {
     services: [],
     composeServices: {},
@@ -742,10 +1098,14 @@ function planSidecars(appDir, projectName, scan, provisionEnv) {
     dependsOn: [],
     secrets: []
   };
+  if (!scan.requiredServices.some((service) => usesDefaultMiddleware(scan, service, options)))
+    return plan;
   const secrets = resolveSidecarSecrets(appDir, projectName);
   const net = ["hai-app"];
   const backends = scan.serviceBackends;
   for (const service of scan.requiredServices) {
+    if (!usesDefaultMiddleware(scan, service, options))
+      continue;
     if (service === "db" && !provisionEnv.HAI_DB) {
       const backend = backends.db ?? "postgresql";
       if (backend === "mysql")
@@ -755,9 +1115,13 @@ function planSidecars(appDir, projectName, scan, provisionEnv) {
       else
         planPostgresDb(plan, projectName, secrets.dbPassword, net);
     } else if (service === "cache" && !provisionEnv.HAI_CACHE) {
-      planRedisCache(plan, projectName, net);
+      if ((backends.cache ?? "redis") === "redis")
+        planRedisCache(plan, projectName, net);
     } else if (service === "storage" && !provisionEnv.HAI_STORAGE) {
-      planMinioStorage(plan, projectName, secrets.storagePassword, net);
+      if ((backends.storage ?? "s3") === "s3")
+        planS3Storage(plan, projectName, secrets.storagePassword, net, s3Engine);
+      else
+        addAppDataVolume(plan, projectName);
     } else if (service === "vecdb" && !provisionEnv.HAI_VECDB) {
       const backend = backends.vecdb ?? "qdrant";
       if (backend === "pgvector")
@@ -768,16 +1132,39 @@ function planSidecars(appDir, projectName, scan, provisionEnv) {
         addAppDataVolume(plan, projectName);
       else
         planQdrantVecdb(plan, projectName, net);
+    } else if (service === "ldap" && backends.ldap === "ldap" && !provisionEnv.HAI_IAM_LDAP) {
+      const password = secrets.ldapPassword ?? secrets.dbPassword;
+      plan.services.push("ldap");
+      plan.dependsOn.push("ldap");
+      plan.composeServices.ldap = { image: IMAGES.ldap, restart: "unless-stopped", env_file: [".env.runtime"], networks: net, volumes: [`${projectName}-ldap-data:/var/lib/ldap`, `${projectName}-ldap-config:/etc/ldap/slapd.d`] };
+      plan.volumes[`${projectName}-ldap-data`] = null;
+      plan.volumes[`${projectName}-ldap-config`] = null;
+      Object.assign(plan.env, { LDAP_DOMAIN: "example.org", LDAP_ORGANISATION: "HAI", LDAP_ADMIN_PASSWORD: password, LDAP_TLS: "false", HAI_IAM_LOGIN_LDAP: "true", HAI_IAM_LDAP: JSON.stringify({ url: "ldap://ldap:389", bindDn: "cn=admin,dc=example,dc=org", bindPassword: password, searchBase: "dc=example,dc=org" }) });
+      plan.secrets.push(password);
+    } else if (service === "email" && (scan.middlewares ? scan.middlewares.some((item) => item.service === "email" && item.backend === "smtp" && (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email ?? "default") === "default") : backends.email === "smtp") && !provisionEnv.HAI_REACH_PROVIDERS) {
+      plan.services.push("email");
+      plan.dependsOn.push("email");
+      plan.composeServices.email = { image: IMAGES.smtp, restart: "unless-stopped", networks: net };
+      const requirements = scan.middlewares?.filter((item) => item.service === "email" && item.backend === "smtp" && ["default", void 0].includes(options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email));
+      if (requirements?.length) {
+        for (const requirement of requirements)
+          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+      } else if (!scan.middlewares) {
+        plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({ name: "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+      }
     }
   }
   return plan;
 }
-function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort) {
-  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv);
+function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv = {}, s3Engine = "rustfs") {
+  const sidecar = planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine);
   const env = {
     NODE_ENV: "production",
     HOST: "0.0.0.0",
     PORT: String(containerPort),
+    HAI_SERV_SERVER_HOST: "0.0.0.0",
+    HAI_SERV_SERVER_PORT: String(containerPort),
+    ...appEnv,
     ...sidecar.env,
     ...provisionEnv
   };
@@ -787,6 +1174,7 @@ function generateComposeFile(options) {
   const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
   const app = {
     image: imageRef,
+    labels: { "org.opencontainers.image.version": options.appVersion },
     container_name: `hai-${projectName}-app`,
     restart: "unless-stopped",
     // 镜像已由 load 注入本地，禁止 compose 再从 registry 拉取
@@ -799,188 +1187,110 @@ function generateComposeFile(options) {
     app.volumes = sidecar.appVolumes;
   if (sidecar.dependsOn.length > 0)
     app.depends_on = sidecar.dependsOn;
+  const services = { app, ...sidecar.composeServices };
+  if (options.web) {
+    delete app.ports;
+    services.web = {
+      image: options.web.imageRef,
+      labels: { "org.opencontainers.image.version": options.appVersion },
+      container_name: `hai-${projectName}-web`,
+      restart: "unless-stopped",
+      pull_policy: "never",
+      ports: [`${hostPort}:${options.web.containerPort}`],
+      environment: { PUBLIC_API_BASE: "" },
+      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`], interval: "30s", timeout: "5s", retries: 3 },
+      volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
+      depends_on: ["app"],
+      networks: ["hai-app"]
+    };
+  }
+  if (services["storage-init"])
+    services["storage-init"] = { ...services["storage-init"], image: imageRef };
   const compose = {
-    services: {
-      app,
-      ...sidecar.composeServices
-    },
-    networks: {
+    "x-hai-version": options.appVersion,
+    services,
+    "networks": {
       "hai-app": { name: `hai-${projectName}` }
     }
   };
   if (Object.keys(sidecar.volumes).length > 0)
     compose.volumes = sidecar.volumes;
-  return stringify(compose);
-}
-function serializeEnvFile(env) {
-  return `${Object.entries(env).map(([key, value]) => `${key}=${value}`).join("\n")}
-`;
-}
-function generateDockerignore() {
-  return `**/node_modules
-**/dist
-**/build
-**/.turbo
-**/.svelte-kit
-**/coverage
-**/test-results
-**/playwright-report
-**/.hai/deploy
-.git
-`;
-}
-function generateFallbackDockerfile(packageName, containerPort) {
-  return `# syntax=docker/dockerfile:1.7
-FROM node:24-bookworm-slim AS build
-ENV PNPM_HOME=/pnpm
-ENV PATH=$PNPM_HOME:$PATH
-ENV CI=true
-WORKDIR /workspace
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY . .
-RUN pnpm install --frozen-lockfile --ignore-scripts
-RUN pnpm --filter ${packageName} build
-RUN pnpm pm deploy --filter ${packageName} --prod /prod/app
-
-FROM node:24-bookworm-slim AS runtime
-ENV NODE_ENV=production
-ENV HOST=0.0.0.0
-ENV PORT=${containerPort}
-WORKDIR /app
-COPY --from=build --chown=node:node /prod/app ./
-USER node
-EXPOSE ${containerPort}
-CMD ["node", "build"]
-`;
-}
-var logger4 = core.logger.child({ module: "deploy", scope: "command" });
-function maskSecrets(text, secrets) {
-  if (!secrets || secrets.length === 0)
-    return text;
-  let masked = text;
-  for (const secret of secrets) {
-    if (secret && secret.length > 0)
-      masked = masked.split(secret).join("***");
-  }
-  return masked;
-}
-function runCommand(command, args, options = {}) {
-  return new Promise((resolve) => {
-    const child = spawn(command, args, {
-      cwd: options.cwd,
-      env: options.env ? { ...process.env, ...options.env } : process.env,
-      shell: false
-    });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    let timer;
-    const finish = (result) => {
-      if (settled)
-        return;
-      settled = true;
-      if (timer)
-        clearTimeout(timer);
-      resolve(result);
-    };
-    if (options.timeoutMs && options.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        logger4.error("Command timed out", { command, timeoutMs: options.timeoutMs });
-        finish(err(
-          HaiDeployError.REMOTE_COMMAND_FAILED,
-          deployM("deploy_commandTimeout", { params: { command } })
-        ));
-      }, options.timeoutMs);
-    }
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (error) => {
-      logger4.error("Command failed to start", { command, error: maskSecrets(String(error), options.secrets) });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(error.message, options.secrets) }
-        }),
-        error
-      ));
-    });
-    child.on("close", (code) => {
-      const exitCode = code ?? -1;
-      if (exitCode === 0) {
-        finish(ok({ code: exitCode, stdout, stderr }));
-        return;
+  if (options.previousCompose && options.serviceModes) {
+    const previous = parse(options.previousCompose);
+    for (const [service, mode] of Object.entries(options.serviceModes)) {
+      if (mode !== "keep")
+        continue;
+      for (const name of [service, `${service}-init`]) {
+        if (previous.services?.[name]) {
+          services[name] = previous.services[name];
+          app.depends_on = [.../* @__PURE__ */ new Set([...app.depends_on ?? [], service])];
+        }
       }
-      logger4.error("Command exited with non-zero code", {
-        command,
-        code: exitCode,
-        stderr: maskSecrets(stderr, options.secrets).slice(-500)
-      });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(stderr || `exit ${exitCode}`, options.secrets).slice(-500) }
-        })
-      ));
-    });
-    if (options.input !== void 0) {
-      child.stdin.write(options.input);
-      child.stdin.end();
-    } else {
-      child.stdin.end();
-    }
-  });
-}
-
-// src/container/deploy-container-runtime.ts
-var logger5 = core.logger.child({ module: "deploy", scope: "container-runtime" });
-async function detectLocalRuntime(preferred = "auto") {
-  const candidates = preferred === "auto" ? ["podman", "docker"] : [preferred];
-  for (const runtime of candidates) {
-    const probe = await runCommand(runtime, ["version"], { timeoutMs: 15e3 });
-    if (probe.success) {
-      logger5.info("Local container runtime detected", { runtime });
-      return ok(runtime);
     }
+    const previousMounts = previous.services?.app?.volumes;
+    if (Array.isArray(previousMounts) && Object.values(options.serviceModes).includes("keep"))
+      app.volumes = [.../* @__PURE__ */ new Set([...app.volumes ?? [], ...previousMounts])];
+    compose.volumes = { ...previous.volumes, ...sidecar.volumes };
   }
-  return err(
-    HaiDeployError.CONTAINER_RUNTIME_NOT_FOUND,
-    deployM("deploy_containerRuntimeNotFound", { params: { runtime: candidates.join(" / ") } })
-  );
-}
-async function buildImage(runtime, options) {
-  const args = ["build", "-f", options.dockerfilePath, "-t", options.imageRef];
-  if (runtime === "podman")
-    args.push("--format", "docker", "--jobs", "1");
-  args.push(options.contextDir);
-  logger5.info("Building container image", { runtime, imageRef: options.imageRef });
-  const result = await runCommand(runtime, args, { cwd: options.contextDir });
-  if (!result.success) {
-    return err(
-      HaiDeployError.CONTAINER_BUILD_FAILED,
-      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
-      result.error
-    );
+  if (services["storage-init"]) {
+    app.depends_on = {
+      ...Object.fromEntries((app.depends_on ?? []).map((name) => [name, { condition: "service_started" }])),
+      "storage-init": { condition: "service_completed_successfully" }
+    };
   }
-  return ok(void 0);
+  for (const service of Object.values(services))
+    service.pull_policy = "never";
+  return stringify(compose);
 }
-async function saveImage(runtime, imageRef, tarPath) {
-  logger5.info("Saving container image", { runtime, imageRef, tarPath });
-  const result = await runCommand(runtime, ["save", "-o", tarPath, imageRef], {});
-  if (!result.success) {
-    return err(
-      HaiDeployError.CONTAINER_BUILD_FAILED,
-      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
-      result.error
-    );
+function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
+  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535))
+    throw new Error("Invalid web proxy target");
+  return `server {
+  listen ${webPort};
+  server_name _;
+  root /usr/share/nginx/html;
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  location = /runtime-config.js {
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+    return 200 'globalThis.__HAI_PUBLIC_CONFIG__={apiBase:globalThis.location.origin+"${apiPrefix}"};';
+  }
+  location = /_hai/web-health {
+    access_log off;
+    return 200 'ok';
+  }
+  location = /health {
+    proxy_pass http://app:${port};
+    proxy_set_header Host $http_host;
+  }
+  location ${apiPrefix.replace(/\/$/, "")}/ {
+    proxy_pass http://app:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_buffering off;
   }
-  return ok(void 0);
 }
-var logger6 = core.logger.child({ module: "deploy", scope: "ssh" });
+`;
+}
+function serializeEnvFile(env) {
+  return `${Object.entries(env).map(([key, value]) => {
+    let literal = value;
+    if (/[\s#$'"]/.test(value)) {
+      if (value.startsWith("{") || value.startsWith("["))
+        literal = `'${value.replaceAll("'", "\\u0027")}'`;
+      else if (!value.includes("'"))
+        literal = `'${value}'`;
+      else
+        literal = JSON.stringify(value).replaceAll("$", "$$");
+    }
+    return `${key}=${literal}`;
+  }).join("\n")}
+`;
+}
+var logger4 = core.logger.child({ module: "deploy", scope: "ssh" });
 function buildConnectOptions(config) {
   const args = ["-o", "BatchMode=yes"];
   args.push("-o", `ConnectTimeout=${config.connectTimeoutSeconds}`);
@@ -1031,7 +1341,7 @@ function createSshExecutor(config) {
     return ok(void 0);
   };
   const ping = async () => {
-    logger6.debug("SSH preflight", { host: config.host, port: config.port });
+    logger4.debug("SSH preflight", { host: config.host, port: config.port });
     const result = await exec("true", { timeoutMs: 2e4 });
     if (!result.success) {
       return err(
@@ -1046,7 +1356,7 @@ function createSshExecutor(config) {
 }
 
 // src/providers/deploy-provider-docker-ssh.ts
-var logger7 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
+var logger5 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
 var HEALTH_POLL_INTERVAL = 3e3;
 var HEALTH_MAX_ATTEMPTS = 40;
 function makeDeploymentId() {
@@ -1055,38 +1365,15 @@ function makeDeploymentId() {
   const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
   return `${stamp}-${randomBytes(3).toString("hex")}`;
 }
-function parseLoadedImageRef(stdout, fallback) {
-  const match = stdout.match(/Loaded image(?:\(s\))?:\s*(\S+)/);
-  return match ? match[1] : fallback;
-}
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
-function readPackageName(appDir) {
-  try {
-    const pkg = JSON.parse(readFileSync(join(appDir, "package.json"), "utf-8"));
-    return pkg.name ?? "app";
-  } catch {
-    return "app";
-  }
-}
-function resolveWorkspaceRoot(appDir) {
-  if (existsSync(join(appDir, "pnpm-workspace.yaml")))
-    return appDir;
-  let current = appDir;
-  let parent = dirname(current);
-  while (parent !== current) {
-    if (existsSync(join(parent, "pnpm-workspace.yaml")))
-      return parent;
-    current = parent;
-    parent = dirname(parent);
-  }
-  return appDir;
-}
-function createDockerSshProvider(config, localRuntimePref = "auto") {
-  const ssh = createSshExecutor(config.ssh);
+function createDockerSshProvider(config, container) {
+  const ssh = config.ssh ? createSshExecutor(config.ssh) : void 0;
   const baseDir = config.remote.baseDir;
   async function detectRemoteRuntime() {
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
     const candidates = config.remote.runtime === "auto" ? ["podman", "docker"] : [config.remote.runtime];
     for (const runtime of candidates) {
       const versionResult = await ssh.exec(`${runtime} version`, { timeoutMs: 2e4 });
@@ -1094,7 +1381,7 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
         continue;
       const composeResult = await ssh.exec(`${runtime} compose version`, { timeoutMs: 2e4 });
       if (composeResult.success) {
-        logger7.info("Remote container runtime detected", { runtime });
+        logger5.info("Remote container runtime detected", { runtime });
         return ok(runtime);
       }
     }
@@ -1116,98 +1403,103 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
     return false;
   }
   const deploy2 = async (context) => {
-    const { appDir, projectName, scan, provisionEnv } = context;
+    const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
     const deploymentId = makeDeploymentId();
-    const containerPort = config.expose.containerPort;
     const hostPort = config.expose.hostPort;
-    const localImageTag = `hai-${projectName}:${deploymentId}`;
-    const runtimeResult = await detectLocalRuntime(localRuntimePref);
-    if (!runtimeResult.success)
-      return err(runtimeResult.error);
-    const localRuntime = runtimeResult.data;
-    const artifactDir = join(appDir, ".hai", "deploy");
-    mkdirSync(artifactDir, { recursive: true });
-    const appDockerfile = join(appDir, "Dockerfile");
-    let dockerfilePath;
-    let contextDir;
-    if (existsSync(appDockerfile)) {
-      dockerfilePath = appDockerfile;
-      contextDir = appDir;
-    } else {
-      dockerfilePath = join(artifactDir, "Dockerfile");
-      writeFileSync(dockerfilePath, generateFallbackDockerfile(readPackageName(appDir), containerPort));
-      writeFileSync(`${dockerfilePath}.dockerignore`, generateDockerignore());
-      contextDir = resolveWorkspaceRoot(appDir);
-      logger7.info("Generated fallback Dockerfile", { dockerfilePath, contextDir });
+    const artifactDir = join(appDir, ".hai", "deploy", options?.environment ?? "prod");
+    mkdirSync(artifactDir, { recursive: true, mode: 448 });
+    chmodSync(artifactDir, 448);
+    const artifact = context.artifact;
+    const resolvedBuildDir = context.artifactDir;
+    const images = artifact.images;
+    const web = images.find((image) => image.name === "web");
+    const app = images.find((image) => image.name === "app");
+    const containerPort = app.containerPort ?? config.expose.containerPort;
+    const url = config.ssh ? `http://${config.ssh.host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
+    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
+    let webProxy;
+    if (web) {
+      const server = loadDeploymentConfig("serv", join(appDir, "config", "_serv.yml"), env);
+      if (!server.success)
+        return server;
+      const http = server.data.http;
+      const cors = server.data.cors;
+      const apiPrefix = http?.apiPrefix ?? "/api/v1";
+      if (typeof apiPrefix !== "string" || !/^\/[\w/-]+$/.test(apiPrefix))
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
+      webProxy = generateWebProxyConfig(containerPort, apiPrefix, web.containerPort ?? 8080);
+      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && config.ssh ? url : cors?.origin ?? "*" } });
     }
-    const buildResult = await buildImage(localRuntime, {
-      contextDir,
-      dockerfilePath,
-      imageRef: localImageTag
-    });
-    if (!buildResult.success)
-      return err(buildResult.error);
-    const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort);
     const envPath = join(artifactDir, ".env.runtime");
+    const previousEnv = existsSync(envPath) ? parseEnv(readFileSync(envPath, "utf8")) : {};
+    Object.assign(env, { ...previousEnv, ...env });
     writeFileSync(envPath, serializeEnvFile(env), { mode: 384 });
-    const tarPath = join(artifactDir, `${projectName}.tar`);
-    const saveResult = await saveImage(localRuntime, localImageTag, tarPath);
-    if (!saveResult.success)
-      return err(saveResult.error);
-    const pingResult = await ssh.ping();
-    if (!pingResult.success)
-      return err(pingResult.error);
-    const remoteRuntimeResult = await detectRemoteRuntime();
-    if (!remoteRuntimeResult.success)
-      return err(remoteRuntimeResult.error);
-    const remoteRuntime = remoteRuntimeResult.data;
-    const remoteDir = `${baseDir}/${projectName}`;
-    const prepareResult = await ssh.exec(`mkdir -p ${remoteDir} && chmod 700 ${remoteDir}`);
-    if (!prepareResult.success)
-      return err(prepareResult.error);
-    const remoteTar = `${remoteDir}/image.tar`;
-    const uploadTarResult = await ssh.upload(tarPath, remoteTar);
-    if (!uploadTarResult.success)
-      return err(uploadTarResult.error);
-    const loadResult = await ssh.exec(`${remoteRuntime} load -i ${remoteTar}`, { timeoutMs: 3e5 });
-    if (!loadResult.success)
-      return err(loadResult.error);
-    const loadedRef = parseLoadedImageRef(loadResult.data.stdout, localImageTag);
-    const remoteImageRef = remoteRuntime === "podman" ? `localhost/${localImageTag}` : localImageTag;
-    if (loadedRef !== remoteImageRef) {
-      const tagResult = await ssh.exec(`${remoteRuntime} tag ${loadedRef} ${remoteImageRef}`);
-      if (!tagResult.success)
-        return err(tagResult.error);
+    if (options?.environment) {
+      const environment = loadDeploymentEnvironment({ environment: options.environment, envDir: options.envDir ?? scan.envDir ?? appDir });
+      if (!environment.success)
+        return environment;
+      const saved = saveDeploymentEnvironment(environment.data, { HAI_DEPLOY_ENVIRONMENT: environment.data.environment, HAI_CORE_ENV: environment.data.values.HAI_CORE_ENV, ...sidecar.env, ...provisionEnv });
+      if (!saved.success)
+        return saved;
     }
+    const composeName = `docker-compose-${artifact.appVersion}.yml`;
+    const latestPath = join(artifactDir, "latest");
+    const previousName = existsSync(latestPath) ? readFileSync(latestPath, "utf8").trim() : "";
+    const previousPath = /^[\w.+-]+\.yml$/.test(previousName) ? join(artifactDir, previousName) : void 0;
     const composeContent = generateComposeFile({
       projectName,
-      imageRef: remoteImageRef,
+      appVersion: artifact.appVersion,
+      imageRef: app.imageRef,
       hostPort,
       containerPort,
-      sidecar
+      sidecar,
+      web: web ? { imageRef: web.imageRef, containerPort: web.containerPort ?? 8080 } : void 0,
+      serviceModes: options?.serviceModes,
+      previousCompose: previousPath && existsSync(previousPath) ? readFileSync(previousPath, "utf8") : void 0
     });
-    const composePath = join(artifactDir, "compose.yml");
+    const composePath = join(artifactDir, composeName);
     writeFileSync(composePath, composeContent);
-    const uploadComposeResult = await ssh.upload(composePath, `${remoteDir}/compose.yml`);
-    if (!uploadComposeResult.success)
-      return err(uploadComposeResult.error);
-    const uploadEnvResult = await ssh.upload(envPath, `${remoteDir}/.env.runtime`);
-    if (!uploadEnvResult.success)
-      return err(uploadEnvResult.error);
-    const secretMask = sidecar.secrets;
-    const chmodResult = await ssh.exec(`chmod 600 ${remoteDir}/.env.runtime`, { secrets: secretMask });
-    if (!chmodResult.success)
-      return err(chmodResult.error);
-    const upResult = await ssh.exec(
-      `cd ${remoteDir} && ${remoteRuntime} compose -p hai-${projectName} up -d`,
-      { timeoutMs: 3e5, secrets: secretMask }
+    if (webProxy)
+      writeFileSync(join(artifactDir, "web.conf"), webProxy);
+    const bundle = await createDeploymentBundle({
+      directory: artifactDir,
+      artifactDir: resolvedBuildDir,
+      artifact,
+      projectName,
+      environment: options?.environment ?? "prod",
+      runtime: config.remote.runtime,
+      coreEnv: env.HAI_CORE_ENV ?? "production",
+      output: options?.output ?? join(artifactDir, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar`)
+    });
+    writeFileSync(latestPath, `${composeName}
+`);
+    if (options?.bundleOnly)
+      return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet: Object.keys(env), ...bundle });
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
+    const ping = await ssh.ping();
+    if (!ping.success)
+      return ping;
+    const remoteRuntime = await detectRemoteRuntime();
+    if (!remoteRuntime.success)
+      return remoteRuntime;
+    const remoteDir = `${baseDir}/${projectName}`;
+    const remoteTar = `${remoteDir}/${basename(bundle.bundlePath)}`;
+    const prepared = await ssh.exec(`mkdir -p -- ${shellArgument(remoteDir)} && chmod 700 -- ${shellArgument(remoteDir)}`);
+    if (!prepared.success)
+      return prepared;
+    const uploaded = await ssh.upload(bundle.bundlePath, remoteTar);
+    if (!uploaded.success)
+      return uploaded;
+    const started = await ssh.exec(
+      `cd ${shellArgument(remoteDir)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} && HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME=${shellArgument(remoteRuntime.data)} sh ${shellArgument(bundle.startName)}`,
+      { timeoutMs: 3e5, secrets: sidecar.secrets }
     );
-    if (!upResult.success)
-      return err(upResult.error);
-    await ssh.exec(`rm -f ${remoteTar}`);
-    const url = `http://${config.ssh.host}:${hostPort}`;
-    logger7.info("Running health check", { url });
-    const healthy = await healthCheck(`${url}/`);
+    if (!started.success)
+      return started;
+    await ssh.exec(`rm -f -- ${shellArgument(remoteTar)} ${images.map((image) => shellArgument(`${remoteDir}/images/${image.file}`)).join(" ")}`);
+    logger5.info("Running health check", { url });
+    const healthy = await healthCheck(`${url}${!web && scan.isSvelteKit ? "/" : "/health"}`) && (!web || await healthCheck(`${url}/_hai/web-health`) && await healthCheck(`${url}/`));
     if (!healthy) {
       return err(
         HaiDeployError.HEALTH_CHECK_FAILED,
@@ -1220,14 +1512,23 @@ function createDockerSshProvider(config, localRuntimePref = "auto") {
       status: "ready",
       provider: "docker-ssh",
       healthCheck: "passed",
-      envVarsSet: Object.keys(env)
+      envVarsSet: Object.keys(env),
+      bundlePath: bundle.bundlePath
     };
-    logger7.info("docker-ssh deployment complete", { url, deploymentId });
+    logger5.info("docker-ssh deployment complete", { url, deploymentId });
     return ok(result);
   };
-  return { name: "docker-ssh", deploy: deploy2 };
+  const deploySafely = async (context) => {
+    try {
+      return await deploy2(context);
+    } catch (error) {
+      logger5.error("Deployment bundle failed", { error });
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"), error);
+    }
+  };
+  return { name: "docker-ssh", deploy: deploySafely };
 }
-var logger8 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
+var logger6 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
 var VERCEL_API = "https://api.vercel.com";
 var POLL_INTERVAL = 3e3;
 var MAX_POLL_ATTEMPTS = 60;
@@ -1280,7 +1581,7 @@ function createVercelProvider() {
   return {
     name: "vercel",
     async authenticate(apiToken) {
-      logger8.debug("Authenticating with Vercel");
+      logger6.debug("Authenticating with Vercel");
       try {
         const user = await vercelFetch(
           apiToken,
@@ -1288,10 +1589,10 @@ function createVercelProvider() {
         );
         token = apiToken;
         const username = user.user.username || user.user.email;
-        logger8.info("Vercel authenticated", { user: username });
+        logger6.info("Vercel authenticated", { user: username });
         return ok(username);
       } catch (error) {
-        logger8.error("Vercel authentication failed", { error });
+        logger6.error("Vercel authentication failed", { error });
         return err(toDeployError(HaiDeployError.AUTH_FAILED, "deploy_authFailed", error));
       }
     },
@@ -1302,11 +1603,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Creating Vercel project", { projectName });
+      logger6.debug("Creating Vercel project", { projectName });
       try {
         const existingId = await findExistingProject(token, projectName);
         if (existingId !== null) {
-          logger8.info("Vercel project found", { projectName, projectId: existingId });
+          logger6.info("Vercel project found", { projectName, projectId: existingId });
           return ok(existingId);
         }
         try {
@@ -1321,13 +1622,13 @@ function createVercelProvider() {
               })
             }
           );
-          logger8.info("Vercel project created", { projectName, projectId: project.id });
+          logger6.info("Vercel project created", { projectName, projectId: project.id });
           return ok(project.id);
         } catch (error) {
           if (error instanceof VercelApiError && error.status === 409) {
             const concurrentProjectId = await findExistingProject(token, projectName);
             if (concurrentProjectId !== null) {
-              logger8.info("Vercel project reused after create conflict", {
+              logger6.info("Vercel project reused after create conflict", {
                 projectName,
                 projectId: concurrentProjectId
               });
@@ -1337,7 +1638,7 @@ function createVercelProvider() {
           throw error;
         }
       } catch (error) {
-        logger8.error("Vercel project creation failed", { projectName, error });
+        logger6.error("Vercel project creation failed", { projectName, error });
         return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error));
       }
     },
@@ -1348,7 +1649,7 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
+      logger6.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
       try {
         const envEntries = Object.entries(envVars).map(([key, value]) => ({
           key,
@@ -1364,10 +1665,10 @@ function createVercelProvider() {
             body: JSON.stringify(envEntries)
           }
         );
-        logger8.info("Vercel env vars set", { projectId, count: envEntries.length });
+        logger6.info("Vercel env vars set", { projectId, count: envEntries.length });
         return ok(void 0);
       } catch (error) {
-        logger8.error("Vercel env vars setup failed", { projectId, error });
+        logger6.error("Vercel env vars setup failed", { projectId, error });
         return err(toDeployError(HaiDeployError.ENV_VAR_FAILED, "deploy_envVarFailed", error));
       }
     },
@@ -1378,8 +1679,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Deploying to Vercel", { projectId, outputDir });
+      logger6.debug("Deploying to Vercel", { projectId, outputDir });
       try {
+        const outputConfig = JSON.parse(readFileSync(join(outputDir, "config.json"), "utf8"));
+        if (outputConfig.version !== 3)
+          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
         const filePaths = collectFiles(outputDir, outputDir);
         const files = [];
         for (const filePath of filePaths) {
@@ -1388,18 +1692,20 @@ function createVercelProvider() {
           const sha = createHash("sha1").update(content).digest("hex");
           const size = statSync(fullPath).size;
           await uploadFile(token, content, sha);
-          files.push({ file: filePath, sha, size });
+          files.push({ file: `.vercel/output/${filePath}`, sha, size });
         }
-        logger8.debug("Files uploaded", { count: files.length });
+        logger6.debug("Files uploaded", { count: files.length });
         const deployment = await vercelFetch(
           token,
-          "/v13/deployments",
+          "/v13/deployments?prebuilt=1",
           {
             method: "POST",
             body: JSON.stringify({
               name: projectId,
               files,
-              projectSettings: { framework: "sveltekit" }
+              version: 2,
+              project: projectId,
+              projectSettings: { framework: null, buildCommand: "", installCommand: "" }
             })
           }
         );
@@ -1410,14 +1716,14 @@ function createVercelProvider() {
           status: finalStatus,
           envVarsSet: []
         };
-        logger8.info("Vercel deployment complete", {
+        logger6.info("Vercel deployment complete", {
           deploymentId: deployment.id,
           url: result.url,
           status: finalStatus
         });
         return ok(result);
       } catch (error) {
-        logger8.error("Vercel deployment failed", { projectId, error });
+        logger6.error("Vercel deployment failed", { projectId, error });
         return err(toDeployError(HaiDeployError.UPLOAD_FAILED, "deploy_uploadFailed", error));
       }
     }
@@ -1462,11 +1768,11 @@ async function pollDeploymentStatus(token, deploymentId) {
     if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
       return "error";
     }
-    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL));
+    await new Promise((resolve6) => setTimeout(resolve6, POLL_INTERVAL));
   }
   return "building";
 }
-var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
+var logger7 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
 function createAliyunProvisioner() {
   let accessKey = null;
   let secretKey = null;
@@ -1475,7 +1781,7 @@ function createAliyunProvisioner() {
     name: "aliyun",
     serviceType: "sms",
     async authenticate(credentials) {
-      logger9.debug("Authenticating with Aliyun");
+      logger7.debug("Authenticating with Aliyun");
       try {
         const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
         const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
@@ -1485,10 +1791,10 @@ function createAliyunProvisioner() {
         accessKey = akId;
         secretKey = akSecret;
         signName = credentials.signName;
-        logger9.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
         return ok(akId);
       } catch (error) {
-        logger9.error("Aliyun authentication failed", { error });
+        logger7.error("Aliyun authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1505,7 +1811,7 @@ function createAliyunProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger9.debug("Provisioning Aliyun SMS service");
+      logger7.debug("Provisioning Aliyun SMS service");
       return ok({
         serviceType: "sms",
         provisionerName: "aliyun",
@@ -1518,7 +1824,7 @@ function createAliyunProvisioner() {
     }
   };
 }
-var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
+var logger8 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
 var NEON_API = "https://console.neon.tech/api/v2";
 var DEFAULT_NEON_DATABASE_NAME = "neondb";
 var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
@@ -1577,7 +1883,7 @@ function createNeonProvisioner() {
     name: "neon",
     serviceType: "db",
     async authenticate(credentials) {
-      logger10.debug("Authenticating with Neon");
+      logger8.debug("Authenticating with Neon");
       try {
         const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
         if (!apiToken) {
@@ -1585,10 +1891,10 @@ function createNeonProvisioner() {
         }
         await listNeonProjects(apiToken);
         token = apiToken;
-        logger10.info("Neon authenticated");
+        logger8.info("Neon authenticated");
         return ok("neon-user");
       } catch (error) {
-        logger10.error("Neon authentication failed", { error });
+        logger8.error("Neon authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1605,7 +1911,7 @@ function createNeonProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger10.debug("Provisioning Neon database", { appName });
+      logger8.debug("Provisioning Neon database", { appName });
       let resource;
       try {
         const projectName = `${appName}-db`;
@@ -1613,7 +1919,7 @@ function createNeonProvisioner() {
         if (existingProject !== null) {
           resource = { resourceInfo: `neon-project:${existingProject.id}`, resourceStatus: "reused" };
           const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
-          logger10.info("Neon project reused", {
+          logger8.info("Neon project reused", {
             projectId: existingProject.id,
             projectName
           });
@@ -1635,10 +1941,10 @@ function createNeonProvisioner() {
         if (!projectId || !connectionUri) {
           throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
         }
-        logger10.info("Neon database provisioned", { projectId });
+        logger8.info("Neon database provisioned", { projectId });
         return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
       } catch (error) {
-        logger10.error("Neon provisioning failed", { appName });
+        logger8.error("Neon provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -1660,7 +1966,7 @@ function createNeonProvisioner() {
     }
   };
 }
-var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
+var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
 var CF_API = "https://api.cloudflare.com/client/v4";
 function createR2Provisioner() {
   let token = null;
@@ -1671,7 +1977,7 @@ function createR2Provisioner() {
     name: "r2",
     serviceType: "storage",
     async authenticate(credentials) {
-      logger11.debug("Authenticating with Cloudflare");
+      logger9.debug("Authenticating with Cloudflare");
       try {
         const acctId = credentials.accountId ?? credentials.account_id ?? "";
         const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
@@ -1688,10 +1994,10 @@ function createR2Provisioner() {
         token = apiTok;
         accessKey = credentials.accessKeyId;
         secretKey = credentials.secretAccessKey;
-        logger11.info("Cloudflare R2 authenticated", { accountId: acctId });
+        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
         return ok(acctId);
       } catch (error) {
-        logger11.error("Cloudflare R2 authentication failed", { error });
+        logger9.error("Cloudflare R2 authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1709,7 +2015,7 @@ function createR2Provisioner() {
         );
       }
       const bucketName = `${appName}-storage`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      logger11.debug("Provisioning R2 bucket", { appName, bucketName });
+      logger9.debug("Provisioning R2 bucket", { appName, bucketName });
       try {
         const createRes = await fetch(
           `${CF_API}/accounts/${accountId}/r2/buckets`,
@@ -1725,7 +2031,7 @@ function createR2Provisioner() {
         if (!createRes.ok && createRes.status !== 409) {
           throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
         }
-        logger11.info("R2 bucket provisioned", { bucketName });
+        logger9.info("R2 bucket provisioned", { bucketName });
         return ok({
           serviceType: "storage",
           provisionerName: "r2",
@@ -1743,7 +2049,7 @@ function createR2Provisioner() {
           resourceInfo: `r2-bucket:${bucketName}`
         });
       } catch (error) {
-        logger11.error("R2 provisioning failed", { appName, error });
+        logger9.error("R2 provisioning failed", { appName, error });
         return err(
           HaiDeployError.PROVISION_FAILED,
           deployM("deploy_provisionFailed", {
@@ -1758,7 +2064,7 @@ function createR2Provisioner() {
     }
   };
 }
-var logger12 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
+var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
 var RESEND_API = "https://api.resend.com";
 function createResendProvisioner() {
   let token = null;
@@ -1767,7 +2073,7 @@ function createResendProvisioner() {
     name: "resend",
     serviceType: "email",
     async authenticate(credentials) {
-      logger12.debug("Authenticating with Resend");
+      logger10.debug("Authenticating with Resend");
       try {
         const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
         if (!apiToken || !credentials.from) {
@@ -1781,10 +2087,10 @@ function createResendProvisioner() {
         }
         token = apiToken;
         from = credentials.from;
-        logger12.info("Resend authenticated");
+        logger10.info("Resend authenticated");
         return ok("resend-user");
       } catch (error) {
-        logger12.error("Resend authentication failed", { error });
+        logger10.error("Resend authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1801,7 +2107,7 @@ function createResendProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger12.debug("Provisioning Resend email service");
+      logger10.debug("Provisioning Resend email service");
       return ok({
         serviceType: "email",
         provisionerName: "resend",
@@ -1814,7 +2120,7 @@ function createResendProvisioner() {
     }
   };
 }
-var logger13 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
+var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
 var UPSTASH_API = "https://api.upstash.com";
 function createUpstashAuthHeader(email, apiKey) {
   return `Basic ${Buffer.from(`${email}:${apiKey}`).toString("base64")}`;
@@ -1865,7 +2171,7 @@ function createUpstashProvisioner() {
     name: "upstash",
     serviceType: "cache",
     async authenticate(credentials) {
-      logger13.debug("Authenticating with Upstash");
+      logger11.debug("Authenticating with Upstash");
       try {
         const userEmail = credentials.email ?? "";
         const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
@@ -1875,10 +2181,10 @@ function createUpstashProvisioner() {
         await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
         apiKey = userKey;
-        logger13.info("Upstash authenticated", { email: userEmail });
+        logger11.info("Upstash authenticated", { email: userEmail });
         return ok(userEmail);
       } catch (error) {
-        logger13.error("Upstash authentication failed", { error });
+        logger11.error("Upstash authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1895,7 +2201,7 @@ function createUpstashProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger13.debug("Provisioning Upstash Redis", { appName });
+      logger11.debug("Provisioning Upstash Redis", { appName });
       let resource;
       try {
         const databaseName = `${appName}-cache`;
@@ -1907,7 +2213,7 @@ function createUpstashProvisioner() {
           }
           resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
           const detail = await getUpstashDatabase(email, apiKey, databaseId);
-          logger13.info("Upstash Redis reused", { databaseId, databaseName });
+          logger11.info("Upstash Redis reused", { databaseId, databaseName });
           return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
         }
         const data = await upstashFetch(email, apiKey, "/v2/redis/database", {
@@ -1920,10 +2226,10 @@ function createUpstashProvisioner() {
         });
         if (data.database_id)
           resource = { resourceInfo: `upstash-db:${data.database_id}`, resourceStatus: "created" };
-        logger13.info("Upstash Redis provisioned", { databaseId: data.database_id });
+        logger11.info("Upstash Redis provisioned", { databaseId: data.database_id });
         return ok(buildUpstashProvisionResult(data, "created"));
       } catch (error) {
-        logger13.error("Upstash provisioning failed", { appName });
+        logger11.error("Upstash provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -1947,7 +2253,7 @@ function createUpstashProvisioner() {
 }
 
 // src/deploy-main.ts
-var logger14 = core.logger.child({ module: "deploy", scope: "main" });
+var logger12 = core.logger.child({ module: "deploy", scope: "main" });
 var currentConfig = null;
 var currentProvider = null;
 var currentContainerProvider = null;
@@ -2000,15 +2306,31 @@ function normalizeProjectName(name) {
   const normalized = name.replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   return normalized || "app";
 }
-function mergeProvisionEnv(results) {
+function mergeProvisionEnv(results, scan, options) {
   let env = {};
-  const reachProviders = [];
+  const reachRequirements = scan?.middlewares?.filter((item) => item.configName === "reach") ?? [];
+  const reachProviders = reachRequirements.map((item) => item.config);
+  let hasReachOutput = false;
   for (const prov of results) {
-    if (prov.envVars.HAI_REACH_PROVIDERS)
-      reachProviders.push(...JSON.parse(prov.envVars.HAI_REACH_PROVIDERS));
+    if (prov.envVars.HAI_REACH_PROVIDERS) {
+      hasReachOutput = true;
+      const supplied = JSON.parse(prov.envVars.HAI_REACH_PROVIDERS);
+      for (const provider of supplied) {
+        const targets = reachRequirements.filter((item) => {
+          const mode = options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[item.service];
+          return item.service === prov.serviceType && (!mode || mode === "default");
+        });
+        if (targets.length) {
+          for (const target of targets)
+            reachProviders[reachRequirements.indexOf(target)] = { ...provider, name: target.config.name ?? provider.name };
+        } else {
+          reachProviders.push(provider);
+        }
+      }
+    }
     env = { ...env, ...prov.envVars };
   }
-  if (reachProviders.length > 0)
+  if (hasReachOutput)
     env.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
   return env;
 }
@@ -2016,7 +2338,7 @@ var deploy = {
   credentials: deployCredentials,
   async init(config) {
     if (initInProgress) {
-      logger14.warn("Deploy init already in progress, skipping concurrent call");
+      logger12.warn("Deploy init already in progress, skipping concurrent call");
       return err(
         HaiDeployError.CONFIG_ERROR,
         deployM("deploy_configError", { params: { error: "init already in progress" } })
@@ -2025,13 +2347,13 @@ var deploy = {
     initInProgress = true;
     try {
       if (currentProvider || currentContainerProvider) {
-        logger14.warn("Deploy module is already initialized, reinitializing");
+        logger12.warn("Deploy module is already initialized, reinitializing");
         await deploy.close();
       }
-      logger14.info("Initializing deploy module");
+      logger12.info("Initializing deploy module");
       const parseResult = DeployConfigSchema.safeParse(config);
       if (!parseResult.success) {
-        logger14.error("Deploy config validation failed", { error: parseResult.error.message });
+        logger12.error("Deploy config validation failed", { error: parseResult.error.message });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", { params: { error: parseResult.error.message } }),
@@ -2043,15 +2365,15 @@ var deploy = {
         let provider = null;
         let containerProvider = null;
         if (parsed.provider.type === "docker-ssh") {
-          containerProvider = createDockerSshProvider(parsed.provider, parsed.container?.runtime);
-          logger14.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh.host });
+          containerProvider = createDockerSshProvider(parsed.provider, parsed.container);
+          logger12.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh?.host });
         } else {
           provider = createProviderByType(parsed.provider.type);
           const authResult = await provider.authenticate(parsed.provider.token);
           if (!authResult.success) {
             return err(authResult.error);
           }
-          logger14.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
+          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         }
         currentProvisioners.clear();
         if (parsed.services) {
@@ -2063,14 +2385,14 @@ var deploy = {
             const credentials = extractCredentials(serviceConfig);
             const provAuthResult = await provisioner.authenticate(credentials);
             if (!provAuthResult.success) {
-              logger14.error("Provisioner authentication failed", {
+              logger12.error("Provisioner authentication failed", {
                 service: serviceType,
                 provisioner: serviceConfig.provisioner
               });
               currentProvisioners.clear();
               return err(provAuthResult.error);
             }
-            logger14.info("Provisioner authenticated", {
+            logger12.info("Provisioner authenticated", {
               service: serviceType,
               user: provAuthResult.data
             });
@@ -2080,7 +2402,7 @@ var deploy = {
         currentProvider = provider;
         currentContainerProvider = containerProvider;
         currentConfig = parsed;
-        logger14.info("Deploy module initialized", {
+        logger12.info("Deploy module initialized", {
           provider: parsed.provider.type,
           provisioners: [...currentProvisioners.keys()]
         });
@@ -2090,7 +2412,7 @@ var deploy = {
         currentContainerProvider = null;
         currentConfig = null;
         currentProvisioners.clear();
-        logger14.error("Deploy module initialization failed", { error });
+        logger12.error("Deploy module initialization failed", { error });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", {
@@ -2105,15 +2427,15 @@ var deploy = {
   },
   async close() {
     if (!currentProvider && !currentContainerProvider) {
-      logger14.info("Deploy module already closed, skipping");
+      logger12.info("Deploy module already closed, skipping");
       return;
     }
-    logger14.info("Closing deploy module");
+    logger12.info("Closing deploy module");
     currentProvider = null;
     currentContainerProvider = null;
     currentConfig = null;
     currentProvisioners.clear();
-    logger14.info("Deploy module closed");
+    logger12.info("Deploy module closed");
   },
   get config() {
     return currentConfig;
@@ -2121,21 +2443,23 @@ var deploy = {
   get isInitialized() {
     return currentProvider !== null || currentContainerProvider !== null;
   },
-  async scan(appDir) {
-    logger14.debug("Scanning application", { appDir });
-    return scanApp(appDir);
+  async scan(appDir, options) {
+    logger12.debug("Scanning application", { appDir });
+    return scanApp(appDir, options);
   },
-  async provisionAll(projectName) {
+  async provisionAll(projectName, services) {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Provisioning all services", { projectName, count: currentProvisioners.size });
+    logger12.info("Provisioning all services", { projectName, count: currentProvisioners.size });
     const results = [];
     for (const [serviceType, provisioner] of currentProvisioners) {
-      logger14.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
+      if (services && !services.includes(serviceType))
+        continue;
+      logger12.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
       const provResult = await provisioner.provision(projectName);
       if (!provResult.success) {
-        logger14.error("Service provisioning failed", {
+        logger12.error("Service provisioning failed", {
           serviceType,
           provisioner: provisioner.name,
           code: provResult.error.code
@@ -2152,7 +2476,7 @@ var deploy = {
         });
       }
       results.push(provResult.data);
-      logger14.info("Service provisioned", { serviceType, provisioner: provisioner.name });
+      logger12.info("Service provisioned", { serviceType, provisioner: provisioner.name });
     }
     return ok(results);
   },
@@ -2160,16 +2484,29 @@ var deploy = {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Starting deployment", { appDir, options });
-    const scanResult = await scanApp(appDir);
+    logger12.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
+    const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
+    const scanResult = await scanApp(appDir, scanOptions);
     if (!scanResult.success) {
       return err(scanResult.error);
     }
     const scan = scanResult.data;
-    const projectName = options?.projectName ?? scan.appName;
+    appDir = scan.appDir ?? appDir;
+    const environment = loadDeploymentEnvironment({ environment: scanOptions.environment ?? "prod", envDir: scan.envDir ?? appDir, requireFile: scanOptions.environment !== void 0 });
+    if (!environment.success)
+      return environment;
+    const appEnv = Object.fromEntries(Object.entries(environment.data.values).filter(([key]) => !key.startsWith("HAI_CLI_") && (!key.startsWith("HAI_DEPLOY_") || key === "HAI_DEPLOY_ENVIRONMENT")));
+    const projectName = `${options?.projectName ?? scan.appName}${scanOptions.environment ? `-${environment.data.environment}` : ""}`;
+    options = {
+      ...options,
+      ...scanOptions.environment ? { environment: environment.data.environment } : {},
+      ...options?.skipMiddleware ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
+    };
     if (currentContainerProvider) {
-      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options);
+      return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options, appEnv);
     }
+    if (options?.bundleOnly)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleOnlyContainer"));
     if (!currentProvider) {
       return notInitialized.result();
     }
@@ -2181,15 +2518,22 @@ var deploy = {
         })
       );
     }
-    let allEnvVars = {};
+    if (!existsSync(resolveOutputDir(appDir, "vercel")))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
+    let allEnvVars = appEnv;
     const recovery = { projectName, stage: "provision", resources: [] };
-    if (!options?.skipProvision) {
-      const provResults = await deploy.provisionAll(projectName);
+    if (!options?.skipMiddleware) {
+      const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
       if (!provResults.success) {
         return err(provResults.error);
       }
       recovery.resources = provResults.data.map(({ envVars: _envVars, ...resource }) => resource);
-      allEnvVars = mergeProvisionEnv(provResults.data);
+      allEnvVars = { ...allEnvVars, ...mergeProvisionEnv(provResults.data, scan, options) };
+      if (options?.environment) {
+        const saved = saveDeploymentEnvironment(environment.data, mergeProvisionEnv(provResults.data, scan, options));
+        if (!saved.success)
+          return recoveryFailure(saved.error, { ...recovery, stage: "save-env" });
+      }
     }
     const projectResult = await currentProvider.createProject(projectName);
     if (!projectResult.success) {
@@ -2203,12 +2547,6 @@ var deploy = {
         return recoveryFailure(envResult.error, { ...recovery, stage: "set-env" });
       }
     }
-    if (!options?.skipBuild) {
-      const buildResult = buildApp(appDir, scan.buildCommand, allEnvVars);
-      if (!buildResult.success) {
-        return recoveryFailure(buildResult.error, { ...recovery, stage: "build" });
-      }
-    }
     const outputDir = resolveOutputDir(appDir, currentConfig?.provider.type ?? "vercel");
     const deployResult = await currentProvider.deploy(projectId, outputDir);
     if (!deployResult.success) {
@@ -2218,7 +2556,7 @@ var deploy = {
       ...deployResult.data,
       envVarsSet: Object.keys(allEnvVars)
     };
-    logger14.info("Deployment completed", {
+    logger12.info("Deployment completed", {
       url: result.url,
       deploymentId: result.deploymentId,
       status: result.status
@@ -2226,25 +2564,79 @@ var deploy = {
     return ok(result);
   }
 };
-async function deployContainerApp(provider, appDir, scan, rawProjectName, options) {
+async function deployContainerApp(provider, appDir, scan, rawProjectName, options, appEnv = {}) {
   const projectName = normalizeProjectName(rawProjectName);
-  if (scan.isSvelteKit && !scan.nodeAdapterInstalled) {
-    return err(
-      HaiDeployError.ADAPTER_MISSING,
-      deployM("deploy_adapterMissing", { params: { adapter: "@sveltejs/adapter-node" } })
-    );
+  let artifact;
+  let artifactDir = options?.artifactDir ?? resolveArtifactDirectory(appDir);
+  try {
+    if (existsSync(join(artifactDir, "latest"))) {
+      const latest = readFileSync(join(artifactDir, "latest"), "utf8").trim();
+      if (!/^[a-z0-9][\w.+-]*$/i.test(latest))
+        throw new Error("Invalid artifact pointer");
+      artifactDir = join(artifactDir, latest);
+    }
+    artifact = await readDeploymentArtifact(artifactDir);
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
   }
+  if (!options?.bundleOnly && currentConfig?.provider.type === "docker-ssh" && !currentConfig.provider.ssh)
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
   let provisionEnv = {};
-  if (!options?.skipProvision) {
-    const provResults = await deploy.provisionAll(projectName);
+  if (!options?.skipMiddleware) {
+    const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
     if (!provResults.success) {
       return err(provResults.error);
     }
-    provisionEnv = mergeProvisionEnv(provResults.data);
+    provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
   }
-  return provider.deploy({ appDir, projectName, scan, provisionEnv });
+  return provider.deploy({ appDir, artifact, artifactDir, projectName, scan, provisionEnv, appEnv, options });
+}
+
+// src/deploy-middleware.ts
+var field = (name, defaultValue, kind, secret = false) => ({ name, defaultValue, kind, secret });
+var required = (name, defaultValue, kind) => ({ ...field(name, defaultValue, kind), required: true });
+var DEPLOY_MIDDLEWARE = {
+  db: [
+    { backend: "sqlite", label: "SQLite", purpose: "deploy_purposeSqlite", fields: [required("database", "./data/app.db")] },
+    ...["postgresql", "mysql"].map((backend) => ({
+      backend,
+      label: backend === "mysql" ? "MySQL" : "PostgreSQL",
+      purpose: "deploy_purposeDatabase",
+      provisioner: backend === "postgresql" ? "neon" : void 0,
+      fields: [field("url", "", "url", true), required("host", "localhost"), required("port", backend === "mysql" ? "3306" : "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true), field("ssl", "false")]
+    }))
+  ],
+  cache: [
+    { backend: "memory", label: "Memory", purpose: "deploy_purposeMemory", fields: [] },
+    { backend: "redis", label: "Redis", purpose: "deploy_purposeCache", provisioner: "upstash", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "6379", "port"), field("password", "", void 0, true), { ...field("db", "0", "number"), maximum: 15 }, field("tls", "false", "boolean"), field("keyPrefix"), field("connectTimeout", "10000", "number"), field("commandTimeout", "5000", "number")] }
+  ],
+  storage: [
+    { backend: "local", label: "Local filesystem", purpose: "deploy_purposeLocal", fields: [required("root", "./data/storage")] },
+    { backend: "s3", label: "S3 / RustFS / MinIO / Cloudflare R2", purpose: "deploy_purposeStorage", provisioner: "cloudflare-r2", fields: [field("endpoint", "", "url"), required("bucket", "hai"), required("region", "us-east-1"), required("accessKeyId"), { ...required("secretAccessKey"), secret: true }, field("forcePathStyle", "true", "boolean")] }
+  ],
+  vecdb: [
+    { backend: "lancedb", label: "LanceDB", purpose: "deploy_purposeLocal", fields: [required("path", "./data/vectors")] },
+    { backend: "qdrant", label: "Qdrant", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:6333", "url"), field("apiKey", "", void 0, true)] },
+    { backend: "pgvector", label: "PostgreSQL / pgvector", purpose: "deploy_purposeVector", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true)] },
+    { backend: "chroma", label: "Chroma", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:8000", "url")] }
+  ],
+  ldap: [
+    { backend: "disabled", label: "Disabled", purpose: "deploy_purposeDisabled", fields: [] },
+    { backend: "ldap", label: "LDAP / OpenLDAP", purpose: "deploy_purposeLdap", fields: [required("url", "ldap://localhost:389", "url"), required("bindDn", "cn=admin,dc=example,dc=org"), { ...required("bindPassword"), secret: true }, required("searchBase", "dc=example,dc=org"), field("searchFilter", "(uid={{username}})"), field("usernameAttribute", "uid"), field("emailAttribute", "mail"), field("displayNameAttribute", "cn"), field("useTls", "false", "boolean"), { ...field("connectTimeout", "5000", "number"), minimum: 1e3 }] }
+  ],
+  email: [
+    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
+    { backend: "smtp", label: "SMTP", purpose: "deploy_purposeEmail", provisioner: "resend", fields: [required("host", "localhost"), required("port", "465", "port"), field("secure", "true", "boolean"), field("user"), field("pass", "", void 0, true), required("from", "noreply@example.com")] },
+    { backend: "api", label: "HTTP notification API", purpose: "deploy_purposeEmail", fields: [required("url", "", "url"), field("method", "POST"), field("headers"), field("timeout", "10000", "number")] }
+  ],
+  sms: [
+    { backend: "aliyun-sms", label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", fields: [required("accessKeyId"), { ...required("accessKeySecret"), secret: true }, required("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] }
+  ]
+};
+function describeMiddlewareBackend(backend) {
+  return deployM(backend.purpose);
 }
 
-export { DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, getDeployRecovery };
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map