@h-ai/deploy 0.1.0-alpha.65 → 0.1.0-alpha.66

package/dist/index.js

@@ -1,16 +1,52 @@
+import { createHash, randomBytes } from 'crypto';
+import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, rmSync, statSync, readdirSync } from 'fs';
+import { resolve, join, basename, dirname, relative, sep } from 'path';
 import { z } from 'zod';
 import { core, ok, err } from '@h-ai/core';
-import { readFileSync, existsSync, writeFileSync, chmodSync, mkdirSync, statSync, readdirSync } from 'fs';
-import { resolve, join, basename, dirname, relative, sep } from 'path';
 import process2 from 'process';
 import { parseEnv } from 'util';
 import { parse, stringify, parseAllDocuments } from 'yaml';
 import { homedir } from 'os';
-import { execSync, spawn } from 'child_process';
-import { randomBytes, createHash } from 'crypto';
+import { spawn } from 'child_process';
 import { Buffer } from 'buffer';
 
-// src/deploy-config.ts
+// src/deploy-artifact.ts
+var DeploymentArtifactSchema = z.object({
+  /** 清单格式版本，与应用版本和部署环境无关。 */
+  version: z.literal(2),
+  /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
+  appVersion: z.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
+  /** 一次完整构建的标识，app/web 必须来自同一份清单。 */
+  buildId: z.string().regex(/^[a-z0-9][\w.+-]*$/i),
+  /** API/独立应用和可选 Web 的镜像归档，至少包含一个 app。 */
+  images: z.array(z.object({
+    /** app 为服务或独立应用，web 为同源 API 代理的静态前端。 */
+    name: z.enum(["app", "web"]),
+    /** 相对于清单目录的 tar 文件名。 */
+    file: z.string().regex(/^[\w.+-]+\.tar$/),
+    /** 归档导入后可直接使用的不可变镜像引用。 */
+    imageRef: z.string().regex(/^[a-z0-9][a-z0-9./:_-]+$/),
+    /** tar 内容的 SHA-256，用于部署前校验。 */
+    sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    /** 容器内部监听端口；服务器公开端口由部署选择。 */
+    containerPort: z.number().int().min(1).max(65535).optional()
+  })).min(1).max(2).refine((images) => images.filter((image) => image.name === "app").length === 1 && new Set(images.map((image) => image.name)).size === images.length)
+}).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`));
+async function artifactChecksum(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file))
+    hash.update(chunk);
+  return hash.digest("hex");
+}
+async function readDeploymentArtifact(directory) {
+  const artifact = DeploymentArtifactSchema.parse(JSON.parse(readFileSync(resolve(directory, "manifest.json"), "utf8")));
+  for (const image of artifact.images) {
+    const file = resolve(directory, image.file);
+    if (!existsSync(file) || !lstatSync(file).isFile() || lstatSync(file).isSymbolicLink() || await artifactChecksum(file) !== image.sha256)
+      throw new Error(`Invalid artifact: ${image.file}`);
+  }
+  return artifact;
+}
 
 // messages/en-US.json
 var en_US_default = {
@@ -22,7 +58,6 @@ var en_US_default = {
   deploy_authRequired: "Authentication required",
   deploy_authFailed: "Authentication failed: {error}",
   deploy_projectCreateFailed: "Project creation failed: {error}",
-  deploy_buildFailed: "Application build failed: {error}",
   deploy_uploadFailed: "Build output upload failed: {error}",
   deploy_deployFailed: "Deployment failed: {error}",
   deploy_provisionFailed: "Service provisioning failed: {service} - {error}",
@@ -42,8 +77,6 @@ var en_US_default = {
   deploy_recoverySuggestion: "Inspect listed resources in the provider console before retrying with the same project name. Unknown means the request may have created a resource. Reused resources are never deleted automatically; remove newly created resources manually only after checking their use.",
   deploy_commandTimeout: "Command timed out: {command}",
   deploy_commandFailed: "Command failed ({command}): {error}",
-  deploy_containerRuntimeNotFound: "No usable container runtime found: {runtime}",
-  deploy_containerBuildFailed: "Container image build failed: {error}",
   deploy_remoteConnectFailed: "Cannot connect to remote host {host}: {error}",
   deploy_remoteRuntimeMissing: "Remote host missing container runtime or compose: {runtime}",
   deploy_imageTransferFailed: "Image transfer failed: {error}",
@@ -64,7 +97,13 @@ var en_US_default = {
   deploy_purposeLdap: "Directory account authentication; the default directory has no business users",
   deploy_purposeConsole: "Messages go to application logs without delivery",
   deploy_purposeEmail: "Email/HTTP delivery; the default SMTP container only captures test messages",
-  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota"
+  deploy_purposeSms: "SMS through Aliyun credentials; requires an existing signature and quota",
+  deploy_webProxyInvalid: "The API prefix must be an absolute path containing only letters, numbers, underscores, hyphens and slashes.",
+  deploy_artifactInvalid: "Build artifacts are missing, corrupt, or could not be packaged. Run pnpm build --target docker at the project root and point --artifact-dir to a complete build directory.",
+  deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
+  deploy_bundleInstructions: "This bundle contains private configuration. Transfer it securely and restrict access.\n1. Copy {file} to Linux using removable media, a private network or scp.\n2. Install Docker/Podman with compose, tar, sha256sum and sh. Load middleware images using docker load/podman load with the exact tags below.\n3. Create a private release directory: mkdir -p release && chmod 700 release\n4. From the bundle directory run tar -xf {file} -C release\n5. Run cd release && sh {start}. Set HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME=docker or podman to select the runtime explicitly.\n6. Check docker compose -f {compose} --env-file .env.runtime ps (or logs; use podman instead of docker for Podman), Web and /health after startup. Bundle generation does not perform server health checks.\nRequired images (app/web are included; prepare middleware separately):\n{images}\nBuilt images can be reused across environments; this bundle contains configuration for the selected environment only.",
+  deploy_bundleMetadata: "Application version: {version}\nBuild ID: {buildId}\nCompose file: {compose}",
+  deploy_bundleOnlyContainer: "Compose bundle generation is supported only by docker-ssh."
 };
 
 // messages/zh-CN.json
@@ -77,7 +116,6 @@ var zh_CN_default = {
   deploy_authRequired: "\u8BF7\u5148\u5B8C\u6210\u8BA4\u8BC1",
   deploy_authFailed: "\u8BA4\u8BC1\u5931\u8D25\uFF1A{error}",
   deploy_projectCreateFailed: "\u9879\u76EE\u521B\u5EFA\u5931\u8D25\uFF1A{error}",
-  deploy_buildFailed: "\u5E94\u7528\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
   deploy_uploadFailed: "\u6784\u5EFA\u4EA7\u7269\u4E0A\u4F20\u5931\u8D25\uFF1A{error}",
   deploy_deployFailed: "\u90E8\u7F72\u5931\u8D25\uFF1A{error}",
   deploy_provisionFailed: "\u57FA\u7840\u8BBE\u65BD\u5F00\u901A\u5931\u8D25\uFF1A{service} - {error}",
@@ -97,8 +135,6 @@ var zh_CN_default = {
   deploy_recoverySuggestion: "\u91CD\u8BD5\u524D\u5728\u670D\u52A1\u5546\u63A7\u5236\u53F0\u6838\u5BF9\u6E05\u5355\uFF0C\u5E76\u4F7F\u7528\u76F8\u540C\u9879\u76EE\u540D\u3002unknown \u8868\u793A\u8BF7\u6C42\u53EF\u80FD\u5DF2\u521B\u5EFA\u8D44\u6E90\u3002\u590D\u7528\u8D44\u6E90\u4E0D\u4F1A\u81EA\u52A8\u5220\u9664\uFF1B\u65B0\u5EFA\u8D44\u6E90\u4EC5\u5728\u786E\u8BA4\u672A\u88AB\u4F7F\u7528\u540E\u4EBA\u5DE5\u6E05\u7406\u3002",
   deploy_commandTimeout: "\u547D\u4EE4\u6267\u884C\u8D85\u65F6\uFF1A{command}",
   deploy_commandFailed: "\u547D\u4EE4\u6267\u884C\u5931\u8D25\uFF08{command}\uFF09\uFF1A{error}",
-  deploy_containerRuntimeNotFound: "\u672A\u627E\u5230\u53EF\u7528\u7684\u5BB9\u5668\u8FD0\u884C\u65F6\uFF1A{runtime}",
-  deploy_containerBuildFailed: "\u5BB9\u5668\u955C\u50CF\u6784\u5EFA\u5931\u8D25\uFF1A{error}",
   deploy_remoteConnectFailed: "\u65E0\u6CD5\u8FDE\u63A5\u8FDC\u7A0B\u4E3B\u673A {host}\uFF1A{error}",
   deploy_remoteRuntimeMissing: "\u8FDC\u7A0B\u4E3B\u673A\u7F3A\u5C11\u5BB9\u5668\u8FD0\u884C\u65F6\u6216 compose\uFF1A{runtime}",
   deploy_imageTransferFailed: "\u955C\u50CF\u4F20\u8F93\u5931\u8D25\uFF1A{error}",
@@ -119,7 +155,13 @@ var zh_CN_default = {
   deploy_purposeLdap: "\u4F01\u4E1A\u76EE\u5F55\u8D26\u53F7\u8BA4\u8BC1\uFF1B\u9ED8\u8BA4\u76EE\u5F55\u4E0D\u5305\u542B\u4E1A\u52A1\u7528\u6237",
   deploy_purposeConsole: "\u6D88\u606F\u8F93\u51FA\u5230\u5E94\u7528\u65E5\u5FD7\uFF0C\u4E0D\u5B9E\u9645\u6295\u9012",
   deploy_purposeEmail: "\u90AE\u4EF6\u6216 HTTP \u901A\u77E5\u6295\u9012\uFF1B\u9ED8\u8BA4 SMTP \u5BB9\u5668\u4EC5\u7528\u4E8E\u6D4B\u8BD5\u63A5\u6536",
-  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6"
+  deploy_purposeSms: "\u901A\u8FC7\u963F\u91CC\u4E91\u51ED\u8BC1\u63A5\u5165\u77ED\u4FE1\u670D\u52A1\uFF0C\u9700\u5DF2\u6709\u7B7E\u540D\u4E0E\u989D\u5EA6",
+  deploy_webProxyInvalid: "API \u524D\u7F00\u5FC5\u987B\u662F\u4EC5\u542B\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u8FDE\u5B57\u7B26\u548C\u659C\u6760\u7684\u7EDD\u5BF9\u8DEF\u5F84\u3002",
+  deploy_artifactInvalid: "\u6784\u5EFA\u4EA7\u7269\u7F3A\u5931\u3001\u635F\u574F\u6216\u90E8\u7F72\u6253\u5305\u5931\u8D25\u3002\u8BF7\u5148\u5728\u5DE5\u7A0B\u6839\u8FD0\u884C pnpm build --target docker\uFF0C\u5E76\u68C0\u67E5 --artifact-dir \u6307\u5411\u5B8C\u6574\u7684\u6784\u5EFA\u76EE\u5F55\u3002",
+  deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
+  deploy_bundleInstructions: "\u6B64\u5305\u5305\u542B\u79C1\u6709\u914D\u7F6E\uFF0C\u8BF7\u5B89\u5168\u642C\u8FD0\u5E76\u9650\u5236\u8BBF\u95EE\u6743\u9650\u3002\n1. \u5C06 {file} \u590D\u5236\u5230 Linux \u670D\u52A1\u5668\uFF08U \u76D8\u3001\u5185\u7F51\u4F20\u8F93\u6216 scp \u5747\u53EF\uFF09\u3002\n2. \u51C6\u5907 Docker/Podman\u3001\u5BF9\u5E94 compose \u547D\u4EE4\u3001tar\u3001sha256sum \u548C sh\uFF1B\u5C06\u6240\u9700\u4E2D\u95F4\u4EF6\u955C\u50CF\u7528 docker load/podman load \u5BFC\u5165\uFF0C\u955C\u50CF\u6807\u7B7E\u987B\u4E0E\u4E0B\u5217\u6E05\u5355\u5B8C\u5168\u4E00\u81F4\u3002\n3. \u65B0\u5EFA\u4EC5\u90E8\u7F72\u7528\u6237\u53EF\u8BBF\u95EE\u7684\u76EE\u5F55\uFF1Amkdir -p release && chmod 700 release\n4. \u5728\u5305\u6240\u5728\u76EE\u5F55\u6267\u884C tar -xf {file} -C release\n5. \u6267\u884C cd release && sh {start}\uFF1B\u53EF\u7528 HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME=docker \u6216 podman \u663E\u5F0F\u9009\u62E9\u8FD0\u884C\u65F6\u3002\n6. \u542F\u52A8\u540E\u7528 docker compose -f {compose} --env-file .env.runtime ps\uFF08\u6216 logs\uFF1BPodman \u5C06 docker \u6362\u4E3A podman\uFF09\u68C0\u67E5\u72B6\u6001\u5E76\u9A8C\u8BC1 Web\u3001/health\uFF1B\u4EC5\u6253\u5305\u4E0D\u4F1A\u6267\u884C\u670D\u52A1\u5668\u5065\u5EB7\u68C0\u67E5\u3002\n\u6240\u9700\u955C\u50CF\uFF08app/web \u5DF2\u542B\u5728\u5305\u4E2D\uFF0C\u4E2D\u95F4\u4EF6\u9700\u53E6\u884C\u51C6\u5907\uFF09\uFF1A\n{images}\n\u6784\u5EFA\u955C\u50CF\u53EF\u7528\u4E8E\u591A\u73AF\u5883\uFF1B\u6B64\u5305\u7684\u73AF\u5883\u914D\u7F6E\u4EC5\u7528\u4E8E\u672C\u6B21\u6240\u9009\u73AF\u5883\u3002",
+  deploy_bundleMetadata: "\u5E94\u7528\u7248\u672C\uFF1A{version}\n\u6784\u5EFA\u7F16\u53F7\uFF1A{buildId}\nCompose \u6587\u4EF6\uFF1A{compose}",
+  deploy_bundleOnlyContainer: "\u4EC5\u751F\u6210 Compose tar \u53EA\u652F\u6301 docker-ssh\u3002"
 };
 
 // src/deploy-i18n.ts
@@ -160,7 +202,7 @@ var ExposeSchema = PortExposeSchema;
 var DockerSshProviderConfigSchema = z.object({
   type: z.literal("docker-ssh"),
   /** SSH 连接参数 */
-  ssh: SshConfigSchema,
+  ssh: SshConfigSchema.optional(),
   /** 远程主机运行参数 */
   remote: z.object({
     /** 远程应用根目录 */
@@ -214,24 +256,15 @@ var DeployConfigSchema = z.object({
   environment: z.string().regex(/^[a-z0-9][\w-]*$/i).refine((value) => !["local", "example"].includes(value.toLowerCase())).optional(),
   provider: ProviderConfigSchema,
   services: ServicesConfigSchema,
-  /** 本地容器构建参数（docker-ssh 使用；auto 优先 podman） */
+  /** Docker Compose 部署参数；构建配置位于项目 hai.build.json。 */
   container: z.object({
-    runtime: z.enum(["auto", "docker", "podman"]).default("auto"),
-    /** Podman 构建是否继承代理；容器不能访问宿主机 localhost 代理时设为 false。 */
-    httpProxy: z.boolean().default(true),
     /** 自建 S3 服务实现；协议仍为 storage.type=s3。 */
-    s3Engine: z.enum(["rustfs", "minio"]).default("rustfs"),
-    /** SQLite 预编译包镜像根地址；省略时从官方 GitHub Release 下载，不允许嵌入凭据。 */
-    sqlitePrebuildMirror: z.url().refine((value) => {
-      const url = new URL(value);
-      return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
-    }).optional()
+    s3Engine: z.enum(["rustfs", "minio"]).default("rustfs")
   }).optional()
 });
 var DeployErrorInfo = {
   DEPLOY_FAILED: "001:500",
   PROJECT_CREATE_FAILED: "002:500",
-  BUILD_FAILED: "003:500",
   UPLOAD_FAILED: "004:500",
   AUTH_REQUIRED: "005:401",
   AUTH_FAILED: "006:401",
@@ -243,8 +276,6 @@ var DeployErrorInfo = {
   UNSUPPORTED_TYPE: "012:400",
   CONFIG_ERROR: "013:500",
   CREDENTIAL_ERROR: "014:500",
-  CONTAINER_RUNTIME_NOT_FOUND: "015:500",
-  CONTAINER_BUILD_FAILED: "016:500",
   REMOTE_CONNECT_FAILED: "017:500",
   REMOTE_COMMAND_FAILED: "018:500",
   IMAGE_TRANSFER_FAILED: "019:500",
@@ -253,9 +284,16 @@ var DeployErrorInfo = {
 var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
 
 // src/deploy-environment.ts
+function environmentValue(value) {
+  try {
+    return parse(value) ?? value;
+  } catch {
+    return value;
+  }
+}
 function resolveConfig(value, prefix, env) {
   if (env[prefix] !== void 0)
-    return parse(env[prefix]) ?? env[prefix];
+    return environmentValue(env[prefix]);
   if (Array.isArray(value))
     return value.map((item, index) => resolveConfig(item, `${prefix}_${index}`, env));
   if (value && typeof value === "object")
@@ -263,7 +301,7 @@ function resolveConfig(value, prefix, env) {
   if (typeof value !== "string")
     return value;
   const resolved = value.replace(/\$\{([^:}]+)(?::([^}]*))?\}/g, (_match, name, fallback) => env[name] ?? fallback ?? "");
-  return /^\$\{[^}]+\}$/.test(value) ? parse(resolved) ?? resolved : resolved;
+  return /^\$\{[^}]+\}$/.test(value) ? environmentValue(resolved) : resolved;
 }
 function loadDeploymentConfig(name, path, values) {
   try {
@@ -531,39 +569,25 @@ function saveCredentials(entries) {
     );
   }
 }
-var logger2 = core.logger.child({ module: "deploy", scope: "functions" });
+function resolveArtifactDirectory(appDir) {
+  let directory = resolve(appDir);
+  while (true) {
+    if (existsSync(join(directory, "hai.build.json")) || existsSync(join(directory, "pnpm-lock.yaml")))
+      return join(directory, ".hai/build/docker");
+    const parent = dirname(directory);
+    if (parent === directory)
+      return join(appDir, ".hai/build/docker");
+    directory = parent;
+  }
+}
 function usesDefaultMiddleware(scan, service, options) {
   const requirements = scan.middlewares?.filter((item) => item.service === service) ?? [];
   return requirements.length ? requirements.some((item) => (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.[service] ?? "default") === "default") : (options?.serviceModes?.[service] ?? "default") === "default";
 }
-function buildApp(appDir, buildCommand, envVars = {}) {
-  logger2.info("Building application", { appDir, buildCommand });
-  try {
-    execSync(buildCommand, {
-      cwd: appDir,
-      stdio: "inherit",
-      env: { ...process2.env, ...envVars }
-    });
-    return ok(void 0);
-  } catch (error) {
-    return err(
-      HaiDeployError.BUILD_FAILED,
-      deployM("deploy_buildFailed", {
-        params: { error: error instanceof Error ? error.message : String(error) }
-      }),
-      error
-    );
-  }
-}
 function resolveOutputDir(appDir, providerType) {
   switch (providerType) {
-    case "vercel": {
-      const vercelOutput = join(appDir, ".vercel", "output");
-      if (existsSync(vercelOutput)) {
-        return vercelOutput;
-      }
-      return join(appDir, "build");
-    }
+    case "vercel":
+      return join(appDir, ".vercel", "output");
     default:
       return join(appDir, "build");
   }
@@ -594,7 +618,7 @@ function recoveryFailure(error, recovery) {
     ext: { recovery }
   });
 }
-var logger3 = core.logger.child({ module: "deploy", scope: "scanner" });
+var logger2 = core.logger.child({ module: "deploy", scope: "scanner" });
 function record(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -713,15 +737,170 @@ async function scanApp(inputDir, options) {
       adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
       nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
       requiredServices: [...new Set(middlewares.map((item) => item.service))],
-      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend])),
-      buildCommand: "pnpm build"
+      serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend]))
     };
-    logger3.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
+    logger2.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
     return ok(scan);
   } catch {
     return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
   }
 }
+var logger3 = core.logger.child({ module: "deploy", scope: "command" });
+function maskSecrets(text, secrets) {
+  if (!secrets || secrets.length === 0)
+    return text;
+  let masked = text;
+  for (const secret of secrets) {
+    if (secret && secret.length > 0)
+      masked = masked.split(secret).join("***");
+  }
+  return masked;
+}
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve6) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env ? { ...process2.env, ...options.env } : process2.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let timer;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve6(result);
+    };
+    if (options.timeoutMs && options.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        child.kill("SIGKILL");
+        logger3.error("Command timed out", { command, timeoutMs: options.timeoutMs });
+        finish(err(
+          HaiDeployError.REMOTE_COMMAND_FAILED,
+          deployM("deploy_commandTimeout", { params: { command } })
+        ));
+      }, options.timeoutMs);
+    }
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    child.on("error", (error) => {
+      logger3.error("Command failed to start", { command, error: maskSecrets(String(error), options.secrets) });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(error.message, options.secrets) }
+        }),
+        error
+      ));
+    });
+    child.on("close", (code) => {
+      const exitCode = code ?? -1;
+      if (exitCode === 0) {
+        finish(ok({ code: exitCode, stdout, stderr }));
+        return;
+      }
+      logger3.error("Command exited with non-zero code", {
+        command,
+        code: exitCode,
+        stderr: maskSecrets(stderr, options.secrets).slice(-500),
+        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
+      });
+      finish(err(
+        HaiDeployError.REMOTE_COMMAND_FAILED,
+        deployM("deploy_commandFailed", {
+          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
+        })
+      ));
+    });
+    if (options.input !== void 0) {
+      child.stdin.write(options.input);
+      child.stdin.end();
+    } else {
+      child.stdin.end();
+    }
+  });
+}
+
+// src/container/deploy-bundle.ts
+function shellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+async function createDeploymentBundle(options) {
+  const { directory, artifactDir, artifact, projectName, environment, runtime, coreEnv } = options;
+  const stem = basename(options.output).replace(/\.tar$/i, "");
+  const versionSuffix = `-${artifact.appVersion}`;
+  const output = resolve(dirname(options.output), `${stem.endsWith(versionSuffix) ? stem : `${stem}${versionSuffix}`}.tar`);
+  const composeName = `docker-compose-${artifact.appVersion}.yml`;
+  mkdirSync(dirname(output), { recursive: true, mode: 448 });
+  const staging = mkdtempSync(join(directory, ".bundle-"));
+  chmodSync(staging, 448);
+  const temporaryTar = `${output}.partial`;
+  const startName = `start-${environment}.sh`;
+  try {
+    mkdirSync(join(staging, "images"));
+    for (const image of artifact.images)
+      copyFileSync(join(artifactDir, image.file), join(staging, "images", image.file));
+    for (const file of [composeName, ".env.runtime", ...artifact.images.some((image) => image.name === "web") ? ["web.conf"] : []])
+      copyFileSync(join(directory, file), join(staging, file));
+    const compose = parse(readFileSync(join(directory, composeName), "utf8"));
+    const images = [...new Set(Object.values(compose.services).flatMap((service) => service.image ? [service.image] : []))];
+    const start = `#!/bin/sh
+set -eu
+cd "$(dirname "$0")"
+umask 077
+export HAI_DEPLOY_ENVIRONMENT=${shellArgument(environment)}
+export HAI_CORE_ENV=${shellArgument(coreEnv)}
+runtime=${shellArgument(runtime)}
+if [ -n "\${HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME:-}" ]; then runtime="$HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME"; fi
+if [ "$runtime" = auto ]; then
+  if command -v podman >/dev/null 2>&1 && podman version >/dev/null 2>&1; then runtime=podman; else runtime=docker; fi
+fi
+case "$runtime" in docker|podman) ;; *) echo 'HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME must be docker or podman' >&2; exit 1;; esac
+"$runtime" version >/dev/null
+"$runtime" compose version >/dev/null
+sha256sum -c SHA256SUMS
+chmod 600 .env.runtime
+${artifact.images.map((image) => `"$runtime" load -i ${shellArgument(`images/${image.file}`)}`).join("\n")}
+# \u79BB\u7EBF\u670D\u52A1\u5668\u5E94\u5148\u5BFC\u5165\u5168\u90E8\u4E2D\u95F4\u4EF6\u955C\u50CF\uFF1B\u7981\u6B62\u9759\u9ED8\u5C1D\u8BD5\u8054\u7F51\u3002
+for image in ${images.map(shellArgument).join(" ")}; do
+  "$runtime" image inspect "$image" >/dev/null 2>&1 || { echo "Missing image: $image. Load the matching image archive before retrying." >&2; exit 1; }
+done
+exec "$runtime" compose -f ${shellArgument(composeName)} --env-file .env.runtime -p ${shellArgument(`hai-${projectName}`)} up -d
+`;
+    writeFileSync(join(directory, startName), start, { mode: 448 });
+    writeFileSync(join(staging, startName), start, { mode: 448 });
+    const instructions = deployM("deploy_bundleInstructions", { params: { file: basename(output), start: startName, images: images.join("\n"), compose: composeName } });
+    const metadata = deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, compose: composeName } });
+    writeFileSync(join(staging, "README.txt"), `${metadata}
+${instructions}
+`);
+    copyFileSync(join(artifactDir, "manifest.json"), join(staging, "manifest.json"));
+    const checksums = [];
+    for (const file of [composeName, "manifest.json", ".env.runtime", startName, ...artifact.images.some((image) => image.name === "web") ? ["web.conf"] : [], ...artifact.images.map((image) => `images/${image.file}`)])
+      checksums.push(`${await artifactChecksum(join(staging, file))}  ${file}`);
+    writeFileSync(join(staging, "SHA256SUMS"), `${checksums.join("\n")}
+`);
+    const tar = await runCommand("tar", ["-cf", temporaryTar, "-C", staging, "."]);
+    if (!tar.success)
+      throw new Error(tar.error.message);
+    chmodSync(temporaryTar, 384);
+    const { renameSync } = await import('fs');
+    renameSync(temporaryTar, output);
+    return { bundlePath: output, instructions, startName };
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+    rmSync(temporaryTar, { force: true });
+  }
+}
 var IMAGES = {
   postgres: "postgres:16-alpine",
   mysql: "mysql:8.4",
@@ -995,6 +1174,7 @@ function generateComposeFile(options) {
   const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
   const app = {
     image: imageRef,
+    labels: { "org.opencontainers.image.version": options.appVersion },
     container_name: `hai-${projectName}-app`,
     restart: "unless-stopped",
     // 镜像已由 load 注入本地，禁止 compose 再从 registry 拉取
@@ -1008,11 +1188,28 @@ function generateComposeFile(options) {
   if (sidecar.dependsOn.length > 0)
     app.depends_on = sidecar.dependsOn;
   const services = { app, ...sidecar.composeServices };
+  if (options.web) {
+    delete app.ports;
+    services.web = {
+      image: options.web.imageRef,
+      labels: { "org.opencontainers.image.version": options.appVersion },
+      container_name: `hai-${projectName}-web`,
+      restart: "unless-stopped",
+      pull_policy: "never",
+      ports: [`${hostPort}:${options.web.containerPort}`],
+      environment: { PUBLIC_API_BASE: "" },
+      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`], interval: "30s", timeout: "5s", retries: 3 },
+      volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
+      depends_on: ["app"],
+      networks: ["hai-app"]
+    };
+  }
   if (services["storage-init"])
     services["storage-init"] = { ...services["storage-init"], image: imageRef };
   const compose = {
+    "x-hai-version": options.appVersion,
     services,
-    networks: {
+    "networks": {
       "hai-app": { name: `hai-${projectName}` }
     }
   };
@@ -1041,8 +1238,43 @@ function generateComposeFile(options) {
       "storage-init": { condition: "service_completed_successfully" }
     };
   }
+  for (const service of Object.values(services))
+    service.pull_policy = "never";
   return stringify(compose);
 }
+function generateWebProxyConfig(port, apiPrefix, webPort = 8080) {
+  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535))
+    throw new Error("Invalid web proxy target");
+  return `server {
+  listen ${webPort};
+  server_name _;
+  root /usr/share/nginx/html;
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  location = /runtime-config.js {
+    add_header Cache-Control "no-store";
+    default_type application/javascript;
+    return 200 'globalThis.__HAI_PUBLIC_CONFIG__={apiBase:globalThis.location.origin+"${apiPrefix}"};';
+  }
+  location = /_hai/web-health {
+    access_log off;
+    return 200 'ok';
+  }
+  location = /health {
+    proxy_pass http://app:${port};
+    proxy_set_header Host $http_host;
+  }
+  location ${apiPrefix.replace(/\/$/, "")}/ {
+    proxy_pass http://app:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_buffering off;
+  }
+}
+`;
+}
 function serializeEnvFile(env) {
   return `${Object.entries(env).map(([key, value]) => {
     let literal = value;
@@ -1058,194 +1290,7 @@ function serializeEnvFile(env) {
   }).join("\n")}
 `;
 }
-function generateDockerignore() {
-  return `**/node_modules
-**/dist
-**/build
-**/.turbo
-**/.svelte-kit
-**/coverage
-**/test-results
-**/playwright-report
-**/.hai/deploy
-**/.env.local
-**/.env.*.local
-**/.env.runtime
-.git
-`;
-}
-function generateFallbackDockerfile(packageName, containerPort, options = {}) {
-  if (!/^@?[a-z0-9][\w./-]*$/i.test(packageName) || !/^[a-z0-9][\w-]*$/i.test(options.environment ?? "prod"))
-    throw new Error("Invalid container build target");
-  const environment = options.environment ?? "prod";
-  const coreEnv = environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
-  return `# syntax=docker/dockerfile:1.7
-FROM node:24-bookworm-slim AS build
-ARG SQLITE_PREBUILD_MIRROR
-ENV npm_config_better_sqlite3_binary_host_mirror=$SQLITE_PREBUILD_MIRROR
-ENV PNPM_HOME=/pnpm
-ENV PATH=$PNPM_HOME:$PATH
-ENV CI=true
-ENV HAI_DEPLOY_ENVIRONMENT=${environment}
-ENV HAI_CORE_ENV=${coreEnv}
-WORKDIR /workspace
-RUN corepack enable && corepack prepare pnpm@12.11.2 --activate
-COPY . .
-RUN pnpm install --frozen-lockfile --ignore-scripts
-RUN pnpm --filter ${packageName}... build
-RUN if [ -d node_modules/better-sqlite3 ]; then cd node_modules/better-sqlite3; for attempt in 1 2 3; do node -e "require('node:child_process').execFileSync(process.execPath,[require.resolve('prebuild-install/bin.js'),'--verbose'],{stdio:'inherit'})" && break; [ "$attempt" = 3 ] && exit 1; sleep 3; done; fi
-RUN pnpm pm deploy --filter ${packageName} --prod /prod/app
-
-FROM node:24-bookworm-slim AS runtime
-ENV NODE_ENV=production
-ENV HAI_DEPLOY_ENVIRONMENT=${environment}
-ENV HAI_CORE_ENV=${coreEnv}
-ENV HOST=0.0.0.0
-ENV PORT=${containerPort}
-WORKDIR /app
-COPY --from=build --chown=node:node /prod/app ./
-RUN mkdir -p data && chown node:node data
-USER node
-EXPOSE ${containerPort}
-CMD ["node", ${JSON.stringify(options.entrypoint ?? "build")}]
-`;
-}
-var logger4 = core.logger.child({ module: "deploy", scope: "command" });
-function maskSecrets(text, secrets) {
-  if (!secrets || secrets.length === 0)
-    return text;
-  let masked = text;
-  for (const secret of secrets) {
-    if (secret && secret.length > 0)
-      masked = masked.split(secret).join("***");
-  }
-  return masked;
-}
-function runCommand(command, args, options = {}) {
-  return new Promise((resolve3) => {
-    const child = spawn(command, args, {
-      cwd: options.cwd,
-      env: options.env ? { ...process2.env, ...options.env } : process2.env,
-      shell: false
-    });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    let timer;
-    const finish = (result) => {
-      if (settled)
-        return;
-      settled = true;
-      if (timer)
-        clearTimeout(timer);
-      resolve3(result);
-    };
-    if (options.timeoutMs && options.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        child.kill("SIGKILL");
-        logger4.error("Command timed out", { command, timeoutMs: options.timeoutMs });
-        finish(err(
-          HaiDeployError.REMOTE_COMMAND_FAILED,
-          deployM("deploy_commandTimeout", { params: { command } })
-        ));
-      }, options.timeoutMs);
-    }
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (error) => {
-      logger4.error("Command failed to start", { command, error: maskSecrets(String(error), options.secrets) });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(error.message, options.secrets) }
-        }),
-        error
-      ));
-    });
-    child.on("close", (code) => {
-      const exitCode = code ?? -1;
-      if (exitCode === 0) {
-        finish(ok({ code: exitCode, stdout, stderr }));
-        return;
-      }
-      logger4.error("Command exited with non-zero code", {
-        command,
-        code: exitCode,
-        stderr: maskSecrets(stderr, options.secrets).slice(-500),
-        stdout: maskSecrets(stdout, options.secrets).slice(-3e3)
-      });
-      finish(err(
-        HaiDeployError.REMOTE_COMMAND_FAILED,
-        deployM("deploy_commandFailed", {
-          params: { command, error: maskSecrets(`${stdout.slice(-2500)}
-${stderr || `exit ${exitCode}`}`, options.secrets).slice(-3e3) }
-        })
-      ));
-    });
-    if (options.input !== void 0) {
-      child.stdin.write(options.input);
-      child.stdin.end();
-    } else {
-      child.stdin.end();
-    }
-  });
-}
-
-// src/container/deploy-container-runtime.ts
-var logger5 = core.logger.child({ module: "deploy", scope: "container-runtime" });
-async function detectLocalRuntime(preferred = "auto") {
-  const candidates = preferred === "auto" ? ["podman", "docker"] : [preferred];
-  for (const runtime of candidates) {
-    const probe = await runCommand(runtime, ["version"], { timeoutMs: 15e3 });
-    if (probe.success) {
-      logger5.info("Local container runtime detected", { runtime });
-      return ok(runtime);
-    }
-  }
-  return err(
-    HaiDeployError.CONTAINER_RUNTIME_NOT_FOUND,
-    deployM("deploy_containerRuntimeNotFound", { params: { runtime: candidates.join(" / ") } })
-  );
-}
-async function buildImage(runtime, options) {
-  const args = ["build", "-f", options.dockerfilePath, "-t", options.imageRef];
-  if (runtime === "podman")
-    args.push("--format", "docker", "--jobs", "1");
-  if (runtime === "podman" && existsSync(`${options.dockerfilePath}.dockerignore`))
-    args.push("--ignorefile", `${options.dockerfilePath}.dockerignore`);
-  if (runtime === "podman" && options.httpProxy === false)
-    args.push("--http-proxy=false");
-  for (const [key, value] of Object.entries(options.buildArgs ?? {}))
-    args.push("--build-arg", `${key}=${value}`);
-  args.push(options.contextDir);
-  logger5.info("Building container image", { runtime, imageRef: options.imageRef });
-  const result = await runCommand(runtime, args, { cwd: options.contextDir });
-  if (!result.success) {
-    return err(
-      HaiDeployError.CONTAINER_BUILD_FAILED,
-      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
-      result.error
-    );
-  }
-  return ok(void 0);
-}
-async function saveImage(runtime, imageRef, tarPath) {
-  logger5.info("Saving container image", { runtime, imageRef, tarPath });
-  const result = await runCommand(runtime, ["save", "-o", tarPath, imageRef], {});
-  if (!result.success) {
-    return err(
-      HaiDeployError.CONTAINER_BUILD_FAILED,
-      deployM("deploy_containerBuildFailed", { params: { error: result.error.message } }),
-      result.error
-    );
-  }
-  return ok(void 0);
-}
-var logger6 = core.logger.child({ module: "deploy", scope: "ssh" });
+var logger4 = core.logger.child({ module: "deploy", scope: "ssh" });
 function buildConnectOptions(config) {
   const args = ["-o", "BatchMode=yes"];
   args.push("-o", `ConnectTimeout=${config.connectTimeoutSeconds}`);
@@ -1296,7 +1341,7 @@ function createSshExecutor(config) {
     return ok(void 0);
   };
   const ping = async () => {
-    logger6.debug("SSH preflight", { host: config.host, port: config.port });
+    logger4.debug("SSH preflight", { host: config.host, port: config.port });
     const result = await exec("true", { timeoutMs: 2e4 });
     if (!result.success) {
       return err(
@@ -1311,52 +1356,24 @@ function createSshExecutor(config) {
 }
 
 // src/providers/deploy-provider-docker-ssh.ts
-var logger7 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
+var logger5 = core.logger.child({ module: "deploy", scope: "provider-docker-ssh" });
 var HEALTH_POLL_INTERVAL = 3e3;
 var HEALTH_MAX_ATTEMPTS = 40;
-function shellArgument(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
 function makeDeploymentId() {
   const now = /* @__PURE__ */ new Date();
   const pad = (n) => String(n).padStart(2, "0");
   const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
   return `${stamp}-${randomBytes(3).toString("hex")}`;
 }
-function parseLoadedImageRef(stdout, fallback) {
-  const match = stdout.match(/Loaded image(?:\(s\))?:\s*(\S+)/);
-  return match ? match[1] : fallback;
-}
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
-}
-function readPackageName(appDir) {
-  try {
-    const pkg = JSON.parse(readFileSync(join(appDir, "package.json"), "utf-8"));
-    return pkg.name ?? "app";
-  } catch {
-    return "app";
-  }
-}
-function resolveWorkspaceRoot(appDir) {
-  if (existsSync(join(appDir, "pnpm-workspace.yaml")))
-    return appDir;
-  let current = appDir;
-  let parent = dirname(current);
-  while (parent !== current) {
-    if (existsSync(join(parent, "pnpm-workspace.yaml")))
-      return parent;
-    current = parent;
-    parent = dirname(parent);
-  }
-  return appDir;
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function createDockerSshProvider(config, container) {
-  const localRuntimePref = container?.runtime ?? "auto";
-  const httpProxy = container?.httpProxy ?? true;
-  const ssh = createSshExecutor(config.ssh);
+  const ssh = config.ssh ? createSshExecutor(config.ssh) : void 0;
   const baseDir = config.remote.baseDir;
   async function detectRemoteRuntime() {
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
     const candidates = config.remote.runtime === "auto" ? ["podman", "docker"] : [config.remote.runtime];
     for (const runtime of candidates) {
       const versionResult = await ssh.exec(`${runtime} version`, { timeoutMs: 2e4 });
@@ -1364,7 +1381,7 @@ function createDockerSshProvider(config, container) {
         continue;
       const composeResult = await ssh.exec(`${runtime} compose version`, { timeoutMs: 2e4 });
       if (composeResult.success) {
-        logger7.info("Remote container runtime detected", { runtime });
+        logger5.info("Remote container runtime detected", { runtime });
         return ok(runtime);
       }
     }
@@ -1388,29 +1405,31 @@ function createDockerSshProvider(config, container) {
   const deploy2 = async (context) => {
     const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
     const deploymentId = makeDeploymentId();
-    const containerPort = config.expose.containerPort;
     const hostPort = config.expose.hostPort;
-    const localImageTag = `hai-${projectName}:${deploymentId}`;
-    const runtimeResult = await detectLocalRuntime(localRuntimePref);
-    if (!runtimeResult.success)
-      return err(runtimeResult.error);
-    const localRuntime = runtimeResult.data;
     const artifactDir = join(appDir, ".hai", "deploy", options?.environment ?? "prod");
-    mkdirSync(artifactDir, { recursive: true });
-    const appDockerfile = join(appDir, "Dockerfile");
-    let dockerfilePath;
-    let contextDir;
-    if (existsSync(appDockerfile)) {
-      dockerfilePath = appDockerfile;
-      contextDir = appDir;
-    } else {
-      dockerfilePath = join(artifactDir, "Dockerfile");
-      writeFileSync(dockerfilePath, generateFallbackDockerfile(readPackageName(appDir), containerPort, { environment: options?.environment, entrypoint: scan.isSvelteKit ? "build" : "dist/index.js" }));
-      writeFileSync(`${dockerfilePath}.dockerignore`, generateDockerignore());
-      contextDir = resolveWorkspaceRoot(appDir);
-      logger7.info("Generated fallback Dockerfile", { dockerfilePath, contextDir });
-    }
+    mkdirSync(artifactDir, { recursive: true, mode: 448 });
+    chmodSync(artifactDir, 448);
+    const artifact = context.artifact;
+    const resolvedBuildDir = context.artifactDir;
+    const images = artifact.images;
+    const web = images.find((image) => image.name === "web");
+    const app = images.find((image) => image.name === "app");
+    const containerPort = app.containerPort ?? config.expose.containerPort;
+    const url = config.ssh ? `http://${config.ssh.host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
     const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
+    let webProxy;
+    if (web) {
+      const server = loadDeploymentConfig("serv", join(appDir, "config", "_serv.yml"), env);
+      if (!server.success)
+        return server;
+      const http = server.data.http;
+      const cors = server.data.cors;
+      const apiPrefix = http?.apiPrefix ?? "/api/v1";
+      if (typeof apiPrefix !== "string" || !/^\/[\w/-]+$/.test(apiPrefix))
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
+      webProxy = generateWebProxyConfig(containerPort, apiPrefix, web.containerPort ?? 8080);
+      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && config.ssh ? url : cors?.origin ?? "*" } });
+    }
     const envPath = join(artifactDir, ".env.runtime");
     const previousEnv = existsSync(envPath) ? parseEnv(readFileSync(envPath, "utf8")) : {};
     Object.assign(env, { ...previousEnv, ...env });
@@ -1423,88 +1442,64 @@ function createDockerSshProvider(config, container) {
       if (!saved.success)
         return saved;
     }
-    const buildResult = await buildImage(localRuntime, {
-      contextDir,
-      dockerfilePath,
-      imageRef: localImageTag,
-      buildArgs: { HAI_DEPLOY_ENVIRONMENT: options?.environment ?? "prod", HAI_CORE_ENV: env.HAI_CORE_ENV ?? "production", SQLITE_PREBUILD_MIRROR: container?.sqlitePrebuildMirror ?? "" },
-      httpProxy
-    });
-    if (!buildResult.success)
-      return err(buildResult.error);
-    const tarPath = join(artifactDir, `${projectName}.tar`);
-    const saveResult = await saveImage(localRuntime, localImageTag, tarPath);
-    if (!saveResult.success)
-      return err(saveResult.error);
-    const pingResult = await ssh.ping();
-    if (!pingResult.success)
-      return err(pingResult.error);
-    const remoteRuntimeResult = await detectRemoteRuntime();
-    if (!remoteRuntimeResult.success)
-      return err(remoteRuntimeResult.error);
-    const remoteRuntime = remoteRuntimeResult.data;
-    const remoteDir = `${baseDir}/${projectName}`;
-    const prepareResult = await ssh.exec(`mkdir -p -- ${shellArgument(remoteDir)} && chmod 700 -- ${shellArgument(remoteDir)}`);
-    if (!prepareResult.success)
-      return err(prepareResult.error);
-    const remoteTar = `${remoteDir}/image.tar`;
-    const uploadTarResult = await ssh.upload(tarPath, remoteTar);
-    if (!uploadTarResult.success)
-      return err(uploadTarResult.error);
-    const loadResult = await ssh.exec(`${remoteRuntime} load -i ${shellArgument(remoteTar)}`, { timeoutMs: 3e5 });
-    if (!loadResult.success)
-      return err(loadResult.error);
-    const loadedRef = parseLoadedImageRef(loadResult.data.stdout, localImageTag);
-    const remoteImageRef = remoteRuntime === "podman" ? `localhost/${localImageTag}` : localImageTag;
-    if (loadedRef !== remoteImageRef) {
-      const tagResult = await ssh.exec(`${remoteRuntime} tag ${shellArgument(loadedRef)} ${shellArgument(remoteImageRef)}`);
-      if (!tagResult.success)
-        return err(tagResult.error);
-    }
+    const composeName = `docker-compose-${artifact.appVersion}.yml`;
+    const latestPath = join(artifactDir, "latest");
+    const previousName = existsSync(latestPath) ? readFileSync(latestPath, "utf8").trim() : "";
+    const previousPath = /^[\w.+-]+\.yml$/.test(previousName) ? join(artifactDir, previousName) : void 0;
     const composeContent = generateComposeFile({
       projectName,
-      imageRef: remoteImageRef,
+      appVersion: artifact.appVersion,
+      imageRef: app.imageRef,
       hostPort,
       containerPort,
       sidecar,
+      web: web ? { imageRef: web.imageRef, containerPort: web.containerPort ?? 8080 } : void 0,
       serviceModes: options?.serviceModes,
-      previousCompose: existsSync(join(artifactDir, "compose.yml")) ? readFileSync(join(artifactDir, "compose.yml"), "utf8") : void 0
+      previousCompose: previousPath && existsSync(previousPath) ? readFileSync(previousPath, "utf8") : void 0
     });
-    const composePath = join(artifactDir, "compose.yml");
+    const composePath = join(artifactDir, composeName);
     writeFileSync(composePath, composeContent);
-    const uploadComposeResult = await ssh.upload(composePath, `${remoteDir}/compose.yml`);
-    if (!uploadComposeResult.success)
-      return err(uploadComposeResult.error);
-    const uploadEnvResult = await ssh.upload(envPath, `${remoteDir}/.env.runtime`);
-    if (!uploadEnvResult.success)
-      return err(uploadEnvResult.error);
-    const startScript = `#!/bin/sh
-set -eu
-cd "$(dirname "$0")"
-export HAI_DEPLOY_ENVIRONMENT=${options?.environment ?? "prod"}
-export HAI_CORE_ENV=${shellArgument(env.HAI_CORE_ENV ?? "production")}
-exec ${remoteRuntime} compose --env-file .env.runtime -p hai-${projectName} up -d
-`;
-    const startName = `start-${options?.environment ?? "prod"}.sh`;
-    const startPath = join(artifactDir, startName);
-    writeFileSync(startPath, startScript, { mode: 448 });
-    const uploadStart = await ssh.upload(startPath, `${remoteDir}/${startName}`);
-    if (!uploadStart.success)
-      return uploadStart;
-    const secretMask = sidecar.secrets;
-    const chmodResult = await ssh.exec(`chmod 600 -- ${shellArgument(`${remoteDir}/.env.runtime`)}`, { secrets: secretMask });
-    if (!chmodResult.success)
-      return err(chmodResult.error);
-    const upResult = await ssh.exec(
-      `cd ${shellArgument(remoteDir)} && sh ${shellArgument(startName)}`,
-      { timeoutMs: 3e5, secrets: secretMask }
+    if (webProxy)
+      writeFileSync(join(artifactDir, "web.conf"), webProxy);
+    const bundle = await createDeploymentBundle({
+      directory: artifactDir,
+      artifactDir: resolvedBuildDir,
+      artifact,
+      projectName,
+      environment: options?.environment ?? "prod",
+      runtime: config.remote.runtime,
+      coreEnv: env.HAI_CORE_ENV ?? "production",
+      output: options?.output ?? join(artifactDir, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar`)
+    });
+    writeFileSync(latestPath, `${composeName}
+`);
+    if (options?.bundleOnly)
+      return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet: Object.keys(env), ...bundle });
+    if (!ssh)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
+    const ping = await ssh.ping();
+    if (!ping.success)
+      return ping;
+    const remoteRuntime = await detectRemoteRuntime();
+    if (!remoteRuntime.success)
+      return remoteRuntime;
+    const remoteDir = `${baseDir}/${projectName}`;
+    const remoteTar = `${remoteDir}/${basename(bundle.bundlePath)}`;
+    const prepared = await ssh.exec(`mkdir -p -- ${shellArgument(remoteDir)} && chmod 700 -- ${shellArgument(remoteDir)}`);
+    if (!prepared.success)
+      return prepared;
+    const uploaded = await ssh.upload(bundle.bundlePath, remoteTar);
+    if (!uploaded.success)
+      return uploaded;
+    const started = await ssh.exec(
+      `cd ${shellArgument(remoteDir)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} && HAI_DEPLOY_PROVIDER_REMOTE_RUNTIME=${shellArgument(remoteRuntime.data)} sh ${shellArgument(bundle.startName)}`,
+      { timeoutMs: 3e5, secrets: sidecar.secrets }
     );
-    if (!upResult.success)
-      return err(upResult.error);
-    await ssh.exec(`rm -f -- ${shellArgument(remoteTar)}`);
-    const url = `http://${config.ssh.host}:${hostPort}`;
-    logger7.info("Running health check", { url });
-    const healthy = await healthCheck(`${url}${scan.isSvelteKit ? "/" : "/health"}`);
+    if (!started.success)
+      return started;
+    await ssh.exec(`rm -f -- ${shellArgument(remoteTar)} ${images.map((image) => shellArgument(`${remoteDir}/images/${image.file}`)).join(" ")}`);
+    logger5.info("Running health check", { url });
+    const healthy = await healthCheck(`${url}${!web && scan.isSvelteKit ? "/" : "/health"}`) && (!web || await healthCheck(`${url}/_hai/web-health`) && await healthCheck(`${url}/`));
     if (!healthy) {
       return err(
         HaiDeployError.HEALTH_CHECK_FAILED,
@@ -1517,14 +1512,23 @@ exec ${remoteRuntime} compose --env-file .env.runtime -p hai-${projectName} up -
       status: "ready",
       provider: "docker-ssh",
       healthCheck: "passed",
-      envVarsSet: Object.keys(env)
+      envVarsSet: Object.keys(env),
+      bundlePath: bundle.bundlePath
     };
-    logger7.info("docker-ssh deployment complete", { url, deploymentId });
+    logger5.info("docker-ssh deployment complete", { url, deploymentId });
     return ok(result);
   };
-  return { name: "docker-ssh", deploy: deploy2 };
+  const deploySafely = async (context) => {
+    try {
+      return await deploy2(context);
+    } catch (error) {
+      logger5.error("Deployment bundle failed", { error });
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"), error);
+    }
+  };
+  return { name: "docker-ssh", deploy: deploySafely };
 }
-var logger8 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
+var logger6 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
 var VERCEL_API = "https://api.vercel.com";
 var POLL_INTERVAL = 3e3;
 var MAX_POLL_ATTEMPTS = 60;
@@ -1577,7 +1581,7 @@ function createVercelProvider() {
   return {
     name: "vercel",
     async authenticate(apiToken) {
-      logger8.debug("Authenticating with Vercel");
+      logger6.debug("Authenticating with Vercel");
       try {
         const user = await vercelFetch(
           apiToken,
@@ -1585,10 +1589,10 @@ function createVercelProvider() {
         );
         token = apiToken;
         const username = user.user.username || user.user.email;
-        logger8.info("Vercel authenticated", { user: username });
+        logger6.info("Vercel authenticated", { user: username });
         return ok(username);
       } catch (error) {
-        logger8.error("Vercel authentication failed", { error });
+        logger6.error("Vercel authentication failed", { error });
         return err(toDeployError(HaiDeployError.AUTH_FAILED, "deploy_authFailed", error));
       }
     },
@@ -1599,11 +1603,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Creating Vercel project", { projectName });
+      logger6.debug("Creating Vercel project", { projectName });
       try {
         const existingId = await findExistingProject(token, projectName);
         if (existingId !== null) {
-          logger8.info("Vercel project found", { projectName, projectId: existingId });
+          logger6.info("Vercel project found", { projectName, projectId: existingId });
           return ok(existingId);
         }
         try {
@@ -1618,13 +1622,13 @@ function createVercelProvider() {
               })
             }
           );
-          logger8.info("Vercel project created", { projectName, projectId: project.id });
+          logger6.info("Vercel project created", { projectName, projectId: project.id });
           return ok(project.id);
         } catch (error) {
           if (error instanceof VercelApiError && error.status === 409) {
             const concurrentProjectId = await findExistingProject(token, projectName);
             if (concurrentProjectId !== null) {
-              logger8.info("Vercel project reused after create conflict", {
+              logger6.info("Vercel project reused after create conflict", {
                 projectName,
                 projectId: concurrentProjectId
               });
@@ -1634,7 +1638,7 @@ function createVercelProvider() {
           throw error;
         }
       } catch (error) {
-        logger8.error("Vercel project creation failed", { projectName, error });
+        logger6.error("Vercel project creation failed", { projectName, error });
         return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error));
       }
     },
@@ -1645,7 +1649,7 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
+      logger6.debug("Setting Vercel env vars", { projectId, count: Object.keys(envVars).length });
       try {
         const envEntries = Object.entries(envVars).map(([key, value]) => ({
           key,
@@ -1661,10 +1665,10 @@ function createVercelProvider() {
             body: JSON.stringify(envEntries)
           }
         );
-        logger8.info("Vercel env vars set", { projectId, count: envEntries.length });
+        logger6.info("Vercel env vars set", { projectId, count: envEntries.length });
         return ok(void 0);
       } catch (error) {
-        logger8.error("Vercel env vars setup failed", { projectId, error });
+        logger6.error("Vercel env vars setup failed", { projectId, error });
         return err(toDeployError(HaiDeployError.ENV_VAR_FAILED, "deploy_envVarFailed", error));
       }
     },
@@ -1675,8 +1679,11 @@ function createVercelProvider() {
           deployM("deploy_authRequired")
         );
       }
-      logger8.debug("Deploying to Vercel", { projectId, outputDir });
+      logger6.debug("Deploying to Vercel", { projectId, outputDir });
       try {
+        const outputConfig = JSON.parse(readFileSync(join(outputDir, "config.json"), "utf8"));
+        if (outputConfig.version !== 3)
+          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
         const filePaths = collectFiles(outputDir, outputDir);
         const files = [];
         for (const filePath of filePaths) {
@@ -1685,18 +1692,20 @@ function createVercelProvider() {
           const sha = createHash("sha1").update(content).digest("hex");
           const size = statSync(fullPath).size;
           await uploadFile(token, content, sha);
-          files.push({ file: filePath, sha, size });
+          files.push({ file: `.vercel/output/${filePath}`, sha, size });
         }
-        logger8.debug("Files uploaded", { count: files.length });
+        logger6.debug("Files uploaded", { count: files.length });
         const deployment = await vercelFetch(
           token,
-          "/v13/deployments",
+          "/v13/deployments?prebuilt=1",
           {
             method: "POST",
             body: JSON.stringify({
               name: projectId,
               files,
-              projectSettings: { framework: "sveltekit" }
+              version: 2,
+              project: projectId,
+              projectSettings: { framework: null, buildCommand: "", installCommand: "" }
             })
           }
         );
@@ -1707,14 +1716,14 @@ function createVercelProvider() {
           status: finalStatus,
           envVarsSet: []
         };
-        logger8.info("Vercel deployment complete", {
+        logger6.info("Vercel deployment complete", {
           deploymentId: deployment.id,
           url: result.url,
           status: finalStatus
         });
         return ok(result);
       } catch (error) {
-        logger8.error("Vercel deployment failed", { projectId, error });
+        logger6.error("Vercel deployment failed", { projectId, error });
         return err(toDeployError(HaiDeployError.UPLOAD_FAILED, "deploy_uploadFailed", error));
       }
     }
@@ -1759,11 +1768,11 @@ async function pollDeploymentStatus(token, deploymentId) {
     if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
       return "error";
     }
-    await new Promise((resolve3) => setTimeout(resolve3, POLL_INTERVAL));
+    await new Promise((resolve6) => setTimeout(resolve6, POLL_INTERVAL));
   }
   return "building";
 }
-var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
+var logger7 = core.logger.child({ module: "deploy", scope: "provisioner-aliyun" });
 function createAliyunProvisioner() {
   let accessKey = null;
   let secretKey = null;
@@ -1772,7 +1781,7 @@ function createAliyunProvisioner() {
     name: "aliyun",
     serviceType: "sms",
     async authenticate(credentials) {
-      logger9.debug("Authenticating with Aliyun");
+      logger7.debug("Authenticating with Aliyun");
       try {
         const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
         const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
@@ -1782,10 +1791,10 @@ function createAliyunProvisioner() {
         accessKey = akId;
         secretKey = akSecret;
         signName = credentials.signName;
-        logger9.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
         return ok(akId);
       } catch (error) {
-        logger9.error("Aliyun authentication failed", { error });
+        logger7.error("Aliyun authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1802,7 +1811,7 @@ function createAliyunProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger9.debug("Provisioning Aliyun SMS service");
+      logger7.debug("Provisioning Aliyun SMS service");
       return ok({
         serviceType: "sms",
         provisionerName: "aliyun",
@@ -1815,7 +1824,7 @@ function createAliyunProvisioner() {
     }
   };
 }
-var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
+var logger8 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
 var NEON_API = "https://console.neon.tech/api/v2";
 var DEFAULT_NEON_DATABASE_NAME = "neondb";
 var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
@@ -1874,7 +1883,7 @@ function createNeonProvisioner() {
     name: "neon",
     serviceType: "db",
     async authenticate(credentials) {
-      logger10.debug("Authenticating with Neon");
+      logger8.debug("Authenticating with Neon");
       try {
         const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
         if (!apiToken) {
@@ -1882,10 +1891,10 @@ function createNeonProvisioner() {
         }
         await listNeonProjects(apiToken);
         token = apiToken;
-        logger10.info("Neon authenticated");
+        logger8.info("Neon authenticated");
         return ok("neon-user");
       } catch (error) {
-        logger10.error("Neon authentication failed", { error });
+        logger8.error("Neon authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -1902,7 +1911,7 @@ function createNeonProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger10.debug("Provisioning Neon database", { appName });
+      logger8.debug("Provisioning Neon database", { appName });
       let resource;
       try {
         const projectName = `${appName}-db`;
@@ -1910,7 +1919,7 @@ function createNeonProvisioner() {
         if (existingProject !== null) {
           resource = { resourceInfo: `neon-project:${existingProject.id}`, resourceStatus: "reused" };
           const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
-          logger10.info("Neon project reused", {
+          logger8.info("Neon project reused", {
             projectId: existingProject.id,
             projectName
           });
@@ -1932,10 +1941,10 @@ function createNeonProvisioner() {
         if (!projectId || !connectionUri) {
           throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
         }
-        logger10.info("Neon database provisioned", { projectId });
+        logger8.info("Neon database provisioned", { projectId });
         return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
       } catch (error) {
-        logger10.error("Neon provisioning failed", { appName });
+        logger8.error("Neon provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -1957,7 +1966,7 @@ function createNeonProvisioner() {
     }
   };
 }
-var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
+var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-r2" });
 var CF_API = "https://api.cloudflare.com/client/v4";
 function createR2Provisioner() {
   let token = null;
@@ -1968,7 +1977,7 @@ function createR2Provisioner() {
     name: "r2",
     serviceType: "storage",
     async authenticate(credentials) {
-      logger11.debug("Authenticating with Cloudflare");
+      logger9.debug("Authenticating with Cloudflare");
       try {
         const acctId = credentials.accountId ?? credentials.account_id ?? "";
         const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
@@ -1985,10 +1994,10 @@ function createR2Provisioner() {
         token = apiTok;
         accessKey = credentials.accessKeyId;
         secretKey = credentials.secretAccessKey;
-        logger11.info("Cloudflare R2 authenticated", { accountId: acctId });
+        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
         return ok(acctId);
       } catch (error) {
-        logger11.error("Cloudflare R2 authentication failed", { error });
+        logger9.error("Cloudflare R2 authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -2006,7 +2015,7 @@ function createR2Provisioner() {
         );
       }
       const bucketName = `${appName}-storage`.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-      logger11.debug("Provisioning R2 bucket", { appName, bucketName });
+      logger9.debug("Provisioning R2 bucket", { appName, bucketName });
       try {
         const createRes = await fetch(
           `${CF_API}/accounts/${accountId}/r2/buckets`,
@@ -2022,7 +2031,7 @@ function createR2Provisioner() {
         if (!createRes.ok && createRes.status !== 409) {
           throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
         }
-        logger11.info("R2 bucket provisioned", { bucketName });
+        logger9.info("R2 bucket provisioned", { bucketName });
         return ok({
           serviceType: "storage",
           provisionerName: "r2",
@@ -2040,7 +2049,7 @@ function createR2Provisioner() {
           resourceInfo: `r2-bucket:${bucketName}`
         });
       } catch (error) {
-        logger11.error("R2 provisioning failed", { appName, error });
+        logger9.error("R2 provisioning failed", { appName, error });
         return err(
           HaiDeployError.PROVISION_FAILED,
           deployM("deploy_provisionFailed", {
@@ -2055,7 +2064,7 @@ function createR2Provisioner() {
     }
   };
 }
-var logger12 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
+var logger10 = core.logger.child({ module: "deploy", scope: "provisioner-resend" });
 var RESEND_API = "https://api.resend.com";
 function createResendProvisioner() {
   let token = null;
@@ -2064,7 +2073,7 @@ function createResendProvisioner() {
     name: "resend",
     serviceType: "email",
     async authenticate(credentials) {
-      logger12.debug("Authenticating with Resend");
+      logger10.debug("Authenticating with Resend");
       try {
         const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
         if (!apiToken || !credentials.from) {
@@ -2078,10 +2087,10 @@ function createResendProvisioner() {
         }
         token = apiToken;
         from = credentials.from;
-        logger12.info("Resend authenticated");
+        logger10.info("Resend authenticated");
         return ok("resend-user");
       } catch (error) {
-        logger12.error("Resend authentication failed", { error });
+        logger10.error("Resend authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -2098,7 +2107,7 @@ function createResendProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger12.debug("Provisioning Resend email service");
+      logger10.debug("Provisioning Resend email service");
       return ok({
         serviceType: "email",
         provisionerName: "resend",
@@ -2111,7 +2120,7 @@ function createResendProvisioner() {
     }
   };
 }
-var logger13 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
+var logger11 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
 var UPSTASH_API = "https://api.upstash.com";
 function createUpstashAuthHeader(email, apiKey) {
   return `Basic ${Buffer.from(`${email}:${apiKey}`).toString("base64")}`;
@@ -2162,7 +2171,7 @@ function createUpstashProvisioner() {
     name: "upstash",
     serviceType: "cache",
     async authenticate(credentials) {
-      logger13.debug("Authenticating with Upstash");
+      logger11.debug("Authenticating with Upstash");
       try {
         const userEmail = credentials.email ?? "";
         const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
@@ -2172,10 +2181,10 @@ function createUpstashProvisioner() {
         await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
         apiKey = userKey;
-        logger13.info("Upstash authenticated", { email: userEmail });
+        logger11.info("Upstash authenticated", { email: userEmail });
         return ok(userEmail);
       } catch (error) {
-        logger13.error("Upstash authentication failed", { error });
+        logger11.error("Upstash authentication failed", { error });
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
@@ -2192,7 +2201,7 @@ function createUpstashProvisioner() {
           deployM("deploy_authRequired")
         );
       }
-      logger13.debug("Provisioning Upstash Redis", { appName });
+      logger11.debug("Provisioning Upstash Redis", { appName });
       let resource;
       try {
         const databaseName = `${appName}-cache`;
@@ -2204,7 +2213,7 @@ function createUpstashProvisioner() {
           }
           resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
           const detail = await getUpstashDatabase(email, apiKey, databaseId);
-          logger13.info("Upstash Redis reused", { databaseId, databaseName });
+          logger11.info("Upstash Redis reused", { databaseId, databaseName });
           return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
         }
         const data = await upstashFetch(email, apiKey, "/v2/redis/database", {
@@ -2217,10 +2226,10 @@ function createUpstashProvisioner() {
         });
         if (data.database_id)
           resource = { resourceInfo: `upstash-db:${data.database_id}`, resourceStatus: "created" };
-        logger13.info("Upstash Redis provisioned", { databaseId: data.database_id });
+        logger11.info("Upstash Redis provisioned", { databaseId: data.database_id });
         return ok(buildUpstashProvisionResult(data, "created"));
       } catch (error) {
-        logger13.error("Upstash provisioning failed", { appName });
+        logger11.error("Upstash provisioning failed", { appName });
         if (resource) {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
@@ -2244,7 +2253,7 @@ function createUpstashProvisioner() {
 }
 
 // src/deploy-main.ts
-var logger14 = core.logger.child({ module: "deploy", scope: "main" });
+var logger12 = core.logger.child({ module: "deploy", scope: "main" });
 var currentConfig = null;
 var currentProvider = null;
 var currentContainerProvider = null;
@@ -2329,7 +2338,7 @@ var deploy = {
   credentials: deployCredentials,
   async init(config) {
     if (initInProgress) {
-      logger14.warn("Deploy init already in progress, skipping concurrent call");
+      logger12.warn("Deploy init already in progress, skipping concurrent call");
       return err(
         HaiDeployError.CONFIG_ERROR,
         deployM("deploy_configError", { params: { error: "init already in progress" } })
@@ -2338,13 +2347,13 @@ var deploy = {
     initInProgress = true;
     try {
       if (currentProvider || currentContainerProvider) {
-        logger14.warn("Deploy module is already initialized, reinitializing");
+        logger12.warn("Deploy module is already initialized, reinitializing");
         await deploy.close();
       }
-      logger14.info("Initializing deploy module");
+      logger12.info("Initializing deploy module");
       const parseResult = DeployConfigSchema.safeParse(config);
       if (!parseResult.success) {
-        logger14.error("Deploy config validation failed", { error: parseResult.error.message });
+        logger12.error("Deploy config validation failed", { error: parseResult.error.message });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", { params: { error: parseResult.error.message } }),
@@ -2357,14 +2366,14 @@ var deploy = {
         let containerProvider = null;
         if (parsed.provider.type === "docker-ssh") {
           containerProvider = createDockerSshProvider(parsed.provider, parsed.container);
-          logger14.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh.host });
+          logger12.info("Container deploy provider ready", { provider: "docker-ssh", host: parsed.provider.ssh?.host });
         } else {
           provider = createProviderByType(parsed.provider.type);
           const authResult = await provider.authenticate(parsed.provider.token);
           if (!authResult.success) {
             return err(authResult.error);
           }
-          logger14.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
+          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         }
         currentProvisioners.clear();
         if (parsed.services) {
@@ -2376,14 +2385,14 @@ var deploy = {
             const credentials = extractCredentials(serviceConfig);
             const provAuthResult = await provisioner.authenticate(credentials);
             if (!provAuthResult.success) {
-              logger14.error("Provisioner authentication failed", {
+              logger12.error("Provisioner authentication failed", {
                 service: serviceType,
                 provisioner: serviceConfig.provisioner
               });
               currentProvisioners.clear();
               return err(provAuthResult.error);
             }
-            logger14.info("Provisioner authenticated", {
+            logger12.info("Provisioner authenticated", {
               service: serviceType,
               user: provAuthResult.data
             });
@@ -2393,7 +2402,7 @@ var deploy = {
         currentProvider = provider;
         currentContainerProvider = containerProvider;
         currentConfig = parsed;
-        logger14.info("Deploy module initialized", {
+        logger12.info("Deploy module initialized", {
           provider: parsed.provider.type,
           provisioners: [...currentProvisioners.keys()]
         });
@@ -2403,7 +2412,7 @@ var deploy = {
         currentContainerProvider = null;
         currentConfig = null;
         currentProvisioners.clear();
-        logger14.error("Deploy module initialization failed", { error });
+        logger12.error("Deploy module initialization failed", { error });
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", {
@@ -2418,15 +2427,15 @@ var deploy = {
   },
   async close() {
     if (!currentProvider && !currentContainerProvider) {
-      logger14.info("Deploy module already closed, skipping");
+      logger12.info("Deploy module already closed, skipping");
       return;
     }
-    logger14.info("Closing deploy module");
+    logger12.info("Closing deploy module");
     currentProvider = null;
     currentContainerProvider = null;
     currentConfig = null;
     currentProvisioners.clear();
-    logger14.info("Deploy module closed");
+    logger12.info("Deploy module closed");
   },
   get config() {
     return currentConfig;
@@ -2435,22 +2444,22 @@ var deploy = {
     return currentProvider !== null || currentContainerProvider !== null;
   },
   async scan(appDir, options) {
-    logger14.debug("Scanning application", { appDir });
+    logger12.debug("Scanning application", { appDir });
     return scanApp(appDir, options);
   },
   async provisionAll(projectName, services) {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Provisioning all services", { projectName, count: currentProvisioners.size });
+    logger12.info("Provisioning all services", { projectName, count: currentProvisioners.size });
     const results = [];
     for (const [serviceType, provisioner] of currentProvisioners) {
       if (services && !services.includes(serviceType))
         continue;
-      logger14.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
+      logger12.debug("Provisioning service", { serviceType, provisioner: provisioner.name });
       const provResult = await provisioner.provision(projectName);
       if (!provResult.success) {
-        logger14.error("Service provisioning failed", {
+        logger12.error("Service provisioning failed", {
           serviceType,
           provisioner: provisioner.name,
           code: provResult.error.code
@@ -2467,7 +2476,7 @@ var deploy = {
         });
       }
       results.push(provResult.data);
-      logger14.info("Service provisioned", { serviceType, provisioner: provisioner.name });
+      logger12.info("Service provisioned", { serviceType, provisioner: provisioner.name });
     }
     return ok(results);
   },
@@ -2475,7 +2484,7 @@ var deploy = {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    logger14.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
+    logger12.info("Starting deployment", { appDir, environment: options?.environment, projectName: options?.projectName });
     const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
     const scanResult = await scanApp(appDir, scanOptions);
     if (!scanResult.success) {
@@ -2491,11 +2500,13 @@ var deploy = {
     options = {
       ...options,
       ...scanOptions.environment ? { environment: environment.data.environment } : {},
-      ...options?.skipProvision ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
+      ...options?.skipMiddleware ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
     };
     if (currentContainerProvider) {
       return deployContainerApp(currentContainerProvider, appDir, scan, projectName, options, appEnv);
     }
+    if (options?.bundleOnly)
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleOnlyContainer"));
     if (!currentProvider) {
       return notInitialized.result();
     }
@@ -2507,9 +2518,11 @@ var deploy = {
         })
       );
     }
+    if (!existsSync(resolveOutputDir(appDir, "vercel")))
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
     let allEnvVars = appEnv;
     const recovery = { projectName, stage: "provision", resources: [] };
-    if (!options?.skipProvision) {
+    if (!options?.skipMiddleware) {
       const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
       if (!provResults.success) {
         return err(provResults.error);
@@ -2534,12 +2547,6 @@ var deploy = {
         return recoveryFailure(envResult.error, { ...recovery, stage: "set-env" });
       }
     }
-    if (!options?.skipBuild) {
-      const buildResult = buildApp(appDir, scan.buildCommand, allEnvVars);
-      if (!buildResult.success) {
-        return recoveryFailure(buildResult.error, { ...recovery, stage: "build" });
-      }
-    }
     const outputDir = resolveOutputDir(appDir, currentConfig?.provider.type ?? "vercel");
     const deployResult = await currentProvider.deploy(projectId, outputDir);
     if (!deployResult.success) {
@@ -2549,7 +2556,7 @@ var deploy = {
       ...deployResult.data,
       envVarsSet: Object.keys(allEnvVars)
     };
-    logger14.info("Deployment completed", {
+    logger12.info("Deployment completed", {
       url: result.url,
       deploymentId: result.deploymentId,
       status: result.status
@@ -2559,21 +2566,30 @@ var deploy = {
 };
 async function deployContainerApp(provider, appDir, scan, rawProjectName, options, appEnv = {}) {
   const projectName = normalizeProjectName(rawProjectName);
-  if (scan.isSvelteKit && !scan.nodeAdapterInstalled) {
-    return err(
-      HaiDeployError.ADAPTER_MISSING,
-      deployM("deploy_adapterMissing", { params: { adapter: "@sveltejs/adapter-node" } })
-    );
+  let artifact;
+  let artifactDir = options?.artifactDir ?? resolveArtifactDirectory(appDir);
+  try {
+    if (existsSync(join(artifactDir, "latest"))) {
+      const latest = readFileSync(join(artifactDir, "latest"), "utf8").trim();
+      if (!/^[a-z0-9][\w.+-]*$/i.test(latest))
+        throw new Error("Invalid artifact pointer");
+      artifactDir = join(artifactDir, latest);
+    }
+    artifact = await readDeploymentArtifact(artifactDir);
+  } catch {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
   }
+  if (!options?.bundleOnly && currentConfig?.provider.type === "docker-ssh" && !currentConfig.provider.ssh)
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
   let provisionEnv = {};
-  if (!options?.skipProvision) {
+  if (!options?.skipMiddleware) {
     const provResults = await deploy.provisionAll(projectName, options?.serviceModes ? scan.requiredServices.filter((service) => usesDefaultMiddleware(scan, service, options)) : void 0);
     if (!provResults.success) {
       return err(provResults.error);
     }
     provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
   }
-  return provider.deploy({ appDir, projectName, scan, provisionEnv, appEnv, options });
+  return provider.deploy({ appDir, artifact, artifactDir, projectName, scan, provisionEnv, appEnv, options });
 }
 
 // src/deploy-middleware.ts
@@ -2621,6 +2637,6 @@ function describeMiddlewareBackend(backend) {
   return deployM(backend.purpose);
 }
 
-export { DEPLOY_MIDDLEWARE, DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, saveDeploymentEnvironment };
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, deploy, describeMiddlewareBackend, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, readDeploymentArtifact, saveDeploymentEnvironment };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map