@h-ai/deploy 1.0.0-beta.17 → 1.0.0-beta.19

package/dist/index.js

@@ -1,11 +1,12 @@
 import { createHash, randomUUID, randomBytes, X509Certificate, createPublicKey, createPrivateKey } from 'crypto';
-import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, mkdirSync, readdirSync, realpathSync, chmodSync, statSync, mkdtempSync, copyFileSync, renameSync, rmSync, createWriteStream } from 'fs';
-import { resolve, extname, join, dirname, relative, basename, sep } from 'path';
+import { createReadStream, readFileSync, existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, openSync, constants, fstatSync, readSync, closeSync, fchmodSync, writeFileSync, fsyncSync, renameSync, unlinkSync, chmodSync, mkdtempSync, copyFileSync, rmSync, createWriteStream, statSync } from 'fs';
+import { resolve, extname, join, dirname, basename, relative, sep } from 'path';
 import { z } from 'zod';
 import { core, err, ok, CoreConfigSchema, RequestAccessConfigSchema, TrustedProxiesSchema } from '@h-ai/core';
 import { spawn, execFileSync } from 'child_process';
 import process from 'process';
 import { LineCounter, parseDocument, parse, stringify, parseAllDocuments } from 'yaml';
+import { Buffer, constants as constants$1 } from 'buffer';
 import { homedir, tmpdir } from 'os';
 import { request } from 'https';
 import { rootCertificates } from 'tls';
@@ -16,19 +17,28 @@ import { Transform } from 'stream';
 import { pipeline } from 'stream/promises';
 import { readdir, readFile } from 'fs/promises';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
-import { Buffer } from 'buffer';
 import { isIP } from 'net';
 
 // src/deploy-artifact.ts
 var DeploymentArtifactSchema = z.object({
   /** 清单格式版本，与应用版本和部署环境无关。 */
-  version: z.union([z.literal(4), z.literal(5)]),
+  version: z.union([
+    z.literal(4),
+    z.literal(5)
+  ]),
   /** 主运行服务：独立后端为 serv，独立浏览器站点（静态或 SSR）为 web。 */
   primaryService: z.enum(["serv", "web"]),
   /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
   appVersion: z.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
   /** 本次构建标识；同一应用版本允许重复构建。 */
   buildId: z.string().max(128).regex(/^[a-z0-9][\w.+-]*$/i),
+  /** 构建启动时观察到的 Git 来源；历史清单可以省略。 */
+  source: z.object({
+    /** 工程 package.json 所在仓库的提交 SHA；无法确定时为 unknown。 */
+    commit: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|unknown)$/),
+    /** 工程及所选镜像上下文/构建定义有未提交改动时为 true；跨仓库或无法检查时为 null。 */
+    dirty: z.boolean().nullable()
+  }).optional(),
   /** 只包含所选镜像的构建不能用于首次安装。 */
   partial: z.boolean().default(false),
   /** 是否包含浏览器端；仅构建 serv 时也保留完整工程的 Web 拓扑。 */
@@ -49,6 +59,8 @@ var DeploymentArtifactSchema = z.object({
     imageRef: z.string().regex(/^[a-z0-9][a-z0-9./:_-]*:[a-z0-9_][a-z0-9_.-]*$/).refine((value) => !value.endsWith(":latest")),
     /** tar 内容的 SHA-256，用于部署前校验。 */
     sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    /** 引擎实际构建的镜像 OS/架构；历史清单可以省略。 */
+    platform: z.string().regex(/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/).optional(),
     /** 容器内部监听端口；服务器公开端口由部署选择。 */
     containerPort: z.number().int().min(1).max(65535).optional()
   })).min(1).max(2).refine((images) => new Set(images.map((image) => image.name)).size === images.length)
@@ -552,8 +564,13 @@ var SshConfigSchema = z.object({
 }).superRefine((ssh, context) => {
   if (ssh.auth === "key" || ssh.auth === void 0 && !ssh.password)
     return;
-  if (!ssh.password || /[\r\n\0]/.test(ssh.password) || new TextEncoder().encode(ssh.password).length > 1023)
-    context.addIssue({ code: "custom", path: ["password"], message: deployM("deploy_sshPasswordInvalid") });
+  if (!ssh.password || /[\r\n\0]/.test(ssh.password) || new TextEncoder().encode(ssh.password).length > 1023) {
+    context.addIssue({
+      code: "custom",
+      path: ["password"],
+      message: deployM("deploy_sshPasswordInvalid")
+    });
+  }
 });
 var HttpsDomainSchema = z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/i).refine((value) => !value.includes(".."));
 var httpsOptions = {
@@ -590,8 +607,13 @@ var PortExposeSchema = z.object({
   /** 可选 HTTPS：已有 PEM 文件或官方 Certbot 自动申请续期；省略保留 HTTP。 */
   https: HttpsConfigSchema.optional().describe("\u53EF\u9009 HTTPS \u5165\u53E3\uFF1Bfiles \u4F7F\u7528\u5DF2\u6709\u8BC1\u4E66\uFF0Cletsencrypt \u4F7F\u7528\u5B98\u65B9 Certbot \u7533\u8BF7\u7EED\u671F\uFF0C\u7701\u7565\u4FDD\u6301 HTTP")
 }).superRefine((expose, context) => {
-  if (expose.https && (expose.https.port === expose.hostPort || expose.https.type === "letsencrypt" && expose.hostPort !== 80))
-    context.addIssue({ code: "custom", path: ["https"], message: deployM("deploy_httpsPortsInvalid") });
+  if (expose.https && (expose.https.port === expose.hostPort || expose.https.type === "letsencrypt" && expose.hostPort !== 80)) {
+    context.addIssue({
+      code: "custom",
+      path: ["https"],
+      message: deployM("deploy_httpsPortsInvalid")
+    });
+  }
 });
 var ExposeSchema = PortExposeSchema;
 var DockerSshProviderConfigSchema = z.object({
@@ -608,7 +630,12 @@ var DockerSshProviderConfigSchema = z.object({
   /** 应用暴露方式 */
   expose: ExposeSchema,
   /** Nginx 前方可信负载均衡的 IP/CIDR；省略时不接受外部转发头。 */
-  trustedEdgeProxies: z.array(z.union([z.ipv4(), z.ipv6(), z.cidrv4(), z.cidrv6()])).max(1e3).optional()
+  trustedEdgeProxies: z.array(z.union([
+    z.ipv4(),
+    z.ipv6(),
+    z.cidrv4(),
+    z.cidrv6()
+  ])).max(1e3).optional()
 });
 var ProviderConfigSchema = z.discriminatedUnion("type", [
   VercelProviderConfigSchema,
@@ -649,23 +676,52 @@ var ServicesConfigSchema = z.object({
   sms: z.discriminatedUnion("provisioner", [AliyunSmsServiceSchema]).optional()
 }).optional();
 function provisionerFields(provisioner) {
-  const schema = [NeonServiceSchema, UpstashServiceSchema, R2ServiceSchema, ResendServiceSchema, AliyunSmsServiceSchema].find((item) => item.shape.provisioner.value === provisioner);
+  const schema = [
+    NeonServiceSchema,
+    UpstashServiceSchema,
+    R2ServiceSchema,
+    ResendServiceSchema,
+    AliyunSmsServiceSchema
+  ].find((item) => item.shape.provisioner.value === provisioner);
   return schema ? Object.keys(schema.shape).filter((name) => name !== "provisioner") : [];
 }
-var reservedComposeHosts = /* @__PURE__ */ new Set(["localhost", "serv", "web", "gateway", "certbot", "db", "cache", "storage", "vecdb", "ldap", "email", "sms"]);
+var reservedComposeHosts = /* @__PURE__ */ new Set([
+  "localhost",
+  "serv",
+  "web",
+  "gateway",
+  "certbot",
+  "db",
+  "cache",
+  "storage",
+  "vecdb",
+  "ldap",
+  "email",
+  "sms"
+]);
 var composeHostname = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
 var ComposeServiceConfigSchema = z.strictObject({
   /** 容器内的主机名到 IPv4 或 IPv6 地址映射，不能覆盖框架内部服务名。 */
-  extra_hosts: z.record(z.string(), z.union([z.ipv4(), z.ipv6()], {
+  extra_hosts: z.record(z.string(), z.union([
+    z.ipv4(),
+    z.ipv6()
+  ], {
     error: () => deployM("deploy_composeHostAddressInvalid")
   })).superRefine((hosts, ctx) => {
     const seen = /* @__PURE__ */ new Set();
     for (const host of Object.keys(hosts)) {
       const key = host.toLowerCase();
       if (host.length > 253 || !composeHostname.test(host)) {
-        ctx.addIssue({ code: "custom", message: deployM("deploy_composeHostnameInvalid") });
+        ctx.addIssue({
+          code: "custom",
+          message: deployM("deploy_composeHostnameInvalid")
+        });
       } else if (reservedComposeHosts.has(key) || seen.has(key)) {
-        ctx.addIssue({ code: "custom", path: [host], message: deployM("deploy_composeHostnameConflict") });
+        ctx.addIssue({
+          code: "custom",
+          path: [host],
+          message: deployM("deploy_composeHostnameConflict")
+        });
       }
       seen.add(key);
     }
@@ -703,8 +759,12 @@ function validateComposeServices(container, artifact) {
   const field2 = `deploy.container.compose.services.${unavailable}`;
   return err({
     ...HaiDeployError.CONFIG_ERROR,
-    message: deployM("deploy_composeServiceUnavailable", { params: { field: field2 } }),
-    ext: { fields: [field2] }
+    message: deployM("deploy_composeServiceUnavailable", {
+      params: { field: field2 }
+    }),
+    ext: {
+      fields: [field2]
+    }
   });
 }
 function resolveImageReference(reference, source) {
@@ -721,8 +781,11 @@ function resolveImageReference(reference, source) {
     parts.unshift("library");
   const mappings = source.type === "cn" ? { "docker.io": "docker.1ms.run", "ghcr.io": "ghcr.1ms.run" } : source.registries;
   const replacement = mappings?.[registry];
-  if (!replacement || typeof replacement !== "string")
-    throw new Error(deployM("deploy_imageSourceMissing", { params: { registry } }));
+  if (!replacement || typeof replacement !== "string") {
+    throw new Error(deployM("deploy_imageSourceMissing", {
+      params: { registry }
+    }));
+  }
   if (replacement.split("/").some((part) => part === "." || part === ".."))
     throw new Error(deployM("deploy_downloadInvalid"));
   let url;
@@ -739,20 +802,32 @@ function resolveImageReference(reference, source) {
 function systemProxy() {
   if (process.platform === "win32") {
     const script = "$p=Get-ItemProperty -LiteralPath 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'; @{enabled=($p.ProxyEnable -eq 1);server=$p.ProxyServer;bypass=$p.ProxyOverride;pac=$p.AutoConfigURL}|ConvertTo-Json -Compress";
-    const value = JSON.parse(execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { encoding: "utf8", windowsHide: true, timeout: 5e3 }));
+    const value = JSON.parse(execFileSync("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      script
+    ], { encoding: "utf8", windowsHide: true, timeout: 5e3 }));
     if (value.pac)
       throw new Error(deployM("deploy_proxySystemUnsupported"));
     if (!value.enabled || !value.server)
       return {};
     const entries = Object.fromEntries(value.server.split(";").map((item) => item.includes("=") ? item.split("=", 2) : ["all", item]));
-    return { http: entries.http ?? entries.all, https: entries.https ?? entries.http ?? entries.all, bypass: value.bypass?.split(";").filter((item) => item !== "<local>").join(",") };
+    return {
+      http: entries.http ?? entries.all,
+      https: entries.https ?? entries.http ?? entries.all,
+      bypass: value.bypass?.split(";").filter((item) => item !== "<local>").join(",")
+    };
   }
   if (process.platform === "darwin") {
     const output = execFileSync("/usr/sbin/scutil", ["--proxy"], { encoding: "utf8", timeout: 5e3 });
     const get = (key) => output.match(new RegExp(`^\\s*${key}\\s*:\\s*(.+)$`, "m"))?.[1]?.trim();
     if (get("ProxyAutoConfigEnable") === "1" || get("ProxyAutoDiscoveryEnable") === "1")
       throw new Error(deployM("deploy_proxySystemUnsupported"));
-    return { http: get("HTTPEnable") === "1" ? `http://${get("HTTPProxy")}:${get("HTTPPort")}` : void 0, https: get("HTTPSEnable") === "1" ? `http://${get("HTTPSProxy")}:${get("HTTPSPort")}` : void 0 };
+    return {
+      http: get("HTTPEnable") === "1" ? `http://${get("HTTPProxy")}:${get("HTTPPort")}` : void 0,
+      https: get("HTTPSEnable") === "1" ? `http://${get("HTTPSProxy")}:${get("HTTPSPort")}` : void 0
+    };
   }
   throw new Error(deployM("deploy_proxySystemUnsupported"));
 }
@@ -780,7 +855,18 @@ function resolveDownloadProxy(config) {
   const bypass = mode === "none" ? "" : config?.bypass ?? values.bypass ?? "";
   if (/[\r\n\0]/.test(bypass))
     throw new Error(deployM("deploy_downloadInvalid"));
-  return { HTTP_PROXY: http, http_proxy: http, HTTPS_PROXY: https, https_proxy: https, NO_PROXY: bypass, no_proxy: bypass, ALL_PROXY: mode === "inherit" ? process.env.ALL_PROXY ?? process.env.all_proxy ?? "" : "", all_proxy: mode === "inherit" ? process.env.ALL_PROXY ?? process.env.all_proxy ?? "" : "", FTP_PROXY: mode === "inherit" ? process.env.FTP_PROXY ?? process.env.ftp_proxy ?? "" : "", ftp_proxy: mode === "inherit" ? process.env.FTP_PROXY ?? process.env.ftp_proxy ?? "" : "" };
+  return {
+    HTTP_PROXY: http,
+    http_proxy: http,
+    HTTPS_PROXY: https,
+    https_proxy: https,
+    NO_PROXY: bypass,
+    no_proxy: bypass,
+    ALL_PROXY: mode === "inherit" ? process.env.ALL_PROXY ?? process.env.all_proxy ?? "" : "",
+    all_proxy: mode === "inherit" ? process.env.ALL_PROXY ?? process.env.all_proxy ?? "" : "",
+    FTP_PROXY: mode === "inherit" ? process.env.FTP_PROXY ?? process.env.ftp_proxy ?? "" : "",
+    ftp_proxy: mode === "inherit" ? process.env.FTP_PROXY ?? process.env.ftp_proxy ?? "" : ""
+  };
 }
 
 // src/deploy-config-shapes.json
@@ -2483,6 +2569,18 @@ var deploy_config_shapes_default = {
                     type: "string",
                     pattern: "^[A-Z_]\\w*$"
                   }
+                },
+                gitEnvironmentRefs: {
+                  default: {},
+                  type: "object",
+                  propertyNames: {
+                    type: "string",
+                    pattern: "^[A-Z_]\\w*$"
+                  },
+                  additionalProperties: {
+                    type: "string",
+                    pattern: "^[A-Z_]\\w*$"
+                  }
                 }
               },
               required: [
@@ -6108,13 +6206,95 @@ var deploy_config_shapes_default = {
     }
   }
 };
+function regular(metadata, options = {}) {
+  if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1n || metadata.size < 0n || metadata.size > BigInt(options.maxBytes ?? constants$1.MAX_LENGTH - 1) || options.private && process.platform !== "win32" && ((metadata.mode & 0o077n) !== 0n || process.getuid?.() !== 0 && metadata.uid !== BigInt(process.getuid?.() ?? -1))) {
+    throw new Error("Unsafe local file metadata");
+  }
+}
+function sameFile(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function readLocalFile(path, options = {}) {
+  const before = lstatSync(path, { bigint: true });
+  regular(before, options);
+  const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    regular(opened, options);
+    if (!sameFile(before, opened))
+      throw new Error("Local file changed before opening");
+    const size = Number(opened.size);
+    const bytes = Buffer.alloc(size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const read = readSync(fd, bytes, length, bytes.length - length, null);
+      if (!read)
+        break;
+      length += read;
+    }
+    const after = fstatSync(fd, { bigint: true });
+    regular(after, options);
+    if (!sameFile(opened, after) || length !== size || opened.size !== after.size || opened.mtimeNs !== after.mtimeNs || opened.ctimeNs !== after.ctimeNs) {
+      throw new Error("Local file changed while reading");
+    }
+    return bytes.subarray(0, length);
+  } finally {
+    closeSync(fd);
+  }
+}
+function existingFile(path) {
+  try {
+    const metadata = lstatSync(path, { bigint: true });
+    regular(metadata);
+    return metadata;
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+      return void 0;
+    throw error;
+  }
+}
+function writeLocalFile(path, content, privateFile2 = false) {
+  const previous = existingFile(path);
+  const mode = privateFile2 ? 384 : previous ? Number(previous.mode & 0o777n) : 420;
+  const temporary = join(dirname(path), `.${basename(path)}.${randomUUID()}.tmp`);
+  let fd;
+  let owned;
+  let published = false;
+  try {
+    fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, mode);
+    owned = fstatSync(fd, { bigint: true });
+    fchmodSync(fd, mode);
+    writeFileSync(fd, content, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = void 0;
+    existingFile(path);
+    const candidate = lstatSync(temporary, { bigint: true });
+    regular(candidate);
+    if (!sameFile(owned, candidate))
+      throw new Error("Local temporary file ownership changed");
+    renameSync(temporary, path);
+    published = true;
+  } finally {
+    if (fd !== void 0)
+      closeSync(fd);
+    if (!published && owned) {
+      try {
+        const candidate = lstatSync(temporary, { bigint: true });
+        if (candidate.isFile() && sameFile(owned, candidate))
+          unlinkSync(temporary);
+      } catch {
+      }
+    }
+  }
+}
 
 // src/deploy-environment.ts
 var shapes = deploy_config_shapes_default;
 function environmentFile(path) {
   const values = {};
   if (existsSync(path)) {
-    for (const [name, value] of Object.entries(core.config.parseEnv(readFileSync(path, "utf8")))) {
+    for (const [name, value] of Object.entries(core.config.parseEnv(readLocalFile(path).toString("utf8")))) {
       if (value !== void 0)
         values[name] = value;
     }
@@ -6125,7 +6305,15 @@ function mergeEnvironmentLayers(layers, prefix) {
   return core.config.mergeEnv(layers.map((layer) => Object.fromEntries(Object.entries(layer).filter(([name]) => !prefix || name === prefix || name.startsWith(`${prefix}_`)))));
 }
 function describeDeploymentVariableSources(directory, environment, values, names) {
-  const files = [`.env.${environment}.local`, ".env.local", `.env.${environment}`, ".env"].map((name) => ({ path: join(directory, name), values: environmentFile(join(directory, name)) }));
+  const files = [
+    `.env.${environment}.local`,
+    ".env.local",
+    `.env.${environment}`,
+    ".env"
+  ].map((name) => ({
+    path: join(directory, name),
+    values: environmentFile(join(directory, name))
+  }));
   return names.filter((name) => values[name]).map((name) => {
     const source = process.env[name] !== void 0 ? "process.env" : files.find((file) => Object.hasOwn(file.values, name))?.path;
     return `${name}: ${source ?? ".env.runtime"}`;
@@ -6140,32 +6328,65 @@ function loadDeploymentConfig(name, path, values) {
         const project = JSON.parse(content);
         input = project && typeof project === "object" && !Array.isArray(project) ? project[name] : void 0;
       } catch {
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: "1" } }));
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", {
+          params: { path, line: "1" }
+        }));
+      }
+      if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", {
+          params: { path, line: "1" }
+        }));
       }
-      if (!input || typeof input !== "object" || Array.isArray(input))
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: "1" } }));
     } else {
       const lineCounter = new LineCounter();
       const document = parseDocument(content, { lineCounter, prettyErrors: false });
-      if (document.errors.length)
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: String(lineCounter.linePos(document.errors[0].pos[0]).line) } }));
+      if (document.errors.length) {
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", {
+          params: {
+            path,
+            line: String(lineCounter.linePos(document.errors[0].pos[0]).line)
+          }
+        }));
+      }
       input = document.toJS();
     }
-    const resolved = core.config.resolve({ name, value: input, environment: values, shape: shapes[name], missing: "empty" });
+    const resolved = core.config.resolve({
+      name,
+      value: input,
+      environment: values,
+      shape: shapes[name],
+      missing: "empty"
+    });
     if (!resolved.success) {
       const cause = resolved.error.cause;
       const fields = cause && typeof cause === "object" && "fields" in cause ? cause.fields : void 0;
       const safeFields = Array.isArray(fields) ? fields.filter((field2) => typeof field2 === "string" && /^HAI_[A-Z0-9_]+$/.test(field2)).join(", ") : "";
-      if (name === "reach" && /^HAI_REACH_PROVIDERS_\d+(?:_|$)/.test(safeFields) && /^\s*\[\s*\]\s*$/.test(values.HAI_REACH_PROVIDERS ?? ""))
-        return err({ ...resolved.error, message: deployM("deploy_reachEmptyProviderOverride", { params: { path, field: safeFields } }) });
-      return err({ ...resolved.error, message: deployM("deploy_configResolutionFailed", { params: { path, fields: safeFields || name } }) });
+      if (name === "reach" && /^HAI_REACH_PROVIDERS_\d+(?:_|$)/.test(safeFields) && /^\s*\[\s*\]\s*$/.test(values.HAI_REACH_PROVIDERS ?? "")) {
+        return err({
+          ...resolved.error,
+          message: deployM("deploy_reachEmptyProviderOverride", {
+            params: { path, field: safeFields }
+          })
+        });
+      }
+      return err({
+        ...resolved.error,
+        message: deployM("deploy_configResolutionFailed", {
+          params: { path, fields: safeFields || name }
+        })
+      });
     }
     const config = resolved.data;
-    if (config !== null && (typeof config !== "object" || Array.isArray(config)))
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: "1" } }));
+    if (config !== null && (typeof config !== "object" || Array.isArray(config))) {
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", {
+        params: { path, line: "1" }
+      }));
+    }
     return ok(config && typeof config === "object" && !Array.isArray(config) ? config : {});
   } catch {
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileUnreadable", { params: { path } }));
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileUnreadable", {
+      params: { path }
+    }));
   }
 }
 function loadDeploymentEnvironment(options) {
@@ -6174,8 +6395,11 @@ function loadDeploymentEnvironment(options) {
     return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_invalidEnvironment"));
   const envDir = resolve(options.envDir);
   const target = join(envDir, `.env.${environment}`);
-  if (options.requireFile !== false && !existsSync(target))
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentMissing", { params: { path: target } }));
+  if (options.requireFile !== false && !existsSync(target)) {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentMissing", {
+      params: { path: target }
+    }));
+  }
   const loaded = core.config.loadEnvFiles({ mode: environment, envDir });
   if (!loaded.success)
     return loaded;
@@ -6189,25 +6413,40 @@ function loadDeploymentEnvironment(options) {
     values.HAI_DEPLOY_ENVIRONMENT = environment;
     if (values.HAI_CORE_ENV === void 0) {
       const fallback = environment === "prod" ? "production" : environment === "dev" ? "development" : environment === "test" ? "test" : "staging";
-      const configured = core.config.resolve({ name: "core", value: { env: fallback }, environment: values, shape: shapes.core });
+      const configured = core.config.resolve({
+        name: "core",
+        value: { env: fallback },
+        environment: values,
+        shape: shapes.core
+      });
       const settings = configured.success && configured.data && typeof configured.data === "object" ? configured.data : void 0;
       values.HAI_CORE_ENV = typeof settings?.env === "string" ? settings.env : fallback;
     }
-    return ok({ environment, envDir, values, targetValues: selected });
+    return ok({
+      environment,
+      envDir,
+      values,
+      targetValues: selected
+    });
   } catch {
     return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_environmentReadFailed"));
   }
 }
 var reachGatewayEnvironment = /^HAI_REACH_PROVIDERS_\d+_GATEWAY$/i;
 function isSecret(name, value) {
+  if (name === "headers" || /^HAI_REACH_PROVIDERS_\d+_HEADERS(?:_|$)/i.test(name))
+    return true;
   if (/^HAI_REACH_PROVIDERS_\d+_GATEWAY_(?:HEADERS|BODY)(?:_|$)/i.test(name))
     return true;
   if (/PASSWORD|SECRET|TOKEN|APIKEY|PRIVATEKEY|ACCESSKEY|AUTHORIZATION/i.test(name.replace(/[^a-z0-9]/gi, "")) || /(?:^|_)PASS$/i.test(name) || value.includes("PRIVATE KEY"))
     return true;
   try {
     const url = new URL(value);
-    if (url.username || url.password || [...url.searchParams.keys()].some((key) => /password|secret|token|key|authorization/i.test(key)))
+    if (url.username || url.password || [
+      ...url.searchParams.keys()
+    ].some((key) => /password|secret|token|key|authorization/i.test(key))) {
       return true;
+    }
   } catch {
   }
   try {
@@ -6249,7 +6488,13 @@ function generatedVariables(values) {
     const structuredNames = Object.keys(group).filter((name) => structures.has(name));
     if (!structuredNames.length)
       continue;
-    const resolved = core.config.resolve({ name: module, value: {}, environment: group, shape: shapes[module], missing: "empty" });
+    const resolved = core.config.resolve({
+      name: module,
+      value: {},
+      environment: group,
+      shape: shapes[module],
+      missing: "empty"
+    });
     if (resolved.success) {
       const flattened = core.config.toEnv({ prefix: `HAI_${module.toUpperCase()}`, value: resolved.data, shape: shapes[module] });
       const represented = structuredNames.every((name) => Object.entries(flattened).some(([key, value]) => key === name || key.startsWith(`${name}_`) || name.startsWith(`${key}_`) && value.startsWith("[")));
@@ -6287,12 +6532,12 @@ function generatedVariables(values) {
   return generated;
 }
 function updateFile(path, values, privateFile2) {
-  let content = existsSync(path) ? readFileSync(path, "utf8") : "# Local private deployment configuration; do not commit.\n";
+  let content = existsSync(path) ? readLocalFile(path).toString("utf8") : "# Local private deployment configuration; do not commit.\n";
   for (const [name, value] of Object.entries(values)) {
     if (!/^[A-Z][A-Z0-9_]*$/.test(name))
       throw new Error("Invalid environment variable name");
     const line = core.config.stringifyEnv({ [name]: value }).trimEnd();
-    const pattern = new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*`, "gm");
+    const pattern = new RegExp(`^[\\t ]*(?:export[\\t ]+)?${name}[\\t ]*=[\\t ]*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*`, "gm");
     if (pattern.test(content))
       content = content.replace(pattern, () => line);
     else
@@ -6303,25 +6548,22 @@ ${line}
   for (const [name, value] of Object.entries(core.config.parseEnv(content)).sort(([left], [right]) => left.length - right.length)) {
     if (!name.startsWith("HAI_") || !/^\s*[[{]/.test(value))
       continue;
-    const parent = new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "m").exec(content);
-    const child = new RegExp(`^(?:export\\s+)?${name}_[A-Z0-9_]+\\s*=`, "m").exec(content);
+    const parent = new RegExp(`^[\\t ]*(?:export[\\t ]+)?${name}[\\t ]*=[\\t ]*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "m").exec(content);
+    const child = new RegExp(`^[\\t ]*(?:export[\\t ]+)?${name}_[A-Z0-9_]+[\\t ]*=`, "m").exec(content);
     if (parent && child && parent.index > child.index) {
       const withoutParent = content.slice(0, parent.index) + content.slice(parent.index + parent[0].length);
       content = withoutParent.slice(0, child.index) + parent[0].replace(/\r?\n?$/, "\n") + withoutParent.slice(child.index);
     }
   }
-  writeFileSync(path, content, { mode: privateFile2 ? 384 : 420 });
-  if (privateFile2)
-    chmodSync(path, 384);
+  writeLocalFile(path, content, privateFile2);
 }
 function removeOverrides(path, names, privateFile2 = true) {
   if (!existsSync(path) || names.length === 0)
     return;
-  let content = readFileSync(path, "utf8");
+  let content = readLocalFile(path).toString("utf8");
   for (const name of names)
-    content = content.replace(new RegExp(`^(?:export\\s+)?${name}\\s*=\\s*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
-  writeFileSync(path, content, { mode: privateFile2 ? 384 : 420 });
-  chmodSync(path, privateFile2 ? 384 : 420);
+    content = content.replace(new RegExp(`^[\\t ]*(?:export[\\t ]+)?${name}[\\t ]*=[\\t ]*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
+  writeLocalFile(path, content, privateFile2);
 }
 function saveDeploymentEnvironment(environment, values, options = {}) {
   try {
@@ -6331,8 +6573,12 @@ function saveDeploymentEnvironment(environment, values, options = {}) {
         return value;
       if (Array.isArray(value))
         return value.map((item, index) => splitArrayValue2(`${name}_${index}`, item) ?? null);
-      if (value && typeof value === "object" && !reachGatewayEnvironment.test(name) && !isSecret(name, "") && Object.keys(value).every((key) => /^[a-z][a-zA-Z0-9]*$/.test(key)))
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, splitArrayValue2(`${name}_${key.toUpperCase()}`, item)]).filter(([, item]) => item !== void 0));
+      if (value && typeof value === "object" && !reachGatewayEnvironment.test(name) && !isSecret(name, "") && Object.keys(value).every((key) => /^[a-z][a-zA-Z0-9]*$/.test(key))) {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+          key,
+          splitArrayValue2(`${name}_${key.toUpperCase()}`, item)
+        ]).filter(([, item]) => item !== void 0));
+      }
       privateValues[name] = literal;
       return void 0;
     };
@@ -6386,10 +6632,10 @@ function saveDeploymentEnvironment(environment, values, options = {}) {
     removeOverrides(privatePath, Object.keys(shared).filter((name) => !(name in privateValues)));
     if (Object.keys(privateValues).length) {
       const ignorePath = join(environment.envDir, ".gitignore");
-      const ignore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf8") : "";
+      const ignore = existsSync(ignorePath) ? readLocalFile(ignorePath).toString("utf8") : "";
       const missing = [".env.local", ".env.*.local", ".hai/deploy/"].filter((line) => !ignore.split(/\r?\n/).includes(line));
       if (missing.length)
-        writeFileSync(ignorePath, `${ignore.trimEnd()}
+        writeLocalFile(ignorePath, `${ignore.trimEnd()}
 ${missing.join("\n")}
 `);
     }
@@ -6399,7 +6645,14 @@ ${missing.join("\n")}
   }
 }
 function normalizeProjectName(name) {
-  const normalized = name.trim().replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  const replaced = name.trim().replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+  let start = 0;
+  let end = replaced.length;
+  while (start < end && replaced[start] === "-")
+    start++;
+  while (end > start && replaced[end - 1] === "-")
+    end--;
+  const normalized = replaced.slice(start, end);
   if (!normalized)
     throw new Error(deployM("deploy_projectNameRequired"));
   return normalized;
@@ -6452,7 +6705,9 @@ function normalizeCredentialEntries(entries) {
 }
 function assertAllowedCredentialKey(key) {
   if (!isAllowedCredentialKey(key)) {
-    throw new Error(deployM("deploy_credentialInvalidKey", { params: { key } }));
+    throw new Error(deployM("deploy_credentialInvalidKey", {
+      params: { key }
+    }));
   }
 }
 function assertAllowedCredentialEntries(entries) {
@@ -6504,7 +6759,9 @@ function loadCredentials() {
     return err(
       HaiDeployError.CREDENTIAL_ERROR,
       deployM("deploy_credentialError", {
-        params: { error: error instanceof Error ? error.message : String(error) }
+        params: {
+          error: error instanceof Error ? error.message : String(error)
+        }
       }),
       error
     );
@@ -6524,7 +6781,9 @@ function saveCredential(key, value) {
     return err(
       HaiDeployError.CREDENTIAL_ERROR,
       deployM("deploy_credentialError", {
-        params: { error: error instanceof Error ? error.message : String(error) }
+        params: {
+          error: error instanceof Error ? error.message : String(error)
+        }
       }),
       error
     );
@@ -6546,7 +6805,9 @@ function saveCredentials(entries) {
     return err(
       HaiDeployError.CREDENTIAL_ERROR,
       deployM("deploy_credentialError", {
-        params: { error: error instanceof Error ? error.message : String(error) }
+        params: {
+          error: error instanceof Error ? error.message : String(error)
+        }
       }),
       error
     );
@@ -6555,12 +6816,59 @@ function saveCredentials(entries) {
 
 // src/deploy-middleware-config.ts
 var connectionFields = {
-  db: ["url", "host", "port", "database", "user", "password", "ssl"],
-  cache: ["url", "host", "port", "password", "cluster", "sentinel", "tls"],
-  storage: ["endpoint", "bucket", "region", "accessKeyId", "secretAccessKey", "forcePathStyle", "createBucket"],
-  vecdb: ["url", "host", "port", "database", "user", "password", "apiKey", "path", "serverCommand", "startupTimeout"],
-  ldap: ["url", "bindDn", "bindPassword", "searchBase", "useTls"],
-  email: ["host", "port", "secure", "user", "pass"]
+  db: [
+    "url",
+    "host",
+    "port",
+    "database",
+    "user",
+    "password",
+    "ssl"
+  ],
+  cache: [
+    "url",
+    "host",
+    "port",
+    "password",
+    "cluster",
+    "sentinel",
+    "tls"
+  ],
+  storage: [
+    "endpoint",
+    "bucket",
+    "region",
+    "accessKeyId",
+    "secretAccessKey",
+    "forcePathStyle",
+    "createBucket"
+  ],
+  vecdb: [
+    "url",
+    "host",
+    "port",
+    "database",
+    "user",
+    "password",
+    "apiKey",
+    "path",
+    "serverCommand",
+    "startupTimeout"
+  ],
+  ldap: [
+    "url",
+    "bindDn",
+    "bindPassword",
+    "searchBase",
+    "useTls"
+  ],
+  email: [
+    "host",
+    "port",
+    "secure",
+    "user",
+    "pass"
+  ]
 };
 function mergeManagedMiddlewareConfig(requirement, supplied) {
   if (!requirement || requirement.service !== "ldap" && requirement.backend !== supplied.type)
@@ -6568,7 +6876,10 @@ function mergeManagedMiddlewareConfig(requirement, supplied) {
   const configured = { ...requirement.config };
   for (const field2 of connectionFields[requirement.service] ?? [])
     delete configured[field2];
-  const merged = { ...configured, ...supplied };
+  const merged = {
+    ...configured,
+    ...supplied
+  };
   if (requirement.service === "cache" && typeof configured.db === "number" && typeof supplied.url === "string") {
     const url = new URL(supplied.url);
     if (configured.db !== 0 || url.pathname !== "" && url.pathname !== "/") {
@@ -6583,21 +6894,39 @@ var RecoverySchema = z.object({
   stage: z.string(),
   platformProjectId: z.string().optional(),
   resources: z.array(z.object({
-    serviceType: z.enum(["db", "cache", "storage", "email", "sms"]),
+    serviceType: z.enum([
+      "db",
+      "cache",
+      "storage",
+      "email",
+      "sms"
+    ]),
     provisionerName: z.string(),
     resourceInfo: z.string(),
     resourceStatus: z.enum(["created", "reused", "unknown"])
   }))
 });
 var CommandStateSchema = z.object({
-  reason: z.enum(["timeout", "output", "input", "spawn", "exit", "configuration"]),
+  reason: z.enum([
+    "timeout",
+    "output",
+    "input",
+    "spawn",
+    "exit",
+    "configuration"
+  ]),
   localTermination: z.enum(["confirmed", "unknown", "not-started"]),
   remoteExecution: z.enum(["unknown", "finished"]).optional(),
   deploymentId: z.string().optional(),
   resultFile: z.string().optional(),
   remoteExitCode: z.number().int().optional(),
   remoteStage: z.string().optional(),
-  remoteRecovery: z.enum(["not-needed", "passed", "failed", "stopped"]).optional()
+  remoteRecovery: z.enum([
+    "not-needed",
+    "passed",
+    "failed",
+    "stopped"
+  ]).optional()
 });
 function getDeployCommandState(error) {
   const parsed = CommandStateSchema.safeParse(error.ext?.commandExecution);
@@ -6613,7 +6942,9 @@ function recoveryFailure(error, recovery) {
     httpStatus: error.httpStatus,
     system: error.system,
     module: error.module,
-    message: deployM("deploy_recoveryFailure", { params: { stage: recovery.stage } }),
+    message: deployM("deploy_recoveryFailure", {
+      params: { stage: recovery.stage }
+    }),
     suggestion: deployM("deploy_recoverySuggestion"),
     ext: { recovery }
   });
@@ -6648,12 +6979,15 @@ function runtimeDependencies(appDir) {
     visited.add(id);
     const metadata = importer === void 0 ? record(packages[id.split("(")[0]]) : {};
     const peers = record(metadata.peerDependencies);
-    for (const [name, reference] of Object.entries({ ...record(node.dependencies), ...record(node.optionalDependencies) })) {
+    for (const [name, reference] of Object.entries({
+      ...record(node.dependencies),
+      ...record(node.optionalDependencies)
+    })) {
       if (name in peers)
         continue;
       const version = typeof reference === "string" ? reference : record(reference).version;
       if (typeof version !== "string")
-        throw new Error("Invalid pnpm dependency reference");
+        throw new TypeError("Invalid pnpm dependency reference");
       if (version.startsWith("link:")) {
         if (importer === void 0)
           throw new Error("Invalid workspace dependency");
@@ -6674,7 +7008,14 @@ function runtimeDependencies(appDir) {
     }
   };
   visit(`workspace:${importerKey}`, record(importers[importerKey]), importerKey);
-  return { runtime: names, build: /* @__PURE__ */ new Set([...names, ...Object.keys(record(record(importers[importerKey]).devDependencies))]), root };
+  return {
+    runtime: names,
+    build: /* @__PURE__ */ new Set([
+      ...names,
+      ...Object.keys(record(record(importers[importerKey]).devDependencies))
+    ]),
+    root
+  };
 }
 async function scanApp(inputDir, options) {
   try {
@@ -6696,7 +7037,14 @@ async function scanApp(inputDir, options) {
     const deps = graph.runtime;
     const configs = {};
     const enabledConfigs = /* @__PURE__ */ new Set();
-    for (const [name, owner] of Object.entries({ db: "reldb", cache: "cache", storage: "storage", vecdb: "vecdb", iam: "iam", reach: "reach" })) {
+    for (const [name, owner] of Object.entries({
+      db: "reldb",
+      cache: "cache",
+      storage: "storage",
+      vecdb: "vecdb",
+      iam: "iam",
+      reach: "reach"
+    })) {
       configs[name] = {};
       if (!deps.has(`@h-ai/${owner}`))
         continue;
@@ -6710,7 +7058,15 @@ async function scanApp(inputDir, options) {
     }
     const middlewares = [];
     const add = (service, backend, configName = service, configPath = [], config = configs[configName] ?? {}, source = `_${configName}.yml`) => {
-      middlewares.push({ service, backend, source, configName, configPath, envPrefix: ["HAI", configName, ...configPath].map((part) => part.toUpperCase()).join("_"), config });
+      middlewares.push({
+        service,
+        backend,
+        source,
+        configName,
+        configPath,
+        envPrefix: ["HAI", configName, ...configPath].map((part) => part.toUpperCase()).join("_"),
+        config
+      });
     };
     const iam = enabledConfigs.has("iam");
     if (enabledConfigs.has("db"))
@@ -6731,8 +7087,12 @@ async function scanApp(inputDir, options) {
         const provider = record(item);
         const type = String(provider.type ?? "");
         const service = type === "aliyun-sms" || ["console", "api"].includes(type) && provider.name === "sms" ? "sms" : ["smtp", "api", "console"].includes(type) ? "email" : void 0;
-        if (service)
-          add(service, type, "reach", ["providers", String(index)], provider, "@h-ai/reach");
+        if (service) {
+          add(service, type, "reach", [
+            "providers",
+            String(index)
+          ], provider, "@h-ai/reach");
+        }
       }
     }
     if (enabledConfigs.has("reach") && providers === void 0)
@@ -6747,19 +7107,33 @@ async function scanApp(inputDir, options) {
       isSvelteKit,
       adapterInstalled: graph.build.has("@sveltejs/adapter-vercel"),
       nodeAdapterInstalled: graph.build.has("@sveltejs/adapter-node"),
-      requiredServices: [...new Set(middlewares.map((item) => item.service))],
+      requiredServices: [
+        ...new Set(middlewares.map((item) => item.service))
+      ],
       serviceBackends: Object.fromEntries(middlewares.map((item) => [item.service, item.backend]))
     };
-    logger2.info("Application scanned", { appName: scan.appName, haiModules: scan.haiModules, requiredServices: scan.requiredServices, serviceBackends: scan.serviceBackends });
+    logger2.info("Application scanned", {
+      appName: scan.appName,
+      haiModules: scan.haiModules,
+      requiredServices: scan.requiredServices,
+      serviceBackends: scan.serviceBackends
+    });
     return ok(scan);
   } catch {
-    return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", { params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" } }));
+    return err(HaiDeployError.SCAN_FAILED, deployM("deploy_scanFailed", {
+      params: { error: "Invalid or ambiguous application/configuration/lockfile; specify the application directory and run pnpm install" }
+    }));
   }
 }
 
 // src/container/deploy-compose-identity.ts
 function createComposeContainerLookupScript() {
-  const labelFormat = ["com.docker.compose.project", "com.docker.compose.service", "io.podman.compose.project", "io.podman.compose.service"].map((key) => `{{index .Config.Labels \`${key}\`}}`).join("|");
+  const labelFormat = [
+    "com.docker.compose.project",
+    "com.docker.compose.service",
+    "io.podman.compose.project",
+    "io.podman.compose.service"
+  ].map((key) => `{{index .Config.Labels \`${key}\`}}`).join("|");
   return String.raw`compose_container_ids() (
   if [ "$#" -ne 4 ]; then printf 'Compose container lookup requires runtime, project, service and selector.\n' >&2; exit 1; fi
   lookup_runtime=$1
@@ -7147,11 +7521,28 @@ deployment_forget_metadata() {
 
 // src/container/deploy-managed-secrets.ts
 var groups = [
-  { name: "DB_PASSWORD", keys: ["POSTGRES_PASSWORD", "MYSQL_PASSWORD", "MYSQL_ROOT_PASSWORD"], services: ["db", "vecdb"] },
-  { name: "STORAGE_PASSWORD", keys: ["RUSTFS_SECRET_KEY", "MINIO_ROOT_PASSWORD"], services: ["storage"] },
-  { name: "LDAP_PASSWORD", keys: ["LDAP_ADMIN_PASSWORD"], services: ["ldap"] }
+  {
+    name: "DB_PASSWORD",
+    keys: ["POSTGRES_PASSWORD", "MYSQL_PASSWORD", "MYSQL_ROOT_PASSWORD"],
+    services: ["db", "vecdb"]
+  },
+  {
+    name: "STORAGE_PASSWORD",
+    keys: ["RUSTFS_SECRET_KEY", "MINIO_ROOT_PASSWORD"],
+    services: ["storage"]
+  },
+  {
+    name: "LDAP_PASSWORD",
+    keys: ["LDAP_ADMIN_PASSWORD"],
+    services: ["ldap"]
+  }
 ];
-var appPrefixes = { db: "HAI_DB", vecdb: "HAI_VECDB", storage: "HAI_STORAGE", ldap: "HAI_IAM_LDAP" };
+var appPrefixes = {
+  db: "HAI_DB",
+  vecdb: "HAI_VECDB",
+  storage: "HAI_STORAGE",
+  ldap: "HAI_IAM_LDAP"
+};
 function resolveComposeNamedVolumes(projectName, mounts, declarations = {}) {
   if (!Array.isArray(mounts))
     return [];
@@ -7177,7 +7568,9 @@ function createManagedSecretAssets(projectName, nativeEnvironment, compose) {
   const bindings = /* @__PURE__ */ new Set();
   const volumes = /* @__PURE__ */ new Set();
   for (const group of groups) {
-    const values = [...new Set(group.keys.flatMap((key) => native[key] === void 0 ? [] : [native[key]]))];
+    const values = [
+      ...new Set(group.keys.flatMap((key) => native[key] === void 0 ? [] : [native[key]]))
+    ];
     if (!values.length)
       continue;
     if (values.length !== 1 || !/^[\w-]{32}$/.test(values[0]))
@@ -7379,7 +7772,7 @@ function createBackendStateAssets(projectName, compose, selected) {
     const service = compose.services[serviceName];
     const image = service?.image;
     if (typeof image !== "string")
-      throw new Error(deployM("deploy_artifactInvalid"));
+      throw new TypeError(deployM("deploy_artifactInvalid"));
     const imageFamily = image.slice(image.lastIndexOf("/") + 1).split(":")[0];
     const family = imageFamily === "postgres" ? "postgresql" : imageFamily;
     const namedVolumes = resolveComposeNamedVolumes(projectName, service.volumes, compose.volumes);
@@ -7732,7 +8125,13 @@ public static class HaiCommandJob {
 }
 `;
 function powershell(script) {
-  return ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")];
+  return [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-EncodedCommand",
+    Buffer.from(script, "utf16le").toString("base64")
+  ];
 }
 function windowsCommand(command, args) {
   const name = `Local\\hai-deploy-${randomUUID()}`;
@@ -7746,7 +8145,13 @@ ${nativeJob}
   [Environment]::SetEnvironmentVariable('${key}', $null)
   exit ([HaiCommandJob]::Run([string]$inputConfig.name, [string]$inputConfig.command, [string[]]$inputConfig.args))
 } catch { [Console]::Error.WriteLine('Windows command job failed'); exit 125 }`;
-  return { name, args: powershell(script), env: { [key]: JSON.stringify({ name, command, args }) } };
+  return {
+    name,
+    args: powershell(script),
+    env: {
+      [key]: JSON.stringify({ name, command, args })
+    }
+  };
 }
 function windowsJobProbe(name) {
   return powershell(`$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $InformationPreference='SilentlyContinue'
@@ -7816,7 +8221,10 @@ function spawnCommand(command, args, options) {
   const job = process.platform === "win32" ? windowsCommand(command, args) : void 0;
   const child = spawn(job ? "powershell.exe" : command, job?.args ?? args, {
     ...options,
-    env: job ? { ...options.env, ...job.env } : options.env,
+    env: job ? {
+      ...options.env,
+      ...job.env
+    } : options.env,
     windowsHide: true,
     shell: false,
     detached: !job
@@ -7843,7 +8251,12 @@ function spawnCommand(command, args, options) {
       if (child.pid) {
         if (job) {
           if (!exited) {
-            windowsKillConfirmed = await helper("taskkill", ["/pid", String(child.pid), "/t", "/f"], Math.max(1, deadline - performance.now()));
+            windowsKillConfirmed = await helper("taskkill", [
+              "/pid",
+              String(child.pid),
+              "/t",
+              "/f"
+            ], Math.max(1, deadline - performance.now()));
             child.kill("SIGKILL");
           }
         } else {
@@ -7885,7 +8298,9 @@ function spawnCommand(command, args, options) {
 
 // src/container/deploy-secret-masker.ts
 function createSecretMasker(secrets = []) {
-  const values = [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length);
+  const values = [
+    ...new Set(secrets.filter(Boolean))
+  ].sort((a, b) => b.length - a.length);
   if (values.reduce((total, value) => total + value.length, 0) > 1048576)
     throw new RangeError("Secret redaction input is too large");
   const pattern = values.length ? new RegExp(values.map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g") : void 0;
@@ -7957,11 +8372,19 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
         throw new RangeError("Invalid command termination timeout");
       if (options.timeoutMs !== void 0 && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 2147483647))
         throw new RangeError("Invalid command timeout");
-      const secrets = [...options.secrets ?? []];
+      const secrets = [
+        ...options.secrets ?? []
+      ];
       const safeCommand = maskSecrets(command, secrets);
       const outputMasker = createSecretMasker(secrets);
       const errorMasker = createSecretMasker(secrets);
-      const control = spawnCommand(command, args, { cwd: options.cwd, env: options.env ? { ...process.env, ...options.env } : process.env });
+      const control = spawnCommand(command, args, {
+        cwd: options.cwd,
+        env: options.env ? {
+          ...process.env,
+          ...options.env
+        } : process.env
+      });
       const child = control.child;
       child.stdout.setEncoding("utf8");
       child.stderr.setEncoding("utf8");
@@ -8000,7 +8423,12 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
         try {
           await options.onOutput?.(text);
         } catch {
-          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+          await interrupt("output", deployM("deploy_commandFailed", {
+            params: {
+              command: safeCommand,
+              error: deployM("deploy_commandOutputFailed")
+            }
+          }));
         }
       };
       const captureError = (text) => {
@@ -8010,7 +8438,9 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
       if (options.timeoutMs && options.timeoutMs > 0) {
         timer = setTimeout(() => {
           logger3.error("Command timed out", { command: safeCommand, timeoutMs: options.timeoutMs });
-          void interrupt("timeout", deployM("deploy_commandTimeout", { params: { command: safeCommand } }));
+          void interrupt("timeout", deployM("deploy_commandTimeout", {
+            params: { command: safeCommand }
+          }));
         }, options.timeoutMs);
       }
       const outputTask = (async () => {
@@ -8025,7 +8455,12 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
           if (!settled && !interrupted)
             await publish(outputMasker.end());
         } catch {
-          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+          await interrupt("output", deployM("deploy_commandFailed", {
+            params: {
+              command: safeCommand,
+              error: deployM("deploy_commandOutputFailed")
+            }
+          }));
         }
       })();
       const errorTask = (async () => {
@@ -8040,16 +8475,28 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
           if (!settled && !interrupted)
             captureError(errorMasker.end());
         } catch {
-          await interrupt("output", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandOutputFailed") } }));
+          await interrupt("output", deployM("deploy_commandFailed", {
+            params: {
+              command: safeCommand,
+              error: deployM("deploy_commandOutputFailed")
+            }
+          }));
         }
       })();
       child.stdin.on("error", () => {
-        void interrupt("input", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandInputFailed") } }));
+        void interrupt("input", deployM("deploy_commandFailed", {
+          params: {
+            command: safeCommand,
+            error: deployM("deploy_commandInputFailed")
+          }
+        }));
       });
       child.on("error", (error) => {
         const safeError = maskSecrets(error.message, secrets);
         logger3.error("Command failed to start", { command: safeCommand, error: safeError });
-        void interrupt("spawn", deployM("deploy_commandFailed", { params: { command: safeCommand, error: safeError } }));
+        void interrupt("spawn", deployM("deploy_commandFailed", {
+          params: { command: safeCommand, error: safeError }
+        }));
       });
       child.on("close", async (code) => {
         await Promise.all([outputTask, errorTask]);
@@ -8058,24 +8505,52 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
         if (timer)
           clearTimeout(timer);
         if (!await control.treeExited()) {
-          await interrupt("exit", deployM("deploy_commandFailed", { params: { command: safeCommand, error: deployM("deploy_commandTreeActive") } }));
+          await interrupt("exit", deployM("deploy_commandFailed", {
+            params: {
+              command: safeCommand,
+              error: deployM("deploy_commandTreeActive")
+            }
+          }));
           return;
         }
         const exitCode = code ?? -1;
         if (exitCode === 0) {
-          finish(ok({ code: exitCode, stdout, stderr, stdoutTruncated, stderrTruncated }));
+          finish(ok({
+            code: exitCode,
+            stdout,
+            stderr,
+            stdoutTruncated,
+            stderrTruncated
+          }));
           return;
         }
-        logger3.error("Command exited with non-zero code", { command: safeCommand, code: exitCode, stderr: maskSecrets(stderr, secrets).slice(-500), stdout: maskSecrets(stdout, secrets).slice(-3e3), stdoutTruncated, stderrTruncated });
-        finish(failure(deployM("deploy_commandFailed", { params: { command: safeCommand, error: maskSecrets(`${stdout.slice(-2500)}
-${stderr || `exit ${exitCode}`}`, secrets).slice(-3e3) } }), { reason: "exit", localTermination: "confirmed" }));
+        logger3.error("Command exited with non-zero code", {
+          command: safeCommand,
+          code: exitCode,
+          stderr: maskSecrets(stderr, secrets).slice(-500),
+          stdout: maskSecrets(stdout, secrets).slice(-3e3),
+          stdoutTruncated,
+          stderrTruncated
+        });
+        finish(failure(deployM("deploy_commandFailed", {
+          params: {
+            command: safeCommand,
+            error: maskSecrets(`${stdout.slice(-2500)}
+${stderr || `exit ${exitCode}`}`, secrets).slice(-3e3)
+          }
+        }), { reason: "exit", localTermination: "confirmed" }));
       });
       if (options.input !== void 0)
         child.stdin.write(options.input);
       child.stdin.end();
     });
   } catch {
-    return failure(deployM("deploy_commandFailed", { params: { command: "<command>", error: deployM("deploy_commandExecutionFailed") } }), { reason: "configuration", localTermination: "not-started" });
+    return failure(deployM("deploy_commandFailed", {
+      params: {
+        command: "<command>",
+        error: deployM("deploy_commandExecutionFailed")
+      }
+    }), { reason: "configuration", localTermination: "not-started" });
   }
 }
 
@@ -8318,7 +8793,13 @@ printf '%s\n' "$HAI_DEPLOY_ASKPASS_PASSWORD"
 `.replaceAll("\\${", "${");
 var compileAskpassScript = "$ErrorActionPreference='Stop'; Add-Type -Language CSharp -TypeDefinition ([System.IO.File]::ReadAllText($env:HAI_DEPLOY_ASKPASS_SOURCE, [System.Text.Encoding]::UTF8)) -OutputType ConsoleApplication -OutputAssembly $env:HAI_DEPLOY_ASKPASS_OUTPUT";
 function helperFailure(key, reason = "configuration") {
-  return err({ ...HaiDeployError.REMOTE_COMMAND_FAILED, message: deployM(key), ext: { commandExecution: { reason, localTermination: "not-started" } } });
+  return err({
+    ...HaiDeployError.REMOTE_COMMAND_FAILED,
+    message: deployM(key),
+    ext: {
+      commandExecution: { reason, localTermination: "not-started" }
+    }
+  });
 }
 async function prepareSshAskpass(password, deadline, terminationTimeoutMs) {
   let directory;
@@ -8349,7 +8830,12 @@ async function prepareSshAskpass(password, deadline, terminationTimeoutMs) {
       const source = join(directory, "askpass.cs");
       writeFileSync(source, windowsAskpassSource, { mode: 384 });
       const compiler = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-      const compiled = await runCommand(compiler, ["-NoProfile", "-NonInteractive", "-Command", compileAskpassScript], {
+      const compiled = await runCommand(compiler, [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        compileAskpassScript
+      ], {
         env: { HAI_DEPLOY_ASKPASS_SOURCE: source, HAI_DEPLOY_ASKPASS_OUTPUT: helper2, HAI_DEPLOY_ASKPASS_PASSWORD: "" },
         timeoutMs: Math.max(1, Math.min(3e4, Math.ceil(deadline - performance.now()))),
         terminationTimeoutMs,
@@ -8370,7 +8856,16 @@ async function prepareSshAskpass(password, deadline, terminationTimeoutMs) {
       const removed = cleanup();
       return removed.success ? helperFailure("deploy_sshAskpassFailed", "timeout") : removed;
     }
-    return ok({ env: { SSH_ASKPASS: helper2, SSH_ASKPASS_REQUIRE: "force", SSH_ASKPASS_PROMPT: "", DISPLAY: "hai-deploy:0", HAI_DEPLOY_ASKPASS_PASSWORD: password }, cleanup });
+    return ok({
+      env: {
+        SSH_ASKPASS: helper2,
+        SSH_ASKPASS_REQUIRE: "force",
+        SSH_ASKPASS_PROMPT: "",
+        DISPLAY: "hai-deploy:0",
+        HAI_DEPLOY_ASKPASS_PASSWORD: password
+      },
+      cleanup
+    });
   } catch {
     const removed = cleanup();
     return removed.success ? helperFailure("deploy_sshAskpassFailed") : removed;
@@ -9331,7 +9826,10 @@ function usesSshPassword(config) {
 }
 function buildConnectOptions(config) {
   const password = usesSshPassword(config);
-  const args = ["-o", password ? "BatchMode=no" : "BatchMode=yes"];
+  const args = [
+    "-o",
+    password ? "BatchMode=no" : "BatchMode=yes"
+  ];
   if (password)
     args.push("-o", "PreferredAuthentications=password", "-o", "PasswordAuthentication=yes", "-o", "PubkeyAuthentication=no", "-o", "NumberOfPasswordPrompts=1");
   args.push("-o", `ConnectTimeout=${config.connectTimeoutSeconds}`);
@@ -9368,8 +9866,15 @@ function createSshExecutor(config) {
   const runAuthenticated = async (command, args, options) => {
     if (!usesSshPassword(config))
       return runCommand(command, args, options);
-    if (!config.password || options.timeoutMs !== void 0 && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 2147483647))
-      return err({ ...HaiDeployError.REMOTE_COMMAND_FAILED, message: deployM("deploy_sshPasswordInvalid"), ext: { commandExecution: { reason: "configuration", localTermination: "not-started" } } });
+    if (!config.password || options.timeoutMs !== void 0 && (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 2147483647)) {
+      return err({
+        ...HaiDeployError.REMOTE_COMMAND_FAILED,
+        message: deployM("deploy_sshPasswordInvalid"),
+        ext: {
+          commandExecution: { reason: "configuration", localTermination: "not-started" }
+        }
+      });
+    }
     const deadline = options.timeoutMs === void 0 ? Number.POSITIVE_INFINITY : performance.now() + options.timeoutMs;
     const prepared = await prepareSshAskpass(config.password, deadline, options.terminationTimeoutMs);
     if (!prepared.success)
@@ -9378,20 +9883,36 @@ function createSshExecutor(config) {
     let removed = ok(void 0);
     try {
       const remaining = deadline - performance.now();
-      result = remaining <= 0 ? err({ ...HaiDeployError.REMOTE_COMMAND_FAILED, message: deployM("deploy_sshAskpassFailed"), ext: { commandExecution: { reason: "timeout", localTermination: "not-started" } } }) : await runCommand(command, args, {
+      result = remaining <= 0 ? err({
+        ...HaiDeployError.REMOTE_COMMAND_FAILED,
+        message: deployM("deploy_sshAskpassFailed"),
+        ext: {
+          commandExecution: { reason: "timeout", localTermination: "not-started" }
+        }
+      }) : await runCommand(command, args, {
         ...options,
         env: prepared.data.env,
         timeoutMs: Number.isFinite(deadline) ? Math.ceil(remaining) : void 0,
-        secrets: [...options.secrets ?? [], config.password]
+        secrets: [
+          ...options.secrets ?? [],
+          config.password
+        ]
       });
     } catch {
-      result = err({ ...HaiDeployError.REMOTE_COMMAND_FAILED, message: deployM("deploy_sshAskpassFailed"), ext: { commandExecution: { reason: "configuration", localTermination: "unknown" } } });
+      result = err({
+        ...HaiDeployError.REMOTE_COMMAND_FAILED,
+        message: deployM("deploy_sshAskpassFailed"),
+        ext: {
+          commandExecution: { reason: "configuration", localTermination: "unknown" }
+        }
+      });
     } finally {
       removed = prepared.data.cleanup();
     }
-    if (!removed.success)
+    if (!removed.success) {
       return result.success ? removed : err({ ...result.error, message: `${result.error.message}
 ${removed.error.message}` });
+    }
     return result;
   };
   const exec = async (remoteCommand, options) => {
@@ -9405,13 +9926,31 @@ ${removed.error.message}` });
     if (result.success)
       return result;
     const state = getDeployCommandState(result.error);
-    return err({ ...result.error, suggestion: deployM("deploy_remoteUnknown"), ext: { ...result.error.ext, commandExecution: { ...state, reason: state?.reason ?? "exit", localTermination: state?.localTermination ?? "unknown", remoteExecution: "unknown" } } });
+    return err({
+      ...result.error,
+      suggestion: deployM("deploy_remoteUnknown"),
+      ext: {
+        ...result.error.ext,
+        commandExecution: {
+          ...state,
+          reason: state?.reason ?? "exit",
+          localTermination: state?.localTermination ?? "unknown",
+          remoteExecution: "unknown"
+        }
+      }
+    });
   };
   const upload = async (localPath, remotePath) => {
     const args = buildScpUploadArgs(config, localPath, remotePath);
     const result = await runAuthenticated("scp", args, { timeoutMs: 6e5 });
     if (!result.success) {
-      return err({ ...HaiDeployError.IMAGE_TRANSFER_FAILED, message: deployM("deploy_imageTransferFailed", { params: { error: result.error.message } }), ext: result.error.ext });
+      return err({
+        ...HaiDeployError.IMAGE_TRANSFER_FAILED,
+        message: deployM("deploy_imageTransferFailed", {
+          params: { error: result.error.message }
+        }),
+        ext: result.error.ext
+      });
     }
     return ok(void 0);
   };
@@ -9419,7 +9958,13 @@ ${removed.error.message}` });
     logger4.debug("SSH preflight", { host: config.host, port: config.port });
     const result = await exec("true", { timeoutMs: 2e4 });
     if (!result.success) {
-      return err({ ...HaiDeployError.REMOTE_CONNECT_FAILED, message: deployM("deploy_remoteConnectFailed", { params: { host: config.host, error: result.error.message } }), ext: result.error.ext });
+      return err({
+        ...HaiDeployError.REMOTE_CONNECT_FAILED,
+        message: deployM("deploy_remoteConnectFailed", {
+          params: { host: config.host, error: result.error.message }
+        }),
+        ext: result.error.ext
+      });
     }
     return ok(void 0);
   };
@@ -9452,8 +9997,11 @@ async function createDeploymentBundle(options) {
     const nodeRuntime = artifact.primaryService === "serv" || !!compose.services[artifact.primaryService]?.environment?.NODE_OPTIONS;
     for (const name of selected) {
       const service = compose.services[name];
-      if (!service)
-        throw new Error(deployM("deploy_selectionInvalid", { params: { service: name } }));
+      if (!service) {
+        throw new Error(deployM("deploy_selectionInvalid", {
+          params: { service: name }
+        }));
+      }
       if (typeof service.image === "string")
         references.add(service.image);
       if (service.depends_on) {
@@ -9467,12 +10015,18 @@ async function createDeploymentBundle(options) {
         service.volumes = service.volumes.map((mount) => typeof mount === "string" ? mount.replace(/^\.\/config(?=:)/, "../../../config").replace(/\.\/(web\.conf|request-access\.yml|tls|proxy-start\.sh|renew-https\.sh|runtime-env\.mjs):/g, `../../${options.deploymentId}/.hai/$1:`) : mount);
       }
     }
-    put(".hai/compose.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, compose.services[name]])) }));
+    put(".hai/compose.json", JSON.stringify({
+      ...compose,
+      services: Object.fromEntries(selected.map((name) => [name, compose.services[name]]))
+    }));
     let runtime;
     const imageList = [];
     for (const reference of references) {
-      if (!/:[^/:]+$/.test(reference) || /:latest$/i.test(reference))
-        throw new Error(deployM("deploy_imageVersionRequired", { params: { image: reference } }));
+      if (!/:[^/:]+$/.test(reference) || /:latest$/i.test(reference)) {
+        throw new Error(deployM("deploy_imageVersionRequired", {
+          params: { image: reference }
+        }));
+      }
       const built = artifact.images.find((image) => image.imageRef === reference);
       const file = built?.file ?? `middleware-${imageList.length + 1}.tar`;
       const destination = join(staging, "images", file);
@@ -9493,10 +10047,20 @@ async function createDeploymentBundle(options) {
           if (!runtime)
             throw new Error(deployM("deploy_bundleRuntimeRequired"));
         }
-        let inspected = await runCommand(runtime, ["image", "inspect", "--format", "{{.Id}}", reference]);
+        let inspected = await runCommand(runtime, [
+          "image",
+          "inspect",
+          "--format",
+          "{{.Id}}",
+          reference
+        ]);
         if (!inspected.success) {
           const download = resolveImageReference(reference, options.imageSource);
-          const pulled = await runCommand(runtime, ["pull", download], { timeoutMs: 6e5, env: proxyEnvironment, secrets: Object.values(proxyEnvironment).filter(Boolean) });
+          const pulled = await runCommand(runtime, ["pull", download], {
+            timeoutMs: 6e5,
+            env: proxyEnvironment,
+            secrets: Object.values(proxyEnvironment).filter(Boolean)
+          });
           if (!pulled.success)
             throw new Error(pulled.error.message);
           if (download !== reference) {
@@ -9504,7 +10068,13 @@ async function createDeploymentBundle(options) {
             if (!tagged.success)
               throw new Error(tagged.error.message);
           }
-          inspected = await runCommand(runtime, ["image", "inspect", "--format", "{{.Id}}", reference]);
+          inspected = await runCommand(runtime, [
+            "image",
+            "inspect",
+            "--format",
+            "{{.Id}}",
+            reference
+          ]);
         }
         const identity = inspected.success && !inspected.data.stdoutTruncated ? inspected.data.stdout.trim().replace(/^sha256:/, "") : "";
         const cacheIdentity = createHash("sha256").update(identity).update("\0").update(reference).digest("hex");
@@ -9516,7 +10086,13 @@ async function createDeploymentBundle(options) {
             checksum = copied;
         }
         if (!checksum) {
-          const saved = await runCommand(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", destination, reference], { timeoutMs: 6e5 });
+          const saved = await runCommand(runtime, [
+            "save",
+            ...runtime === "podman" ? ["--format", "docker-archive"] : [],
+            "-o",
+            destination,
+            reference
+          ], { timeoutMs: 6e5 });
           if (!saved.success)
             throw new Error(saved.error.message);
           checksum = await artifactChecksum(destination);
@@ -9558,7 +10134,12 @@ async function createDeploymentBundle(options) {
       if (file !== "https")
         put(`.hai/${file}`, content);
     }
-    const httpsFingerprint = config.expose.https ? createHash("sha256").update(JSON.stringify({ ...config.expose.https, certificateFile: void 0, privateKeyFile: void 0, certificate: options.httpsAssets?.["tls/fullchain.pem"] })).digest("hex") : "";
+    const httpsFingerprint = config.expose.https ? createHash("sha256").update(JSON.stringify({
+      ...config.expose.https,
+      certificateFile: void 0,
+      privateKeyFile: void 0,
+      certificate: options.httpsAssets?.["tls/fullchain.pem"]
+    })).digest("hex") : "";
     const backend = createBackendStateAssets(projectName, compose, selected);
     const metadata = {
       "layout": `${config.expose.hostPort}:${options.containerPort}:${options.hasWebConfig ? options.proxyService === "gateway" ? "gateway" : "true" : "false"}:${artifact.primaryService}:${options.hasWebConfig ? await artifactChecksum(join(directory, "web.conf")) : ""}${httpsFingerprint ? `:${httpsFingerprint}` : ""}
@@ -9580,31 +10161,103 @@ async function createDeploymentBundle(options) {
       // 未选应用时只带容器原生绑定，保持当前发布的应用连接归属。
       "managed-bindings": updatesApp ? managed["managed-bindings"] : managed["managed-bindings"].replace(/^.* prefix\n/gm, ""),
       "managed-volumes": managed["managed-volumes"],
-      "managed-app-keys": updatesApp ? `${[...new Set(options.managedAppKeys)].join("\n")}
+      "managed-app-keys": updatesApp ? `${[
+        ...new Set(options.managedAppKeys)
+      ].join("\n")}
 ` : "\n",
-      "unmanaged-app-keys": updatesApp ? `${[...new Set(options.unmanagedAppKeys)].join("\n")}
+      "unmanaged-app-keys": updatesApp ? `${[
+        ...new Set(options.unmanagedAppKeys)
+      ].join("\n")}
 ` : "\n",
       "state-backends": backend["state-backends"]
     };
-    put("manifest.json", `${JSON.stringify({ ...artifact, bundleFormat: 2, images: artifact.images.filter((image) => references.has(image.imageRef)), deploymentId: options.deploymentId, selectedServices: selected, partial: options.partial, metadata }, null, 2)}
+    put("manifest.json", `${JSON.stringify({
+      ...artifact,
+      bundleFormat: 2,
+      images: artifact.images.filter((image) => references.has(image.imageRef)),
+      deploymentId: options.deploymentId,
+      selectedServices: selected,
+      partial: options.partial,
+      metadata
+    }, null, 2)}
 `);
     const serverDirectory = `${config.remote.baseDir}/${projectName}`;
-    put("apply.sh", createApplyScript({ deploymentId: options.deploymentId, projectName, environment, directory: serverDirectory, runtime: config.remote.runtime, partial: options.partial, selected, primaryService: artifact.primaryService, hostPort: config.expose.hostPort, healthPaths: options.healthPaths }));
-    const instructionParams = { file: basename(output), images: [...references].join("\n") };
+    put("apply.sh", createApplyScript({
+      deploymentId: options.deploymentId,
+      projectName,
+      environment,
+      directory: serverDirectory,
+      runtime: config.remote.runtime,
+      partial: options.partial,
+      selected,
+      primaryService: artifact.primaryService,
+      hostPort: config.expose.hostPort,
+      healthPaths: options.healthPaths
+    }));
+    const instructionParams = {
+      file: basename(output),
+      images: [...references].join("\n")
+    };
     const mode = deployM(options.partial ? "deploy_bundlePartial" : "deploy_bundleFull");
-    const selection = deployM("deploy_bundleSelection", { params: { mode, services: selected.join(", ") } });
+    const selection = deployM("deploy_bundleSelection", {
+      params: {
+        mode,
+        services: selected.join(", ")
+      }
+    });
     const instructions = `${selection}
 ${deployM("deploy_bundleInstructions", { params: instructionParams })}`;
-    const runtimeGuide = deployM("deploy_bundleRuntime", { params: { directory: serverDirectory, deploymentId: options.deploymentId } });
-    const variableGuide = deployM("deploy_bundleVariables", { params: { environment, keys: Object.keys(core.config.parseEnv(applicationEnvironment)).sort().join(", ") || "\u2014" } });
+    const runtimeGuide = deployM("deploy_bundleRuntime", {
+      params: { directory: serverDirectory, deploymentId: options.deploymentId }
+    });
+    const variableGuide = deployM("deploy_bundleVariables", {
+      params: { environment, keys: Object.keys(core.config.parseEnv(applicationEnvironment)).sort().join(", ") || "\u2014" }
+    });
     const https = config.expose.https;
     const certificates = https?.type === "files" ? `${serverDirectory}/releases/${options.deploymentId}/.hai/tls` : `${serverDirectory}/https/certificates/${https?.domain}`;
-    const httpsGuide = https ? deployM("deploy_bundleHttps", { params: { domain: https.domain, port: https.port, mode: https.type, certificates, environment } }) + (https.type === "letsencrypt" ? `
-${deployM("deploy_bundleAcme", { params: { state: `${serverDirectory}/https/acme`, domain: https.domain } })}` : "") : deployM("deploy_bundleHttpOnly", { params: { port: config.expose.hostPort } });
-    const accountGuide = deployM("deploy_bundleAccounts", { params: { sources: options.accountSources || "\u2014" } });
-    const guides = [runtimeGuide, variableGuide, httpsGuide, accountGuide, deployM("deploy_bundleDirectories", { params: { directory: serverDirectory, deploymentId: options.deploymentId } })].join("\n\n");
-    const bundleMetadata = deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, deploymentId: options.deploymentId, compose: ".hai/compose.json" } });
-    const manualGuide = deployM("deploy_bundleApplyGuide", { params: { file: shellArgument(basename(output)), directory: serverDirectory, target: shellArgument(serverDirectory), runtime: config.remote.runtime, deploymentId: options.deploymentId } });
+    const httpsGuide = https ? deployM("deploy_bundleHttps", {
+      params: {
+        domain: https.domain,
+        port: https.port,
+        mode: https.type,
+        certificates,
+        environment
+      }
+    }) + (https.type === "letsencrypt" ? `
+${deployM("deploy_bundleAcme", {
+      params: { state: `${serverDirectory}/https/acme`, domain: https.domain }
+    })}` : "") : deployM("deploy_bundleHttpOnly", {
+      params: { port: config.expose.hostPort }
+    });
+    const accountGuide = deployM("deploy_bundleAccounts", {
+      params: { sources: options.accountSources || "\u2014" }
+    });
+    const guides = [
+      runtimeGuide,
+      variableGuide,
+      httpsGuide,
+      accountGuide,
+      deployM("deploy_bundleDirectories", {
+        params: { directory: serverDirectory, deploymentId: options.deploymentId }
+      })
+    ].join("\n\n");
+    const bundleMetadata = deployM("deploy_bundleMetadata", {
+      params: {
+        version: artifact.appVersion,
+        buildId: artifact.buildId,
+        deploymentId: options.deploymentId,
+        compose: ".hai/compose.json"
+      }
+    });
+    const manualGuide = deployM("deploy_bundleApplyGuide", {
+      params: {
+        file: shellArgument(basename(output)),
+        directory: serverDirectory,
+        target: shellArgument(serverDirectory),
+        runtime: config.remote.runtime,
+        deploymentId: options.deploymentId
+      }
+    });
     put("APPLY.txt", `${bundleMetadata}
 ${selection}
 
@@ -9622,7 +10275,13 @@ ${guides}
       checksums.push(`${fileHashes.get(file) ?? await artifactChecksum(join(staging, file))}  ${file}`);
     writeFileSync(join(staging, ".hai/SHA256SUMS"), `${checksums.join("\n")}
 `);
-    const tar = await runCommand("tar", [output.endsWith(".gz") ? "-czf" : "-cf", temporaryTar, "-C", staging, "."]);
+    const tar = await runCommand("tar", [
+      output.endsWith(".gz") ? "-czf" : "-cf",
+      temporaryTar,
+      "-C",
+      staging,
+      "."
+    ]);
     if (!tar.success)
       throw new Error(tar.error.message);
     chmodSync(temporaryTar, 384);
@@ -9630,7 +10289,10 @@ ${guides}
     const upload = createUploadScripts();
     const scripts = directory;
     writeFileSync(join(scripts, "deploy.sh"), upload.sh, { mode: 448 });
-    writeFileSync(join(scripts, "deploy-local.sh"), createLocalInstallScript({ bundle: basename(output), directory: serverDirectory }), { mode: 448 });
+    writeFileSync(join(scripts, "deploy-local.sh"), createLocalInstallScript({
+      bundle: basename(output),
+      directory: serverDirectory
+    }), { mode: 448 });
     writeFileSync(join(scripts, "deploy.ps1"), upload.ps1);
     writeFileSync(join(scripts, "read-target.awk"), upload.reader);
     const target = {
@@ -9662,10 +10324,18 @@ ${guides}
     writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...target, _comments: comments }, null, 2)}
 `);
     writeFileSync(join(scripts, "README.txt"), readme);
-    for (const file of [`docker-compose-${artifact.appVersion}.yml`, ".env.runtime", "middleware-runtime.env", "request-access.yml", ...options.hasWebConfig ? ["web.conf"] : []])
+    for (const file of [
+      `docker-compose-${artifact.appVersion}.yml`,
+      ".env.runtime",
+      "middleware-runtime.env",
+      "request-access.yml",
+      ...options.hasWebConfig ? ["web.conf"] : []
+    ])
       rmSync(join(directory, file), { force: true });
     return { bundlePath: output, instructions: `${selection}
-${deployM("deploy_bundleInstructions", { params: { ...instructionParams, file: output } })}
+${deployM("deploy_bundleInstructions", {
+      params: { ...instructionParams, file: output }
+    })}
 ${guides}
 ${scripts}`, startName: "apply.sh" };
   } finally {
@@ -9694,9 +10364,7 @@ function createHttpsAssets(config, projectDirectory) {
     try {
       const readPem = (file) => {
         const path = resolve(projectDirectory, file);
-        if (!statSync(path).isFile() || statSync(path).size > 1048576)
-          throw new Error("Invalid PEM file");
-        return readFileSync(path, "utf8");
+        return readLocalFile(path, { maxBytes: 1048576 }).toString("utf8");
       };
       const certificate = readPem(config.certificateFile);
       const key = readPem(config.privateKeyFile);
@@ -9889,7 +10557,21 @@ function planPostgresDb(plan, projectName, password, net) {
     restart: "unless-stopped",
     env_file: ["middleware-runtime.env"],
     volumes: [`${projectName}-db-data:/var/lib/postgresql/data`],
-    healthcheck: { test: ["CMD", "pg_isready", "-h", "127.0.0.1", "-U", "hai", "-d", "hai"], interval: "2s", timeout: "5s", retries: 60 },
+    healthcheck: {
+      test: [
+        "CMD",
+        "pg_isready",
+        "-h",
+        "127.0.0.1",
+        "-U",
+        "hai",
+        "-d",
+        "hai"
+      ],
+      interval: "2s",
+      timeout: "5s",
+      retries: 60
+    },
     networks: net
   };
   plan.volumes[`${projectName}-db-data`] = null;
@@ -9908,7 +10590,12 @@ function planMysqlDb(plan, projectName, password, net) {
     restart: "unless-stopped",
     env_file: ["middleware-runtime.env"],
     volumes: [`${projectName}-db-data:/var/lib/mysql`],
-    healthcheck: { test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --silent"], interval: "2s", timeout: "5s", retries: 60 },
+    healthcheck: {
+      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 --silent"],
+      interval: "2s",
+      timeout: "5s",
+      retries: 60
+    },
     networks: net
   };
   plan.volumes[`${projectName}-db-data`] = null;
@@ -9926,7 +10613,12 @@ function planRedisCache(plan, projectName, net) {
     image: IMAGES.redis,
     container_name: `hai-${projectName}-cache`,
     restart: "unless-stopped",
-    healthcheck: { test: ["CMD", "redis-cli", "ping"], interval: "2s", timeout: "5s", retries: 60 },
+    healthcheck: {
+      test: ["CMD", "redis-cli", "ping"],
+      interval: "2s",
+      timeout: "5s",
+      retries: 60
+    },
     networks: net
   };
   plan.env.HAI_CACHE = JSON.stringify({ type: "redis", url: "redis://cache:6379" });
@@ -9938,15 +10630,40 @@ function planS3Storage(plan, projectName, password, net, engine, configured = {}
     image: IMAGES[engine],
     container_name: `hai-${projectName}-storage`,
     restart: "unless-stopped",
-    ...engine === "minio" ? { command: ["server", "/data"] } : {},
-    healthcheck: { test: engine === "rustfs" ? ["CMD", "curl", "--noproxy", "*", "-fsS", "http://127.0.0.1:9000/minio/health/ready"] : ["CMD", "mc", "ready", "http://127.0.0.1:9000"], interval: "2s", timeout: "5s", retries: 60 },
+    ...engine === "minio" ? {
+      command: ["server", "/data"]
+    } : {},
+    healthcheck: {
+      test: engine === "rustfs" ? [
+        "CMD",
+        "curl",
+        "--noproxy",
+        "*",
+        "-fsS",
+        "http://127.0.0.1:9000/minio/health/ready"
+      ] : [
+        "CMD",
+        "mc",
+        "ready",
+        "http://127.0.0.1:9000"
+      ],
+      interval: "2s",
+      timeout: "5s",
+      retries: 60
+    },
     env_file: ["middleware-runtime.env"],
     volumes: [`${projectName}-storage-data:/data`],
     networks: net
   };
   plan.volumes[`${projectName}-storage-data`] = null;
   if (engine === "rustfs") {
-    Object.assign(plan.containerEnv, { RUSTFS_ACCESS_KEY: "hai-storage", RUSTFS_SECRET_KEY: password, RUSTFS_ADDRESS: "0.0.0.0:9000", RUSTFS_VOLUMES: "/data", RUSTFS_CONSOLE_ENABLE: "false" });
+    Object.assign(plan.containerEnv, {
+      RUSTFS_ACCESS_KEY: "hai-storage",
+      RUSTFS_SECRET_KEY: password,
+      RUSTFS_ADDRESS: "0.0.0.0:9000",
+      RUSTFS_VOLUMES: "/data",
+      RUSTFS_CONSOLE_ENABLE: "false"
+    });
   } else {
     Object.assign(plan.containerEnv, { MINIO_ROOT_USER: "hai-storage", MINIO_ROOT_PASSWORD: password });
   }
@@ -9956,7 +10673,12 @@ function planS3Storage(plan, projectName, password, net, engine, configured = {}
     bucket: configured.bucket || "hai",
     region: configured.region || "us-east-1",
     // 自建只替换连接和托管凭据，不能丢失对象前缀、外部签名地址或操作日志策略。
-    ...Object.fromEntries(["prefix", "publicEndpoint", "publicUrl", "operationLog"].filter((name) => configured[name] !== void 0).map((name) => [name, configured[name]])),
+    ...Object.fromEntries([
+      "prefix",
+      "publicEndpoint",
+      "publicUrl",
+      "operationLog"
+    ].filter((name) => configured[name] !== void 0).map((name) => [name, configured[name]])),
     accessKeyId: "hai-storage",
     secretAccessKey: password,
     forcePathStyle: true,
@@ -10081,11 +10803,30 @@ function planSidecars(_appDir, projectName, scan, provisionEnv, options, s3Engin
       const password = secrets.ldapPassword ?? secrets.dbPassword;
       plan.services.push("ldap");
       plan.dependsOn.push("ldap");
-      plan.composeServices.ldap = { image: IMAGES.ldap, restart: "unless-stopped", env_file: ["middleware-runtime.env"], networks: net, volumes: [`${projectName}-ldap-data:/var/lib/ldap`, `${projectName}-ldap-config:/etc/ldap/slapd.d`] };
+      plan.composeServices.ldap = {
+        image: IMAGES.ldap,
+        restart: "unless-stopped",
+        env_file: ["middleware-runtime.env"],
+        networks: net,
+        volumes: [`${projectName}-ldap-data:/var/lib/ldap`, `${projectName}-ldap-config:/etc/ldap/slapd.d`]
+      };
       plan.volumes[`${projectName}-ldap-data`] = null;
       plan.volumes[`${projectName}-ldap-config`] = null;
-      Object.assign(plan.containerEnv, { LDAP_DOMAIN: "example.org", LDAP_ORGANISATION: "HAI", LDAP_ADMIN_PASSWORD: password, LDAP_TLS: "false" });
-      Object.assign(plan.env, { HAI_IAM_LOGIN_LDAP: "true", HAI_IAM_LDAP: JSON.stringify({ url: "ldap://ldap:389", bindDn: "cn=admin,dc=example,dc=org", bindPassword: password, searchBase: "dc=example,dc=org" }) });
+      Object.assign(plan.containerEnv, {
+        LDAP_DOMAIN: "example.org",
+        LDAP_ORGANISATION: "HAI",
+        LDAP_ADMIN_PASSWORD: password,
+        LDAP_TLS: "false"
+      });
+      Object.assign(plan.env, {
+        HAI_IAM_LOGIN_LDAP: "true",
+        HAI_IAM_LDAP: JSON.stringify({
+          url: "ldap://ldap:389",
+          bindDn: "cn=admin,dc=example,dc=org",
+          bindPassword: password,
+          searchBase: "dc=example,dc=org"
+        })
+      });
       plan.secrets.push(password);
     } else if (service === "email" && (scan.middlewares ? scan.middlewares.some((item) => item.service === "email" && item.backend === "smtp" && (options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email ?? "default") === "default") : backends.email === "smtp") && !provisionEnv.HAI_REACH_PROVIDERS) {
       plan.services.push("email");
@@ -10093,10 +10834,25 @@ function planSidecars(_appDir, projectName, scan, provisionEnv, options, s3Engin
       plan.composeServices.email = { image: IMAGES.smtp, restart: "unless-stopped", networks: net };
       const requirements = scan.middlewares?.filter((item) => item.service === "email" && item.backend === "smtp" && ["default", void 0].includes(options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email));
       if (requirements?.length) {
-        for (const requirement of requirements)
-          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: requirement.config.from || "noreply@example.com" });
+        for (const requirement of requirements) {
+          plan.env[requirement.envPrefix] = JSON.stringify({
+            name: requirement.config.name ?? "email",
+            type: "smtp",
+            host: "email",
+            port: 1025,
+            secure: false,
+            from: requirement.config.from || "noreply@example.com"
+          });
+        }
       } else if (!scan.middlewares) {
-        plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({ name: "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+        plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({
+          name: "email",
+          type: "smtp",
+          host: "email",
+          port: 1025,
+          secure: false,
+          from: "noreply@example.com"
+        });
       }
     }
   }
@@ -10111,15 +10867,21 @@ function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort,
   const sidecar = planSidecars(appDir, projectName, scan, provisionEnv, options, s3Engine);
   const environment = options?.environment ?? appEnv.HAI_DEPLOY_ENVIRONMENT ?? "prod";
   const nodeEnv = environment === "dev" || environment === "development" ? "development" : environment === "test" ? "test" : "production";
-  const env = mergeEnvironmentLayers([{
-    NODE_ENV: nodeEnv
-  }, Object.fromEntries(Object.entries(appEnv).filter(([name]) => !CONTAINER_ENV_KEYS.has(name))), sidecar.env, provisionEnv, {
-    // 容器监听由本次制品决定，本机回环地址和开发端口不能覆盖部署拓扑。
-    HOST: "0.0.0.0",
-    PORT: String(containerPort),
-    HAI_SERV_SERVER_HOST: "0.0.0.0",
-    HAI_SERV_SERVER_PORT: String(containerPort)
-  }]);
+  const env = mergeEnvironmentLayers([
+    {
+      NODE_ENV: nodeEnv
+    },
+    Object.fromEntries(Object.entries(appEnv).filter(([name]) => !CONTAINER_ENV_KEYS.has(name))),
+    sidecar.env,
+    provisionEnv,
+    {
+      // 容器监听由本次制品决定，本机回环地址和开发端口不能覆盖部署拓扑。
+      HOST: "0.0.0.0",
+      PORT: String(containerPort),
+      HAI_SERV_SERVER_HOST: "0.0.0.0",
+      HAI_SERV_SERVER_PORT: String(containerPort)
+    }
+  ]);
   return { env, sidecar };
 }
 function generateComposeFile(options) {
@@ -10139,7 +10901,12 @@ function generateComposeFile(options) {
   };
   if (primaryService === "serv") {
     app.healthcheck = {
-      test: ["CMD", "node", "-e", "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config', configSchemas: { serv: ServConfigSchema } }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"],
+      test: [
+        "CMD",
+        "node",
+        "-e",
+        "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config', configSchemas: { serv: ServConfigSchema } }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"
+      ],
       interval: "30s",
       timeout: "5s",
       start_period: "15s",
@@ -10157,14 +10924,31 @@ function generateComposeFile(options) {
     appVolumes.push("./request-access.yml:/run/hai/request-access.yml:ro");
   if (options.web || options.gateway)
     appEnvironment.HAI_DEPLOY_PRIVATE_PROXY = "1";
+  if (nodeRuntime && primaryService === "web") {
+    if (!options.gateway)
+      throw new Error("SvelteKit SSR requires a private gateway");
+    Object.assign(appEnvironment, {
+      PROTOCOL_HEADER: "x-forwarded-proto",
+      HOST_HEADER: "host",
+      PORT_HEADER: "",
+      ADDRESS_HEADER: "x-forwarded-for",
+      XFF_DEPTH: "1"
+    });
+  }
   if (Object.keys(appEnvironment).length)
     app.environment = appEnvironment;
   if (options.mountWebConfig)
     appVolumes.push("./web.conf:/etc/nginx/conf.d/default.conf:ro");
   if (appVolumes.length)
     app.volumes = appVolumes;
-  if (sidecar.dependsOn.length > 0)
-    app.depends_on = Object.fromEntries(sidecar.dependsOn.map((name) => [name, { condition: sidecar.composeServices[name]?.healthcheck ? "service_healthy" : "service_started" }]));
+  if (sidecar.dependsOn.length > 0) {
+    app.depends_on = Object.fromEntries(sidecar.dependsOn.map((name) => [
+      name,
+      {
+        condition: sidecar.composeServices[name]?.healthcheck ? "service_healthy" : "service_started"
+      }
+    ]));
+  }
   const services = { [primaryService]: app, ...sidecar.composeServices };
   if (options.web) {
     delete app.ports;
@@ -10176,7 +10960,21 @@ function generateComposeFile(options) {
       pull_policy: "never",
       ports: [`${hostPort}:${options.web.containerPort}`],
       environment: { PUBLIC_API_BASE: "" },
-      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`], interval: "30s", timeout: "5s", retries: 3 },
+      healthcheck: {
+        test: [
+          "CMD",
+          "wget",
+          "-Y",
+          "off",
+          "-q",
+          "-O",
+          "/dev/null",
+          `http://127.0.0.1:${options.web.containerPort}/_hai/web-health`
+        ],
+        interval: "30s",
+        timeout: "5s",
+        retries: 3
+      },
       volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
       depends_on: sidecar.services.includes("storage") ? ["serv", "storage"] : ["serv"],
       networks: ["hai-app"]
@@ -10189,9 +10987,26 @@ function generateComposeFile(options) {
       container_name: `hai-${projectName}-gateway`,
       restart: "unless-stopped",
       ports: [`${hostPort}:8080`],
-      healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/_hai/gateway-health"], interval: "30s", timeout: "5s", retries: 3 },
+      healthcheck: {
+        test: [
+          "CMD",
+          "wget",
+          "-Y",
+          "off",
+          "-q",
+          "-O",
+          "/dev/null",
+          "http://127.0.0.1:8080/_hai/gateway-health"
+        ],
+        interval: "30s",
+        timeout: "5s",
+        retries: 3
+      },
       volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
-      depends_on: [primaryService, ...sidecar.services.includes("storage") ? ["storage"] : []],
+      depends_on: [
+        primaryService,
+        ...sidecar.services.includes("storage") ? ["storage"] : []
+      ],
       networks: ["hai-app"]
     };
   }
@@ -10234,7 +11049,10 @@ function generateComposeFile(options) {
   };
   if (Object.keys(sidecar.volumes).length > 0)
     compose.volumes = sidecar.volumes;
-  for (const role of [primaryService, ...options.web ? ["web"] : []]) {
+  for (const role of [
+    primaryService,
+    ...options.web ? ["web"] : []
+  ]) {
     const hosts = Object.entries(options.compose?.services[role]?.extra_hosts ?? {});
     if (hosts.length)
       services[role].extra_hosts = hosts.map(([host, ip]) => `${host}:${ip}`);
@@ -10248,12 +11066,18 @@ function generateWebProxyConfig(port, apiPrefix, options = {}) {
   const webPort = options.webPort ?? 8080;
   const webBasePath = options.webBasePath ?? "";
   const apiPath = apiPrefix.replace(/\/+$/, "");
-  const backendPaths = [...new Set(options.backendPaths ?? ["/health"])];
+  const backendPaths = [
+    ...new Set(options.backendPaths ?? ["/health"])
+  ];
   if (!/^\/[\w.-]+(?:\/[\w.-]+)*$/.test(apiPrefix) || apiPrefix.split("/").some((part) => part === "." || part === "..") || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535) || backendPaths.includes(`${webBasePath}/`) || backendPaths.some((path) => !/^\/[\w./-]*$/.test(path) || path.includes("//") || path.split("/").some((part) => part === "." || part === "..") || path === `${webBasePath}/runtime-config.js` || path === "/_hai/web-health") || webBasePath && (backendPaths.includes(webBasePath) || webBasePath === apiPath || webBasePath.startsWith(`${apiPath}/`))) {
     throw new Error("Invalid web proxy target");
   }
   const webLocation = renderWebLocation(webBasePath);
-  const storageLocation = options.storageBucket ? renderStorageLocation(options.storageBucket, [apiPath, ...backendPaths, ...options.storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]], options.storageBasePath) : "";
+  const storageLocation = options.storageBucket ? renderStorageLocation(options.storageBucket, [
+    apiPath,
+    ...backendPaths,
+    ...options.storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]
+  ], options.storageBasePath) : "";
   const backendLocations = backendPaths.map((path) => `  location = ${path} {
     proxy_pass http://hai_serv_backend;
     proxy_http_version 1.1;
@@ -10345,11 +11169,13 @@ function generateApplicationProxyConfig(options) {
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     throw new Error("Invalid application proxy target");
   const bodyLimits = resolveTransportBodyLimits(maxPlaintextBytes);
+  const trustedEdges = renderTrustedEdgeProxies(options.trustedEdgeProxies);
+  const forwardedProtocol = options.trustedEdgeProxies?.length ? "$hai_request_scheme" : "$scheme";
   return `include /tmp/hai-dns.conf;
-${renderResolvedUpstream("hai_application_backend", primaryService, port)}${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
+${renderResolvedUpstream("hai_application_backend", primaryService, port)}${renderTrustedEdgeProtocol(options.trustedEdgeProxies)}${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
   listen 8080;
   server_name _;
-${renderTrustedEdgeProxies(options.trustedEdgeProxies)}  large_client_header_buffers 4 32k;
+${trustedEdges}  large_client_header_buffers 4 32k;
 ${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath) : ""}  location = /_hai/gateway-health {
     access_log off;
     return 200 'ok';
@@ -10359,8 +11185,11 @@ ${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath)
     proxy_pass http://hai_application_backend;
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;
-    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Proto ${forwardedProtocol};
     proxy_set_header Connection "";
+    proxy_set_header X-Forwarded-Host $http_host;
+    proxy_set_header X-Forwarded-Port "";
+    proxy_set_header Forwarded "";
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_request_buffering off;
@@ -10388,6 +11217,20 @@ function renderTrustedEdgeProxies(entries = []) {
   real_ip_recursive on;
 `;
 }
+function renderTrustedEdgeProtocol(entries = []) {
+  if (!entries.length)
+    return "";
+  return `geo $realip_remote_addr $hai_trusted_edge {
+  default 0;
+${entries.map((entry) => `  ${entry} 1;`).join("\n")}
+}
+map "$hai_trusted_edge:$http_x_forwarded_proto" $hai_request_scheme {
+  default $scheme;
+  "1:http" http;
+  "1:https" https;
+}
+`;
+}
 function renderWebLocation(webBasePath) {
   if (webBasePath && (!/^\/[\w.-]+(?:\/[\w.-]+)*$/.test(webBasePath) || webBasePath.split("/").some((segment) => segment === "." || segment === "..") || ["/health", "/_hai/web-health"].includes(webBasePath)))
     throw new Error("Invalid web base path");
@@ -10443,8 +11286,13 @@ function prepareRequestAccess(options) {
   if (!scope || typeof scope !== "object" || !("access" in scope))
     return ok({ settings: options.settings });
   const configured = RequestAccessConfigSchema.safeParse(scope.access);
-  if (!configured.success)
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_requestAccessInvalid", { params: { field: options.module === "serv" ? "serv.http.access" : "kit.access" } }));
+  if (!configured.success) {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_requestAccessInvalid", {
+      params: {
+        field: options.module === "serv" ? "serv.http.access" : "kit.access"
+      }
+    }));
+  }
   try {
     const policy = core.access.loadPolicy(configured.data, options.directory);
     const check = core.access.createRequestCheck(policy);
@@ -10453,10 +11301,20 @@ function prepareRequestAccess(options) {
     if (configured.data === false || !("file" in configured.data))
       return ok({ settings: options.settings });
     const access = { file: "/run/hai/request-access.yml" };
-    const settings = options.module === "serv" ? { ...options.settings, http: { ...scope, access } } : { ...options.settings, access };
-    return ok({ settings, snapshot: stringify(policy, { aliasDuplicateObjects: false }) });
+    const settings = options.module === "serv" ? {
+      ...options.settings,
+      http: { ...scope, access }
+    } : { ...options.settings, access };
+    return ok({
+      settings,
+      snapshot: stringify(policy, { aliasDuplicateObjects: false })
+    });
   } catch {
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_requestAccessInvalid", { params: { field: options.module === "serv" ? "serv.http.access" : "kit.access" } }));
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_requestAccessInvalid", {
+      params: {
+        field: options.module === "serv" ? "serv.http.access" : "kit.access"
+      }
+    }));
   }
 }
 var HEALTH_MAX_ATTEMPTS = 40;
@@ -10475,10 +11333,25 @@ function endpointSettings(value) {
 }
 var ServerResultSchema = z.object({
   deploymentId: z.string(),
-  stage: z.enum(["preflight", "credentials", "recover", "images", "dependencies", "start", "https", "health", "complete"]),
+  stage: z.enum([
+    "preflight",
+    "credentials",
+    "recover",
+    "images",
+    "dependencies",
+    "start",
+    "https",
+    "health",
+    "complete"
+  ]),
   exitCode: z.number().int().min(0).max(255),
   durationSeconds: z.number().int().nonnegative(),
-  recoveryStatus: z.enum(["not-needed", "passed", "failed", "stopped"]).optional()
+  recoveryStatus: z.enum([
+    "not-needed",
+    "passed",
+    "failed",
+    "stopped"
+  ]).optional()
 });
 function makeDeploymentId() {
   return `${core.time.formatDate(/* @__PURE__ */ new Date(), "YYYYMMDD-HHmmss")}-${randomBytes(3).toString("hex")}`;
@@ -10505,7 +11378,11 @@ function createDockerSshProvider(config, container) {
     }
     return err(
       HaiDeployError.REMOTE_COMMAND_FAILED,
-      deployM("deploy_remoteRuntimeMissing", { params: { runtime: candidates.join(" / ") } })
+      deployM("deploy_remoteRuntimeMissing", {
+        params: {
+          runtime: candidates.join(" / ")
+        }
+      })
     );
   }
   async function healthCheck(url, certificate) {
@@ -10513,7 +11390,10 @@ function createDockerSshProvider(config, container) {
       try {
         if (certificate) {
           const healthy = await new Promise((resolve9) => {
-            const request$1 = request(url, { ca: [...rootCertificates, certificate], timeout: 5e3 }, (response) => {
+            const request$1 = request(url, {
+              ca: [...rootCertificates, certificate],
+              timeout: 5e3
+            }, (response) => {
               response.resume();
               resolve9(response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300);
             });
@@ -10525,7 +11405,9 @@ function createDockerSshProvider(config, container) {
           if (healthy)
             return true;
         } else {
-          const response = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+          const response = await fetch(url, {
+            signal: AbortSignal.timeout(5e3)
+          });
           await response.body?.cancel();
           if (response.ok)
             return true;
@@ -10550,10 +11432,16 @@ function createDockerSshProvider(config, container) {
     const primaryService = artifact.primaryService;
     const app = images.find((image) => image.name === primaryService);
     if (options?.selectedServices) {
-      const available = [...images.map((image) => image.name), ...scan.requiredServices];
+      const available = [
+        ...images.map((image) => image.name),
+        ...scan.requiredServices
+      ];
       const invalid = options.selectedServices.find((name2) => !available.includes(name2));
-      if (!options.selectedServices.length || new Set(options.selectedServices).size !== options.selectedServices.length || invalid)
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: invalid ?? options.selectedServices.join(", ") } }));
+      if (!options.selectedServices.length || new Set(options.selectedServices).size !== options.selectedServices.length || invalid) {
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", {
+          params: { service: invalid ?? options.selectedServices.join(", ") }
+        }));
+      }
     }
     const hasWebProxy = primaryService === "serv" && artifact.hasWeb;
     const partial = artifact.partial || options?.selectedServices !== void 0;
@@ -10568,14 +11456,12 @@ function createDockerSshProvider(config, container) {
     const plannedRuntime = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
     const { sidecar } = plannedRuntime;
     let { env } = plannedRuntime;
-    if (https && scan.isSvelteKit && !env.ORIGIN)
-      env.ORIGIN = url;
     const managedStorage = sidecar.services.includes("storage") ? JSON.parse(sidecar.env.HAI_STORAGE) : void 0;
     let storageBasePath = "";
     if (managedStorage?.publicEndpoint !== void 0) {
       try {
         if (typeof managedStorage.publicEndpoint !== "string")
-          throw new Error("Invalid public endpoint type");
+          throw new TypeError("Invalid public endpoint type");
         const unsafeCharacters = /[\u0000-\u0020\u007F\\%]/.test(managedStorage.publicEndpoint);
         const endpoint = new URL(managedStorage.publicEndpoint);
         if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || !/^\/(?:[\w.-]+(?:\/[\w.-]+)*\/?)?$/.test(endpoint.pathname) || unsafeCharacters || /(?:^|\/)\.{1,2}(?:\/|$)/.test(managedStorage.publicEndpoint)) {
@@ -10587,7 +11473,7 @@ function createDockerSshProvider(config, container) {
       }
     }
     const storageRouting = managedStorage ? createHash("sha256").update(JSON.stringify({ ...managedStorage, secretAccessKey: void 0 })).digest("hex") : "";
-    const gateway = !hasWebProxy && (!!managedStorage || !!https && !standaloneWebConfig);
+    const gateway = !hasWebProxy && (scan.isSvelteKit || !!managedStorage || !!https && !standaloneWebConfig);
     if (gateway && primaryService === "web" && !scan.isSvelteKit)
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageBackendRequired"));
     const proxyService = gateway ? "gateway" : "web";
@@ -10649,8 +11535,14 @@ function createDockerSshProvider(config, container) {
         return prepared2;
       Object.assign(server.data, prepared2.data.settings);
       requestAccessSnapshot = prepared2.data.snapshot;
-      if (requestAccessSnapshot)
-        env = mergeEnvironmentLayers([env, { HAI_SERV: JSON.stringify(server.data) }]);
+      if (requestAccessSnapshot) {
+        env = mergeEnvironmentLayers([
+          env,
+          {
+            HAI_SERV: JSON.stringify(server.data)
+          }
+        ]);
+      }
     }
     let feedbackTransportBytes;
     if (scan.haiModules?.includes("@h-ai/feedback")) {
@@ -10676,8 +11568,14 @@ function createDockerSshProvider(config, container) {
           return prepared2;
         Object.assign(kit.data, prepared2.data.settings);
         requestAccessSnapshot = prepared2.data.snapshot;
-        if (requestAccessSnapshot)
-          env = mergeEnvironmentLayers([env, { HAI_KIT: JSON.stringify(kit.data) }]);
+        if (requestAccessSnapshot) {
+          env = mergeEnvironmentLayers([
+            env,
+            {
+              HAI_KIT: JSON.stringify(kit.data)
+            }
+          ]);
+        }
       }
       const transport = kit.data.transport;
       if (transport && typeof transport === "object") {
@@ -10693,8 +11591,13 @@ function createDockerSshProvider(config, container) {
         }
       }
     }
-    if (updatesApp && protectedTransport && scan.haiModules?.includes("@h-ai/crypto") && !parseTransportServerKeyRing(env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING).success)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_transportKeyRingInvalid", { params: { path: join(scan.envDir ?? appDir, `.env.${options?.environment ?? "prod"}.local`) } }));
+    if (updatesApp && protectedTransport && scan.haiModules?.includes("@h-ai/crypto") && !parseTransportServerKeyRing(env.HAI_CRYPTO_TRANSPORT_SERVERKEYRING).success) {
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_transportKeyRingInvalid", {
+        params: {
+          path: join(scan.envDir ?? appDir, `.env.${options?.environment ?? "prod"}.local`)
+        }
+      }));
+    }
     let webProxy;
     if (hasWebProxy) {
       const http = server.data.http;
@@ -10709,11 +11612,30 @@ function createDockerSshProvider(config, container) {
       try {
         const configured = transport ? transport.maxPlaintextBytes : void 0;
         const limits = resolveTransportBodyLimits(Math.max(createTransportBodyPolicy(configured === "auto" ? void 0 : configured, transport ? transport.routePlaintextBytes : void 0).maximum.plaintextBytes, feedbackTransportBytes ?? 0));
-        webProxy = generateWebProxyConfig(containerPort, apiPrefix, { webPort: webContainerPort, maxPlaintextBytes: limits.plaintextBytes, webBasePath, backendPaths, storageBucket: managedStorage?.bucket, storageBasePath, trustedEdgeProxies: config.trustedEdgeProxies });
+        webProxy = generateWebProxyConfig(containerPort, apiPrefix, {
+          webPort: webContainerPort,
+          maxPlaintextBytes: limits.plaintextBytes,
+          webBasePath,
+          backendPaths,
+          storageBucket: managedStorage?.bucket,
+          storageBasePath,
+          trustedEdgeProxies: config.trustedEdgeProxies
+        });
       } catch (error) {
         return err(HaiDeployError.CONFIG_ERROR, error instanceof RangeError ? error.message : deployM(managedStorage ? "deploy_storageProxyInvalid" : "deploy_transportBodyLimitInvalid"));
       }
-      env = mergeEnvironmentLayers([env, { HAI_SERV: JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && (config.ssh || https) ? url : cors?.origin ?? "*" } }) }]);
+      env = mergeEnvironmentLayers([
+        env,
+        {
+          HAI_SERV: JSON.stringify({
+            ...server.data,
+            cors: {
+              ...cors,
+              origin: (!cors?.origin || cors.origin === "*") && (config.ssh || https) ? url : cors?.origin ?? "*"
+            }
+          })
+        }
+      ]);
     } else if (gateway) {
       try {
         const http = server.data.http;
@@ -10721,7 +11643,18 @@ function createDockerSshProvider(config, container) {
           const transport = server.data.transport;
           applicationPlaintextBytes = Math.max(createTransportBodyPolicy(transport?.maxPlaintextBytes === "auto" ? void 0 : transport?.maxPlaintextBytes, transport?.routePlaintextBytes).maximum.plaintextBytes, feedbackTransportBytes ?? 0);
         }
-        webProxy = generateApplicationProxyConfig({ primaryService, port: containerPort, bucket: managedStorage?.bucket, storageBasePath, reservedPaths: [http?.apiPrefix ?? "/api/v1", ...storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]], maxPlaintextBytes: applicationPlaintextBytes, trustedEdgeProxies: config.trustedEdgeProxies });
+        webProxy = generateApplicationProxyConfig({
+          primaryService,
+          port: containerPort,
+          bucket: managedStorage?.bucket,
+          storageBasePath,
+          reservedPaths: [
+            http?.apiPrefix ?? "/api/v1",
+            ...storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]
+          ],
+          maxPlaintextBytes: applicationPlaintextBytes,
+          trustedEdgeProxies: config.trustedEdgeProxies
+        });
       } catch {
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageProxyInvalid"));
       }
@@ -10730,11 +11663,23 @@ function createDockerSshProvider(config, container) {
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webBaseConflict"));
       webProxy = generateStaticWebConfig(containerPort, webBasePath);
     }
-    if (https && webProxy)
+    if (https && webProxy) {
       webProxy = renderHttpsProxy(webProxy, https, hasWebProxy ? webContainerPort : gateway ? 8080 : containerPort);
+    }
     if (https && primaryService === "serv" && !hasWebProxy) {
       const cors = server.data.cors;
-      env = mergeEnvironmentLayers([env, { HAI_SERV: JSON.stringify({ ...server.data, cors: { ...cors, origin: !cors?.origin || cors.origin === "*" ? url : cors.origin } }) }]);
+      env = mergeEnvironmentLayers([
+        env,
+        {
+          HAI_SERV: JSON.stringify({
+            ...server.data,
+            cors: {
+              ...cors,
+              origin: !cors?.origin || cors.origin === "*" ? url : cors.origin
+            }
+          })
+        }
+      ]);
     }
     const requestedOutput = options?.output ?? join(deploymentRoot, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar.gz`);
     const compressed = requestedOutput.endsWith(".tar.gz");
@@ -10744,20 +11689,43 @@ function createDockerSshProvider(config, container) {
     if (!/^[\w.+-]+$/.test(name))
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleNameInvalid"));
     const artifactDir = resolve(dirname(requestedOutput), name);
-    if (existsSync(artifactDir))
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleDirectoryExists", { params: { path: artifactDir } }));
+    if (existsSync(artifactDir)) {
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_bundleDirectoryExists", {
+        params: { path: artifactDir }
+      }));
+    }
     mkdirSync(dirname(artifactDir), { recursive: true, mode: 448 });
     mkdirSync(artifactDir, { mode: 448 });
     chmodSync(artifactDir, 448);
     const envPath = join(artifactDir, ".env.runtime");
     const nodeRuntime = primaryService === "serv" || scan.isSvelteKit;
     const startupOverrides = nodeRuntime ? { NODE_OPTIONS: "", HAI_DEPLOY_PRIVATE_PROXY: "" } : {};
+    if (scan.isSvelteKit) {
+      for (const name2 of [
+        "ORIGIN",
+        "PROTOCOL_HEADER",
+        "HOST_HEADER",
+        "PORT_HEADER",
+        "ADDRESS_HEADER",
+        "XFF_DEPTH"
+      ])
+        startupOverrides[name2] = "";
+    }
     const runtimeEnvironment = serializeEnvFile(env, startupOverrides, nodeRuntime ? "node" : "compose");
-    const envVarsSet = [.../* @__PURE__ */ new Set([
-      ...Object.keys(parseEnv(runtimeEnvironment)),
-      ...nodeRuntime ? ["NODE_OPTIONS"] : [],
-      ...hasWebProxy || gateway ? ["HAI_DEPLOY_PRIVATE_PROXY"] : []
-    ])];
+    const envVarsSet = [
+      .../* @__PURE__ */ new Set([
+        ...Object.keys(parseEnv(runtimeEnvironment)),
+        ...nodeRuntime ? ["NODE_OPTIONS"] : [],
+        ...hasWebProxy || gateway ? ["HAI_DEPLOY_PRIVATE_PROXY"] : [],
+        ...scan.isSvelteKit ? [
+          "PROTOCOL_HEADER",
+          "HOST_HEADER",
+          "PORT_HEADER",
+          "ADDRESS_HEADER",
+          "XFF_DEPTH"
+        ] : []
+      ])
+    ];
     writeFileSync(envPath, runtimeEnvironment, { mode: 384 });
     if (requestAccessSnapshot)
       writeFileSync(join(artifactDir, "request-access.yml"), requestAccessSnapshot, { mode: 384 });
@@ -10766,7 +11734,12 @@ function createDockerSshProvider(config, container) {
       const environment = loadDeploymentEnvironment({ environment: options.environment, envDir: options.envDir ?? scan.envDir ?? appDir });
       if (!environment.success)
         return environment;
-      const saved = saveDeploymentEnvironment(environment.data, { HAI_DEPLOY_ENVIRONMENT: environment.data.environment, HAI_CORE_ENV: environment.data.values.HAI_CORE_ENV, ...sidecar.env, ...provisionEnv });
+      const saved = saveDeploymentEnvironment(environment.data, {
+        HAI_DEPLOY_ENVIRONMENT: environment.data.environment,
+        HAI_CORE_ENV: environment.data.values.HAI_CORE_ENV,
+        ...sidecar.env,
+        ...provisionEnv
+      });
       if (!saved.success)
         return saved;
     }
@@ -10792,16 +11765,27 @@ function createDockerSshProvider(config, container) {
     writeFileSync(composePath, composeContent);
     if (webProxy)
       writeFileSync(join(artifactDir, "web.conf"), webProxy);
-    const selected = options?.selectedServices ? [...options.selectedServices] : artifact.partial ? images.map((image) => image.name) : [...images.map((image) => image.name), ...Object.keys(sidecar.composeServices)];
+    const selected = options?.selectedServices ? [...options.selectedServices] : artifact.partial ? images.map((image) => image.name) : [
+      ...images.map((image) => image.name),
+      ...Object.keys(sidecar.composeServices)
+    ];
     if (gateway && !partial)
       selected.push("gateway");
     if (https?.type === "letsencrypt" && !partial)
       selected.push("certbot");
-    if (!selected.length || selected.some((name2) => !/^[a-z][a-z0-9-]*$/.test(name2)) || new Set(selected).size !== selected.length)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: selected.join(", ") } }));
+    if (!selected.length || selected.some((name2) => !/^[a-z][a-z0-9-]*$/.test(name2)) || new Set(selected).size !== selected.length) {
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", {
+        params: {
+          service: selected.join(", ")
+        }
+      }));
+    }
     for (const name2 of selected) {
-      if (["serv", "web"].includes(name2) && !images.some((image) => image.name === name2))
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: name2 } }));
+      if (["serv", "web"].includes(name2) && !images.some((image) => image.name === name2)) {
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", {
+          params: { service: name2 }
+        }));
+      }
     }
     options?.onProgress?.("packaging");
     const bundle = await createDeploymentBundle({
@@ -10823,14 +11807,28 @@ function createDockerSshProvider(config, container) {
       containerPort,
       managedAppKeys: Object.keys(sidecar.env),
       unmanagedAppKeys: scan.middlewares?.filter((item) => !Object.hasOwn(sidecar.env, item.envPrefix)).map((item) => item.envPrefix),
-      accountSources: describeDeploymentVariableSources(options?.envDir ?? scan.envDir ?? appDir, options?.environment ?? "prod", env, ["HAI_ADMIN_DEFAULT_PASSWORD", "HAI_AUDIT_ADMIN_PASSWORD", "HAI_CONFIG_ADMIN_PASSWORD", "HAI_BUSINESS_OPERATOR_PASSWORD"]),
+      accountSources: describeDeploymentVariableSources(options?.envDir ?? scan.envDir ?? appDir, options?.environment ?? "prod", env, [
+        "HAI_ADMIN_DEFAULT_PASSWORD",
+        "HAI_AUDIT_ADMIN_PASSWORD",
+        "HAI_CONFIG_ADMIN_PASSWORD",
+        "HAI_BUSINESS_OPERATOR_PASSWORD"
+      ]),
       healthPaths,
       httpsAssets,
       output: join(artifactDir, `${name}.tar${compressed ? ".gz" : ""}`),
       cacheDirectory: join(resolveProjectDirectory(appDir), ".hai", "cache", "images")
     });
-    if (options?.bundleOnly)
-      return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet, ...bundle });
+    if (options?.bundleOnly) {
+      return ok({
+        url: "",
+        deploymentId,
+        status: "packaged",
+        provider: "docker-ssh",
+        healthCheck: "skipped",
+        envVarsSet,
+        ...bundle
+      });
+    }
     if (!ssh)
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
     const ping = await ssh.ping();
@@ -10850,19 +11848,23 @@ function createDockerSshProvider(config, container) {
     let pendingOutput = "";
     const started = await ssh.exec(
       `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)} && { rm -rf -- ${shellArgument(`${remoteTar}.contents`)} && rm -f -- ${shellArgument(remoteTar)} || printf '[WARN] Deployment passed; incoming archive cleanup failed\\n' >&2; }`,
-      { timeoutMs: 6e5, secrets: sidecar.secrets, onOutput: (output) => {
-        const parts = output.split("\n");
-        for (let index = 0; index < parts.length; index++) {
-          pendingOutput += parts[index].slice(0, 512 - pendingOutput.length);
-          if (index === parts.length - 1)
-            break;
-          const line = pendingOutput;
-          pendingOutput = "";
-          const stage = /^\[(preflight|images|dependencies|start|https|health|complete)\]/.exec(line)?.[1];
-          if (stage)
-            options?.onProgress?.(stage);
+      {
+        timeoutMs: 6e5,
+        secrets: sidecar.secrets,
+        onOutput: (output) => {
+          const parts = output.split("\n");
+          for (let index = 0; index < parts.length; index++) {
+            pendingOutput += parts[index].slice(0, 512 - pendingOutput.length);
+            if (index === parts.length - 1)
+              break;
+            const line = pendingOutput;
+            pendingOutput = "";
+            const stage = /^\[(preflight|images|dependencies|start|https|health|complete)\]/.exec(line)?.[1];
+            if (stage)
+              options?.onProgress?.(stage);
+          }
         }
-      } }
+      }
     );
     if (!started.success) {
       const resultFile = `${remoteDir}/result-${deploymentId}.json`;
@@ -10877,16 +11879,34 @@ function createDockerSshProvider(config, container) {
         } catch {
         }
       }
-      return err({ ...started.error, message: `${started.error.message}
-${terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage, code: String(terminal.exitCode) } }) : deployM("deploy_remoteUnknown")}`, suggestion: terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage, code: String(terminal.exitCode) } }) : deployM("deploy_remoteUnknown"), ext: { ...started.error.ext, commandExecution: {
-        ...state,
-        reason: state?.reason ?? "exit",
-        localTermination: state?.localTermination ?? "unknown",
-        remoteExecution: terminal ? "finished" : "unknown",
-        deploymentId,
-        resultFile,
-        ...terminal ? { remoteExitCode: terminal.exitCode, remoteStage: terminal.stage, remoteRecovery: terminal.recoveryStatus } : {}
-      } } });
+      return err({
+        ...started.error,
+        message: `${started.error.message}
+${terminal ? deployM("deploy_remoteFinished", {
+          params: {
+            stage: terminal.stage,
+            code: String(terminal.exitCode)
+          }
+        }) : deployM("deploy_remoteUnknown")}`,
+        suggestion: terminal ? deployM("deploy_remoteFinished", {
+          params: {
+            stage: terminal.stage,
+            code: String(terminal.exitCode)
+          }
+        }) : deployM("deploy_remoteUnknown"),
+        ext: {
+          ...started.error.ext,
+          commandExecution: {
+            ...state,
+            reason: state?.reason ?? "exit",
+            localTermination: state?.localTermination ?? "unknown",
+            remoteExecution: terminal ? "finished" : "unknown",
+            deploymentId,
+            resultFile,
+            ...terminal ? { remoteExitCode: terminal.exitCode, remoteStage: terminal.stage, remoteRecovery: terminal.recoveryStatus } : {}
+          }
+        }
+      });
     }
     logger5.info("Running health check", { url: applicationUrl });
     let healthy = true;
@@ -10898,16 +11918,24 @@ ${terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage,
     }
     if (!healthy) {
       return err(
-        { ...HaiDeployError.HEALTH_CHECK_FAILED, message: deployM("deploy_healthCheckFailed", { params: { url: applicationUrl } }), ext: { commandExecution: {
-          reason: "exit",
-          localTermination: "confirmed",
-          remoteExecution: "finished",
-          deploymentId,
-          resultFile: `${remoteDir}/result-${deploymentId}.json`,
-          remoteExitCode: 0,
-          remoteStage: "complete",
-          remoteRecovery: "not-needed"
-        } } }
+        {
+          ...HaiDeployError.HEALTH_CHECK_FAILED,
+          message: deployM("deploy_healthCheckFailed", {
+            params: { url: applicationUrl }
+          }),
+          ext: {
+            commandExecution: {
+              reason: "exit",
+              localTermination: "confirmed",
+              remoteExecution: "finished",
+              deploymentId,
+              resultFile: `${remoteDir}/result-${deploymentId}.json`,
+              remoteExitCode: 0,
+              remoteStage: "complete",
+              remoteRecovery: "not-needed"
+            }
+          }
+        }
       );
     }
     const result = {
@@ -10929,11 +11957,16 @@ ${terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage,
       const reason = error instanceof Error ? error.message : String(error);
       let safeReason = "Deployment bundle failed";
       try {
-        safeReason = maskSecrets(reason, [...Object.values(context.appEnv ?? {}), config.ssh?.password ?? ""].filter(Boolean));
+        safeReason = maskSecrets(reason, [
+          ...Object.values(context.appEnv ?? {}),
+          config.ssh?.password ?? ""
+        ].filter(Boolean));
       } catch {
       }
       logger5.error("Deployment bundle failed", { reason: safeReason });
-      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", { params: { reason: safeReason } }));
+      return err(HaiDeployError.DEPLOY_FAILED, deployM("deploy_bundleFailed", {
+        params: { reason: safeReason }
+      }));
     }
   };
   return { name: "docker-ssh", deploy: deploySafely };
@@ -10944,7 +11977,12 @@ var POLL_INTERVAL = 3e3;
 var MAX_POLL_ATTEMPTS = 60;
 var VercelApiError = class extends Error {
   constructor(status) {
-    super(deployM("deploy_apiError", { params: { service: "Vercel", status: String(status) } }));
+    super(deployM("deploy_apiError", {
+      params: {
+        service: "Vercel",
+        status: String(status)
+      }
+    }));
     this.status = status;
   }
   status;
@@ -10953,7 +11991,9 @@ function toDeployError(codeDef, messageKey, error) {
   return {
     ...codeDef,
     message: deployM(messageKey, {
-      params: { error: error instanceof Error ? error.message : String(error) }
+      params: {
+        error: error instanceof Error ? error.message : String(error)
+      }
     }),
     cause: error
   };
@@ -11163,7 +12203,11 @@ async function uploadFile(token, content, sha) {
     body: new Blob([uploadContent])
   });
   if (!response.ok && response.status !== 409) {
-    throw new Error(deployM("deploy_fileUploadFailed", { params: { status: String(response.status) } }));
+    throw new Error(deployM("deploy_fileUploadFailed", {
+      params: {
+        status: String(response.status)
+      }
+    }));
   }
 }
 async function pollDeploymentStatus(token, deploymentId) {
@@ -11196,7 +12240,9 @@ function createAliyunProvisioner() {
         const akId = credentials.accessKeyId ?? credentials.access_key_id ?? credentials.access_key ?? "";
         const akSecret = credentials.accessKeySecret ?? credentials.access_key_secret ?? credentials.secret_key ?? "";
         if (!akId || !akSecret || !credentials.signName) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "accessKeyId, accessKeySecret, signName" } }));
+          throw new Error(deployM("deploy_credentialMissing", {
+            params: { fields: "accessKeyId, accessKeySecret, signName" }
+          }));
         }
         accessKey = akId;
         secretKey = akSecret;
@@ -11208,7 +12254,9 @@ function createAliyunProvisioner() {
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
-            params: { error: error instanceof Error ? error.message : String(error) }
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
           }),
           error
         );
@@ -11227,7 +12275,15 @@ function createAliyunProvisioner() {
         provisionerName: "aliyun",
         resourceStatus: "reused",
         envVars: {
-          HAI_REACH_PROVIDERS: JSON.stringify([{ name: "sms", type: "aliyun-sms", accessKeyId: accessKey, accessKeySecret: secretKey, signName }])
+          HAI_REACH_PROVIDERS: JSON.stringify([
+            {
+              name: "sms",
+              type: "aliyun-sms",
+              accessKeyId: accessKey,
+              accessKeySecret: secretKey,
+              signName
+            }
+          ])
         },
         resourceInfo: "aliyun:verify-only"
       });
@@ -11249,7 +12305,12 @@ async function neonFetch(token, path, options) {
     }
   });
   if (!response.ok) {
-    throw new Error(deployM("deploy_apiError", { params: { service: "Neon", status: String(response.status) } }));
+    throw new Error(deployM("deploy_apiError", {
+      params: {
+        service: "Neon",
+        status: String(response.status)
+      }
+    }));
   }
   return response.json();
 }
@@ -11269,10 +12330,14 @@ async function getNeonConnectionUri(token, projectId) {
   const data = await neonFetch(
     token,
     `/projects/${projectId}/connection_uri?${query.toString()}`,
-    { headers: { "Content-Type": "application/json" } }
+    {
+      headers: { "Content-Type": "application/json" }
+    }
   );
   if (!data.uri) {
-    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
+    throw new Error(deployM("deploy_provisionNoResult", {
+      params: { service: "Neon" }
+    }));
   }
   return data.uri;
 }
@@ -11282,7 +12347,11 @@ function buildNeonProvisionResult(projectId, connectionUri, resourceStatus) {
     provisionerName: "neon",
     resourceStatus,
     envVars: {
-      HAI_DB: JSON.stringify({ type: "postgresql", url: connectionUri, database: decodeURIComponent(new URL(connectionUri).pathname.slice(1)) })
+      HAI_DB: JSON.stringify({
+        type: "postgresql",
+        url: connectionUri,
+        database: decodeURIComponent(new URL(connectionUri).pathname.slice(1))
+      })
     },
     resourceInfo: `neon-project:${projectId}`
   };
@@ -11297,7 +12366,9 @@ function createNeonProvisioner() {
       try {
         const apiToken = credentials.apiKey ?? credentials.token ?? credentials.api_key ?? "";
         if (!apiToken) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "token" } }));
+          throw new Error(deployM("deploy_credentialMissing", {
+            params: { fields: "token" }
+          }));
         }
         await listNeonProjects(apiToken);
         token = apiToken;
@@ -11308,7 +12379,9 @@ function createNeonProvisioner() {
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
-            params: { error: error instanceof Error ? error.message : String(error) }
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
           }),
           error
         );
@@ -11349,7 +12422,9 @@ function createNeonProvisioner() {
           resource = { resourceInfo: `neon-project:${projectId}`, resourceStatus: "created" };
         const connectionUri = data.connection_uris?.[0]?.connection_uri ?? "";
         if (!projectId || !connectionUri) {
-          throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
+          throw new Error(deployM("deploy_provisionNoResult", {
+            params: { service: "Neon" }
+          }));
         }
         logger8.info("Neon database provisioned", { projectId });
         return ok(buildNeonProvisionResult(projectId, connectionUri, "created"));
@@ -11359,7 +12434,9 @@ function createNeonProvisioner() {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
             stage: "provision:db",
-            resources: [{ serviceType: "db", provisionerName: "neon", ...resource }]
+            resources: [
+              { serviceType: "db", provisionerName: "neon", ...resource }
+            ]
           });
         }
         return err(
@@ -11392,13 +12469,20 @@ function createR2Provisioner() {
         const acctId = credentials.accountId ?? credentials.account_id ?? "";
         const apiTok = credentials.apiToken ?? credentials.api_token ?? credentials.token ?? "";
         if (!acctId || !apiTok || !credentials.accessKeyId || !credentials.secretAccessKey) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "accountId, apiToken, accessKeyId, secretAccessKey" } }));
+          throw new Error(deployM("deploy_credentialMissing", {
+            params: { fields: "accountId, apiToken, accessKeyId, secretAccessKey" }
+          }));
         }
         const res = await fetch(`${CF_API}/accounts/${acctId}/r2/buckets`, {
           headers: { Authorization: `Bearer ${apiTok}` }
         });
         if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(res.status) } }));
+          throw new Error(deployM("deploy_apiError", {
+            params: {
+              service: "Cloudflare",
+              status: String(res.status)
+            }
+          }));
         }
         accountId = acctId;
         token = apiTok;
@@ -11411,7 +12495,9 @@ function createR2Provisioner() {
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
-            params: { error: error instanceof Error ? error.message : String(error) }
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
           }),
           error
         );
@@ -11439,7 +12525,12 @@ function createR2Provisioner() {
           }
         );
         if (!createRes.ok && createRes.status !== 409) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
+          throw new Error(deployM("deploy_apiError", {
+            params: {
+              service: "Cloudflare",
+              status: String(createRes.status)
+            }
+          }));
         }
         logger9.info("R2 bucket provisioned", { bucketName });
         return ok({
@@ -11487,13 +12578,20 @@ function createResendProvisioner() {
       try {
         const apiToken = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
         if (!apiToken || !credentials.from) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "apiKey, from" } }));
+          throw new Error(deployM("deploy_credentialMissing", {
+            params: { fields: "apiKey, from" }
+          }));
         }
         const res = await fetch(`${RESEND_API}/domains`, {
           headers: { Authorization: `Bearer ${apiToken}` }
         });
         if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Resend", status: String(res.status) } }));
+          throw new Error(deployM("deploy_apiError", {
+            params: {
+              service: "Resend",
+              status: String(res.status)
+            }
+          }));
         }
         token = apiToken;
         from = credentials.from;
@@ -11504,7 +12602,9 @@ function createResendProvisioner() {
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
-            params: { error: error instanceof Error ? error.message : String(error) }
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
           }),
           error
         );
@@ -11523,7 +12623,18 @@ function createResendProvisioner() {
         provisionerName: "resend",
         resourceStatus: "reused",
         envVars: {
-          HAI_REACH_PROVIDERS: JSON.stringify([{ name: "email", type: "smtp", host: "smtp.resend.com", port: 465, secure: true, user: "resend", pass: token, from }])
+          HAI_REACH_PROVIDERS: JSON.stringify([
+            {
+              name: "email",
+              type: "smtp",
+              host: "smtp.resend.com",
+              port: 465,
+              secure: true,
+              user: "resend",
+              pass: token,
+              from
+            }
+          ])
         },
         resourceInfo: "resend:verify-only"
       });
@@ -11545,7 +12656,12 @@ async function upstashFetch(email, apiKey, path, options) {
     }
   });
   if (!response.ok) {
-    throw new Error(deployM("deploy_apiError", { params: { service: "Upstash", status: String(response.status) } }));
+    throw new Error(deployM("deploy_apiError", {
+      params: {
+        service: "Upstash",
+        status: String(response.status)
+      }
+    }));
   }
   return response.json();
 }
@@ -11562,7 +12678,9 @@ async function getUpstashDatabase(email, apiKey, databaseId) {
 function buildUpstashProvisionResult(database, resourceStatus) {
   const databaseId = database.database_id ?? "";
   if (!databaseId || !database.endpoint || !database.password || !database.port) {
-    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
+    throw new Error(deployM("deploy_provisionNoResult", {
+      params: { service: "Upstash" }
+    }));
   }
   return {
     serviceType: "cache",
@@ -11586,7 +12704,9 @@ function createUpstashProvisioner() {
         const userEmail = credentials.email ?? "";
         const userKey = credentials.apiKey ?? credentials.api_key ?? credentials.token ?? "";
         if (!userEmail || !userKey) {
-          throw new Error(deployM("deploy_credentialMissing", { params: { fields: "email, api_key" } }));
+          throw new Error(deployM("deploy_credentialMissing", {
+            params: { fields: "email, api_key" }
+          }));
         }
         await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
@@ -11598,7 +12718,9 @@ function createUpstashProvisioner() {
         return err(
           HaiDeployError.AUTH_FAILED,
           deployM("deploy_authFailed", {
-            params: { error: error instanceof Error ? error.message : String(error) }
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
           }),
           error
         );
@@ -11619,12 +12741,17 @@ function createUpstashProvisioner() {
         if (existingDatabase !== null) {
           const databaseId = existingDatabase.database_id ?? "";
           if (!databaseId) {
-            throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
+            throw new Error(deployM("deploy_provisionNoResult", {
+              params: { service: "Upstash" }
+            }));
           }
           resource = { resourceInfo: `upstash-db:${databaseId}`, resourceStatus: "reused" };
           const detail = await getUpstashDatabase(email, apiKey, databaseId);
           logger11.info("Upstash Redis reused", { databaseId, databaseName });
-          return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }, "reused"));
+          return ok(buildUpstashProvisionResult({
+            ...existingDatabase,
+            ...detail
+          }, "reused"));
         }
         const data = await upstashFetch(email, apiKey, "/v2/redis/database", {
           method: "POST",
@@ -11644,7 +12771,9 @@ function createUpstashProvisioner() {
           return recoveryFailure({ ...HaiDeployError.PROVISION_FAILED}, {
             projectName: appName,
             stage: "provision:cache",
-            resources: [{ serviceType: "cache", provisionerName: "upstash", ...resource }]
+            resources: [
+              { serviceType: "cache", provisionerName: "upstash", ...resource }
+            ]
           });
         }
         return err(
@@ -11678,7 +12807,9 @@ function createProviderByType(type) {
     case "vercel":
       return createVercelProvider();
     default:
-      throw new Error(deployM("deploy_unsupportedProviderType", { params: { type } }));
+      throw new Error(deployM("deploy_unsupportedProviderType", {
+        params: { type }
+      }));
   }
 }
 function createProvisionerByName(provisioner) {
@@ -11694,7 +12825,9 @@ function createProvisionerByName(provisioner) {
     case "aliyun":
       return createAliyunProvisioner();
     default:
-      throw new Error(deployM("deploy_unsupportedProvisionerType", { params: { type: provisioner } }));
+      throw new Error(deployM("deploy_unsupportedProvisionerType", {
+        params: { type: provisioner }
+      }));
   }
 }
 function extractCredentials(serviceConfig) {
@@ -11727,8 +12860,12 @@ function mergeProvisionEnv(results, scan, options) {
           return item.service === prov.serviceType && (!mode || mode === "default");
         });
         if (targets.length) {
-          for (const target of targets)
-            reachProviders[reachRequirements.indexOf(target)] = { ...mergeManagedMiddlewareConfig(target, provider), name: target.config.name ?? provider.name };
+          for (const target of targets) {
+            reachProviders[reachRequirements.indexOf(target)] = {
+              ...mergeManagedMiddlewareConfig(target, provider),
+              name: target.config.name ?? provider.name
+            };
+          }
         } else {
           reachProviders.push(provider);
         }
@@ -11750,7 +12887,9 @@ var deploy = {
       logger12.warn("Deploy init already in progress, skipping concurrent call");
       return err(
         HaiDeployError.CONFIG_ERROR,
-        deployM("deploy_configError", { params: { error: "init already in progress" } })
+        deployM("deploy_configError", {
+          params: { error: "init already in progress" }
+        })
       );
     }
     initInProgress = true;
@@ -11765,7 +12904,9 @@ var deploy = {
         logger12.error("Deploy config validation failed", { error: parseResult.error.message });
         return err(
           HaiDeployError.CONFIG_ERROR,
-          deployM("deploy_configError", { params: { error: parseResult.error.message } }),
+          deployM("deploy_configError", {
+            params: { error: parseResult.error.message }
+          }),
           parseResult.error
         );
       }
@@ -11813,7 +12954,9 @@ var deploy = {
         currentConfig = parsed;
         logger12.info("Deploy module initialized", {
           provider: parsed.provider.type,
-          provisioners: [...currentProvisioners.keys()]
+          provisioners: [
+            ...currentProvisioners.keys()
+          ]
         });
         return ok(void 0);
       } catch (error) {
@@ -11825,7 +12968,9 @@ var deploy = {
         return err(
           HaiDeployError.CONFIG_ERROR,
           deployM("deploy_configError", {
-            params: { error: error instanceof Error ? error.message : String(error) }
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
           }),
           error
         );
@@ -11879,7 +13024,12 @@ var deploy = {
           resources: [
             ...results.map(({ envVars: _envVars, ...resource }) => resource),
             ...getDeployRecovery(provResult.error)?.resources ?? [
-              { serviceType, provisionerName: provisioner.name, resourceInfo: projectName, resourceStatus: "unknown" }
+              {
+                serviceType,
+                provisionerName: provisioner.name,
+                resourceInfo: projectName,
+                resourceStatus: "unknown"
+              }
             ]
           ]
         });
@@ -11917,7 +13067,9 @@ var deploy = {
             connectionVariables.add(match[1]);
         }
       } catch {
-        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path: projectFile, line: "1" } }));
+        return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", {
+          params: { path: projectFile, line: "1" }
+        }));
       }
     }
     const appEnv = Object.fromEntries(Object.entries(environment.data.values).filter(([key]) => key !== "HAI_DEPLOY" && !connectionVariables.has(key) && !key.startsWith("HAI_CLI_") && (!key.startsWith("HAI_DEPLOY_") || key === "HAI_DEPLOY_ENVIRONMENT")));
@@ -11925,7 +13077,9 @@ var deploy = {
     options = {
       ...options,
       ...scanOptions.environment ? { environment: environment.data.environment } : {},
-      ...options?.skipMiddleware ? { serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"])) } : {}
+      ...options?.skipMiddleware ? {
+        serviceModes: Object.fromEntries(scan.requiredServices.map((service) => [service, "keep"]))
+      } : {}
     };
     if (options.selectedServices) {
       options.serviceModes = {
@@ -11961,7 +13115,10 @@ var deploy = {
         return err(provResults.error);
       }
       recovery.resources = provResults.data.map(({ envVars: _envVars, ...resource }) => resource);
-      allEnvVars = { ...allEnvVars, ...mergeProvisionEnv(provResults.data, scan, options) };
+      allEnvVars = {
+        ...allEnvVars,
+        ...mergeProvisionEnv(provResults.data, scan, options)
+      };
       if (options?.environment) {
         const saved = saveDeploymentEnvironment(environment.data, mergeProvisionEnv(provResults.data, scan, options));
         if (!saved.success)
@@ -12037,7 +13194,16 @@ async function deployContainerApp(provider, appDir, scan, rawProjectName, option
     }
     provisionEnv = mergeProvisionEnv(provResults.data, scan, options);
   }
-  return provider.deploy({ appDir, artifact, artifactDir, projectName, scan, provisionEnv, appEnv, options });
+  return provider.deploy({
+    appDir,
+    artifact,
+    artifactDir,
+    projectName,
+    scan,
+    provisionEnv,
+    appEnv,
+    options
+  });
 }
 z.enum(["sqlite", "postgresql", "mysql"]);
 var ReldbOperationLogConfigSchema = z.object({
@@ -12070,7 +13236,12 @@ var MysqlPoolConfigSchema = z.object({
 }).strict();
 var SslConfigSchema = z.union([
   z.boolean(),
-  z.enum(["require", "prefer", "allow", "disable"]),
+  z.enum([
+    "require",
+    "prefer",
+    "allow",
+    "disable"
+  ]),
   z.record(z.string(), z.unknown())
 ]);
 var MysqlSslConfigSchema = z.union([
@@ -12086,7 +13257,9 @@ var MysqlSslConfigSchema = z.union([
     cert: z.string().min(1).optional(),
     /** MySQL 客户端私钥，PEM 内容；必须同时提供 cert */
     key: z.string().min(1).optional()
-  }).strict().refine((ssl) => Boolean(ssl.cert) === Boolean(ssl.key), { path: ["key"] })
+  }).strict().refine((ssl) => Boolean(ssl.cert) === Boolean(ssl.key), {
+    path: ["key"]
+  })
 ]);
 var SqliteOptionsSchema = z.object({
   /** 是否启用 WAL 模式（默认 true），可提高并发读写性能 */
@@ -12148,7 +13321,10 @@ var PostgresqlConfigSchema = NetworkConfigSchema.extend({
 var MysqlConfigSchema = NetworkConfigSchema.extend({
   type: z.literal("mysql"),
   /** 网络数据库URL；MySQL空串表示使用分字段，非空仅mysql://且拒绝query/fragment，优先于host/port/database/user/password */
-  url: z.union([z.literal("").transform(() => void 0), z.url({ protocol: /^mysql$/ }).refine((value) => !value.includes("?") && !value.includes("#"))]).optional(),
+  url: z.union([
+    z.literal("").transform(() => void 0),
+    z.url({ protocol: /^mysql$/ }).refine((value) => !value.includes("?") && !value.includes("#"))
+  ]).optional(),
   /** 数据库：SQLite文件路径或:memory:；PostgreSQL必填名称；MySQL无URL时必填，URL模式从URL读取 */
   database: z.string().min(1).optional(),
   /** TLS：PostgreSQL使用其模式；MySQL仅false或严格对象，空对象默认校验证书链和DNS身份 */
@@ -12158,7 +13334,9 @@ var MysqlConfigSchema = NetworkConfigSchema.extend({
   /** MySQL 特定选项 */
   mysql: MysqlOptionsSchema.optional(),
   ...OperationLogConfigFieldSchema
-}).refine((config) => Boolean(config.url) || Boolean(config.database), { path: ["database"] });
+}).refine((config) => Boolean(config.url) || Boolean(config.database), {
+  path: ["database"]
+});
 var ReldbConfigSchema = z.discriminatedUnion("type", [
   SqliteConfigSchema,
   PostgresqlConfigSchema,
@@ -12168,8 +13346,12 @@ function canKeepMiddleware(requirement, backend, environment) {
   const privatePath = join(environment.envDir, `.env.${environment.environment}.local`);
   let targetValues = environment.targetValues;
   try {
-    if (existsSync(privatePath))
-      targetValues = core.config.mergeEnv([targetValues, core.config.parseEnv(readFileSync(privatePath, "utf8"))]);
+    if (existsSync(privatePath)) {
+      targetValues = core.config.mergeEnv([
+        targetValues,
+        core.config.parseEnv(readLocalFile(privatePath).toString("utf8"))
+      ]);
+    }
   } catch {
     return false;
   }
@@ -12179,19 +13361,31 @@ function canKeepMiddleware(requirement, backend, environment) {
   function empty(value2) {
     if (Array.isArray(value2))
       return value2.map(empty);
-    if (value2 && typeof value2 === "object")
-      return Object.fromEntries(Object.entries(value2).map(([name, child]) => [name, empty(child)]));
+    if (value2 && typeof value2 === "object") {
+      return Object.fromEntries(Object.entries(value2).map(([name, child]) => [
+        name,
+        empty(child)
+      ]));
+    }
     return void 0;
   }
   let seed = empty(requirement.config);
-  for (const part of [...requirement.configPath].reverse())
+  for (const part of [...requirement.configPath].reverse()) {
     seed = /^\d+$/.test(part) ? Array.from({ length: Number(part) + 1 }, (_, index) => index === Number(part) ? seed : null) : { [part]: seed };
-  const resolved = core.config.resolve({ name: requirement.configName, value: seed, environment: targetValues, shape: structures[requirement.configName], missing: "empty" });
+  }
+  const resolved = core.config.resolve({
+    name: requirement.configName,
+    value: seed,
+    environment: targetValues,
+    shape: structures[requirement.configName],
+    missing: "empty"
+  });
   if (!resolved.success)
     return false;
   let value = resolved.data;
-  for (const part of requirement.configPath)
+  for (const part of requirement.configPath) {
     value = value && typeof value === "object" ? value[part] : void 0;
+  }
   if (!value || typeof value !== "object" || Array.isArray(value))
     return false;
   const target = value;
@@ -12208,30 +13402,39 @@ function validateMiddlewareField(options) {
 }
 function middlewareFieldProblem(options) {
   const { value, field: field2, backend } = options;
-  if (value === "")
+  if (value === "") {
     return field2.required ? deployM("deploy_middlewareRequired") : void 0;
-  if (field2.kind === "port")
-    return /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 ? void 0 : deployM("deploy_middlewareInteger", { params: { min: 1, max: 65535 } });
+  }
+  if (field2.kind === "port") {
+    return /^\d+$/.test(value) && Number(value) >= 1 && Number(value) <= 65535 ? void 0 : deployM("deploy_middlewareInteger", {
+      params: { min: 1, max: 65535 }
+    });
+  }
   if (field2.kind === "number") {
     const min = field2.minimum ?? 0;
     const max = field2.maximum ?? Number.MAX_SAFE_INTEGER;
-    return /^\d+$/.test(value) && Number(value) >= min && Number(value) <= max ? void 0 : deployM("deploy_middlewareInteger", { params: { min, max } });
+    return /^\d+$/.test(value) && Number(value) >= min && Number(value) <= max ? void 0 : deployM("deploy_middlewareInteger", {
+      params: { min, max }
+    });
   }
-  if (field2.kind === "boolean")
+  if (field2.kind === "boolean") {
     return ["true", "false"].includes(value) ? void 0 : deployM("deploy_middlewareBoolean");
+  }
   if (backend === "s3" && field2.name === "endpoint") {
     const endpoint = URL.parse(value);
     return endpoint?.hostname && ["http:", "https:"].includes(endpoint.protocol) ? void 0 : deployM("deploy_middlewareS3Endpoint");
   }
-  if (field2.kind === "url")
+  if (field2.kind === "url") {
     return URL.canParse(value) ? void 0 : deployM("deploy_middlewareUrl");
+  }
   if (field2.name === "ssl") {
     try {
       const document = parseDocument(value);
       if (document.errors.length)
         return deployM("deploy_middlewareTlsSyntax");
-      if (!(backend === "mysql" ? MysqlSslConfigSchema : SslConfigSchema).safeParse(document.toJS()).success)
+      if (!(backend === "mysql" ? MysqlSslConfigSchema : SslConfigSchema).safeParse(document.toJS()).success) {
         return deployM(backend === "mysql" ? "deploy_middlewareMysqlTls" : "deploy_middlewarePostgresTls");
+      }
     } catch {
       return deployM("deploy_middlewareTlsSyntax");
     }
@@ -12253,8 +13456,11 @@ function parseMiddlewareField(options) {
   if (options.managed && (options.field.secret || options.field.managed) && options.value === "")
     return ok(void 0);
   const problem = middlewareFieldProblem(options);
-  if (problem)
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_middlewareFieldError", { params: { field: options.field.name, reason: problem } }));
+  if (problem) {
+    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_middlewareFieldError", {
+      params: { field: options.field.name, reason: problem }
+    }));
+  }
   const { value, field: field2 } = options;
   if (value === "")
     return ok(void 0);
@@ -12272,8 +13478,13 @@ function saveMiddlewareEnvironment(environment, options) {
       const configuration = requirement.service === "ldap" ? options.configuration : { ...options.configuration, type: backend };
       if (requirement.service === "db") {
         const validated = ReldbConfigSchema.safeParse(configuration);
-        if (!validated.success)
-          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_middlewareFieldInvalid", { params: { fields: validated.error.issues.map((issue) => `db.${issue.path.join(".")}`).join(", ") } }));
+        if (!validated.success) {
+          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_middlewareFieldInvalid", {
+            params: {
+              fields: validated.error.issues.map((issue) => `db.${issue.path.join(".")}`).join(", ")
+            }
+          }));
+        }
       }
       if (requirement.service === "ldap") {
         updates.HAI_IAM_LOGIN_LDAP = backend !== "disabled";
@@ -12287,17 +13498,26 @@ function saveMiddlewareEnvironment(environment, options) {
     mkdirSync(directory, { recursive: true });
     const path = join(directory, `_${requirement.configName}.yml`);
     const lineCounter = new LineCounter();
-    const document = parseDocument(existsSync(path) ? readFileSync(path, "utf8") : "{}\n", { lineCounter, prettyErrors: false });
-    if (document.errors.length)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", { params: { path, line: String(lineCounter.linePos(document.errors[0].pos[0]).line) } }));
-    if (backend !== "disabled" && requirement.configPath.length && !document.hasIn(requirement.configPath))
+    const document = parseDocument(existsSync(path) ? readLocalFile(path).toString("utf8") : "{}\n", { lineCounter, prettyErrors: false });
+    if (document.errors.length) {
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_configFileInvalid", {
+        params: {
+          path,
+          line: String(lineCounter.linePos(document.errors[0].pos[0]).line)
+        }
+      }));
+    }
+    if (backend !== "disabled" && requirement.configPath.length && !document.hasIn(requirement.configPath)) {
       document.setIn(requirement.configPath, document.createNode(requirement.config.name ? { name: requirement.config.name, type: backend } : {}));
+    }
     if (requirement.service === "ldap" && !document.hasIn(["login", "ldap"]))
       document.setIn(["login", "ldap"], false);
     const content = document.toString();
-    if (!existsSync(path) || readFileSync(path, "utf8") !== content)
-      writeFileSync(path, content);
-    return saveDeploymentEnvironment(environment, updates, { replace: options.configuration && backend !== "disabled" ? [requirement.envPrefix] : [] });
+    if (!existsSync(path) || readLocalFile(path).toString("utf8") !== content)
+      writeLocalFile(path, content);
+    return saveDeploymentEnvironment(environment, updates, {
+      replace: options.configuration && backend !== "disabled" ? [requirement.envPrefix] : []
+    });
   } catch {
     return err(HaiDeployError.ENV_VAR_FAILED, deployM("deploy_environmentWriteFailed"));
   }
@@ -12305,46 +13525,253 @@ function saveMiddlewareEnvironment(environment, options) {
 
 // src/deploy-middleware.ts
 var field = (name, defaultValue, kind, secret = false) => ({ name, defaultValue, kind, secret });
-var required = (name, defaultValue, kind) => ({ ...field(name, defaultValue, kind), required: true });
+function required(name, defaultValue, kind) {
+  return {
+    ...field(name, defaultValue, kind),
+    required: true
+  };
+}
 var DEPLOY_MIDDLEWARE = {
   db: [
-    { backend: "sqlite", label: "SQLite", purpose: "deploy_purposeSqlite", fields: [required("database", "./data/app.db")] },
+    {
+      backend: "sqlite",
+      label: "SQLite",
+      purpose: "deploy_purposeSqlite",
+      fields: [
+        required("database", "./data/app.db")
+      ]
+    },
     ...["postgresql", "mysql"].map((backend) => ({
       backend,
       label: backend === "mysql" ? "MySQL" : "PostgreSQL",
       purpose: "deploy_purposeDatabase",
       provisioner: backend === "postgresql" ? "neon" : void 0,
       cloudFields: backend === "postgresql" ? provisionerFields("neon") : void 0,
-      fields: [field("url", "", "url", true), required("host", "localhost"), required("port", backend === "mysql" ? "3306" : "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true), field("ssl", "false")]
+      fields: [
+        field("url", "", "url", true),
+        required("host", "localhost"),
+        required("port", backend === "mysql" ? "3306" : "5432", "port"),
+        required("database", "hai"),
+        field("user", "hai"),
+        field("password", "", void 0, true),
+        field("ssl", "false")
+      ]
     }))
   ],
   cache: [
-    { backend: "memory", label: "Memory", purpose: "deploy_purposeMemory", fields: [] },
-    { backend: "redis", label: "Redis", purpose: "deploy_purposeCache", provisioner: "upstash", cloudFields: provisionerFields("upstash"), fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "6379", "port"), field("password", "", void 0, true), { ...field("db", "0", "number"), maximum: 15 }, field("tls", "false", "boolean"), field("keyPrefix"), field("connectTimeout", "10000", "number"), field("commandTimeout", "5000", "number")] }
+    {
+      backend: "memory",
+      label: "Memory",
+      purpose: "deploy_purposeMemory",
+      fields: []
+    },
+    {
+      backend: "redis",
+      label: "Redis",
+      purpose: "deploy_purposeCache",
+      provisioner: "upstash",
+      cloudFields: provisionerFields("upstash"),
+      fields: [
+        field("url", "", "url", true),
+        required("host", "localhost"),
+        required("port", "6379", "port"),
+        field("password", "", void 0, true),
+        {
+          ...field("db", "0", "number"),
+          maximum: 15
+        },
+        field("tls", "false", "boolean"),
+        field("keyPrefix"),
+        field("connectTimeout", "10000", "number"),
+        field("commandTimeout", "5000", "number")
+      ]
+    }
   ],
   storage: [
-    { backend: "local", label: "Local filesystem", purpose: "deploy_purposeLocal", fields: [required("root", "./data/storage")] },
-    { backend: "s3", label: "S3 / RustFS / MinIO / Cloudflare R2", purpose: "deploy_purposeStorage", provisioner: "cloudflare-r2", cloudFields: provisionerFields("cloudflare-r2"), containerOptions: [{ field: "s3Engine", variable: "HAI_DEPLOY_CONTAINER_S3ENGINE", purpose: "deploy_s3Engine", defaultValue: "rustfs", choices: [{ label: "RustFS", value: "rustfs" }, { label: "MinIO", value: "minio" }] }], fields: [field("endpoint", "", "url"), required("bucket", "hai"), required("region", "us-east-1"), { ...required("accessKeyId"), managed: true }, { ...required("secretAccessKey"), secret: true }, field("forcePathStyle", "true", "boolean")] }
+    {
+      backend: "local",
+      label: "Local filesystem",
+      purpose: "deploy_purposeLocal",
+      fields: [
+        required("root", "./data/storage")
+      ]
+    },
+    {
+      backend: "s3",
+      label: "S3 / RustFS / MinIO / Cloudflare R2",
+      purpose: "deploy_purposeStorage",
+      provisioner: "cloudflare-r2",
+      cloudFields: provisionerFields("cloudflare-r2"),
+      containerOptions: [
+        {
+          field: "s3Engine",
+          variable: "HAI_DEPLOY_CONTAINER_S3ENGINE",
+          purpose: "deploy_s3Engine",
+          defaultValue: "rustfs",
+          choices: [
+            { label: "RustFS", value: "rustfs" },
+            { label: "MinIO", value: "minio" }
+          ]
+        }
+      ],
+      fields: [
+        field("endpoint", "", "url"),
+        required("bucket", "hai"),
+        required("region", "us-east-1"),
+        {
+          ...required("accessKeyId"),
+          managed: true
+        },
+        {
+          ...required("secretAccessKey"),
+          secret: true
+        },
+        field("forcePathStyle", "true", "boolean")
+      ]
+    }
   ],
   vecdb: [
-    { backend: "lancedb", label: "LanceDB", purpose: "deploy_purposeLocal", fields: [required("path", "./data/vectors")] },
-    { backend: "qdrant", label: "Qdrant", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:6333", "url"), field("apiKey", "", void 0, true)] },
-    { backend: "pgvector", label: "PostgreSQL / pgvector", purpose: "deploy_purposeVector", fields: [field("url", "", "url", true), required("host", "localhost"), required("port", "5432", "port"), required("database", "hai"), field("user", "hai"), field("password", "", void 0, true)] },
-    { backend: "chroma", label: "Chroma", purpose: "deploy_purposeVector", fields: [required("url", "http://localhost:8000", "url")] }
+    {
+      backend: "lancedb",
+      label: "LanceDB",
+      purpose: "deploy_purposeLocal",
+      fields: [
+        required("path", "./data/vectors")
+      ]
+    },
+    {
+      backend: "qdrant",
+      label: "Qdrant",
+      purpose: "deploy_purposeVector",
+      fields: [
+        required("url", "http://localhost:6333", "url"),
+        field("apiKey", "", void 0, true)
+      ]
+    },
+    {
+      backend: "pgvector",
+      label: "PostgreSQL / pgvector",
+      purpose: "deploy_purposeVector",
+      fields: [
+        field("url", "", "url", true),
+        required("host", "localhost"),
+        required("port", "5432", "port"),
+        required("database", "hai"),
+        field("user", "hai"),
+        field("password", "", void 0, true)
+      ]
+    },
+    {
+      backend: "chroma",
+      label: "Chroma",
+      purpose: "deploy_purposeVector",
+      fields: [
+        required("url", "http://localhost:8000", "url")
+      ]
+    }
   ],
   ldap: [
-    { backend: "disabled", label: "Disabled", purpose: "deploy_purposeDisabled", fields: [] },
-    { backend: "ldap", label: "LDAP / OpenLDAP", purpose: "deploy_purposeLdap", fields: [required("url", "ldap://localhost:389", "url"), required("bindDn", "cn=admin,dc=example,dc=org"), { ...required("bindPassword"), secret: true }, required("searchBase", "dc=example,dc=org"), field("searchFilter", "(uid={{username}})"), field("usernameAttribute", "uid"), field("emailAttribute", "mail"), field("displayNameAttribute", "cn"), field("useTls", "false", "boolean"), { ...field("connectTimeout", "5000", "number"), minimum: 1e3 }] }
+    {
+      backend: "disabled",
+      label: "Disabled",
+      purpose: "deploy_purposeDisabled",
+      fields: []
+    },
+    {
+      backend: "ldap",
+      label: "LDAP / OpenLDAP",
+      purpose: "deploy_purposeLdap",
+      fields: [
+        required("url", "ldap://localhost:389", "url"),
+        required("bindDn", "cn=admin,dc=example,dc=org"),
+        {
+          ...required("bindPassword"),
+          secret: true
+        },
+        required("searchBase", "dc=example,dc=org"),
+        field("searchFilter", "(uid={{username}})"),
+        field("usernameAttribute", "uid"),
+        field("emailAttribute", "mail"),
+        field("displayNameAttribute", "cn"),
+        field("useTls", "false", "boolean"),
+        {
+          ...field("connectTimeout", "5000", "number"),
+          minimum: 1e3
+        }
+      ]
+    }
   ],
   email: [
-    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
-    { backend: "smtp", label: "SMTP", purpose: "deploy_purposeEmail", provisioner: "resend", cloudFields: provisionerFields("resend"), fields: [required("host", "localhost"), required("port", "465", "port"), field("secure", "true", "boolean"), field("user"), field("pass", "", void 0, true), required("from", "noreply@example.com")] },
-    { backend: "api", containerSupported: false, label: "HTTP notification API", purpose: "deploy_purposeEmail", fields: [required("url", "", "url"), field("method", "POST"), field("headers", "", void 0, true), field("timeout", "10000", "number")] }
+    {
+      backend: "console",
+      label: "Console",
+      purpose: "deploy_purposeConsole",
+      fields: []
+    },
+    {
+      backend: "smtp",
+      label: "SMTP",
+      purpose: "deploy_purposeEmail",
+      provisioner: "resend",
+      cloudFields: provisionerFields("resend"),
+      fields: [
+        required("host", "localhost"),
+        required("port", "465", "port"),
+        field("secure", "true", "boolean"),
+        field("user"),
+        field("pass", "", void 0, true),
+        required("from", "noreply@example.com")
+      ]
+    },
+    {
+      backend: "api",
+      containerSupported: false,
+      label: "HTTP notification API",
+      purpose: "deploy_purposeEmail",
+      fields: [
+        required("url", "", "url"),
+        field("method", "POST"),
+        field("headers", "", void 0, true),
+        field("timeout", "10000", "number")
+      ]
+    }
   ],
   sms: [
-    { backend: "console", label: "Console", purpose: "deploy_purposeConsole", fields: [] },
-    { backend: "aliyun-sms", containerSupported: false, label: "Aliyun SMS", purpose: "deploy_purposeSms", provisioner: "aliyun", cloudFields: provisionerFields("aliyun"), fields: [required("accessKeyId"), { ...required("accessKeySecret"), secret: true }, required("signName"), field("endpoint", "dysmsapi.aliyuncs.com")] },
-    { backend: "api", containerSupported: false, label: "HTTP notification API", purpose: "deploy_purposeSms", fields: [required("url", "", "url"), field("method", "POST"), field("headers", "", void 0, true), field("timeout", "10000", "number")] }
+    {
+      backend: "console",
+      label: "Console",
+      purpose: "deploy_purposeConsole",
+      fields: []
+    },
+    {
+      backend: "aliyun-sms",
+      containerSupported: false,
+      label: "Aliyun SMS",
+      purpose: "deploy_purposeSms",
+      provisioner: "aliyun",
+      cloudFields: provisionerFields("aliyun"),
+      fields: [
+        required("accessKeyId"),
+        {
+          ...required("accessKeySecret"),
+          secret: true
+        },
+        required("signName"),
+        field("endpoint", "dysmsapi.aliyuncs.com")
+      ]
+    },
+    {
+      backend: "api",
+      containerSupported: false,
+      label: "HTTP notification API",
+      purpose: "deploy_purposeSms",
+      fields: [
+        required("url", "", "url"),
+        field("method", "POST"),
+        field("headers", "", void 0, true),
+        field("timeout", "10000", "number")
+      ]
+    }
   ]
 };
 function describeMiddlewareBackend(backend) {
@@ -12354,8 +13781,15 @@ async function createDeploymentPlan(appDir, input, options = {}) {
   if ("projectName" in options && options.projectName !== void 0)
     return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_projectNameOverrideRemoved"));
   const parsed = DeployConfigSchema.safeParse(input);
-  if (!parsed.success)
-    return err({ ...HaiDeployError.CONFIG_ERROR, message: deployM("deploy_artifactInvalid"), ext: { fields: parsed.error.issues.map((issue) => issue.path.join(".")) } });
+  if (!parsed.success) {
+    return err({
+      ...HaiDeployError.CONFIG_ERROR,
+      message: deployM("deploy_artifactInvalid"),
+      ext: {
+        fields: parsed.error.issues.map((issue) => issue.path.join("."))
+      }
+    });
+  }
   const config = parsed.data;
   const scan = await scanApp(appDir, { environment: options.environment ?? config.environment, envDir: options.envDir });
   if (!scan.success)
@@ -12382,21 +13816,51 @@ async function createDeploymentPlan(appDir, input, options = {}) {
       const compose = validateComposeServices(config.container, artifact);
       if (!compose.success)
         return compose;
-      images = [.../* @__PURE__ */ new Set([artifact.primaryService, ...artifact.hasWeb ? ["web"] : []])];
+      images = [
+        .../* @__PURE__ */ new Set([
+          artifact.primaryService,
+          ...artifact.hasWeb ? ["web"] : []
+        ])
+      ];
     } else {
       const file = join(root, "hai.json");
-      const project = existsSync(file) ? z.object({ build: z.object({ images: z.array(z.object({ name: DeploymentArtifactSchema.shape.primaryService })).min(1).max(2).refine((items) => new Set(items.map((item) => item.name)).size === items.length).optional() }).optional() }).parse(JSON.parse(readFileSync(file, "utf8"))) : void 0;
-      images = project?.build?.images?.map((image) => image.name) ?? [app.isSvelteKit ? "web" : "serv"];
-    }
-    const middlewares = (app.middlewares ?? []).filter((item) => !["sqlite", "local", "memory", "disabled", "console", "lancedb"].includes(item.backend));
-    const available = [.../* @__PURE__ */ new Set([...images, ...app.requiredServices])];
-    const selected = [...options.selectedServices ?? (artifact?.partial ? artifact.images.map((image) => image.name) : available)];
+      const project = existsSync(file) ? z.object({
+        build: z.object({
+          images: z.array(z.object({ name: DeploymentArtifactSchema.shape.primaryService })).min(1).max(2).refine((items) => new Set(items.map((item) => item.name)).size === items.length).optional()
+        }).optional()
+      }).parse(JSON.parse(readFileSync(file, "utf8"))) : void 0;
+      images = project?.build?.images?.map((image) => image.name) ?? [
+        app.isSvelteKit ? "web" : "serv"
+      ];
+    }
+    const middlewares = (app.middlewares ?? []).filter((item) => ![
+      "sqlite",
+      "local",
+      "memory",
+      "disabled",
+      "console",
+      "lancedb"
+    ].includes(item.backend));
+    const available = [
+      .../* @__PURE__ */ new Set([
+        ...images,
+        ...app.requiredServices
+      ])
+    ];
+    const selected = [
+      ...options.selectedServices ?? (artifact?.partial ? artifact.images.map((image) => image.name) : available)
+    ];
     if (!selected.length || new Set(selected).size !== selected.length || selected.some((name) => !available.includes(name)))
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
     if (artifact && selected.some((name) => images.includes(name) && !artifact.images.some((image) => image.name === name)))
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
     const remoteDirectory = provider.type === "docker-ssh" ? `${provider.remote.baseDir}/${projectName}` : void 0;
-    const baseline = { required: Boolean(artifact?.partial || options.selectedServices), state: "not-inspected", current: remoteDirectory ? `${remoteDirectory}/current` : void 0, release: void 0 };
+    const baseline = {
+      required: Boolean(artifact?.partial || options.selectedServices),
+      state: "not-inspected",
+      current: remoteDirectory ? `${remoteDirectory}/current` : void 0,
+      release: void 0
+    };
     if (options.inspectRemote) {
       if (provider.type !== "docker-ssh" || !provider.ssh || !remoteDirectory)
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_sshRequired"));
@@ -12412,13 +13876,27 @@ async function createDeploymentPlan(appDir, input, options = {}) {
         baseline.release = release || void 0;
       }
     }
-    const configFiles = [".env", ".env.local", `.env.${environment.data.environment}`, `.env.${environment.data.environment}.local`].map((name) => join(environment.data.envDir, name)).filter(existsSync);
+    const configFiles = [
+      ".env",
+      ".env.local",
+      `.env.${environment.data.environment}`,
+      `.env.${environment.data.environment}.local`
+    ].map((name) => join(environment.data.envDir, name)).filter(existsSync);
     const configDirectory = join(directory, "config");
     if (existsSync(configDirectory))
       configFiles.push(...readdirSync(configDirectory, { withFileTypes: true }).filter((entry) => entry.isFile() && /\.ya?ml$/i.test(entry.name)).map((entry) => join(configDirectory, entry.name)).sort());
-    const serviceModes = { ...options.skipMiddleware ? {} : options.serviceModes, ...Object.fromEntries(app.requiredServices.filter((service) => options.skipMiddleware || !selected.includes(service)).map((service) => [service, "keep"])) };
+    const serviceModes = {
+      ...options.skipMiddleware ? {} : options.serviceModes,
+      ...Object.fromEntries(app.requiredServices.filter((service) => options.skipMiddleware || !selected.includes(service)).map((service) => [service, "keep"]))
+    };
     const effective = resolveSidecarOptions(app, { ...options, selectedServices: selected, serviceModes });
-    const provisionKeys = { db: "HAI_DB", cache: "HAI_CACHE", storage: "HAI_STORAGE", email: "HAI_REACH_PROVIDERS", sms: "HAI_REACH_PROVIDERS" };
+    const provisionKeys = {
+      db: "HAI_DB",
+      cache: "HAI_CACHE",
+      storage: "HAI_STORAGE",
+      email: "HAI_REACH_PROVIDERS",
+      sms: "HAI_REACH_PROVIDERS"
+    };
     const provisionEnv = {};
     const provisioners = /* @__PURE__ */ new Map();
     for (const service of Object.keys(provisionKeys)) {
@@ -12430,7 +13908,7 @@ async function createDeploymentPlan(appDir, input, options = {}) {
     }
     const sidecar = provider.type === "docker-ssh" ? planSidecars(directory, projectName, app, provisionEnv, effective, config.container?.s3Engine, { dbPassword: "", storagePassword: "", ldapPassword: "" }) : void 0;
     const https = provider.type === "docker-ssh" ? provider.expose.https : void 0;
-    const gateway = !!artifact && !(artifact.primaryService === "serv" && artifact.hasWeb) && (sidecar?.services.includes("storage") || !!https && (artifact.primaryService === "serv" || app.isSvelteKit));
+    const gateway = !!artifact && !(artifact.primaryService === "serv" && artifact.hasWeb) && (app.isSvelteKit || sidecar?.services.includes("storage") || !!https && artifact.primaryService === "serv");
     if (gateway && artifact.primaryService === "web" && !app.isSvelteKit)
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageBackendRequired"));
     if (gateway) {
@@ -12449,17 +13927,54 @@ async function createDeploymentPlan(appDir, input, options = {}) {
       root,
       serviceDir: directory,
       environment: environment.data.environment,
-      target: provider.type === "docker-ssh" ? { provider: provider.type, host: provider.ssh?.host, port: provider.ssh?.port, directory: remoteDirectory, runtime: provider.remote.runtime, hostPort: provider.expose.hostPort, https: https ? { type: https.type, domain: https.domain, port: https.port } : void 0 } : { provider: provider.type },
-      artifact: artifact ? { directory: artifactDir, version: artifact.appVersion, buildId: artifact.buildId, verified: true, images: artifact.images.map((image) => ({ name: image.name, reference: image.imageRef, sha256: image.sha256 })) } : void 0,
+      target: provider.type === "docker-ssh" ? {
+        provider: provider.type,
+        host: provider.ssh?.host,
+        port: provider.ssh?.port,
+        directory: remoteDirectory,
+        runtime: provider.remote.runtime,
+        hostPort: provider.expose.hostPort,
+        https: https ? { type: https.type, domain: https.domain, port: https.port } : void 0
+      } : { provider: provider.type },
+      artifact: artifact ? {
+        directory: artifactDir,
+        version: artifact.appVersion,
+        buildId: artifact.buildId,
+        verified: true,
+        images: artifact.images.map((image) => ({ name: image.name, reference: image.imageRef, sha256: image.sha256 }))
+      } : void 0,
       selected,
       retained: available.filter((name) => !selected.includes(name)),
-      containers: provider.type === "docker-ssh" ? [...selected.filter((name) => images.includes(name) || name === "gateway").map((name) => `hai-${projectName}-${name}`), ...services.flatMap(([, service]) => typeof service.container_name === "string" ? [service.container_name] : [])] : [],
-      composeManagedServices: [...services.filter(([, service]) => typeof service.container_name !== "string").map(([name]) => name), ...selected.includes("certbot") ? ["certbot"] : []],
+      containers: provider.type === "docker-ssh" ? [
+        ...selected.filter((name) => images.includes(name) || name === "gateway").map((name) => `hai-${projectName}-${name}`),
+        ...services.flatMap(([, service]) => typeof service.container_name === "string" ? [service.container_name] : [])
+      ] : [],
+      composeManagedServices: [
+        ...services.filter(([, service]) => typeof service.container_name !== "string").map(([name]) => name),
+        ...selected.includes("certbot") ? ["certbot"] : []
+      ],
       logicalVolumes: Object.keys(sidecar?.volumes ?? {}),
-      middleware: middlewares.map((item) => ({ service: item.service, backend: item.backend, configuration: item.envPrefix, action: selected.includes(item.service) ? effective.serviceModes?.[item.envPrefix] ?? effective.serviceModes?.[item.service] ?? "default" : "keep", provisioner: provisioners.get(item.service) })),
-      configuration: { files: [join(root, "hai.json"), ...configFiles].filter(existsSync), environmentKeys: Object.keys(environment.data.values).sort() },
+      middleware: middlewares.map((item) => ({
+        service: item.service,
+        backend: item.backend,
+        configuration: item.envPrefix,
+        action: selected.includes(item.service) ? effective.serviceModes?.[item.envPrefix] ?? effective.serviceModes?.[item.service] ?? "default" : "keep",
+        provisioner: provisioners.get(item.service)
+      })),
+      configuration: {
+        files: [
+          join(root, "hai.json"),
+          ...configFiles
+        ].filter(existsSync),
+        environmentKeys: Object.keys(environment.data.values).sort()
+      },
       baseline,
-      recovery: { releases: remoteDirectory ? `${remoteDirectory}/releases` : void 0, point: baseline.release ?? "previous-successful-release", preservesVolumes: true, databaseRollback: false }
+      recovery: {
+        releases: remoteDirectory ? `${remoteDirectory}/releases` : void 0,
+        point: baseline.release ?? "previous-successful-release",
+        preservesVolumes: true,
+        databaseRollback: false
+      }
     });
   } catch {
     return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
@@ -12470,7 +13985,11 @@ var passwordSchema = z.string().min(1).max(1024).refine((value) => Buffer.from(v
 var importSchema = z.strictObject({
   version: z.literal(1),
   projectName: nameSchema,
-  credentials: z.strictObject({ DB_PASSWORD: passwordSchema.optional(), STORAGE_PASSWORD: passwordSchema.optional(), LDAP_PASSWORD: passwordSchema.optional() }),
+  credentials: z.strictObject({
+    DB_PASSWORD: passwordSchema.optional(),
+    STORAGE_PASSWORD: passwordSchema.optional(),
+    LDAP_PASSWORD: passwordSchema.optional()
+  }),
   services: z.array(z.strictObject({
     service: z.enum(["db", "vecdb", "storage", "ldap"]),
     container: nameSchema,
@@ -12484,7 +14003,12 @@ var importSchema = z.strictObject({
     bindDn: z.string().min(1).max(512).default("cn=admin,dc=example,dc=org")
   })).min(1).max(4)
 });
-var groups2 = { db: "DB_PASSWORD", vecdb: "DB_PASSWORD", storage: "STORAGE_PASSWORD", ldap: "LDAP_PASSWORD" };
+var groups2 = {
+  db: "DB_PASSWORD",
+  vecdb: "DB_PASSWORD",
+  storage: "STORAGE_PASSWORD",
+  ldap: "LDAP_PASSWORD"
+};
 var importCommitScript = String.raw`(async()=>{const fs=require('node:fs'),path=require('node:path'),crypto=require('node:crypto');const root=process.argv[1];let temporary;
 try{process.stdout.write('LOCKED\n');let input='';for await(const chunk of process.stdin){input+=chunk;if(input.length>65536)throw Error()}
 if(!input)return;const {content}=JSON.parse(input);if(typeof content!=='string'||!content.startsWith('FORMAT_VERSION=2\n'))throw Error();
@@ -12516,11 +14040,24 @@ async function importDeploymentSecrets(options) {
       throw new Error("input");
     const input = privateFile(resolve(options.inputFile));
     const parsed = importSchema.safeParse(JSON.parse(input));
-    if (!parsed.success)
-      return err({ ...HaiDeployError.CONFIG_ERROR, message: deployM("deploy_secretImportFailed", { params: { phase } }), ext: { phase, state: "unchanged", fields: parsed.error.issues.map((issue) => issue.path.join(".")) } });
+    if (!parsed.success) {
+      return err({
+        ...HaiDeployError.CONFIG_ERROR,
+        message: deployM("deploy_secretImportFailed", {
+          params: { phase }
+        }),
+        ext: {
+          phase,
+          state: "unchanged",
+          fields: parsed.error.issues.map((issue) => issue.path.join("."))
+        }
+      });
+    }
     const config = parsed.data;
     const project = `hai-${config.projectName}`;
-    const selectedGroups = [...new Set(config.services.map((service) => groups2[service.service]))].sort();
+    const selectedGroups = [
+      ...new Set(config.services.map((service) => groups2[service.service]))
+    ].sort();
     if (new Set(config.services.map((service) => service.service)).size !== config.services.length || Object.keys(config.credentials).some((group) => !selectedGroups.includes(group)) || selectedGroups.some((group) => !config.credentials[group])) {
       throw new Error("input");
     }
@@ -12560,23 +14097,89 @@ async function importDeploymentSecrets(options) {
         const application = await inspectContainer(options.runtime, helper2, secrets);
         if (application.project !== project || application.service !== "app" || !application.running || !application.networks.some((network) => identity.networks.includes(network)))
           throw new Error("identity");
-        const result = await runCommand(options.runtime, ["exec", "-i", helper2, "node", "-e", s3VerificationScript], { input: JSON.stringify({ endpoint: `http://${service.container}:9000`, bucket: service.bucket, accessKeyId: service.accessKeyId, secret: password, region: service.region }), secrets, timeoutMs: 15e3, maxCaptureChars: 1024 });
+        const result = await runCommand(options.runtime, [
+          "exec",
+          "-i",
+          helper2,
+          "node",
+          "-e",
+          s3VerificationScript
+        ], {
+          input: JSON.stringify({
+            endpoint: `http://${service.container}:9000`,
+            bucket: service.bucket,
+            accessKeyId: service.accessKeyId,
+            secret: password,
+            region: service.region
+          }),
+          secrets,
+          timeoutMs: 15e3,
+          maxCaptureChars: 1024
+        });
         verified = result.success && result.data.stdout.trim() === "VERIFIED";
       } else {
-        const args = service.kind === "ldap" ? ["exec", "-i", service.container, "ldapwhoami", "-x", "-H", "ldap://127.0.0.1:389", "-D", service.bindDn, "-y", "/dev/stdin"] : ["exec", "-i", service.container, "sh", "-c", service.kind === "postgresql" ? 'IFS= read -r PGPASSWORD; export PGPASSWORD; exec psql --no-psqlrc -h "$3" -U "$1" -d "dbname=$2 require_auth=scram-sha-256,md5,password" -Atc "SELECT 1"' : 'IFS= read -r MYSQL_PWD; export MYSQL_PWD; exec mysql -h 127.0.0.1 -u "$1" "$2" -Nse "SELECT 1"', "hai-secret-check", service.username, service.database, service.container];
-        const result = await runCommand(options.runtime, args, { input: service.kind === "ldap" ? password : `${password}
-`, secrets, timeoutMs: 15e3, maxCaptureChars: 1024 });
+        const args = service.kind === "ldap" ? [
+          "exec",
+          "-i",
+          service.container,
+          "ldapwhoami",
+          "-x",
+          "-H",
+          "ldap://127.0.0.1:389",
+          "-D",
+          service.bindDn,
+          "-y",
+          "/dev/stdin"
+        ] : [
+          "exec",
+          "-i",
+          service.container,
+          "sh",
+          "-c",
+          service.kind === "postgresql" ? 'IFS= read -r PGPASSWORD; export PGPASSWORD; exec psql --no-psqlrc -h "$3" -U "$1" -d "dbname=$2 require_auth=scram-sha-256,md5,password" -Atc "SELECT 1"' : 'IFS= read -r MYSQL_PWD; export MYSQL_PWD; exec mysql -h 127.0.0.1 -u "$1" "$2" -Nse "SELECT 1"',
+          "hai-secret-check",
+          service.username,
+          service.database,
+          service.container
+        ];
+        const result = await runCommand(options.runtime, args, {
+          input: service.kind === "ldap" ? password : `${password}
+`,
+          secrets,
+          timeoutMs: 15e3,
+          maxCaptureChars: 1024
+        });
         verified = result.success && !result.data.stdoutTruncated && (service.kind === "ldap" ? result.data.stdout.trim().startsWith("dn:") : result.data.stdout.trim() === "1");
         if (verified && service.kind === "mysql") {
-          const rootCheck = await runCommand(options.runtime, [...args.slice(0, -3), "root", service.database, service.container], { input: `${password}
-`, secrets, timeoutMs: 15e3, maxCaptureChars: 1024 });
+          const rootCheck = await runCommand(options.runtime, [
+            ...args.slice(0, -3),
+            "root",
+            service.database,
+            service.container
+          ], {
+            input: `${password}
+`,
+            secrets,
+            timeoutMs: 15e3,
+            maxCaptureChars: 1024
+          });
           verified = rootCheck.success && !rootCheck.data.stdoutTruncated && rootCheck.data.stdout.trim() === "1";
           const invalidPassword = `hai-import-invalid-${randomUUID()}`;
           for (const username of [service.username, "root"]) {
             if (!verified)
               break;
-            const negative = await runCommand(options.runtime, [...args.slice(0, -3), username, service.database, service.container], { input: `${invalidPassword}
-`, secrets: [...secrets, invalidPassword], timeoutMs: 15e3, maxCaptureChars: 1024 });
+            const negative = await runCommand(options.runtime, [
+              ...args.slice(0, -3),
+              username,
+              service.database,
+              service.container
+            ], {
+              input: `${invalidPassword}
+`,
+              secrets: [...secrets, invalidPassword],
+              timeoutMs: 15e3,
+              maxCaptureChars: 1024
+            });
             verified = !negative.success && /ERROR 1045 \(28000\)/.test(negative.error.message);
           }
         }
@@ -12586,8 +14189,15 @@ async function importDeploymentSecrets(options) {
       phase = "identity";
     }
     phase = "state";
-    const uniqueVolumes = [...new Map(volumes.map((volume) => [`${volume.group}:${volume.name}`, volume])).values()].sort((a, b) => `${a.group}:${a.name}`.localeCompare(`${b.group}:${b.name}`));
-    const lines = ["FORMAT_VERSION=2", `PROJECT=${project}`, ...selectedGroups.map((group) => `${group}=${Buffer.from(config.credentials[group], "utf8").toString("hex")}`), ...uniqueVolumes.map((volume, index) => `VOLUME_${index + 1}=${volume.group}:${volume.name}`)];
+    const uniqueVolumes = [
+      ...new Map(volumes.map((volume) => [`${volume.group}:${volume.name}`, volume])).values()
+    ].sort((a, b) => `${a.group}:${a.name}`.localeCompare(`${b.group}:${b.name}`));
+    const lines = [
+      "FORMAT_VERSION=2",
+      `PROJECT=${project}`,
+      ...selectedGroups.map((group) => `${group}=${Buffer.from(config.credentials[group], "utf8").toString("hex")}`),
+      ...uniqueVolumes.map((volume, index) => `VOLUME_${index + 1}=${volume.group}:${volume.name}`)
+    ];
     let changed = false;
     if (existsSync(stateFile) || isSymbolicLink(stateFile)) {
       const existing = readImportedState(privateFile(stateFile));
@@ -12600,9 +14210,24 @@ async function importDeploymentSecrets(options) {
         throw new Error("lock");
       changed = true;
     }
-    return ok({ projectName: config.projectName, stateVersion: 2, groups: selectedGroups, volumes: uniqueVolumes.map((volume) => volume.name), changed });
+    return ok({
+      projectName: config.projectName,
+      stateVersion: 2,
+      groups: selectedGroups,
+      volumes: uniqueVolumes.map((volume) => volume.name),
+      changed
+    });
   } catch {
-    return err({ ...HaiDeployError.CONFIG_ERROR, message: deployM("deploy_secretImportFailed", { params: { phase } }), ext: { phase, state: commitAttempted ? "unknown" : "unchanged" } });
+    return err({
+      ...HaiDeployError.CONFIG_ERROR,
+      message: deployM("deploy_secretImportFailed", {
+        params: { phase }
+      }),
+      ext: {
+        phase,
+        state: commitAttempted ? "unknown" : "unchanged"
+      }
+    });
   } finally {
     await lock?.release();
   }
@@ -12638,19 +14263,26 @@ function isSymbolicLink(path) {
   }
 }
 function privateFile(path) {
-  const stat = lstatSync(path);
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 65536 || process.platform !== "win32" && (stat.mode & 63 || process.getuid?.() !== 0 && stat.uid !== process.getuid?.()))
-    throw new Error("private-file");
-  return readFileSync(path, "utf8");
+  return readLocalFile(path, { maxBytes: 65536, private: true }).toString("utf8");
 }
 async function inspectContainer(runtime, container, secrets) {
-  const result = await runCommand(runtime, ["inspect", "--format", "{{json .Config.Labels}}\n{{json .Mounts}}\n{{json .State.Running}}\n{{json .NetworkSettings.Networks}}", container], { secrets, timeoutMs: 1e4, maxCaptureChars: 32768 });
+  const result = await runCommand(runtime, [
+    "inspect",
+    "--format",
+    "{{json .Config.Labels}}\n{{json .Mounts}}\n{{json .State.Running}}\n{{json .NetworkSettings.Networks}}",
+    container
+  ], { secrets, timeoutMs: 1e4, maxCaptureChars: 32768 });
   if (!result.success || result.data.stdoutTruncated)
     throw new Error("identity");
   const [labelsText, mountsText, runningText, networksText] = result.data.stdout.trim().split("\n");
   const labels = z.record(z.string(), z.string()).parse(JSON.parse(labelsText));
-  const mounts = z.array(z.object({ Type: z.string(), Name: z.string().optional() })).parse(JSON.parse(mountsText));
-  const networks = z.record(z.string(), z.object({ NetworkID: z.string() })).parse(JSON.parse(networksText) ?? {});
+  const mounts = z.array(z.object({
+    Type: z.string(),
+    Name: z.string().optional()
+  })).parse(JSON.parse(mountsText));
+  const networks = z.record(z.string(), z.object({
+    NetworkID: z.string()
+  })).parse(JSON.parse(networksText) ?? {});
   const dockerProject = labels["com.docker.compose.project"] || void 0;
   const podmanProject = labels["io.podman.compose.project"] || void 0;
   const dockerService = labels["com.docker.compose.service"] || void 0;
@@ -12658,11 +14290,27 @@ async function inspectContainer(runtime, container, secrets) {
   if (Boolean(dockerProject) !== Boolean(dockerService) || Boolean(podmanProject) !== Boolean(podmanService) || dockerProject && podmanProject && dockerProject !== podmanProject || dockerService && podmanService && dockerService !== podmanService) {
     throw new Error("identity");
   }
-  return { project: dockerProject ?? podmanProject, service: dockerService ?? podmanService, running: runningText === "true", volumes: mounts.flatMap((mount) => mount.Type === "volume" && mount.Name ? [mount.Name] : []), networks: Object.values(networks).map((network) => network.NetworkID) };
+  return {
+    project: dockerProject ?? podmanProject,
+    service: dockerService ?? podmanService,
+    running: runningText === "true",
+    volumes: mounts.flatMap((mount) => mount.Type === "volume" && mount.Name ? [mount.Name] : []),
+    networks: Object.values(networks).map((network) => network.NetworkID)
+  };
 }
 async function acquireImportLock(path, root) {
   return new Promise((resolveLock, reject) => {
-    const child = spawn("flock", ["-n", path, process.execPath, "-e", importCommitScript, root], { stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+    const child = spawn("flock", [
+      "-n",
+      path,
+      process.execPath,
+      "-e",
+      importCommitScript,
+      root
+    ], {
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true
+    });
     let acquired = false;
     let exited = false;
     let output = "";