@h-ai/deploy 1.0.0-beta.2 → 1.0.0-beta.4

package/dist/index.js

@@ -1,18 +1,23 @@
-import { createHash, randomUUID, randomBytes } from 'crypto';
-import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, readdirSync, realpathSync, chmodSync, mkdirSync, mkdtempSync, copyFileSync, renameSync, rmSync, statSync } from 'fs';
+import { createHash, randomUUID, randomBytes, X509Certificate, createPublicKey, createPrivateKey } from 'crypto';
+import { createReadStream, readFileSync, existsSync, lstatSync, writeFileSync, readdirSync, realpathSync, chmodSync, mkdirSync, statSync, mkdtempSync, copyFileSync, renameSync, rmSync, createWriteStream } from 'fs';
 import { resolve, extname, join, dirname, relative, basename, sep } from 'path';
 import { z } from 'zod';
-import { core, err, ok, RequestAccessConfigSchema, TrustedProxiesSchema } from '@h-ai/core';
+import { core, err, ok, CoreConfigSchema, RequestAccessConfigSchema, TrustedProxiesSchema } from '@h-ai/core';
 import process6 from 'process';
 import { parseEnv } from 'util';
 import { LineCounter, parseDocument, parse, stringify, parseAllDocuments } from 'yaml';
 import { homedir, tmpdir } from 'os';
+import { request } from 'https';
+import { rootCertificates } from 'tls';
 import { resolveFeedbackBudget } from '@h-ai/api-contract/feedback';
 import { resolveTransportBodyLimits, createTransportBodyPolicy, parseTransportServerKeyRing } from '@h-ai/crypto';
+import { Transform } from 'stream';
+import { pipeline } from 'stream/promises';
 import { spawn } from 'child_process';
 import { readdir, readFile } from 'fs/promises';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
 import { Buffer } from 'buffer';
+import { isIP } from 'net';
 
 // src/deploy-artifact.ts
 var DeploymentArtifactSchema = z.object({
@@ -119,7 +124,7 @@ var en_US_default = {
   deploy_storageProxyInvalid: "Cannot generate the storage proxy. Use a valid DNS bucket name whose path does not overlap the website, API, or health endpoints.",
   deploy_storagePublicEndpointInvalid: "Invalid storage.publicEndpoint. Use a browser-accessible HTTP(S) address with an optional valid proxy path, without a bucket, credentials, query or fragment.",
   deploy_storageBackendRequired: "A static browser app cannot deploy server-side storage credentials. Configure Storage in Serv or SvelteKit and obtain presigned links through its API.",
-  deploy_artifactInvalid: "Image artifacts are missing or invalid. Run pnpm build --target docker, select valid --artifact-dir, or use pnpm run deploy --build.",
+  deploy_artifactInvalid: "Image artifacts are missing or invalid. Run pnpm build --target image, select valid --artifact-dir, or use pnpm run deploy --build.",
   deploy_sshRequired: "Automatic deployment requires SSH settings. Use --bundle-only for manual transfer when the server is unreachable.",
   deploy_sshPasswordInvalid: "SSH passwords must be nonempty, contain no CR/LF/NUL, and be at most 1023 UTF-8 bytes.",
   deploy_sshAskpassFailed: "Could not prepare the managed SSH password helper. Check OpenSSH and Windows PowerShell 5.",
@@ -169,7 +174,9 @@ var en_US_default = {
   deploy_secretImportFailed: "Legacy credential import was rejected during {phase}; check private input permissions, project/volume identity, live credentials and the deployment lock. No services were updated; inspect the protected state file if commit is unconfirmed",
   deploy_projectNameRequired: "The root package.json.name is missing or cannot be normalized into an image and deployment resource identity.",
   deploy_projectNameOverrideRemoved: "Deployment identity comes from the root package.json.name; remove the obsolete projectName override.",
-  deploy_requestAccessInvalid: "Invalid request access policy ({field}). Check fields, IP addresses, timezones and time windows. For a file reference, use readable YAML no larger than 1 MiB. Fix the configuration and create a new bundle."
+  deploy_requestAccessInvalid: "Invalid request access policy ({field}). Check fields, IP addresses, timezones and time windows. For a file reference, use readable YAML no larger than 1 MiB. Fix the configuration and create a new bundle.",
+  deploy_httpsPortsInvalid: "HTTP and HTTPS ports must differ; Let\u2019s Encrypt HTTP-01 requires host port 80.",
+  deploy_httpsCertificateInvalid: "Invalid HTTPS certificate. Check readable PEM files, matching unencrypted private key, validity dates and domain, then repackage."
 };
 
 // messages/ja-JP.json
@@ -227,7 +234,7 @@ var ja_JP_default = {
   deploy_storageProxyInvalid: "\u30B9\u30C8\u30EC\u30FC\u30B8\u30D7\u30ED\u30AD\u30B7\u3092\u751F\u6210\u3067\u304D\u307E\u305B\u3093\u3002\u6709\u52B9\u306A DNS \u30D0\u30B1\u30C3\u30C8\u540D\u3092\u6307\u5B9A\u3057\u3001\u30B5\u30A4\u30C8\u3001API\u3001\u30D8\u30EB\u30B9\u30C1\u30A7\u30C3\u30AF\u306E\u30D1\u30B9\u3068\u306E\u91CD\u8907\u3092\u907F\u3051\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_storagePublicEndpointInvalid: "storage.publicEndpoint \u304C\u7121\u52B9\u3067\u3059\u3002\u30D6\u30E9\u30A6\u30B6\u30FC\u304B\u3089\u5230\u9054\u53EF\u80FD\u306A HTTP(S) \u30A2\u30C9\u30EC\u30B9\u306B\u6709\u52B9\u306A\u30D7\u30ED\u30AD\u30B7\u30D1\u30B9\u3092\u6307\u5B9A\u3067\u304D\u307E\u3059\u3002\u30D0\u30B1\u30C3\u30C8\u3001\u8A8D\u8A3C\u60C5\u5831\u3001\u30AF\u30A8\u30EA\u3001\u30D5\u30E9\u30B0\u30E1\u30F3\u30C8\u306F\u542B\u3081\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002",
   deploy_storageBackendRequired: "\u9759\u7684\u30D6\u30E9\u30A6\u30B6\u30A2\u30D7\u30EA\u306B\u306F\u30B5\u30FC\u30D0\u30FC\u7528\u30B9\u30C8\u30EC\u30FC\u30B8\u8A8D\u8A3C\u60C5\u5831\u3092\u914D\u7F6E\u3067\u304D\u307E\u305B\u3093\u3002Serv \u307E\u305F\u306F SvelteKit \u3067 Storage \u3092\u8A2D\u5B9A\u3057\u3001API \u7D4C\u7531\u3067\u7F72\u540D\u4ED8\u304D\u30EA\u30F3\u30AF\u3092\u53D6\u5F97\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-  deploy_artifactInvalid: "\u30A4\u30E1\u30FC\u30B8\u6210\u679C\u7269\u304C\u5B58\u5728\u3057\u306A\u3044\u304B\u3001\u7121\u52B9\u3067\u3059\u3002pnpm build --target docker \u3092\u5B9F\u884C\u3059\u308B\u304B\u3001--artifact-dir \u3067\u6709\u52B9\u306A\u6210\u679C\u7269\u3092\u9078\u629E\u3059\u308B\u304B\u3001pnpm run deploy --build \u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_artifactInvalid: "\u30A4\u30E1\u30FC\u30B8\u6210\u679C\u7269\u304C\u5B58\u5728\u3057\u306A\u3044\u304B\u3001\u7121\u52B9\u3067\u3059\u3002pnpm build --target image \u3092\u5B9F\u884C\u3059\u308B\u304B\u3001--artifact-dir \u3067\u6709\u52B9\u306A\u6210\u679C\u7269\u3092\u9078\u629E\u3059\u308B\u304B\u3001pnpm run deploy --build \u3092\u4F7F\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_sshRequired: "\u81EA\u52D5\u30C7\u30D7\u30ED\u30A4\u306B\u306FSSH\u8A2D\u5B9A\u304C\u5FC5\u8981\u3067\u3059\u3002\u30B5\u30FC\u30D0\u30FC\u306B\u63A5\u7D9A\u3067\u304D\u306A\u3044\u5834\u5408\u306F--bundle-only\u3067\u624B\u52D5\u8EE2\u9001\u7528\u306E\u30D0\u30F3\u30C9\u30EB\u3092\u751F\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_sshPasswordInvalid: "SSH\u30D1\u30B9\u30EF\u30FC\u30C9\u306F\u7A7A\u306B\u3067\u304D\u305A\u3001CR/LF/NUL\u3092\u542B\u3081\u3089\u308C\u307E\u305B\u3093\u3002UTF-8\u30671023\u30D0\u30A4\u30C8\u4EE5\u4E0B\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_sshAskpassFailed: "\u7BA1\u7406\u5BFE\u8C61\u306ESSH\u30D1\u30B9\u30EF\u30FC\u30C9helper\u3092\u6E96\u5099\u3067\u304D\u307E\u305B\u3093\u3002OpenSSH\u3068Windows PowerShell 5\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
@@ -277,7 +284,9 @@ var ja_JP_default = {
   deploy_secretImportFailed: "\u65E7\u8A8D\u8A3C\u60C5\u5831\u306E\u30A4\u30F3\u30DD\u30FC\u30C8\u306F {phase} \u6BB5\u968E\u3067\u62D2\u5426\u3055\u308C\u307E\u3057\u305F\u3002\u5165\u529B\u6A29\u9650\u3001\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u3068\u30DC\u30EA\u30E5\u30FC\u30E0\u3001\u5B9F\u969B\u306E\u8A8D\u8A3C\u60C5\u5831\u3001\u30C7\u30D7\u30ED\u30A4\u30ED\u30C3\u30AF\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30B5\u30FC\u30D3\u30B9\u306F\u66F4\u65B0\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u78BA\u5B9A\u304C\u4E0D\u660E\u306A\u5834\u5408\u306F\u4FDD\u8B77\u3055\u308C\u305F\u72B6\u614B\u30D5\u30A1\u30A4\u30EB\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044",
   deploy_projectNameRequired: "\u5DE5\u7A0B\u30EB\u30FC\u30C8\u306E package.json.name \u304C\u306A\u3044\u304B\u6B63\u898F\u5316\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30A4\u30E1\u30FC\u30B8\u3068\u30C7\u30D7\u30ED\u30A4\u30EA\u30BD\u30FC\u30B9\u306E\u8B58\u5225\u540D\u3092\u751F\u6210\u3067\u304D\u307E\u305B\u3093\u3002",
   deploy_projectNameOverrideRemoved: "\u30C7\u30D7\u30ED\u30A4\u8B58\u5225\u540D\u306F\u5DE5\u7A0B\u30EB\u30FC\u30C8\u306E package.json.name \u304B\u3089\u53D6\u5F97\u3057\u307E\u3059\u3002\u65E7 projectName \u4E0A\u66F8\u304D\u5F15\u6570\u3092\u524A\u9664\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-  deploy_requestAccessInvalid: "\u30EA\u30AF\u30A8\u30B9\u30C8\u30A2\u30AF\u30BB\u30B9\u8A2D\u5B9A\uFF08{field}\uFF09\u304C\u7121\u52B9\u3067\u3059\u3002\u30D5\u30A3\u30FC\u30EB\u30C9\u3001IP\u3001\u30BF\u30A4\u30E0\u30BE\u30FC\u30F3\u3001\u6642\u9593\u5E2F\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30D5\u30A1\u30A4\u30EB\u306F\u8AAD\u307F\u53D6\u308A\u53EF\u80FD\u306A 1 MiB \u4EE5\u4E0B\u306E YAML \u3092\u6307\u5B9A\u3057\u3001\u4FEE\u6B63\u5F8C\u306B\u518D\u30D1\u30C3\u30B1\u30FC\u30B8\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+  deploy_requestAccessInvalid: "\u30EA\u30AF\u30A8\u30B9\u30C8\u30A2\u30AF\u30BB\u30B9\u8A2D\u5B9A\uFF08{field}\uFF09\u304C\u7121\u52B9\u3067\u3059\u3002\u30D5\u30A3\u30FC\u30EB\u30C9\u3001IP\u3001\u30BF\u30A4\u30E0\u30BE\u30FC\u30F3\u3001\u6642\u9593\u5E2F\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30D5\u30A1\u30A4\u30EB\u306F\u8AAD\u307F\u53D6\u308A\u53EF\u80FD\u306A 1 MiB \u4EE5\u4E0B\u306E YAML \u3092\u6307\u5B9A\u3057\u3001\u4FEE\u6B63\u5F8C\u306B\u518D\u30D1\u30C3\u30B1\u30FC\u30B8\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  deploy_httpsPortsInvalid: "HTTP \u3068 HTTPS \u306E\u30DD\u30FC\u30C8\u306F\u7570\u306A\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002Let\u2019s Encrypt HTTP-01 \u306B\u306F\u30DB\u30B9\u30C8\u306E\u30DD\u30FC\u30C8 80 \u304C\u5FC5\u8981\u3067\u3059\u3002",
+  deploy_httpsCertificateInvalid: "HTTPS \u8A3C\u660E\u66F8\u304C\u7121\u52B9\u3067\u3059\u3002PEM \u30D5\u30A1\u30A4\u30EB\u3001\u6697\u53F7\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u79D8\u5BC6\u9375\u3068\u306E\u4E00\u81F4\u3001\u6709\u52B9\u671F\u9593\u3001\u30C9\u30E1\u30A4\u30F3\u3092\u78BA\u8A8D\u3057\u3001\u518D\u4F5C\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -335,7 +344,7 @@ var zh_CN_default = {
   deploy_storageProxyInvalid: "\u65E0\u6CD5\u751F\u6210\u5BF9\u8C61\u5B58\u50A8\u4EE3\u7406\uFF1A\u8BF7\u4F7F\u7528\u6709\u6548\u7684 DNS \u6876\u540D\uFF0C\u5E76\u786E\u4FDD\u6876\u8DEF\u5F84\u4E0D\u4E0E\u7F51\u7AD9\u76EE\u5F55\u3001API \u6216\u5065\u5EB7\u68C0\u67E5\u5165\u53E3\u91CD\u53E0\u3002",
   deploy_storagePublicEndpointInvalid: "storage.publicEndpoint \u65E0\u6548\uFF1A\u8BF7\u586B\u5199\u6D4F\u89C8\u5668\u53EF\u8BBF\u95EE\u7684 HTTP(S) \u5730\u5740\uFF0C\u53EF\u5305\u542B\u89C4\u8303\u7684\u4EE3\u7406\u76EE\u5F55\uFF0C\u4E0D\u80FD\u5305\u542B\u6876\u540D\u3001\u51ED\u636E\u3001\u67E5\u8BE2\u6216\u7247\u6BB5\u3002",
   deploy_storageBackendRequired: "\u9759\u6001\u6D4F\u89C8\u5668\u5E94\u7528\u4E0D\u80FD\u90E8\u7F72\u5B58\u50A8\u670D\u52A1\u7AEF\u914D\u7F6E\u3002\u8BF7\u5728 Serv \u6216 SvelteKit \u670D\u52A1\u4E2D\u914D\u7F6E Storage\uFF0C\u518D\u901A\u8FC7 API \u83B7\u53D6\u9884\u7B7E\u540D\u94FE\u63A5\u3002",
-  deploy_artifactInvalid: "\u955C\u50CF\u4EA7\u7269\u7F3A\u5931\u6216\u6821\u9A8C\u5931\u8D25\u3002\u8BF7\u5148\u6267\u884C pnpm build --target docker\uFF0C\u6216\u7528 --artifact-dir \u6307\u5B9A\u6709\u6548\u4EA7\u7269\uFF1B\u4E5F\u53EF\u7528 pnpm run deploy --build \u4E00\u6B21\u5B8C\u6210\u3002",
+  deploy_artifactInvalid: "\u955C\u50CF\u4EA7\u7269\u7F3A\u5931\u6216\u6821\u9A8C\u5931\u8D25\u3002\u8BF7\u5148\u6267\u884C pnpm build --target image\uFF0C\u6216\u7528 --artifact-dir \u6307\u5B9A\u6709\u6548\u4EA7\u7269\uFF1B\u4E5F\u53EF\u7528 pnpm run deploy --build \u4E00\u6B21\u5B8C\u6210\u3002",
   deploy_sshRequired: "\u81EA\u52A8\u90E8\u7F72\u9700\u8981 SSH \u914D\u7F6E\uFF1B\u65E0\u7F51\u7EDC\u8FDE\u63A5\u65F6\u4F7F\u7528 --bundle-only \u751F\u6210\u90E8\u7F72\u5305\u5E76\u624B\u5DE5\u642C\u8FD0\u3002",
   deploy_sshPasswordInvalid: "SSH \u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A\u6216\u5305\u542B CR/LF/NUL\uFF0CUTF-8 \u957F\u5EA6\u4E0D\u80FD\u8D85\u8FC7 1023 \u5B57\u8282\u3002",
   deploy_sshAskpassFailed: "\u65E0\u6CD5\u51C6\u5907\u53D7\u63A7 SSH \u5BC6\u7801 helper\uFF1B\u8BF7\u68C0\u67E5\u7CFB\u7EDF OpenSSH \u548C Windows PowerShell 5\u3002",
@@ -385,7 +394,9 @@ var zh_CN_default = {
   deploy_secretImportFailed: "\u65E7\u51ED\u636E\u5BFC\u5165\u5728 {phase} \u9636\u6BB5\u88AB\u62D2\u7EDD\uFF1B\u8BF7\u6838\u5BF9\u79C1\u6709\u8F93\u5165\u6743\u9650\u3001\u9879\u76EE/\u5377\u8EAB\u4EFD\u3001\u5B9E\u9645\u670D\u52A1\u51ED\u636E\u53CA\u90E8\u7F72\u9501\uFF0C\u672A\u6267\u884C\u670D\u52A1\u66F4\u65B0\uFF1B\u63D0\u4EA4\u7ED3\u679C\u4E0D\u660E\u65F6\u8BF7\u6838\u5BF9\u53D7\u4FDD\u62A4\u7684\u72B6\u6001\u6587\u4EF6",
   deploy_projectNameRequired: "\u5DE5\u7A0B\u6839 package.json.name \u7F3A\u5931\u6216\u65E0\u6CD5\u5F52\u4E00\u5316\uFF0C\u4E0D\u80FD\u751F\u6210\u955C\u50CF\u4E0E\u90E8\u7F72\u8D44\u6E90\u8EAB\u4EFD\u3002",
   deploy_projectNameOverrideRemoved: "\u90E8\u7F72\u9879\u76EE\u540D\u7EDF\u4E00\u6765\u81EA\u5DE5\u7A0B\u6839 package.json.name\uFF1B\u8BF7\u79FB\u9664\u65E7 projectName \u8986\u76D6\u53C2\u6570\u3002",
-  deploy_requestAccessInvalid: "\u8BF7\u6C42\u8BBF\u95EE\u7B56\u7565\u914D\u7F6E\u65E0\u6548\uFF08{field}\uFF09\u3002\u8BF7\u68C0\u67E5\u5B57\u6BB5\u3001IP\u3001\u65F6\u533A\u53CA\u65F6\u95F4\u7A97\u53E3\uFF1B\u5982\u5F15\u7528\u6587\u4EF6\uFF0C\u8BF7\u786E\u8BA4\u6587\u4EF6\u53EF\u8BFB\u3001\u683C\u5F0F\u4E3A YAML \u4E14\u4E0D\u8D85\u8FC7 1 MiB\u3002\u4FEE\u6B63\u540E\u91CD\u65B0\u6253\u5305\u3002"
+  deploy_requestAccessInvalid: "\u8BF7\u6C42\u8BBF\u95EE\u7B56\u7565\u914D\u7F6E\u65E0\u6548\uFF08{field}\uFF09\u3002\u8BF7\u68C0\u67E5\u5B57\u6BB5\u3001IP\u3001\u65F6\u533A\u53CA\u65F6\u95F4\u7A97\u53E3\uFF1B\u5982\u5F15\u7528\u6587\u4EF6\uFF0C\u8BF7\u786E\u8BA4\u6587\u4EF6\u53EF\u8BFB\u3001\u683C\u5F0F\u4E3A YAML \u4E14\u4E0D\u8D85\u8FC7 1 MiB\u3002\u4FEE\u6B63\u540E\u91CD\u65B0\u6253\u5305\u3002",
+  deploy_httpsPortsInvalid: "HTTP \u4E0E HTTPS \u7AEF\u53E3\u5FC5\u987B\u4E0D\u540C\uFF1BLet\u2019s Encrypt \u7684 HTTP-01 \u5165\u53E3\u5FC5\u987B\u4F7F\u7528\u5BBF\u4E3B\u673A 80 \u7AEF\u53E3\u3002",
+  deploy_httpsCertificateInvalid: "HTTPS \u8BC1\u4E66\u65E0\u6548\uFF1A\u8BF7\u6838\u5BF9 PEM \u6587\u4EF6\u53EF\u8BFB\u3001\u8BC1\u4E66\u4E0E\u672A\u52A0\u5BC6\u79C1\u94A5\u5339\u914D\u3001\u8BC1\u4E66\u6709\u6548\u671F\u53CA\u57DF\u540D\uFF0C\u7136\u540E\u91CD\u65B0\u6253\u5305\u3002"
 };
 
 // src/deploy-i18n.ts
@@ -425,12 +436,43 @@ var SshConfigSchema = z.object({
   if (!ssh.password || /[\r\n\0]/.test(ssh.password) || new TextEncoder().encode(ssh.password).length > 1023)
     context.addIssue({ code: "custom", path: ["password"], message: deployM("deploy_sshPasswordInvalid") });
 });
+var HttpsDomainSchema = z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/i).refine((value) => !value.includes(".."));
+var httpsOptions = {
+  /** 公开访问域名；同时用于证书身份校验和 Nginx 入口。 */
+  domain: HttpsDomainSchema.describe("HTTPS \u516C\u5F00\u57DF\u540D\uFF1B\u8BC1\u4E66\u5FC5\u987B\u5339\u914D\u8BE5\u57DF\u540D"),
+  /** HTTPS 宿主端口，与 HTTP 端口不同。 */
+  port: z.number().int().min(1).max(65535).default(443).describe("HTTPS \u5BBF\u4E3B\u7AEF\u53E3\uFF0C\u9ED8\u8BA4 443\uFF0C\u987B\u4E0E HTTP \u7AEF\u53E3\u4E0D\u540C"),
+  /** 是否将普通 HTTP 请求跳转到 HTTPS。 */
+  redirectHttp: z.boolean().default(true).describe("\u666E\u901A HTTP \u8BF7\u6C42\u662F\u5426\u4EE5 308 \u8DF3\u8F6C\u81F3 HTTPS\uFF0C\u5065\u5EB7\u68C0\u67E5\u548C ACME \u6311\u6218\u9664\u5916")
+};
+var HttpsConfigSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("files"),
+    ...httpsOptions,
+    /** 相对于工程根或绝对路径的 PEM 完整证书链及未加密私钥。 */
+    certificateFile: z.string().min(1).describe("PEM \u5B8C\u6574\u8BC1\u4E66\u94FE\u8DEF\u5F84\uFF0C\u76F8\u5BF9\u5DE5\u7A0B\u6839\u6216\u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u6253\u5305\u65F6\u590D\u5236\u5230\u79C1\u6709\u53D1\u5E03\u76EE\u5F55"),
+    privateKeyFile: z.string().min(1).describe("\u672A\u52A0\u5BC6 PEM \u79C1\u94A5\u8DEF\u5F84\uFF0C\u76F8\u5BF9\u5DE5\u7A0B\u6839\u6216\u7EDD\u5BF9\u8DEF\u5F84\uFF1B\u5FC5\u987B\u4E0E\u8BC1\u4E66\u5339\u914D")
+  }),
+  z.object({
+    type: z.literal("letsencrypt"),
+    ...httpsOptions,
+    domain: HttpsDomainSchema.refine((value) => value.includes(".") && !/^\d+(?:\.\d+){3}$/.test(value)).describe("Let\u2019s Encrypt \u5355\u4E2A\u516C\u7F51\u57DF\u540D\uFF0C\u4F7F\u7528 HTTP-01\uFF0C\u4E0D\u652F\u6301 IP \u6216\u901A\u914D\u7B26"),
+    email: z.email().describe("Let\u2019s Encrypt \u8D26\u53F7\u8054\u7CFB\u90AE\u7BB1"),
+    /** 使用者须明确同意 Let's Encrypt 的服务条款。 */
+    acceptTerms: z.literal(true).describe("\u660E\u786E\u540C\u610F Let\u2019s Encrypt \u670D\u52A1\u6761\u6B3E\u540E\u624D\u53EF\u8BBE\u7F6E\u4E3A true")
+  })
+]);
 var PortExposeSchema = z.object({
   type: z.literal("port").default("port"),
   /** 容器内监听端口（adapter-node 默认 3000） */
   containerPort: z.number().int().min(1).max(65535).default(3e3),
   /** 宿主机映射端口 */
-  hostPort: z.number().int().min(1).max(65535)
+  hostPort: z.number().int().min(1).max(65535),
+  /** 可选 HTTPS：已有 PEM 文件或官方 Certbot 自动申请续期；省略保留 HTTP。 */
+  https: HttpsConfigSchema.optional().describe("\u53EF\u9009 HTTPS \u5165\u53E3\uFF1Bfiles \u4F7F\u7528\u5DF2\u6709\u8BC1\u4E66\uFF0Cletsencrypt \u4F7F\u7528\u5B98\u65B9 Certbot \u7533\u8BF7\u7EED\u671F\uFF0C\u7701\u7565\u4FDD\u6301 HTTP")
+}).superRefine((expose, context) => {
+  if (expose.https && (expose.https.port === expose.hostPort || expose.https.type === "letsencrypt" && expose.hostPort !== 80))
+    context.addIssue({ code: "custom", path: ["https"], message: deployM("deploy_httpsPortsInvalid") });
 });
 var ExposeSchema = PortExposeSchema;
 var DockerSshProviderConfigSchema = z.object({
@@ -929,6 +971,32 @@ function saveCredentials(entries) {
     );
   }
 }
+
+// src/deploy-middleware-config.ts
+var connectionFields = {
+  db: ["url", "host", "port", "database", "user", "password", "ssl"],
+  cache: ["url", "host", "port", "password", "cluster", "sentinel", "tls"],
+  storage: ["endpoint", "bucket", "region", "accessKeyId", "secretAccessKey", "forcePathStyle", "createBucket"],
+  vecdb: ["url", "host", "port", "database", "user", "password", "apiKey", "path", "serverCommand", "startupTimeout"],
+  ldap: ["url", "bindDn", "bindPassword", "searchBase", "useTls"],
+  email: ["host", "port", "secure", "user", "pass"]
+};
+function mergeManagedMiddlewareConfig(requirement, supplied) {
+  if (!requirement || requirement.service !== "ldap" && requirement.backend !== supplied.type)
+    return supplied;
+  const configured = { ...requirement.config };
+  for (const field2 of connectionFields[requirement.service] ?? [])
+    delete configured[field2];
+  const merged = { ...configured, ...supplied };
+  if (requirement.service === "cache" && typeof configured.db === "number" && typeof supplied.url === "string") {
+    const url = new URL(supplied.url);
+    if (configured.db !== 0 || url.pathname !== "" && url.pathname !== "/") {
+      url.pathname = String(configured.db);
+      merged.url = url.toString();
+    }
+  }
+  return merged;
+}
 var RecoverySchema = z.object({
   projectName: z.string(),
   stage: z.string(),
@@ -1796,7 +1864,7 @@ async function groupExited(pid) {
 async function helper(command, args, timeoutMs) {
   if (timeoutMs <= 0)
     return false;
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = spawn(command, args, { windowsHide: true, shell: false, stdio: "ignore" });
     let settled = false;
     let timer;
@@ -1806,7 +1874,7 @@ async function helper(command, args, timeoutMs) {
       settled = true;
       if (timer)
         clearTimeout(timer);
-      resolve8(success);
+      resolve9(success);
     };
     timer = globalThis.setTimeout(() => {
       child.kill("SIGKILL");
@@ -1949,7 +2017,7 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
     ext: { commandExecution: state }
   });
   try {
-    return await new Promise((resolve8) => {
+    return await new Promise((resolve9) => {
       if (typeof command !== "string" || !command || command.includes("\0") || args.some((argument) => typeof argument !== "string" || argument.includes("\0")))
         throw new TypeError("Invalid command arguments");
       if (options.input !== void 0 && typeof options.input !== "string")
@@ -1984,7 +2052,7 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
         settled = true;
         if (timer)
           clearTimeout(timer);
-        resolve8(result);
+        resolve9(result);
       };
       const interrupt = (reason, message) => {
         interrupted = true;
@@ -2433,7 +2501,7 @@ start_services() {
   application_services=''
   application_orphan_option=$orphan_option
   for service in "$@"; do
-    case "$service" in serv|web|gateway) ;; *) middleware_services="$middleware_services $service";; esac
+    case "$service" in serv|web|gateway|certbot) ;; *) middleware_services="$middleware_services $service";; esac
   done
   if [ -n "$middleware_services" ]; then
     compose up -d --no-deps --no-build --pull never "$recreate_option" $orphan_option $middleware_services || return 1
@@ -2449,6 +2517,9 @@ start_services() {
   fi
   case " $* " in *' gateway '*) compose up -d --no-deps --no-build --pull never "$recreate_option" gateway || return 1;; esac
 }
+start_renewal() {
+  case " $* " in *' certbot '*) compose up -d --no-deps --no-build --pull never --no-recreate certbot || return 1;; esac
+}
 read_proxy_service() {
   proxy_directory=$1
   if [ -e "$proxy_directory/proxy-service" ] || [ -L "$proxy_directory/proxy-service" ]; then
@@ -2472,13 +2543,22 @@ reload_retained_proxy() {
   esac
 }
 wait_http() {
-  http_port=$1
-  shift
+  http_release=$1
+  http_port=$2
+  shift 2
+  https_domain=''
+  if [ -f "$http_release/https" ]; then
+    read -r https_domain https_port https_type < "$http_release/https"
+    https_certificates="$http_release/tls"
+    if [ "$https_type" = letsencrypt ]; then https_certificates="$root/https/certificates/$https_domain"; fi
+  fi
   for http_path in "$@"; do
     http_ready=false
     http_attempt=0
     while [ "$http_attempt" -lt 40 ]; do
-      if curl --noproxy '*' -fsS --max-time 5 "http://127.0.0.1:$http_port$http_path" >/dev/null 2>&1; then http_ready=true; break; fi
+      if [ -n "$https_domain" ]; then
+        if curl --noproxy '*' -fsS --max-time 5 --cacert "$https_certificates/fullchain.pem" --resolve "$https_domain:$https_port:127.0.0.1" "https://$https_domain:$https_port$http_path" >/dev/null 2>&1; then http_ready=true; break; fi
+      elif curl --noproxy '*' -fsS --max-time 5 "http://127.0.0.1:$http_port$http_path" >/dev/null 2>&1; then http_ready=true; break; fi
       http_attempt=$((http_attempt + 1))
       sleep 3
     done
@@ -2491,7 +2571,6 @@ verify_recovery() {
   recovery_port=$(awk -F: 'NR == 1 { print $1 }' "$recovery_release/layout") || return 1
   recovery_paths=''
   if [ -f "$recovery_release/health-paths" ]; then
-    recovery_port=$(cat "$recovery_release/health-port") || return 1
     recovery_paths=$(cat "$recovery_release/health-paths") || return 1
   else
     # 旧格式发布没有独立健康文件；按已存拓扑恢复最小 HTTP 检查。
@@ -2501,10 +2580,10 @@ verify_recovery() {
     elif [ "$recovery_primary" = web ]; then recovery_paths='/'; else recovery_paths='/health'; fi
   fi
   case "$recovery_port" in ''|*[!0-9]*) return 1;; esac
-  test -n "$recovery_paths" || return 1
   wait_services $recover_selected || return 1
+  start_renewal $recover_selected || return 1
   reload_retained_proxy "$recovery_release" || return 1
-  wait_http "$recovery_port" $recovery_paths
+  wait_http "$recovery_release" "$recovery_port" $recovery_paths
 }
 finish() {
   code=$?
@@ -2632,7 +2711,7 @@ if [ "$partial" = true ]; then
   test "$current_storage_routing" = "$previous_storage_routing" || { printf 'Managed storage configuration changed. Create a full deployment to switch its public endpoint, bucket, or access policy consistently.\n' >&2; exit 1; }
   if ! cmp -s layout "$root/releases/$previous/layout"; then
     # 容量调整允许复用已部署 Web 镜像；端口、路由及其余代理策略仍要求全量部署。
-    test "$(awk -F: '{print $1 ":" $2 ":" $3 ":" $4}' layout)" = "$(awk -F: '{print $1 ":" $2 ":" $3 ":" $4}' "$root/releases/$previous/layout")" || { printf 'Ports or application layout changed. Create a full deployment bundle.\n' >&2; exit 1; }
+    test "$(awk -F: '{print $1 ":" $2 ":" $3 ":" $4 ":" $6}' layout)" = "$(awk -F: '{print $1 ":" $2 ":" $3 ":" $4 ":" $6}' "$root/releases/$previous/layout")" || { printf 'Ports, HTTPS or application layout changed. Create a full deployment bundle.\n' >&2; exit 1; }
     test -f web.conf && test -f proxy-entry.json || { printf 'Proxy configuration missing. Create a full deployment bundle.\n' >&2; exit 1; }
     previous_proxy=
     while IFS= read -r compose_file; do
@@ -2650,9 +2729,17 @@ if [ "$partial" = true ]; then
   fi
 fi
 mkdir -p "$release"
-cp -R "$source_dir/." "$release/"
+# 镜像直接从本次解包目录导入；发布记录只保存运行配置与恢复证据。
+for entry in "$source_dir"/* "$source_dir"/.[!.]*; do
+  test -e "$entry" || continue
+  test "$entry" != "$source_dir/images" || continue
+  cp -R "$entry" "$release/"
+done
 # Nginx 以非 root 用户运行；只开放不含凭据的代理配置读取权限。
 if [ -f "$release/web.conf" ]; then chmod 644 "$release/web.conf"; fi
+for https_script in https-start.sh renew-https.sh; do
+  if [ -f "$release/$https_script" ]; then chmod 444 "$release/$https_script"; fi
+done
 # 策略不是凭据，发布目录保持700；只读挂载允许镜像中的非root应用读取。
 if [ -f "$release/request-access.yml" ]; then chmod 444 "$release/request-access.yml"; fi
 : > "$release/compose-files"
@@ -2666,6 +2753,12 @@ if [ "$partial" = true ]; then
 fi
 step credentials 'Resolving server-managed middleware credentials'
 sh "$release/resolve-managed-secrets.sh" "$root" "$release" "$runtime"
+if [ -f "$release/runtime-env.mjs" ]; then
+  # 上级目录保护宿主秘密；只读文件挂载允许非 root 应用读取，宿主所有者仍可修改配置。
+  chmod 700 "$root" "$release"
+  chmod 644 "$release/.env.runtime" "$release/middleware.env"
+  chmod 444 "$release/runtime-env.mjs"
+fi
 # 在任何可能启动服务（包括增量恢复旧拓扑）之前定稿，失败回滚不删除卷的引擎身份。
 sh "$release/resolve-backend-state.sh" "$root" "$release" "$runtime" "$previous" commit
 printf '%s\n' "$release/compose-entry.json" >> "$release/compose-files"
@@ -2703,12 +2796,15 @@ step images 'Loading packaged images (no registry access)'
 while IFS=' ' read -r archive reference; do
   test -n "$archive" || continue
   images_changed=true
-  "$runtime" load -i "$release/images/$archive"
+  "$runtime" load -i "$source_dir/images/$archive"
   "$runtime" image inspect "$reference" >/dev/null
   architecture=$("$runtime" image inspect --format '{{.Architecture}}' "$reference")
   host_arch=$(uname -m)
   case "$host_arch:$architecture" in x86_64:amd64|aarch64:arm64) ;; *) printf 'Image architecture %s does not match server %s\n' "$architecture" "$host_arch" >&2; exit 1;; esac
 done < "$release/image-list"
+if [ -f "$release/prepare-https.sh" ]; then
+  sh "$release/prepare-https.sh" "$root" "$release" "$runtime" prepare "$partial"
+fi
 step dependencies 'Checking dependencies of selected services'
 if [ "$partial" = true ]; then cat "$release/services" >> "$release/dependencies"; fi
 while IFS= read -r dependency; do
@@ -2720,9 +2816,18 @@ step start 'Updating selected services'
 changed=true
 remove_selected $selected
 start_services $selected
+if [ -f "$release/prepare-https.sh" ] && [ "$partial" = false ]; then
+  step https 'Issuing or installing HTTPS certificate'
+  tls_proxy=$(read_proxy_service "$release")
+  wait_services "$tls_proxy"
+  sh "$release/prepare-https.sh" "$root" "$release" "$runtime" issue "$partial"
+  compose exec -T "$tls_proxy" nginx -t
+  compose exec -T "$tls_proxy" nginx -s reload
+fi
+start_renewal $selected
 reload_retained_proxy "$release"
 step health 'Checking HTTP access'
-wait_http @@PORT@@ @@HEALTH@@
+wait_http "$release" @@PORT@@ @@HEALTH@@
 step complete 'Deployment passed all checks'
 printf '%s\n' "$id" > "$root/current.next"
 mv "$root/current.next" "$root/current"
@@ -2776,7 +2881,7 @@ case "$timeout" in ''|*[!0-9]*|???????????*) invalid_target;; esac
 test "$timeout" -ge 1 && test "$timeout" -le 2147483647 || invalid_target
 case "$remote" in /*) ;; *) invalid_target;; esac
 case "$remote" in *[!a-zA-Z0-9/_.\ -]*|*/../*|*/..|/..) invalid_target;; esac
-case "$bundle" in *.tar) ;; *) invalid_target;; esac
+case "$bundle" in *.tar|*.tar.gz) ;; *) invalid_target;; esac
 case "$bundle" in ''|*[!a-zA-Z0-9_.+-]*) invalid_target;; esac
 case "$strict" in true) strict=accept-new;; false) strict=no;; *) invalid_target;; esac
 test -f "./$bundle" || { printf 'Bundle missing: %s\n' "$bundle" >&2; exit 1; }
@@ -2900,7 +3005,7 @@ monitor=''
 if [ "$upload_code" -ne 0 ]; then printf '[FAIL] Upload failed (exit %s). Check SSH output above.\n' "$upload_code" >&2; exit "$upload_code"; fi
 printf '[UPLOAD] 100%% (%s/%s bytes)\n' "$total" "$total"
 printf '[3/3] Applying package and checking HTTP access\n'
-if run_native ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"; then
+if run_native ssh "$@" -p "$port" "$user@$host" "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote' && { rm -rf -- '$bundle.contents' && rm -f -- '$bundle' || printf '[WARN] Deployment passed; incoming archive cleanup failed\\n' >&2; }"; then
   :
 else
   code=$?
@@ -2935,7 +3040,7 @@ if ($windowsRuntime) {
 Set-Location -LiteralPath $PSScriptRoot
 $target = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'deploy-target.json') -Raw -Encoding UTF8 | ConvertFrom-Json
 if ($target.host -eq 'SERVER_HOST') { throw 'Set the server host in deploy-target.json.' }
-if ($target.host -isnot [string] -or $target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -isnot [string] -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -isnot [string] -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]*$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -isnot [string] -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar$') { throw 'Invalid deployment target.' }
+if ($target.host -isnot [string] -or $target.host -notmatch '^[a-zA-Z0-9][a-zA-Z0-9.:-]*$' -or $target.username -isnot [string] -or $target.username -notmatch '^[a-zA-Z_][a-zA-Z0-9_-]*$' -or $target.directory -isnot [string] -or $target.directory -notmatch '^/[a-zA-Z0-9/_. -]*$' -or $target.directory -match '(^|/)\.\.(/|$)' -or $target.bundle -isnot [string] -or $target.bundle -notmatch '^[a-zA-Z0-9_.+-]+\.tar(\.gz)?$') { throw 'Invalid deployment target.' }
 $port = if ($null -eq $target.port) { 22 } else { $target.port }
 $timeout = if ($null -eq $target.connectTimeoutSeconds) { 10 } else { $target.connectTimeoutSeconds }
 if ($port -is [string] -or [string]$port -notmatch '^[0-9]+$' -or $port -lt 1 -or $port -gt 65535 -or $timeout -is [string] -or [string]$timeout -notmatch '^[0-9]+$' -or $timeout -lt 1 -or $timeout -gt 2147483647) { throw 'Invalid deployment port or timeout.' }
@@ -3094,7 +3199,7 @@ try {
   Invoke-Step '2/3 Upload' 'scp' ($options + @('-P', [string]$port, "./$bundle", "$($scpDestination):$remote/incoming/$bundle"))
   Write-Host "[UPLOAD] 100% ($uploadBytes/$uploadBytes bytes)"
   $applying = $true
-  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote'"))
+  Invoke-Step '3/3 Apply and verify HTTP' 'ssh' ($options + @('-p', [string]$port, $destination, "cd '$remote/incoming' && mkdir -p '$bundle.contents' && tar -xf '$bundle' -C '$bundle.contents' && sh '$bundle.contents/apply.sh' '$remote' && { rm -rf -- '$bundle.contents' && rm -f -- '$bundle' || printf '[WARN] Deployment passed; incoming archive cleanup failed\\n' >&2; }"))
 } catch {
   if ($applying) {
     if ($LASTEXITCODE -gt 0 -and $LASTEXITCODE -lt 128) { [Console]::Error.WriteLine("[FAIL] Remote deployment failed (exit $LASTEXITCODE). Inspect $remote/result-<deploymentId>.json (ID in README.txt) and startup diagnostics.") }
@@ -3263,13 +3368,14 @@ ${removed.error.message}` });
 async function createDeploymentBundle(options) {
   const { directory, artifactDir, artifact, projectName, environment, config, selected } = options;
   const output = resolve(options.output);
-  if (!/^[\w.+-]+\.tar$/.test(basename(output)))
+  if (!/^[\w.+-]+\.tar(?:\.gz)?$/.test(basename(output)))
     throw new Error(deployM("deploy_bundleNameInvalid"));
   const staging = mkdtempSync(join(directory, ".bundle-"));
   const temporaryTar = `${output}.partial`;
   mkdirSync(dirname(output), { recursive: true, mode: 448 });
   chmodSync(staging, 448);
   const files = [];
+  const fileHashes = /* @__PURE__ */ new Map();
   const put = (file, content) => {
     mkdirSync(dirname(join(staging, file)), { recursive: true });
     writeFileSync(join(staging, file), content, { mode: 384 });
@@ -3294,7 +3400,7 @@ async function createDeploymentBundle(options) {
         service.env_file = name === artifact.primaryService ? [`../${options.deploymentId}/.env.runtime`, `../${options.deploymentId}/middleware.env`] : [`../${options.deploymentId}/middleware-runtime.env`];
       }
       if (Array.isArray(service.volumes))
-        service.volumes = service.volumes.map((mount) => typeof mount === "string" ? mount.replace("./web.conf:", `../${options.deploymentId}/web.conf:`).replace("./request-access.yml:", `../${options.deploymentId}/request-access.yml:`) : mount);
+        service.volumes = service.volumes.map((mount) => typeof mount === "string" ? mount.replace(/\.\/(web\.conf|request-access\.yml|tls|https-start\.sh|renew-https\.sh|\.env\.runtime|middleware\.env|runtime-env\.mjs):/g, `../${options.deploymentId}/$1:`) : mount);
     }
     put("compose.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, compose.services[name]])) }));
     put("compose-entry.json", JSON.stringify({ ...compose, services: Object.fromEntries(selected.map((name) => [name, { extends: { file: `../${options.deploymentId}/compose.json`, service: name } }])) }));
@@ -3305,8 +3411,12 @@ async function createDeploymentBundle(options) {
         throw new Error(deployM("deploy_imageVersionRequired", { params: { image: reference } }));
       const built = artifact.images.find((image) => image.imageRef === reference);
       const file = built?.file ?? `middleware-${imageList.length + 1}.tar`;
+      const destination = join(staging, "images", file);
       if (built) {
-        copyFileSync(join(artifactDir, file), join(staging, "images", file));
+        const checksum = await copyArchive(join(artifactDir, file), destination);
+        if (checksum !== built.sha256)
+          throw new Error(deployM("deploy_artifactInvalid"));
+        fileHashes.set(`images/${file}`, checksum);
       } else {
         if (!runtime) {
           const candidates = options.runtime === "auto" ? ["podman", "docker"] : [options.runtime];
@@ -3319,14 +3429,41 @@ async function createDeploymentBundle(options) {
           if (!runtime)
             throw new Error(deployM("deploy_bundleRuntimeRequired"));
         }
-        if (!(await runCommand(runtime, ["image", "inspect", reference])).success) {
+        let inspected = await runCommand(runtime, ["image", "inspect", "--format", "{{.Id}}", reference]);
+        if (!inspected.success) {
           const pulled = await runCommand(runtime, ["pull", reference], { timeoutMs: 6e5 });
           if (!pulled.success)
             throw new Error(pulled.error.message);
+          inspected = await runCommand(runtime, ["image", "inspect", "--format", "{{.Id}}", reference]);
         }
-        const saved = await runCommand(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", join(staging, "images", file), reference], { timeoutMs: 6e5 });
-        if (!saved.success)
-          throw new Error(saved.error.message);
+        const identity = inspected.success && !inspected.data.stdoutTruncated ? inspected.data.stdout.trim().replace(/^sha256:/, "") : "";
+        const cacheIdentity = createHash("sha256").update(identity).update("\0").update(reference).digest("hex");
+        const cache = options.cacheDirectory && /^[a-f0-9]{64}$/.test(identity) ? join(options.cacheDirectory, `${runtime}-${cacheIdentity}.tar`) : void 0;
+        let checksum;
+        if (cache && existsSync(cache) && existsSync(`${cache}.sha256`) && lstatSync(cache).isFile() && !lstatSync(cache).isSymbolicLink()) {
+          const copied = await copyArchive(cache, destination);
+          if (copied === readFileSync(`${cache}.sha256`, "utf8").trim())
+            checksum = copied;
+        }
+        if (!checksum) {
+          const saved = await runCommand(runtime, ["save", ...runtime === "podman" ? ["--format", "docker-archive"] : [], "-o", destination, reference], { timeoutMs: 6e5 });
+          if (!saved.success)
+            throw new Error(saved.error.message);
+          checksum = await artifactChecksum(destination);
+          if (cache) {
+            mkdirSync(dirname(cache), { recursive: true, mode: 448 });
+            const temporary = `${cache}.${basename(staging)}`;
+            try {
+              copyFileSync(destination, temporary);
+              renameSync(temporary, cache);
+              writeFileSync(`${cache}.sha256`, `${checksum}
+`, { mode: 384 });
+            } finally {
+              rmSync(temporary, { force: true });
+            }
+          }
+        }
+        fileHashes.set(`images/${file}`, checksum);
       }
       files.push(`images/${file}`);
       imageList.push(`${file} ${reference}`);
@@ -3335,6 +3472,8 @@ async function createDeploymentBundle(options) {
     if (selected.includes(artifact.primaryService) && existsSync(join(directory, "request-access.yml")))
       put("request-access.yml", readFileSync(join(directory, "request-access.yml"), "utf8"));
     put("middleware.env", options.middlewareEnv);
+    if (selected.includes(artifact.primaryService) && !compose.services[artifact.primaryService]?.env_file)
+      put("runtime-env.mjs", readFileSync(new URL("./deploy-runtime-env.mjs", import.meta.url), "utf8"));
     const middlewareRuntime = join(directory, "middleware-runtime.env");
     const nativeEnvironment = existsSync(middlewareRuntime) ? readFileSync(middlewareRuntime, "utf8") : "";
     put("middleware-runtime.env", nativeEnvironment);
@@ -3342,18 +3481,17 @@ async function createDeploymentBundle(options) {
       put(file, content);
     if (options.hasWebConfig)
       put("web.conf", readFileSync(join(directory, "web.conf"), "utf8"));
+    for (const [file, content] of Object.entries(options.httpsAssets ?? {}))
+      put(file, content);
     put("manifest.json", `${JSON.stringify({ ...artifact, images: artifact.images.filter((image) => references.has(image.imageRef)), deploymentId: options.deploymentId, selectedServices: selected, partial: options.partial }, null, 2)}
 `);
     if (options.hasWebConfig) {
       put("proxy-entry.json", JSON.stringify({ services: { [options.proxyService ?? "web"]: { volumes: [`../${options.deploymentId}/web.conf:/etc/nginx/conf.d/default.conf:ro`] } } }));
     }
-    put("proxy-service", `${options.hasWebConfig ? options.proxyService ?? "web" : ""}
-`);
     put("storage-routing", `${options.storageRouting ?? ""}
 `);
-    put("layout", `${config.expose.hostPort}:${options.containerPort}:${options.hasWebConfig ? options.proxyService === "gateway" ? "gateway" : "true" : "false"}:${artifact.primaryService}:${options.hasWebConfig ? await artifactChecksum(join(directory, "web.conf")) : ""}
-`);
-    put("health-port", `${config.expose.hostPort}
+    const httpsFingerprint = config.expose.https ? createHash("sha256").update(JSON.stringify({ ...config.expose.https, certificateFile: void 0, privateKeyFile: void 0, certificate: options.httpsAssets?.["tls/fullchain.pem"] })).digest("hex") : "";
+    put("layout", `${config.expose.hostPort}:${options.containerPort}:${options.hasWebConfig ? options.proxyService === "gateway" ? "gateway" : "true" : "false"}:${artifact.primaryService}:${options.hasWebConfig ? await artifactChecksum(join(directory, "web.conf")) : ""}${httpsFingerprint ? `:${httpsFingerprint}` : ""}
 `);
     put("web-base-path", `${artifact.webBasePath ?? ""}
 `);
@@ -3371,15 +3509,15 @@ async function createDeploymentBundle(options) {
     const selection = deployM("deploy_bundleSelection", { params: { mode, services: selected.join(", ") } });
     const instructions = `${selection}
 ${deployM("deploy_bundleInstructions", { params: instructionParams })}`;
-    put("README.txt", `${deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, deploymentId: options.deploymentId, compose: "compose.json" } })}
+    const readme = `${deployM("deploy_bundleMetadata", { params: { version: artifact.appVersion, buildId: artifact.buildId, deploymentId: options.deploymentId, compose: "compose.json" } })}
 ${instructions}
-`);
+`;
     const checksums = [];
     for (const file of files)
-      checksums.push(`${await artifactChecksum(join(staging, file))}  ${file}`);
+      checksums.push(`${fileHashes.get(file) ?? await artifactChecksum(join(staging, file))}  ${file}`);
     writeFileSync(join(staging, "SHA256SUMS"), `${checksums.join("\n")}
 `);
-    const tar = await runCommand("tar", ["-cf", temporaryTar, "-C", staging, "."]);
+    const tar = await runCommand("tar", [output.endsWith(".gz") ? "-czf" : "-cf", temporaryTar, "-C", staging, "."]);
     if (!tar.success)
       throw new Error(tar.error.message);
     chmodSync(temporaryTar, 384);
@@ -3418,7 +3556,7 @@ ${instructions}
     };
     writeFileSync(join(scripts, "deploy-target.json"), `${JSON.stringify({ ...target, _comments: comments }, null, 2)}
 `);
-    writeFileSync(join(scripts, "README.txt"), readFileSync(join(staging, "README.txt"), "utf8"));
+    writeFileSync(join(scripts, "README.txt"), readme);
     for (const file of [`docker-compose-${artifact.appVersion}.yml`, ".env.runtime", "middleware-runtime.env", "request-access.yml", ...options.hasWebConfig ? ["web.conf"] : []])
       rmSync(join(directory, file), { force: true });
     return { bundlePath: output, instructions: `${selection}
@@ -3429,6 +3567,178 @@ ${scripts}`, startName: "apply.sh" };
     rmSync(temporaryTar, { force: true });
   }
 }
+async function copyArchive(source, destination) {
+  const hash = createHash("sha256");
+  const digest = new Transform({
+    transform(chunk, _encoding, callback) {
+      hash.update(chunk);
+      callback(null, chunk);
+    }
+  });
+  await pipeline(createReadStream(source), digest, createWriteStream(destination, { mode: 384 }));
+  return hash.digest("hex");
+}
+var CERTBOT_IMAGE = "docker.io/certbot/certbot:v5.9.0";
+function createHttpsAssets(config, projectDirectory) {
+  const assets = {
+    https: `${config.domain} ${config.port} ${config.type}
+`
+  };
+  if (config.type === "files") {
+    try {
+      const readPem = (file) => {
+        const path = resolve(projectDirectory, file);
+        if (!statSync(path).isFile() || statSync(path).size > 1048576)
+          throw new Error("Invalid PEM file");
+        return readFileSync(path, "utf8");
+      };
+      const certificate = readPem(config.certificateFile);
+      const key = readPem(config.privateKeyFile);
+      const parsed = new X509Certificate(certificate);
+      const publicKey = createPublicKey(createPrivateKey(key)).export({ type: "spki", format: "der" });
+      const now = Date.now();
+      if (!publicKey.equals(parsed.publicKey.export({ type: "spki", format: "der" })) || now < Date.parse(parsed.validFrom) || now >= Date.parse(parsed.validTo) || !(isIP(config.domain) ? parsed.checkIP(config.domain) : parsed.checkHost(config.domain))) {
+        throw new Error("Certificate validation failed");
+      }
+      assets["tls/fullchain.pem"] = certificate;
+      assets["tls/privkey.pem"] = key;
+    } catch {
+      throw new Error(deployM("deploy_httpsCertificateInvalid"));
+    }
+  } else {
+    assets["renew-https.sh"] = createRenewScript(config);
+  }
+  assets["prepare-https.sh"] = createPrepareScript(config);
+  assets["https-start.sh"] = String.raw`#!/bin/sh
+set -eu
+# 目录挂载允许原子替换证书；只有新证书通过 nginx -t 才重载。
+watch_certificate() {
+  previous=$(sha256sum /etc/nginx/tls/fullchain.pem)
+  while sleep 60; do
+    current=$(sha256sum /etc/nginx/tls/fullchain.pem) || continue
+    if [ "$previous" != "$current" ]; then
+      if nginx -t && nginx -s reload; then previous=$current; else printf '[ERROR] HTTPS certificate reload failed\n' >&2; fi
+    fi
+  done
+}
+watch_certificate &
+exec /docker-entrypoint.sh nginx -g 'daemon off;'
+`;
+  return assets;
+}
+function renderHttpsProxy(source, config, httpPort) {
+  const publicPort = config.port === 443 ? "" : `:${config.port}`;
+  const challenge = "  location ^~ /.well-known/acme-challenge/ { root /var/www/certbot; }\n";
+  const tls = source.replace(`listen ${httpPort};`, `listen ${httpPort === 8443 ? 8444 : 8443} ssl;
+  ssl_certificate /etc/nginx/tls/fullchain.pem;
+  ssl_certificate_key /etc/nginx/tls/privkey.pem;`).replace("server_name _;", `server_name ${config.domain};`).replaceAll("proxy_set_header X-Forwarded-Proto $scheme;", "proxy_set_header X-Forwarded-Proto https;");
+  const http = config.redirectHttp ? `server {
+  listen ${httpPort};
+  server_name ${config.domain};
+${challenge}  location ~ ^/_hai/(web-health|gateway-health)$ { access_log off; return 200 'ok'; }
+  location / { return 308 https://${config.domain}${publicPort}$request_uri; }
+}
+` : source.slice(source.indexOf("server {")).replace("server_name _;", `server_name ${config.domain};
+${challenge}`);
+  return `${tls}
+${http}`;
+}
+var publishCertificate = String.raw`publish_certificate() {
+  certificate="/etc/letsencrypt/live/$domain"
+  test -s "$certificate/fullchain.pem" && test -s "$certificate/privkey.pem"
+  cp "$certificate/fullchain.pem" /output/fullchain.pem.next
+  cp "$certificate/privkey.pem" /output/privkey.pem.next
+  chmod 444 /output/fullchain.pem.next /output/privkey.pem.next
+  mv /output/privkey.pem.next /output/privkey.pem
+  mv /output/fullchain.pem.next /output/fullchain.pem
+}
+`;
+function createRenewScript(config) {
+  return `#!/bin/sh
+set -eu
+domain=${shellArgument(config.domain)}
+${publishCertificate}${String.raw`
+trap 'exit 0' TERM INT
+# Certbot 自己判断到期时间；同一官方客户端同时负责申请与续期，不实现 ACME 协议。
+while :; do
+  if certbot renew --cert-name "$domain" --non-interactive; then
+    if [ -s "/etc/letsencrypt/live/$domain/fullchain.pem" ]; then
+      current=$(sha256sum "/etc/letsencrypt/live/$domain/fullchain.pem" | awk '{print $1}')
+      installed=$(sha256sum /output/fullchain.pem | awk '{print $1}')
+      if [ "$current" != "$installed" ]; then publish_certificate; fi
+    fi
+  else
+    printf '[ERROR] Certbot renewal failed; the existing certificate remains installed\n' >&2
+  fi
+  sleep 43200 & wait $! || exit 0
+done
+`}`;
+}
+function createPrepareScript(config) {
+  const header = `#!/bin/sh
+set -eu
+umask 077
+root=$1
+release=$2
+runtime=$3
+mode=$4
+domain=${shellArgument(config.domain)}
+`;
+  if (config.type === "files") {
+    return header + String.raw`
+test "$mode" != prepare || {
+  # 宿主 root/release 保持私密；容器仅可读取独立挂载的证书目录。
+  chmod 700 "$root" "$release"
+  chmod 755 "$release/tls"
+  chmod 444 "$release/tls/fullchain.pem" "$release/tls/privkey.pem"
+}
+`;
+  }
+  const python = [
+    "from cryptography import x509",
+    "from cryptography.x509.oid import NameOID",
+    "from cryptography.hazmat.primitives import hashes, serialization",
+    "from cryptography.hazmat.primitives.asymmetric import ec",
+    "from datetime import datetime, timedelta, timezone",
+    "from pathlib import Path",
+    "import sys",
+    "name=sys.argv[1]",
+    "key=ec.generate_private_key(ec.SECP256R1())",
+    "subject=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,name)])",
+    "now=datetime.now(timezone.utc)",
+    "cert=x509.CertificateBuilder().subject_name(subject).issuer_name(subject).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(days=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName(name)]),False).sign(key,hashes.SHA256())",
+    'Path("/output/privkey.pem").write_bytes(key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))',
+    'Path("/output/fullchain.pem").write_bytes(cert.public_bytes(serialization.Encoding.PEM))'
+  ].join("\n");
+  const publish = `set -eu
+domain=${shellArgument(config.domain)}
+${publishCertificate}
+publish_certificate
+`;
+  return `${header}image=${shellArgument(CERTBOT_IMAGE)}
+email=${shellArgument(config.email)}
+bootstrap=${shellArgument(python)}
+${String.raw`
+state="$root/https"
+certificates="$state/certificates/$domain"
+mkdir -p "$state/acme" "$state/webroot" "$certificates"
+chmod 700 "$root" "$state" "$state/acme"
+chmod 755 "$state/webroot" "$certificates"
+if [ "$mode" = prepare ]; then
+  if [ ! -s "$certificates/fullchain.pem" ] || [ ! -s "$certificates/privkey.pem" ]; then
+    if [ "$5" = true ]; then printf 'HTTPS certificate state missing; create a full deployment.\n' >&2; exit 1; fi
+    # 临时证书只用于启动挑战入口；签发失败不得提交 current。
+    "$runtime" run --rm --pull never --entrypoint python -v "$certificates:/output" "$image" -c "$bootstrap" "$domain"
+    chmod 444 "$certificates/fullchain.pem" "$certificates/privkey.pem"
+  fi
+elif [ "$mode" = issue ]; then
+  "$runtime" run --rm --pull never -v "$state/acme:/etc/letsencrypt" -v "$state/webroot:/var/www/certbot" "$image" certonly --webroot --webroot-path /var/www/certbot --cert-name "$domain" --domain "$domain" --email "$email" --agree-tos --non-interactive --keep-until-expiring
+  "$runtime" run --rm --pull never --entrypoint sh -v "$state/acme:/etc/letsencrypt:ro" -v "$certificates:/output" "$image" -c `}${shellArgument(publish)}
+fi
+`;
+}
+
+// src/container/deploy-container-compose.ts
 var IMAGES = {
   postgres: "docker.io/library/postgres:16.15-alpine",
   mysql: "docker.io/library/mysql:8.4.11",
@@ -3693,12 +4003,17 @@ function planSidecars(_appDir, projectName, scan, provisionEnv, options, s3Engin
       const requirements = scan.middlewares?.filter((item) => item.service === "email" && item.backend === "smtp" && ["default", void 0].includes(options?.serviceModes?.[item.envPrefix] ?? options?.serviceModes?.email));
       if (requirements?.length) {
         for (const requirement of requirements)
-          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
+          plan.env[requirement.envPrefix] = JSON.stringify({ name: requirement.config.name ?? "email", type: "smtp", host: "email", port: 1025, secure: false, from: requirement.config.from || "noreply@example.com" });
       } else if (!scan.middlewares) {
         plan.env.HAI_REACH_PROVIDERS_0 = JSON.stringify({ name: "email", type: "smtp", host: "email", port: 1025, secure: false, from: "noreply@example.com" });
       }
     }
   }
+  for (const requirement of scan.middlewares ?? []) {
+    const supplied = plan.env[requirement.envPrefix];
+    if (supplied)
+      plan.env[requirement.envPrefix] = JSON.stringify(mergeManagedMiddlewareConfig(requirement, JSON.parse(supplied)));
+  }
   return plan;
 }
 function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv = {}, s3Engine = "rustfs") {
@@ -3717,6 +4032,7 @@ function buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort,
 function generateComposeFile(options) {
   const { projectName, imageRef, hostPort, containerPort, sidecar } = options;
   const primaryService = options.primaryService ?? "serv";
+  const nodeRuntime = options.nodeRuntime ?? primaryService === "serv";
   const app = {
     image: imageRef,
     labels: { "org.opencontainers.image.version": options.appVersion },
@@ -3728,11 +4044,28 @@ function generateComposeFile(options) {
     ports: [`${hostPort}:${containerPort}`],
     networks: ["hai-app"]
   };
+  if (primaryService === "serv") {
+    app.healthcheck = {
+      test: ["CMD", "node", "-e", "(async () => { try { const { core } = await import('@h-ai/core'); const { ServConfigSchema } = await import('@h-ai/serv'); core.init({ configDir: './config' }); const { server, http } = ServConfigSchema.parse(core.config.getOrThrow('serv')); if (http.health === false) process.exit(0); const response = await fetch('http://127.0.0.1:' + server.port + http.health.path, { signal: AbortSignal.timeout(4000) }); process.exit(response.ok ? 0 : 1); } catch { process.exit(1); } })()"],
+      interval: "30s",
+      timeout: "5s",
+      start_period: "15s",
+      retries: 3
+    };
+  }
   const appVolumes = [...sidecar.appVolumes];
+  const appEnvironment = {};
+  if (nodeRuntime) {
+    delete app.env_file;
+    appVolumes.push("./.env.runtime:/run/hai/.env.runtime:ro", "./middleware.env:/run/hai/middleware.env:ro", "./runtime-env.mjs:/run/hai/runtime-env.mjs:ro");
+    appEnvironment.NODE_OPTIONS = `--import /run/hai/runtime-env.mjs${options.nodeOptions ? ` ${options.nodeOptions}` : ""}`.replaceAll("$", () => "$$");
+  }
   if (options.requestAccessPolicy)
     appVolumes.push("./request-access.yml:/run/hai/request-access.yml:ro");
   if (options.web || options.gateway)
-    app.environment = { HAI_DEPLOY_PRIVATE_PROXY: "1" };
+    appEnvironment.HAI_DEPLOY_PRIVATE_PROXY = "1";
+  if (Object.keys(appEnvironment).length)
+    app.environment = appEnvironment;
   if (options.mountWebConfig)
     appVolumes.push("./web.conf:/etc/nginx/conf.d/default.conf:ro");
   if (appVolumes.length)
@@ -3765,10 +4098,38 @@ function generateComposeFile(options) {
       ports: [`${hostPort}:8080`],
       healthcheck: { test: ["CMD", "wget", "-Y", "off", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/_hai/gateway-health"], interval: "30s", timeout: "5s", retries: 3 },
       volumes: ["./web.conf:/etc/nginx/conf.d/default.conf:ro"],
-      depends_on: [primaryService, "storage"],
+      depends_on: [primaryService, ...sidecar.services.includes("storage") ? ["storage"] : []],
       networks: ["hai-app"]
     };
   }
+  if (options.https) {
+    const proxy = services[options.gateway ? "gateway" : options.web ? "web" : primaryService];
+    const https = options.https;
+    const httpPort = options.gateway ? 8080 : options.web?.containerPort ?? containerPort;
+    proxy.ports = [...proxy.ports, `${https.port}:${httpPort === 8443 ? 8444 : 8443}`];
+    const certificates = https.type === "files" ? "./tls" : `../../https/certificates/${https.domain}`;
+    proxy.volumes = [
+      ...proxy.volumes,
+      `${certificates}:/etc/nginx/tls:ro`,
+      "./https-start.sh:/run/hai/https-start.sh:ro",
+      ...https.type === "letsencrypt" ? ["../../https/webroot:/var/www/certbot:ro"] : []
+    ];
+    proxy.entrypoint = ["sh", "/run/hai/https-start.sh"];
+    if (https.type === "letsencrypt") {
+      services.certbot = {
+        image: CERTBOT_IMAGE,
+        restart: "unless-stopped",
+        entrypoint: ["sh", "/run/hai/renew-https.sh"],
+        volumes: [
+          "../../https/acme:/etc/letsencrypt",
+          "../../https/webroot:/var/www/certbot",
+          `../../https/certificates/${https.domain}:/output`,
+          "./renew-https.sh:/run/hai/renew-https.sh:ro"
+        ],
+        networks: ["hai-app"]
+      };
+    }
+  }
   const compose = {
     "x-hai-version": options.appVersion,
     services,
@@ -3787,11 +4148,21 @@ function generateWebProxyConfig(port, apiPrefix, options = {}) {
   const webPort = options.webPort ?? 8080;
   const webBasePath = options.webBasePath ?? "";
   const apiPath = apiPrefix.replace(/\/+$/, "");
-  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535) || webBasePath && (webBasePath === apiPath || webBasePath.startsWith(`${apiPath}/`))) {
+  const backendPaths = [...new Set(options.backendPaths ?? ["/health"])];
+  if (!/^\/[\w/-]+$/.test(apiPrefix) || ![port, webPort].every((value) => Number.isInteger(value) && value >= 1 && value <= 65535) || backendPaths.some((path) => !/^\/[\w./-]*$/.test(path) || path.startsWith("//") || path.split("/").some((part) => part === "." || part === "..") || path === `${webBasePath}/runtime-config.js` || path === "/_hai/web-health") || webBasePath && (backendPaths.includes(webBasePath) || webBasePath === apiPath || webBasePath.startsWith(`${apiPath}/`))) {
     throw new Error("Invalid web proxy target");
   }
   const webLocation = renderWebLocation(webBasePath);
-  const storageLocation = options.storageBucket ? renderStorageLocation(options.storageBucket, [apiPath, ...options.storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]], options.storageBasePath) : "";
+  const storageLocation = options.storageBucket ? renderStorageLocation(options.storageBucket, [apiPath, ...backendPaths, ...options.storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]], options.storageBasePath) : "";
+  const backendLocations = backendPaths.map((path) => `  location = ${path} {
+    proxy_pass http://serv:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Real-IP $remote_addr;
+  }
+`).join("");
   return `${options.storageBucket ? renderStorageUpstream(options.storageBucket, options.storageBasePath) : ""}server {
   listen ${webPort};
   server_name _;
@@ -3806,13 +4177,7 @@ ${storageLocation}${webLocation}  location = ${webBasePath}/runtime-config.js {
     access_log off;
     return 200 'ok';
   }
-  location = /health {
-    proxy_pass http://serv:${port};
-    proxy_set_header Host $http_host;
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header X-Real-IP $remote_addr;
-  }
-  location ${apiPrefix.replace(/\/$/, "")}/ {
+${backendLocations}  location ${apiPrefix.replace(/\/$/, "")}/ {
     client_max_body_size ${bodyLimits.encryptedPayloadBytes};
     proxy_pass http://serv:${port};
     proxy_http_version 1.1;
@@ -3878,11 +4243,11 @@ function generateApplicationProxyConfig(options) {
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     throw new Error("Invalid application proxy target");
   const bodyLimits = resolveTransportBodyLimits(maxPlaintextBytes);
-  return `${renderStorageUpstream(bucket, options.storageBasePath)}server {
+  return `${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
   listen 8080;
   server_name _;
 ${renderTrustedEdgeProxies(options.trustedEdgeProxies)}  large_client_header_buffers 4 32k;
-${renderStorageLocation(bucket, reservedPaths, options.storageBasePath)}  location = /_hai/gateway-health {
+${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath) : ""}  location = /_hai/gateway-health {
     access_log off;
     return 200 'ok';
   }
@@ -3990,9 +4355,22 @@ function prepareRequestAccess(options) {
   }
 }
 var HEALTH_MAX_ATTEMPTS = 40;
+function servicePath(value, fallback) {
+  const path = value ?? fallback;
+  if (typeof path !== "string" || !/^\/[\w./-]*$/.test(path) || path.startsWith("//") || path.split("/").some((part) => part === "." || part === ".."))
+    throw new Error("Invalid service endpoint path");
+  return path;
+}
+function endpointSettings(value) {
+  if (value === void 0)
+    return {};
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid service endpoint configuration");
+  return value;
+}
 var ServerResultSchema = z.object({
   deploymentId: z.string(),
-  stage: z.enum(["preflight", "credentials", "recover", "images", "dependencies", "start", "health", "complete"]),
+  stage: z.enum(["preflight", "credentials", "recover", "images", "dependencies", "start", "https", "health", "complete"]),
   exitCode: z.number().int().min(0).max(255),
   durationSeconds: z.number().int().nonnegative(),
   recoveryStatus: z.enum(["not-needed", "passed", "failed", "stopped"]).optional()
@@ -4004,7 +4382,7 @@ function makeDeploymentId() {
   return `${stamp}-${randomBytes(3).toString("hex")}`;
 }
 function sleep(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 function createDockerSshProvider(config, container) {
   const ssh = config.ssh ? createSshExecutor(config.ssh) : void 0;
@@ -4028,13 +4406,28 @@ function createDockerSshProvider(config, container) {
       deployM("deploy_remoteRuntimeMissing", { params: { runtime: candidates.join(" / ") } })
     );
   }
-  async function healthCheck(url) {
+  async function healthCheck(url, certificate) {
     for (let attempt = 0; attempt < HEALTH_MAX_ATTEMPTS; attempt++) {
       try {
-        const response = await fetch(url, { signal: AbortSignal.timeout(5e3) });
-        await response.body?.cancel();
-        if (response.ok)
-          return true;
+        if (certificate) {
+          const healthy = await new Promise((resolve9) => {
+            const request$1 = request(url, { ca: [...rootCertificates, certificate], timeout: 5e3 }, (response) => {
+              response.resume();
+              resolve9(response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300);
+            });
+            request$1.on("error", () => resolve9(false));
+            request$1.on("close", () => resolve9(false));
+            request$1.on("timeout", () => request$1.destroy());
+            request$1.end();
+          });
+          if (healthy)
+            return true;
+        } else {
+          const response = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+          await response.body?.cancel();
+          if (response.ok)
+            return true;
+        }
       } catch {
       }
       await sleep(HEALTH_POLL_INTERVAL);
@@ -4045,6 +4438,8 @@ function createDockerSshProvider(config, container) {
     const { appDir, projectName, scan, provisionEnv, appEnv, options } = context;
     const deploymentId = makeDeploymentId();
     const hostPort = config.expose.hostPort;
+    const https = config.expose.https;
+    const httpsAssets = https ? createHttpsAssets(https, resolveProjectDirectory(appDir)) : void 0;
     const deploymentRoot = join(resolveProjectDirectory(appDir), ".hai", "deploy", options?.environment ?? "prod");
     const artifact = context.artifact;
     const resolvedBuildDir = context.artifactDir;
@@ -4063,12 +4458,14 @@ function createDockerSshProvider(config, container) {
     const containerPort = app?.containerPort ?? (primaryService === "serv" ? artifact.servContainerPort : artifact.webContainerPort) ?? config.expose.containerPort;
     const webContainerPort = web?.containerPort ?? artifact.webContainerPort ?? 8080;
     const host = config.ssh?.host;
-    const url = host ? `http://${host.includes(":") ? `[${host}]` : host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
+    const url = https ? `https://${https.domain}${https.port === 443 ? "" : `:${https.port}`}` : host ? `http://${host.includes(":") ? `[${host}]` : host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
     const webBasePath = artifact.webBasePath ?? "";
     const applicationUrl = `${url}${webBasePath ? `${webBasePath}/` : ""}`;
-    const standaloneWebConfig = primaryService === "web" && !scan.isSvelteKit && !!webBasePath;
-    const healthPaths = hasWebProxy ? ["/health", "/_hai/web-health", `${webBasePath}/`] : scan.isSvelteKit ? [`${webBasePath}/`] : standaloneWebConfig ? ["/health", `${webBasePath}/`] : ["/health"];
+    const standaloneWebConfig = primaryService === "web" && !scan.isSvelteKit && (!!webBasePath || !!https);
+    const healthPaths = hasWebProxy ? ["/_hai/web-health", `${webBasePath}/`] : scan.isSvelteKit ? [`${webBasePath}/`] : primaryService === "serv" ? [] : standaloneWebConfig ? ["/health", `${webBasePath}/`] : ["/health"];
     const { env, sidecar } = buildRuntimeEnv(appDir, projectName, scan, provisionEnv, containerPort, options, appEnv, container?.s3Engine);
+    if (https && scan.isSvelteKit && !env.ORIGIN)
+      env.ORIGIN = url;
     const managedStorage = sidecar.services.includes("storage") ? JSON.parse(sidecar.env.HAI_STORAGE) : void 0;
     let storageBasePath = "";
     if (managedStorage?.publicEndpoint !== void 0) {
@@ -4086,7 +4483,7 @@ function createDockerSshProvider(config, container) {
       }
     }
     const storageRouting = managedStorage ? createHash("sha256").update(JSON.stringify({ ...managedStorage, secretAccessKey: void 0 })).digest("hex") : "";
-    const gateway = !!managedStorage && !hasWebProxy;
+    const gateway = !hasWebProxy && (!!managedStorage || !!https && !standaloneWebConfig);
     if (gateway && primaryService === "web" && !scan.isSvelteKit)
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageBackendRequired"));
     const proxyService = gateway ? "gateway" : "web";
@@ -4097,6 +4494,35 @@ function createDockerSshProvider(config, container) {
     const server = existsSync(serverPath) || hasWebProxy ? loadDeploymentConfig("serv", serverPath, env) : ok({});
     if (!server.success)
       return server;
+    const backendPaths = [];
+    try {
+      const http = endpointSettings(server.data.http);
+      if (primaryService === "serv" && http.health !== false) {
+        const health = endpointSettings(http.health);
+        const path = servicePath(health.path, "/health");
+        healthPaths.unshift(path);
+        backendPaths.push(path, servicePath(health.readyPath, "/ready"));
+      }
+      if (hasWebProxy) {
+        const corePath = join(appDir, "config", "_core.yml");
+        const settings = existsSync(corePath) ? loadDeploymentConfig("core", corePath, env) : ok(env.HAI_CORE ? JSON.parse(env.HAI_CORE) : { env: env.HAI_CORE_ENV });
+        if (!settings.success)
+          return settings;
+        const application = CoreConfigSchema.safeParse(settings.data);
+        if (!application.success)
+          return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
+        if (application.data.env !== "production") {
+          if (http.openapi !== void 0 && http.openapi !== false)
+            backendPaths.push(servicePath(endpointSettings(http.openapi).path, "/openapi.json"));
+          if (http.docs !== void 0 && http.docs !== false) {
+            const docsPath = servicePath(endpointSettings(http.docs).path, "/docs");
+            backendPaths.push(docsPath, `${docsPath.slice(0, docsPath.lastIndexOf("/") + 1)}_hai/scalar.js`);
+          }
+        }
+      }
+    } catch {
+      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
+    }
     let requestAccessSnapshot;
     if (updatesApp && primaryService === "serv") {
       const prepared2 = prepareRequestAccess({ settings: server.data, module: "serv", directory: appDir });
@@ -4158,25 +4584,25 @@ function createDockerSshProvider(config, container) {
       if (typeof apiPrefix !== "string" || !/^\/[\w/-]+$/.test(apiPrefix)) {
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webProxyInvalid"));
       }
-      if (webBasePath && (["/health", "/_hai/web-health"].includes(webBasePath) || webBasePath === apiPrefix.replace(/\/+$/, "") || webBasePath.startsWith(`${apiPrefix.replace(/\/+$/, "")}/`)))
+      if (webBasePath && ([...backendPaths, "/_hai/web-health"].includes(webBasePath) || webBasePath === apiPrefix.replace(/\/+$/, "") || webBasePath.startsWith(`${apiPrefix.replace(/\/+$/, "")}/`)))
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webBaseConflict"));
       const transport = server.data.transport;
       try {
         const configured = transport ? transport.maxPlaintextBytes : void 0;
         const limits = resolveTransportBodyLimits(Math.max(createTransportBodyPolicy(configured === "auto" ? void 0 : configured, transport ? transport.routePlaintextBytes : void 0).maximum.plaintextBytes, feedbackTransportBytes ?? 0));
-        webProxy = generateWebProxyConfig(containerPort, apiPrefix, { webPort: webContainerPort, maxPlaintextBytes: limits.plaintextBytes, webBasePath, storageBucket: managedStorage?.bucket, storageBasePath, trustedEdgeProxies: config.trustedEdgeProxies });
+        webProxy = generateWebProxyConfig(containerPort, apiPrefix, { webPort: webContainerPort, maxPlaintextBytes: limits.plaintextBytes, webBasePath, backendPaths, storageBucket: managedStorage?.bucket, storageBasePath, trustedEdgeProxies: config.trustedEdgeProxies });
       } catch (error) {
         return err(HaiDeployError.CONFIG_ERROR, error instanceof RangeError ? error.message : deployM(managedStorage ? "deploy_storageProxyInvalid" : "deploy_transportBodyLimitInvalid"));
       }
-      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && config.ssh ? url : cors?.origin ?? "*" } });
-    } else if (gateway && managedStorage) {
+      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: (!cors?.origin || cors.origin === "*") && (config.ssh || https) ? url : cors?.origin ?? "*" } });
+    } else if (gateway) {
       try {
         const http = server.data.http;
         if (primaryService === "serv") {
           const transport = server.data.transport;
           applicationPlaintextBytes = Math.max(createTransportBodyPolicy(transport?.maxPlaintextBytes === "auto" ? void 0 : transport?.maxPlaintextBytes, transport?.routePlaintextBytes).maximum.plaintextBytes, feedbackTransportBytes ?? 0);
         }
-        webProxy = generateApplicationProxyConfig({ primaryService, port: containerPort, bucket: managedStorage.bucket, storageBasePath, reservedPaths: [http?.apiPrefix ?? "/api/v1", ...storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]], maxPlaintextBytes: applicationPlaintextBytes, trustedEdgeProxies: config.trustedEdgeProxies });
+        webProxy = generateApplicationProxyConfig({ primaryService, port: containerPort, bucket: managedStorage?.bucket, storageBasePath, reservedPaths: [http?.apiPrefix ?? "/api/v1", ...storageBasePath ? [`${webBasePath}/_app`, `${webBasePath}/assets`, `${webBasePath}/runtime-config.js`] : [webBasePath]], maxPlaintextBytes: applicationPlaintextBytes, trustedEdgeProxies: config.trustedEdgeProxies });
       } catch {
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageProxyInvalid"));
       }
@@ -4185,8 +4611,15 @@ function createDockerSshProvider(config, container) {
         return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_webBaseConflict"));
       webProxy = generateStaticWebConfig(containerPort, webBasePath);
     }
-    const requestedOutput = options?.output ?? join(deploymentRoot, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar`);
-    const stem = basename(requestedOutput).replace(/\.tar$/i, "");
+    if (https && webProxy)
+      webProxy = renderHttpsProxy(webProxy, https, hasWebProxy ? webContainerPort : gateway ? 8080 : containerPort);
+    if (https && primaryService === "serv" && !hasWebProxy) {
+      const cors = server.data.cors;
+      env.HAI_SERV = JSON.stringify({ ...server.data, cors: { ...cors, origin: !cors?.origin || cors.origin === "*" ? url : cors.origin } });
+    }
+    const requestedOutput = options?.output ?? join(deploymentRoot, `bundle-${projectName}-${deploymentId}-${artifact.appVersion}.tar.gz`);
+    const compressed = requestedOutput.endsWith(".tar.gz");
+    const stem = basename(requestedOutput).replace(/\.tar(?:\.gz)?$/i, "");
     const suffix = `-${artifact.appVersion}`;
     const name = stem.endsWith(suffix) ? stem : `${stem}${suffix}`;
     if (!/^[\w.+-]+$/.test(name))
@@ -4219,10 +4652,13 @@ function createDockerSshProvider(config, container) {
       containerPort,
       primaryService,
       requestAccessPolicy: requestAccessSnapshot !== void 0,
+      nodeRuntime: primaryService === "serv" || scan.isSvelteKit,
+      nodeOptions: env.NODE_OPTIONS,
       sidecar,
       web: hasWebProxy ? { imageRef: web?.imageRef ?? "localhost/hai-unselected:0", containerPort: webContainerPort } : void 0,
       mountWebConfig: standaloneWebConfig,
-      gateway
+      gateway,
+      https
     });
     const composePath = join(artifactDir, composeName);
     writeFileSync(composePath, composeContent);
@@ -4231,6 +4667,8 @@ function createDockerSshProvider(config, container) {
     const selected = options?.selectedServices ? [...options.selectedServices] : artifact.partial ? images.map((image) => image.name) : [...images.map((image) => image.name), ...Object.keys(sidecar.composeServices)];
     if (gateway && !partial)
       selected.push("gateway");
+    if (https?.type === "letsencrypt" && !partial)
+      selected.push("certbot");
     if (!selected.length || selected.some((name2) => !/^[a-z][a-z0-9-]*$/.test(name2)) || new Set(selected).size !== selected.length)
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_selectionInvalid", { params: { service: selected.join(", ") } }));
     for (const name2 of selected) {
@@ -4255,7 +4693,9 @@ function createDockerSshProvider(config, container) {
       containerPort,
       middlewareEnv: serializeEnvFile(sidecar.env),
       healthPaths,
-      output: join(artifactDir, `${name}.tar`)
+      httpsAssets,
+      output: join(artifactDir, `${name}.tar${compressed ? ".gz" : ""}`),
+      cacheDirectory: join(resolveProjectDirectory(appDir), ".hai", "cache", "images")
     });
     if (options?.bundleOnly)
       return ok({ url: "", deploymentId, status: "packaged", provider: "docker-ssh", healthCheck: "skipped", envVarsSet: Object.keys(env), ...bundle });
@@ -4277,7 +4717,7 @@ function createDockerSshProvider(config, container) {
       return uploaded;
     let pendingOutput = "";
     const started = await ssh.exec(
-      `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)}`,
+      `mkdir -p ${shellArgument(`${remoteTar}.contents`)} && chmod 600 ${shellArgument(remoteTar)} && tar -xf ${shellArgument(remoteTar)} -C ${shellArgument(`${remoteTar}.contents`)} && sh ${shellArgument(`${remoteTar}.contents/${bundle.startName}`)} ${shellArgument(remoteDir)} && { rm -rf -- ${shellArgument(`${remoteTar}.contents`)} && rm -f -- ${shellArgument(remoteTar)} || printf '[WARN] Deployment passed; incoming archive cleanup failed\\n' >&2; }`,
       { timeoutMs: 6e5, secrets: sidecar.secrets, onOutput: (output) => {
         const parts = output.split("\n");
         for (let index = 0; index < parts.length; index++) {
@@ -4286,7 +4726,7 @@ function createDockerSshProvider(config, container) {
             break;
           const line = pendingOutput;
           pendingOutput = "";
-          const stage = /^\[(preflight|images|dependencies|start|health|complete)\]/.exec(line)?.[1];
+          const stage = /^\[(preflight|images|dependencies|start|https|health|complete)\]/.exec(line)?.[1];
           if (stage)
             options?.onProgress?.(stage);
         }
@@ -4319,7 +4759,7 @@ ${terminal ? deployM("deploy_remoteFinished", { params: { stage: terminal.stage,
     logger5.info("Running health check", { url: applicationUrl });
     let healthy = true;
     for (const healthPath of healthPaths) {
-      if (!await healthCheck(`${url}${healthPath}`)) {
+      if (!await healthCheck(`${url}${healthPath}`, httpsAssets?.["tls/fullchain.pem"])) {
         healthy = false;
         break;
       }
@@ -4606,7 +5046,7 @@ async function pollDeploymentStatus(token, deploymentId) {
     if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
       return "error";
     }
-    await new Promise((resolve8) => setTimeout(resolve8, POLL_INTERVAL));
+    await new Promise((resolve9) => setTimeout(resolve9, POLL_INTERVAL));
   }
   return "building";
 }
@@ -5141,7 +5581,7 @@ var deployCredentials = {
   saveAll: (entries) => saveCredentials(entries)
 };
 function mergeProvisionEnv(results, scan, options) {
-  let env = {};
+  const env = {};
   const reachRequirements = scan?.middlewares?.filter((item) => item.configName === "reach") ?? [];
   const reachProviders = reachRequirements.map((item) => item.config);
   let hasReachOutput = false;
@@ -5156,13 +5596,16 @@ function mergeProvisionEnv(results, scan, options) {
         });
         if (targets.length) {
           for (const target of targets)
-            reachProviders[reachRequirements.indexOf(target)] = { ...provider, name: target.config.name ?? provider.name };
+            reachProviders[reachRequirements.indexOf(target)] = { ...mergeManagedMiddlewareConfig(target, provider), name: target.config.name ?? provider.name };
         } else {
           reachProviders.push(provider);
         }
       }
     }
-    env = { ...env, ...prov.envVars };
+    for (const [name, value] of Object.entries(prov.envVars)) {
+      const requirement = scan?.middlewares?.find((item) => item.envPrefix === name);
+      env[name] = requirement ? JSON.stringify(mergeManagedMiddlewareConfig(requirement, JSON.parse(value))) : value;
+    }
   }
   if (hasReachOutput)
     env.HAI_REACH_PROVIDERS = JSON.stringify(reachProviders);
@@ -5583,7 +6026,8 @@ async function createDeploymentPlan(appDir, input, options = {}) {
       }
     }
     const sidecar = provider.type === "docker-ssh" ? planSidecars(directory, projectName, app, provisionEnv, effective, config.container?.s3Engine, { dbPassword: "", storagePassword: "", ldapPassword: "" }) : void 0;
-    const gateway = !!artifact && sidecar?.services.includes("storage") && !(artifact.primaryService === "serv" && artifact.hasWeb);
+    const https = provider.type === "docker-ssh" ? provider.expose.https : void 0;
+    const gateway = !!artifact && !(artifact.primaryService === "serv" && artifact.hasWeb) && (sidecar?.services.includes("storage") || !!https && (artifact.primaryService === "serv" || app.isSvelteKit));
     if (gateway && artifact.primaryService === "web" && !app.isSvelteKit)
       return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_storageBackendRequired"));
     if (gateway) {
@@ -5591,18 +6035,23 @@ async function createDeploymentPlan(appDir, input, options = {}) {
       if (!baseline.required)
         selected.push("gateway");
     }
+    if (https?.type === "letsencrypt") {
+      available.push("certbot");
+      if (!baseline.required)
+        selected.push("certbot");
+    }
     const services = Object.entries(sidecar?.composeServices ?? {}).filter(([name]) => selected.includes(name));
     return ok({
       projectName,
       root,
-      appDir: directory,
+      serviceDir: directory,
       environment: environment.data.environment,
-      target: provider.type === "docker-ssh" ? { provider: provider.type, host: provider.ssh?.host, port: provider.ssh?.port, directory: remoteDirectory, runtime: provider.remote.runtime, hostPort: provider.expose.hostPort } : { provider: provider.type },
+      target: provider.type === "docker-ssh" ? { provider: provider.type, host: provider.ssh?.host, port: provider.ssh?.port, directory: remoteDirectory, runtime: provider.remote.runtime, hostPort: provider.expose.hostPort, https: https ? { type: https.type, domain: https.domain, port: https.port } : void 0 } : { provider: provider.type },
       artifact: artifact ? { directory: artifactDir, version: artifact.appVersion, buildId: artifact.buildId, verified: true, images: artifact.images.map((image) => ({ name: image.name, reference: image.imageRef, sha256: image.sha256 })) } : void 0,
       selected,
       retained: available.filter((name) => !selected.includes(name)),
       containers: provider.type === "docker-ssh" ? [...selected.filter((name) => images.includes(name) || name === "gateway").map((name) => `hai-${projectName}-${name}`), ...services.flatMap(([, service]) => typeof service.container_name === "string" ? [service.container_name] : [])] : [],
-      composeManagedServices: services.filter(([, service]) => typeof service.container_name !== "string").map(([name]) => name),
+      composeManagedServices: [...services.filter(([, service]) => typeof service.container_name !== "string").map(([name]) => name), ...selected.includes("certbot") ? ["certbot"] : []],
       logicalVolumes: Object.keys(sidecar?.volumes ?? {}),
       middleware: middlewares.map((item) => ({ service: item.service, backend: item.backend, configuration: item.envPrefix, action: selected.includes(item.service) ? effective.serviceModes?.[item.envPrefix] ?? effective.serviceModes?.[item.service] ?? "default" : "keep", provisioner: provisioners.get(item.service) })),
       configuration: { files: [join(root, "hai.json"), ...configFiles].filter(existsSync), environmentKeys: Object.keys(environment.data.values).sort() },