@h-ai/deploy 1.0.0-beta.20 → 1.0.0-beta.22

package/README.en.md

@@ -163,6 +163,8 @@ In `hai deploy`, choose a URL or individual fields for custom PostgreSQL, MySQL,
 
 #### Direct private object storage access
 
+Nginx serves a standalone HTTP 404 page when a presigned download reaches the static site fallback or the SSR/API gateway receives an application 404. The page uses Chinese, English, or Japanese based on the browser language. Update the proxy rules with a full deployment bundle. Rebuild independently run static web images from the updated CLI templates. [Download troubleshooting](../../docs/usage/configuration/data.md#下载链接无法访问)
+
 Self-hosted S3 uses an internal endpoint. Set `_storage.yml` publicEndpoint to an external address such as `https://app.example.com/delivery/files`. Nginx exposes `/delivery/files/<bucket>/...`, removes the proxy directory and forwards the original bucket URI, signature query and Host directly to storage:9000. Files bypass Serv; omitting the directory retains root bucket routes. A route may sit under the website directory; API, asset and health conflicts fail packaging. Storage ports/consoles remain private, buffering/signature logs are disabled, and S3 handles authorization and cross-origin CORS. External ingress must retain the full entry path and Host so only the SDK gateway removes the prefix.
 
 Managed deployments retain bucket/region/prefix/publicEndpoint/publicUrl/operationLog while replacing internal connections and managed credentials. Adding the gateway or changing access settings requires a full baseline; partial preflight rejects mismatching configuration fingerprints. App/storage partial updates refresh retained proxy DNS, and recovery restores the previous topology. External/kept storage gets no local sidecar route; Local does not expose private directories. See the [storage handbook](../../docs/usage/configuration/data.md).

package/README.ja.md

@@ -163,6 +163,8 @@ SSH 設定は選択環境の `.env.<環境>.local` に保存します。`--bundl
 
 #### 非公開オブジェクトストレージへの直接アクセス
 
+署名付きダウンロードが静的サイトのフォールバックに到達した場合、または SSR/API ゲートウェイがアプリから 404 を受け取った場合、Nginx は専用ページを HTTP 404 で返します。ブラウザーの言語に応じて中国語、英語、日本語で表示します。プロキシのルールを更新するには完全デプロイバンドルを使用し、静的 Web イメージを単独で使う場合は更新後の CLI テンプレートから再構築してください。[ダウンロードのトラブルシューティング](../../docs/usage/configuration/data.md#下载链接无法访问)
+
 自前 S3 の endpoint は内部接続先です。publicEndpoint に `https://app.example.com/delivery/files` などの外部アドレスを設定できます。Nginx は `/delivery/files/<bucket>/...` を受け、入口パスだけを除去し、本来のバケット URI、署名クエリ、Host を保持して storage:9000 に転送します。Serv を経由せず、パス省略時は従来のルートバケット形式です。サイト配下に置けますが API、資源、ヘルスパスの競合は拒否します。ポートと管理コンソールは非公開、バッファリングと署名ログは無効です。認可と CORS は S3 に設定し、外部プロキシは入口パスと Host を保持してください。
 
 自前構成は bucket/region/prefix/publicEndpoint/publicUrl/operationLog を保持し、内部接続と受管認証情報だけを置き換えます。gateway 追加や公開設定変更には完全デプロイが必要で、部分更新の事前検証は設定摘要の不一致を拒否します。アプリ/ストレージ部分更新では保持プロキシの DNS を更新し、失敗時は以前の構成に復元します。外部/保持接続にローカルルートは生成せず、Local の非公開ディレクトリも公開しません。[ストレージ手引き](../../docs/usage/configuration/data.md)を参照してください。

package/README.md

@@ -177,6 +177,8 @@ SSH 参数保存到选中环境的 `.env.<环境>.local`。`--bundle-only` 在
 
 #### 私有对象存储直连
 
+预签名下载请求落入静态网站回退，或 SSR/API 网关收到应用的 404 时，Nginx 返回 HTTP 404 和独立的下载提示页。提示按浏览器语言显示中文、英文或日文。现有容器部署使用完整交付包更新代理规则，独立静态 Web 镜像使用更新后的 CLI 模板重新构建。[下载排查](../../docs/usage/configuration/data.md#下载链接无法访问)
+
 自建 S3 的 `endpoint` 使用 Compose 内部地址，浏览器地址用 `_storage.yml` 的 `publicEndpoint` 配置，例如 `https://app.example.com/delivery/files`。Nginx 对外开放 `/delivery/files/<bucket>/...`，去掉 `/delivery/files` 后将原始桶 URI、签名查询与 Host 直接转发 storage:9000，文件不经过 Serv；省略目录时继续使用根桶路径。入口可位于网站目录内，API/资源/健康路径冲突会在打包前失败。存储端口与控制台不公开，对象缓冲和签名日志关闭；S3 负责私有桶授权和跨源 CORS。外层代理须保留完整入口路径与 Host，只由 SDK 网关去掉前缀。
 
 自建配置保留 bucket/region/prefix/publicEndpoint/publicUrl/operationLog，只替换内部连接与托管凭据。首次增加网关或改变这些访问设置须全量部署，增量预检按配置摘要拒绝不一致；普通应用/存储增量刷新保留代理的服务 DNS，失败恢复使用旧拓扑。外部/保持连接不生成本地存储路由，Local 不公开私有目录。详见[存储配置手册](../../docs/usage/configuration/data.md#配置人员区分三个访问地址).

package/dist/index.d.ts

@@ -1077,7 +1077,7 @@ declare const deploy: DeployFunctions;
  * const message = deployM('deploy_sshRequired')
  * ```
  */
-declare const deployM: (key: "deploy_composeHostAddressInvalid" | "deploy_composeHostnameInvalid" | "deploy_composeHostnameConflict" | "deploy_composeProviderRequired" | "deploy_composeServiceUnavailable" | "deploy_notInitialized" | "deploy_initFailed" | "deploy_unsupportedProviderType" | "deploy_unsupportedProvisionerType" | "deploy_configTokenRequired" | "deploy_authRequired" | "deploy_authFailed" | "deploy_projectCreateFailed" | "deploy_uploadFailed" | "deploy_deployFailed" | "deploy_provisionFailed" | "deploy_adapterMissing" | "deploy_scanFailed" | "deploy_envVarFailed" | "deploy_credentialError" | "deploy_credentialInvalidKey" | "deploy_credentialSaved" | "deploy_credentialLoaded" | "deploy_configError" | "deploy_credentialMissing" | "deploy_apiError" | "deploy_fileUploadFailed" | "deploy_provisionNoResult" | "deploy_recoveryFailure" | "deploy_recoverySuggestion" | "deploy_commandTimeout" | "deploy_commandFailed" | "deploy_remoteConnectFailed" | "deploy_remoteRuntimeMissing" | "deploy_imageTransferFailed" | "deploy_healthCheckFailed" | "deploy_invalidEnvironment" | "deploy_environmentMissing" | "deploy_environmentReadFailed" | "deploy_environmentWriteFailed" | "deploy_multipleApplications" | "deploy_purposeSqlite" | "deploy_purposeDatabase" | "deploy_purposeMemory" | "deploy_purposeLocal" | "deploy_purposeCache" | "deploy_purposeStorage" | "deploy_purposeVector" | "deploy_purposeDisabled" | "deploy_purposeLdap" | "deploy_purposeConsole" | "deploy_purposeEmail" | "deploy_purposeSms" | "deploy_webProxyInvalid" | "deploy_webBaseConflict" | "deploy_storageProxyInvalid" | "deploy_storagePublicEndpointInvalid" | "deploy_storageBackendRequired" | "deploy_artifactInvalid" | "deploy_sshRequired" | "deploy_sshPasswordInvalid" | "deploy_sshAskpassFailed" | "deploy_sshAskpassCleanupFailed" | "deploy_targetAuth" | "deploy_targetPasswordEnv" | "deploy_bundleInstructions" | "deploy_bundleApplyGuide" | "deploy_bundleMetadata" | "deploy_targetHost" | "deploy_targetPort" | "deploy_targetUsername" | "deploy_targetIdentityFile" | "deploy_targetKnownHostsFile" | "deploy_targetStrictHostKeyChecking" | "deploy_targetConnectTimeoutSeconds" | "deploy_targetDirectory" | "deploy_targetBundle" | "deploy_bundleOnlyContainer" | "deploy_selectedContainerOnly" | "deploy_selectionInvalid" | "deploy_imageVersionRequired" | "deploy_bundleRuntimeRequired" | "deploy_bundleFailed" | "deploy_configFileInvalid" | "deploy_configFileUnreadable" | "deploy_bundleNameInvalid" | "deploy_localStopped" | "deploy_localUnknown" | "deploy_localNotStarted" | "deploy_commandOutputFailed" | "deploy_commandInputFailed" | "deploy_commandTreeActive" | "deploy_commandExecutionFailed" | "deploy_remoteUnknown" | "deploy_remoteFinished" | "deploy_bundleDirectoryExists" | "deploy_bundleFull" | "deploy_bundlePartial" | "deploy_bundleSelection" | "deploy_transportBodyLimitInvalid" | "deploy_transportKeyRingInvalid" | "deploy_uploadPasswordPrompt" | "deploy_uploadPasswordUnavailable" | "deploy_uploadPasswordCancelled" | "deploy_uploadPasswordInvalid" | "deploy_managedSecretsInvalid" | "deploy_secretImportFailed" | "deploy_projectNameRequired" | "deploy_projectNameOverrideRemoved" | "deploy_requestAccessInvalid" | "deploy_httpsPortsInvalid" | "deploy_httpsCertificateInvalid" | "deploy_bundleRuntime" | "deploy_refreshCookieSecureInvalid" | "deploy_postgresPasswordConflict" | "deploy_bundleVariables" | "deploy_bundleHttpOnly" | "deploy_bundleHttps" | "deploy_bundleAcme" | "deploy_bundleAccounts" | "deploy_bundleDirectories" | "deploy_downloadInvalid" | "deploy_imageSourceMissing" | "deploy_proxySystemUnsupported" | "deploy_middlewareFieldInvalid" | "deploy_middlewareFieldError" | "deploy_middlewareRequired" | "deploy_middlewareInteger" | "deploy_middlewareBoolean" | "deploy_middlewareUrl" | "deploy_middlewareS3Endpoint" | "deploy_middlewareTlsSyntax" | "deploy_middlewareMysqlTls" | "deploy_middlewarePostgresTls" | "deploy_middlewareHeaders" | "deploy_middlewareMethod" | "deploy_configResolutionFailed" | "deploy_reachEmptyProviderOverride" | "deploy_s3Engine", options?: _h_ai_core.MessageOptions) => string;
+declare const deployM: (key: "deploy_composeHostAddressInvalid" | "deploy_composeHostnameInvalid" | "deploy_composeHostnameConflict" | "deploy_composeProviderRequired" | "deploy_composeServiceUnavailable" | "deploy_notInitialized" | "deploy_initFailed" | "deploy_unsupportedProviderType" | "deploy_unsupportedProvisionerType" | "deploy_configTokenRequired" | "deploy_authRequired" | "deploy_authFailed" | "deploy_projectCreateFailed" | "deploy_uploadFailed" | "deploy_deployFailed" | "deploy_provisionFailed" | "deploy_adapterMissing" | "deploy_scanFailed" | "deploy_envVarFailed" | "deploy_credentialError" | "deploy_credentialInvalidKey" | "deploy_credentialSaved" | "deploy_credentialLoaded" | "deploy_configError" | "deploy_credentialMissing" | "deploy_apiError" | "deploy_fileUploadFailed" | "deploy_provisionNoResult" | "deploy_recoveryFailure" | "deploy_recoverySuggestion" | "deploy_commandTimeout" | "deploy_commandFailed" | "deploy_remoteConnectFailed" | "deploy_remoteRuntimeMissing" | "deploy_imageTransferFailed" | "deploy_healthCheckFailed" | "deploy_invalidEnvironment" | "deploy_environmentMissing" | "deploy_environmentReadFailed" | "deploy_environmentWriteFailed" | "deploy_multipleApplications" | "deploy_purposeSqlite" | "deploy_purposeDatabase" | "deploy_purposeMemory" | "deploy_purposeLocal" | "deploy_purposeCache" | "deploy_purposeStorage" | "deploy_purposeVector" | "deploy_purposeDisabled" | "deploy_purposeLdap" | "deploy_purposeConsole" | "deploy_purposeEmail" | "deploy_purposeSms" | "deploy_webProxyInvalid" | "deploy_webBaseConflict" | "deploy_storageProxyInvalid" | "deploy_storagePublicEndpointInvalid" | "deploy_storageBackendRequired" | "deploy_artifactInvalid" | "deploy_sshRequired" | "deploy_sshPasswordInvalid" | "deploy_sshAskpassFailed" | "deploy_sshAskpassCleanupFailed" | "deploy_targetAuth" | "deploy_targetPasswordEnv" | "deploy_bundleInstructions" | "deploy_bundleApplyGuide" | "deploy_bundleMetadata" | "deploy_targetHost" | "deploy_targetPort" | "deploy_targetUsername" | "deploy_targetIdentityFile" | "deploy_targetKnownHostsFile" | "deploy_targetStrictHostKeyChecking" | "deploy_targetConnectTimeoutSeconds" | "deploy_targetDirectory" | "deploy_targetBundle" | "deploy_bundleOnlyContainer" | "deploy_selectedContainerOnly" | "deploy_selectionInvalid" | "deploy_imageVersionRequired" | "deploy_bundleRuntimeRequired" | "deploy_bundleFailed" | "deploy_configFileInvalid" | "deploy_configFileUnreadable" | "deploy_bundleNameInvalid" | "deploy_localStopped" | "deploy_localUnknown" | "deploy_localNotStarted" | "deploy_commandOutputFailed" | "deploy_commandInputFailed" | "deploy_commandTreeActive" | "deploy_commandExecutionFailed" | "deploy_remoteUnknown" | "deploy_remoteFinished" | "deploy_bundleDirectoryExists" | "deploy_bundleFull" | "deploy_bundlePartial" | "deploy_bundleSelection" | "deploy_transportBodyLimitInvalid" | "deploy_transportKeyRingInvalid" | "deploy_uploadPasswordPrompt" | "deploy_uploadPasswordUnavailable" | "deploy_uploadPasswordCancelled" | "deploy_uploadPasswordInvalid" | "deploy_managedSecretsInvalid" | "deploy_secretImportFailed" | "deploy_projectNameRequired" | "deploy_projectNameOverrideRemoved" | "deploy_requestAccessInvalid" | "deploy_httpsPortsInvalid" | "deploy_httpsCertificateInvalid" | "deploy_bundleRuntime" | "deploy_refreshCookieSecureInvalid" | "deploy_postgresPasswordConflict" | "deploy_bundleVariables" | "deploy_bundleHttpOnly" | "deploy_bundleHttps" | "deploy_bundleAcme" | "deploy_bundleAccounts" | "deploy_bundleDirectories" | "deploy_downloadInvalid" | "deploy_imageSourceMissing" | "deploy_proxySystemUnsupported" | "deploy_middlewareFieldInvalid" | "deploy_middlewareFieldError" | "deploy_middlewareRequired" | "deploy_middlewareInteger" | "deploy_middlewareBoolean" | "deploy_middlewareUrl" | "deploy_middlewareS3Endpoint" | "deploy_middlewareTlsSyntax" | "deploy_middlewareMysqlTls" | "deploy_middlewarePostgresTls" | "deploy_middlewareHeaders" | "deploy_middlewareMethod" | "deploy_configResolutionFailed" | "deploy_reachEmptyProviderOverride" | "deploy_s3Engine" | "deploy_downloadUnavailableTitle" | "deploy_downloadUnavailableInstruction", options?: _h_ai_core.MessageOptions) => string;
 
 /**
  * 部署中间件的后端与连接字段目录，供扫描、CLI 和容器规划共同使用。

package/dist/index.js

@@ -221,7 +221,9 @@ var en_US_default = {
   deploy_middlewareMethod: "Enter POST or PUT.",
   deploy_configResolutionFailed: "Cannot resolve {path}. Check the configuration structure and array indices for {fields}.",
   deploy_reachEmptyProviderOverride: "While resolving {path}, {field} refers to a missing provider because HAI_REACH_PROVIDERS is []. Remove stale indexed variables and set HAI_REACH_PROVIDERS to the complete notification provider list in .env.<environment>.local.",
-  deploy_s3Engine: "Choose the self-hosted S3 implementation"
+  deploy_s3Engine: "Choose the self-hosted S3 implementation",
+  deploy_downloadUnavailableTitle: "Download link unavailable",
+  deploy_downloadUnavailableInstruction: "Return to the download page to get a new link. If the download still fails, contact your administrator."
 };
 
 // messages/ja-JP.json
@@ -364,7 +366,9 @@ var ja_JP_default = {
   deploy_middlewareMethod: "POST \u307E\u305F\u306F PUT \u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_configResolutionFailed: "{path} \u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002{fields} \u306B\u5BFE\u5FDC\u3059\u308B\u8A2D\u5B9A\u306E\u69CB\u9020\u3068\u914D\u5217\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_reachEmptyProviderOverride: "{path} \u306E\u6709\u52B9\u306A\u8A2D\u5B9A\u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002HAI_REACH_PROVIDERS \u304C [] \u306E\u305F\u3081\u3001{field} \u306B\u5BFE\u5FDC\u3059\u308B\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u304C\u3042\u308A\u307E\u305B\u3093\u3002\u53E4\u3044\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u4ED8\u304D\u5909\u6570\u3092\u524A\u9664\u3057\u3001.env.<\u74B0\u5883>.local \u306E HAI_REACH_PROVIDERS \u306B\u901A\u77E5\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u5B8C\u5168\u306A\u4E00\u89A7\u3092\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-  deploy_s3Engine: "\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8 S3 \u306E\u5B9F\u88C5\u3092\u9078\u629E"
+  deploy_s3Engine: "\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8 S3 \u306E\u5B9F\u88C5\u3092\u9078\u629E",
+  deploy_downloadUnavailableTitle: "\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u30EA\u30F3\u30AF\u306B\u30A2\u30AF\u30BB\u30B9\u3067\u304D\u307E\u305B\u3093",
+  deploy_downloadUnavailableInstruction: "\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u30DA\u30FC\u30B8\u306B\u623B\u308A\u3001\u65B0\u3057\u3044\u30EA\u30F3\u30AF\u3092\u53D6\u5F97\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u89E3\u6C7A\u3057\u306A\u3044\u5834\u5408\u306F\u7BA1\u7406\u8005\u306B\u304A\u554F\u3044\u5408\u308F\u305B\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -507,7 +511,9 @@ var zh_CN_default = {
   deploy_middlewareMethod: "\u8BF7\u8F93\u5165 POST \u6216 PUT\u3002",
   deploy_configResolutionFailed: "\u65E0\u6CD5\u89E3\u6790 {path}\u3002\u8BF7\u68C0\u67E5 {fields} \u5BF9\u5E94\u7684\u914D\u7F6E\u7ED3\u6784\u4E0E\u6570\u7EC4\u7D22\u5F15\u3002",
   deploy_reachEmptyProviderOverride: "\u89E3\u6790 {path} \u7684\u751F\u6548\u914D\u7F6E\u65F6\u53D1\u73B0 {field} \u6307\u5411\u4E0D\u5B58\u5728\u7684 Provider\u3002HAI_REACH_PROVIDERS \u5F53\u524D\u4E3A []\u3002\u8BF7\u5220\u9664\u65E7\u7684\u7D22\u5F15\u53D8\u91CF\uFF0C\u5E76\u5728 .env.<\u73AF\u5883>.local \u4E2D\u7528 HAI_REACH_PROVIDERS \u914D\u7F6E\u5B8C\u6574\u7684\u901A\u77E5 Provider \u5217\u8868\u3002",
-  deploy_s3Engine: "\u9009\u62E9\u81EA\u5EFA S3 \u670D\u52A1\u5B9E\u73B0"
+  deploy_s3Engine: "\u9009\u62E9\u81EA\u5EFA S3 \u670D\u52A1\u5B9E\u73B0",
+  deploy_downloadUnavailableTitle: "\u4E0B\u8F7D\u94FE\u63A5\u65E0\u6CD5\u8BBF\u95EE",
+  deploy_downloadUnavailableInstruction: "\u8BF7\u8FD4\u56DE\u4E0B\u8F7D\u9875\u9762\u91CD\u65B0\u83B7\u53D6\u94FE\u63A5\u3002\u82E5\u4ECD\u65E0\u6CD5\u4E0B\u8F7D\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u3002"
 };
 
 // src/deploy-i18n.ts
@@ -1457,7 +1463,26 @@ var deploy_config_shapes_default = {
             type: "string",
             format: "uri"
           },
+          multipart: {
+            default: {},
+            type: "object",
+            properties: {
+              partSizeBytes: {
+                default: 5242880,
+                type: "integer",
+                minimum: 5242880,
+                maximum: 5368709120
+              },
+              queueSize: {
+                default: 2,
+                type: "integer",
+                minimum: 1,
+                maximum: 9007199254740991
+              }
+            }
+          },
           operationLog: {
+            default: {},
             type: "object",
             properties: {
               read: {
@@ -1465,7 +1490,7 @@ var deploy_config_shapes_default = {
                 type: "boolean"
               },
               write: {
-                default: false,
+                default: true,
                 type: "boolean"
               },
               maxLength: {
@@ -1473,15 +1498,6 @@ var deploy_config_shapes_default = {
                 type: "integer",
                 minimum: 0,
                 maximum: 9007199254740991
-              },
-              level: {
-                default: "debug",
-                type: "string",
-                enum: [
-                  "info",
-                  "debug",
-                  "trace"
-                ]
               }
             }
           }
@@ -1514,6 +1530,7 @@ var deploy_config_shapes_default = {
             type: "number"
           },
           operationLog: {
+            default: {},
             type: "object",
             properties: {
               read: {
@@ -1521,7 +1538,7 @@ var deploy_config_shapes_default = {
                 type: "boolean"
               },
               write: {
-                default: false,
+                default: true,
                 type: "boolean"
               },
               maxLength: {
@@ -1529,15 +1546,6 @@ var deploy_config_shapes_default = {
                 type: "integer",
                 minimum: 0,
                 maximum: 9007199254740991
-              },
-              level: {
-                default: "debug",
-                type: "string",
-                enum: [
-                  "info",
-                  "debug",
-                  "trace"
-                ]
               }
             }
           }
@@ -10354,6 +10362,87 @@ async function copyArchive(source, destination) {
   await pipeline(createReadStream(source), digest, createWriteStream(destination, { mode: 384 }));
   return hash.digest("hex");
 }
+
+// src/container/deploy-download-error.ts
+var PAGE_STYLE = `
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    background: #f1f5f9;
+    color: #172033;
+    font-family: Inter, system-ui, "Microsoft YaHei", sans-serif;
+    line-height: 1.7;
+  }
+  main {
+    width: min(100%, 640px);
+    padding: clamp(24px, 6vw, 48px);
+    border: 1px solid #dbe3ee;
+    border-top: 4px solid #2563eb;
+    border-radius: 12px;
+    background: #fff;
+  }
+  h1 { margin: 0 0 16px; font-size: clamp(24px, 5vw, 32px); line-height: 1.4; }
+  p { margin: 0; color: #475569; font-size: 16px; }
+`;
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderPage() {
+  return `<!doctype html>
+<html lang="$hai_download_language">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex">
+  <meta name="referrer" content="no-referrer">
+  <link rel="icon" href="data:,">
+  <title>$hai_download_title</title>
+  <style>${PAGE_STYLE}</style>
+</head>
+<body><main><h1>$hai_download_title</h1><p>$hai_download_instruction</p></main></body>
+</html>`;
+}
+function renderDownloadErrorMaps() {
+  return `map "$request_method:$args" $hai_signed_download {
+  default 0;
+  "~*^(GET|HEAD):(?:[^&]*&)*X-Amz-Signature=[^&]+(?:&|$)" 1;
+}
+map $http_accept_language $hai_download_language {
+  default zh-CN;
+  ~*^en en-US;
+  ~*^ja ja-JP;
+}
+map $hai_download_language $hai_download_title {
+  default ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableTitle", { locale: "zh-CN" })))};
+  en-US ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableTitle", { locale: "en-US" })))};
+  ja-JP ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableTitle", { locale: "ja-JP" })))};
+}
+map $hai_download_language $hai_download_instruction {
+  default ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableInstruction", { locale: "zh-CN" })))};
+  en-US ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableInstruction", { locale: "en-US" })))};
+  ja-JP ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableInstruction", { locale: "ja-JP" })))};
+}
+`;
+}
+function renderDownloadErrorLocation() {
+  return `  location @hai_download_unavailable {
+    access_log off;
+    error_log /dev/null;
+    types { }
+    default_type text/html;
+    charset utf-8;
+    add_header Cache-Control "private, no-store" always;
+    add_header Referrer-Policy no-referrer always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
+    return 404 ${JSON.stringify(renderPage())};
+  }
+`;
+}
 var CERTBOT_IMAGE = "docker.io/certbot/certbot:v5.9.0";
 function createHttpsAssets(config, projectDirectory) {
   const assets = {
@@ -11088,6 +11177,7 @@ function generateWebProxyConfig(port, apiPrefix, options = {}) {
   }
 `).join("");
   return `include /tmp/hai-dns.conf;
+${renderDownloadErrorMaps()}
 ${renderResolvedUpstream("hai_serv_backend", "serv", port)}${options.storageBucket ? renderStorageUpstream(options.storageBucket, options.storageBasePath) : ""}server {
   listen ${webPort};
   server_name _;
@@ -11171,17 +11261,7 @@ function generateApplicationProxyConfig(options) {
   const bodyLimits = resolveTransportBodyLimits(maxPlaintextBytes);
   const trustedEdges = renderTrustedEdgeProxies(options.trustedEdgeProxies);
   const forwardedProtocol = options.trustedEdgeProxies?.length ? "$hai_request_scheme" : "$scheme";
-  return `include /tmp/hai-dns.conf;
-${renderResolvedUpstream("hai_application_backend", primaryService, port)}${renderTrustedEdgeProtocol(options.trustedEdgeProxies)}${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
-  listen 8080;
-  server_name _;
-${trustedEdges}  large_client_header_buffers 4 32k;
-${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath) : ""}  location = /_hai/gateway-health {
-    access_log off;
-    return 200 'ok';
-  }
-  location / {
-    client_max_body_size ${bodyLimits.encryptedPayloadBytes};
+  const proxySettings = `    client_max_body_size ${bodyLimits.encryptedPayloadBytes};
     proxy_pass http://hai_application_backend;
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;
@@ -11195,7 +11275,29 @@ ${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath)
     proxy_request_buffering off;
     proxy_buffering off;
     proxy_buffer_size 32k;
-    proxy_buffers 8 32k;
+    proxy_buffers 8 32k;`;
+  return `include /tmp/hai-dns.conf;
+${renderDownloadErrorMaps()}
+${renderResolvedUpstream("hai_application_backend", primaryService, port)}${renderTrustedEdgeProtocol(options.trustedEdgeProxies)}${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
+  listen 8080;
+  server_name _;
+${trustedEdges}  large_client_header_buffers 4 32k;
+${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath) : ""}  location = /_hai/gateway-health {
+    access_log off;
+    return 200 'ok';
+  }
+${renderDownloadErrorLocation()}  location / {
+    recursive_error_pages on;
+    error_page 418 = @hai_download_proxy;
+    if ($hai_signed_download) { return 418; }
+${proxySettings}
+  }
+  location @hai_download_proxy {
+    access_log off;
+    error_log /dev/null;
+    proxy_intercept_errors on;
+    error_page 404 = @hai_download_unavailable;
+${proxySettings}
   }
 }
 `;
@@ -11234,24 +11336,35 @@ map "$hai_trusted_edge:$http_x_forwarded_proto" $hai_request_scheme {
 function renderWebLocation(webBasePath) {
   if (webBasePath && (!/^\/[\w.-]+(?:\/[\w.-]+)*$/.test(webBasePath) || webBasePath.split("/").some((segment) => segment === "." || segment === "..") || ["/health", "/_hai/web-health"].includes(webBasePath)))
     throw new Error("Invalid web base path");
-  return webBasePath ? `  absolute_redirect off;
+  const fallback = `${renderDownloadErrorLocation()}  location @hai_spa_fallback {
+    error_page 418 = @hai_download_unavailable;
+    if ($hai_signed_download) { return 418; }
+    try_files /index.html =404;
+  }
+`;
+  return fallback + (webBasePath ? `  absolute_redirect off;
   location = ${webBasePath} {
     return 308 ${webBasePath}/$is_args$args;
   }
   location ${webBasePath}/ {
     rewrite ^${webBasePath.replaceAll(".", "\\.").replaceAll("-", "\\-")}/(.*)$ /$1 break;
-    try_files $uri/index.html $uri /index.html =404;
+    try_files $uri/index.html $uri @hai_spa_fallback;
+  }
+  location / {
+    error_page 418 = @hai_download_unavailable;
+    if ($hai_signed_download) { return 418; }
+    return 404;
   }
-  location / { return 404; }
 ` : `  location / {
-    try_files $uri $uri/ /index.html;
+    try_files $uri $uri/ @hai_spa_fallback;
   }
-`;
+`);
 }
 function generateStaticWebConfig(port, webBasePath) {
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     throw new Error("Invalid web proxy target");
-  return `server {
+  return `${renderDownloadErrorMaps()}
+server {
   listen ${port};
   server_name _;
   root /usr/share/nginx/html;
@@ -12042,7 +12155,7 @@ function createVercelProvider() {
         );
         token = apiToken;
         const username = user.user.username || user.user.email;
-        logger6.info("Vercel authenticated", { user: username });
+        logger6.info("Vercel authenticated");
         return ok(username);
       } catch (error) {
         logger6.error("Vercel authentication failed", { error });
@@ -12252,7 +12365,7 @@ function createAliyunProvisioner() {
         accessKey = akId;
         secretKey = akSecret;
         signName = credentials.signName;
-        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        logger7.info("Aliyun authenticated");
         return ok(akId);
       } catch (error) {
         logger7.error("Aliyun authentication failed", { error });
@@ -12493,7 +12606,7 @@ function createR2Provisioner() {
         token = apiTok;
         accessKey = credentials.accessKeyId;
         secretKey = credentials.secretAccessKey;
-        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
+        logger9.info("Cloudflare R2 authenticated");
         return ok(acctId);
       } catch (error) {
         logger9.error("Cloudflare R2 authentication failed", { error });
@@ -12716,7 +12829,7 @@ function createUpstashProvisioner() {
         await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
         apiKey = userKey;
-        logger11.info("Upstash authenticated", { email: userEmail });
+        logger11.info("Upstash authenticated");
         return ok(userEmail);
       } catch (error) {
         logger11.error("Upstash authentication failed", { error });
@@ -12925,10 +13038,8 @@ var deploy = {
         } else {
           provider = createProviderByType(parsed.provider.type);
           const authResult = await provider.authenticate(parsed.provider.token);
-          if (!authResult.success) {
+          if (!authResult.success)
             return err(authResult.error);
-          }
-          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         }
         currentProvisioners.clear();
         if (parsed.services) {
@@ -12942,14 +13053,16 @@ var deploy = {
             if (!provAuthResult.success) {
               logger12.error("Provisioner authentication failed", {
                 service: serviceType,
-                provisioner: serviceConfig.provisioner
+                provisioner: serviceConfig.provisioner,
+                errorCode: provAuthResult.error.code,
+                traceId: provAuthResult.error.traceId
               });
               currentProvisioners.clear();
               return err(provAuthResult.error);
             }
             logger12.info("Provisioner authenticated", {
               service: serviceType,
-              user: provAuthResult.data
+              provisioner: provisioner.name
             });
             currentProvisioners.set(serviceType, provisioner);
           }