@h-ai/deploy 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/index.js

@@ -1,9 +1,9 @@
 import { createHash, randomUUID, randomBytes, X509Certificate, createPublicKey, createPrivateKey } from 'crypto';
-import { createReadStream, readFileSync, existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, openSync, constants, fstatSync, readSync, closeSync, fchmodSync, writeFileSync, fsyncSync, renameSync, unlinkSync, chmodSync, mkdtempSync, copyFileSync, rmSync, createWriteStream, statSync } from 'fs';
+import { createReadStream, readFileSync, existsSync, lstatSync, mkdirSync, readdirSync, openSync, constants, fstatSync, readSync, closeSync, fchmodSync, writeFileSync, fsyncSync, renameSync, unlinkSync, chmodSync, mkdtempSync, copyFileSync, rmSync, realpathSync, createWriteStream, statSync } from 'fs';
 import { resolve, extname, join, dirname, basename, relative, sep } from 'path';
 import { z } from 'zod';
 import { core, err, ok, CoreConfigSchema, RequestAccessConfigSchema, TrustedProxiesSchema } from '@h-ai/core';
-import { spawn, execFileSync } from 'child_process';
+import { execFileSync, spawn } from 'child_process';
 import process from 'process';
 import { LineCounter, parseDocument, parse, stringify, parseAllDocuments } from 'yaml';
 import { Buffer, constants as constants$1 } from 'buffer';
@@ -22,17 +22,14 @@ import { isIP } from 'net';
 // src/deploy-artifact.ts
 var DeploymentArtifactSchema = z.object({
   /** 清单格式版本，与应用版本和部署环境无关。 */
-  version: z.union([
-    z.literal(4),
-    z.literal(5)
-  ]),
+  version: z.literal(5),
   /** 主运行服务：独立后端为 serv，独立浏览器站点（静态或 SSR）为 web。 */
   primaryService: z.enum(["serv", "web"]),
   /** 应用根 package.json 的版本，用于归档、Compose 与桌面交付；最长 80 字符。 */
   appVersion: z.string().max(80).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9a-z-]+(?:\.[0-9a-z-]+)*)?(?:\+[0-9a-z-]+(?:\.[0-9a-z-]+)*)?$/i),
   /** 本次构建标识；同一应用版本允许重复构建。 */
   buildId: z.string().max(128).regex(/^[a-z0-9][\w.+-]*$/i),
-  /** 构建启动时观察到的 Git 来源；历史清单可以省略。 */
+  /** 构建启动时观察到的 Git 来源。 */
   source: z.object({
     /** 工程 package.json 所在仓库的提交 SHA；无法确定时为 unknown。 */
     commit: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64}|unknown)$/),
@@ -43,8 +40,8 @@ var DeploymentArtifactSchema = z.object({
   partial: z.boolean().default(false),
   /** 是否包含浏览器端；仅构建 serv 时也保留完整工程的 Web 拓扑。 */
   hasWeb: z.boolean().default(false),
-  /** Web构建的公开挂载目录，无末尾斜杠；省略或空字符串保持域名根目录。增量制品须保留完整拓扑的同一值。 */
-  webBasePath: z.string().refine((value) => value === "" || /^\/[\w.-]+(?:\/[\w.-]+)*$/.test(value) && !value.split("/").some((segment) => segment === "." || segment === "..")).optional(),
+  /** Web 构建的公开挂载目录，无末尾斜杠；空字符串表示域名根目录。增量制品须保留完整拓扑的同一值。 */
+  webBasePath: z.string().refine((value) => value === "" || /^\/[\w.-]+(?:\/[\w.-]+)*$/.test(value) && !value.split("/").some((segment) => segment === "." || segment === "..")),
   /** 工程显式配置的后端端口，部分构建未包含 serv 时仍保留。 */
   servContainerPort: z.number().int().min(1).max(65535).optional(),
   /** 工程显式配置的 Web 端口，部分构建未包含 web 镜像时仍保留；缺省使用部署默认值。 */
@@ -59,12 +56,12 @@ var DeploymentArtifactSchema = z.object({
     imageRef: z.string().regex(/^[a-z0-9][a-z0-9./:_-]*:[a-z0-9_][a-z0-9_.-]*$/).refine((value) => !value.endsWith(":latest")),
     /** tar 内容的 SHA-256，用于部署前校验。 */
     sha256: z.string().regex(/^[a-f0-9]{64}$/),
-    /** 引擎实际构建的镜像 OS/架构；历史清单可以省略。 */
+    /** 引擎实际构建的镜像 OS/架构。 */
     platform: z.string().regex(/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/).optional(),
     /** 容器内部监听端口；服务器公开端口由部署选择。 */
     containerPort: z.number().int().min(1).max(65535).optional()
   })).min(1).max(2).refine((images) => new Set(images.map((image) => image.name)).size === images.length)
-}).refine((artifact) => artifact.version === 5 ? !!artifact.webBasePath : !artifact.webBasePath).refine((artifact) => !artifact.webBasePath || artifact.hasWeb).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`)).refine((artifact) => artifact.primaryService !== "web" || artifact.hasWeb).refine((artifact) => artifact.images.every((image) => image.name === artifact.primaryService || image.name === "web" && artifact.hasWeb)).refine((artifact) => artifact.partial || artifact.images.some((image) => image.name === artifact.primaryService)).refine((artifact) => artifact.partial || !artifact.hasWeb || artifact.images.some((image) => image.name === "web"));
+}).refine((artifact) => !artifact.webBasePath || artifact.hasWeb).refine((artifact) => artifact.images.every((image) => image.file === `${image.name}-${artifact.appVersion}.tar`)).refine((artifact) => artifact.primaryService !== "web" || artifact.hasWeb).refine((artifact) => artifact.images.every((image) => image.name === artifact.primaryService || image.name === "web" && artifact.hasWeb)).refine((artifact) => artifact.partial || artifact.images.some((image) => image.name === artifact.primaryService)).refine((artifact) => artifact.partial || !artifact.hasWeb || artifact.images.some((image) => image.name === "web"));
 async function artifactChecksum(file) {
   const hash = createHash("sha256");
   for await (const chunk of createReadStream(file))
@@ -189,9 +186,7 @@ var en_US_default = {
   deploy_uploadPasswordCancelled: "Password input cancelled; no server connection was made.",
   deploy_uploadPasswordInvalid: "SSH passwords must contain 1\u20131023 UTF-8 bytes without line breaks.",
   deploy_managedSecretsInvalid: "Invalid generated middleware credential candidates. Rebuild the deployment bundle; server credentials will not be rotated automatically.",
-  deploy_secretImportFailed: "Legacy credential import was rejected during {phase}; check private input permissions, project/volume identity, live credentials and the deployment lock. No services were updated; inspect the protected state file if commit is unconfirmed",
   deploy_projectNameRequired: "The root package.json.name is missing or cannot be normalized into an image and deployment resource identity.",
-  deploy_projectNameOverrideRemoved: "Deployment identity comes from the root package.json.name; remove the obsolete projectName override.",
   deploy_requestAccessInvalid: "Invalid request access policy ({field}). Check fields, IP addresses, timezones and time windows. For a file reference, use readable YAML no larger than 1 MiB. Fix the configuration and create a new bundle.",
   deploy_httpsPortsInvalid: "HTTP and HTTPS ports must differ; Let\u2019s Encrypt HTTP-01 requires host port 80.",
   deploy_httpsCertificateInvalid: "Invalid HTTPS certificate. Check readable PEM files, matching unencrypted private key, validity dates and domain, then repackage.",
@@ -221,7 +216,9 @@ var en_US_default = {
   deploy_middlewareMethod: "Enter POST or PUT.",
   deploy_configResolutionFailed: "Cannot resolve {path}. Check the configuration structure and array indices for {fields}.",
   deploy_reachEmptyProviderOverride: "While resolving {path}, {field} refers to a missing provider because HAI_REACH_PROVIDERS is []. Remove stale indexed variables and set HAI_REACH_PROVIDERS to the complete notification provider list in .env.<environment>.local.",
-  deploy_s3Engine: "Choose the self-hosted S3 implementation"
+  deploy_s3Engine: "Choose the self-hosted S3 implementation",
+  deploy_downloadUnavailableTitle: "Download link unavailable",
+  deploy_downloadUnavailableInstruction: "Return to the download page to get a new link. If the download still fails, contact your administrator."
 };
 
 // messages/ja-JP.json
@@ -332,9 +329,7 @@ var ja_JP_default = {
   deploy_uploadPasswordCancelled: "\u30D1\u30B9\u30EF\u30FC\u30C9\u5165\u529B\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F\u3002\u30B5\u30FC\u30D0\u30FC\u306B\u306F\u672A\u63A5\u7D9A\u3067\u3059\u3002",
   deploy_uploadPasswordInvalid: "SSH \u30D1\u30B9\u30EF\u30FC\u30C9\u306F\u6539\u884C\u3092\u542B\u307E\u306A\u3044 1\u20131023 UTF-8 \u30D0\u30A4\u30C8\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_managedSecretsInvalid: "\u81EA\u5EFA\u30DF\u30C9\u30EB\u30A6\u30A7\u30A2\u306E\u5019\u88DC\u8A8D\u8A3C\u60C5\u5831\u304C\u7121\u52B9\u3067\u3059\u3002\u914D\u7F6E\u30D1\u30C3\u30B1\u30FC\u30B8\u3092\u518D\u751F\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30B5\u30FC\u30D0\u30FC\u306E\u8A8D\u8A3C\u60C5\u5831\u306F\u81EA\u52D5\u5909\u66F4\u3055\u308C\u307E\u305B\u3093\u3002",
-  deploy_secretImportFailed: "\u65E7\u8A8D\u8A3C\u60C5\u5831\u306E\u30A4\u30F3\u30DD\u30FC\u30C8\u306F {phase} \u6BB5\u968E\u3067\u62D2\u5426\u3055\u308C\u307E\u3057\u305F\u3002\u5165\u529B\u6A29\u9650\u3001\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u3068\u30DC\u30EA\u30E5\u30FC\u30E0\u3001\u5B9F\u969B\u306E\u8A8D\u8A3C\u60C5\u5831\u3001\u30C7\u30D7\u30ED\u30A4\u30ED\u30C3\u30AF\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30B5\u30FC\u30D3\u30B9\u306F\u66F4\u65B0\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002\u78BA\u5B9A\u304C\u4E0D\u660E\u306A\u5834\u5408\u306F\u4FDD\u8B77\u3055\u308C\u305F\u72B6\u614B\u30D5\u30A1\u30A4\u30EB\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044",
   deploy_projectNameRequired: "\u5DE5\u7A0B\u30EB\u30FC\u30C8\u306E package.json.name \u304C\u306A\u3044\u304B\u6B63\u898F\u5316\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30A4\u30E1\u30FC\u30B8\u3068\u30C7\u30D7\u30ED\u30A4\u30EA\u30BD\u30FC\u30B9\u306E\u8B58\u5225\u540D\u3092\u751F\u6210\u3067\u304D\u307E\u305B\u3093\u3002",
-  deploy_projectNameOverrideRemoved: "\u30C7\u30D7\u30ED\u30A4\u8B58\u5225\u540D\u306F\u5DE5\u7A0B\u30EB\u30FC\u30C8\u306E package.json.name \u304B\u3089\u53D6\u5F97\u3057\u307E\u3059\u3002\u65E7 projectName \u4E0A\u66F8\u304D\u5F15\u6570\u3092\u524A\u9664\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_requestAccessInvalid: "\u30EA\u30AF\u30A8\u30B9\u30C8\u30A2\u30AF\u30BB\u30B9\u8A2D\u5B9A\uFF08{field}\uFF09\u304C\u7121\u52B9\u3067\u3059\u3002\u30D5\u30A3\u30FC\u30EB\u30C9\u3001IP\u3001\u30BF\u30A4\u30E0\u30BE\u30FC\u30F3\u3001\u6642\u9593\u5E2F\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u30D5\u30A1\u30A4\u30EB\u306F\u8AAD\u307F\u53D6\u308A\u53EF\u80FD\u306A 1 MiB \u4EE5\u4E0B\u306E YAML \u3092\u6307\u5B9A\u3057\u3001\u4FEE\u6B63\u5F8C\u306B\u518D\u30D1\u30C3\u30B1\u30FC\u30B8\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_httpsPortsInvalid: "HTTP \u3068 HTTPS \u306E\u30DD\u30FC\u30C8\u306F\u7570\u306A\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059\u3002Let\u2019s Encrypt HTTP-01 \u306B\u306F\u30DB\u30B9\u30C8\u306E\u30DD\u30FC\u30C8 80 \u304C\u5FC5\u8981\u3067\u3059\u3002",
   deploy_httpsCertificateInvalid: "HTTPS \u8A3C\u660E\u66F8\u304C\u7121\u52B9\u3067\u3059\u3002PEM \u30D5\u30A1\u30A4\u30EB\u3001\u6697\u53F7\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u79D8\u5BC6\u9375\u3068\u306E\u4E00\u81F4\u3001\u6709\u52B9\u671F\u9593\u3001\u30C9\u30E1\u30A4\u30F3\u3092\u78BA\u8A8D\u3057\u3001\u518D\u4F5C\u6210\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
@@ -364,7 +359,9 @@ var ja_JP_default = {
   deploy_middlewareMethod: "POST \u307E\u305F\u306F PUT \u3092\u5165\u529B\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_configResolutionFailed: "{path} \u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002{fields} \u306B\u5BFE\u5FDC\u3059\u308B\u8A2D\u5B9A\u306E\u69CB\u9020\u3068\u914D\u5217\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   deploy_reachEmptyProviderOverride: "{path} \u306E\u6709\u52B9\u306A\u8A2D\u5B9A\u3092\u89E3\u6C7A\u3067\u304D\u307E\u305B\u3093\u3002HAI_REACH_PROVIDERS \u304C [] \u306E\u305F\u3081\u3001{field} \u306B\u5BFE\u5FDC\u3059\u308B\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u304C\u3042\u308A\u307E\u305B\u3093\u3002\u53E4\u3044\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u4ED8\u304D\u5909\u6570\u3092\u524A\u9664\u3057\u3001.env.<\u74B0\u5883>.local \u306E HAI_REACH_PROVIDERS \u306B\u901A\u77E5\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u5B8C\u5168\u306A\u4E00\u89A7\u3092\u8A2D\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-  deploy_s3Engine: "\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8 S3 \u306E\u5B9F\u88C5\u3092\u9078\u629E"
+  deploy_s3Engine: "\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8 S3 \u306E\u5B9F\u88C5\u3092\u9078\u629E",
+  deploy_downloadUnavailableTitle: "\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u30EA\u30F3\u30AF\u306B\u30A2\u30AF\u30BB\u30B9\u3067\u304D\u307E\u305B\u3093",
+  deploy_downloadUnavailableInstruction: "\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u30DA\u30FC\u30B8\u306B\u623B\u308A\u3001\u65B0\u3057\u3044\u30EA\u30F3\u30AF\u3092\u53D6\u5F97\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u89E3\u6C7A\u3057\u306A\u3044\u5834\u5408\u306F\u7BA1\u7406\u8005\u306B\u304A\u554F\u3044\u5408\u308F\u305B\u304F\u3060\u3055\u3044\u3002"
 };
 
 // messages/zh-CN.json
@@ -475,9 +472,7 @@ var zh_CN_default = {
   deploy_uploadPasswordCancelled: "\u5DF2\u53D6\u6D88\u5BC6\u7801\u8F93\u5165\uFF0C\u5C1A\u672A\u8FDE\u63A5\u670D\u52A1\u5668\u3002",
   deploy_uploadPasswordInvalid: "SSH \u5BC6\u7801\u987B\u4E3A 1\u20131023 \u4E2A UTF-8 \u5B57\u8282\uFF0C\u4E14\u4E0D\u80FD\u5305\u542B\u6362\u884C\u3002",
   deploy_managedSecretsInvalid: "\u81EA\u5EFA\u4E2D\u95F4\u4EF6\u5019\u9009\u51ED\u636E\u65E0\u6548\uFF0C\u8BF7\u91CD\u65B0\u751F\u6210\u90E8\u7F72\u5305\uFF1B\u670D\u52A1\u5668\u51ED\u636E\u4E0D\u4F1A\u81EA\u52A8\u66F4\u6362\u3002",
-  deploy_secretImportFailed: "\u65E7\u51ED\u636E\u5BFC\u5165\u5728 {phase} \u9636\u6BB5\u88AB\u62D2\u7EDD\uFF1B\u8BF7\u6838\u5BF9\u79C1\u6709\u8F93\u5165\u6743\u9650\u3001\u9879\u76EE/\u5377\u8EAB\u4EFD\u3001\u5B9E\u9645\u670D\u52A1\u51ED\u636E\u53CA\u90E8\u7F72\u9501\uFF0C\u672A\u6267\u884C\u670D\u52A1\u66F4\u65B0\uFF1B\u63D0\u4EA4\u7ED3\u679C\u4E0D\u660E\u65F6\u8BF7\u6838\u5BF9\u53D7\u4FDD\u62A4\u7684\u72B6\u6001\u6587\u4EF6",
   deploy_projectNameRequired: "\u5DE5\u7A0B\u6839 package.json.name \u7F3A\u5931\u6216\u65E0\u6CD5\u5F52\u4E00\u5316\uFF0C\u4E0D\u80FD\u751F\u6210\u955C\u50CF\u4E0E\u90E8\u7F72\u8D44\u6E90\u8EAB\u4EFD\u3002",
-  deploy_projectNameOverrideRemoved: "\u90E8\u7F72\u9879\u76EE\u540D\u7EDF\u4E00\u6765\u81EA\u5DE5\u7A0B\u6839 package.json.name\uFF1B\u8BF7\u79FB\u9664\u65E7 projectName \u8986\u76D6\u53C2\u6570\u3002",
   deploy_requestAccessInvalid: "\u8BF7\u6C42\u8BBF\u95EE\u7B56\u7565\u914D\u7F6E\u65E0\u6548\uFF08{field}\uFF09\u3002\u8BF7\u68C0\u67E5\u5B57\u6BB5\u3001IP\u3001\u65F6\u533A\u53CA\u65F6\u95F4\u7A97\u53E3\uFF1B\u5982\u5F15\u7528\u6587\u4EF6\uFF0C\u8BF7\u786E\u8BA4\u6587\u4EF6\u53EF\u8BFB\u3001\u683C\u5F0F\u4E3A YAML \u4E14\u4E0D\u8D85\u8FC7 1 MiB\u3002\u4FEE\u6B63\u540E\u91CD\u65B0\u6253\u5305\u3002",
   deploy_httpsPortsInvalid: "HTTP \u4E0E HTTPS \u7AEF\u53E3\u5FC5\u987B\u4E0D\u540C\uFF1BLet\u2019s Encrypt \u7684 HTTP-01 \u5165\u53E3\u5FC5\u987B\u4F7F\u7528\u5BBF\u4E3B\u673A 80 \u7AEF\u53E3\u3002",
   deploy_httpsCertificateInvalid: "HTTPS \u8BC1\u4E66\u65E0\u6548\uFF1A\u8BF7\u6838\u5BF9 PEM \u6587\u4EF6\u53EF\u8BFB\u3001\u8BC1\u4E66\u4E0E\u672A\u52A0\u5BC6\u79C1\u94A5\u5339\u914D\u3001\u8BC1\u4E66\u6709\u6548\u671F\u53CA\u57DF\u540D\uFF0C\u7136\u540E\u91CD\u65B0\u6253\u5305\u3002",
@@ -507,7 +502,9 @@ var zh_CN_default = {
   deploy_middlewareMethod: "\u8BF7\u8F93\u5165 POST \u6216 PUT\u3002",
   deploy_configResolutionFailed: "\u65E0\u6CD5\u89E3\u6790 {path}\u3002\u8BF7\u68C0\u67E5 {fields} \u5BF9\u5E94\u7684\u914D\u7F6E\u7ED3\u6784\u4E0E\u6570\u7EC4\u7D22\u5F15\u3002",
   deploy_reachEmptyProviderOverride: "\u89E3\u6790 {path} \u7684\u751F\u6548\u914D\u7F6E\u65F6\u53D1\u73B0 {field} \u6307\u5411\u4E0D\u5B58\u5728\u7684 Provider\u3002HAI_REACH_PROVIDERS \u5F53\u524D\u4E3A []\u3002\u8BF7\u5220\u9664\u65E7\u7684\u7D22\u5F15\u53D8\u91CF\uFF0C\u5E76\u5728 .env.<\u73AF\u5883>.local \u4E2D\u7528 HAI_REACH_PROVIDERS \u914D\u7F6E\u5B8C\u6574\u7684\u901A\u77E5 Provider \u5217\u8868\u3002",
-  deploy_s3Engine: "\u9009\u62E9\u81EA\u5EFA S3 \u670D\u52A1\u5B9E\u73B0"
+  deploy_s3Engine: "\u9009\u62E9\u81EA\u5EFA S3 \u670D\u52A1\u5B9E\u73B0",
+  deploy_downloadUnavailableTitle: "\u4E0B\u8F7D\u94FE\u63A5\u65E0\u6CD5\u8BBF\u95EE",
+  deploy_downloadUnavailableInstruction: "\u8BF7\u8FD4\u56DE\u4E0B\u8F7D\u9875\u9762\u91CD\u65B0\u83B7\u53D6\u94FE\u63A5\u3002\u82E5\u4ECD\u65E0\u6CD5\u4E0B\u8F7D\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u3002"
 };
 
 // src/deploy-i18n.ts
@@ -1457,7 +1454,26 @@ var deploy_config_shapes_default = {
             type: "string",
             format: "uri"
           },
+          multipart: {
+            default: {},
+            type: "object",
+            properties: {
+              partSizeBytes: {
+                default: 5242880,
+                type: "integer",
+                minimum: 5242880,
+                maximum: 5368709120
+              },
+              queueSize: {
+                default: 2,
+                type: "integer",
+                minimum: 1,
+                maximum: 9007199254740991
+              }
+            }
+          },
           operationLog: {
+            default: {},
             type: "object",
             properties: {
               read: {
@@ -1465,7 +1481,7 @@ var deploy_config_shapes_default = {
                 type: "boolean"
               },
               write: {
-                default: false,
+                default: true,
                 type: "boolean"
               },
               maxLength: {
@@ -1473,15 +1489,6 @@ var deploy_config_shapes_default = {
                 type: "integer",
                 minimum: 0,
                 maximum: 9007199254740991
-              },
-              level: {
-                default: "debug",
-                type: "string",
-                enum: [
-                  "info",
-                  "debug",
-                  "trace"
-                ]
               }
             }
           }
@@ -1514,6 +1521,7 @@ var deploy_config_shapes_default = {
             type: "number"
           },
           operationLog: {
+            default: {},
             type: "object",
             properties: {
               read: {
@@ -1521,7 +1529,7 @@ var deploy_config_shapes_default = {
                 type: "boolean"
               },
               write: {
-                default: false,
+                default: true,
                 type: "boolean"
               },
               maxLength: {
@@ -1529,15 +1537,6 @@ var deploy_config_shapes_default = {
                 type: "integer",
                 minimum: 0,
                 maximum: 9007199254740991
-              },
-              level: {
-                default: "debug",
-                type: "string",
-                enum: [
-                  "info",
-                  "debug",
-                  "trace"
-                ]
               }
             }
           }
@@ -6253,9 +6252,9 @@ function existingFile(path) {
     throw error;
   }
 }
-function writeLocalFile(path, content, privateFile2 = false) {
+function writeLocalFile(path, content, privateFile = false) {
   const previous = existingFile(path);
-  const mode = privateFile2 ? 384 : previous ? Number(previous.mode & 0o777n) : 420;
+  const mode = privateFile ? 384 : previous ? Number(previous.mode & 0o777n) : 420;
   const temporary = join(dirname(path), `.${basename(path)}.${randomUUID()}.tmp`);
   let fd;
   let owned;
@@ -6462,7 +6461,7 @@ function isSecret(name, value) {
 }
 function generatedVariables(values) {
   const generated = {};
-  const groups3 = /* @__PURE__ */ new Map();
+  const groups2 = /* @__PURE__ */ new Map();
   const structures = /* @__PURE__ */ new Set();
   for (const [name, value] of Object.entries(values)) {
     if (value === void 0)
@@ -6474,9 +6473,9 @@ function generatedVariables(values) {
     const module = /^HAI_([A-Z0-9]+)(?:_|$)/.exec(name)?.[1]?.toLowerCase();
     if (!module || !shapes[module])
       continue;
-    const group = groups3.get(module) ?? {};
+    const group = groups2.get(module) ?? {};
     group[name] = text;
-    groups3.set(module, group);
+    groups2.set(module, group);
     try {
       const parsed = JSON.parse(text);
       if (parsed !== null && typeof parsed === "object")
@@ -6484,7 +6483,7 @@ function generatedVariables(values) {
     } catch {
     }
   }
-  for (const [module, group] of groups3) {
+  for (const [module, group] of groups2) {
     const structuredNames = Object.keys(group).filter((name) => structures.has(name));
     if (!structuredNames.length)
       continue;
@@ -6531,7 +6530,7 @@ function generatedVariables(values) {
   }
   return generated;
 }
-function updateFile(path, values, privateFile2) {
+function updateFile(path, values, privateFile) {
   let content = existsSync(path) ? readLocalFile(path).toString("utf8") : "# Local private deployment configuration; do not commit.\n";
   for (const [name, value] of Object.entries(values)) {
     if (!/^[A-Z][A-Z0-9_]*$/.test(name))
@@ -6555,15 +6554,15 @@ ${line}
       content = withoutParent.slice(0, child.index) + parent[0].replace(/\r?\n?$/, "\n") + withoutParent.slice(child.index);
     }
   }
-  writeLocalFile(path, content, privateFile2);
+  writeLocalFile(path, content, privateFile);
 }
-function removeOverrides(path, names, privateFile2 = true) {
+function removeOverrides(path, names, privateFile = true) {
   if (!existsSync(path) || names.length === 0)
     return;
   let content = readLocalFile(path).toString("utf8");
   for (const name of names)
     content = content.replace(new RegExp(`^[\\t ]*(?:export[\\t ]+)?${name}[\\t ]*=[\\t ]*(?:'[^']*'|"(?:[^"\\\\]|\\\\.)*"|\`[^\`]*\`|[^\\r\\n]*)[^\\r\\n]*(?:\\r?\\n|$)`, "gm"), "");
-  writeLocalFile(path, content, privateFile2);
+  writeLocalFile(path, content, privateFile);
 }
 function saveDeploymentEnvironment(environment, values, options = {}) {
   try {
@@ -7126,47 +7125,6 @@ async function scanApp(inputDir, options) {
   }
 }
 
-// src/container/deploy-compose-identity.ts
-function createComposeContainerLookupScript() {
-  const labelFormat = [
-    "com.docker.compose.project",
-    "com.docker.compose.service",
-    "io.podman.compose.project",
-    "io.podman.compose.service"
-  ].map((key) => `{{index .Config.Labels \`${key}\`}}`).join("|");
-  return String.raw`compose_container_ids() (
-  if [ "$#" -ne 4 ]; then printf 'Compose container lookup requires runtime, project, service and selector.\n' >&2; exit 1; fi
-  lookup_runtime=$1
-  lookup_project=$2
-  lookup_service=$3
-  lookup_selector=$4
-  case "$lookup_runtime" in docker|podman) ;; *) printf 'Invalid Compose lookup runtime.\n' >&2; exit 1;; esac
-  case "$lookup_project" in ''|*[!A-Za-z0-9_.-]*) printf 'Invalid Compose project identity.\n' >&2; exit 1;; esac
-  case "$lookup_service" in ''|*[!A-Za-z0-9_.-]*) printf 'Invalid Compose service identity.\n' >&2; exit 1;; esac
-  case "$lookup_selector" in -q|-aq) ;; *) printf 'Invalid Compose container selector.\n' >&2; exit 1;; esac
-  lookup_ids=''
-  for lookup_namespace in com.docker.compose io.podman.compose; do
-    lookup_found=$("$lookup_runtime" ps "$lookup_selector" --filter "label=$lookup_namespace.project=$lookup_project" --filter "label=$lookup_namespace.service=$lookup_service") || { printf 'Cannot query Compose containers.\n' >&2; exit 1; }
-    printf '%s\n' "$lookup_found" | LC_ALL=C awk 'NF {if(NF!=1 || $0!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/) exit 1}' || { printf 'Invalid Compose container identifiers.\n' >&2; exit 1; }
-    lookup_ids=$(printf '%s\n%s\n' "$lookup_ids" "$lookup_found" | LC_ALL=C awk 'NF && !seen[$0]++ {print}') || exit 1
-  done
-  for lookup_id in $lookup_ids; do
-    lookup_labels=$("$lookup_runtime" inspect --format '${labelFormat}' "$lookup_id") || { printf 'Cannot inspect Compose container labels.\n' >&2; exit 1; }
-    printf '%s\n' "$lookup_labels" | LC_ALL=C awk -F'|' -v project="$lookup_project" -v service="$lookup_service" '
-      NR!=1 || NF!=4 {exit 1}
-      {
-        docker=($1!="" && $1!="<no value>") || ($2!="" && $2!="<no value>")
-        podman=($3!="" && $3!="<no value>") || ($4!="" && $4!="<no value>")
-        if((!docker && !podman) || (docker && ($1!=project || $2!=service)) || (podman && ($3!=project || $4!=service))) exit 1
-      }
-      END {if(NR!=1) exit 1}
-    ' || { printf 'Container labels do not confirm the requested Compose project and service.\n' >&2; exit 1; }
-  done
-  if [ -n "$lookup_ids" ]; then printf '%s\n' "$lookup_ids"; fi
-)
-`;
-}
-
 // src/container/deploy-json.ts
 function createDeploymentJsonTool() {
   return String.raw`function fail(message) {
@@ -7491,7 +7449,7 @@ deployment_metadata_init() {
 deployment_metadata_file() {
   metadata_directory=$1
   metadata_name=$2
-  case "$metadata_name" in layout|health-paths|image-list|dependencies|managed-project|managed-bindings|managed-volumes|managed-app-keys|unmanaged-app-keys|state-backends|storage-routing|web-base-path|node-runtime|proxy-service|https) ;; *) printf 'Unknown deployment metadata field.\n' >&2; return 1;; esac
+  case "$metadata_name" in layout|health-paths|image-list|dependencies|managed-bindings|managed-volumes|managed-app-keys|unmanaged-app-keys|state-backends|storage-routing|web-base-path|node-runtime|proxy-service|https) ;; *) printf 'Unknown deployment metadata field.\n' >&2; return 1;; esac
   test -f "$metadata_directory/manifest.json" && test ! -L "$metadata_directory/manifest.json" || return 1
   metadata_identity=$(printf '%s' "$metadata_directory" | sha256sum | awk '{print $1}')
   metadata_cached="$metadata_work/$metadata_identity-$metadata_name"
@@ -7588,8 +7546,6 @@ function createManagedSecretAssets(projectName, nativeEnvironment, compose) {
     }
   }
   return {
-    "managed-project": `hai-${projectName}
-`,
     "managed-candidates.env": candidates.length ? `${candidates.join("\n")}
 ` : "",
     "managed-bindings": bindings.size ? `${[...bindings].join("\n")}
@@ -7599,29 +7555,6 @@ function createManagedSecretAssets(projectName, nativeEnvironment, compose) {
     "resolve-managed-secrets.sh": createManagedSecretScript()
   };
 }
-function createManagedSecretValidationScript() {
-  return String.raw`valid_values() {
-  version=$(awk -F= '$1=="FORMAT_VERSION" {print $2}' "$1")
-  if [ "$version" = 2 ]; then
-    LC_ALL=C awk -F= '
-      NF {
-        if(NF!=2 || seen[$1]++) exit 1
-        if($1=="FORMAT_VERSION") {if($2!="2") exit 1; next}
-        if($1=="PROJECT") {if($2!~/^[A-Za-z0-9][A-Za-z0-9_.-]*$/) exit 1; project=1; next}
-        if($1~/^VOLUME_[0-9]+$/) {if($2!~/^(DB_PASSWORD|STORAGE_PASSWORD|LDAP_PASSWORD):[A-Za-z0-9][A-Za-z0-9_.-]*$/) exit 1; next}
-        if($1!~/^(DB_PASSWORD|STORAGE_PASSWORD|LDAP_PASSWORD)$/ || $2!~/^[0-9a-f]+$/ || length($2)%2 || length($2)>8192) exit 1
-        for(i=1;i<=length($2);i+=2) {b=substr($2,i,2); if(b~/^[01]/ || b=="7f") exit 1}
-      }
-      END {if(!project) exit 1}
-    ' "$1"
-    return
-  fi
-  LC_ALL=C awk -F= '
-    NF {if(NF!=2 || $1!~/^(DB_PASSWORD|STORAGE_PASSWORD|LDAP_PASSWORD)$/ || $2!~/^[A-Za-z0-9_-]+$/ || length($2)!=32 || seen[$1]++) exit 1}
-  ' "$1"
-}
-`;
-}
 function createManagedSecretScript() {
   return String.raw`#!/bin/sh
 # 由 apply.sh 在项目部署锁内调用；长期凭据只保存在服务器，不依赖打包机。
@@ -7636,12 +7569,15 @@ test -d "$root" && test ! -L "$root" && test -d "$release/.hai" && test ! -L "$r
 @@MANIFEST_FUNCTIONS@@
 deployment_metadata_init
 trap deployment_metadata_cleanup EXIT
-managed_project=$(deployment_metadata_file "$release" managed-project)
 managed_bindings=$(deployment_metadata_file "$release" managed-bindings)
 managed_volumes=$(deployment_metadata_file "$release" managed-volumes)
 test -s "$candidate_file" || exit 0
 fail() { printf '%s\n' "$*" >&2; exit 1; }
-@@MANAGED_VALUES_VALIDATOR@@
+valid_values() {
+  LC_ALL=C awk -F= '
+    NF {if(NF!=2 || $1!~/^(DB_PASSWORD|STORAGE_PASSWORD|LDAP_PASSWORD)$/ || $2!~/^[A-Za-z0-9_-]+$/ || length($2)!=32 || seen[$1]++) exit 1}
+  ' "$1"
+}
 value_of() { awk -F= -v key="$2" '$1==key {print $2}' "$1"; }
 test ! -L "$state" || fail "Invalid managed middleware credential state: $state"
 valid_values "$candidate_file" || fail 'Invalid managed middleware credential candidates; rebuild the deployment bundle.'
@@ -7652,22 +7588,6 @@ if [ -f "$state" ]; then
 else
   : > "$next"
 fi
-format=$(value_of "$next" FORMAT_VERSION)
-if [ "$format" = 2 ]; then
-  test "$(value_of "$next" PROJECT)" = "$(cat "$managed_project")" || fail 'Managed middleware credential project mismatch.'
-  known=$("$runtime" volume ls -q) || fail 'Cannot check persistent volumes; managed middleware credentials were not changed.'
-  while IFS=' ' read -r volume_group volume; do
-    test -n "$volume" || continue
-    binding="$volume_group:$volume"
-    if ! awk -F= -v binding="$binding" '$1~/^VOLUME_[0-9]+$/ && $2==binding {found=1} END {exit !found}' "$next"; then
-      if printf '%s\n' "$known" | grep -Fxq "$volume"; then
-        fail 'Existing persistent volume is not bound to the imported credential state. Import its verified identity first.'
-      fi
-      index=$(awk -F= '$1~/^VOLUME_[0-9]+$/ {n=substr($1,8)+0; if(n>max)max=n} END {print max+1}' "$next")
-      printf 'VOLUME_%s=%s\n' "$index" "$binding" >> "$next"
-    fi
-  done < "$managed_volumes"
-fi
 volumes_checked=false
 known_volumes=''
 while IFS='=' read -r name candidate; do
@@ -7684,64 +7604,24 @@ while IFS='=' read -r name candidate; do
         fail "Missing $name in $state for existing persistent volume $volume. Restore the server credential state before retrying."
       fi
     done < "$managed_volumes"
-    value=$candidate
-    if [ "$format" = 2 ]; then value=$(printf '%s' "$candidate" | od -An -tx1 | tr -d ' \n'); fi
-    printf '%s=%s\n' "$name" "$value" >> "$next"
+    printf '%s=%s\n' "$name" "$candidate" >> "$next"
   fi
 done < "$candidate_file"
 while IFS='=' read -r name candidate; do
   test -n "$name" || continue
   value=$(value_of "$next" "$name")
   for file in config/.env.runtime .hai/middleware-runtime.env; do
-    compose_environment=false
-    if [ "$file" = .hai/middleware-runtime.env ]; then compose_environment=true; fi
-    HAI_DEPLOY_SECRET_CANDIDATE="$candidate" HAI_DEPLOY_SECRET_VALUE="$value" LC_ALL=C awk -v group="$name" -v format="$format" -v compose_environment="$compose_environment" '
+    HAI_DEPLOY_SECRET_CANDIDATE="$candidate" HAI_DEPLOY_SECRET_VALUE="$value" LC_ALL=C awk -v group="$name" '
       FILENAME==ARGV[1] {if($1==group) {keys[$2]=$3}; next}
       function replace_literal(line, needle, value, result, at) {
         result=""
         while((at=index(line,needle))>0) {result=result substr(line,1,at-1) value; line=substr(line,at+length(needle))}
         return result line
       }
-      function decode_hex(hex, result, i, high, low) {
-        for(i=1;i<=length(hex);i+=2) {high=index("0123456789abcdef",substr(hex,i,1))-1; low=index("0123456789abcdef",substr(hex,i+1,1))-1; result=result sprintf("%c",high*16+low)}
-        return result
-      }
-      function json_escape(value, apostrophe, result, i, ch) {
-        for(i=1;i<=length(value);i++) {
-          ch=substr(value,i,1)
-          if(ch=="\\") result=result "\\\\"
-          else if(ch=="\"") result=result "\\\""
-          else if(ch==sprintf("%c",39) && apostrophe) result=result "\\u0027"
-          else result=result ch
-        }
-        return result
-      }
-      function uri_escape(value, result, i, ch, j, ordinal) {
-        for(i=1;i<=length(value);i++) {
-          ch=substr(value,i,1)
-          if(ch~/[A-Za-z0-9_.~-]/) result=result ch
-          else {ordinal=0; for(j=1;j<=255;j++) if(sprintf("%c",j)==ch) {ordinal=j; break}; result=result sprintf("%%%02X",ordinal)}
-        }
-        return result
-      }
       {
         equal=index($0,"="); key=substr($0,1,equal-1); scoped=0
         for(prefix in keys) if(key==prefix || (keys[prefix]=="prefix" && index(key,prefix "_")==1)) scoped=1
-        if(scoped && format==2 && index($0,ENVIRON["HAI_DEPLOY_SECRET_CANDIDATE"])>0) {
-          candidate=ENVIRON["HAI_DEPLOY_SECRET_CANDIDATE"]; value=decode_hex(ENVIRON["HAI_DEPLOY_SECRET_VALUE"])
-          literal=substr($0,equal+1); quote=sprintf("%c",39)
-          json=substr(literal,1,1)==quote && (substr(literal,2,1)=="{" || substr(literal,2,1)=="[")
-          if(json) literal=substr(literal,2,length(literal)-2)
-          literal=replace_literal(literal,":" candidate "@",":" uri_escape(value) "@")
-          if(json) {literal=replace_literal(literal,candidate,json_escape(value,1)); print key "=" quote literal quote}
-          else {
-            if(substr(literal,1,1)==quote || substr(literal,1,1)=="\"") literal=substr(literal,2,length(literal)-2)
-            literal=replace_literal(literal,candidate,value)
-            literal=json_escape(literal,0); if(compose_environment=="true") literal=replace_literal(literal,"$","$")
-            print key "=\"" literal "\""
-          }
-        }
-        else if(scoped) print replace_literal($0,ENVIRON["HAI_DEPLOY_SECRET_CANDIDATE"],ENVIRON["HAI_DEPLOY_SECRET_VALUE"])
+        if(scoped) print replace_literal($0,ENVIRON["HAI_DEPLOY_SECRET_CANDIDATE"],ENVIRON["HAI_DEPLOY_SECRET_VALUE"])
         else print
       }
     ' "$managed_bindings" "$release/$file" > "$release/$file.next"
@@ -7751,7 +7631,7 @@ done < "$candidate_file"
 chmod 600 "$next"
 mv "$next" "$state"
 printf '[INFO] Managed middleware credential source: %s (server state; values hidden).\n' "$state"
-`.replace("@@MANAGED_VALUES_VALIDATOR@@", () => createManagedSecretValidationScript()).replace("@@MANIFEST_FUNCTIONS@@", () => createDeploymentManifestFunctions());
+`.replace("@@MANIFEST_FUNCTIONS@@", () => createDeploymentManifestFunctions());
 }
 
 // src/container/deploy-backend-state.ts
@@ -7814,11 +7694,11 @@ backend_manifest=$(deployment_metadata_file "$release" state-backends)
 regular() { test -f "$1" && test ! -L "$1" || fail "Backend state must be a regular file: $1"; }
 absent_or_regular() { if [ -e "$1" ] || [ -L "$1" ]; then regular "$1"; fi; }
 valid_tuples() {
-  LC_ALL=C awk -v legacy="$2" '
+  LC_ALL=C awk '
     NF {
-      if((NF!=3 && !(legacy==1 && NF==2)) || roles[$1]++) exit 1
+      if(NF!=3 || roles[$1]++) exit 1
       if(!(($1=="db" && $2~/^(postgresql|mysql)$/) || ($1=="storage" && $2~/^(rustfs|minio)$/) || ($1=="vecdb" && $2~/^(qdrant|pgvector|chroma)$/))) exit 1
-      if(NF==3 && ($3!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/ || volumes[$3]++)) exit 1
+      if($3!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/ || volumes[$3]++) exit 1
     }
   ' "$1"
 }
@@ -7869,45 +7749,6 @@ known=$("$runtime" volume ls -q) || fail 'Cannot list persistent volumes; no bac
 printf '%s\n' "$known" | LC_ALL=C awk 'NF {if(NF!=1 || $1!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/ || seen[$1]++) exit 1}' || fail 'Invalid persistent volume listing.'
 exists_volume() { printf '%s\n' "$known" | grep -Fxq "$1"; }
 ledger_tuple() { printf '%s\n' "$ledger" | awk -v volume="$1" '$3==volume {print}'; }
-@@MANAGED_VALUES_VALIDATOR@@
-@@COMPOSE_CONTAINER_LOOKUP@@
-# 状态补证：卷挂载和镜像均取自同项目、同角色的唯一实际容器。
-container_binding() {
-  binding_service=$1
-  binding_family=$2
-  binding_expected=$3
-  binding_running=$4
-  binding_flags=-aq
-  if [ "$binding_running" = true ]; then binding_flags=-q; fi
-  binding_containers=$(compose_container_ids "$runtime" "$project" "$binding_service" "$binding_flags") || fail 'Cannot inspect successful deployment containers.'
-  printf '%s\n' "$binding_containers" | LC_ALL=C awk 'NR!=1 || NF!=1 || $1!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/ {exit 1} END {if(NR!=1) exit 1}' || fail "Cannot prove the previous volume binding for $binding_service. Restore verified backend state."
-  if [ "$binding_running" = true ]; then
-    binding_status=$("$runtime" inspect --format '{{.State.Running}}' "$binding_containers") || fail 'Cannot verify the imported service is running.'
-    test "$binding_status" = true || fail "Imported backend requires its verified original container to be running: $binding_service."
-  fi
-  binding_mounted=$("$runtime" inspect --format '{{range .Mounts}}{{if eq .Type "volume"}}{{println .Name}}{{end}}{{end}}' "$binding_containers") || fail 'Cannot inspect previous named volume mounts.'
-  printf '%s\n' "$binding_mounted" | LC_ALL=C awk 'NR!=1 || NF!=1 || $1!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/ {exit 1} END {if(NR!=1) exit 1}' || fail "Ambiguous previous volume binding for $binding_service."
-  binding_image=$("$runtime" inspect --format '{{.Config.Image}}' "$binding_containers") || fail 'Cannot identify the previous container image.'
-  binding_actual_family=$(printf '%s\n' "$binding_image" | LC_ALL=C awk 'NR!=1 || NF!=1 {exit 1} {image=$0; sub(/^.*\//,"",image); sub(/[:@].*$/,"",image); if(image=="postgres") image="postgresql"; print image}') || fail 'Invalid previous container image identity.'
-  test "$binding_actual_family" = "$binding_family" || fail "Actual previous container image does not confirm its backend family: $binding_service."
-  if [ -n "$binding_expected" ] && [ "$binding_expected" != "$binding_mounted" ]; then fail "Actual previous volume differs from its backend manifest: $binding_service."; fi
-  printf '%s\n' "$binding_mounted"
-}
-confirmed_import() {
-  import_service=$1
-  import_family=$2
-  import_volume=$3
-  import_state="$root/managed-secrets.env"
-  test -f "$import_state" && test ! -L "$import_state" || return 1
-  valid_values "$import_state" || return 1
-  test "$(awk -F= '$1=="FORMAT_VERSION" {print $2}' "$import_state")" = 2 || return 1
-  test "$(awk -F= '$1=="PROJECT" {print $2}' "$import_state")" = "$project" || return 1
-  case "$import_service" in db|vecdb) import_group=DB_PASSWORD;; storage) import_group=STORAGE_PASSWORD;; *) return 1;; esac
-  awk -F= -v group="$import_group" -v binding="$import_group:$import_volume" '$1==group && $2!="" {credential=1} $1~/^VOLUME_[0-9]+$/ && $2==binding {volume=1} END {exit !(credential && volume)}' "$import_state" || return 1
-  # 密码不证明目录格式；受控导入还须与唯一运行原容器的实际卷及镜像家族共同吻合。
-  import_actual=$(container_binding "$import_service" "$import_family" "$import_volume" true) || return 1
-  test "$import_actual" = "$import_volume"
-}
 snapshot_previous=$previous
 if [ -z "$snapshot_previous" ]; then snapshot_previous=-; fi
 if [ "$mode" = recover ]; then
@@ -7925,7 +7766,7 @@ RECOVERY_TUPLES
   exit 0
 fi
 regular "$backend_manifest"
-valid_tuples "$backend_manifest" 0 || fail 'Invalid backend manifest; rebuild the deployment bundle.'
+valid_tuples "$backend_manifest" || fail 'Invalid backend manifest; rebuild the deployment bundle.'
 active=''
 if [ -n "$previous" ]; then
   baseline="$root/releases/$previous"
@@ -7934,7 +7775,7 @@ if [ -n "$previous" ]; then
   baseline_services=$(deployment_services_file "$baseline")
   previous_manifest=$(deployment_metadata_file "$baseline" state-backends)
   regular "$previous_manifest"
-  valid_tuples "$previous_manifest" 0 || fail 'Invalid successful backend manifest.'
+  valid_tuples "$previous_manifest" || fail 'Invalid successful backend manifest.'
   LC_ALL=C awk 'NF {if(NF!=1 || $1!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/ || seen[$1]++) exit 1}' "$baseline_services" || fail 'Invalid successful deployment services.'
   for active_service in db storage vecdb; do
     if ! grep -Fxq "$active_service" "$baseline_services"; then continue; fi
@@ -7947,28 +7788,18 @@ if [ -n "$previous" ]; then
     printf '%s %s %s\n' "$active_service" "$active_family" "$active_volume" | LC_ALL=C awk 'NF!=3 || !(($1=="db" && $2~/^(postgresql|mysql)$/) || ($1=="storage" && $2~/^(rustfs|minio)$/) || ($1=="vecdb" && $2~/^(qdrant|pgvector|chroma)$/)) {exit 1}' || fail "Unknown installed backend for $active_service."
     exists_volume "$active_volume" || fail "Active persistent volume is missing: $active_volume. Restore its backup instead of creating an empty replacement."
     confirmed=$(ledger_tuple "$active_volume")
-    test -z "$confirmed" || test "$confirmed" = "$active_service $active_family $active_volume" || fail "Active persistent backend conflicts with the protected ledger: $active_service."
-    if [ -z "$confirmed" ]; then
-      proven_volume=$(container_binding "$active_service" "$active_family" "$active_volume" false)
-      test "$proven_volume" = "$active_volume" || fail "Cannot confirm the active persistent volume: $active_service."
-    fi
+    test "$confirmed" = "$active_service $active_family $active_volume" || fail "Active persistent backend is missing from or conflicts with the protected ledger: $active_service. Restore verified backend state."
     active=$(printf '%s\n%s %s %s\n' "$active" "$active_service" "$active_family" "$active_volume" | sed '/^$/d')
   done
 fi
-# 各个旧 Compose 片段不能把同一实际卷重复绑定给不同有状态角色。
-printf '%s\n' "$active" | valid_tuples /dev/stdin 0 || fail 'Conflicting successful persistent volume bindings.'
+# 同一实际卷不能绑定给多个有状态服务。
+printf '%s\n' "$active" | valid_tuples /dev/stdin || fail 'Conflicting successful persistent volume bindings.'
 # 合并时只替换同一卷的无数据预认领，不能按本次拓扑裁剪历史绑定。
 merged=$ledger
 merge_tuple() {
   merged=$(printf '%s\n' "$merged" | awk -v volume="$3" 'NF && $3!=volume {print}')
   merged=$(printf '%s\n%s %s %s\n' "$merged" "$1" "$2" "$3" | sed '/^$/d')
 }
-while IFS=' ' read -r active_service active_family active_volume; do
-  test -n "$active_service" || continue
-  merge_tuple "$active_service" "$active_family" "$active_volume"
-done <<ACTIVE_TUPLES
-$active
-ACTIVE_TUPLES
 while IFS=' ' read -r candidate_service candidate_family candidate_volume; do
   test -n "$candidate_service" || continue
   prior_active=$(printf '%s\n' "$active" | awk -v service="$candidate_service" '$1==service {print}')
@@ -7976,8 +7807,6 @@ while IFS=' ' read -r candidate_service candidate_family candidate_volume; do
   test -z "$prior_active" || test "$prior_active" = "$tuple" || fail "Persistent backend $candidate_service changed or its active volume binding changed. Use a separate deployment identity and migrate or restore data explicitly."
   if exists_volume "$candidate_volume"; then
     confirmed=$(ledger_tuple "$candidate_volume")
-    if [ -z "$confirmed" ]; then confirmed=$(printf '%s\n' "$active" | awk -v volume="$candidate_volume" '$3==volume {print}'); fi
-    if [ -z "$confirmed" ] && confirmed_import "$candidate_service" "$candidate_family" "$candidate_volume"; then confirmed=$tuple; fi
     test "$confirmed" = "$tuple" || fail "Existing persistent volume has an unknown or incompatible backend: $candidate_service. Restore verified backend state; in-place reuse is refused."
   else
     users=$("$runtime" ps -aq --filter "volume=$candidate_volume") || fail 'Cannot check persistent volume users.'
@@ -7997,7 +7826,7 @@ mv -f -- "$snapshot.next" "$snapshot"
 (set -C; printf '%s\n' "$state_content" > "$state.next") || fail 'Cannot stage the persistent backend ledger.'
 chmod 600 "$state.next"
 mv -f -- "$state.next" "$state"
-`.replace("@@PROJECT@@", () => projectName).replace("@@MANAGED_VALUES_VALIDATOR@@", () => createManagedSecretValidationScript()).replace("@@COMPOSE_CONTAINER_LOOKUP@@", () => createComposeContainerLookupScript()).replace("@@MANIFEST_FUNCTIONS@@", () => createDeploymentManifestFunctions());
+`.replace("@@PROJECT@@", () => projectName).replace("@@MANIFEST_FUNCTIONS@@", () => createDeploymentManifestFunctions());
 }
 var nativeJob = String.raw`
 using System;
@@ -8196,7 +8025,7 @@ async function groupExited(pid) {
 async function helper(command, args, timeoutMs) {
   if (timeoutMs <= 0)
     return false;
-  return new Promise((resolve9) => {
+  return new Promise((resolve8) => {
     const child = spawn(command, args, { windowsHide: true, shell: false, stdio: "ignore" });
     let settled = false;
     let timer;
@@ -8206,7 +8035,7 @@ async function helper(command, args, timeoutMs) {
       settled = true;
       if (timer)
         clearTimeout(timer);
-      resolve9(success);
+      resolve8(success);
     };
     timer = globalThis.setTimeout(() => {
       child.kill("SIGKILL");
@@ -8359,7 +8188,7 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
     ext: { commandExecution: state }
   });
   try {
-    return await new Promise((resolve9) => {
+    return await new Promise((resolve8) => {
       if (typeof command !== "string" || !command || command.includes("\0") || args.some((argument) => typeof argument !== "string" || argument.includes("\0")))
         throw new TypeError("Invalid command arguments");
       if (options.input !== void 0 && typeof options.input !== "string")
@@ -8402,7 +8231,7 @@ ${deployM(state.localTermination === "confirmed" ? "deploy_localStopped" : state
         settled = true;
         if (timer)
           clearTimeout(timer);
-        resolve9(result);
+        resolve8(result);
       };
       const interrupt = (reason, message) => {
         interrupted = true;
@@ -8589,6 +8418,47 @@ watch_certificate &
 `;
 }
 
+// src/container/deploy-compose-identity.ts
+function createComposeContainerLookupScript() {
+  const labelFormat = [
+    "com.docker.compose.project",
+    "com.docker.compose.service",
+    "io.podman.compose.project",
+    "io.podman.compose.service"
+  ].map((key) => `{{index .Config.Labels \`${key}\`}}`).join("|");
+  return String.raw`compose_container_ids() (
+  if [ "$#" -ne 4 ]; then printf 'Compose container lookup requires runtime, project, service and selector.\n' >&2; exit 1; fi
+  lookup_runtime=$1
+  lookup_project=$2
+  lookup_service=$3
+  lookup_selector=$4
+  case "$lookup_runtime" in docker|podman) ;; *) printf 'Invalid Compose lookup runtime.\n' >&2; exit 1;; esac
+  case "$lookup_project" in ''|*[!A-Za-z0-9_.-]*) printf 'Invalid Compose project identity.\n' >&2; exit 1;; esac
+  case "$lookup_service" in ''|*[!A-Za-z0-9_.-]*) printf 'Invalid Compose service identity.\n' >&2; exit 1;; esac
+  case "$lookup_selector" in -q|-aq) ;; *) printf 'Invalid Compose container selector.\n' >&2; exit 1;; esac
+  lookup_ids=''
+  for lookup_namespace in com.docker.compose io.podman.compose; do
+    lookup_found=$("$lookup_runtime" ps "$lookup_selector" --filter "label=$lookup_namespace.project=$lookup_project" --filter "label=$lookup_namespace.service=$lookup_service") || { printf 'Cannot query Compose containers.\n' >&2; exit 1; }
+    printf '%s\n' "$lookup_found" | LC_ALL=C awk 'NF {if(NF!=1 || $0!~/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/) exit 1}' || { printf 'Invalid Compose container identifiers.\n' >&2; exit 1; }
+    lookup_ids=$(printf '%s\n%s\n' "$lookup_ids" "$lookup_found" | LC_ALL=C awk 'NF && !seen[$0]++ {print}') || exit 1
+  done
+  for lookup_id in $lookup_ids; do
+    lookup_labels=$("$lookup_runtime" inspect --format '${labelFormat}' "$lookup_id") || { printf 'Cannot inspect Compose container labels.\n' >&2; exit 1; }
+    printf '%s\n' "$lookup_labels" | LC_ALL=C awk -F'|' -v project="$lookup_project" -v service="$lookup_service" '
+      NR!=1 || NF!=4 {exit 1}
+      {
+        docker=($1!="" && $1!="<no value>") || ($2!="" && $2!="<no value>")
+        podman=($3!="" && $3!="<no value>") || ($4!="" && $4!="<no value>")
+        if((!docker && !podman) || (docker && ($1!=project || $2!=service)) || (podman && ($3!=project || $4!=service))) exit 1
+      }
+      END {if(NR!=1) exit 1}
+    ' || { printf 'Container labels do not confirm the requested Compose project and service.\n' >&2; exit 1; }
+  done
+  if [ -n "$lookup_ids" ]; then printf '%s\n' "$lookup_ids"; fi
+)
+`;
+}
+
 // src/container/deploy-runtime-script.ts
 function createRuntimeConfigurationScript(primaryService) {
   return String.raw`configuration_mount() {
@@ -9248,7 +9118,7 @@ if [ "$partial" = true ]; then
       fi
       ;;
   esac
-  # 目录属于完整Web拓扑；旧版本缺省为根目录，服务增量不能意外丢失或改变既有目录。
+  # Web 挂载目录由完整拓扑确定，服务增量必须匹配已部署的目录。
   current_web_base=$(deployment_json read metadata.web-base-path string "$source_dir/manifest.json")
   previous_web_base=$(deployment_json read metadata.web-base-path string "$root/releases/$previous/manifest.json")
   test "$current_web_base" = "$previous_web_base" || { printf 'Web base path changed. Match the installed prefix for partial updates, or create a full deployment.\n' >&2; exit 1; }
@@ -10144,7 +10014,7 @@ async function createDeploymentBundle(options) {
     const metadata = {
       "layout": `${config.expose.hostPort}:${options.containerPort}:${options.hasWebConfig ? options.proxyService === "gateway" ? "gateway" : "true" : "false"}:${artifact.primaryService}:${options.hasWebConfig ? await artifactChecksum(join(directory, "web.conf")) : ""}${httpsFingerprint ? `:${httpsFingerprint}` : ""}
 `,
-      "web-base-path": `${artifact.webBasePath ?? ""}
+      "web-base-path": `${artifact.webBasePath}
 `,
       "health-paths": `${options.healthPaths.join("\n")}
 `,
@@ -10157,7 +10027,6 @@ async function createDeploymentBundle(options) {
       "node-runtime": String(nodeRuntime),
       "proxy-service": options.hasWebConfig ? options.proxyService ?? "web" : "",
       "https": options.httpsAssets?.https ?? "",
-      "managed-project": managed["managed-project"],
       // 未选应用时只带容器原生绑定，保持当前发布的应用连接归属。
       "managed-bindings": updatesApp ? managed["managed-bindings"] : managed["managed-bindings"].replace(/^.* prefix\n/gm, ""),
       "managed-volumes": managed["managed-volumes"],
@@ -10354,6 +10223,87 @@ async function copyArchive(source, destination) {
   await pipeline(createReadStream(source), digest, createWriteStream(destination, { mode: 384 }));
   return hash.digest("hex");
 }
+
+// src/container/deploy-download-error.ts
+var PAGE_STYLE = `
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    background: #f1f5f9;
+    color: #172033;
+    font-family: Inter, system-ui, "Microsoft YaHei", sans-serif;
+    line-height: 1.7;
+  }
+  main {
+    width: min(100%, 640px);
+    padding: clamp(24px, 6vw, 48px);
+    border: 1px solid #dbe3ee;
+    border-top: 4px solid #2563eb;
+    border-radius: 12px;
+    background: #fff;
+  }
+  h1 { margin: 0 0 16px; font-size: clamp(24px, 5vw, 32px); line-height: 1.4; }
+  p { margin: 0; color: #475569; font-size: 16px; }
+`;
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderPage() {
+  return `<!doctype html>
+<html lang="$hai_download_language">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="robots" content="noindex">
+  <meta name="referrer" content="no-referrer">
+  <link rel="icon" href="data:,">
+  <title>$hai_download_title</title>
+  <style>${PAGE_STYLE}</style>
+</head>
+<body><main><h1>$hai_download_title</h1><p>$hai_download_instruction</p></main></body>
+</html>`;
+}
+function renderDownloadErrorMaps() {
+  return `map "$request_method:$args" $hai_signed_download {
+  default 0;
+  "~*^(GET|HEAD):(?:[^&]*&)*X-Amz-Signature=[^&]+(?:&|$)" 1;
+}
+map $http_accept_language $hai_download_language {
+  default zh-CN;
+  ~*^en en-US;
+  ~*^ja ja-JP;
+}
+map $hai_download_language $hai_download_title {
+  default ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableTitle", { locale: "zh-CN" })))};
+  en-US ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableTitle", { locale: "en-US" })))};
+  ja-JP ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableTitle", { locale: "ja-JP" })))};
+}
+map $hai_download_language $hai_download_instruction {
+  default ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableInstruction", { locale: "zh-CN" })))};
+  en-US ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableInstruction", { locale: "en-US" })))};
+  ja-JP ${JSON.stringify(escapeHtml(deployM("deploy_downloadUnavailableInstruction", { locale: "ja-JP" })))};
+}
+`;
+}
+function renderDownloadErrorLocation() {
+  return `  location @hai_download_unavailable {
+    access_log off;
+    error_log /dev/null;
+    types { }
+    default_type text/html;
+    charset utf-8;
+    add_header Cache-Control "private, no-store" always;
+    add_header Referrer-Policy no-referrer always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
+    return 404 ${JSON.stringify(renderPage())};
+  }
+`;
+}
 var CERTBOT_IMAGE = "docker.io/certbot/certbot:v5.9.0";
 function createHttpsAssets(config, projectDirectory) {
   const assets = {
@@ -11088,6 +11038,7 @@ function generateWebProxyConfig(port, apiPrefix, options = {}) {
   }
 `).join("");
   return `include /tmp/hai-dns.conf;
+${renderDownloadErrorMaps()}
 ${renderResolvedUpstream("hai_serv_backend", "serv", port)}${options.storageBucket ? renderStorageUpstream(options.storageBucket, options.storageBasePath) : ""}server {
   listen ${webPort};
   server_name _;
@@ -11171,17 +11122,7 @@ function generateApplicationProxyConfig(options) {
   const bodyLimits = resolveTransportBodyLimits(maxPlaintextBytes);
   const trustedEdges = renderTrustedEdgeProxies(options.trustedEdgeProxies);
   const forwardedProtocol = options.trustedEdgeProxies?.length ? "$hai_request_scheme" : "$scheme";
-  return `include /tmp/hai-dns.conf;
-${renderResolvedUpstream("hai_application_backend", primaryService, port)}${renderTrustedEdgeProtocol(options.trustedEdgeProxies)}${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
-  listen 8080;
-  server_name _;
-${trustedEdges}  large_client_header_buffers 4 32k;
-${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath) : ""}  location = /_hai/gateway-health {
-    access_log off;
-    return 200 'ok';
-  }
-  location / {
-    client_max_body_size ${bodyLimits.encryptedPayloadBytes};
+  const proxySettings = `    client_max_body_size ${bodyLimits.encryptedPayloadBytes};
     proxy_pass http://hai_application_backend;
     proxy_http_version 1.1;
     proxy_set_header Host $http_host;
@@ -11195,7 +11136,29 @@ ${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath)
     proxy_request_buffering off;
     proxy_buffering off;
     proxy_buffer_size 32k;
-    proxy_buffers 8 32k;
+    proxy_buffers 8 32k;`;
+  return `include /tmp/hai-dns.conf;
+${renderDownloadErrorMaps()}
+${renderResolvedUpstream("hai_application_backend", primaryService, port)}${renderTrustedEdgeProtocol(options.trustedEdgeProxies)}${bucket ? renderStorageUpstream(bucket, options.storageBasePath) : ""}server {
+  listen 8080;
+  server_name _;
+${trustedEdges}  large_client_header_buffers 4 32k;
+${bucket ? renderStorageLocation(bucket, reservedPaths, options.storageBasePath) : ""}  location = /_hai/gateway-health {
+    access_log off;
+    return 200 'ok';
+  }
+${renderDownloadErrorLocation()}  location / {
+    recursive_error_pages on;
+    error_page 418 = @hai_download_proxy;
+    if ($hai_signed_download) { return 418; }
+${proxySettings}
+  }
+  location @hai_download_proxy {
+    access_log off;
+    error_log /dev/null;
+    proxy_intercept_errors on;
+    error_page 404 = @hai_download_unavailable;
+${proxySettings}
   }
 }
 `;
@@ -11234,24 +11197,35 @@ map "$hai_trusted_edge:$http_x_forwarded_proto" $hai_request_scheme {
 function renderWebLocation(webBasePath) {
   if (webBasePath && (!/^\/[\w.-]+(?:\/[\w.-]+)*$/.test(webBasePath) || webBasePath.split("/").some((segment) => segment === "." || segment === "..") || ["/health", "/_hai/web-health"].includes(webBasePath)))
     throw new Error("Invalid web base path");
-  return webBasePath ? `  absolute_redirect off;
+  const fallback = `${renderDownloadErrorLocation()}  location @hai_spa_fallback {
+    error_page 418 = @hai_download_unavailable;
+    if ($hai_signed_download) { return 418; }
+    try_files /index.html =404;
+  }
+`;
+  return fallback + (webBasePath ? `  absolute_redirect off;
   location = ${webBasePath} {
     return 308 ${webBasePath}/$is_args$args;
   }
   location ${webBasePath}/ {
     rewrite ^${webBasePath.replaceAll(".", "\\.").replaceAll("-", "\\-")}/(.*)$ /$1 break;
-    try_files $uri/index.html $uri /index.html =404;
+    try_files $uri/index.html $uri @hai_spa_fallback;
+  }
+  location / {
+    error_page 418 = @hai_download_unavailable;
+    if ($hai_signed_download) { return 418; }
+    return 404;
   }
-  location / { return 404; }
 ` : `  location / {
-    try_files $uri $uri/ /index.html;
+    try_files $uri $uri/ @hai_spa_fallback;
   }
-`;
+`);
 }
 function generateStaticWebConfig(port, webBasePath) {
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     throw new Error("Invalid web proxy target");
-  return `server {
+  return `${renderDownloadErrorMaps()}
+server {
   listen ${port};
   server_name _;
   root /usr/share/nginx/html;
@@ -11357,7 +11331,7 @@ function makeDeploymentId() {
   return `${core.time.formatDate(/* @__PURE__ */ new Date(), "YYYYMMDD-HHmmss")}-${randomBytes(3).toString("hex")}`;
 }
 function sleep(ms) {
-  return new Promise((resolve9) => setTimeout(resolve9, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 function createDockerSshProvider(config, container) {
   const ssh = config.ssh ? createSshExecutor(config.ssh) : void 0;
@@ -11389,16 +11363,16 @@ function createDockerSshProvider(config, container) {
     for (let attempt = 0; attempt < HEALTH_MAX_ATTEMPTS; attempt++) {
       try {
         if (certificate) {
-          const healthy = await new Promise((resolve9) => {
+          const healthy = await new Promise((resolve8) => {
             const request$1 = request(url, {
               ca: [...rootCertificates, certificate],
               timeout: 5e3
             }, (response) => {
               response.resume();
-              resolve9(response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300);
+              resolve8(response.statusCode !== void 0 && response.statusCode >= 200 && response.statusCode < 300);
             });
-            request$1.on("error", () => resolve9(false));
-            request$1.on("close", () => resolve9(false));
+            request$1.on("error", () => resolve8(false));
+            request$1.on("close", () => resolve8(false));
             request$1.on("timeout", () => request$1.destroy());
             request$1.end();
           });
@@ -11449,7 +11423,7 @@ function createDockerSshProvider(config, container) {
     const webContainerPort = web?.containerPort ?? artifact.webContainerPort ?? 8080;
     const host = config.ssh?.host;
     const url = https ? `https://${https.domain}${https.port === 443 ? "" : `:${https.port}`}` : host ? `http://${host.includes(":") ? `[${host}]` : host}:${hostPort}` : `http://SERVER_HOST:${hostPort}`;
-    const webBasePath = artifact.webBasePath ?? "";
+    const webBasePath = artifact.webBasePath;
     const applicationUrl = `${url}${webBasePath ? `${webBasePath}/` : ""}`;
     const standaloneWebConfig = primaryService === "web" && !scan.isSvelteKit && (!!webBasePath || !!https);
     const healthPaths = hasWebProxy ? ["/_hai/web-health", `${webBasePath}/`] : scan.isSvelteKit ? [`${webBasePath}/`] : primaryService === "serv" ? [] : standaloneWebConfig ? ["/health", `${webBasePath}/`] : ["/health"];
@@ -12042,7 +12016,7 @@ function createVercelProvider() {
         );
         token = apiToken;
         const username = user.user.username || user.user.email;
-        logger6.info("Vercel authenticated", { user: username });
+        logger6.info("Vercel authenticated");
         return ok(username);
       } catch (error) {
         logger6.error("Vercel authentication failed", { error });
@@ -12227,7 +12201,7 @@ async function pollDeploymentStatus(token, deploymentId) {
     if (deployment.readyState === "ERROR" || deployment.readyState === "CANCELED") {
       return "error";
     }
-    await new Promise((resolve9) => setTimeout(resolve9, POLL_INTERVAL));
+    await new Promise((resolve8) => setTimeout(resolve8, POLL_INTERVAL));
   }
   return "building";
 }
@@ -12252,7 +12226,7 @@ function createAliyunProvisioner() {
         accessKey = akId;
         secretKey = akSecret;
         signName = credentials.signName;
-        logger7.info("Aliyun authenticated", { accessKeyId: `${akId.slice(0, 6)}***` });
+        logger7.info("Aliyun authenticated");
         return ok(akId);
       } catch (error) {
         logger7.error("Aliyun authentication failed", { error });
@@ -12493,7 +12467,7 @@ function createR2Provisioner() {
         token = apiTok;
         accessKey = credentials.accessKeyId;
         secretKey = credentials.secretAccessKey;
-        logger9.info("Cloudflare R2 authenticated", { accountId: acctId });
+        logger9.info("Cloudflare R2 authenticated");
         return ok(acctId);
       } catch (error) {
         logger9.error("Cloudflare R2 authentication failed", { error });
@@ -12716,7 +12690,7 @@ function createUpstashProvisioner() {
         await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
         apiKey = userKey;
-        logger11.info("Upstash authenticated", { email: userEmail });
+        logger11.info("Upstash authenticated");
         return ok(userEmail);
       } catch (error) {
         logger11.error("Upstash authentication failed", { error });
@@ -12925,10 +12899,8 @@ var deploy = {
         } else {
           provider = createProviderByType(parsed.provider.type);
           const authResult = await provider.authenticate(parsed.provider.token);
-          if (!authResult.success) {
+          if (!authResult.success)
             return err(authResult.error);
-          }
-          logger12.info("Provider authenticated", { provider: parsed.provider.type, user: authResult.data });
         }
         currentProvisioners.clear();
         if (parsed.services) {
@@ -12942,14 +12914,16 @@ var deploy = {
             if (!provAuthResult.success) {
               logger12.error("Provisioner authentication failed", {
                 service: serviceType,
-                provisioner: serviceConfig.provisioner
+                provisioner: serviceConfig.provisioner,
+                errorCode: provAuthResult.error.code,
+                traceId: provAuthResult.error.traceId
               });
               currentProvisioners.clear();
               return err(provAuthResult.error);
             }
             logger12.info("Provisioner authenticated", {
               service: serviceType,
-              user: provAuthResult.data
+              provisioner: provisioner.name
             });
             currentProvisioners.set(serviceType, provisioner);
           }
@@ -13048,8 +13022,6 @@ var deploy = {
     if (!currentProvider && !currentContainerProvider) {
       return notInitialized.result();
     }
-    if (options && "projectName" in options && options.projectName !== void 0)
-      return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_projectNameOverrideRemoved"));
     logger12.info("Starting deployment", { appDir, environment: options?.environment });
     const scanOptions = { ...options, environment: options?.environment ?? currentConfig?.environment };
     const scanResult = await scanApp(appDir, scanOptions);
@@ -13783,8 +13755,6 @@ function describeMiddlewareBackend(backend) {
   return deployM(backend.purpose);
 }
 async function createDeploymentPlan(appDir, input, options = {}) {
-  if ("projectName" in options && options.projectName !== void 0)
-    return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_projectNameOverrideRemoved"));
   const parsed = DeployConfigSchema.safeParse(input);
   if (!parsed.success) {
     return err({
@@ -13985,389 +13955,7 @@ async function createDeploymentPlan(appDir, input, options = {}) {
     return err(HaiDeployError.CONFIG_ERROR, deployM("deploy_artifactInvalid"));
   }
 }
-var nameSchema = z.string().regex(/^[a-z0-9][\w.-]{0,127}$/i);
-var passwordSchema = z.string().min(1).max(1024).refine((value) => Buffer.from(value, "utf8").toString("utf8") === value && [...value].every((character) => character.codePointAt(0) >= 32 && character.codePointAt(0) !== 127));
-var importSchema = z.strictObject({
-  version: z.literal(1),
-  projectName: nameSchema,
-  credentials: z.strictObject({
-    DB_PASSWORD: passwordSchema.optional(),
-    STORAGE_PASSWORD: passwordSchema.optional(),
-    LDAP_PASSWORD: passwordSchema.optional()
-  }),
-  services: z.array(z.strictObject({
-    service: z.enum(["db", "vecdb", "storage", "ldap"]),
-    container: nameSchema,
-    kind: z.enum(["postgresql", "mysql", "s3", "ldap"]),
-    volumes: z.array(nameSchema).min(1).max(8),
-    username: z.string().min(1).max(128).default("hai"),
-    database: z.string().min(1).max(128).default("hai"),
-    bucket: z.string().regex(/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/).default("hai"),
-    accessKeyId: z.string().min(1).max(128).default("hai-storage"),
-    region: z.string().regex(/^[a-z0-9-]+$/).default("us-east-1"),
-    bindDn: z.string().min(1).max(512).default("cn=admin,dc=example,dc=org")
-  })).min(1).max(4)
-});
-var groups2 = {
-  db: "DB_PASSWORD",
-  vecdb: "DB_PASSWORD",
-  storage: "STORAGE_PASSWORD",
-  ldap: "LDAP_PASSWORD"
-};
-var importCommitScript = String.raw`(async()=>{const fs=require('node:fs'),path=require('node:path'),crypto=require('node:crypto');const root=process.argv[1];let temporary;
-try{process.stdout.write('LOCKED\n');let input='';for await(const chunk of process.stdin){input+=chunk;if(input.length>65536)throw Error()}
-if(!input)return;const {content}=JSON.parse(input);if(typeof content!=='string'||!content.startsWith('FORMAT_VERSION=2\n'))throw Error();
-const state=path.join(root,'managed-secrets.env');try{fs.lstatSync(state);throw Error('exists')}catch(error){if(error.code!=='ENOENT')throw error}
-temporary=path.join(root,'.managed-secrets-'+crypto.randomUUID()+'.next');const fd=fs.openSync(temporary,fs.constants.O_WRONLY|fs.constants.O_CREAT|fs.constants.O_EXCL|fs.constants.O_NOFOLLOW,0o600);
-try{fs.writeFileSync(fd,content);fs.fsyncSync(fd)}finally{fs.closeSync(fd)}fs.renameSync(temporary,state);temporary=undefined;
-const directory=fs.openSync(root,fs.constants.O_RDONLY);try{fs.fsyncSync(directory)}finally{fs.closeSync(directory)}process.stdout.write('COMMITTED\n');
-}catch{process.exitCode=1}finally{if(temporary)try{fs.unlinkSync(temporary)}catch{}}})()`;
-var s3VerificationScript = String.raw`(async()=>{try{
-const {createHash,createHmac}=require('node:crypto');let input='';for await(const chunk of process.stdin)input+=chunk;
-const {endpoint,bucket,accessKeyId,secret,region}=JSON.parse(input);const url=new URL('/'+encodeURIComponent(bucket),endpoint);
-const hash=value=>createHash('sha256').update(value).digest('hex');const hmac=(key,value)=>createHmac('sha256',key).update(value).digest();
-const date=new Date().toISOString().replace(/[:-]|\.\d{3}/g,'');const day=date.slice(0,8);const payload=hash('');
-const headers='host:'+url.host+'\nx-amz-content-sha256:'+payload+'\nx-amz-date:'+date+'\n';const signed='host;x-amz-content-sha256;x-amz-date';
-const scope=day+'/'+region+'/s3/aws4_request';const canonical=['HEAD',url.pathname,'',headers,signed,payload].join('\n');
-const key=hmac(hmac(hmac(hmac('AWS4'+secret,day),region),'s3'),'aws4_request');const signature=hmac(key,['AWS4-HMAC-SHA256',date,scope,hash(canonical)].join('\n')).toString('hex');
-const response=await fetch(url,{method:'HEAD',redirect:'manual',signal:AbortSignal.timeout(10000),headers:{'x-amz-date':date,'x-amz-content-sha256':payload,Authorization:'AWS4-HMAC-SHA256 Credential='+accessKeyId+'/'+scope+', SignedHeaders='+signed+', Signature='+signature}});
-await response.body?.cancel();if(response.ok)process.stdout.write('VERIFIED');else process.exitCode=1;
-}catch{process.exitCode=1}})()`;
-async function importDeploymentSecrets(options) {
-  let lock;
-  let commitAttempted = false;
-  let phase = "input";
-  try {
-    if (!["docker", "podman"].includes(options.runtime))
-      throw new Error("input");
-    const root = resolve(options.directory);
-    if (realpathSync(root) !== root || !lstatSync(root).isDirectory() || process.platform !== "win32" && lstatSync(root).mode & 18)
-      throw new Error("input");
-    const input = privateFile(resolve(options.inputFile));
-    const parsed = importSchema.safeParse(JSON.parse(input));
-    if (!parsed.success) {
-      return err({
-        ...HaiDeployError.CONFIG_ERROR,
-        message: deployM("deploy_secretImportFailed", {
-          params: { phase }
-        }),
-        ext: {
-          phase,
-          state: "unchanged",
-          fields: parsed.error.issues.map((issue) => issue.path.join("."))
-        }
-      });
-    }
-    const config = parsed.data;
-    const project = `hai-${config.projectName}`;
-    const selectedGroups = [
-      ...new Set(config.services.map((service) => groups2[service.service]))
-    ].sort();
-    if (new Set(config.services.map((service) => service.service)).size !== config.services.length || Object.keys(config.credentials).some((group) => !selectedGroups.includes(group)) || selectedGroups.some((group) => !config.credentials[group])) {
-      throw new Error("input");
-    }
-    const secrets = Object.values(config.credentials).filter((value) => typeof value === "string");
-    const stateFile = join(root, "managed-secrets.env");
-    const lockFile = join(root, ".deploy.lock");
-    phase = "lock";
-    if (options.dryRun === false) {
-      if (process.platform !== "linux")
-        throw new Error("lock");
-      if (existsSync(lockFile) && (lstatSync(lockFile).isSymbolicLink() || !lstatSync(lockFile).isFile() || lstatSync(lockFile).nlink !== 1))
-        throw new Error("lock");
-      lock = await acquireImportLock(lockFile, root);
-    }
-    phase = "identity";
-    const volumes = [];
-    for (const service of config.services) {
-      const kindValid = service.service === "storage" ? service.kind === "s3" : service.service === "ldap" ? service.kind === "ldap" : ["postgresql", "mysql"].includes(service.kind);
-      if (!kindValid)
-        throw new Error("identity");
-      if (["postgresql", "mysql"].includes(service.kind) && (service.username !== "hai" || service.database !== "hai") || service.kind === "s3" && (service.accessKeyId !== "hai-storage" || service.bucket !== "hai" || service.region !== "us-east-1") || service.kind === "ldap" && service.bindDn !== "cn=admin,dc=example,dc=org") {
-        throw new Error("identity");
-      }
-      const identity = await inspectContainer(options.runtime, service.container, secrets);
-      if (identity.project !== project || identity.service !== service.service || !identity.running)
-        throw new Error("identity");
-      for (const volume of service.volumes) {
-        if (!identity.volumes.includes(volume))
-          throw new Error("identity");
-        volumes.push({ group: groups2[service.service], name: volume });
-      }
-      phase = "verification";
-      const password = config.credentials[groups2[service.service]];
-      let verified = false;
-      if (service.kind === "s3") {
-        const helper2 = `hai-${config.projectName}-app`;
-        const application = await inspectContainer(options.runtime, helper2, secrets);
-        if (application.project !== project || application.service !== "app" || !application.running || !application.networks.some((network) => identity.networks.includes(network)))
-          throw new Error("identity");
-        const result = await runCommand(options.runtime, [
-          "exec",
-          "-i",
-          helper2,
-          "node",
-          "-e",
-          s3VerificationScript
-        ], {
-          input: JSON.stringify({
-            endpoint: `http://${service.container}:9000`,
-            bucket: service.bucket,
-            accessKeyId: service.accessKeyId,
-            secret: password,
-            region: service.region
-          }),
-          secrets,
-          timeoutMs: 15e3,
-          maxCaptureChars: 1024
-        });
-        verified = result.success && result.data.stdout.trim() === "VERIFIED";
-      } else {
-        const args = service.kind === "ldap" ? [
-          "exec",
-          "-i",
-          service.container,
-          "ldapwhoami",
-          "-x",
-          "-H",
-          "ldap://127.0.0.1:389",
-          "-D",
-          service.bindDn,
-          "-y",
-          "/dev/stdin"
-        ] : [
-          "exec",
-          "-i",
-          service.container,
-          "sh",
-          "-c",
-          service.kind === "postgresql" ? 'IFS= read -r PGPASSWORD; export PGPASSWORD; exec psql --no-psqlrc -h "$3" -U "$1" -d "dbname=$2 require_auth=scram-sha-256,md5,password" -Atc "SELECT 1"' : 'IFS= read -r MYSQL_PWD; export MYSQL_PWD; exec mysql -h 127.0.0.1 -u "$1" "$2" -Nse "SELECT 1"',
-          "hai-secret-check",
-          service.username,
-          service.database,
-          service.container
-        ];
-        const result = await runCommand(options.runtime, args, {
-          input: service.kind === "ldap" ? password : `${password}
-`,
-          secrets,
-          timeoutMs: 15e3,
-          maxCaptureChars: 1024
-        });
-        verified = result.success && !result.data.stdoutTruncated && (service.kind === "ldap" ? result.data.stdout.trim().startsWith("dn:") : result.data.stdout.trim() === "1");
-        if (verified && service.kind === "mysql") {
-          const rootCheck = await runCommand(options.runtime, [
-            ...args.slice(0, -3),
-            "root",
-            service.database,
-            service.container
-          ], {
-            input: `${password}
-`,
-            secrets,
-            timeoutMs: 15e3,
-            maxCaptureChars: 1024
-          });
-          verified = rootCheck.success && !rootCheck.data.stdoutTruncated && rootCheck.data.stdout.trim() === "1";
-          const invalidPassword = `hai-import-invalid-${randomUUID()}`;
-          for (const username of [service.username, "root"]) {
-            if (!verified)
-              break;
-            const negative = await runCommand(options.runtime, [
-              ...args.slice(0, -3),
-              username,
-              service.database,
-              service.container
-            ], {
-              input: `${invalidPassword}
-`,
-              secrets: [...secrets, invalidPassword],
-              timeoutMs: 15e3,
-              maxCaptureChars: 1024
-            });
-            verified = !negative.success && /ERROR 1045 \(28000\)/.test(negative.error.message);
-          }
-        }
-      }
-      if (!verified)
-        throw new Error("verification");
-      phase = "identity";
-    }
-    phase = "state";
-    const uniqueVolumes = [
-      ...new Map(volumes.map((volume) => [`${volume.group}:${volume.name}`, volume])).values()
-    ].sort((a, b) => `${a.group}:${a.name}`.localeCompare(`${b.group}:${b.name}`));
-    const lines = [
-      "FORMAT_VERSION=2",
-      `PROJECT=${project}`,
-      ...selectedGroups.map((group) => `${group}=${Buffer.from(config.credentials[group], "utf8").toString("hex")}`),
-      ...uniqueVolumes.map((volume, index) => `VOLUME_${index + 1}=${volume.group}:${volume.name}`)
-    ];
-    let changed = false;
-    if (existsSync(stateFile) || isSymbolicLink(stateFile)) {
-      const existing = readImportedState(privateFile(stateFile));
-      if (existing.FORMAT_VERSION !== "2" || existing.PROJECT !== project || selectedGroups.some((group) => existing[group] !== Buffer.from(config.credentials[group], "utf8").toString("hex")) || uniqueVolumes.some((volume) => !Object.entries(existing).some(([key, value]) => /^VOLUME_\d+$/.test(key) && value === `${volume.group}:${volume.name}`)))
-        throw new Error("state");
-    } else if (options.dryRun === false) {
-      commitAttempted = true;
-      if (!lock || !await lock.commit(`${lines.join("\n")}
-`))
-        throw new Error("lock");
-      changed = true;
-    }
-    return ok({
-      projectName: config.projectName,
-      stateVersion: 2,
-      groups: selectedGroups,
-      volumes: uniqueVolumes.map((volume) => volume.name),
-      changed
-    });
-  } catch {
-    return err({
-      ...HaiDeployError.CONFIG_ERROR,
-      message: deployM("deploy_secretImportFailed", {
-        params: { phase }
-      }),
-      ext: {
-        phase,
-        state: commitAttempted ? "unknown" : "unchanged"
-      }
-    });
-  } finally {
-    await lock?.release();
-  }
-}
-function readImportedState(text) {
-  const result = {};
-  for (const line of text.trimEnd().split("\n")) {
-    const match = /^(FORMAT_VERSION|PROJECT|DB_PASSWORD|STORAGE_PASSWORD|LDAP_PASSWORD|VOLUME_[1-9]\d*)=([^=]+)$/.exec(line);
-    if (!match || Object.hasOwn(result, match[1]))
-      throw new Error("state");
-    const key = match[1];
-    const value = match[2];
-    if (key.endsWith("_PASSWORD")) {
-      if (!/^(?:[a-f0-9]{2})+$/.test(value))
-        throw new Error("state");
-      const decoded = Buffer.from(value, "hex").toString("utf8");
-      if (!passwordSchema.safeParse(decoded).success || Buffer.from(decoded, "utf8").toString("hex") !== value)
-        throw new Error("state");
-    } else if (key.startsWith("VOLUME_") && !/^(?:DB_PASSWORD|STORAGE_PASSWORD|LDAP_PASSWORD):[a-zA-Z0-9][\w.-]*$/.test(value)) {
-      throw new Error("state");
-    }
-    result[key] = value;
-  }
-  if (result.FORMAT_VERSION !== "2" || !nameSchema.safeParse(result.PROJECT).success)
-    throw new Error("state");
-  return result;
-}
-function isSymbolicLink(path) {
-  try {
-    return lstatSync(path).isSymbolicLink();
-  } catch {
-    return false;
-  }
-}
-function privateFile(path) {
-  return readLocalFile(path, { maxBytes: 65536, private: true }).toString("utf8");
-}
-async function inspectContainer(runtime, container, secrets) {
-  const result = await runCommand(runtime, [
-    "inspect",
-    "--format",
-    "{{json .Config.Labels}}\n{{json .Mounts}}\n{{json .State.Running}}\n{{json .NetworkSettings.Networks}}",
-    container
-  ], { secrets, timeoutMs: 1e4, maxCaptureChars: 32768 });
-  if (!result.success || result.data.stdoutTruncated)
-    throw new Error("identity");
-  const [labelsText, mountsText, runningText, networksText] = result.data.stdout.trim().split("\n");
-  const labels = z.record(z.string(), z.string()).parse(JSON.parse(labelsText));
-  const mounts = z.array(z.object({
-    Type: z.string(),
-    Name: z.string().optional()
-  })).parse(JSON.parse(mountsText));
-  const networks = z.record(z.string(), z.object({
-    NetworkID: z.string()
-  })).parse(JSON.parse(networksText) ?? {});
-  const dockerProject = labels["com.docker.compose.project"] || void 0;
-  const podmanProject = labels["io.podman.compose.project"] || void 0;
-  const dockerService = labels["com.docker.compose.service"] || void 0;
-  const podmanService = labels["io.podman.compose.service"] || void 0;
-  if (Boolean(dockerProject) !== Boolean(dockerService) || Boolean(podmanProject) !== Boolean(podmanService) || dockerProject && podmanProject && dockerProject !== podmanProject || dockerService && podmanService && dockerService !== podmanService) {
-    throw new Error("identity");
-  }
-  return {
-    project: dockerProject ?? podmanProject,
-    service: dockerService ?? podmanService,
-    running: runningText === "true",
-    volumes: mounts.flatMap((mount) => mount.Type === "volume" && mount.Name ? [mount.Name] : []),
-    networks: Object.values(networks).map((network) => network.NetworkID)
-  };
-}
-async function acquireImportLock(path, root) {
-  return new Promise((resolveLock, reject) => {
-    const child = spawn("flock", [
-      "-n",
-      path,
-      process.execPath,
-      "-e",
-      importCommitScript,
-      root
-    ], {
-      stdio: ["pipe", "pipe", "ignore"],
-      windowsHide: true
-    });
-    let acquired = false;
-    let exited = false;
-    let output = "";
-    const finished = new Promise((done) => child.once("close", () => {
-      exited = true;
-      done();
-    }));
-    child.stdin.on("error", () => {
-    });
-    const timer = setTimeout(() => {
-      child.stdin.end();
-      child.kill();
-      reject(new Error("lock"));
-    }, 5e3);
-    child.once("error", () => {
-      clearTimeout(timer);
-      reject(new Error("lock"));
-    });
-    child.once("exit", () => {
-      if (!acquired) {
-        clearTimeout(timer);
-        reject(new Error("lock"));
-      }
-    });
-    child.stdout.on("data", (data) => {
-      output += data.toString();
-      if (acquired || !output.includes("\n"))
-        return;
-      if (!output.startsWith("LOCKED\n") || exited) {
-        child.stdin.end();
-        reject(new Error("lock"));
-        return;
-      }
-      acquired = true;
-      clearTimeout(timer);
-      resolveLock({
-        commit: async (content) => {
-          if (exited)
-            return false;
-          child.stdin.end(JSON.stringify({ content }));
-          await finished;
-          return child.exitCode === 0 && output === "LOCKED\nCOMMITTED\n";
-        },
-        release: async () => {
-          child.stdin.end();
-          await finished;
-        }
-      });
-    });
-  });
-}
 
-export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, canKeepMiddleware, createDeploymentPlan, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, importDeploymentSecrets, loadDeploymentConfig, loadDeploymentEnvironment, mergeEnvironmentLayers, normalizeProjectName, parseMiddlewareField, readDeploymentArtifact, resolveDownloadProxy, resolveImageReference, saveDeploymentEnvironment, saveMiddlewareEnvironment, validateMiddlewareField };
+export { DEPLOY_MIDDLEWARE, DeployConfigSchema, DeploymentArtifactSchema, HaiDeployError, ProviderConfigSchema, artifactChecksum, canKeepMiddleware, createDeploymentPlan, deploy, describeMiddlewareBackend, getDeployCommandState, getDeployRecovery, loadDeploymentConfig, loadDeploymentEnvironment, mergeEnvironmentLayers, normalizeProjectName, parseMiddlewareField, readDeploymentArtifact, resolveDownloadProxy, resolveImageReference, saveDeploymentEnvironment, saveMiddlewareEnvironment, validateMiddlewareField };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map