@insforge/cli 0.1.57 → 0.1.60

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { join as join12, dirname } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
@@ -41,8 +41,8 @@ var LineReader = class {
     this.output.write(prompt);
     if (this.queue.length > 0) return this.queue.shift();
     if (this.closed) return null;
-    return new Promise((resolve4) => {
-      this.waiter = resolve4;
+    return new Promise((resolve5) => {
+      this.waiter = resolve5;
     });
   }
   close() {
@@ -411,8 +411,8 @@ function startCallbackServer() {
   return new Promise((resolveServer) => {
     let resolveResult;
     let rejectResult;
-    const resultPromise = new Promise((resolve4, reject) => {
-      resolveResult = resolve4;
+    const resultPromise = new Promise((resolve5, reject) => {
+      resolveResult = resolve5;
       rejectResult = reject;
     });
     const server = createServer((req, res) => {
@@ -539,6 +539,9 @@ To sign in, open this URL in your browser:
 
 // src/lib/credentials.ts
 import * as clack3 from "@clack/prompts";
+function isPatLogin(creds) {
+  return creds?.refresh_token?.startsWith("uak_") ?? false;
+}
 async function requireAuth(apiUrl, allowOssBypass = true) {
   const projConfig = getProjectConfig();
   if (allowOssBypass && projConfig?.project_id === FAKE_PROJECT_ID) {
@@ -556,6 +559,10 @@ async function requireAuth(apiUrl, allowOssBypass = true) {
   }
   const creds = getCredentials();
   if (creds && creds.access_token) return creds;
+  if (isPatLogin(creds)) {
+    await refreshAccessToken(apiUrl);
+    return getCredentials();
+  }
   clack3.log.info("You need to log in to continue.");
   for (; ; ) {
     try {
@@ -573,10 +580,43 @@ async function requireAuth(apiUrl, allowOssBypass = true) {
 }
 async function refreshAccessToken(apiUrl) {
   const creds = getCredentials();
-  if (!creds?.refresh_token) {
-    throw new AuthError("Refresh token not found. Run `npx @insforge/cli login` again.");
+  if (!creds) {
+    throw new AuthError("Not logged in. Run `npx @insforge/cli login` first.");
   }
   const platformUrl = getPlatformApiUrl(apiUrl);
+  if (isPatLogin(creds)) {
+    let res;
+    try {
+      res = await fetch(`${platformUrl}/auth/v1/exchange-api-key`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ apiKey: creds.refresh_token })
+      });
+    } catch {
+      throw new AuthError(
+        `Unable to reach auth server at ${platformUrl}. Check your network connection.`
+      );
+    }
+    if (!res.ok) {
+      if (res.status === 401 || res.status === 403 || res.status === 404) {
+        throw new AuthError(
+          "API key is invalid or revoked. Run `npx @insforge/cli login --user-api-key <new-key>` again."
+        );
+      }
+      throw new AuthError(
+        `Auth server returned HTTP ${res.status} while refreshing session. Please retry shortly.`
+      );
+    }
+    const data = await res.json().catch(() => ({}));
+    if (typeof data.token !== "string" || data.token.length === 0) {
+      throw new AuthError("Exchange endpoint returned an invalid response (missing token).");
+    }
+    saveCredentials({ ...creds, access_token: data.token });
+    return data.token;
+  }
+  if (!creds.refresh_token) {
+    throw new AuthError("Refresh token not found. Run `npx @insforge/cli login` again.");
+  }
   const config = getGlobalConfig();
   const clientId = config.oauth_client_id ?? DEFAULT_CLIENT_ID;
   try {
@@ -708,7 +748,7 @@ async function reportAgentConnected(payload, apiUrl) {
   await fetch(`${baseUrl}/tracking/v1/agent-connected`, {
     method: "POST",
     headers,
-    body: JSON.stringify(payload)
+    body: JSON.stringify({ ...payload, client: "cli" })
   });
 }
 async function streamDiagnosticAnalysis(payload, onEvent, apiUrl) {
@@ -774,10 +814,12 @@ async function createProject(orgId, name, region, apiUrl) {
 
 // src/commands/login.ts
 function registerLoginCommand(program2) {
-  program2.command("login").description("Authenticate with InsForge platform").option("--email", "Login with email and password instead of browser").option("--client-id <id>", "OAuth client ID (defaults to insforge-cli)").action(async (opts, cmd) => {
+  program2.command("login").description("Authenticate with InsForge platform").option("--email", "Login with email and password instead of browser").option("--client-id <id>", "OAuth client ID (defaults to insforge-cli)").option("--user-api-key <key>", "Authenticate with a uak_ personal access token").action(async (opts, cmd) => {
     const { json, apiUrl } = getRootOpts(cmd);
     try {
-      if (opts.email) {
+      if (opts.userApiKey) {
+        await loginWithUserApiKey(opts.userApiKey, json, apiUrl);
+      } else if (opts.email) {
         await loginWithEmail(json, apiUrl);
       } else {
         await loginWithOAuth(json, apiUrl);
@@ -846,6 +888,78 @@ async function loginWithOAuth(json, apiUrl) {
     console.log(JSON.stringify({ success: true, user: creds.user }));
   }
 }
+async function loginWithUserApiKey(key, json, apiUrl) {
+  if (!json) {
+    clack4.intro("InsForge CLI");
+  }
+  if (!key.startsWith("uak_")) {
+    throw new CLIError('Invalid API key \u2014 must start with "uak_".');
+  }
+  const s = !json ? clack4.spinner() : null;
+  s?.start("Verifying API key...");
+  let jwt;
+  let user;
+  try {
+    const exchanged = await exchangePatForJwt(key, apiUrl);
+    jwt = exchanged.token;
+    user = exchanged.user;
+  } catch (err) {
+    s?.stop("API key verification failed");
+    throw err instanceof CLIError ? err : new CLIError(err instanceof Error ? err.message : String(err));
+  }
+  saveCredentials({
+    access_token: jwt,
+    refresh_token: key,
+    user
+  });
+  if (!json) {
+    s?.stop(`Authenticated as ${user.email}`);
+    clack4.outro("Done");
+  } else {
+    console.log(JSON.stringify({ success: true, user }));
+  }
+}
+async function exchangePatForJwt(apiKey, apiUrl) {
+  const baseUrl = getPlatformApiUrl(apiUrl);
+  const fullUrl = `${baseUrl}/auth/v1/exchange-api-key`;
+  let res;
+  try {
+    res = await fetch(fullUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ apiKey })
+    });
+  } catch (err) {
+    throw new CLIError(formatFetchError(err, fullUrl));
+  }
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    const msg = body.message ?? body.error ?? `HTTP ${res.status}`;
+    throw new CLIError(`API key is invalid or revoked: ${msg}`);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (typeof data.token !== "string" || data.token.length === 0) {
+    throw new CLIError("Exchange endpoint returned an invalid response (missing token).");
+  }
+  const jwt = data.token;
+  let profileRes;
+  try {
+    profileRes = await fetch(`${baseUrl}/auth/v1/profile`, {
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  } catch (err) {
+    throw new CLIError(formatFetchError(err, `${baseUrl}/auth/v1/profile`));
+  }
+  if (!profileRes.ok) {
+    throw new CLIError(`Exchange succeeded but could not fetch profile: HTTP ${profileRes.status}`);
+  }
+  const profile = await profileRes.json().catch(() => null);
+  const user = profile && typeof profile === "object" && "user" in profile ? profile.user : profile ?? void 0;
+  if (!user) {
+    throw new CLIError("Exchange succeeded but profile response was empty");
+  }
+  return { token: jwt, user };
+}
 
 // src/lib/output.ts
 import Table from "cli-table3";
@@ -1208,10 +1322,11 @@ async function ossFetch(path5, options = {}) {
       message += `
 ${err.nextActions}`;
     }
-    if (res.status === 404 && path5.startsWith("/api/compute")) {
+    const isRouteLevel404 = !err.error || err.error === "NOT_FOUND";
+    if (res.status === 404 && isRouteLevel404 && path5.startsWith("/api/compute")) {
       message = "Compute services are not available on this backend.\nSelf-hosted: upgrade your InsForge instance. Cloud: contact your InsForge admin to enable compute.";
     }
-    if (res.status === 404 && path5 === "/api/database/migrations") {
+    if (res.status === 404 && isRouteLevel404 && path5 === "/api/database/migrations") {
       message = "Database migrations are not available on this backend.\nSelf-hosted: upgrade your InsForge instance. Cloud: contact your InsForge admin about database migration support.";
     }
     throw new CLIError(message);
@@ -1351,11 +1466,11 @@ async function collectDeploymentFiles(sourceDir) {
   return files;
 }
 async function createZipBuffer(sourceDir) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const archive = archiver("zip", { zlib: { level: 9 } });
     const chunks = [];
     archive.on("data", (chunk) => chunks.push(chunk));
-    archive.on("end", () => resolve4(Buffer.concat(chunks)));
+    archive.on("end", () => resolve5(Buffer.concat(chunks)));
     archive.on("error", (err) => reject(err));
     archive.directory(sourceDir, false, (entry) => {
       if (shouldExclude(entry.name)) return false;
@@ -1437,7 +1552,7 @@ async function pollDeployment(deploymentId, spinner7, syncBeforeRead) {
   const startTime = Date.now();
   let deployment = null;
   while (Date.now() - startTime < POLL_TIMEOUT_MS) {
-    await new Promise((resolve4) => setTimeout(resolve4, POLL_INTERVAL_MS));
+    await new Promise((resolve5) => setTimeout(resolve5, POLL_INTERVAL_MS));
     try {
       if (syncBeforeRead) {
         await ossFetch(`/api/deployments/${deploymentId}/sync`, { method: "POST" });
@@ -2754,13 +2869,17 @@ import { join as join8 } from "path";
 // src/lib/migrations.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync } from "fs";
 import { join as join7 } from "path";
-var MIGRATION_VERSION_REGEX = /^\d{14}$/u;
-var MIGRATION_FILENAME_REGEX = /^(\d{14})_([a-z0-9-]+)\.sql$/u;
+var MIGRATION_VERSION_REGEX = /^\d{1,64}$/u;
+var MIGRATION_FILENAME_REGEX = /^(\d{1,64})_([a-z0-9-]+)\.sql$/u;
 function assertValidMigrationVersion(version) {
   if (!MIGRATION_VERSION_REGEX.test(version)) {
-    throw new CLIError(`Invalid migration version: ${version}. Expected YYYYMMDDHHmmss.`);
+    throw new CLIError(`Invalid migration version: ${version}. Expected a numeric string of at most 64 digits (e.g. 0001 or 20260418091500).`);
   }
 }
+function canonicalMigrationVersion(version) {
+  assertValidMigrationVersion(version);
+  return BigInt(version).toString();
+}
 function parseMigrationFilename(filename) {
   const match = MIGRATION_FILENAME_REGEX.exec(filename);
   if (!match) {
@@ -2768,11 +2887,16 @@ function parseMigrationFilename(filename) {
   }
   return {
     filename,
-    version: match[1],
+    version: canonicalMigrationVersion(match[1]),
     name: match[2]
   };
 }
 function compareMigrationVersions(left, right) {
+  if (MIGRATION_VERSION_REGEX.test(left) && MIGRATION_VERSION_REGEX.test(right)) {
+    const a = BigInt(left);
+    const b = BigInt(right);
+    return a < b ? -1 : a > b ? 1 : 0;
+  }
   return left.localeCompare(right);
 }
 function getRemoteMigrationVersionStatus(version, appliedVersions, latestRemoteVersion) {
@@ -2794,6 +2918,10 @@ function formatMigrationVersion(date) {
   return `${year}${month}${day}${hour}${minute}${second}`;
 }
 function incrementMigrationVersion(version) {
+  assertValidMigrationVersion(version);
+  if (!/^\d{14}$/u.test(version)) {
+    return String(BigInt(version) + 1n);
+  }
   const year = Number(version.slice(0, 4));
   const month = Number(version.slice(4, 6)) - 1;
   const day = Number(version.slice(6, 8));
@@ -2876,8 +3004,9 @@ function findOlderThanHeadLocalMigrations(migrations, appliedVersions, latestRem
   );
 }
 function findLocalMigrationByVersion(version, filenames) {
+  const canonicalVersion = canonicalMigrationVersion(version);
   const matches = filenames.map((filename) => parseMigrationFilename(filename)).filter(
-    (migration) => migration !== null && migration.version === version
+    (migration) => migration !== null && migration.version === canonicalVersion
   );
   if (matches.length === 0) {
     throw new CLIError(`Local migration for version ${version} not found.`);
@@ -2890,7 +3019,7 @@ function findLocalMigrationByVersion(version, filenames) {
   return matches[0];
 }
 function resolveMigrationTarget(target, filenames) {
-  if (/^\d{14}$/u.test(target)) {
+  if (/^\d{1,64}$/u.test(target)) {
     return findLocalMigrationByVersion(target, filenames);
   }
   const parsedTarget = parseMigrationFilename(target);
@@ -2929,7 +3058,7 @@ async function fetchRemoteMigrations() {
   const raw = await res.json();
   const migrations = Array.isArray(raw.migrations) ? raw.migrations : [];
   for (const migration of migrations) {
-    assertValidMigrationVersion(migration.version);
+    migration.version = canonicalMigrationVersion(migration.version);
   }
   return migrations;
 }
@@ -2989,6 +3118,9 @@ function registerDbMigrationsCommand(dbCmd2) {
       await requireAuth();
       const migrations = await fetchRemoteMigrations();
       const migrationsDir = ensureMigrationsDir();
+      const existingLocalVersions = new Set(
+        listLocalMigrationFilenames().map((filename) => parseMigrationFilename(filename)).filter((migration) => migration !== null).map((migration) => migration.version)
+      );
       const createdFiles = [];
       const skippedFiles = [];
       for (const migration of [...migrations].sort(
@@ -3000,12 +3132,13 @@ function registerDbMigrationsCommand(dbCmd2) {
           migration.name
         );
         const filePath = join8(migrationsDir, filename);
-        if (existsSync4(filePath)) {
+        if (existingLocalVersions.has(migration.version) || existsSync4(filePath)) {
           skippedFiles.push(filename);
           continue;
         }
         writeFileSync3(filePath, formatMigrationSql(migration.statements));
         createdFiles.push(filename);
+        existingLocalVersions.add(migration.version);
       }
       if (json) {
         outputJson({
@@ -4330,7 +4463,10 @@ function registerSchedulesGetCommand(schedulesCmd2) {
 
 // src/commands/schedules/create.ts
 function registerSchedulesCreateCommand(schedulesCmd2) {
-  schedulesCmd2.command("create").description("Create a new schedule").requiredOption("--name <name>", "Schedule name").requiredOption("--cron <expression>", "Cron expression (5-field format)").requiredOption("--url <url>", "URL to invoke").requiredOption("--method <method>", "HTTP method (GET, POST, PUT, PATCH, DELETE)").option("--headers <json>", "HTTP headers as JSON").option("--body <json>", "Request body as JSON").action(async (opts, cmd) => {
+  schedulesCmd2.command("create").description("Create a new schedule").requiredOption("--name <name>", "Schedule name").requiredOption(
+    "--cron <expression>",
+    'Cron expression. 5-field cron (e.g. "*/5 * * * *", "0 9 * * 1-5") or pg_cron interval syntax for sub-minute cadence (e.g. "30 seconds", "5 minutes").'
+  ).requiredOption("--url <url>", "URL to invoke").requiredOption("--method <method>", "HTTP method (GET, POST, PUT, PATCH, DELETE)").option("--headers <json>", "HTTP headers as JSON").option("--body <json>", "Request body as JSON").action(async (opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
       await requireAuth();
@@ -4374,7 +4510,10 @@ function registerSchedulesCreateCommand(schedulesCmd2) {
 
 // src/commands/schedules/update.ts
 function registerSchedulesUpdateCommand(schedulesCmd2) {
-  schedulesCmd2.command("update <id>").description("Update a schedule").option("--name <name>", "New schedule name").option("--cron <expression>", "New cron expression").option("--url <url>", "New URL to invoke").option("--method <method>", "New HTTP method").option("--headers <json>", "New HTTP headers as JSON").option("--body <json>", "New request body as JSON").option("--active <bool>", "Enable/disable schedule (true/false)").action(async (id, opts, cmd) => {
+  schedulesCmd2.command("update <id>").description("Update a schedule").option("--name <name>", "New schedule name").option(
+    "--cron <expression>",
+    'New cron expression. 5-field cron or pg_cron interval syntax (e.g. "30 seconds").'
+  ).option("--url <url>", "New URL to invoke").option("--method <method>", "New HTTP method").option("--headers <json>", "New HTTP headers as JSON").option("--body <json>", "New request body as JSON").option("--active <bool>", "Enable/disable schedule (true/false)").action(async (id, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
       await requireAuth();
@@ -4550,48 +4689,6 @@ function registerComputeGetCommand(computeCmd2) {
   });
 }
 
-// src/commands/compute/create.ts
-function registerComputeCreateCommand(computeCmd2) {
-  computeCmd2.command("create").description("Create and deploy a compute service").requiredOption("--name <name>", "Service name (DNS-safe, e.g. my-api)").requiredOption("--image <image>", "Docker image URL (e.g. nginx:alpine)").option("--port <port>", "Container port", "8080").option("--cpu <tier>", "CPU tier (shared-1x, shared-2x, performance-1x, performance-2x, performance-4x)", "shared-1x").option("--memory <mb>", "Memory in MB (256, 512, 1024, 2048, 4096, 8192)", "512").option("--region <region>", "Fly.io region", "iad").option("--env <json>", "Environment variables as JSON object").action(async (opts, cmd) => {
-    const { json } = getRootOpts(cmd);
-    try {
-      await requireAuth();
-      const body = {
-        name: opts.name,
-        imageUrl: opts.image,
-        port: Number(opts.port),
-        cpu: opts.cpu,
-        memory: Number(opts.memory),
-        region: opts.region
-      };
-      if (opts.env) {
-        try {
-          body.envVars = JSON.parse(opts.env);
-        } catch {
-          throw new CLIError("Invalid JSON for --env");
-        }
-      }
-      const res = await ossFetch("/api/compute/services", {
-        method: "POST",
-        body: JSON.stringify(body)
-      });
-      const service = await res.json();
-      if (json) {
-        outputJson(service);
-      } else {
-        outputSuccess(`Service "${service.name}" created [${service.status}]`);
-        if (service.endpointUrl) {
-          console.log(`  Endpoint: ${service.endpointUrl}`);
-        }
-      }
-      await reportCliUsage("cli.compute.create", true);
-    } catch (err) {
-      await reportCliUsage("cli.compute.create", false);
-      handleError(err, json);
-    }
-  });
-}
-
 // src/commands/compute/update.ts
 function registerComputeUpdateCommand(computeCmd2) {
   computeCmd2.command("update <id>").description("Update a compute service").option("--image <image>", "Docker image URL").option("--port <port>", "Container port").option("--cpu <tier>", "CPU tier").option("--memory <mb>", "Memory in MB").option("--region <region>", "Fly.io region").option("--env <json>", "Environment variables as JSON object").action(async (id, opts, cmd) => {
@@ -4747,175 +4844,237 @@ function registerComputeLogsCommand(computeCmd2) {
 }
 
 // src/commands/compute/deploy.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync5, unlinkSync as unlinkSync2, renameSync } from "fs";
-import { join as join11 } from "path";
-import { execSync, spawn } from "child_process";
-function parseFlyToml(dir) {
-  const tomlPath = join11(dir, "fly.toml");
-  if (!existsSync7(tomlPath)) return {};
-  const content = readFileSync7(tomlPath, "utf-8");
-  const config = {};
-  const portMatch = content.match(/internal_port\s*=\s*(\d+)/);
-  if (portMatch) config.internalPort = Number(portMatch[1]);
-  const regionMatch = content.match(/primary_region\s*=\s*'([^']+)'/);
-  if (regionMatch) config.region = regionMatch[1];
-  const memoryMatch = content.match(/memory\s*=\s*'(\d+)/);
-  if (memoryMatch) config.memory = memoryMatch[1];
-  const cpuKindMatch = content.match(/cpu_kind\s*=\s*'([^']+)'/);
-  if (cpuKindMatch) config.cpuKind = cpuKindMatch[1];
-  const cpusMatch = content.match(/cpus\s*=\s*(\d+)/);
-  if (cpusMatch) config.cpus = Number(cpusMatch[1]);
-  return config;
-}
-function memoryToCpuTier(cpuKind, cpus) {
-  if (!cpuKind) return void 0;
-  const kind = cpuKind === "performance" ? "performance" : "shared";
-  const count = cpus ?? 1;
-  return `${kind}-${count}x`;
-}
-function generateFlyToml(appName, opts) {
-  const cpuParts = opts.cpu.split("-");
-  const cpuKind = cpuParts[0] ?? "shared";
-  const cpuCount = parseInt(cpuParts[1] ?? "1", 10);
-  return `# Auto-generated by InsForge CLI
-app = '${appName}'
-primary_region = '${opts.region}'
-
-[build]
-  dockerfile = 'Dockerfile'
+import { existsSync as existsSync7 } from "fs";
+import { join as join11, resolve as resolve4 } from "path";
 
-[http_service]
-  internal_port = ${opts.port}
-  force_https = true
-  auto_stop_machines = 'stop'
-  auto_start_machines = true
-  min_machines_running = 0
-
-[[vm]]
-  memory = '${opts.memory}mb'
-  cpu_kind = '${cpuKind}'
-  cpus = ${cpuCount}
-`;
-}
-function checkFlyctl() {
-  try {
-    execSync("flyctl version", { stdio: "pipe" });
-  } catch {
+// src/lib/flyctl.ts
+import { spawn, spawnSync } from "child_process";
+function ensureFlyctlAvailable() {
+  const r = spawnSync("flyctl", ["version"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (r.error || r.status !== 0) {
     throw new CLIError(
-      "flyctl is not installed.\nInstall it with: curl -L https://fly.io/install.sh | sh\nOr: brew install flyctl"
+      "flyctl is required for source-mode deploy.\n  \u2022 Install: curl -L https://fly.io/install.sh | sh\n  \u2022 Or use --image <pre-built-image> instead.\n" + (r.stderr ? `  Detail: ${r.stderr.trim().slice(0, 200)}` : "")
     );
   }
 }
-function getFlyToken() {
-  const token = process.env.FLY_API_TOKEN;
-  if (!token) {
-    throw new CLIError(
-      "FLY_API_TOKEN environment variable is required for compute deploy.\nSet it with: export FLY_API_TOKEN=<your-fly-token>"
+function flyctlBuildAndPush(opts) {
+  return new Promise((resolve5, reject) => {
+    const child = spawn(
+      "flyctl",
+      [
+        "deploy",
+        "--remote-only",
+        "--build-only",
+        "--push",
+        "--app",
+        opts.appId,
+        "--image-label",
+        opts.imageLabel,
+        "--no-cache"
+      ],
+      {
+        cwd: opts.dir,
+        env: { ...process.env, FLY_API_TOKEN: opts.token },
+        stdio: ["inherit", "pipe", "pipe"]
+      }
     );
-  }
-  return token;
+    let captured = "";
+    child.stdout?.on("data", (b) => {
+      const s = b.toString();
+      captured += s;
+      process.stdout.write(s);
+    });
+    child.stderr?.on("data", (b) => {
+      const s = b.toString();
+      captured += s;
+      process.stderr.write(s);
+    });
+    child.on("error", (err) => {
+      reject(new CLIError(`flyctl deploy could not start: ${err.message}`));
+    });
+    child.on("exit", (code) => {
+      if (code !== 0) {
+        return reject(
+          new CLIError(`flyctl deploy --build-only failed (exit ${code}). See output above.`)
+        );
+      }
+      const m = captured.match(/pushing manifest for registry\.fly\.io\/[^\s]+@(sha256:[0-9a-f]+)/);
+      if (!m) {
+        return reject(
+          new CLIError(
+            'flyctl deploy succeeded but the buildkit "pushing manifest" line was not found. Cannot determine image digest \u2014 please re-run with FLY_LOG_LEVEL=debug and report.'
+          )
+        );
+      }
+      resolve5({ imageRef: `registry.fly.io/${opts.appId}@${m[1]}` });
+    });
+  });
 }
+
+// src/commands/compute/deploy.ts
 function registerComputeDeployCommand(computeCmd2) {
-  computeCmd2.command("deploy [directory]").description("Build and deploy a Dockerfile as a compute service").requiredOption("--name <name>", "Service name").option("--port <port>", "Container port").option("--cpu <tier>", "CPU tier (shared-1x, shared-2x, performance-1x, etc.)").option("--memory <mb>", "Memory in MB (256, 512, 1024, 2048, 4096, 8192)").option("--region <region>", "Fly.io region").option("--env <json>", "Environment variables as JSON object").action(async (directory, opts, cmd) => {
+  computeCmd2.command("deploy [dir]").description(
+    "Deploy a compute service. Two modes:\n  compute deploy <dir> --name <name>             (source mode \u2014 flyctl remote build + push, requires flyctl on PATH; no Docker needed)\n  compute deploy --image <url> --name <name>     (image mode \u2014 deploys pre-built image, no flyctl/Docker required)"
+  ).requiredOption("--name <name>", "Service name (DNS-safe, e.g. my-api)").option("--image <url>", "Pre-built image URL (image mode)").option("--port <port>", "Container port", "8080").option(
+    "--cpu <tier>",
+    "CPU tier in <kind>-<N>x format (e.g. shared-1x, performance-2x)",
+    "shared-1x"
+  ).option("--memory <mb>", "Memory in MB", "512").option("--region <region>", "Fly.io region", "iad").option("--env <json>", "Env vars as JSON object").action(async (dir, opts, cmd) => {
     const { json } = getRootOpts(cmd);
     try {
       await requireAuth();
-      checkFlyctl();
-      const flyToken = getFlyToken();
-      const dir = directory ?? process.cwd();
-      const dockerfilePath = join11(dir, "Dockerfile");
-      if (!existsSync7(dockerfilePath)) {
-        throw new CLIError(`No Dockerfile found in ${dir}`);
+      if (dir && opts.image) {
+        throw new CLIError("Cannot use both [dir] and --image \u2014 pick one mode.");
+      }
+      if (!dir && !opts.image) {
+        throw new CLIError(
+          "Must provide either [dir] (source mode) or --image <url> (image mode)."
+        );
+      }
+      const port = Number(opts.port);
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new CLIError(`Invalid --port: ${opts.port}`);
+      }
+      const memory = Number(opts.memory);
+      if (!Number.isInteger(memory) || memory <= 0) {
+        throw new CLIError(`Invalid --memory: ${opts.memory}`);
       }
-      const flyTomlDefaults = parseFlyToml(dir);
-      const port = Number(opts.port) || flyTomlDefaults.internalPort || 8080;
-      const cpu = opts.cpu || memoryToCpuTier(flyTomlDefaults.cpuKind, flyTomlDefaults.cpus) || "shared-1x";
-      const memory = Number(opts.memory) || Number(flyTomlDefaults.memory) || 512;
-      const region = opts.region || flyTomlDefaults.region || "iad";
       let envVars;
       if (opts.env) {
+        let parsed;
         try {
-          envVars = JSON.parse(opts.env);
+          parsed = JSON.parse(opts.env);
         } catch {
           throw new CLIError("Invalid JSON for --env");
         }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+          throw new CLIError('--env must be a JSON object like {"KEY":"value"}');
+        }
+        for (const [k, v] of Object.entries(parsed)) {
+          if (typeof v !== "string") {
+            throw new CLIError(
+              `--env values must be strings \u2014 got ${typeof v} for key "${k}"`
+            );
+          }
+        }
+        envVars = parsed;
       }
-      if (!json) outputInfo(`Checking for existing service "${opts.name}"...`);
+      const baseBody = {
+        name: opts.name,
+        port,
+        cpu: opts.cpu,
+        memory,
+        region: opts.region
+      };
+      if (envVars) baseBody.envVars = envVars;
+      if (!dir) {
+        const body = { ...baseBody, imageUrl: opts.image };
+        const listRes2 = await ossFetch("/api/compute/services");
+        const existing2 = (await listRes2.json()).find(
+          (s) => s.name === opts.name
+        );
+        let res;
+        if (existing2) {
+          if (!json) outputInfo(`Found existing service "${opts.name}", updating...`);
+          const updateBody2 = { ...body };
+          delete updateBody2.name;
+          res = await ossFetch(`/api/compute/services/${encodeURIComponent(existing2.id)}`, {
+            method: "PATCH",
+            body: JSON.stringify(updateBody2)
+          });
+        } else {
+          res = await ossFetch("/api/compute/services", {
+            method: "POST",
+            body: JSON.stringify(body)
+          });
+        }
+        const service2 = await res.json();
+        if (json) {
+          outputJson(service2);
+        } else {
+          const verb = existing2 ? "updated" : "deployed";
+          outputSuccess(`Service "${service2.name}" ${verb} [${service2.status}]`);
+          if (service2.endpointUrl) console.log(`  Endpoint: ${service2.endpointUrl}`);
+        }
+        await reportCliUsage("cli.compute.deploy", true);
+        return;
+      }
+      const absDir = resolve4(dir);
+      const dockerfilePath = join11(absDir, "Dockerfile");
+      if (!existsSync7(dockerfilePath)) {
+        throw new CLIError(
+          `No Dockerfile at ${dockerfilePath}.
+  Either:
+   \u2022 Create one (ask your AI agent \u2014 see the insforge-cli skill)
+   \u2022 Use --image <url> to deploy a pre-built image instead`
+        );
+      }
+      ensureFlyctlAvailable();
+      if (!json) outputInfo(`Detected Dockerfile at ${dockerfilePath}`);
       const listRes = await ossFetch("/api/compute/services");
-      const services = await listRes.json();
-      const existing = services.find((s) => s.name === opts.name);
+      const existing = (await listRes.json()).find((s) => s.name === opts.name);
       let serviceId;
       let flyAppId;
       if (existing) {
+        if (!existing.flyAppId) {
+          throw new CLIError(
+            `Service "${opts.name}" exists but has no Fly app yet. Delete it and redeploy.`
+          );
+        }
         serviceId = existing.id;
         flyAppId = existing.flyAppId;
-        if (!json) outputInfo(`Found existing service, redeploying...`);
+        if (!json) outputInfo(`Found existing service "${opts.name}" (${flyAppId}), updating...`);
       } else {
         if (!json) outputInfo(`Creating service "${opts.name}"...`);
-        const body = {
-          name: opts.name,
-          imageUrl: "dockerfile",
-          port,
-          cpu,
-          memory,
-          region
-        };
-        if (envVars) body.envVars = envVars;
-        const deployRes = await ossFetch("/api/compute/services/deploy", {
+        const prepareRes = await ossFetch("/api/compute/services/deploy", {
           method: "POST",
-          body: JSON.stringify(body)
-        });
-        const service = await deployRes.json();
-        serviceId = service.id;
-        flyAppId = service.flyAppId;
-      }
-      const existingTomlPath = join11(dir, "fly.toml");
-      const backupTomlPath = join11(dir, "fly.toml.insforge-backup");
-      let hadExistingToml = false;
-      if (existsSync7(existingTomlPath)) {
-        hadExistingToml = true;
-        renameSync(existingTomlPath, backupTomlPath);
-      }
-      const tomlContent = generateFlyToml(flyAppId, { port, memory, cpu, region });
-      writeFileSync5(existingTomlPath, tomlContent);
-      try {
-        if (!json) outputInfo("Building and deploying (this may take a few minutes)...");
-        await new Promise((resolve4, reject) => {
-          const child = spawn(
-            "flyctl",
-            ["deploy", "--remote-only", "--app", flyAppId, "--access-token", flyToken, "--yes"],
-            { cwd: dir, stdio: json ? "pipe" : "inherit" }
-          );
-          child.on("close", (code) => {
-            if (code === 0) resolve4();
-            else reject(new CLIError(`flyctl deploy failed with exit code ${code}`));
-          });
-          child.on("error", (err) => reject(new CLIError(`flyctl deploy error: ${err.message}`)));
+          body: JSON.stringify(baseBody)
         });
-        if (!json) outputInfo("Syncing deployment info...");
-        const syncRes = await ossFetch(
-          `/api/compute/services/${encodeURIComponent(serviceId)}/sync`,
-          { method: "PATCH" }
-        );
-        const synced = await syncRes.json();
-        if (json) {
-          outputJson(synced);
-        } else {
-          outputSuccess(`Service "${synced.name}" deployed [${synced.status}]`);
-          if (synced.endpointUrl) {
-            console.log(`  Endpoint: ${synced.endpointUrl}`);
-          }
-        }
-        await reportCliUsage("cli.compute.deploy", true);
-      } finally {
-        try {
-          unlinkSync2(existingTomlPath);
-          if (hadExistingToml) {
-            renameSync(backupTomlPath, existingTomlPath);
-          }
-        } catch {
-        }
+        const prepared = await prepareRes.json();
+        serviceId = prepared.id;
+        flyAppId = prepared.flyAppId;
+        if (!json) outputInfo(`Created Fly app ${flyAppId}`);
+      }
+      if (!json) outputInfo("Requesting deploy token...");
+      const tokenRes = await ossFetch(
+        `/api/compute/services/${encodeURIComponent(serviceId)}/deploy-token`,
+        { method: "POST" }
+      );
+      const tokenJson = await tokenRes.json();
+      const imageLabel = `cli-${Date.now()}`;
+      if (!json) outputInfo(`Building & pushing on Fly remote builder...`);
+      const { imageRef } = await flyctlBuildAndPush({
+        dir: absDir,
+        appId: flyAppId,
+        imageLabel,
+        token: tokenJson.token
+      });
+      if (!json) outputInfo("Launching machine...");
+      const updateBody = {
+        imageUrl: imageRef,
+        port,
+        cpu: opts.cpu,
+        memory,
+        region: opts.region
+      };
+      if (envVars) updateBody.envVars = envVars;
+      const finalRes = await ossFetch(
+        `/api/compute/services/${encodeURIComponent(serviceId)}`,
+        { method: "PATCH", body: JSON.stringify(updateBody) }
+      );
+      const service = await finalRes.json();
+      if (json) {
+        outputJson(service);
+      } else {
+        const verb = existing ? "updated" : "deployed";
+        outputSuccess(`Service "${service.name}" ${verb} [${service.status}]`);
+        if (service.endpointUrl) console.log(`  Endpoint: ${service.endpointUrl}`);
+        console.log(`  Image: ${imageRef} (built remotely; no local image to clean up)`);
       }
+      await reportCliUsage("cli.compute.deploy", true);
     } catch (err) {
       await reportCliUsage("cli.compute.deploy", false);
       handleError(err, json);
@@ -5602,7 +5761,7 @@ function registerDiagnoseCommands(diagnoseCmd2) {
         const s = !json ? clack10.spinner() : null;
         s?.start("Collecting diagnostic data...");
         const data2 = await collectDiagnosticData(projectId, ossMode, apiUrl);
-        const cliVersion = "0.1.57";
+        const cliVersion = "0.1.60";
         s?.stop("Data collected");
         if (!json) {
           console.log(`
@@ -5831,7 +5990,7 @@ function formatBytesCompact(bytes) {
 
 // src/index.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync8(join12(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync7(join12(__dirname, "../package.json"), "utf-8"));
 var INSFORGE_LOGO = `
 \u2588\u2588\u2557\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557
 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D
@@ -5903,7 +6062,6 @@ registerDiagnoseCommands(diagnoseCmd);
 var computeCmd = program.command("compute").description("Manage compute services (Docker containers on Fly.io)");
 registerComputeListCommand(computeCmd);
 registerComputeGetCommand(computeCmd);
-registerComputeCreateCommand(computeCmd);
 registerComputeDeployCommand(computeCmd);
 registerComputeUpdateCommand(computeCmd);
 registerComputeDeleteCommand(computeCmd);