@lead-routing/cli 0.3.0 → 0.4.1

package/dist/index.js

@@ -5,10 +5,10 @@ import { Command } from "commander";
 
 // src/commands/init.ts
 import { promises as dns } from "dns";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
-import { intro, outro, note as note4, log as log9, confirm as confirm2, cancel as cancel3, isCancel as isCancel4, password as promptPassword } from "@clack/prompts";
-import chalk2 from "chalk";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+import { intro, outro, note as note3, log as log7, confirm, cancel as cancel3, isCancel as isCancel3, password as promptPassword } from "@clack/prompts";
+import chalk from "chalk";
 
 // src/steps/prerequisites.ts
 import { log } from "@clack/prompts";
@@ -111,7 +111,7 @@ function bail2(value) {
 }
 async function collectConfig(opts = {}) {
   note2(
-    "You will need:\n  \u2022 A Salesforce Connected App (Client ID + Secret) \u2014 instructions below\n  \u2022 Public HTTPS URLs for the web app and routing engine",
+    "You will need:\n  \u2022 Public HTTPS URLs for the web app and routing engine",
     "Before you begin"
   );
   const appUrl = await text2({
@@ -142,33 +142,6 @@ async function collectConfig(opts = {}) {
     }
   });
   if (isCancel2(engineUrl)) bail2(engineUrl);
-  const callbackUrl = `${appUrl.trim().replace(/\/+$/, "")}/api/auth/sfdc/callback`;
-  note2(
-    `You need a Salesforce Connected App. If you haven't created one yet:
-
-  1. Go to Salesforce Setup \u2192 App Manager \u2192 New Connected App
-  2. Connected App Name: Lead Routing
-  3. Check "Enable OAuth Settings"
-  4. Callback URL (copy exactly \u2014 must match):
-       ${callbackUrl}
-  5. Selected Scopes: api  \u2022  refresh_token, offline_access
-  6. Check "Require Secret for Web Server Flow"
-  7. Save \u2014 wait ~2 min, then click "Manage Consumer Details"
-  8. Copy the Consumer Key (Client ID) and Consumer Secret below`,
-    "Salesforce Connected App setup"
-  );
-  const sfdcClientId = await text2({
-    message: 'Consumer Key (labelled "Client ID" in newer orgs)',
-    placeholder: "3MVG9...",
-    validate: (v) => !v ? "Required" : void 0
-  });
-  if (isCancel2(sfdcClientId)) bail2(sfdcClientId);
-  const sfdcClientSecret = await password2({
-    message: 'Consumer Secret (labelled "Client Secret" in newer orgs)',
-    validate: (v) => !v ? "Required" : void 0
-  });
-  if (isCancel2(sfdcClientSecret)) bail2(sfdcClientSecret);
-  const sfdcLoginUrl = opts.sandbox ? "https://test.salesforce.com" : "https://login.salesforce.com";
   const dbPassword = generateSecret(16);
   const managedDb = !opts.externalDb;
   const databaseUrl = opts.externalDb ?? `postgresql://leadrouting:${dbPassword}@postgres:5432/leadrouting`;
@@ -200,9 +173,6 @@ async function collectConfig(opts = {}) {
   return {
     appUrl: appUrl.trim().replace(/\/+$/, ""),
     engineUrl: engineUrl.trim().replace(/\/+$/, ""),
-    sfdcClientId: sfdcClientId.trim(),
-    sfdcClientSecret: sfdcClientSecret.trim(),
-    sfdcLoginUrl,
     managedDb,
     databaseUrl,
     dbPassword: managedDb ? dbPassword : "",
@@ -360,12 +330,6 @@ function renderEnvWeb(c) {
     `# Redis`,
     `REDIS_URL=${c.redisUrl}`,
     ``,
-    `# Salesforce OAuth`,
-    `SFDC_CLIENT_ID=${c.sfdcClientId}`,
-    `SFDC_CLIENT_SECRET=${c.sfdcClientSecret}`,
-    `SFDC_LOGIN_URL=${c.sfdcLoginUrl}`,
-    `SFDC_REDIRECT_URI=${c.appUrl.replace(/\/+$/, "")}/api/auth/sfdc/callback`,
-    ``,
     `# Session`,
     `SESSION_SECRET=${c.sessionSecret}`,
     ``,
@@ -400,11 +364,6 @@ function renderEnvEngine(c) {
     `# Redis`,
     `REDIS_URL=${c.redisUrl}`,
     ``,
-    `# Salesforce OAuth`,
-    `SFDC_CLIENT_ID=${c.sfdcClientId}`,
-    `SFDC_CLIENT_SECRET=${c.sfdcClientSecret}`,
-    `SFDC_LOGIN_URL=${c.sfdcLoginUrl}`,
-    ``,
     `# Webhook`,
     `ENGINE_WEBHOOK_SECRET=${c.engineWebhookSecret}`,
     ``,
@@ -544,9 +503,6 @@ function generateFiles(cfg, sshCfg) {
     publicEngineUrl: cfg.engineUrl,
     databaseUrl: cfg.databaseUrl,
     redisUrl: cfg.redisUrl,
-    sfdcClientId: cfg.sfdcClientId,
-    sfdcClientSecret: cfg.sfdcClientSecret,
-    sfdcLoginUrl: cfg.sfdcLoginUrl,
     sessionSecret: cfg.sessionSecret,
     engineWebhookSecret: cfg.engineWebhookSecret,
     adminSecret: cfg.adminSecret,
@@ -562,9 +518,6 @@ function generateFiles(cfg, sshCfg) {
   const envEngineContent = renderEnvEngine({
     databaseUrl: cfg.databaseUrl,
     redisUrl: cfg.redisUrl,
-    sfdcClientId: cfg.sfdcClientId,
-    sfdcClientSecret: cfg.sfdcClientSecret,
-    sfdcLoginUrl: cfg.sfdcLoginUrl,
     engineWebhookSecret: cfg.engineWebhookSecret,
     internalApiKey: cfg.internalApiKey
   });
@@ -587,9 +540,6 @@ function generateFiles(cfg, sshCfg) {
       db: cfg.managedDb,
       redis: cfg.managedRedis
     },
-    // Stored so `lead-routing sfdc deploy` can re-authenticate without re-prompting
-    sfdcClientId: cfg.sfdcClientId,
-    sfdcLoginUrl: cfg.sfdcLoginUrl,
     engineWebhookSecret: cfg.engineWebhookSecret,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     version: getCliVersion()
@@ -935,1174 +885,1098 @@ function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// src/steps/sfdc-deploy-inline.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, cpSync, rmSync } from "fs";
-import { join as join5, dirname as dirname2 } from "path";
-import { tmpdir } from "os";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { execSync } from "child_process";
-import { spinner as spinner5, log as log7 } from "@clack/prompts";
-
-// src/utils/sfdc-api.ts
-var API_VERSION = "v59.0";
-var SalesforceApi = class {
-  constructor(instanceUrl, accessToken) {
-    this.instanceUrl = instanceUrl;
-    this.accessToken = accessToken;
-    this.baseUrl = `${instanceUrl.replace(/\/+$/, "")}/services/data/${API_VERSION}`;
-  }
-  baseUrl;
-  headers(extra) {
-    return {
-      Authorization: `Bearer ${this.accessToken}`,
-      "Content-Type": "application/json",
-      ...extra
+// src/utils/ssh.ts
+import net from "net";
+import { NodeSSH } from "node-ssh";
+var SshConnection = class {
+  ssh = new NodeSSH();
+  _connected = false;
+  async connect(config2) {
+    const opts = {
+      host: config2.host,
+      port: config2.port,
+      username: config2.username,
+      // Reduce connection timeout to fail fast on bad creds
+      readyTimeout: 15e3
     };
-  }
-  /** Execute a SOQL query and return records */
-  async query(soql) {
-    const url = `${this.baseUrl}/query?q=${encodeURIComponent(soql)}`;
-    const res = await fetch(url, { headers: this.headers() });
-    if (!res.ok) {
-      const body = await res.text();
-      throw new Error(`SOQL query failed (${res.status}): ${body}`);
-    }
-    const data = await res.json();
-    return data.records;
-  }
-  /** Create an sObject record, returns the new record ID */
-  async create(sobject, data) {
-    const url = `${this.baseUrl}/sobjects/${sobject}`;
-    const res = await fetch(url, {
-      method: "POST",
-      headers: this.headers(),
-      body: JSON.stringify(data)
-    });
-    if (!res.ok) {
-      const body = await res.text();
-      if (res.status === 400 && body.includes("Duplicate")) {
-        throw new DuplicateError(body);
-      }
-      throw new Error(`Create ${sobject} failed (${res.status}): ${body}`);
-    }
-    const result = await res.json();
-    return result.id;
-  }
-  /** Update an sObject record */
-  async update(sobject, id, data) {
-    const url = `${this.baseUrl}/sobjects/${sobject}/${id}`;
-    const res = await fetch(url, {
-      method: "PATCH",
-      headers: this.headers(),
-      body: JSON.stringify(data)
-    });
-    if (!res.ok) {
-      const body = await res.text();
-      throw new Error(`Update ${sobject}/${id} failed (${res.status}): ${body}`);
+    if (config2.privateKeyPath) {
+      opts.privateKeyPath = config2.privateKeyPath;
+    } else if (config2.password) {
+      opts.password = config2.password;
     }
+    await this.ssh.connect(opts);
+    this._connected = true;
   }
-  /** Get current user info (for permission set assignment) */
-  async getCurrentUserId() {
-    const url = `${this.instanceUrl.replace(/\/+$/, "")}/services/oauth2/userinfo`;
-    const res = await fetch(url, {
-      headers: { Authorization: `Bearer ${this.accessToken}` }
-    });
-    if (!res.ok) {
-      const body = await res.text();
-      throw new Error(`Get current user failed (${res.status}): ${body}`);
-    }
-    const data = await res.json();
-    return data.user_id;
+  get isConnected() {
+    return this._connected;
   }
   /**
-   * Deploy metadata using the Source Deploy API (same API that `sf project deploy start` uses).
-   * Accepts a ZIP buffer containing the source-format package.
-   * Returns the deploy request ID for polling.
+   * Run a command remotely. Throws if exit code is non-zero.
    */
-  async deployMetadata(zipBuffer) {
-    const url = `${this.baseUrl}/metadata/deployRequest`;
-    const boundary = `----FormBoundary${Date.now()}`;
-    const deployOptions = JSON.stringify({
-      deployOptions: {
-        rollbackOnError: true,
-        singlePackage: true
-      }
-    });
-    const parts = [];
-    parts.push(
-      Buffer.from(
-        `--${boundary}\r
-Content-Disposition: form-data; name="json"\r
-Content-Type: application/json\r
-\r
-${deployOptions}\r
-`
-      )
-    );
-    parts.push(
-      Buffer.from(
-        `--${boundary}\r
-Content-Disposition: form-data; name="file"; filename="deploy.zip"\r
-Content-Type: application/zip\r
-\r
-`
-      )
-    );
-    parts.push(zipBuffer);
-    parts.push(Buffer.from(`\r
---${boundary}--\r
-`));
-    const body = Buffer.concat(parts);
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${this.accessToken}`,
-        "Content-Type": `multipart/form-data; boundary=${boundary}`
-      },
-      body
-    });
-    if (!res.ok) {
-      const text5 = await res.text();
+  async exec(cmd, cwd) {
+    const result = await this.ssh.execCommand(cmd, cwd ? { cwd } : {});
+    if (result.code !== 0) {
       throw new Error(
-        `Metadata deploy request failed (${res.status}): ${text5}`
+        `Remote command failed (exit ${result.code}): ${cmd}
+${result.stderr || result.stdout}`
       );
     }
-    const result = await res.json();
-    return result.id;
+    return { stdout: result.stdout, stderr: result.stderr };
   }
   /**
-   * Poll deploy status until complete.
-   * Returns deploy result with success/failure info.
+   * Run a command remotely without throwing — returns code + output.
    */
-  async waitForDeploy(deployId, timeoutMs = 3e5) {
-    const startTime = Date.now();
-    const pollInterval = 3e3;
-    while (Date.now() - startTime < timeoutMs) {
-      const url = `${this.baseUrl}/metadata/deployRequest/${deployId}?includeDetails=true`;
-      const res = await fetch(url, { headers: this.headers() });
-      if (!res.ok) {
-        const text5 = await res.text();
-        throw new Error(
-          `Deploy status check failed (${res.status}): ${text5}`
-        );
-      }
-      const data = await res.json();
-      const result = data.deployResult;
-      if (result.done) {
-        return result;
-      }
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
-    }
-    throw new Error(`Deploy timed out after ${timeoutMs / 1e3}s`);
+  async execSilent(cmd, cwd) {
+    const result = await this.ssh.execCommand(cmd, cwd ? { cwd } : {});
+    return { stdout: result.stdout, stderr: result.stderr, code: result.code ?? 1 };
   }
-};
-var DuplicateError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "DuplicateError";
+  /**
+   * Create a remote directory (including parents).
+   */
+  async mkdir(remotePath) {
+    await this.exec(`mkdir -p ${remotePath}`);
+  }
+  /**
+   * Upload local files to the remote server via SFTP.
+   */
+  async upload(files) {
+    await this.ssh.putFiles(files);
+  }
+  /**
+   * Resolve ~ in a remote path by querying $HOME on the server.
+   */
+  async resolveHome(remotePath) {
+    if (!remotePath.startsWith("~")) return remotePath;
+    const { stdout } = await this.exec("echo $HOME");
+    return stdout.trim() + remotePath.slice(1);
+  }
+  /**
+   * Open an SSH port-forward tunnel.
+   * Creates a local TCP server that pipes connections through to
+   * localhost:{remotePort} on the remote machine.
+   *
+   * Returns the local port and a close() function.
+   * Call close() when migrations are done.
+   */
+  async tunnel(remotePort) {
+    const sshClient = this.ssh.connection;
+    if (!sshClient) throw new Error("SSH not connected \u2014 cannot open tunnel");
+    const server = net.createServer((socket) => {
+      ;
+      sshClient.forwardOut(
+        "127.0.0.1",
+        0,
+        "localhost",
+        remotePort,
+        (err, stream) => {
+          if (err) {
+            socket.destroy();
+            return;
+          }
+          socket.pipe(stream);
+          stream.pipe(socket);
+          socket.on("close", () => stream.destroy());
+          stream.on("close", () => socket.destroy());
+        }
+      );
+    });
+    return new Promise((resolve, reject) => {
+      server.listen(0, "127.0.0.1", () => {
+        const { port } = server.address();
+        resolve({
+          localPort: port,
+          close: () => server.close()
+        });
+      });
+      server.on("error", reject);
+    });
+  }
+  async disconnect() {
+    if (this._connected) {
+      this.ssh.dispose();
+      this._connected = false;
+    }
   }
 };
 
-// src/utils/zip-source.ts
-import { join as join4 } from "path";
-import { readdirSync, readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
-import archiver from "archiver";
-var META_TYPE_MAP = {
-  applications: "CustomApplication",
-  classes: "ApexClass",
-  triggers: "ApexTrigger",
-  lwc: "LightningComponentBundle",
-  permissionsets: "PermissionSet",
-  namedCredentials: "NamedCredential",
-  remoteSiteSettings: "RemoteSiteSetting",
-  tabs: "CustomTab"
-};
-async function zipSourcePackage(packageDir) {
-  const forceAppDefault = join4(packageDir, "force-app", "main", "default");
-  let apiVersion = "59.0";
+// src/commands/init.ts
+async function checkDnsResolvable(appUrl, engineUrl) {
+  let hosts;
   try {
-    const proj = JSON.parse(readFileSync3(join4(packageDir, "sfdx-project.json"), "utf8"));
-    if (proj.sourceApiVersion) apiVersion = proj.sourceApiVersion;
+    hosts = [.../* @__PURE__ */ new Set([new URL(appUrl).hostname, new URL(engineUrl).hostname])];
   } catch {
+    return;
   }
-  const members = /* @__PURE__ */ new Map();
-  const addMember = (type, name) => {
-    if (!members.has(type)) members.set(type, /* @__PURE__ */ new Set());
-    members.get(type).add(name);
-  };
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    const archive = archiver("zip", { zlib: { level: 9 } });
-    archive.on("data", (chunk) => chunks.push(chunk));
-    archive.on("end", () => resolve(Buffer.concat(chunks)));
-    archive.on("error", reject);
-    for (const [dirName, metaType] of Object.entries(META_TYPE_MAP)) {
-      const srcDir = join4(forceAppDefault, dirName);
-      if (!existsSync3(srcDir)) continue;
-      const entries = readdirSync(srcDir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (dirName === "lwc" && entry.isDirectory()) {
-          addMember(metaType, entry.name);
-          archive.directory(join4(srcDir, entry.name), `${dirName}/${entry.name}`);
-        } else if (entry.isFile()) {
-          archive.file(join4(srcDir, entry.name), { name: `${dirName}/${entry.name}` });
-          if (!entry.name.endsWith("-meta.xml")) {
-            const memberName = entry.name.replace(/\.[^.]+$/, "");
-            addMember(metaType, memberName);
-          }
-        }
+  for (const host of hosts) {
+    try {
+      await dns.lookup(host);
+    } catch {
+      log7.warn(
+        `${chalk.yellow(host)} does not resolve in DNS yet.
+  Check for typos \u2014 a bad domain will cause a 2-minute timeout at step 7.`
+      );
+      const go = await confirm({ message: "Continue anyway?", initialValue: true });
+      if (isCancel3(go) || !go) {
+        cancel3("Setup cancelled.");
+        process.exit(0);
       }
     }
-    const objectsDir = join4(forceAppDefault, "objects");
-    if (existsSync3(objectsDir)) {
-      for (const objEntry of readdirSync(objectsDir, { withFileTypes: true })) {
-        if (!objEntry.isDirectory()) continue;
-        const objName = objEntry.name;
-        addMember("CustomObject", objName);
-        const objDir = join4(objectsDir, objName);
-        const objectXml = mergeObjectXml(objDir, objName, apiVersion);
-        archive.append(Buffer.from(objectXml, "utf8"), {
-          name: `objects/${objName}.object`
+  }
+}
+async function runInit(options = {}) {
+  const dryRun = options.dryRun ?? false;
+  const resume = options.resume ?? false;
+  console.log();
+  intro(
+    chalk.bold.cyan("Lead Routing \u2014 Self-Hosted Setup") + (dryRun ? chalk.yellow("  [dry run]") : "") + (resume ? chalk.yellow("  [resume]") : "")
+  );
+  const ssh = new SshConnection();
+  if (resume) {
+    try {
+      const dir = findInstallDir();
+      if (!dir) {
+        log7.error("No lead-routing.json found \u2014 run `lead-routing init` first.");
+        process.exit(1);
+      }
+      const saved = readConfig(dir);
+      let sshPassword;
+      if (!saved.ssh.privateKeyPath) {
+        const pw = await promptPassword({
+          message: `SSH password for ${saved.ssh.username}@${saved.ssh.host}`
         });
+        if (typeof pw === "symbol") process.exit(0);
+        sshPassword = pw;
       }
+      log7.step("Connecting to server");
+      await ssh.connect({
+        host: saved.ssh.host,
+        port: saved.ssh.port,
+        username: saved.ssh.username,
+        privateKeyPath: saved.ssh.privateKeyPath,
+        password: sshPassword,
+        remoteDir: saved.remoteDir
+      });
+      log7.success(`Connected to ${saved.ssh.host}`);
+      const remoteDir = await ssh.resolveHome(saved.remoteDir);
+      log7.step("Step 7/7  Verifying health");
+      await verifyHealth(saved.appUrl, saved.engineUrl, ssh, remoteDir);
+      note3(
+        `Open ${saved.appUrl} \u2192 Integrations \u2192 Salesforce to connect your CRM and deploy the package.`,
+        "Next: Connect Salesforce"
+      );
+      outro(
+        chalk.green("\u2714  You're live!") + `
+
+  Dashboard:      ${chalk.cyan(saved.appUrl)}
+  Routing engine: ${chalk.cyan(saved.engineUrl)}
+
+` + chalk.bold("  Next steps:\n") + `  ${chalk.cyan("1.")} Open ${chalk.cyan(saved.appUrl)} and log in
+  ${chalk.cyan("2.")} Go to Integrations \u2192 Salesforce to connect your org
+  ${chalk.cyan("3.")} Deploy the package and configure routing objects
+  ${chalk.cyan("4.")} Create your first routing rule
+
+  Run ${chalk.cyan("lead-routing doctor")} to check service health at any time.
+  Run ${chalk.cyan("lead-routing deploy")} to update to a new version.`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log7.error(`Resume failed: ${message}`);
+      process.exit(1);
+    } finally {
+      await ssh.disconnect();
     }
-    const packageXml = generatePackageXml(members, apiVersion);
-    archive.append(Buffer.from(packageXml, "utf8"), { name: "package.xml" });
-    archive.finalize();
-  });
-}
-function mergeObjectXml(objDir, objName, apiVersion) {
-  const lines = [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    '<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">'
-  ];
-  const objMetaPath = join4(objDir, `${objName}.object-meta.xml`);
-  if (existsSync3(objMetaPath)) {
-    const content = readFileSync3(objMetaPath, "utf8");
-    const inner = content.replace(/<\?xml[^?]*\?>\s*/g, "").replace(/<CustomObject[^>]*>/g, "").replace(/<\/CustomObject>/g, "").trim();
-    if (inner) lines.push(inner);
+    return;
   }
-  const fieldsDir = join4(objDir, "fields");
-  if (existsSync3(fieldsDir)) {
-    for (const fieldFile of readdirSync(fieldsDir).sort()) {
-      if (!fieldFile.endsWith(".field-meta.xml")) continue;
-      const content = readFileSync3(join4(fieldsDir, fieldFile), "utf8");
-      const inner = content.replace(/<\?xml[^?]*\?>\s*/g, "").replace(/<CustomField[^>]*>/g, "").replace(/<\/CustomField>/g, "").trim();
-      if (inner) {
-        lines.push("    <fields>");
-        lines.push(`        ${inner}`);
-        lines.push("    </fields>");
+  try {
+    log7.step("Step 1/7  Checking local prerequisites");
+    await checkPrerequisites();
+    log7.step("Step 2/7  SSH connection");
+    const sshCfg = await collectSshConfig({
+      sshPort: options.sshPort,
+      sshUser: options.sshUser,
+      sshKey: options.sshKey,
+      remoteDir: options.remoteDir
+    });
+    if (!dryRun) {
+      try {
+        await ssh.connect(sshCfg);
+        log7.success(`Connected to ${sshCfg.host}`);
+      } catch (err) {
+        log7.error(`SSH connection failed: ${String(err)}`);
+        log7.info("Check your password and re-run `lead-routing init`.");
+        process.exit(1);
       }
     }
-  }
-  lines.push("</CustomObject>");
-  return lines.join("\n");
-}
-function generatePackageXml(members, apiVersion) {
-  const lines = [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    '<Package xmlns="http://soap.sforce.com/2006/04/metadata">'
-  ];
-  for (const [metaType, names] of [...members.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
-    lines.push("    <types>");
-    for (const name of [...names].sort()) {
-      lines.push(`        <members>${name}</members>`);
+    log7.step("Step 3/7  Configuration");
+    const cfg = await collectConfig({
+      externalDb: options.externalDb,
+      externalRedis: options.externalRedis
+    });
+    await checkDnsResolvable(cfg.appUrl, cfg.engineUrl);
+    log7.step("Step 4/7  Generating config files");
+    const { dir, adminSecret } = generateFiles(cfg, sshCfg);
+    note3(
+      `Local config directory: ${chalk.cyan(dir)}
+Files created: docker-compose.yml, Caddyfile, .env.web, .env.engine, lead-routing.json`,
+      "Files"
+    );
+    if (dryRun) {
+      outro(
+        chalk.yellow("Dry run complete \u2014 no connection made, no services started.") + `
+
+  Config files written to: ${chalk.cyan(dir)}
+
+  When ready, run ${chalk.cyan("lead-routing init")} (without --dry-run) to deploy.`
+      );
+      return;
     }
-    lines.push(`        <name>${metaType}</name>`);
-    lines.push("    </types>");
+    log7.step("Step 5/7  Remote setup");
+    const remoteDir = await ssh.resolveHome(sshCfg.remoteDir);
+    await checkRemotePrerequisites(ssh);
+    await uploadFiles(ssh, dir, remoteDir);
+    log7.step("Step 6/7  Starting services");
+    await startServices(ssh, remoteDir);
+    log7.step("Step 7/7  Verifying health");
+    await verifyHealth(cfg.appUrl, cfg.engineUrl, ssh, remoteDir);
+    try {
+      const envWebPath = join4(dir, ".env.web");
+      const envContent = readFileSync3(envWebPath, "utf-8");
+      const cleaned = envContent.split("\n").filter((line) => !line.startsWith("ADMIN_PASSWORD=")).join("\n");
+      writeFileSync3(envWebPath, cleaned, "utf-8");
+      log7.success("Removed ADMIN_PASSWORD from .env.web (no longer needed after seed)");
+    } catch {
+    }
+    note3(
+      `Open ${cfg.appUrl} \u2192 Integrations \u2192 Salesforce to connect your CRM and deploy the package.`,
+      "Next: Connect Salesforce"
+    );
+    outro(
+      chalk.green("\u2714  You're live!") + `
+
+  Dashboard:      ${chalk.cyan(cfg.appUrl)}
+  Routing engine: ${chalk.cyan(cfg.engineUrl)}
+
+  Admin email:    ${chalk.white(cfg.adminEmail)}
+  Admin secret:   ${chalk.yellow(adminSecret)}
+                  ${chalk.dim("run `lead-routing config show` to retrieve later")}
+
+` + chalk.bold("  Next steps:\n") + `  ${chalk.cyan("1.")} Open ${chalk.cyan(cfg.appUrl)} and log in
+  ${chalk.cyan("2.")} Go to Integrations \u2192 Salesforce to connect your org
+  ${chalk.cyan("3.")} Deploy the package and configure routing objects
+  ${chalk.cyan("4.")} Create your first routing rule
+
+  Run ${chalk.cyan("lead-routing doctor")} to check service health at any time.
+  Run ${chalk.cyan("lead-routing deploy")} to update to a new version.`
+    );
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log7.error(`Setup failed: ${message}`);
+    process.exit(1);
+  } finally {
+    await ssh.disconnect();
   }
-  lines.push(`    <version>${apiVersion}</version>`);
-  lines.push("</Package>");
-  return lines.join("\n");
 }
 
-// src/steps/sfdc-deploy-inline.ts
-var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
-function patchXml(content, tag, value) {
-  const re = new RegExp(`(<${tag}>)[^<]*(</\\s*${tag}>)`, "g");
-  return content.replace(re, `$1${value}$2`);
-}
-async function sfdcDeployInline(params) {
-  const { appUrl, engineUrl, installDir } = params;
-  const s = spinner5();
-  const { accessToken, instanceUrl } = await loginViaAppBridge(appUrl);
-  const sf = new SalesforceApi(instanceUrl, accessToken);
-  s.start("Copying Salesforce package\u2026");
-  const inDist = join5(__dirname2, "sfdc-package");
-  const nextToDist = join5(__dirname2, "..", "sfdc-package");
-  const bundledPkg = existsSync4(inDist) ? inDist : nextToDist;
-  const destPkg = join5(installDir ?? tmpdir(), "lead-routing-sfdc-package");
-  if (!existsSync4(bundledPkg)) {
-    s.stop("sfdc-package not found in CLI bundle");
-    throw new Error(
-      `Expected bundle at: ${inDist}
-The CLI may need to be reinstalled: npm i -g @lead-routing/cli`
+// src/commands/deploy.ts
+import { writeFileSync as writeFileSync4, unlinkSync } from "fs";
+import { join as join5 } from "path";
+import { tmpdir } from "os";
+import { intro as intro2, outro as outro2, log as log8, password as promptPassword2 } from "@clack/prompts";
+import chalk2 from "chalk";
+async function runDeploy() {
+  console.log();
+  intro2(chalk2.bold.cyan("Lead Routing \u2014 Deploy"));
+  const dir = findInstallDir();
+  if (!dir) {
+    log8.error(
+      "No lead-routing.json found. Run `lead-routing init` first, or run this command from your install directory."
     );
+    process.exit(1);
   }
-  if (existsSync4(destPkg)) rmSync(destPkg, { recursive: true, force: true });
-  cpSync(bundledPkg, destPkg, { recursive: true });
-  s.stop("Package copied");
-  const ncPath = join5(
-    destPkg,
-    "force-app",
-    "main",
-    "default",
-    "namedCredentials",
-    "RoutingEngine.namedCredential-meta.xml"
-  );
-  if (existsSync4(ncPath)) {
-    const nc = patchXml(readFileSync4(ncPath, "utf8"), "endpoint", engineUrl);
-    writeFileSync3(ncPath, nc, "utf8");
-  }
-  const rssEnginePath = join5(
-    destPkg,
-    "force-app",
-    "main",
-    "default",
-    "remoteSiteSettings",
-    "LeadRouterEngine.remoteSite-meta.xml"
-  );
-  if (existsSync4(rssEnginePath)) {
-    let rss = patchXml(readFileSync4(rssEnginePath, "utf8"), "url", engineUrl);
-    rss = patchXml(rss, "description", "Lead Router Engine endpoint");
-    writeFileSync3(rssEnginePath, rss, "utf8");
-  }
-  const rssAppPath = join5(
-    destPkg,
-    "force-app",
-    "main",
-    "default",
-    "remoteSiteSettings",
-    "LeadRouterApp.remoteSite-meta.xml"
-  );
-  if (existsSync4(rssAppPath)) {
-    let rss = patchXml(readFileSync4(rssAppPath, "utf8"), "url", appUrl);
-    rss = patchXml(rss, "description", "Lead Router App URL");
-    writeFileSync3(rssAppPath, rss, "utf8");
+  const cfg = readConfig(dir);
+  const ssh = new SshConnection();
+  let sshPassword;
+  if (!cfg.ssh.privateKeyPath) {
+    const pw = await promptPassword2({
+      message: `SSH password for ${cfg.ssh.username}@${cfg.ssh.host}`
+    });
+    if (typeof pw === "symbol") process.exit(0);
+    sshPassword = pw;
   }
-  log7.success("Remote Site Settings patched");
-  s.start("Deploying Salesforce package (this may take ~2 min)\u2026");
   try {
-    const zipBuffer = await zipSourcePackage(destPkg);
-    const deployId = await sf.deployMetadata(zipBuffer);
-    const result = await sf.waitForDeploy(deployId);
-    if (!result.success) {
-      const failures = result.details?.componentFailures ?? [];
-      const failureMsg = failures.map((f) => `  ${f.componentType}/${f.fullName}: ${f.problem}`).join("\n");
-      s.stop("Deployment failed");
-      throw new Error(
-        `Metadata deploy failed (${result.numberComponentErrors} error(s)):
-${failureMsg || result.errorMessage || "Unknown error"}`
-      );
-    }
-    s.stop(`Package deployed (${result.numberComponentsDeployed} components)`);
+    await ssh.connect({
+      host: cfg.ssh.host,
+      port: cfg.ssh.port,
+      username: cfg.ssh.username,
+      privateKeyPath: cfg.ssh.privateKeyPath,
+      password: sshPassword,
+      remoteDir: cfg.remoteDir
+    });
+    log8.success(`Connected to ${cfg.ssh.host}`);
   } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Metadata deploy failed")) {
-      throw err;
-    }
-    s.stop("Deployment failed");
-    throw new Error(
-      `Metadata deploy failed: ${String(err)}
-
-  The patched package is at: ${destPkg}
-  You can retry with: sf project deploy start --source-dir force-app`
-    );
+    log8.error(`SSH connection failed: ${String(err)}`);
+    process.exit(1);
   }
-  s.start("Assigning LeadRouterAdmin permission set\u2026");
   try {
-    const permSets = await sf.query(
-      "SELECT Id FROM PermissionSet WHERE Name = 'LeadRouterAdmin' LIMIT 1"
+    const remoteDir = await ssh.resolveHome(cfg.remoteDir);
+    log8.step("Syncing Caddyfile");
+    const caddyContent = renderCaddyfile(cfg.appUrl, cfg.engineUrl);
+    const tmpCaddy = join5(tmpdir(), "lead-routing-Caddyfile");
+    writeFileSync4(tmpCaddy, caddyContent, "utf8");
+    await ssh.upload([{ local: tmpCaddy, remote: `${remoteDir}/Caddyfile` }]);
+    unlinkSync(tmpCaddy);
+    await ssh.exec("docker compose restart caddy", remoteDir);
+    log8.success("Caddyfile synced \u2014 waiting for TLS cert (~30s)");
+    log8.step("Pulling latest Docker images");
+    await ssh.exec("docker compose pull", remoteDir);
+    log8.success("Images pulled");
+    log8.step("Restarting services");
+    await ssh.exec("docker compose up -d --remove-orphans", remoteDir);
+    log8.success("Services restarted");
+    outro2(
+      chalk2.green("\u2714  Deployment complete!") + `
+
+  ${chalk2.cyan(cfg.appUrl)}`
     );
-    if (permSets.length === 0) {
-      s.stop("LeadRouterAdmin permission set not found (non-fatal)");
-      log7.warn("The permission set may not have been included in the deploy.");
-    } else {
-      const userId = await sf.getCurrentUserId();
-      try {
-        await sf.create("PermissionSetAssignment", {
-          AssigneeId: userId,
-          PermissionSetId: permSets[0].Id
-        });
-        s.stop("Permission set assigned \u2014 Lead Router Setup will appear in the App Launcher");
-      } catch (err) {
-        if (err instanceof DuplicateError) {
-          s.stop("Permission set already assigned");
-        } else {
-          throw err;
-        }
-      }
-    }
   } catch (err) {
-    if (!(err instanceof DuplicateError)) {
-      s.stop("Permission set assignment failed (non-fatal)");
-      log7.warn(String(err));
-      log7.info(
-        "Grant access manually:\n  Salesforce Setup \u2192 Users \u2192 Permission Sets \u2192 Lead Router Admin \u2192 Manage Assignments"
-      );
-    }
+    const message = err instanceof Error ? err.message : String(err);
+    log8.error(`Deploy failed: ${message}`);
+    process.exit(1);
+  } finally {
+    await ssh.disconnect();
   }
-  s.start("Writing org settings to Routing_Settings__c\u2026");
+}
+
+// src/commands/doctor.ts
+import { intro as intro3, outro as outro3, log as log9 } from "@clack/prompts";
+import chalk3 from "chalk";
+import { execa } from "execa";
+async function runDoctor() {
+  console.log();
+  intro3(chalk3.bold.cyan("Lead Routing \u2014 Health Check"));
+  const dir = findInstallDir();
+  if (!dir) {
+    log9.error("No lead-routing.json found. Run `lead-routing init` first.");
+    process.exit(1);
+  }
+  const cfg = readConfig(dir);
+  const checks = [];
+  checks.push(await checkDockerDaemon());
+  const containers = ["web", "engine"];
+  if (cfg.dockerManaged.db) containers.push("postgres");
+  if (cfg.dockerManaged.redis) containers.push("redis");
+  for (const name of containers) {
+    checks.push(await checkContainer(name, dir));
+  }
+  checks.push(await checkEndpoint("Web app", `${cfg.appUrl}/api/health`));
+  checks.push(await checkEndpoint("Routing engine", `${cfg.engineUrl}/health`));
+  console.log();
+  for (const c of checks) {
+    const icon = c.pass ? chalk3.green("\u2714") : chalk3.red("\u2717");
+    const label = c.pass ? chalk3.white(c.label) : chalk3.red(c.label);
+    const detail = c.detail ? chalk3.dim(` \u2014 ${c.detail}`) : "";
+    console.log(`  ${icon}  ${label}${detail}`);
+  }
+  console.log();
+  const failed = checks.filter((c) => !c.pass);
+  if (failed.length === 0) {
+    outro3(chalk3.green("All checks passed"));
+  } else {
+    outro3(chalk3.yellow(`${failed.length} check(s) failed`));
+    process.exit(1);
+  }
+}
+async function checkDockerDaemon() {
   try {
-    const existing = await sf.query(
-      "SELECT Id FROM Routing_Settings__c LIMIT 1"
-    );
-    const settingsData = {
-      App_Url__c: appUrl,
-      Engine_Endpoint__c: engineUrl
-    };
-    if (params.webhookSecret) {
-      settingsData.Webhook_Secret__c = params.webhookSecret;
-    }
-    if (existing.length > 0) {
-      await sf.update("Routing_Settings__c", existing[0].Id, settingsData);
-    } else {
-      await sf.create("Routing_Settings__c", settingsData);
-    }
-    s.stop("Org settings written");
-  } catch (err) {
-    s.stop("Org settings write failed (non-fatal)");
-    log7.warn(String(err));
-    log7.info("Set manually: Salesforce \u2192 Custom Settings \u2192 Routing Settings \u2192 Manage");
+    await execa("docker", ["info"], { reject: true });
+    return { label: "Docker daemon", pass: true };
+  } catch {
+    return { label: "Docker daemon", pass: false, detail: "not running" };
   }
 }
-async function loginViaAppBridge(rawAppUrl) {
-  const appUrl = rawAppUrl.replace(/\/+$/, "");
-  const s = spinner5();
-  s.start("Starting Salesforce authentication via your Lead Router app\u2026");
-  let sessionId;
-  let authUrl;
+async function checkContainer(name, dir) {
   try {
-    const res = await fetch(`${appUrl}/api/cli-auth/request`, { method: "POST" });
-    if (!res.ok) {
-      s.stop("Failed to start auth session");
-      throw new Error(
-        `Could not reach ${appUrl}/api/cli-auth/request (HTTP ${res.status}).
-Make sure the web app is running and accessible.`
-      );
+    const result = await execa(
+      "docker",
+      ["compose", "ps", "--format", "json", name],
+      { cwd: dir, reject: false }
+    );
+    const output = result.stdout.trim();
+    if (!output) {
+      return { label: `Container: ${name}`, pass: false, detail: "not found" };
     }
-    const data = await res.json();
-    sessionId = data.sessionId;
-    authUrl = data.authUrl;
-  } catch (err) {
-    s.stop("Could not reach Lead Router app");
-    throw new Error(
-      `Failed to connect to ${appUrl}: ${String(err)}
-Ensure the app is running and the URL is correct.`
+    const rows = output.split("\n").map((l) => {
+      try {
+        return JSON.parse(l);
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+    const running = rows.some(
+      (r) => r.State === "running" || r.Status && r.Status.toLowerCase().includes("up")
     );
-  }
-  s.stop("Auth session started");
-  log7.info(`Open this URL in your browser to authenticate with Salesforce:
-
-  ${authUrl}
-`);
-  log7.info('If Chrome shows a "Dangerous site" warning with no proceed option, paste the URL into Safari or Firefox.');
-  const opener = process.platform === "win32" ? "start" : process.platform === "darwin" ? "open" : "xdg-open";
-  try {
-    execSync(`${opener} "${authUrl}"`, { stdio: "ignore" });
+    return {
+      label: `Container: ${name}`,
+      pass: running,
+      detail: running ? "running" : "not running"
+    };
   } catch {
+    return { label: `Container: ${name}`, pass: false, detail: "error checking status" };
   }
-  s.start("Waiting for Salesforce authentication in browser\u2026");
-  const maxPolls = 150;
-  let accessToken;
-  let instanceUrl;
-  for (let i = 0; i < maxPolls; i++) {
-    await new Promise((r) => setTimeout(r, 2e3));
-    try {
-      const pollRes = await fetch(`${appUrl}/api/cli-auth/poll/${sessionId}`);
-      if (pollRes.status === 410) {
-        s.stop("Auth session expired");
-        throw new Error("CLI auth session expired. Please re-run the command.");
-      }
-      const data = await pollRes.json();
-      if (data.status === "ok") {
-        accessToken = data.accessToken;
-        instanceUrl = data.instanceUrl;
-        break;
-      }
-    } catch (err) {
-      if (String(err).includes("session expired")) throw err;
-    }
-  }
-  if (!accessToken || !instanceUrl) {
-    s.stop("Timed out");
-    throw new Error(
-      "Timed out waiting for Salesforce authentication (5 minutes).\nPlease re-run the command and complete login within 5 minutes."
-    );
+}
+async function checkEndpoint(label, url) {
+  try {
+    const res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+    return {
+      label: `Health: ${label}`,
+      pass: res.ok,
+      detail: `HTTP ${res.status}`
+    };
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return { label: `Health: ${label}`, pass: false, detail };
   }
-  s.stop("Authenticated with Salesforce");
-  return { accessToken, instanceUrl };
 }
 
-// src/steps/app-launcher-guide.ts
-import { note as note3, confirm, isCancel as isCancel3, log as log8 } from "@clack/prompts";
-import chalk from "chalk";
-async function guideAppLauncherSetup(appUrl) {
-  note3(
-    `Complete the following steps in Salesforce now:
-
-  ${chalk.cyan("1.")} Open ${chalk.bold("App Launcher")} (grid icon, top-left in Salesforce)
-  ${chalk.cyan("2.")} Search for ${chalk.white('"Lead Router Setup"')} and click it
-  ${chalk.cyan("3.")} Click ${chalk.white('"Connect to Lead Router"')}
-     \u2192 You will be redirected to ${chalk.dim(appUrl)} and back
-     \u2192 Authorize the OAuth connection when prompted
-
-  ${chalk.cyan("4.")} ${chalk.bold("Step 1")} \u2014 wait for the ${chalk.green('"Connected"')} checkmark (~5 sec)
-  ${chalk.cyan("5.")} ${chalk.bold("Step 2")} \u2014 click ${chalk.white("Activate")} to enable Lead triggers
-  ${chalk.cyan("6.")} ${chalk.bold("Step 3")} \u2014 click ${chalk.white("Sync Fields")} to index your Lead field schema
-  ${chalk.cyan("7.")} ${chalk.bold("Step 4")} \u2014 click ${chalk.white("Send Test")} to fire a test routing event
-     \u2192 ${chalk.dim('"Test successful"')} or ${chalk.dim('"No matching rule"')} are both valid
-
-` + chalk.dim("Keep this terminal open while you complete the wizard."),
-    "Complete Salesforce setup"
-  );
-  const done = await confirm({
-    message: "Have you completed the App Launcher wizard?",
-    initialValue: false
-  });
-  if (isCancel3(done)) {
-    log8.warn(
-      "Wizard skipped. Run `lead-routing sfdc deploy` to retry the Salesforce setup."
-    );
-    return;
+// src/commands/logs.ts
+import { log as log10 } from "@clack/prompts";
+import { execa as execa2 } from "execa";
+var VALID_SERVICES = ["web", "engine", "postgres", "redis"];
+async function runLogs(service = "engine") {
+  if (!VALID_SERVICES.includes(service)) {
+    log10.error(`Unknown service "${service}". Valid options: ${VALID_SERVICES.join(", ")}`);
+    process.exit(1);
   }
-  if (!done) {
-    log8.warn(
-      `No problem \u2014 complete it at your own pace.
-  Open App Launcher \u2192 Lead Router Setup \u2192 Connect to Lead Router
-  Dashboard: ${appUrl}`
-    );
-  } else {
-    log8.success("Salesforce setup complete");
+  const dir = findInstallDir();
+  if (!dir) {
+    log10.error("No lead-routing.json found. Run `lead-routing init` first.");
+    process.exit(1);
   }
+  console.log(`
+Streaming logs for ${service} (Ctrl+C to stop)...
+`);
+  const child = execa2("docker", ["compose", "logs", "-f", "--tail=100", service], {
+    cwd: dir,
+    stdio: "inherit",
+    reject: false
+  });
+  await child;
 }
 
-// src/utils/ssh.ts
-import net from "net";
-import { NodeSSH } from "node-ssh";
-var SshConnection = class {
-  ssh = new NodeSSH();
-  _connected = false;
-  async connect(config2) {
-    const opts = {
-      host: config2.host,
-      port: config2.port,
-      username: config2.username,
-      // Reduce connection timeout to fail fast on bad creds
-      readyTimeout: 15e3
-    };
-    if (config2.privateKeyPath) {
-      opts.privateKeyPath = config2.privateKeyPath;
-    } else if (config2.password) {
-      opts.password = config2.password;
-    }
-    await this.ssh.connect(opts);
-    this._connected = true;
+// src/commands/status.ts
+import { log as log11 } from "@clack/prompts";
+import { execa as execa3 } from "execa";
+async function runStatus() {
+  const dir = findInstallDir();
+  if (!dir) {
+    log11.error("No lead-routing.json found. Run `lead-routing init` first.");
+    process.exit(1);
   }
-  get isConnected() {
-    return this._connected;
+  const result = await execa3("docker", ["compose", "ps"], {
+    cwd: dir,
+    stdio: "inherit",
+    reject: false
+  });
+  if (result.exitCode !== 0) {
+    log11.error("Failed to get container status. Is Docker running?");
+    process.exit(1);
   }
-  /**
-   * Run a command remotely. Throws if exit code is non-zero.
-   */
-  async exec(cmd, cwd) {
-    const result = await this.ssh.execCommand(cmd, cwd ? { cwd } : {});
-    if (result.code !== 0) {
-      throw new Error(
-        `Remote command failed (exit ${result.code}): ${cmd}
-${result.stderr || result.stdout}`
-      );
-    }
-    return { stdout: result.stdout, stderr: result.stderr };
+}
+
+// src/commands/config.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync3 } from "fs";
+import { join as join6 } from "path";
+import { intro as intro4, outro as outro4, log as log12 } from "@clack/prompts";
+import chalk4 from "chalk";
+function parseEnv(filePath) {
+  const map = /* @__PURE__ */ new Map();
+  if (!existsSync3(filePath)) return map;
+  for (const line of readFileSync4(filePath, "utf8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    map.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
   }
-  /**
-   * Run a command remotely without throwing — returns code + output.
-   */
-  async execSilent(cmd, cwd) {
-    const result = await this.ssh.execCommand(cmd, cwd ? { cwd } : {});
-    return { stdout: result.stdout, stderr: result.stderr, code: result.code ?? 1 };
+  return map;
+}
+async function runConfigSfdc() {
+  intro4("Lead Routing \u2014 Salesforce Configuration");
+  const dir = findInstallDir();
+  if (!dir) {
+    log12.error("No lead-routing installation found in the current directory.");
+    log12.info("Run `lead-routing init` first, or cd into your installation directory.");
+    process.exit(1);
   }
-  /**
-   * Create a remote directory (including parents).
-   */
-  async mkdir(remotePath) {
-    await this.exec(`mkdir -p ${remotePath}`);
+  log12.info(
+    "Salesforce credentials are now managed automatically via the managed package.\nNo manual configuration is needed.\n\nIf you need to reconnect Salesforce, go to the web app \u2192 Settings \u2192 Connect Salesforce."
+  );
+  outro4("No changes needed.");
+}
+function runConfigShow() {
+  const dir = findInstallDir();
+  if (!dir) {
+    console.error("No lead-routing installation found in the current directory.");
+    process.exit(1);
   }
-  /**
-   * Upload local files to the remote server via SFTP.
-   */
-  async upload(files) {
-    await this.ssh.putFiles(files);
+  const envWeb = join6(dir, ".env.web");
+  const cfg = parseEnv(envWeb);
+  const adminSecret = cfg.get("ADMIN_SECRET") ?? "(not found)";
+  const appUrl = cfg.get("APP_URL") ?? "(not found)";
+  console.log();
+  console.log(chalk4.bold("Lead Routing \u2014 Installation Config"));
+  console.log();
+  console.log(`  Admin panel:   ${chalk4.cyan(appUrl + "/admin")}`);
+  console.log(`  Admin secret:  ${chalk4.yellow(adminSecret)}`);
+  console.log();
+}
+
+// src/commands/sfdc.ts
+import { intro as intro5, outro as outro5, text as text3, log as log15 } from "@clack/prompts";
+import chalk6 from "chalk";
+
+// src/steps/sfdc-deploy-inline.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync5, cpSync, rmSync } from "fs";
+import { join as join8, dirname as dirname2 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { execSync } from "child_process";
+import { spinner as spinner5, log as log13 } from "@clack/prompts";
+
+// src/utils/sfdc-api.ts
+var API_VERSION = "v59.0";
+var SalesforceApi = class {
+  constructor(instanceUrl, accessToken) {
+    this.instanceUrl = instanceUrl;
+    this.accessToken = accessToken;
+    this.baseUrl = `${instanceUrl.replace(/\/+$/, "")}/services/data/${API_VERSION}`;
   }
-  /**
-   * Resolve ~ in a remote path by querying $HOME on the server.
-   */
-  async resolveHome(remotePath) {
-    if (!remotePath.startsWith("~")) return remotePath;
-    const { stdout } = await this.exec("echo $HOME");
-    return stdout.trim() + remotePath.slice(1);
+  baseUrl;
+  headers(extra) {
+    return {
+      Authorization: `Bearer ${this.accessToken}`,
+      "Content-Type": "application/json",
+      ...extra
+    };
+  }
+  /** Execute a SOQL query and return records */
+  async query(soql) {
+    const url = `${this.baseUrl}/query?q=${encodeURIComponent(soql)}`;
+    const res = await fetch(url, { headers: this.headers() });
+    if (!res.ok) {
+      const body = await res.text();
+      throw new Error(`SOQL query failed (${res.status}): ${body}`);
+    }
+    const data = await res.json();
+    return data.records;
+  }
+  /** Create an sObject record, returns the new record ID */
+  async create(sobject, data) {
+    const url = `${this.baseUrl}/sobjects/${sobject}`;
+    const res = await fetch(url, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(data)
+    });
+    if (!res.ok) {
+      const body = await res.text();
+      if (res.status === 400 && body.includes("Duplicate")) {
+        throw new DuplicateError(body);
+      }
+      throw new Error(`Create ${sobject} failed (${res.status}): ${body}`);
+    }
+    const result = await res.json();
+    return result.id;
+  }
+  /** Update an sObject record */
+  async update(sobject, id, data) {
+    const url = `${this.baseUrl}/sobjects/${sobject}/${id}`;
+    const res = await fetch(url, {
+      method: "PATCH",
+      headers: this.headers(),
+      body: JSON.stringify(data)
+    });
+    if (!res.ok) {
+      const body = await res.text();
+      throw new Error(`Update ${sobject}/${id} failed (${res.status}): ${body}`);
+    }
+  }
+  /** Get current user info (for permission set assignment) */
+  async getCurrentUserId() {
+    const url = `${this.instanceUrl.replace(/\/+$/, "")}/services/oauth2/userinfo`;
+    const res = await fetch(url, {
+      headers: { Authorization: `Bearer ${this.accessToken}` }
+    });
+    if (!res.ok) {
+      const body = await res.text();
+      throw new Error(`Get current user failed (${res.status}): ${body}`);
+    }
+    const data = await res.json();
+    return data.user_id;
   }
   /**
-   * Open an SSH port-forward tunnel.
-   * Creates a local TCP server that pipes connections through to
-   * localhost:{remotePort} on the remote machine.
-   *
-   * Returns the local port and a close() function.
-   * Call close() when migrations are done.
+   * Deploy metadata using the Source Deploy API (same API that `sf project deploy start` uses).
+   * Accepts a ZIP buffer containing the source-format package.
+   * Returns the deploy request ID for polling.
    */
-  async tunnel(remotePort) {
-    const sshClient = this.ssh.connection;
-    if (!sshClient) throw new Error("SSH not connected \u2014 cannot open tunnel");
-    const server = net.createServer((socket) => {
-      ;
-      sshClient.forwardOut(
-        "127.0.0.1",
-        0,
-        "localhost",
-        remotePort,
-        (err, stream) => {
-          if (err) {
-            socket.destroy();
-            return;
-          }
-          socket.pipe(stream);
-          stream.pipe(socket);
-          socket.on("close", () => stream.destroy());
-          stream.on("close", () => socket.destroy());
-        }
-      );
+  async deployMetadata(zipBuffer) {
+    const url = `${this.baseUrl}/metadata/deployRequest`;
+    const boundary = `----FormBoundary${Date.now()}`;
+    const deployOptions = JSON.stringify({
+      deployOptions: {
+        rollbackOnError: true,
+        singlePackage: true
+      }
     });
-    return new Promise((resolve, reject) => {
-      server.listen(0, "127.0.0.1", () => {
-        const { port } = server.address();
-        resolve({
-          localPort: port,
-          close: () => server.close()
-        });
-      });
-      server.on("error", reject);
+    const parts = [];
+    parts.push(
+      Buffer.from(
+        `--${boundary}\r
+Content-Disposition: form-data; name="json"\r
+Content-Type: application/json\r
+\r
+${deployOptions}\r
+`
+      )
+    );
+    parts.push(
+      Buffer.from(
+        `--${boundary}\r
+Content-Disposition: form-data; name="file"; filename="deploy.zip"\r
+Content-Type: application/zip\r
+\r
+`
+      )
+    );
+    parts.push(zipBuffer);
+    parts.push(Buffer.from(`\r
+--${boundary}--\r
+`));
+    const body = Buffer.concat(parts);
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.accessToken}`,
+        "Content-Type": `multipart/form-data; boundary=${boundary}`
+      },
+      body
     });
+    if (!res.ok) {
+      const text4 = await res.text();
+      throw new Error(
+        `Metadata deploy request failed (${res.status}): ${text4}`
+      );
+    }
+    const result = await res.json();
+    return result.id;
   }
-  async disconnect() {
-    if (this._connected) {
-      this.ssh.dispose();
-      this._connected = false;
+  /**
+   * Poll deploy status until complete.
+   * Returns deploy result with success/failure info.
+   */
+  async waitForDeploy(deployId, timeoutMs = 3e5) {
+    const startTime = Date.now();
+    const pollInterval = 3e3;
+    while (Date.now() - startTime < timeoutMs) {
+      const url = `${this.baseUrl}/metadata/deployRequest/${deployId}?includeDetails=true`;
+      const res = await fetch(url, { headers: this.headers() });
+      if (!res.ok) {
+        const text4 = await res.text();
+        throw new Error(
+          `Deploy status check failed (${res.status}): ${text4}`
+        );
+      }
+      const data = await res.json();
+      const result = data.deployResult;
+      if (result.done) {
+        return result;
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
     }
+    throw new Error(`Deploy timed out after ${timeoutMs / 1e3}s`);
+  }
+};
+var DuplicateError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DuplicateError";
   }
 };
 
-// src/commands/init.ts
-async function checkDnsResolvable(appUrl, engineUrl) {
-  let hosts;
+// src/utils/zip-source.ts
+import { join as join7 } from "path";
+import { readdirSync, readFileSync as readFileSync5, existsSync as existsSync4 } from "fs";
+import archiver from "archiver";
+var META_TYPE_MAP = {
+  applications: "CustomApplication",
+  classes: "ApexClass",
+  triggers: "ApexTrigger",
+  lwc: "LightningComponentBundle",
+  permissionsets: "PermissionSet",
+  namedCredentials: "NamedCredential",
+  remoteSiteSettings: "RemoteSiteSetting",
+  tabs: "CustomTab"
+};
+async function zipSourcePackage(packageDir) {
+  const forceAppDefault = join7(packageDir, "force-app", "main", "default");
+  let apiVersion = "59.0";
   try {
-    hosts = [.../* @__PURE__ */ new Set([new URL(appUrl).hostname, new URL(engineUrl).hostname])];
+    const proj = JSON.parse(readFileSync5(join7(packageDir, "sfdx-project.json"), "utf8"));
+    if (proj.sourceApiVersion) apiVersion = proj.sourceApiVersion;
   } catch {
-    return;
-  }
-  for (const host of hosts) {
-    try {
-      await dns.lookup(host);
-    } catch {
-      log9.warn(
-        `${chalk2.yellow(host)} does not resolve in DNS yet.
-  Check for typos \u2014 a bad domain will cause a 2-minute timeout at step 8.`
-      );
-      const go = await confirm2({ message: "Continue anyway?", initialValue: true });
-      if (isCancel4(go) || !go) {
-        cancel3("Setup cancelled.");
-        process.exit(0);
-      }
-    }
   }
-}
-async function runInit(options = {}) {
-  const dryRun = options.dryRun ?? false;
-  const resume = options.resume ?? false;
-  console.log();
-  intro(
-    chalk2.bold.cyan("Lead Routing \u2014 Self-Hosted Setup") + (dryRun ? chalk2.yellow("  [dry run]") : "") + (resume ? chalk2.yellow("  [resume]") : "")
-  );
-  const ssh = new SshConnection();
-  if (resume) {
-    try {
-      const dir = findInstallDir();
-      if (!dir) {
-        log9.error("No lead-routing.json found \u2014 run `lead-routing init` first.");
-        process.exit(1);
+  const members = /* @__PURE__ */ new Map();
+  const addMember = (type, name) => {
+    if (!members.has(type)) members.set(type, /* @__PURE__ */ new Set());
+    members.get(type).add(name);
+  };
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const archive = archiver("zip", { zlib: { level: 9 } });
+    archive.on("data", (chunk) => chunks.push(chunk));
+    archive.on("end", () => resolve(Buffer.concat(chunks)));
+    archive.on("error", reject);
+    for (const [dirName, metaType] of Object.entries(META_TYPE_MAP)) {
+      const srcDir = join7(forceAppDefault, dirName);
+      if (!existsSync4(srcDir)) continue;
+      const entries = readdirSync(srcDir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (dirName === "lwc" && entry.isDirectory()) {
+          addMember(metaType, entry.name);
+          archive.directory(join7(srcDir, entry.name), `${dirName}/${entry.name}`);
+        } else if (entry.isFile()) {
+          archive.file(join7(srcDir, entry.name), { name: `${dirName}/${entry.name}` });
+          if (!entry.name.endsWith("-meta.xml")) {
+            const memberName = entry.name.replace(/\.[^.]+$/, "");
+            addMember(metaType, memberName);
+          }
+        }
       }
-      const saved = readConfig(dir);
-      let sshPassword;
-      if (!saved.ssh.privateKeyPath) {
-        const pw = await promptPassword({
-          message: `SSH password for ${saved.ssh.username}@${saved.ssh.host}`
+    }
+    const objectsDir = join7(forceAppDefault, "objects");
+    if (existsSync4(objectsDir)) {
+      for (const objEntry of readdirSync(objectsDir, { withFileTypes: true })) {
+        if (!objEntry.isDirectory()) continue;
+        const objName = objEntry.name;
+        addMember("CustomObject", objName);
+        const objDir = join7(objectsDir, objName);
+        const objectXml = mergeObjectXml(objDir, objName, apiVersion);
+        archive.append(Buffer.from(objectXml, "utf8"), {
+          name: `objects/${objName}.object`
         });
-        if (typeof pw === "symbol") process.exit(0);
-        sshPassword = pw;
       }
-      log9.step("Connecting to server");
-      await ssh.connect({
-        host: saved.ssh.host,
-        port: saved.ssh.port,
-        username: saved.ssh.username,
-        privateKeyPath: saved.ssh.privateKeyPath,
-        password: sshPassword,
-        remoteDir: saved.remoteDir
-      });
-      log9.success(`Connected to ${saved.ssh.host}`);
-      const remoteDir = await ssh.resolveHome(saved.remoteDir);
-      log9.step("Step 7/8  Verifying health");
-      await verifyHealth(saved.appUrl, saved.engineUrl, ssh, remoteDir);
-      log9.step("Step 8/8  Deploying Salesforce package");
-      await sfdcDeployInline({
-        appUrl: saved.appUrl,
-        engineUrl: saved.engineUrl,
-        orgAlias: "lead-routing",
-        sfdcClientId: saved.sfdcClientId ?? "",
-        sfdcLoginUrl: saved.sfdcLoginUrl ?? "https://login.salesforce.com",
-        installDir: dir,
-        webhookSecret: saved.engineWebhookSecret
-      });
-      await guideAppLauncherSetup(saved.appUrl);
-      outro(
-        chalk2.green("\u2714  You're live!") + `
-
-  Dashboard:      ${chalk2.cyan(saved.appUrl)}
-  Routing engine: ${chalk2.cyan(saved.engineUrl)}
-
-` + chalk2.bold("  Next steps:\n") + `  ${chalk2.cyan("1.")} Open ${chalk2.cyan(saved.appUrl)} and log in
-  ${chalk2.cyan("2.")} Create your first routing rule to start routing leads
-
-  Run ${chalk2.cyan("lead-routing doctor")} to check service health at any time.
-  Run ${chalk2.cyan("lead-routing deploy")} to update to a new version.`
-      );
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      log9.error(`Resume failed: ${message}`);
-      process.exit(1);
-    } finally {
-      await ssh.disconnect();
     }
-    return;
+    const packageXml = generatePackageXml(members, apiVersion);
+    archive.append(Buffer.from(packageXml, "utf8"), { name: "package.xml" });
+    archive.finalize();
+  });
+}
+function mergeObjectXml(objDir, objName, apiVersion) {
+  const lines = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">'
+  ];
+  const objMetaPath = join7(objDir, `${objName}.object-meta.xml`);
+  if (existsSync4(objMetaPath)) {
+    const content = readFileSync5(objMetaPath, "utf8");
+    const inner = content.replace(/<\?xml[^?]*\?>\s*/g, "").replace(/<CustomObject[^>]*>/g, "").replace(/<\/CustomObject>/g, "").trim();
+    if (inner) lines.push(inner);
   }
-  try {
-    log9.step("Step 1/8  Checking local prerequisites");
-    await checkPrerequisites();
-    log9.step("Step 2/8  SSH connection");
-    const sshCfg = await collectSshConfig({
-      sshPort: options.sshPort,
-      sshUser: options.sshUser,
-      sshKey: options.sshKey,
-      remoteDir: options.remoteDir
-    });
-    if (!dryRun) {
-      try {
-        await ssh.connect(sshCfg);
-        log9.success(`Connected to ${sshCfg.host}`);
-      } catch (err) {
-        log9.error(`SSH connection failed: ${String(err)}`);
-        log9.info("Check your password and re-run `lead-routing init`.");
-        process.exit(1);
+  const fieldsDir = join7(objDir, "fields");
+  if (existsSync4(fieldsDir)) {
+    for (const fieldFile of readdirSync(fieldsDir).sort()) {
+      if (!fieldFile.endsWith(".field-meta.xml")) continue;
+      const content = readFileSync5(join7(fieldsDir, fieldFile), "utf8");
+      const inner = content.replace(/<\?xml[^?]*\?>\s*/g, "").replace(/<CustomField[^>]*>/g, "").replace(/<\/CustomField>/g, "").trim();
+      if (inner) {
+        lines.push("    <fields>");
+        lines.push(`        ${inner}`);
+        lines.push("    </fields>");
       }
     }
-    log9.step("Step 3/8  Configuration");
-    const cfg = await collectConfig({
-      sandbox: options.sandbox,
-      externalDb: options.externalDb,
-      externalRedis: options.externalRedis
-    });
-    await checkDnsResolvable(cfg.appUrl, cfg.engineUrl);
-    log9.step("Step 4/8  Generating config files");
-    const { dir, adminSecret } = generateFiles(cfg, sshCfg);
-    note4(
-      `Local config directory: ${chalk2.cyan(dir)}
-Files created: docker-compose.yml, Caddyfile, .env.web, .env.engine, lead-routing.json`,
-      "Files"
-    );
-    if (dryRun) {
-      outro(
-        chalk2.yellow("Dry run complete \u2014 no connection made, no services started.") + `
-
-  Config files written to: ${chalk2.cyan(dir)}
-
-  When ready, run ${chalk2.cyan("lead-routing init")} (without --dry-run) to deploy.`
-      );
-      return;
-    }
-    log9.step("Step 5/8  Remote setup");
-    const remoteDir = await ssh.resolveHome(sshCfg.remoteDir);
-    await checkRemotePrerequisites(ssh);
-    await uploadFiles(ssh, dir, remoteDir);
-    log9.step("Step 6/8  Starting services");
-    await startServices(ssh, remoteDir);
-    log9.step("Step 7/8  Verifying health");
-    await verifyHealth(cfg.appUrl, cfg.engineUrl, ssh, remoteDir);
-    try {
-      const envWebPath = join6(dir, ".env.web");
-      const envContent = readFileSync5(envWebPath, "utf-8");
-      const cleaned = envContent.split("\n").filter((line) => !line.startsWith("ADMIN_PASSWORD=")).join("\n");
-      writeFileSync4(envWebPath, cleaned, "utf-8");
-      log9.success("Removed ADMIN_PASSWORD from .env.web (no longer needed after seed)");
-    } catch {
-    }
-    log9.step("Step 8/8  Deploying Salesforce package");
-    await sfdcDeployInline({
-      appUrl: cfg.appUrl,
-      engineUrl: cfg.engineUrl,
-      orgAlias: "lead-routing",
-      sfdcClientId: cfg.sfdcClientId,
-      sfdcLoginUrl: cfg.sfdcLoginUrl,
-      installDir: dir,
-      webhookSecret: cfg.engineWebhookSecret
-    });
-    await guideAppLauncherSetup(cfg.appUrl);
-    outro(
-      chalk2.green("\u2714  You're live!") + `
-
-  Dashboard:      ${chalk2.cyan(cfg.appUrl)}
-  Routing engine: ${chalk2.cyan(cfg.engineUrl)}
-
-  Admin email:    ${chalk2.white(cfg.adminEmail)}
-  Admin secret:   ${chalk2.yellow(adminSecret)}
-                  ${chalk2.dim("run `lead-routing config show` to retrieve later")}
-
-` + chalk2.bold("  Next steps:\n") + `  ${chalk2.cyan("1.")} Open ${chalk2.cyan(cfg.appUrl)} and log in
-  ${chalk2.cyan("2.")} Create your first routing rule to start routing leads
-
-  Run ${chalk2.cyan("lead-routing doctor")} to check service health at any time.
-  Run ${chalk2.cyan("lead-routing deploy")} to update to a new version.`
-    );
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    log9.error(`Setup failed: ${message}`);
-    process.exit(1);
-  } finally {
-    await ssh.disconnect();
   }
+  lines.push("</CustomObject>");
+  return lines.join("\n");
 }
-
-// src/commands/deploy.ts
-import { writeFileSync as writeFileSync5, unlinkSync } from "fs";
-import { join as join7 } from "path";
-import { tmpdir as tmpdir2 } from "os";
-import { intro as intro2, outro as outro2, log as log10, password as promptPassword2 } from "@clack/prompts";
-import chalk3 from "chalk";
-async function runDeploy() {
-  console.log();
-  intro2(chalk3.bold.cyan("Lead Routing \u2014 Deploy"));
-  const dir = findInstallDir();
-  if (!dir) {
-    log10.error(
-      "No lead-routing.json found. Run `lead-routing init` first, or run this command from your install directory."
-    );
-    process.exit(1);
-  }
-  const cfg = readConfig(dir);
-  const ssh = new SshConnection();
-  let sshPassword;
-  if (!cfg.ssh.privateKeyPath) {
-    const pw = await promptPassword2({
-      message: `SSH password for ${cfg.ssh.username}@${cfg.ssh.host}`
-    });
-    if (typeof pw === "symbol") process.exit(0);
-    sshPassword = pw;
-  }
-  try {
-    await ssh.connect({
-      host: cfg.ssh.host,
-      port: cfg.ssh.port,
-      username: cfg.ssh.username,
-      privateKeyPath: cfg.ssh.privateKeyPath,
-      password: sshPassword,
-      remoteDir: cfg.remoteDir
-    });
-    log10.success(`Connected to ${cfg.ssh.host}`);
-  } catch (err) {
-    log10.error(`SSH connection failed: ${String(err)}`);
-    process.exit(1);
-  }
-  try {
-    const remoteDir = await ssh.resolveHome(cfg.remoteDir);
-    log10.step("Syncing Caddyfile");
-    const caddyContent = renderCaddyfile(cfg.appUrl, cfg.engineUrl);
-    const tmpCaddy = join7(tmpdir2(), "lead-routing-Caddyfile");
-    writeFileSync5(tmpCaddy, caddyContent, "utf8");
-    await ssh.upload([{ local: tmpCaddy, remote: `${remoteDir}/Caddyfile` }]);
-    unlinkSync(tmpCaddy);
-    await ssh.exec("docker compose restart caddy", remoteDir);
-    log10.success("Caddyfile synced \u2014 waiting for TLS cert (~30s)");
-    log10.step("Pulling latest Docker images");
-    await ssh.exec("docker compose pull", remoteDir);
-    log10.success("Images pulled");
-    log10.step("Restarting services");
-    await ssh.exec("docker compose up -d --remove-orphans", remoteDir);
-    log10.success("Services restarted");
-    outro2(
-      chalk3.green("\u2714  Deployment complete!") + `
-
-  ${chalk3.cyan(cfg.appUrl)}`
-    );
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    log10.error(`Deploy failed: ${message}`);
-    process.exit(1);
-  } finally {
-    await ssh.disconnect();
+function generatePackageXml(members, apiVersion) {
+  const lines = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<Package xmlns="http://soap.sforce.com/2006/04/metadata">'
+  ];
+  for (const [metaType, names] of [...members.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    lines.push("    <types>");
+    for (const name of [...names].sort()) {
+      lines.push(`        <members>${name}</members>`);
+    }
+    lines.push(`        <name>${metaType}</name>`);
+    lines.push("    </types>");
   }
+  lines.push(`    <version>${apiVersion}</version>`);
+  lines.push("</Package>");
+  return lines.join("\n");
 }
 
-// src/commands/doctor.ts
-import { intro as intro3, outro as outro3, log as log11 } from "@clack/prompts";
-import chalk4 from "chalk";
-import { execa } from "execa";
-async function runDoctor() {
-  console.log();
-  intro3(chalk4.bold.cyan("Lead Routing \u2014 Health Check"));
-  const dir = findInstallDir();
-  if (!dir) {
-    log11.error("No lead-routing.json found. Run `lead-routing init` first.");
-    process.exit(1);
+// src/steps/sfdc-deploy-inline.ts
+var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
+function patchXml(content, tag, value) {
+  const re = new RegExp(`(<${tag}>)[^<]*(</\\s*${tag}>)`, "g");
+  return content.replace(re, `$1${value}$2`);
+}
+async function sfdcDeployInline(params) {
+  const { appUrl, engineUrl, installDir } = params;
+  const s = spinner5();
+  const { accessToken, instanceUrl } = await loginViaAppBridge(appUrl);
+  const sf = new SalesforceApi(instanceUrl, accessToken);
+  s.start("Copying Salesforce package\u2026");
+  const inDist = join8(__dirname2, "sfdc-package");
+  const nextToDist = join8(__dirname2, "..", "sfdc-package");
+  const bundledPkg = existsSync5(inDist) ? inDist : nextToDist;
+  const destPkg = join8(installDir ?? tmpdir2(), "lead-routing-sfdc-package");
+  if (!existsSync5(bundledPkg)) {
+    s.stop("sfdc-package not found in CLI bundle");
+    throw new Error(
+      `Expected bundle at: ${inDist}
+The CLI may need to be reinstalled: npm i -g @lead-routing/cli`
+    );
   }
-  const cfg = readConfig(dir);
-  const checks = [];
-  checks.push(await checkDockerDaemon());
-  const containers = ["web", "engine"];
-  if (cfg.dockerManaged.db) containers.push("postgres");
-  if (cfg.dockerManaged.redis) containers.push("redis");
-  for (const name of containers) {
-    checks.push(await checkContainer(name, dir));
+  if (existsSync5(destPkg)) rmSync(destPkg, { recursive: true, force: true });
+  cpSync(bundledPkg, destPkg, { recursive: true });
+  s.stop("Package copied");
+  const ncPath = join8(
+    destPkg,
+    "force-app",
+    "main",
+    "default",
+    "namedCredentials",
+    "RoutingEngine.namedCredential-meta.xml"
+  );
+  if (existsSync5(ncPath)) {
+    const nc = patchXml(readFileSync6(ncPath, "utf8"), "endpoint", engineUrl);
+    writeFileSync6(ncPath, nc, "utf8");
   }
-  checks.push(await checkEndpoint("Web app", `${cfg.appUrl}/api/health`));
-  checks.push(await checkEndpoint("Routing engine", `${cfg.engineUrl}/health`));
-  console.log();
-  for (const c of checks) {
-    const icon = c.pass ? chalk4.green("\u2714") : chalk4.red("\u2717");
-    const label = c.pass ? chalk4.white(c.label) : chalk4.red(c.label);
-    const detail = c.detail ? chalk4.dim(` \u2014 ${c.detail}`) : "";
-    console.log(`  ${icon}  ${label}${detail}`);
+  const rssEnginePath = join8(
+    destPkg,
+    "force-app",
+    "main",
+    "default",
+    "remoteSiteSettings",
+    "LeadRouterEngine.remoteSite-meta.xml"
+  );
+  if (existsSync5(rssEnginePath)) {
+    let rss = patchXml(readFileSync6(rssEnginePath, "utf8"), "url", engineUrl);
+    rss = patchXml(rss, "description", "Lead Router Engine endpoint");
+    writeFileSync6(rssEnginePath, rss, "utf8");
   }
-  console.log();
-  const failed = checks.filter((c) => !c.pass);
-  if (failed.length === 0) {
-    outro3(chalk4.green("All checks passed"));
-  } else {
-    outro3(chalk4.yellow(`${failed.length} check(s) failed`));
-    process.exit(1);
+  const rssAppPath = join8(
+    destPkg,
+    "force-app",
+    "main",
+    "default",
+    "remoteSiteSettings",
+    "LeadRouterApp.remoteSite-meta.xml"
+  );
+  if (existsSync5(rssAppPath)) {
+    let rss = patchXml(readFileSync6(rssAppPath, "utf8"), "url", appUrl);
+    rss = patchXml(rss, "description", "Lead Router App URL");
+    writeFileSync6(rssAppPath, rss, "utf8");
   }
-}
-async function checkDockerDaemon() {
+  log13.success("Remote Site Settings patched");
+  s.start("Deploying Salesforce package (this may take ~2 min)\u2026");
   try {
-    await execa("docker", ["info"], { reject: true });
-    return { label: "Docker daemon", pass: true };
-  } catch {
-    return { label: "Docker daemon", pass: false, detail: "not running" };
+    const zipBuffer = await zipSourcePackage(destPkg);
+    const deployId = await sf.deployMetadata(zipBuffer);
+    const result = await sf.waitForDeploy(deployId);
+    if (!result.success) {
+      const failures = result.details?.componentFailures ?? [];
+      const failureMsg = failures.map((f) => `  ${f.componentType}/${f.fullName}: ${f.problem}`).join("\n");
+      s.stop("Deployment failed");
+      throw new Error(
+        `Metadata deploy failed (${result.numberComponentErrors} error(s)):
+${failureMsg || result.errorMessage || "Unknown error"}`
+      );
+    }
+    s.stop(`Package deployed (${result.numberComponentsDeployed} components)`);
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Metadata deploy failed")) {
+      throw err;
+    }
+    s.stop("Deployment failed");
+    throw new Error(
+      `Metadata deploy failed: ${String(err)}
+
+  The patched package is at: ${destPkg}
+  You can retry with: sf project deploy start --source-dir force-app`
+    );
   }
-}
-async function checkContainer(name, dir) {
+  s.start("Assigning LeadRouterAdmin permission set\u2026");
   try {
-    const result = await execa(
-      "docker",
-      ["compose", "ps", "--format", "json", name],
-      { cwd: dir, reject: false }
+    const permSets = await sf.query(
+      "SELECT Id FROM PermissionSet WHERE Name = 'LeadRouterAdmin' LIMIT 1"
     );
-    const output = result.stdout.trim();
-    if (!output) {
-      return { label: `Container: ${name}`, pass: false, detail: "not found" };
-    }
-    const rows = output.split("\n").map((l) => {
+    if (permSets.length === 0) {
+      s.stop("LeadRouterAdmin permission set not found (non-fatal)");
+      log13.warn("The permission set may not have been included in the deploy.");
+    } else {
+      const userId = await sf.getCurrentUserId();
       try {
-        return JSON.parse(l);
-      } catch {
-        return null;
+        await sf.create("PermissionSetAssignment", {
+          AssigneeId: userId,
+          PermissionSetId: permSets[0].Id
+        });
+        s.stop("Permission set assigned \u2014 Lead Router Setup will appear in the App Launcher");
+      } catch (err) {
+        if (err instanceof DuplicateError) {
+          s.stop("Permission set already assigned");
+        } else {
+          throw err;
+        }
       }
-    }).filter(Boolean);
-    const running = rows.some(
-      (r) => r.State === "running" || r.Status && r.Status.toLowerCase().includes("up")
+    }
+  } catch (err) {
+    if (!(err instanceof DuplicateError)) {
+      s.stop("Permission set assignment failed (non-fatal)");
+      log13.warn(String(err));
+      log13.info(
+        "Grant access manually:\n  Salesforce Setup \u2192 Users \u2192 Permission Sets \u2192 Lead Router Admin \u2192 Manage Assignments"
+      );
+    }
+  }
+  s.start("Writing org settings to Routing_Settings__c\u2026");
+  try {
+    const existing = await sf.query(
+      "SELECT Id FROM Routing_Settings__c LIMIT 1"
     );
-    return {
-      label: `Container: ${name}`,
-      pass: running,
-      detail: running ? "running" : "not running"
+    const settingsData = {
+      App_Url__c: appUrl,
+      Engine_Endpoint__c: engineUrl
     };
-  } catch {
-    return { label: `Container: ${name}`, pass: false, detail: "error checking status" };
+    if (params.webhookSecret) {
+      settingsData.Webhook_Secret__c = params.webhookSecret;
+    }
+    if (existing.length > 0) {
+      await sf.update("Routing_Settings__c", existing[0].Id, settingsData);
+    } else {
+      await sf.create("Routing_Settings__c", settingsData);
+    }
+    s.stop("Org settings written");
+  } catch (err) {
+    s.stop("Org settings write failed (non-fatal)");
+    log13.warn(String(err));
+    log13.info("Set manually: Salesforce \u2192 Custom Settings \u2192 Routing Settings \u2192 Manage");
   }
 }
-async function checkEndpoint(label, url) {
+async function loginViaAppBridge(rawAppUrl) {
+  const appUrl = rawAppUrl.replace(/\/+$/, "");
+  const s = spinner5();
+  s.start("Starting Salesforce authentication via your Lead Router app\u2026");
+  let sessionId;
+  let authUrl;
   try {
-    const res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
-    return {
-      label: `Health: ${label}`,
-      pass: res.ok,
-      detail: `HTTP ${res.status}`
-    };
+    const res = await fetch(`${appUrl}/api/cli-auth/request`, { method: "POST" });
+    if (!res.ok) {
+      s.stop("Failed to start auth session");
+      throw new Error(
+        `Could not reach ${appUrl}/api/cli-auth/request (HTTP ${res.status}).
+Make sure the web app is running and accessible.`
+      );
+    }
+    const data = await res.json();
+    sessionId = data.sessionId;
+    authUrl = data.authUrl;
   } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    return { label: `Health: ${label}`, pass: false, detail };
+    s.stop("Could not reach Lead Router app");
+    throw new Error(
+      `Failed to connect to ${appUrl}: ${String(err)}
+Ensure the app is running and the URL is correct.`
+    );
   }
-}
+  s.stop("Auth session started");
+  log13.info(`Open this URL in your browser to authenticate with Salesforce:
 
-// src/commands/logs.ts
-import { log as log12 } from "@clack/prompts";
-import { execa as execa2 } from "execa";
-var VALID_SERVICES = ["web", "engine", "postgres", "redis"];
-async function runLogs(service = "engine") {
-  if (!VALID_SERVICES.includes(service)) {
-    log12.error(`Unknown service "${service}". Valid options: ${VALID_SERVICES.join(", ")}`);
-    process.exit(1);
-  }
-  const dir = findInstallDir();
-  if (!dir) {
-    log12.error("No lead-routing.json found. Run `lead-routing init` first.");
-    process.exit(1);
-  }
-  console.log(`
-Streaming logs for ${service} (Ctrl+C to stop)...
+  ${authUrl}
 `);
-  const child = execa2("docker", ["compose", "logs", "-f", "--tail=100", service], {
-    cwd: dir,
-    stdio: "inherit",
-    reject: false
-  });
-  await child;
-}
-
-// src/commands/status.ts
-import { log as log13 } from "@clack/prompts";
-import { execa as execa3 } from "execa";
-async function runStatus() {
-  const dir = findInstallDir();
-  if (!dir) {
-    log13.error("No lead-routing.json found. Run `lead-routing init` first.");
-    process.exit(1);
+  log13.info('If Chrome shows a "Dangerous site" warning with no proceed option, paste the URL into Safari or Firefox.');
+  const opener = process.platform === "win32" ? "start" : process.platform === "darwin" ? "open" : "xdg-open";
+  try {
+    execSync(`${opener} "${authUrl}"`, { stdio: "ignore" });
+  } catch {
   }
-  const result = await execa3("docker", ["compose", "ps"], {
-    cwd: dir,
-    stdio: "inherit",
-    reject: false
-  });
-  if (result.exitCode !== 0) {
-    log13.error("Failed to get container status. Is Docker running?");
-    process.exit(1);
+  s.start("Waiting for Salesforce authentication in browser\u2026");
+  const maxPolls = 150;
+  let accessToken;
+  let instanceUrl;
+  for (let i = 0; i < maxPolls; i++) {
+    await new Promise((r) => setTimeout(r, 2e3));
+    try {
+      const pollRes = await fetch(`${appUrl}/api/cli-auth/poll/${sessionId}`);
+      if (pollRes.status === 410) {
+        s.stop("Auth session expired");
+        throw new Error("CLI auth session expired. Please re-run the command.");
+      }
+      const data = await pollRes.json();
+      if (data.status === "ok") {
+        accessToken = data.accessToken;
+        instanceUrl = data.instanceUrl;
+        break;
+      }
+    } catch (err) {
+      if (String(err).includes("session expired")) throw err;
+    }
+  }
+  if (!accessToken || !instanceUrl) {
+    s.stop("Timed out");
+    throw new Error(
+      "Timed out waiting for Salesforce authentication (5 minutes).\nPlease re-run the command and complete login within 5 minutes."
+    );
   }
+  s.stop("Authenticated with Salesforce");
+  return { accessToken, instanceUrl };
 }
 
-// src/commands/config.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync5 } from "fs";
-import { join as join8 } from "path";
-import { intro as intro4, outro as outro4, text as text3, password as password3, spinner as spinner6, log as log14 } from "@clack/prompts";
+// src/steps/app-launcher-guide.ts
+import { note as note4, confirm as confirm2, isCancel as isCancel4, log as log14 } from "@clack/prompts";
 import chalk5 from "chalk";
-import { execa as execa4 } from "execa";
-function parseEnv(filePath) {
-  const map = /* @__PURE__ */ new Map();
-  if (!existsSync5(filePath)) return map;
-  for (const line of readFileSync6(filePath, "utf8").split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq === -1) continue;
-    map.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
-  }
-  return map;
-}
-function writeEnv(filePath, updates) {
-  const lines = existsSync5(filePath) ? readFileSync6(filePath, "utf8").split("\n") : [];
-  const updated = /* @__PURE__ */ new Set();
-  const result = lines.map((line) => {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) return line;
-    const eq = trimmed.indexOf("=");
-    if (eq === -1) return line;
-    const key = trimmed.slice(0, eq);
-    if (key in updates) {
-      updated.add(key);
-      return `${key}=${updates[key]}`;
-    }
-    return line;
-  });
-  for (const [key, val] of Object.entries(updates)) {
-    if (!updated.has(key)) result.push(`${key}=${val}`);
-  }
-  writeFileSync6(filePath, result.join("\n"), "utf8");
-}
-async function runConfigSfdc() {
-  intro4("Lead Routing \u2014 Update Salesforce Credentials");
-  const dir = findInstallDir();
-  if (!dir) {
-    log14.error("No lead-routing installation found in the current directory.");
-    log14.info("Run `lead-routing init` first, or cd into your installation directory.");
-    process.exit(1);
-  }
-  const envWeb = join8(dir, ".env.web");
-  const envEngine = join8(dir, ".env.engine");
-  const currentWeb = parseEnv(envWeb);
-  const currentClientId = currentWeb.get("SFDC_CLIENT_ID") ?? "";
-  const currentLoginUrl = currentWeb.get("SFDC_LOGIN_URL") ?? "https://login.salesforce.com";
-  const currentAppUrl = currentWeb.get("APP_URL") ?? "";
-  const callbackUrl = `${currentAppUrl}/api/auth/callback`;
-  log14.info(
-    `Paste the credentials from your Salesforce Connected App.
-Callback URL for your Connected App: ${callbackUrl}`
+async function guideAppLauncherSetup(appUrl) {
+  note4(
+    `Complete the following steps in Salesforce now:
+
+  ${chalk5.cyan("1.")} Open ${chalk5.bold("App Launcher")} (grid icon, top-left in Salesforce)
+  ${chalk5.cyan("2.")} Search for ${chalk5.white('"Lead Router Setup"')} and click it
+  ${chalk5.cyan("3.")} Click ${chalk5.white('"Connect to Lead Router"')}
+     \u2192 You will be redirected to ${chalk5.dim(appUrl)} and back
+     \u2192 Authorize the OAuth connection when prompted
+
+  ${chalk5.cyan("4.")} ${chalk5.bold("Step 1")} \u2014 wait for the ${chalk5.green('"Connected"')} checkmark (~5 sec)
+  ${chalk5.cyan("5.")} ${chalk5.bold("Step 2")} \u2014 click ${chalk5.white("Activate")} to enable Lead triggers
+  ${chalk5.cyan("6.")} ${chalk5.bold("Step 3")} \u2014 click ${chalk5.white("Sync Fields")} to index your Lead field schema
+  ${chalk5.cyan("7.")} ${chalk5.bold("Step 4")} \u2014 click ${chalk5.white("Send Test")} to fire a test routing event
+     \u2192 ${chalk5.dim('"Test successful"')} or ${chalk5.dim('"No matching rule"')} are both valid
+
+` + chalk5.dim("Keep this terminal open while you complete the wizard."),
+    "Complete Salesforce setup"
   );
-  const clientId = await text3({
-    message: "Consumer Key (Client ID)",
-    initialValue: currentClientId,
-    validate: (v) => !v ? "Required" : void 0
-  });
-  if (clientId === null || typeof clientId === "symbol") {
-    process.exit(0);
-  }
-  const clientSecret = await password3({
-    message: "Consumer Secret (Client Secret)",
-    validate: (v) => !v ? "Required" : void 0
+  const done = await confirm2({
+    message: "Have you completed the App Launcher wizard?",
+    initialValue: false
   });
-  if (clientSecret === null || typeof clientSecret === "symbol") {
-    process.exit(0);
-  }
-  const updates = {
-    SFDC_CLIENT_ID: clientId,
-    SFDC_CLIENT_SECRET: clientSecret
-  };
-  writeEnv(envWeb, updates);
-  writeEnv(envEngine, updates);
-  log14.success("Updated .env.web and .env.engine");
-  const s = spinner6();
-  s.start("Restarting web and engine containers\u2026");
-  try {
-    await execa4("docker", ["compose", "up", "-d", "--force-recreate", "web", "engine"], {
-      cwd: dir
-    });
-    s.stop("Containers restarted");
-  } catch (err) {
-    s.stop("Restart failed \u2014 run `docker compose up -d --force-recreate web engine` manually");
-    log14.warn(String(err));
+  if (isCancel4(done)) {
+    log14.warn(
+      "Wizard skipped. Run `lead-routing sfdc deploy` to retry the Salesforce setup."
+    );
+    return;
   }
-  outro4(
-    "Salesforce credentials updated!\n\nNext: go to the web app \u2192 Settings \u2192 Connect Salesforce to refresh your OAuth tokens."
-  );
-}
-function runConfigShow() {
-  const dir = findInstallDir();
-  if (!dir) {
-    console.error("No lead-routing installation found in the current directory.");
-    process.exit(1);
+  if (!done) {
+    log14.warn(
+      `No problem \u2014 complete it at your own pace.
+  Open App Launcher \u2192 Lead Router Setup \u2192 Connect to Lead Router
+  Dashboard: ${appUrl}`
+    );
+  } else {
+    log14.success("Salesforce setup complete");
   }
-  const envWeb = join8(dir, ".env.web");
-  const cfg = parseEnv(envWeb);
-  const adminSecret = cfg.get("ADMIN_SECRET") ?? "(not found)";
-  const appUrl = cfg.get("APP_URL") ?? "(not found)";
-  const sfdcClientId = cfg.get("SFDC_CLIENT_ID") ?? "(not found)";
-  console.log();
-  console.log(chalk5.bold("Lead Routing \u2014 Installation Config"));
-  console.log();
-  console.log(`  Admin panel:   ${chalk5.cyan(appUrl + "/admin")}`);
-  console.log(`  Admin secret:  ${chalk5.yellow(adminSecret)}`);
-  console.log();
-  console.log(`  SFDC Client ID: ${chalk5.white(sfdcClientId)}`);
-  console.log();
 }
 
 // src/commands/sfdc.ts
-import { intro as intro5, outro as outro5, text as text4, log as log15 } from "@clack/prompts";
-import chalk6 from "chalk";
 async function runSfdcDeploy() {
   intro5("Lead Routing \u2014 Deploy Salesforce Package");
   let appUrl;
@@ -2115,20 +1989,20 @@ async function runSfdcDeploy() {
     log15.info(`Using config from ${dir}/lead-routing.json`);
   } else {
     log15.warn("No lead-routing.json found \u2014 enter the URLs from your installation.");
-    const rawApp = await text4({
+    const rawApp = await text3({
       message: "App URL (e.g. https://leads.acme.com)",
       validate: (v) => !v ? "Required" : void 0
     });
     if (typeof rawApp === "symbol") process.exit(0);
     appUrl = rawApp.trim();
-    const rawEngine = await text4({
+    const rawEngine = await text3({
       message: "Engine URL (e.g. https://engine.acme.com or https://acme.com:3001)",
       validate: (v) => !v ? "Required" : void 0
     });
     if (typeof rawEngine === "symbol") process.exit(0);
     engineUrl = rawEngine.trim();
   }
-  const alias = await text4({
+  const alias = await text3({
     message: "Salesforce org alias (used to log in)",
     placeholder: "lead-routing",
     initialValue: "lead-routing",
@@ -2140,9 +2014,6 @@ async function runSfdcDeploy() {
       appUrl,
       engineUrl,
       orgAlias: alias,
-      // Read from config if available
-      sfdcClientId: config2?.sfdcClientId ?? "",
-      sfdcLoginUrl: config2?.sfdcLoginUrl ?? "https://login.salesforce.com",
       installDir: dir ?? void 0,
       webhookSecret: config2?.engineWebhookSecret
     });
@@ -2249,10 +2120,9 @@ async function runUninstall() {
 // src/index.ts
 var program = new Command();
 program.name("lead-routing").description("Self-hosted Lead Routing \u2014 scaffold, deploy, and manage your installation").version("0.1.13");
-program.command("init").description("Interactive setup wizard \u2014 configure and deploy the full Lead Routing stack").option("--dry-run", "Generate config files without connecting or deploying").option("--resume", "Skip to health check using existing lead-routing.json (post-timeout recovery)").option("--sandbox", "Use Salesforce sandbox (test.salesforce.com) instead of production").option("--ssh-port <port>", "SSH port (default: 22)", parseInt).option("--ssh-user <user>", "SSH username (default: root)").option("--ssh-key <path>", "Path to SSH private key (overrides auto-detection)").option("--remote-dir <path>", "Remote install directory (default: ~/lead-routing)").option("--external-db <url>", "Use external PostgreSQL URL instead of managed Docker container").option("--external-redis <url>", "Use external Redis URL instead of managed Docker container").action((opts) => runInit({
+program.command("init").description("Interactive setup wizard \u2014 configure and deploy the full Lead Routing stack").option("--dry-run", "Generate config files without connecting or deploying").option("--resume", "Skip to health check using existing lead-routing.json (post-timeout recovery)").option("--ssh-port <port>", "SSH port (default: 22)", parseInt).option("--ssh-user <user>", "SSH username (default: root)").option("--ssh-key <path>", "Path to SSH private key (overrides auto-detection)").option("--remote-dir <path>", "Remote install directory (default: ~/lead-routing)").option("--external-db <url>", "Use external PostgreSQL URL instead of managed Docker container").option("--external-redis <url>", "Use external Redis URL instead of managed Docker container").action((opts) => runInit({
   dryRun: opts.dryRun,
   resume: opts.resume,
-  sandbox: opts.sandbox,
   sshPort: opts.sshPort,
   sshUser: opts.sshUser,
   sshKey: opts.sshKey,