@mintmcp/hosted-cli 0.0.17 → 0.0.18

package/src/index.ts

@@ -13,6 +13,7 @@ import { fileURLToPath } from "url";
 import z, { ZodSchema } from "zod";
 import {
   type AppRouter,
+  type GatewayId,
   HostedIdSchema,
   type HostedTransport,
   UserConfigUpdateSchema,
@@ -34,6 +35,18 @@ import {
   sameStoredAuthAccount,
   useAuth,
 } from "./auth.js";
+import {
+  assertImageSupportsPlatform,
+  buildImage,
+  defaultBuildPlatform,
+  defaultLocalTestImageRef,
+  ensureDockerAvailable,
+  ensureDockerBuildxAvailable,
+  ensureImageAvailableLocally,
+  loginToRegistry,
+  pushImage,
+  smokeTestImage,
+} from "./containerBuilder.js";
 import {
   buildPartialUpdate,
   type DeployOptions,
@@ -52,6 +65,7 @@ export type CliClientAppRouterInputs = inferRouterInputs<AppRouter>;
 export type CliClientAppRouterOutputs = inferRouterOutputs<AppRouter>;
 
 const TransportSchema = z.enum(["http", "stdio"]);
+const parseTransport = argParser(TransportSchema);
 
 const TRPC_API_URL: Record<Env, string> = {
   staging: "http://localhost:3000/api.trpc",
@@ -69,16 +83,46 @@ const HOSTED_CONFIG_PATHS: Record<Env, string> = {
   production: ".mintmcp/hosted.json",
 };
 
-const HostedConfigSchema = z.object({
+const HostedConfigBaseSchema = z.object({
   hostedId: HostedIdSchema,
 
-  // Directory containing data to send to hosted server, relative to "--base".
-  mntDataDir: z.string(),
-
   // Organization that owns this hosted server. Older config files may omit it.
   organizationId: z.string().optional(),
 });
+
+const HostedConfigSchema = z.union([
+  HostedConfigBaseSchema.extend({
+    mode: z.literal("container"),
+    image: z.string().optional(),
+    transport: TransportSchema.optional(),
+
+    // Directory containing data to send to hosted server, relative to "--base".
+    mntDataDir: z.string().optional(),
+  }),
+  HostedConfigBaseSchema.extend({
+    // Directory containing data to send to hosted server, relative to "--base".
+    mntDataDir: z.string(),
+  }),
+]);
 type HostedConfig = z.infer<typeof HostedConfigSchema>;
+type DeployResult = {
+  config: HostedConfig;
+  gatewayId?: GatewayId;
+};
+
+type RegistryPushSession =
+  CliClientAppRouterOutputs["mcpHost"]["createRegistryPushSession"];
+
+function storedTransport(config: HostedConfig): Transport | undefined {
+  return "mode" in config ? config.transport : undefined;
+}
+
+function canUseDirectImageStartup(params: {
+  transport: Transport | undefined;
+  mntDataDir: string | undefined;
+}): boolean {
+  return params.transport === "http" && params.mntDataDir == undefined;
+}
 
 function isTRPCUnauthorized(error: unknown): boolean {
   return (
@@ -208,7 +252,7 @@ async function uploadData(
   return { secretDataZipGcsPath: upload.secretDataZipGcsPath };
 }
 
-const DEPLOY_OPTIONS_NEW_SERVER_DEFAULTS = {
+const DEPLOY_OPTIONS_LEGACY_DEFAULTS = {
   transport: "stdio",
   // Skip install/build if already done (e.g., by startup probe or previous session).
   startupCommand:
@@ -216,33 +260,53 @@ const DEPLOY_OPTIONS_NEW_SERVER_DEFAULTS = {
   mntDataDir: ".",
 } as const;
 
+const DEPLOY_OPTIONS_CONTAINER_DEFAULTS = {
+  transport: "http",
+} as const;
+
 async function createNew(
   client: Awaited<ReturnType<typeof makeAuthenticatedClient>>,
   base: string,
   organizationId: string,
   options: DeployOptions,
-): Promise<HostedConfig> {
-  const {
-    name,
-    transport,
-    startupCommand,
-    mntDataDir = ".",
-  } = {
-    ...DEPLOY_OPTIONS_NEW_SERVER_DEFAULTS,
+): Promise<DeployResult> {
+  const defaults = options.image
+    ? DEPLOY_OPTIONS_CONTAINER_DEFAULTS
+    : DEPLOY_OPTIONS_LEGACY_DEFAULTS;
+  const { name, image, transport, startupCommand, mntDataDir } = {
+    ...defaults,
     ...options,
   };
   if (name == undefined) {
     throw new Error("--name is a required option when creating a new server");
   }
+  if (
+    image != undefined &&
+    startupCommand == undefined &&
+    !canUseDirectImageStartup({ transport, mntDataDir })
+  ) {
+    throw new Error(
+      "--startup-command is required unless using --transport http without --mnt-data-dir",
+    );
+  }
+  if (image == undefined && startupCommand == undefined) {
+    throw new Error(
+      "Expected --startup-command to be defined after applying defaults",
+    );
+  }
 
-  const upload = await uploadData(client, path.join(base, mntDataDir));
+  const upload =
+    mntDataDir != undefined || image == undefined
+      ? await uploadData(client, path.join(base, mntDataDir ?? "."))
+      : undefined;
 
   const config = UserConfigUpdateSchema.parse({
     userGivenName: name,
-    command: startupCommand,
+    ...(image != undefined ? { image } : {}),
+    ...(startupCommand != undefined ? { command: startupCommand } : {}),
     transport: toHostedTransport(transport),
     replaceEnv: [],
-    secretDataZipGcsPath: upload.secretDataZipGcsPath,
+    ...(upload ? { secretDataZipGcsPath: upload.secretDataZipGcsPath } : {}),
   } satisfies z.input<typeof UserConfigUpdateSchema>);
 
   const createdServer = await client.mcpHost.createServer.mutate({
@@ -250,9 +314,15 @@ async function createNew(
   });
 
   return {
-    hostedId: createdServer.hostedId,
-    mntDataDir,
-    organizationId,
+    config: HostedConfigSchema.parse({
+      hostedId: createdServer.hostedId,
+      ...(image != undefined
+        ? { mode: "container" as const, image, transport }
+        : {}),
+      ...(mntDataDir != undefined ? { mntDataDir } : {}),
+      organizationId,
+    }),
+    gatewayId: createdServer.gatewayId,
   };
 }
 
@@ -262,7 +332,7 @@ async function updateExisting(
   config: HostedConfig,
   organizationId: string,
   options: DeployOptions,
-): Promise<HostedConfig> {
+): Promise<DeployResult> {
   if (
     config.organizationId != undefined &&
     config.organizationId !== organizationId
@@ -271,20 +341,273 @@ async function updateExisting(
       `Hosted config belongs to organization ${config.organizationId}, but the selected credentials are for ${organizationId}. Switch organizations with "hosted auth use --organization-id ${config.organizationId}" before deploying.`,
     );
   }
-  const newConfig = { ...config };
-  if (options.mntDataDir != undefined) {
-    newConfig.mntDataDir = options.mntDataDir;
+  const nextTransport = options.transport ?? storedTransport(config);
+  const clearCommand =
+    options.image != undefined &&
+    options.startupCommand == undefined &&
+    options.mntDataDir == undefined &&
+    nextTransport === "http";
+  if (
+    options.image != undefined &&
+    options.startupCommand == undefined &&
+    !clearCommand
+  ) {
+    if (options.mntDataDir != undefined) {
+      throw new Error(
+        "--startup-command is required when using --mnt-data-dir with --image",
+      );
+    }
+    if (nextTransport == undefined) {
+      throw new Error(
+        "--startup-command is required unless the resulting transport is known to be http. Pass --transport http to switch to direct image startup.",
+      );
+    }
+    throw new Error(
+      "--startup-command is required unless using --transport http without --mnt-data-dir",
+    );
   }
-  newConfig.organizationId = organizationId;
-  const upload = await uploadData(
-    client,
-    path.join(base, newConfig.mntDataDir),
-  );
-  await client.mcpHost.partialUpdateServer.mutate({
+  const newConfig = HostedConfigSchema.parse({
+    ...config,
+    ...(options.mntDataDir != undefined
+      ? { mntDataDir: options.mntDataDir }
+      : {}),
+    ...(options.image != undefined
+      ? {
+          mode: "container" as const,
+          image: options.image,
+          ...(nextTransport != undefined ? { transport: nextTransport } : {}),
+        }
+      : {}),
+    ...("mode" in config && nextTransport != undefined
+      ? { transport: nextTransport }
+      : {}),
+    organizationId,
+  });
+  const upload =
+    (options.image == undefined || options.mntDataDir != undefined) &&
+    newConfig.mntDataDir != undefined
+      ? await uploadData(client, path.join(base, newConfig.mntDataDir))
+      : undefined;
+  const updatedServer = await client.mcpHost.partialUpdateServer.mutate({
     hostedId: config.hostedId,
-    update: buildPartialUpdate(options, upload.secretDataZipGcsPath),
+    update: buildPartialUpdate(options, upload?.secretDataZipGcsPath, {
+      clearCommand,
+    }),
+  });
+  return {
+    config: newConfig,
+    ...(updatedServer.gatewayId != undefined
+      ? { gatewayId: updatedServer.gatewayId }
+      : {}),
+  };
+}
+
+function connectorSettingsUrl(env: Env, gatewayId: GatewayId): string {
+  const url = new URL("/vmcps", WEB_CLIENT_URL[env]);
+  url.searchParams.set("id", gatewayId);
+  url.searchParams.set("serverTab", "connector-settings");
+  return url.toString();
+}
+
+function logDeployResult(
+  env: Env,
+  action: "Created" | "Updated",
+  result: DeployResult,
+): void {
+  if (result.gatewayId == undefined) {
+    console.log(`${action}.`);
+    return;
+  }
+  console.log(`${action} ${connectorSettingsUrl(env, result.gatewayId)}`);
+}
+
+function updateConfigAfterManagedPush(
+  config: HostedConfig,
+  organizationId: string,
+  managedImageRef: string,
+): HostedConfig {
+  return HostedConfigSchema.parse({
+    ...config,
+    mode: "container" as const,
+    image: managedImageRef,
+    organizationId,
+    ...("mode" in config && config.transport != undefined
+      ? { transport: config.transport }
+      : {}),
+  });
+}
+
+function managedRegistryImageRef(session: RegistryPushSession): string {
+  return `${session.registryHost}/${session.repository}:${session.imageTag}`;
+}
+
+async function buildAndPushManagedImage(params: {
+  client: AuthenticatedClient;
+  organizationId: string;
+  config: HostedConfig;
+  dockerfile: string;
+  context: string;
+  buildArg: string[];
+  target?: string;
+  platform: string;
+}): Promise<DeployResult> {
+  if (
+    params.config.organizationId != undefined &&
+    params.config.organizationId !== params.organizationId
+  ) {
+    throw new Error(
+      `Hosted config belongs to organization ${params.config.organizationId}, but the selected credentials are for ${params.organizationId}. Switch organizations with "hosted auth use --organization-id ${params.config.organizationId}" before building and pushing.`,
+    );
+  }
+
+  const session = await params.client.mcpHost.createRegistryPushSession.mutate({
+    hostedId: params.config.hostedId,
+  });
+
+  const deployImageRef = managedRegistryImageRef(session);
+  const buildResult = buildImage({
+    dockerfile: params.dockerfile,
+    context: params.context,
+    buildArgs: params.buildArg,
+    ...(params.target != undefined ? { target: params.target } : {}),
+    platform: params.platform,
+    imageRef: deployImageRef,
+  });
+
+  loginToRegistry(session.registryHost, session.username, session.password);
+  pushImage(buildResult.imageRef);
+
+  const finalized = await params.client.mcpHost.finalizeRegistryPush.mutate({
+    hostedId: params.config.hostedId,
+    finalizeToken: session.finalizeToken,
+  });
+
+  return {
+    config: updateConfigAfterManagedPush(
+      params.config,
+      params.organizationId,
+      deployImageRef,
+    ),
+    ...(finalized.gatewayId != undefined
+      ? { gatewayId: finalized.gatewayId }
+      : {}),
+  };
+}
+
+function buildManagedImageCreateConfig(params: {
+  name?: string;
+  transport?: Transport;
+  startupCommand?: string;
+}) {
+  const transport = params.transport ?? "http";
+  if (params.name == undefined) {
+    throw new Error(
+      "--name is a required option when building and pushing a new managed image connector",
+    );
+  }
+  if (
+    params.startupCommand == undefined &&
+    !canUseDirectImageStartup({ transport, mntDataDir: undefined })
+  ) {
+    throw new Error(
+      "--startup-command is required unless using --transport http",
+    );
+  }
+  return UserConfigUpdateSchema.omit({ image: true }).parse({
+    userGivenName: params.name,
+    ...(params.startupCommand != undefined
+      ? { command: params.startupCommand }
+      : {}),
+    transport: toHostedTransport(transport),
+    replaceEnv: [],
+  });
+}
+
+async function buildAndPushManagedImageForCreate(params: {
+  client: AuthenticatedClient;
+  organizationId: string;
+  name?: string;
+  transport?: Transport;
+  startupCommand?: string;
+  dockerfile: string;
+  context: string;
+  buildArg: string[];
+  target?: string;
+  platform: string;
+}): Promise<DeployResult> {
+  const config = buildManagedImageCreateConfig({
+    ...(params.name != undefined ? { name: params.name } : {}),
+    ...(params.transport != undefined ? { transport: params.transport } : {}),
+    ...(params.startupCommand != undefined
+      ? { startupCommand: params.startupCommand }
+      : {}),
+  });
+
+  const session =
+    await params.client.mcpHost.createRegistryPushSessionForCreate.mutate({});
+  const deployImageRef = managedRegistryImageRef(session);
+  const buildResult = buildImage({
+    dockerfile: params.dockerfile,
+    context: params.context,
+    buildArgs: params.buildArg,
+    ...(params.target != undefined ? { target: params.target } : {}),
+    platform: params.platform,
+    imageRef: deployImageRef,
+  });
+
+  loginToRegistry(session.registryHost, session.username, session.password);
+  pushImage(buildResult.imageRef);
+
+  const finalized =
+    await params.client.mcpHost.finalizeRegistryPushCreate.mutate({
+      finalizeToken: session.finalizeToken,
+      config,
+    });
+
+  return {
+    config: HostedConfigSchema.parse({
+      hostedId: finalized.hostedId,
+      organizationId: params.organizationId,
+      mode: "container" as const,
+      image: deployImageRef,
+      ...(params.transport != undefined
+        ? { transport: params.transport }
+        : { transport: "http" as const }),
+    }),
+    gatewayId: finalized.gatewayId,
+  };
+}
+
+async function deployWithOptions(
+  env: Env,
+  base: string,
+  options: DeployOptions,
+): Promise<void> {
+  const auth = await getAuth(env);
+
+  await withAuthRetry(env, async (client) => {
+    const configPath = path.join(base, HOSTED_CONFIG_PATHS[env]);
+
+    let result: DeployResult;
+    if (fs.existsSync(configPath)) {
+      console.log("Updating existing server...");
+      const configData = fs.readFileSync(configPath, "utf8");
+      result = await updateExisting(
+        client,
+        base,
+        HostedConfigSchema.parse(JSON.parse(configData)),
+        auth.organizationId,
+        options,
+      );
+      logDeployResult(env, "Updated", result);
+    } else {
+      console.log("Creating new server...");
+      result = await createNew(client, base, auth.organizationId, options);
+      logDeployResult(env, "Created", result);
+    }
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, JSON.stringify(result.config, null, 2));
   });
-  return newConfig;
 }
 
 const program = new Command()
@@ -300,9 +623,47 @@ const program = new Command()
   .option("-b, --base <base>", "base directory for config and data.", ".");
 
 function makeDefaultMessage(
-  optionName: keyof typeof DEPLOY_OPTIONS_NEW_SERVER_DEFAULTS,
+  optionName: keyof typeof DEPLOY_OPTIONS_LEGACY_DEFAULTS,
 ): string {
-  return `Defaults to '${DEPLOY_OPTIONS_NEW_SERVER_DEFAULTS[optionName]}' for new servers.`;
+  return `For new zip-based servers, defaults to '${DEPLOY_OPTIONS_LEGACY_DEFAULTS[optionName]}'.`;
+}
+
+function collect(value: string, previous: string[]): string[] {
+  return previous.concat([value]);
+}
+
+function parsePositiveInt(value: string): number {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new InvalidArgumentError("Expected a positive integer.");
+  }
+  return parsed;
+}
+
+function shouldBuildTestImage(options: {
+  build?: boolean;
+  image?: string;
+  dockerfile?: string;
+  context?: string;
+  buildArg?: string[];
+  target?: string;
+}): boolean {
+  if (options.build) {
+    return true;
+  }
+  if (options.image == undefined) {
+    return true;
+  }
+  if (options.dockerfile !== undefined && options.dockerfile !== "Dockerfile") {
+    return true;
+  }
+  if (options.context !== undefined && options.context !== ".") {
+    return true;
+  }
+  if ((options.buildArg?.length ?? 0) > 0) {
+    return true;
+  }
+  return options.target != undefined;
 }
 
 const authCommand = program
@@ -372,14 +733,18 @@ program
     "-n, --name <name>",
     "Name of the hosted server. Required for new servers.",
   )
+  .option(
+    "--image <ref>",
+    "Container image reference (e.g., ghcr.io/org/repo:tag). Skips zip upload when --mnt-data-dir is not also supplied.",
+  )
   .option(
     "-t, --transport <transport>",
-    `Transport (stdio or http). ${makeDefaultMessage("transport")}`,
+    `Transport (stdio or http). Defaults to 'http' for image-based creates. ${makeDefaultMessage("transport")}`,
     argParser(TransportSchema),
   )
   .option(
     "--startup-command <command>",
-    `Command that runs on hosted container to start the server (runs in bash). ${makeDefaultMessage("startupCommand")}`,
+    `Command that runs on hosted container to start the server (runs in bash). Required for stdio and zip-backed image deploys. ${makeDefaultMessage("startupCommand")}`,
   )
   .option(
     "--mnt-data-dir <directory>",
@@ -387,39 +752,244 @@ program
   )
   .action(async (options) => {
     const { env, base } = program.opts();
-    const auth = await getAuth(env);
+    await deployWithOptions(env, base, options);
+  });
 
-    await withAuthRetry(env, async (client) => {
-      const configPath = path.join(base, HOSTED_CONFIG_PATHS[env]);
+program
+  .command("test-image")
+  .description(
+    "Run a local MCP smoke test against a container image. Builds the current Dockerfile by default; with --image, tests that existing image directly.",
+  )
+  .option(
+    "--image <ref>",
+    "Existing image reference to test directly, or the output tag to build when --build or other build options are supplied.",
+  )
+  .option(
+    "--build",
+    "Force a local build before testing, even when --image is supplied.",
+  )
+  .option("--dockerfile <path>", "Path to Dockerfile", "Dockerfile")
+  .option("--context <dir>", "Docker build context directory", ".")
+  .option(
+    "--build-arg <arg>",
+    "Build arguments (KEY=VALUE), repeatable",
+    collect,
+    [],
+  )
+  .option("--target <target>", "Multi-stage build target")
+  .option(
+    "--probe-path <path>",
+    "HTTP path to probe with MCP initialize",
+    "/mcp",
+  )
+  .option(
+    "--probe-timeout-ms <ms>",
+    "How long to wait for the local MCP probe to succeed",
+    parsePositiveInt,
+    30_000,
+  )
+  .option(
+    "--env <entry>",
+    "Container runtime env vars for the local smoke test (KEY=VALUE), repeatable",
+    collect,
+    [],
+  )
+  .option(
+    "--env-file <path>",
+    "Path to a Docker env file for the local smoke test",
+  )
+  .action(async (options) => {
+    ensureDockerAvailable();
+    ensureDockerBuildxAvailable();
 
-      let newOrUpdatedConfig: HostedConfig;
-      if (fs.existsSync(configPath)) {
-        console.log("Updating existing server...");
-        const configData = fs.readFileSync(configPath, "utf8");
-        newOrUpdatedConfig = await updateExisting(
-          client,
-          base,
-          HostedConfigSchema.parse(JSON.parse(configData)),
-          auth.organizationId,
-          options,
-        );
-        console.log(
-          `Updated ${WEB_CLIENT_URL[env]}/hosted/${newOrUpdatedConfig.hostedId}`,
+    const shouldBuild = shouldBuildTestImage(options);
+    const imageRef = options.image ?? defaultLocalTestImageRef();
+
+    if (shouldBuild) {
+      buildImage({
+        dockerfile: options.dockerfile,
+        context: options.context,
+        buildArgs: options.buildArg,
+        ...(options.target != undefined ? { target: options.target } : {}),
+        imageRef,
+      });
+    } else {
+      ensureImageAvailableLocally(imageRef);
+    }
+
+    await smokeTestImage({
+      imageRef,
+      probePath: options.probePath,
+      probeTimeoutMs: options.probeTimeoutMs,
+      env: options.env,
+      ...(options.envFile != undefined ? { envFile: options.envFile } : {}),
+    });
+  });
+
+program
+  .command("build-and-push")
+  .description(
+    "Build a Docker image, push it through the managed registry, and finalize the hosted connector image update or creation.",
+  )
+  .option("--dockerfile <path>", "Path to Dockerfile", "Dockerfile")
+  .option("--context <dir>", "Docker build context directory", ".")
+  .option(
+    "--build-arg <arg>",
+    "Build arguments (KEY=VALUE), repeatable",
+    collect,
+    [],
+  )
+  .option("--target <target>", "Multi-stage build target")
+  .option(
+    "--platform <platform>",
+    `Target platform to build for before push. Defaults to '${defaultBuildPlatform()}'.`,
+    defaultBuildPlatform(),
+  )
+  .option(
+    "--name <name>",
+    "Connector name when creating a new hosted connector",
+  )
+  .option(
+    "--transport <transport>",
+    "Transport to configure when creating a new managed connector",
+    parseTransport,
+  )
+  .option(
+    "--startup-command <command>",
+    "Startup command to configure when creating a new managed connector",
+  )
+  .action(async (options) => {
+    const { env, base } = program.opts();
+
+    ensureDockerAvailable();
+    ensureDockerBuildxAvailable();
+
+    if (options.platform !== defaultBuildPlatform()) {
+      console.warn(
+        `Building for ${options.platform}. Hosted deployments typically target ${defaultBuildPlatform()}; choose a different platform only when you know the runtime is compatible.`,
+      );
+    }
+
+    const configPath = path.join(base, HOSTED_CONFIG_PATHS[env]);
+    const auth = await getAuth(env);
+    const hasExistingConfig = fs.existsSync(configPath);
+
+    const result = await withAuthRetry(env, async (client) => {
+      if (hasExistingConfig) {
+        const config = HostedConfigSchema.parse(
+          JSON.parse(fs.readFileSync(configPath, "utf8")),
         );
-      } else {
-        console.log("Creating new server...");
-        newOrUpdatedConfig = await createNew(
+        return await buildAndPushManagedImage({
           client,
-          base,
-          auth.organizationId,
-          options,
-        );
-        console.log(
-          `Created ${WEB_CLIENT_URL[env]}/hosted/${newOrUpdatedConfig.hostedId}`,
-        );
+          organizationId: auth.organizationId,
+          config,
+          dockerfile: options.dockerfile,
+          context: options.context,
+          buildArg: options.buildArg,
+          ...(options.target != undefined ? { target: options.target } : {}),
+          platform: options.platform,
+        });
       }
-      fs.mkdirSync(path.dirname(configPath), { recursive: true });
-      fs.writeFileSync(configPath, JSON.stringify(newOrUpdatedConfig, null, 2));
+
+      return await buildAndPushManagedImageForCreate({
+        client,
+        organizationId: auth.organizationId,
+        ...(options.name != undefined ? { name: options.name } : {}),
+        ...(options.transport != undefined
+          ? { transport: options.transport }
+          : {}),
+        ...(options.startupCommand != undefined
+          ? { startupCommand: options.startupCommand }
+          : {}),
+        dockerfile: options.dockerfile,
+        context: options.context,
+        buildArg: options.buildArg,
+        ...(options.target != undefined ? { target: options.target } : {}),
+        platform: options.platform,
+      });
+    });
+
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, JSON.stringify(result.config, null, 2));
+    logDeployResult(env, hasExistingConfig ? "Updated" : "Created", result);
+  });
+
+program
+  .command("build-and-deploy")
+  .description(
+    "Build a Docker image for hosted deployment, push it, verify the target platform, and deploy it.",
+  )
+  .requiredOption(
+    "--image <ref>",
+    "Image reference to build, push, and deploy (e.g., ghcr.io/org/repo:tag).",
+  )
+  .option("--dockerfile <path>", "Path to Dockerfile", "Dockerfile")
+  .option("--context <dir>", "Docker build context directory", ".")
+  .option(
+    "--build-arg <arg>",
+    "Build arguments (KEY=VALUE), repeatable",
+    collect,
+    [],
+  )
+  .option("--target <target>", "Multi-stage build target")
+  .option(
+    "--platform <platform>",
+    `Target platform to build for before deploy. Defaults to '${defaultBuildPlatform()}'.`,
+    defaultBuildPlatform(),
+  )
+  .option(
+    "-n, --name <name>",
+    "Name of the hosted server. Required for new servers.",
+  )
+  .option(
+    "-t, --transport <transport>",
+    `Transport (stdio or http). Defaults to 'http' for image-based creates. ${makeDefaultMessage("transport")}`,
+    argParser(TransportSchema),
+  )
+  .option(
+    "--startup-command <command>",
+    `Command that runs on hosted container to start the server (runs in bash). Required for stdio and zip-backed image deploys. ${makeDefaultMessage("startupCommand")}`,
+  )
+  .option(
+    "--mnt-data-dir <directory>",
+    `Directory to copy to /mnt on the server. ${makeDefaultMessage("mntDataDir")}`,
+  )
+  .action(async (options) => {
+    const { env, base } = program.opts();
+
+    ensureDockerAvailable();
+    ensureDockerBuildxAvailable();
+
+    if (options.platform !== defaultBuildPlatform()) {
+      console.warn(
+        `Building for ${options.platform}. Hosted deployments typically target ${defaultBuildPlatform()}; choose a different platform only when you know the runtime is compatible.`,
+      );
+    }
+
+    const buildResult = buildImage({
+      dockerfile: options.dockerfile,
+      context: options.context,
+      buildArgs: options.buildArg,
+      ...(options.target != undefined ? { target: options.target } : {}),
+      platform: options.platform,
+      imageRef: options.image,
+    });
+
+    pushImage(buildResult.imageRef);
+    assertImageSupportsPlatform(buildResult.imageRef, options.platform);
+
+    await deployWithOptions(env, base, {
+      image: buildResult.imageRef,
+      ...(options.name != undefined ? { name: options.name } : {}),
+      ...(options.transport != undefined
+        ? { transport: options.transport }
+        : {}),
+      ...(options.startupCommand != undefined
+        ? { startupCommand: options.startupCommand }
+        : {}),
+      ...(options.mntDataDir != undefined
+        ? { mntDataDir: options.mntDataDir }
+        : {}),
     });
   });