@omen.foundation/node-microservice-runtime 0.1.104 → 0.1.106

package/scripts/publish-service.mjs

@@ -1,1551 +1,1585 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs/promises';
-import fssync from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import crypto from 'node:crypto';
-import { fileURLToPath } from 'node:url';
-import { fetch } from 'undici';
-import tar from 'tar-stream';
-import dotenv from 'dotenv';
-import { runCommand } from './lib/cli-utils.mjs';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DEFAULT_NODE_VERSION = '20';
-const MANIFEST_MEDIA_TYPE = 'application/vnd.docker.distribution.manifest.v2+json';
-const CONFIG_MEDIA_TYPE = 'application/vnd.docker.container.image.v1+json';
-const LAYER_MEDIA_TYPE = 'application/vnd.docker.image.rootfs.diff.tar.gzip';
-
-// ANSI color codes for colorful output
-const colors = {
-  reset: '\x1b[0m',
-  bright: '\x1b[1m',
-  dim: '\x1b[2m',
-  green: '\x1b[32m',
-  yellow: '\x1b[33m',
-  blue: '\x1b[34m',
-  magenta: '\x1b[35m',
-  cyan: '\x1b[36m',
-  red: '\x1b[31m',
-};
-
-// Progress bar manager
-class ProgressBar {
-  constructor(totalSteps) {
-    this.totalSteps = totalSteps;
-    this.currentStep = 0;
-    this.currentTask = '';
-    this.startTime = Date.now();
-  }
-
-  start(task) {
-    this.currentTask = task;
-    this.currentStep++;
-    this.update();
-  }
-
-  complete(task) {
-    this.currentTask = task;
-    this.update();
-    process.stdout.write('\n');
-  }
-
-  update() {
-    const percentage = Math.round((this.currentStep / this.totalSteps) * 100);
-    const barWidth = 30;
-    const filled = Math.round((percentage / 100) * barWidth);
-    const empty = barWidth - filled;
-    const bar = '█'.repeat(filled) + '░'.repeat(empty);
-    
-    const elapsed = ((Date.now() - this.startTime) / 1000).toFixed(1);
-    
-    // Clear line and write progress
-    process.stdout.write(`\r${colors.cyan}${bar}${colors.reset} ${colors.bright}${percentage}%${colors.reset} ${colors.dim}${this.currentTask}${colors.reset} ${colors.dim}(${elapsed}s)${colors.reset}`);
-  }
-
-  success(message) {
-    process.stdout.write(`\r${colors.green}✓${colors.reset} ${message}\n`);
-  }
-
-  info(message) {
-    process.stdout.write(`\r${colors.blue}ℹ${colors.reset} ${message}\n`);
-  }
-
-  error(message) {
-    process.stdout.write(`\r${colors.red}✗${colors.reset} ${message}\n`);
-  }
-}
-
-function parseArgs(argv) {
-  const args = {
-    entry: 'dist/main.js',
-    openapi: 'beam_openApi.json',
-    envFile: undefined,
-    cid: process.env.BEAMABLE_CID || process.env.CID,
-    pid: process.env.BEAMABLE_PID || process.env.PID,
-    host: process.env.BEAMABLE_HOST || process.env.HOST,
-    namePrefix: process.env.BEAMABLE_NAME_PREFIX || process.env.NAME_PREFIX,
-    token: process.env.BEAMABLE_TOKEN || process.env.BEAMABLE_ACCESS_TOKEN || process.env.ACCESS_TOKEN,
-    gamePid: process.env.BEAMABLE_GAME_PID,
-    comments: process.env.BEAMABLE_PUBLISH_COMMENTS,
-    service: process.env.BEAMABLE_SERVICE_ID,
-    dockerTag: process.env.BEAMABLE_DOCKER_TAG,
-    nodeVersion: process.env.BEAMABLE_NODE_VERSION || DEFAULT_NODE_VERSION,
-    skipValidate: false,
-    apiHost: process.env.BEAMABLE_API_HOST,
-  };
-
-  const queue = [...argv];
-  while (queue.length > 0) {
-    const current = queue.shift();
-    switch (current) {
-      case '--entry':
-        args.entry = queue.shift();
-        break;
-      case '--openapi':
-        args.openapi = queue.shift();
-        break;
-      case '--env-file':
-        args.envFile = queue.shift();
-        break;
-      case '--cid':
-        args.cid = queue.shift();
-        break;
-      case '--pid':
-        args.pid = queue.shift();
-        break;
-      case '--host':
-        args.host = queue.shift();
-        break;
-      case '--routing-key':
-      case '--name-prefix':
-        args.namePrefix = queue.shift();
-        break;
-      case '--token':
-        args.token = queue.shift();
-        break;
-      case '--game-pid':
-        args.gamePid = queue.shift();
-        break;
-      case '--comments':
-        args.comments = queue.shift();
-        break;
-      case '--service':
-        args.service = queue.shift();
-        break;
-      case '--docker-tag':
-        args.dockerTag = queue.shift();
-        break;
-      case '--node-version':
-        args.nodeVersion = queue.shift();
-        break;
-      case '--skip-validate':
-        args.skipValidate = true;
-        break;
-      case '--api-host':
-        args.apiHost = queue.shift();
-        break;
-      default:
-        throw new Error(`Unknown argument: ${current}`);
-    }
-  }
-
-  if (process.env.npm_config_env_file) {
-    args.envFile = process.env.npm_config_env_file;
-  }
-
-  return args;
-}
-
-function ensure(value, message) {
-  if (!value) {
-    throw new Error(message);
-  }
-  return value;
-}
-
-function md5Hex(input) {
-  return crypto.createHash('md5').update(input).digest('hex');
-}
-
-function sha256Digest(buffer) {
-  return `sha256:${crypto.createHash('sha256').update(buffer).digest('hex')}`;
-}
-
-function shortDigest(fullDigest) {
-  if (!fullDigest) {
-    return '';
-  }
-  const parts = fullDigest.split(':');
-  const hash = parts.length > 1 ? parts[1] : parts[0];
-  return hash.substring(0, 12);
-}
-
-function normalizeApiHost(host) {
-  if (!host) {
-    return undefined;
-  }
-  if (host.startsWith('wss://')) {
-    return `https://${host.substring('wss://'.length).replace(/\/socket$/, '')}`;
-  }
-  if (host.startsWith('ws://')) {
-    return `http://${host.substring('ws://'.length).replace(/\/socket$/, '')}`;
-  }
-  return host.replace(/\/$/, '');
-}
-
-async function readJson(filePath) {
-  const content = await fs.readFile(filePath, 'utf8');
-  return JSON.parse(content);
-}
-
-async function copyDirectory(source, destination) {
-  const entries = await fs.readdir(source, { withFileTypes: true });
-  await fs.mkdir(destination, { recursive: true });
-  for (const entry of entries) {
-    const srcPath = path.join(source, entry.name);
-    const destPath = path.join(destination, entry.name);
-    if (entry.isDirectory()) {
-      await copyDirectory(srcPath, destPath);
-    } else if (entry.isFile()) {
-      await fs.copyFile(srcPath, destPath);
-    }
-  }
-}
-
-async function readDockerImageTar(tarPath) {
-  const files = new Map();
-  const extract = tar.extract();
-
-  await new Promise((resolve, reject) => {
-    extract.on('entry', (header, stream, next) => {
-      const chunks = [];
-      stream.on('data', (chunk) => chunks.push(chunk));
-      stream.on('end', () => {
-        files.set(header.name, Buffer.concat(chunks));
-        next();
-      });
-      stream.on('error', reject);
-    });
-    extract.on('finish', resolve);
-    extract.on('error', reject);
-
-    fssync.createReadStream(tarPath).pipe(extract);
-  });
-
-  const manifestBuffer = files.get('manifest.json');
-  if (!manifestBuffer) {
-    throw new Error('Docker image archive missing manifest.json');
-  }
-
-  const manifestJson = JSON.parse(manifestBuffer.toString());
-  if (!Array.isArray(manifestJson) || manifestJson.length === 0) {
-    throw new Error('Unexpected manifest.json structure.');
-  }
-
-  const manifestEntry = manifestJson[0];
-  const configName = manifestEntry.Config || manifestEntry.config;
-  const layerNames = manifestEntry.Layers || manifestEntry.layers;
-
-  if (!configName || !layerNames) {
-    throw new Error('Manifest entry missing Config or Layers.');
-  }
-
-  const configBuffer = files.get(configName);
-  if (!configBuffer) {
-    throw new Error(`Config blob missing in archive: ${configName}`);
-  }
-
-  const layers = layerNames.map((layerName) => {
-    const buffer = files.get(layerName);
-    if (!buffer) {
-      throw new Error(`Layer missing in archive: ${layerName}`);
-    }
-    return { name: layerName, buffer };
-  });
-
-  return { manifestEntry, configBuffer, layers };
-}
-
-async function checkBlobExists(baseUrl, digest, headers) {
-  const url = new URL(`blobs/${digest}`, baseUrl);
-  const response = await fetch(url, { method: 'HEAD', headers, redirect: 'manual' });
-
-  if (response.status === 307 && response.headers.get('location')) {
-    const redirected = response.headers.get('location');
-    const nextBase = redirected.startsWith('http') ? redirected : new URL(redirected, baseUrl).href;
-    return checkBlobExists(nextBase, digest, headers);
-  }
-
-  return response.status === 200;
-}
-
-async function verifyManifestExists(baseUrl, tag, headers) {
-  const url = new URL(`manifests/${tag}`, baseUrl);
-  const response = await fetch(url, { method: 'HEAD', headers, redirect: 'manual' });
-
-  if (response.status === 307 && response.headers.get('location')) {
-    const redirected = response.headers.get('location');
-    const nextBase = redirected.startsWith('http') ? redirected : new URL(redirected, baseUrl).href;
-    return verifyManifestExists(nextBase, tag, headers);
-  }
-
-  return response.status === 200;
-}
-
-async function prepareUploadLocation(baseUrl, headers) {
-  const url = new URL('blobs/uploads/', baseUrl);
-  // Match C# CLI exactly: StringContent("") sets Content-Type and Content-Length
-  const requestHeaders = {
-    ...headers,
-    'Content-Type': 'text/plain; charset=utf-8',
-    'Content-Length': '0',
-  };
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]     [SUBSTEP: Prepare Upload Location]`);
-  //   console.error(`[beamo-node]       URL: ${url}`);
-  //   console.error(`[beamo-node]       Method: POST`);
-  //   console.error(`[beamo-node]       Headers:`, JSON.stringify(requestHeaders, null, 2));
-  // }
-  
-  let response;
-  try {
-    response = await fetch(url, {
-      method: 'POST',
-      headers: requestHeaders,
-      body: '', // Empty body
-    });
-  } catch (error) {
-    // Network/SSL errors happen before HTTP response
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    const errorDetails = {
-      url: url.toString(),
-      error: errorMsg,
-      ...(error instanceof Error && error.stack ? { stack: error.stack } : {}),
-      ...(error instanceof Error && error.cause ? { cause: error.cause } : {}),
-    };
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error('[beamo-node]       Network error:', errorDetails);
-    // }
-    throw new Error(`Network error preparing upload location: ${errorMsg}. URL: ${url.toString()}`);
-  }
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]       Response Status: ${response.status}`);
-  //   console.error(`[beamo-node]       Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
-  // }
-  
-  if (!response.ok) {
-    const text = await response.text();
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error('[beamo-node]       Upload location failed', {
-    //     status: response.status,
-    //     statusText: response.statusText,
-    //     headers: Object.fromEntries(response.headers.entries()),
-    //     body: text.substring(0, 500),
-    //   });
-    // }
-    throw new Error(`Failed to prepare upload location: ${response.status} ${text}`);
-  }
-  const location = response.headers.get('location');
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]       Upload Location: ${location}`);
-  // }
-  return location;
-}
-
-async function uploadBlob(baseUrl, digest, buffer, headers) {
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]       [SUBSTEP: Upload Blob]`);
-  //   console.error(`[beamo-node]         Digest: ${digest}`);
-  //   console.error(`[beamo-node]         Size: ${buffer.length} bytes`);
-  // }
-  
-  const exists = await checkBlobExists(baseUrl, digest, headers);
-  if (exists) {
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]         Blob already exists, skipping upload`);
-    // }
-    return { digest, size: buffer.length };
-  }
-
-  const location = await prepareUploadLocation(baseUrl, headers);
-  if (!location) {
-    throw new Error('Registry did not provide an upload location.');
-  }
-
-  // Match C# CLI: NormalizeWithDigest forces HTTPS and default port (-1 means use default for scheme)
-  const locationUrl = new URL(location.startsWith('http') ? location : new URL(location, baseUrl).href);
-  // Force HTTPS and remove explicit port (use default port 443 for HTTPS)
-  locationUrl.protocol = 'https:';
-  locationUrl.port = ''; // Empty string means use default port for the scheme
-  locationUrl.searchParams.set('digest', digest);
-  const uploadUrl = locationUrl;
-
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]         Upload URL: ${uploadUrl}`);
-  //   console.error(`[beamo-node]         Method: PUT`);
-  //   const uploadHeaders = { ...headers, 'Content-Type': 'application/octet-stream' };
-  //   console.error(`[beamo-node]         Upload Headers:`, JSON.stringify(uploadHeaders, null, 2));
-  // }
-
-  const response = await fetch(uploadUrl, {
-    method: 'PUT',
-    headers: { ...headers, 'Content-Type': 'application/octet-stream' },
-    body: buffer,
-  });
-
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]         Response Status: ${response.status}`);
-  //   console.error(`[beamo-node]         Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
-  // }
-  
-  if (!response.ok) {
-    const text = await response.text();
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]         Response Body: ${text.substring(0, 500)}`);
-    // }
-    throw new Error(`Failed to upload blob ${digest}: ${response.status} ${text}`);
-  }
-
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]         Blob upload successful`);
-  // }
-
-  return { digest, size: buffer.length };
-}
-
-async function uploadManifest(baseUrl, manifestJson, shortImageId, headers) {
-  // Match C# CLI: upload manifest using the short imageId as the tag
-  // The backend looks up images using this short imageId tag
-  const manifestJsonString = JSON.stringify(manifestJson);
-  const url = new URL(`manifests/${shortImageId}`, baseUrl);
-  const requestHeaders = { ...headers, 'Content-Type': MANIFEST_MEDIA_TYPE };
-
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]     [SUBSTEP: Upload Manifest to Registry]`);
-  //   console.error(`[beamo-node]       URL: ${url}`);
-  //   console.error(`[beamo-node]       Method: PUT`);
-  //   console.error(`[beamo-node]       Tag: ${shortImageId}`);
-  //   console.error(`[beamo-node]       Headers:`, JSON.stringify(requestHeaders, null, 2));
-  //   console.error(`[beamo-node]       Manifest JSON:`, manifestJsonString);
-  // }
-
-  const response = await fetch(url, {
-    method: 'PUT',
-    headers: requestHeaders,
-    body: manifestJsonString,
-  });
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]       Response Status: ${response.status}`);
-  //   console.error(`[beamo-node]       Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
-  // }
-  
-  if (!response.ok) {
-    const text = await response.text();
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]       Response Body: ${text.substring(0, 500)}`);
-    // }
-    throw new Error(`Failed to upload manifest: ${response.status} ${text}`);
-  }
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]       Manifest upload successful`);
-  // }
-}
-
-async function fetchJson(url, options = {}) {
-  const response = await fetch(url, options);
-  if (!response.ok) {
-    const text = await response.text();
-    const error = new Error(`Request failed ${response.status}: ${text}`);
-    error.status = response.status;
-    throw error;
-  }
-  return response.json();
-}
-
-async function resolveGamePid(apiHost, token, cid, pid, explicitGamePid) {
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node] [STEP: Resolve Game PID]`);
-  //   console.error(`[beamo-node]   Explicit Game PID: ${explicitGamePid || '(none)'}`);
-  //   console.error(`[beamo-node]   Realm PID: ${pid}`);
-  //   console.error(`[beamo-node]   NOTE: Always resolving root project (Game ID) from API, ignoring explicit value`);
-  // }
-  
-  // Always resolve the root project from the API (matching C# CLI's FindRoot().Pid)
-  // The explicit game PID might be incorrect (could be realm PID instead of root)
-  const scope = pid ? `${cid}.${pid}` : cid;
-  try {
-    const url = new URL(`/basic/realms/game`, apiHost);
-    url.searchParams.set('rootPID', pid);
-    const requestHeaders = {
-      Authorization: `Bearer ${token}`,
-      Accept: 'application/json',
-      ...(scope ? { 'X-BEAM-SCOPE': scope } : {}),
-    };
-    
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   Fetching game PID from: ${url}`);
-    //   console.error(`[beamo-node]   Headers:`, JSON.stringify(requestHeaders, null, 2));
-    // }
-    
-    const body = await fetchJson(url, { headers: requestHeaders });
-
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   Response:`, JSON.stringify(body, null, 2));
-    // }
-
-    const projects = Array.isArray(body?.projects) ? body.projects : [];
-    if (projects.length === 0) {
-      // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-      //   console.error(`[beamo-node]   No projects found, using realm PID: ${pid}`);
-      // }
-      return pid;
-    }
-
-    // Match C# CLI FindRoot() logic: walk up parent chain until Parent == null (root)
-    const byPid = new Map(projects.map((project) => [project.pid, project]));
-    let current = byPid.get(pid);
-    if (!current) {
-      // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-      //   console.error(`[beamo-node]   Realm PID not found in projects, using realm PID: ${pid}`);
-      // }
-      return pid;
-    }
-    
-    const visited = new Set();
-    // Walk up parent chain until we find root (parent == null or isRoot == true)
-    while (current && (current.parent != null && current.parent !== '' && !current.isRoot) && !visited.has(current.parent)) {
-      visited.add(current.pid);
-      current = byPid.get(current.parent);
-      if (!current) {
-        // Parent not found in projects list, current is as far as we can go
-        break;
-      }
-    }
-    // current is now the root (or the original if no parent chain)
-    const resolved = current?.pid ?? pid;
-    
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   Resolved Game PID (root): ${resolved}`);
-    //   if (explicitGamePid && explicitGamePid !== resolved) {
-    //     console.error(`[beamo-node]   ⚠️  WARNING: Explicit Game PID (${explicitGamePid}) does not match resolved root (${resolved})`);
-    //     console.error(`[beamo-node]   Using resolved root (${resolved}) for imageNameMD5 calculation`);
-    //   }
-    // }
-    return resolved;
-  } catch (error) {
-    // Debug logging only
-    return pid;
-  }
-}
-
-async function getScopedAccessToken(apiHost, cid, pid, refreshToken, fallbackToken) {
-  const scope = pid ? `${cid}.${pid}` : cid;
-  if (!refreshToken) {
-    return { accessToken: fallbackToken, refreshToken };
-  }
-
-  try {
-    const response = await fetch(new URL('/basic/auth/token', apiHost), {
-      method: 'POST',
-      headers: {
-        Accept: 'application/json',
-        'Content-Type': 'application/json',
-        ...(scope ? { 'X-BEAM-SCOPE': scope } : {}),
-      },
-      body: JSON.stringify({
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken,
-      }),
-    });
-
-    if (!response.ok) {
-      const text = await response.text();
-      throw new Error(`Refresh token request failed: ${response.status} ${text}`);
-    }
-
-    const body = await response.json();
-    const accessToken = body.access_token ?? fallbackToken;
-    const nextRefresh = body.refresh_token ?? refreshToken;
-    return { accessToken, refreshToken: nextRefresh };
-  } catch (error) {
-    // Debug logging only
-    return { accessToken: fallbackToken, refreshToken };
-  }
-}
-
-async function getRegistryUrl(apiHost, token, cid, pid) {
-  const scope = pid ? `${cid}.${pid}` : cid;
-  const url = new URL('/basic/beamo/registry', apiHost);
-  const headers = {
-    Authorization: `Bearer ${token}`,
-    Accept: 'application/json',
-    ...(scope ? { 'X-BEAM-SCOPE': scope } : {}),
-  };
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node] [STEP: Get Registry URL]`);
-  //   console.error(`[beamo-node]   URL: ${url}`);
-  //   console.error(`[beamo-node]   Headers:`, JSON.stringify(headers, null, 2));
-  //   console.error(`[beamo-node]   Scope: ${scope}`);
-  // }
-  
-  const body = await fetchJson(url, { headers });
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   Response:`, JSON.stringify(body, null, 2));
-  // }
-  
-  const uri = body.uri || body.registry || body.url;
-  if (!uri) {
-    throw new Error('Registry URI response missing "uri" field.');
-  }
-  // Match C# CLI exactly: GetDockerImageRegistryUri() returns scheme://host/v2/ (Host property strips port)
-  const normalized = uri.includes('://') ? uri : `https://${uri}`;
-  const parsed = new URL(normalized);
-  // parsedUri.Host in C# is just the hostname (no port), so we use hostname here
-  const registryUrl = `${parsed.protocol}//${parsed.hostname}/v2/`;
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   Normalized Registry URL: ${registryUrl}`);
-  // }
-  
-  return registryUrl;
-}
-
-async function uploadDockerImage({
-  apiHost,
-  registryUrl,
-  cid,
-  pid,
-  gamePid,
-  token,
-  serviceId,
-  uniqueName,
-  imageTarPath,
-  fullImageId,
-  progress,
-}) {
-  const baseUrl = `${registryUrl}${uniqueName}/`;
-  // Match C# CLI and backend: use realm PID in headers (backend checks registry using rc.projectId)
-  // uniqueName uses gamePid (matches backend's rc.gameId), but headers use realm PID
-  const headers = {
-    'x-ks-clientid': cid,
-    'x-ks-projectid': pid, // Use realm PID (matches backend's rc.projectId in DockerRegistryClient)
-    'x-ks-token': token, // Access token from login
-  };
-  
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node] [STEP: Upload Docker Image]`);
-  //   console.error(`[beamo-node]   Base URL: ${baseUrl}`);
-  //   console.error(`[beamo-node]   Registry URL: ${registryUrl}`);
-  //   console.error(`[beamo-node]   Unique Name: ${uniqueName}`);
-  //   console.error(`[beamo-node]   Service ID: ${serviceId}`);
-  //   console.error(`[beamo-node]   CID: ${cid}`);
-  //   console.error(`[beamo-node]   Realm PID: ${pid}`);
-  //   console.error(`[beamo-node]   Game PID: ${gamePid}`);
-  //   console.error(`[beamo-node]   Full Image ID: ${fullImageId}`);
-  //   console.error(`[beamo-node]   Upload Headers:`, JSON.stringify(headers, null, 2));
-  // }
-
-  const { manifestEntry, configBuffer, layers } = await readDockerImageTar(imageTarPath);
-
-  // Upload config
-  if (progress) {
-    process.stdout.write(`\r${colors.blue}↑${colors.reset} Uploading config...`);
-  }
-  const configDigestValue = sha256Digest(configBuffer);
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   [SUBSTEP: Upload Config]`);
-  //   console.error(`[beamo-node]     Config Digest: ${configDigestValue}`);
-  //   console.error(`[beamo-node]     Config Size: ${configBuffer.length} bytes`);
-  // }
-  const configDigest = await uploadBlob(baseUrl, configDigestValue, configBuffer, headers);
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]     Config Upload Result:`, JSON.stringify(configDigest, null, 2));
-  // }
-
-  // Upload layers with progress
-  const layerDescriptors = [];
-  const totalLayers = layers.length;
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   [SUBSTEP: Upload Layers]`);
-  //   console.error(`[beamo-node]     Total Layers: ${totalLayers}`);
-  // }
-  for (let i = 0; i < layers.length; i++) {
-    if (progress) {
-      process.stdout.write(`\r${colors.blue}↑${colors.reset} Uploading layers (${i + 1}/${totalLayers})...`);
-    }
-    const layerDigestValue = sha256Digest(layers[i].buffer);
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]     Layer ${i + 1}/${totalLayers}:`);
-    //   console.error(`[beamo-node]       Digest: ${layerDigestValue}`);
-    //   console.error(`[beamo-node]       Size: ${layers[i].buffer.length} bytes`);
-    // }
-    const descriptor = await uploadBlob(baseUrl, layerDigestValue, layers[i].buffer, headers);
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]       Upload Result:`, JSON.stringify(descriptor, null, 2));
-    // }
-    layerDescriptors.push({
-      digest: descriptor.digest,
-      size: descriptor.size,
-      mediaType: LAYER_MEDIA_TYPE,
-    });
-  }
-
-  const uploadManifestJson = {
-    schemaVersion: 2,
-    mediaType: MANIFEST_MEDIA_TYPE,
-    config: {
-      mediaType: CONFIG_MEDIA_TYPE,
-      digest: configDigest.digest,
-      size: configDigest.size,
-    },
-    layers: layerDescriptors,
-  };
-
-  // Upload manifest using short imageId as tag (matching C# CLI behavior)
-  if (progress) {
-    process.stdout.write(`\r${colors.blue}↑${colors.reset} Uploading manifest...`);
-  }
-  const shortImageId = shortDigest(fullImageId);
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   [SUBSTEP: Upload Manifest]`);
-  //   console.error(`[beamo-node]     Short Image ID: ${shortImageId}`);
-  //   console.error(`[beamo-node]     Manifest JSON:`, JSON.stringify(uploadManifestJson, null, 2));
-  // }
-  await uploadManifest(baseUrl, uploadManifestJson, shortImageId, headers);
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]     Manifest Upload Complete`);
-  // }
-  if (progress) {
-    process.stdout.write('\r');
-  }
-}
-
-async function fetchCurrentManifest(apiHost, token, cid, pid) {
-  const response = await fetch(new URL('/api/beamo/manifests/current', apiHost), {
-    headers: {
-      Authorization: `Bearer ${token}`,
-      Accept: 'application/json',
-      'X-BEAM-SCOPE': `${cid}.${pid}`,
-    },
-  });
-  if (response.status === 404) {
-    // No existing manifest (first publish) - return null
-    return null;
-  }
-  if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Failed to fetch current manifest: ${response.status} ${text}`);
-  }
-  return response.json();
-}
-
-async function discoverStorageObjects(srcDir, cwd = process.cwd()) {
-  const storageObjects = [];
-  try {
-    // Resolve src path relative to current working directory (where publish is run from)
-    const srcPath = path.isAbsolute(srcDir) ? srcDir : path.resolve(cwd, srcDir || 'src');
-    
-    console.log(`[beamo-node] Searching for @StorageObject decorators in: ${srcPath}`);
-    
-    // Check if directory exists
-    try {
-      const stats = await fs.stat(srcPath);
-      if (!stats.isDirectory()) {
-        console.warn(`[beamo-node] Warning: ${srcPath} is not a directory`);
-        return storageObjects;
-      }
-    } catch (error) {
-      console.warn(`[beamo-node] Warning: Directory ${srcPath} does not exist`);
-      return storageObjects;
-    }
-    
-    const files = await getAllTypeScriptFiles(srcPath);
-    
-    if (files.length === 0) {
-      console.warn(`[beamo-node] Warning: No TypeScript files found in ${srcPath}`);
-      return storageObjects;
-    }
-    
-    console.log(`[beamo-node] Scanning ${files.length} TypeScript file(s) for @StorageObject decorators...`);
-    
-    for (const file of files) {
-      const content = await fs.readFile(file, 'utf-8');
-      // Match @StorageObject('StorageName') pattern - handle both single and double quotes
-      // Also match multiline patterns where decorator might be on a different line
-      const storageRegex = /@StorageObject\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-      let match;
-      while ((match = storageRegex.exec(content)) !== null) {
-        const storageName = match[1];
-        if (storageName && !storageObjects.find(s => s.id === storageName)) {
-          storageObjects.push({
-            id: storageName,
-            enabled: true,
-            checksum: null,
-            archived: false,
-          });
-          console.log(`[beamo-node] ✓ Discovered storage object: ${storageName} (from ${path.relative(cwd, file)})`);
-        }
-      }
-    }
-    
-    if (storageObjects.length === 0) {
-      console.log(`[beamo-node] No @StorageObject decorators found in ${files.length} file(s) in ${srcPath}`);
-      console.log(`[beamo-node] Make sure your storage classes are decorated with @StorageObject('StorageName')`);
-    }
-  } catch (error) {
-    console.warn(`[beamo-node] Error discovering storage objects: ${error instanceof Error ? error.message : String(error)}`);
-    if (error instanceof Error && error.stack) {
-      console.warn(`[beamo-node] Stack: ${error.stack}`);
-    }
-    // If we can't discover storage, that's okay - we'll just use existing ones
-  }
-  return storageObjects;
-}
-
-async function discoverFederationComponents(srcDir) {
-  const components = [];
-  try {
-    const srcPath = path.resolve(srcDir || 'src');
-    const files = await getAllTypeScriptFiles(srcPath);
-    
-    for (const file of files) {
-      const content = await fs.readFile(file, 'utf-8');
-      
-      // Match @FederatedInventory({ identity: IdentityClass }) pattern
-      const federatedInventoryRegex = /@FederatedInventory\s*\(\s*\{\s*identity:\s*(\w+)\s*\}\s*\)/g;
-      let match;
-      while ((match = federatedInventoryRegex.exec(content)) !== null) {
-        const identityClassName = match[1];
-        
-        // Find the identity class definition in the same file or other files
-        // Look for: class IdentityClass implements FederationIdentity { getUniqueName(): string { return 'name'; } }
-        // Use multiline matching to handle class definitions that span multiple lines
-        const identityClassRegex = new RegExp(
-          `class\\s+${identityClassName}[^{]*\\{[\\s\\S]*?getUniqueName\\(\\)[\\s\\S]*?return\\s+['"]([^'"]+)['"]`,
-          's'
-        );
-        let identityMatch = identityClassRegex.exec(content);
-        
-        // If not found in current file, search other files
-        if (!identityMatch) {
-          for (const otherFile of files) {
-            if (otherFile !== file) {
-              const otherContent = await fs.readFile(otherFile, 'utf-8');
-              identityMatch = identityClassRegex.exec(otherContent);
-              if (identityMatch) {
-                break;
-              }
-            }
-          }
-        }
-        
-        if (identityMatch) {
-          const identityName = identityMatch[1];
-          // Add both IFederatedInventory and IFederatedLogin components
-          const inventoryComponent = `IFederatedInventory/${identityName}`;
-          const loginComponent = `IFederatedLogin/${identityName}`;
-          if (!components.includes(inventoryComponent)) {
-            components.push(inventoryComponent);
-          }
-          if (!components.includes(loginComponent)) {
-            components.push(loginComponent);
-          }
-        }
-      }
-    }
-  } catch (error) {
-    // If we can't discover components, that's okay - we'll just use existing ones
-    // Debug logging only
-  }
-  return components;
-}
-
-async function getAllTypeScriptFiles(dir) {
-  const files = [];
-  try {
-    const entries = await fs.readdir(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = path.join(dir, entry.name);
-      if (entry.isDirectory() && entry.name !== 'node_modules' && !entry.name.startsWith('.')) {
-        files.push(...await getAllTypeScriptFiles(fullPath));
-      } else if (entry.isFile() && (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx'))) {
-        files.push(fullPath);
-      }
-    }
-  } catch (error) {
-    // Ignore errors reading directories
-  }
-  return files;
-}
-
-async function updateManifest({
-  apiHost,
-  token,
-  cid,
-  pid,
-  serviceId,
-  shortImageId, // This is now the full image ID (sha256:...) for backend verification
-  comments,
-  existingManifest,
-  discoveredStorage,
-  discoveredComponents,
-  discoveredDependencies,
-}) {
-  const serviceReferences = existingManifest?.serviceReferences?.Value
-    ?? existingManifest?.serviceReferences
-    ?? existingManifest?.manifest
-    ?? [];
-  const storageRefsRaw = existingManifest?.storageReferences?.Value
-    ?? existingManifest?.storageReferences
-    ?? [];
-  const existingStorage = Array.isArray(storageRefsRaw)
-    ? storageRefsRaw.map((reference) => ({
-        id: reference.id?.Value ?? reference.id,
-        storageType: reference.storageType?.Value ?? reference.storageType ?? 'mongov1',
-        enabled: reference.enabled?.Value ?? reference.enabled ?? true,
-        checksum: reference.checksum?.Value ?? reference.checksum,
-        archived: reference.archived?.Value ?? reference.archived ?? false,
-      }))
-    : [];
-  
-  // Merge discovered storage with existing storage
-  // If a storage object exists in both, keep the existing one (preserves checksum, etc.)
-  // But ensure storageType is always set to 'mongov1' for MongoDB storage
-  const storageMap = new Map();
-  existingStorage.forEach(s => {
-    // Normalize storageType: update 'mongo' to 'mongov1' if present
-    const normalizedStorage = {
-      ...s,
-      storageType: s.storageType === 'mongo' ? 'mongov1' : (s.storageType || 'mongov1'),
-    };
-    storageMap.set(s.id, normalizedStorage);
-  });
-  discoveredStorage.forEach(s => {
-    if (!storageMap.has(s.id)) {
-      storageMap.set(s.id, {
-        ...s,
-        storageType: 'mongov1', // All discovered storage uses MongoDB
-      });
-    } else {
-      // Update existing storage to ensure storageType is 'mongov1'
-      const existing = storageMap.get(s.id);
-      storageMap.set(s.id, {
-        ...existing,
-        storageType: 'mongov1',
-      });
-    }
-  });
-  const storageReferences = Array.from(storageMap.values());
-
-  // Extract existing components and dependencies for the service
-  const existingServiceRef = serviceReferences.find(
-    (ref) => (ref.serviceName?.Value ?? ref.serviceName) === serviceId
-  );
-  const existingComponents = existingServiceRef?.components?.Value 
-    ?? existingServiceRef?.components 
-    ?? [];
-  const existingDependencies = existingServiceRef?.dependencies?.Value 
-    ?? existingServiceRef?.dependencies 
-    ?? [];
-
-  // Components are ServiceComponent objects with {name: string}
-  // Merge discovered with existing (preserve existing, add new)
-  const componentsMap = new Map();
-  // Add existing components
-  if (Array.isArray(existingComponents)) {
-    existingComponents.forEach(comp => {
-      const name = comp.name?.Value ?? comp.name ?? comp;
-      if (typeof name === 'string') {
-        componentsMap.set(name, { name });
-      }
-    });
-  }
-  // Add discovered components (will overwrite existing if same name)
-  (discoveredComponents || []).forEach(compName => {
-    componentsMap.set(compName, { name: compName });
-  });
-  const components = Array.from(componentsMap.values());
-
-  // Dependencies are objects with {id, storageType}, need to merge by id
-  const dependenciesMap = new Map();
-  // Add existing dependencies
-  if (Array.isArray(existingDependencies)) {
-    existingDependencies.forEach(dep => {
-      const id = dep.id?.Value ?? dep.id ?? dep;
-      if (typeof id === 'string') {
-        let storageType = dep.storageType?.Value ?? dep.storageType ?? 'mongov1';
-        // Normalize: update 'mongo' to 'mongov1' to match C# microservices
-        if (storageType === 'mongo') {
-          storageType = 'mongov1';
-        }
-        dependenciesMap.set(id, { id, storageType });
-      }
-    });
-  }
-  // Add discovered dependencies (will overwrite existing if same id)
-  (discoveredDependencies || []).forEach(dep => {
-    dependenciesMap.set(dep.id, dep);
-  });
-  const dependencies = Array.from(dependenciesMap.values());
-
-  let updated = false;
-  const mappedServices = serviceReferences.map((reference) => {
-    const name = reference.serviceName?.Value ?? reference.serviceName;
-    if (name === serviceId) {
-      updated = true;
-      return {
-        serviceName: serviceId,
-        enabled: true,
-        templateId: reference.templateId?.Value ?? reference.templateId ?? 'small',
-        containerHealthCheckPort: reference.containerHealthCheckPort?.Value ?? reference.containerHealthCheckPort ?? 6565,
-        imageId: shortImageId,
-        imageCpuArch: reference.imageCpuArch?.Value ?? reference.imageCpuArch ?? 'linux/amd64',
-        logProvider: reference.logProvider?.Value ?? reference.logProvider ?? 'Clickhouse',
-        dependencies,
-        components,
-      };
-    }
-    return {
-      serviceName: name,
-      enabled: reference.enabled?.Value ?? reference.enabled ?? true,
-      templateId: reference.templateId?.Value ?? reference.templateId ?? 'small',
-      containerHealthCheckPort: reference.containerHealthCheckPort?.Value ?? reference.containerHealthCheckPort ?? 6565,
-      imageId: reference.imageId?.Value ?? reference.imageId ?? shortImageId,
-      imageCpuArch: reference.imageCpuArch?.Value ?? reference.imageCpuArch ?? 'linux/amd64',
-      logProvider: reference.logProvider?.Value ?? reference.logProvider ?? 'Clickhouse',
-      dependencies: reference.dependencies?.Value ?? reference.dependencies ?? [],
-      components: reference.components?.Value ?? reference.components ?? [],
-    };
-  });
-
-  if (!updated) {
-    mappedServices.push({
-      serviceName: serviceId,
-      enabled: true,
-      templateId: 'small',
-      containerHealthCheckPort: 6565,
-      imageId: shortImageId,
-      imageCpuArch: 'linux/amd64',
-      logProvider: 'Clickhouse',
-      dependencies,
-      components,
-    });
-  }
-
-  const requestBody = {
-    autoDeploy: true,
-    comments: comments ?? '',
-    manifest: mappedServices,
-    storageReferences,
-  };
-  
-  // Log storage references being sent to backend
-  if (storageReferences.length > 0) {
-    console.log(`[beamo-node] Publishing ${storageReferences.length} storage reference(s) in manifest:`);
-    storageReferences.forEach(s => {
-      console.log(`[beamo-node]   - ${s.id} (type: ${s.storageType || 'mongov1'}, enabled: ${s.enabled !== false})`);
-    });
-  } else {
-    console.warn(`[beamo-node] Warning: No storage references in manifest. Database will not be created automatically.`);
-  }
-
-  const publishUrl = new URL('/basic/beamo/manifest', apiHost);
-  const publishHeaders = {
-    Authorization: `Bearer ${token}`,
-    Accept: 'application/json',
-    'Content-Type': 'application/json',
-    'X-BEAM-SCOPE': `${cid}.${pid}`,
-  };
-
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node] [STEP: Publish Manifest to Backend]`);
-  //   console.error(`[beamo-node]   URL: ${publishUrl}`);
-  //   console.error(`[beamo-node]   Method: POST`);
-  //   console.error(`[beamo-node]   Headers:`, JSON.stringify(publishHeaders, null, 2));
-  //   console.error(`[beamo-node]   Service: ${serviceId}`);
-  //   console.error(`[beamo-node]   CID: ${cid}`);
-  //   console.error(`[beamo-node]   Realm PID (from X-BEAM-SCOPE): ${pid}`);
-  //   console.error(`[beamo-node]   Short Image ID: ${shortImageId}`);
-  //   console.error(`[beamo-node]   Expected Backend Check:`);
-  //   console.error(`[beamo-node]     - Backend will calculate imageNameMD5 using: rc.cid, rc.gameId, serviceName`);
-  //   console.error(`[beamo-node]     - Backend will check: {registryURI}/{imageNameMD5}/manifests/{imageId}`);
-  //   console.error(`[beamo-node]     - Backend will use headers: X-KS-PROJECTID: rc.projectId (from X-BEAM-SCOPE)`);
-  //   console.error(`[beamo-node]     - NOTE: rc.gameId might differ from realm PID if backend resolves it differently`);
-  //   console.error(`[beamo-node]   Request Body:`, JSON.stringify(requestBody, null, 2));
-  //   console.error(`[beamo-node]   Service Entry in Manifest:`, JSON.stringify(mappedServices.find(s => s.serviceName === serviceId), null, 2));
-  // }
-
-  const response = await fetch(publishUrl, {
-    method: 'POST',
-    headers: publishHeaders,
-    body: JSON.stringify(requestBody),
-  });
-
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   Response Status: ${response.status}`);
-  //   console.error(`[beamo-node]   Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
-  // }
-  
-  if (!response.ok) {
-    const text = await response.text();
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   Response Body: ${text}`);
-    //   console.error(`[beamo-node]   Full Request Body (for debugging):`, JSON.stringify(requestBody, null, 2));
-    // }
-    throw new Error(`Failed to publish manifest: ${response.status} ${text}`);
-  }
-  
-  const responseBody = await response.json();
-  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-  //   console.error(`[beamo-node]   Response Body:`, JSON.stringify(responseBody, null, 2));
-  //   console.error(`[beamo-node]   ✓ Manifest published successfully`);
-  // }
-}
-
-async function prepareDockerContext({ entry, distDir, openapiPath, packageJson, packageLock, nodeVersion }) {
-  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'beam-node-ms-'));
-  const contextDir = path.join(tempRoot, 'context');
-  const appDir = path.join(contextDir, 'app');
-  await fs.mkdir(appDir, { recursive: true });
-
-  // Read and modify package.json to handle file: dependencies
-  const pkg = JSON.parse(await fs.readFile(packageJson, 'utf8'));
-  const modifiedPkg = { ...pkg };
-  
-  // No need to handle file: dependencies anymore - the runtime is published to npm
-  // Just copy the package.json as-is
-  await fs.copyFile(packageJson, path.join(appDir, 'package.json'));
-  
-  try {
-    await fs.copyFile(packageLock, path.join(appDir, 'package-lock.json'));
-  } catch {
-    // ignore missing package-lock
-  }
-
-  await copyDirectory(distDir, path.join(appDir, 'dist'));
-  try {
-    await fs.copyFile(openapiPath, path.join(appDir, 'beam_openApi.json'));
-  } catch {
-    await fs.writeFile(path.join(appDir, 'beam_openApi.json'), '{}\n');
-  }
-  
-  // Copy beam.env file if it exists (for developer-defined environment variables)
-  let beamEnvFile = null;
-  const beamEnvPath = path.join(path.dirname(packageJson), 'beam.env');
-  const beamEnvHiddenPath = path.join(path.dirname(packageJson), '.beam.env');
-  try {
-    if (await fs.access(beamEnvPath).then(() => true).catch(() => false)) {
-      await fs.copyFile(beamEnvPath, path.join(appDir, 'beam.env'));
-      beamEnvFile = 'beam.env';
-      console.log('Included beam.env file in Docker image');
-    } else if (await fs.access(beamEnvHiddenPath).then(() => true).catch(() => false)) {
-      await fs.copyFile(beamEnvHiddenPath, path.join(appDir, '.beam.env'));
-      beamEnvFile = '.beam.env';
-      console.log('Included .beam.env file in Docker image');
-    }
-  } catch {
-    // beam.env is optional, ignore if not found
-  }
-
-  const dockerfile = `# syntax=docker/dockerfile:1
-ARG NODE_VERSION=${nodeVersion}
-FROM node:${nodeVersion}-alpine
-
-WORKDIR /beam/service
-
-COPY app/package*.json ./
-# Install dependencies (runtime is now on npm, so no special handling needed)
-RUN npm install --omit=dev && npm cache clean --force
-
-# Pre-install OpenTelemetry collector binary and config to avoid runtime download delay (~12 seconds)
-# This is stored in /opt/beam/collectors/ which persists and is checked first by the runtime
-RUN mkdir -p /opt/beam/collectors/1.0.1 && \\
-    apk add --no-cache wget gzip && \\
-    wget https://collectors.beamable.com/version/1.0.1/collector-linux-amd64.gz -O /tmp/collector.gz && \\
-    gunzip /tmp/collector.gz && \\
-    mv /tmp/collector /opt/beam/collectors/1.0.1/collector-linux-amd64 && \\
-    chmod +x /opt/beam/collectors/1.0.1/collector-linux-amd64 && \\
-    wget https://collectors.beamable.com/version/1.0.1/clickhouse-config.yaml.gz -O /tmp/config.gz && \\
-    gunzip /tmp/config.gz && \\
-    mv /tmp/config /opt/beam/collectors/1.0.1/clickhouse-config.yaml && \\
-    rm -f /tmp/collector.gz /tmp/config.gz && \\
-    apk del wget gzip
-
-COPY app/dist ./dist
-COPY app/beam_openApi.json ./beam_openApi.json${beamEnvFile ? `\nCOPY app/${beamEnvFile} ./${beamEnvFile}` : ''}
-
-# Expose health check port (matches C# microservice behavior)
-EXPOSE 6565
-
-ENV NODE_ENV=production
-
-# Add startup script to log what's happening and catch errors
-RUN echo '#!/bin/sh' > /beam/service/start.sh && \\
-    echo 'echo "Starting Node.js microservice..."' >> /beam/service/start.sh && \\
-    echo 'echo "Working directory: $(pwd)"' >> /beam/service/start.sh && \\
-    echo 'echo "Node version: $(node --version)"' >> /beam/service/start.sh && \\
-    echo 'echo "Files in dist:"' >> /beam/service/start.sh && \\
-    echo 'ls -la dist/ || echo "dist directory not found!"' >> /beam/service/start.sh && \\
-    echo 'echo "Starting main.js..."' >> /beam/service/start.sh && \\
-    echo 'exec node dist/main.js' >> /beam/service/start.sh && \\
-    chmod +x /beam/service/start.sh
-
-# Use ENTRYPOINT with startup script to ensure we see what's happening
-ENTRYPOINT ["/beam/service/start.sh"]
-
-# Debug option: uncomment the line below and comment the ENTRYPOINT above
-# to keep the container alive for debugging (like C# Dockerfile does)
-# ENTRYPOINT ["tail", "-f", "/dev/null"]
-`;
-  await fs.writeFile(path.join(contextDir, 'Dockerfile'), dockerfile, 'utf8');
-
-  return { tempRoot, contextDir };
-}
-
-async function main() {
-  // Parse --env-file first so we can load .env before parseArgs reads environment variables
-  // This ensures .env file values are used instead of stale system environment variables
-  const rawArgs = process.argv.slice(2);
-  let envFile = undefined;
-  for (let i = 0; i < rawArgs.length; i++) {
-    if (rawArgs[i] === '--env-file' && i + 1 < rawArgs.length) {
-      envFile = rawArgs[i + 1];
-      break;
-    }
-  }
-  
-  // Load .env file first with override to ensure it takes precedence
-  if (envFile) {
-    dotenv.config({ path: path.resolve(envFile), override: true });
-  } else if (process.env.npm_config_env_file) {
-    dotenv.config({ path: path.resolve(process.env.npm_config_env_file), override: true });
-  }
-
-  // Now parse all args - env vars from .env will be available
-  const args = parseArgs(rawArgs);
-
-  const pkg = await readJson(path.resolve('package.json'));
-  const beamableConfig = pkg.beamable || {};
-
-  const serviceId = args.service || beamableConfig.beamoId || pkg.name;
-  ensure(serviceId, 'Service identifier is required. Provide --service or set beamable.beamoId in package.json.');
-
-  const cid = ensure(args.cid || beamableConfig.cid || process.env.CID, 'CID is required (set CID env var or --cid).');
-  const pid = ensure(args.pid || beamableConfig.pid || process.env.PID, 'PID is required (set PID env var or --pid).');
-  const host = args.host || beamableConfig.host || process.env.HOST || 'wss://api.beamable.com/socket';
-  const apiHost = normalizeApiHost(args.apiHost || beamableConfig.apiHost || process.env.BEAMABLE_API_HOST || host);
-  const token = ensure(args.token || process.env.ACCESS_TOKEN || process.env.BEAMABLE_TOKEN, 'Access token is required (set BEAMABLE_TOKEN env var or --token).');
-  
-  const configuredGamePid = args.gamePid || beamableConfig.gamePid || process.env.BEAMABLE_GAME_PID;
-  const refreshToken = args.refreshToken || process.env.BEAMABLE_REFRESH_TOKEN || process.env.REFRESH_TOKEN;
-
-  if (!apiHost) {
-    throw new Error('API host could not be determined. Set BEAMABLE_API_HOST or provide --api-host.');
-  }
-
-  // Initialize progress bar (8 main steps)
-  const progress = new ProgressBar(8);
-  console.log(`${colors.bright}${colors.cyan}Publishing ${serviceId}...${colors.reset}\n`);
-
-  // Step 1: Build
-  progress.start('Building project');
-  if (!args.skipValidate) {
-    const validateScript = path.resolve(__dirname, 'validate-service.mjs');
-    const validateArgs = ['--entry', args.entry, '--output', args.openapi, '--cid', cid, '--pid', pid, '--host', host];
-    if (args.envFile) {
-      validateArgs.push('--env-file', args.envFile);
-    }
-    if (args.namePrefix) {
-      validateArgs.push('--routing-key', args.namePrefix);
-    }
-    validateArgs.push('--skip-build');
-    await runCommand('npm', ['run', 'build'], { silent: true });
-    await runCommand(process.execPath, [validateScript, ...validateArgs], { shell: false, silent: true });
-  } else {
-    await runCommand('npm', ['run', 'build'], { silent: true });
-  }
-  progress.complete('Build complete');
-
-  const packageJsonPath = path.resolve('package.json');
-  const packageLockPath = path.resolve('package-lock.json');
-  const distDir = path.resolve('dist');
-  const openapiPath = path.resolve(args.openapi);
-  const entryFile = path.resolve(args.entry);
-
-  await fs.access(entryFile);
-  await fs.access(distDir);
-
-  let tempRoot;
-  try {
-    // Step 2: Prepare Docker context
-    progress.start('Preparing Docker context');
-    const context = await prepareDockerContext({
-      entry: entryFile,
-      distDir,
-      openapiPath,
-      packageJson: packageJsonPath,
-      packageLock: packageLockPath,
-      nodeVersion: args.nodeVersion,
-    });
-    tempRoot = context.tempRoot;
-    const { contextDir } = context;
-    progress.complete('Docker context prepared');
-
-    // Step 3: Build Docker image
-    progress.start('Building Docker image');
-    const dockerTag = args.dockerTag || `${serviceId.toLowerCase().replace(/[^a-z0-9-_]/g, '-')}:${Date.now()}`;
-    await runCommand('docker', ['build', '-t', dockerTag, contextDir], { cwd: contextDir, silent: true });
-    progress.complete('Docker image built');
-
-    // Step 4: Extract image ID and save
-    progress.start('Preparing image for upload');
-    const inspect = await runCommand('docker', ['image', 'inspect', '--format', '{{.Id}}', dockerTag], { capture: true });
-    const fullImageId = inspect.stdout.trim();
-    const imageTarPath = path.join(tempRoot, `${serviceId.replace(/[^a-z0-9-_]/gi, '_')}.tar`);
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   // Calculate short digest manually (shortDigest function defined later)
-    //   const longImageId = fullImageId.includes(':') ? fullImageId.split(':')[1] : fullImageId;
-    //   const shortImageIdPreview = longImageId.substring(0, 12);
-    //   console.error(`[beamo-node] [STEP: Extract Image ID]`);
-    //   console.error(`[beamo-node]   Docker Tag: ${dockerTag}`);
-    //   console.error(`[beamo-node]   Full Image ID: ${fullImageId}`);
-    //   console.error(`[beamo-node]   Short Image ID (preview): ${shortImageIdPreview}`);
-    //   console.error(`[beamo-node]   Image Tar Path: ${imageTarPath}`);
-    // }
-    await runCommand('docker', ['image', 'save', dockerTag, '-o', imageTarPath], { silent: true });
-    progress.complete('Image prepared');
-
-    // Step 5: Authenticate and get registry
-    progress.start('Authenticating');
-    const resolvedGamePid = await resolveGamePid(apiHost, token, cid, pid, configuredGamePid);
-    
-    // Verify token is valid (401 means invalid token, 403 might just be permission issue)
-    try {
-      const testUrl = new URL('/basic/accounts/me', apiHost);
-      const testResponse = await fetch(testUrl, {
-        headers: {
-          Authorization: `Bearer ${token}`,
-          Accept: 'application/json',
-          'X-BEAM-SCOPE': `${cid}.${pid}`,
-        },
-      });
-      if (testResponse.status === 401) {
-        throw new Error(`Token validation failed: ${testResponse.status} ${await testResponse.text()}`);
-      }
-    } catch (error) {
-      if (error.message.includes('401')) {
-        throw new Error(`Token validation failed: ${error.message}. Please run "beamo-node login" again.`);
-      }
-    }
-    
-    // Match C# CLI: GetDockerImageRegistryUri() uses realm PID from context (X-BEAM-SCOPE)
-    // uniqueName uses gamePid (matches backend's rc.gameId), but registry URL uses realm PID
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node] [STEP: Calculate Registry Path]`);
-    //   console.error(`[beamo-node]   CID: ${cid}`);
-    //   console.error(`[beamo-node]   Realm PID: ${pid}`);
-    //   console.error(`[beamo-node]   Resolved Game PID: ${resolvedGamePid}`);
-    //   console.error(`[beamo-node]   Service ID: ${serviceId}`);
-    // }
-    const registryUrl = await getRegistryUrl(apiHost, token, cid, pid);
-    const uniqueNameInput = `${cid}_${resolvedGamePid}_${serviceId}`;
-    const uniqueName = md5Hex(uniqueNameInput).substring(0, 30);
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   Unique Name Input: ${uniqueNameInput}`);
-    //   console.error(`[beamo-node]   Unique Name (MD5 first 30 chars): ${uniqueName}`);
-    //   console.error(`[beamo-node]   Registry URL: ${registryUrl}`);
-    // }
-    progress.complete('Authenticated');
-
-    // Step 6: Upload Docker image
-    progress.start('Uploading Docker image to registry');
-    await uploadDockerImage({
-      apiHost,
-      registryUrl,
-      cid,
-      pid,
-      gamePid: resolvedGamePid,
-      token,
-      serviceId,
-      uniqueName,
-      imageTarPath,
-      fullImageId,
-      progress,
-    });
-    progress.complete('Image uploaded');
-
-    // Verify image exists in registry before proceeding
-    const shortImageId = shortDigest(fullImageId);
-    const baseUrl = `${registryUrl}${uniqueName}/`;
-    const verifyHeaders = {
-      'x-ks-clientid': cid,
-      'x-ks-projectid': pid, // Use realm PID (matches backend's rc.projectId when checking registry)
-      'x-ks-token': token,
-    };
-    
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node] [STEP: Post-Upload Verification]`);
-    //   console.error(`[beamo-node]   Full Image ID: ${fullImageId}`);
-    //   console.error(`[beamo-node]   Short Image ID: ${shortImageId}`);
-    //   console.error(`[beamo-node]   Base URL: ${baseUrl}`);
-    //   console.error(`[beamo-node]   Verification URL: ${baseUrl}manifests/${shortImageId}`);
-    //   console.error(`[beamo-node]   Verify Headers:`, JSON.stringify(verifyHeaders, null, 2));
-    // }
-    
-    // Wait a moment for registry to propagate
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   Waiting 3 seconds for registry propagation...`);
-    // }
-    await new Promise(resolve => setTimeout(resolve, 3000));
-    
-    const imageExists = await verifyManifestExists(baseUrl, shortImageId, verifyHeaders);
-    if (!imageExists) {
-      throw new Error(`Image verification failed: manifest with tag ${shortImageId} not found in registry at ${baseUrl}manifests/${shortImageId}. The image may not have uploaded successfully.`);
-    }
-    
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node]   ✓ Image verification passed`);
-    // }
-    
-    // CRITICAL: Perform exact backend check simulation
-    // The backend uses HEAD request with specific headers - let's verify it works
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node] [STEP: Backend Check Simulation]`);
-    //   console.error(`[beamo-node]   Simulating exact backend check...`);
-    //   const backendCheckUrl = `${registryUrl}${uniqueName}/manifests/${shortImageId}`;
-    //   console.error(`[beamo-node]   Backend will check: ${backendCheckUrl}`);
-    //   console.error(`[beamo-node]   Backend will use headers:`, JSON.stringify(verifyHeaders, null, 2));
-    //   try {
-    //     const backendCheckResponse = await fetch(backendCheckUrl, {
-    //       method: 'HEAD',
-    //       headers: verifyHeaders,
-    //     });
-    //     console.error(`[beamo-node]   Backend simulation response status: ${backendCheckResponse.status}`);
-    //     if (backendCheckResponse.status !== 200) {
-    //       console.error(`[beamo-node]   ⚠️  Backend simulation FAILED - status ${backendCheckResponse.status}`);
-    //       const responseText = await backendCheckResponse.text().catch(() => '');
-    //       console.error(`[beamo-node]   Response: ${responseText}`);
-    //     } else {
-    //       console.error(`[beamo-node]   ✓ Backend simulation passed`);
-    //     }
-    //   } catch (error) {
-    //     console.error(`[beamo-node]   ⚠️  Backend simulation error: ${error.message}`);
-    //   }
-    // }
-    
-    // CRITICAL: Before publishing, verify using the backend's expected gameId
-    // The backend resolves rc.gameId from the realm hierarchy, which might differ from our resolvedGamePid
-    // We need to check what the backend will actually use
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`[beamo-node] [STEP: Pre-Publish Backend Simulation]`);
-    //   console.error(`[beamo-node]   Simulating backend's imageNameMD5 calculation...`);
-    //   console.error(`[beamo-node]   Backend will use: rc.cid, rc.gameId (resolved from realm hierarchy), serviceName`);
-    //   console.error(`[beamo-node]   Our calculation used: cid=${cid}, gamePid=${resolvedGamePid}, serviceName=${serviceId}`);
-    //   console.error(`[beamo-node]   Our uniqueName: ${uniqueName}`);
-    //   console.error(`[beamo-node]   WARNING: If backend's rc.gameId differs from our resolvedGamePid, the check will fail!`);
-    // }
-    
-    // Try to resolve what the backend's rc.gameId will be by making the same API call the backend would make
-    // The backend resolves gameId from the realm hierarchy when processing X-BEAM-SCOPE
-    // try {
-    //   const backendGamePidCheck = await resolveGamePid(apiHost, token, cid, pid, null); // Force resolution
-    //   if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //     console.error(`[beamo-node]   Backend's expected gameId (resolved from realm hierarchy): ${backendGamePidCheck}`);
-    //     if (backendGamePidCheck !== resolvedGamePid) {
-    //       console.error(`[beamo-node]   ⚠️  MISMATCH DETECTED!`);
-    //       console.error(`[beamo-node]     Our resolvedGamePid: ${resolvedGamePid}`);
-    //       console.error(`[beamo-node]     Backend's expected gameId: ${backendGamePidCheck}`);
-    //       console.error(`[beamo-node]     This will cause imageNameMD5 mismatch!`);
-    //       const backendUniqueNameInput = `${cid}_${backendGamePidCheck}_${serviceId}`;
-    //       const backendUniqueName = md5Hex(backendUniqueNameInput).substring(0, 30);
-    //       console.error(`[beamo-node]     Backend will check: ${registryUrl}${backendUniqueName}/manifests/${shortImageId}`);
-    //       console.error(`[beamo-node]     But we uploaded to: ${registryUrl}${uniqueName}/manifests/${shortImageId}`);
-    //     } else {
-    //       console.error(`[beamo-node]   ✓ Game PID matches - backend should find the image`);
-    //     }
-    //   }
-    // } catch (error) {
-    //   if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //     console.error(`[beamo-node]   Could not verify backend gameId resolution: ${error.message}`);
-    //   }
-    // }
-
-    // Step 7: Discover storage, components, and dependencies
-    progress.start('Discovering storage objects and components');
-    // shortImageId already defined above from verification step
-    const existingManifest = await fetchCurrentManifest(apiHost, token, cid, pid);
-    const discoveredStorage = await discoverStorageObjects('src', process.cwd());
-    const discoveredComponents = await discoverFederationComponents('src');
-    // Dependencies are ServiceDependencyReference objects with id and storageType
-    // storageType should be "mongov1" for MongoDB storage objects (matching C# microservices)
-    const discoveredDependencies = discoveredStorage.map(s => ({
-      id: s.id,
-      storageType: 'mongov1', // MongoDB storage type (matches ServiceStorageReference in backend)
-    }));
-    
-    if (discoveredStorage.length > 0) {
-      console.log(`[beamo-node] Discovered ${discoveredStorage.length} storage object(s): ${discoveredStorage.map(s => s.id).join(', ')}`);
-    }
-    
-    progress.complete('Storage and components discovered');
-
-    // Step 8: Publish manifest
-    progress.start('Publishing manifest');
-    await updateManifest({
-      apiHost,
-      token,
-      cid,
-      pid,
-      serviceId,
-      shortImageId,
-      comments: args.comments,
-      existingManifest,
-      discoveredStorage,
-      discoveredComponents,
-      discoveredDependencies,
-    });
-    progress.complete('Manifest published');
-
-    // Success message
-    console.log(`\n${colors.green}${colors.bright}✓ Publish complete!${colors.reset}`);
-    console.log(`${colors.dim}  Service:${colors.reset} ${serviceId}`);
-    console.log(`${colors.dim}  Image ID:${colors.reset} ${fullImageId}`);
-    console.log(`${colors.dim}  Registry:${colors.reset} ${registryUrl}${uniqueName}`);
-  } finally {
-    if (tempRoot) {
-      await fs.rm(tempRoot, { recursive: true, force: true });
-    }
-  }
-}
-
-main().catch(async (error) => {
-  // Show clean error message
-  console.error(`\n${colors.red}${colors.bright}✗ Publish failed${colors.reset}`);
-  if (error instanceof Error) {
-    console.error(`${colors.red}${error.message}${colors.reset}`);
-    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
-    //   console.error(`\n${colors.dim}Stack:${colors.reset} ${error.stack}`);
-    //   if (error.cause) {
-    //     console.error(`${colors.dim}Cause:${colors.reset} ${error.cause}`);
-    //   }
-    //   if (error.stdout) {
-    //     console.error(`${colors.dim}stdout:${colors.reset} ${error.stdout}`);
-    //   }
-    //   if (error.stderr) {
-    //     console.error(`${colors.dim}stderr:${colors.reset} ${error.stderr}`);
-    //   }
-    //   console.error(`\n${colors.dim}Full error:${colors.reset}`, JSON.stringify(error, Object.getOwnPropertyNames(error), 2));
-    // }
-  } else {
-    console.error(`${colors.red}${error}${colors.reset}`);
-  }
-  process.exit(1);
-});
+#!/usr/bin/env node
+
+import fs from 'node:fs/promises';
+import fssync from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { fetch } from 'undici';
+import tar from 'tar-stream';
+import dotenv from 'dotenv';
+import { runCommand } from './lib/cli-utils.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DEFAULT_NODE_VERSION = '20';
+const MANIFEST_MEDIA_TYPE = 'application/vnd.docker.distribution.manifest.v2+json';
+const CONFIG_MEDIA_TYPE = 'application/vnd.docker.container.image.v1+json';
+const LAYER_MEDIA_TYPE = 'application/vnd.docker.image.rootfs.diff.tar.gzip';
+
+// ANSI color codes for colorful output
+const colors = {
+  reset: '\x1b[0m',
+  bright: '\x1b[1m',
+  dim: '\x1b[2m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  blue: '\x1b[34m',
+  magenta: '\x1b[35m',
+  cyan: '\x1b[36m',
+  red: '\x1b[31m',
+};
+
+// Progress bar manager
+class ProgressBar {
+  constructor(totalSteps) {
+    this.totalSteps = totalSteps;
+    this.currentStep = 0;
+    this.currentTask = '';
+    this.startTime = Date.now();
+  }
+
+  start(task) {
+    this.currentTask = task;
+    this.currentStep++;
+    this.update();
+  }
+
+  complete(task) {
+    this.currentTask = task;
+    this.update();
+    process.stdout.write('\n');
+  }
+
+  update() {
+    const percentage = Math.round((this.currentStep / this.totalSteps) * 100);
+    const barWidth = 30;
+    const filled = Math.round((percentage / 100) * barWidth);
+    const empty = barWidth - filled;
+    const bar = '█'.repeat(filled) + '░'.repeat(empty);
+    
+    const elapsed = ((Date.now() - this.startTime) / 1000).toFixed(1);
+    
+    // Clear line and write progress
+    process.stdout.write(`\r${colors.cyan}${bar}${colors.reset} ${colors.bright}${percentage}%${colors.reset} ${colors.dim}${this.currentTask}${colors.reset} ${colors.dim}(${elapsed}s)${colors.reset}`);
+  }
+
+  success(message) {
+    process.stdout.write(`\r${colors.green}✓${colors.reset} ${message}\n`);
+  }
+
+  info(message) {
+    process.stdout.write(`\r${colors.blue}ℹ${colors.reset} ${message}\n`);
+  }
+
+  error(message) {
+    process.stdout.write(`\r${colors.red}✗${colors.reset} ${message}\n`);
+  }
+}
+
+function parseArgs(argv) {
+  const args = {
+    entry: 'dist/main.js',
+    openapi: 'beam_openApi.json',
+    envFile: undefined,
+    cid: process.env.BEAMABLE_CID || process.env.CID,
+    pid: process.env.BEAMABLE_PID || process.env.PID,
+    host: process.env.BEAMABLE_HOST || process.env.HOST,
+    namePrefix: process.env.BEAMABLE_NAME_PREFIX || process.env.NAME_PREFIX,
+    token: process.env.BEAMABLE_TOKEN || process.env.BEAMABLE_ACCESS_TOKEN || process.env.ACCESS_TOKEN,
+    gamePid: process.env.BEAMABLE_GAME_PID,
+    comments: process.env.BEAMABLE_PUBLISH_COMMENTS,
+    service: process.env.BEAMABLE_SERVICE_ID,
+    dockerTag: process.env.BEAMABLE_DOCKER_TAG,
+    nodeVersion: process.env.BEAMABLE_NODE_VERSION || DEFAULT_NODE_VERSION,
+    skipValidate: false,
+    apiHost: process.env.BEAMABLE_API_HOST,
+  };
+
+  const queue = [...argv];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    switch (current) {
+      case '--entry':
+        args.entry = queue.shift();
+        break;
+      case '--openapi':
+        args.openapi = queue.shift();
+        break;
+      case '--env-file':
+        args.envFile = queue.shift();
+        break;
+      case '--cid':
+        args.cid = queue.shift();
+        break;
+      case '--pid':
+        args.pid = queue.shift();
+        break;
+      case '--host':
+        args.host = queue.shift();
+        break;
+      case '--routing-key':
+      case '--name-prefix':
+        args.namePrefix = queue.shift();
+        break;
+      case '--token':
+        args.token = queue.shift();
+        break;
+      case '--game-pid':
+        args.gamePid = queue.shift();
+        break;
+      case '--comments':
+        args.comments = queue.shift();
+        break;
+      case '--service':
+        args.service = queue.shift();
+        break;
+      case '--docker-tag':
+        args.dockerTag = queue.shift();
+        break;
+      case '--node-version':
+        args.nodeVersion = queue.shift();
+        break;
+      case '--skip-validate':
+        args.skipValidate = true;
+        break;
+      case '--api-host':
+        args.apiHost = queue.shift();
+        break;
+      default:
+        throw new Error(`Unknown argument: ${current}`);
+    }
+  }
+
+  if (process.env.npm_config_env_file) {
+    args.envFile = process.env.npm_config_env_file;
+  }
+
+  return args;
+}
+
+function ensure(value, message) {
+  if (!value) {
+    throw new Error(message);
+  }
+  return value;
+}
+
+function md5Hex(input) {
+  return crypto.createHash('md5').update(input).digest('hex');
+}
+
+function sha256Digest(buffer) {
+  return `sha256:${crypto.createHash('sha256').update(buffer).digest('hex')}`;
+}
+
+function shortDigest(fullDigest) {
+  if (!fullDigest) {
+    return '';
+  }
+  const parts = fullDigest.split(':');
+  const hash = parts.length > 1 ? parts[1] : parts[0];
+  return hash.substring(0, 12);
+}
+
+function normalizeApiHost(host) {
+  if (!host) {
+    return undefined;
+  }
+  if (host.startsWith('wss://')) {
+    return `https://${host.substring('wss://'.length).replace(/\/socket$/, '')}`;
+  }
+  if (host.startsWith('ws://')) {
+    return `http://${host.substring('ws://'.length).replace(/\/socket$/, '')}`;
+  }
+  return host.replace(/\/$/, '');
+}
+
+async function readJson(filePath) {
+  const content = await fs.readFile(filePath, 'utf8');
+  return JSON.parse(content);
+}
+
+async function copyDirectory(source, destination) {
+  const entries = await fs.readdir(source, { withFileTypes: true });
+  await fs.mkdir(destination, { recursive: true });
+  for (const entry of entries) {
+    const srcPath = path.join(source, entry.name);
+    const destPath = path.join(destination, entry.name);
+    if (entry.isDirectory()) {
+      await copyDirectory(srcPath, destPath);
+    } else if (entry.isFile()) {
+      await fs.copyFile(srcPath, destPath);
+    }
+  }
+}
+
+async function readDockerImageTar(tarPath) {
+  const files = new Map();
+  const extract = tar.extract();
+
+  await new Promise((resolve, reject) => {
+    extract.on('entry', (header, stream, next) => {
+      const chunks = [];
+      stream.on('data', (chunk) => chunks.push(chunk));
+      stream.on('end', () => {
+        files.set(header.name, Buffer.concat(chunks));
+        next();
+      });
+      stream.on('error', reject);
+    });
+    extract.on('finish', resolve);
+    extract.on('error', reject);
+
+    fssync.createReadStream(tarPath).pipe(extract);
+  });
+
+  const manifestBuffer = files.get('manifest.json');
+  if (!manifestBuffer) {
+    throw new Error('Docker image archive missing manifest.json');
+  }
+
+  const manifestJson = JSON.parse(manifestBuffer.toString());
+  if (!Array.isArray(manifestJson) || manifestJson.length === 0) {
+    throw new Error('Unexpected manifest.json structure.');
+  }
+
+  const manifestEntry = manifestJson[0];
+  const configName = manifestEntry.Config || manifestEntry.config;
+  const layerNames = manifestEntry.Layers || manifestEntry.layers;
+
+  if (!configName || !layerNames) {
+    throw new Error('Manifest entry missing Config or Layers.');
+  }
+
+  const configBuffer = files.get(configName);
+  if (!configBuffer) {
+    throw new Error(`Config blob missing in archive: ${configName}`);
+  }
+
+  const layers = layerNames.map((layerName) => {
+    const buffer = files.get(layerName);
+    if (!buffer) {
+      throw new Error(`Layer missing in archive: ${layerName}`);
+    }
+    return { name: layerName, buffer };
+  });
+
+  return { manifestEntry, configBuffer, layers };
+}
+
+async function checkBlobExists(baseUrl, digest, headers) {
+  const url = new URL(`blobs/${digest}`, baseUrl);
+  const response = await fetch(url, { method: 'HEAD', headers, redirect: 'manual' });
+
+  if (response.status === 307 && response.headers.get('location')) {
+    const redirected = response.headers.get('location');
+    const nextBase = redirected.startsWith('http') ? redirected : new URL(redirected, baseUrl).href;
+    return checkBlobExists(nextBase, digest, headers);
+  }
+
+  return response.status === 200;
+}
+
+async function verifyManifestExists(baseUrl, tag, headers) {
+  const url = new URL(`manifests/${tag}`, baseUrl);
+  const response = await fetch(url, { method: 'HEAD', headers, redirect: 'manual' });
+
+  if (response.status === 307 && response.headers.get('location')) {
+    const redirected = response.headers.get('location');
+    const nextBase = redirected.startsWith('http') ? redirected : new URL(redirected, baseUrl).href;
+    return verifyManifestExists(nextBase, tag, headers);
+  }
+
+  return response.status === 200;
+}
+
+async function prepareUploadLocation(baseUrl, headers) {
+  const url = new URL('blobs/uploads/', baseUrl);
+  // Match C# CLI exactly: StringContent("") sets Content-Type and Content-Length
+  const requestHeaders = {
+    ...headers,
+    'Content-Type': 'text/plain; charset=utf-8',
+    'Content-Length': '0',
+  };
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]     [SUBSTEP: Prepare Upload Location]`);
+  //   console.error(`[beamo-node]       URL: ${url}`);
+  //   console.error(`[beamo-node]       Method: POST`);
+  //   console.error(`[beamo-node]       Headers:`, JSON.stringify(requestHeaders, null, 2));
+  // }
+  
+  let response;
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      headers: requestHeaders,
+      body: '', // Empty body
+    });
+  } catch (error) {
+    // Network/SSL errors happen before HTTP response
+    const errorMsg = error instanceof Error ? error.message : String(error);
+    const errorDetails = {
+      url: url.toString(),
+      error: errorMsg,
+      ...(error instanceof Error && error.stack ? { stack: error.stack } : {}),
+      ...(error instanceof Error && error.cause ? { cause: error.cause } : {}),
+    };
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error('[beamo-node]       Network error:', errorDetails);
+    // }
+    throw new Error(`Network error preparing upload location: ${errorMsg}. URL: ${url.toString()}`);
+  }
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]       Response Status: ${response.status}`);
+  //   console.error(`[beamo-node]       Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
+  // }
+  
+  if (!response.ok) {
+    const text = await response.text();
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error('[beamo-node]       Upload location failed', {
+    //     status: response.status,
+    //     statusText: response.statusText,
+    //     headers: Object.fromEntries(response.headers.entries()),
+    //     body: text.substring(0, 500),
+    //   });
+    // }
+    throw new Error(`Failed to prepare upload location: ${response.status} ${text}`);
+  }
+  const location = response.headers.get('location');
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]       Upload Location: ${location}`);
+  // }
+  return location;
+}
+
+async function uploadBlob(baseUrl, digest, buffer, headers) {
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]       [SUBSTEP: Upload Blob]`);
+  //   console.error(`[beamo-node]         Digest: ${digest}`);
+  //   console.error(`[beamo-node]         Size: ${buffer.length} bytes`);
+  // }
+  
+  const exists = await checkBlobExists(baseUrl, digest, headers);
+  if (exists) {
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]         Blob already exists, skipping upload`);
+    // }
+    return { digest, size: buffer.length };
+  }
+
+  const location = await prepareUploadLocation(baseUrl, headers);
+  if (!location) {
+    throw new Error('Registry did not provide an upload location.');
+  }
+
+  // Match C# CLI: NormalizeWithDigest forces HTTPS and default port (-1 means use default for scheme)
+  const locationUrl = new URL(location.startsWith('http') ? location : new URL(location, baseUrl).href);
+  // Force HTTPS and remove explicit port (use default port 443 for HTTPS)
+  locationUrl.protocol = 'https:';
+  locationUrl.port = ''; // Empty string means use default port for the scheme
+  locationUrl.searchParams.set('digest', digest);
+  const uploadUrl = locationUrl;
+
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]         Upload URL: ${uploadUrl}`);
+  //   console.error(`[beamo-node]         Method: PUT`);
+  //   const uploadHeaders = { ...headers, 'Content-Type': 'application/octet-stream' };
+  //   console.error(`[beamo-node]         Upload Headers:`, JSON.stringify(uploadHeaders, null, 2));
+  // }
+
+  const response = await fetch(uploadUrl, {
+    method: 'PUT',
+    headers: { ...headers, 'Content-Type': 'application/octet-stream' },
+    body: buffer,
+  });
+
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]         Response Status: ${response.status}`);
+  //   console.error(`[beamo-node]         Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
+  // }
+  
+  if (!response.ok) {
+    const text = await response.text();
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]         Response Body: ${text.substring(0, 500)}`);
+    // }
+    throw new Error(`Failed to upload blob ${digest}: ${response.status} ${text}`);
+  }
+
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]         Blob upload successful`);
+  // }
+
+  return { digest, size: buffer.length };
+}
+
+async function uploadManifest(baseUrl, manifestJson, shortImageId, headers) {
+  // Match C# CLI: upload manifest using the short imageId as the tag
+  // The backend looks up images using this short imageId tag
+  const manifestJsonString = JSON.stringify(manifestJson);
+  const url = new URL(`manifests/${shortImageId}`, baseUrl);
+  const requestHeaders = { ...headers, 'Content-Type': MANIFEST_MEDIA_TYPE };
+
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]     [SUBSTEP: Upload Manifest to Registry]`);
+  //   console.error(`[beamo-node]       URL: ${url}`);
+  //   console.error(`[beamo-node]       Method: PUT`);
+  //   console.error(`[beamo-node]       Tag: ${shortImageId}`);
+  //   console.error(`[beamo-node]       Headers:`, JSON.stringify(requestHeaders, null, 2));
+  //   console.error(`[beamo-node]       Manifest JSON:`, manifestJsonString);
+  // }
+
+  const response = await fetch(url, {
+    method: 'PUT',
+    headers: requestHeaders,
+    body: manifestJsonString,
+  });
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]       Response Status: ${response.status}`);
+  //   console.error(`[beamo-node]       Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
+  // }
+  
+  if (!response.ok) {
+    const text = await response.text();
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]       Response Body: ${text.substring(0, 500)}`);
+    // }
+    throw new Error(`Failed to upload manifest: ${response.status} ${text}`);
+  }
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]       Manifest upload successful`);
+  // }
+}
+
+async function fetchJson(url, options = {}) {
+  const response = await fetch(url, options);
+  if (!response.ok) {
+    const text = await response.text();
+    const error = new Error(`Request failed ${response.status}: ${text}`);
+    error.status = response.status;
+    throw error;
+  }
+  return response.json();
+}
+
+async function resolveGamePid(apiHost, token, cid, pid, explicitGamePid) {
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node] [STEP: Resolve Game PID]`);
+  //   console.error(`[beamo-node]   Explicit Game PID: ${explicitGamePid || '(none)'}`);
+  //   console.error(`[beamo-node]   Realm PID: ${pid}`);
+  //   console.error(`[beamo-node]   NOTE: Always resolving root project (Game ID) from API, ignoring explicit value`);
+  // }
+  
+  // Always resolve the root project from the API (matching C# CLI's FindRoot().Pid)
+  // The explicit game PID might be incorrect (could be realm PID instead of root)
+  const scope = pid ? `${cid}.${pid}` : cid;
+  try {
+    const url = new URL(`/basic/realms/game`, apiHost);
+    url.searchParams.set('rootPID', pid);
+    const requestHeaders = {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+      ...(scope ? { 'X-BEAM-SCOPE': scope } : {}),
+    };
+    
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   Fetching game PID from: ${url}`);
+    //   console.error(`[beamo-node]   Headers:`, JSON.stringify(requestHeaders, null, 2));
+    // }
+    
+    const body = await fetchJson(url, { headers: requestHeaders });
+
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   Response:`, JSON.stringify(body, null, 2));
+    // }
+
+    const projects = Array.isArray(body?.projects) ? body.projects : [];
+    if (projects.length === 0) {
+      // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+      //   console.error(`[beamo-node]   No projects found, using realm PID: ${pid}`);
+      // }
+      return pid;
+    }
+
+    // Match C# CLI FindRoot() logic: walk up parent chain until Parent == null (root)
+    const byPid = new Map(projects.map((project) => [project.pid, project]));
+    let current = byPid.get(pid);
+    if (!current) {
+      // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+      //   console.error(`[beamo-node]   Realm PID not found in projects, using realm PID: ${pid}`);
+      // }
+      return pid;
+    }
+    
+    const visited = new Set();
+    // Walk up parent chain until we find root (parent == null or isRoot == true)
+    while (current && (current.parent != null && current.parent !== '' && !current.isRoot) && !visited.has(current.parent)) {
+      visited.add(current.pid);
+      current = byPid.get(current.parent);
+      if (!current) {
+        // Parent not found in projects list, current is as far as we can go
+        break;
+      }
+    }
+    // current is now the root (or the original if no parent chain)
+    const resolved = current?.pid ?? pid;
+    
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   Resolved Game PID (root): ${resolved}`);
+    //   if (explicitGamePid && explicitGamePid !== resolved) {
+    //     console.error(`[beamo-node]   ⚠️  WARNING: Explicit Game PID (${explicitGamePid}) does not match resolved root (${resolved})`);
+    //     console.error(`[beamo-node]   Using resolved root (${resolved}) for imageNameMD5 calculation`);
+    //   }
+    // }
+    return resolved;
+  } catch (error) {
+    // Debug logging only
+    return pid;
+  }
+}
+
+async function getScopedAccessToken(apiHost, cid, pid, refreshToken, fallbackToken) {
+  const scope = pid ? `${cid}.${pid}` : cid;
+  if (!refreshToken) {
+    return { accessToken: fallbackToken, refreshToken };
+  }
+
+  try {
+    const response = await fetch(new URL('/basic/auth/token', apiHost), {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+        ...(scope ? { 'X-BEAM-SCOPE': scope } : {}),
+      },
+      body: JSON.stringify({
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+      }),
+    });
+
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`Refresh token request failed: ${response.status} ${text}`);
+    }
+
+    const body = await response.json();
+    const accessToken = body.access_token ?? fallbackToken;
+    const nextRefresh = body.refresh_token ?? refreshToken;
+    return { accessToken, refreshToken: nextRefresh };
+  } catch (error) {
+    // Debug logging only
+    return { accessToken: fallbackToken, refreshToken };
+  }
+}
+
+async function getRegistryUrl(apiHost, token, cid, pid) {
+  const scope = pid ? `${cid}.${pid}` : cid;
+  const url = new URL('/basic/beamo/registry', apiHost);
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: 'application/json',
+    ...(scope ? { 'X-BEAM-SCOPE': scope } : {}),
+  };
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node] [STEP: Get Registry URL]`);
+  //   console.error(`[beamo-node]   URL: ${url}`);
+  //   console.error(`[beamo-node]   Headers:`, JSON.stringify(headers, null, 2));
+  //   console.error(`[beamo-node]   Scope: ${scope}`);
+  // }
+  
+  const body = await fetchJson(url, { headers });
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   Response:`, JSON.stringify(body, null, 2));
+  // }
+  
+  const uri = body.uri || body.registry || body.url;
+  if (!uri) {
+    throw new Error('Registry URI response missing "uri" field.');
+  }
+  // Match C# CLI exactly: GetDockerImageRegistryUri() returns scheme://host/v2/ (Host property strips port)
+  const normalized = uri.includes('://') ? uri : `https://${uri}`;
+  const parsed = new URL(normalized);
+  // parsedUri.Host in C# is just the hostname (no port), so we use hostname here
+  const registryUrl = `${parsed.protocol}//${parsed.hostname}/v2/`;
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   Normalized Registry URL: ${registryUrl}`);
+  // }
+  
+  return registryUrl;
+}
+
+async function uploadDockerImage({
+  apiHost,
+  registryUrl,
+  cid,
+  pid,
+  gamePid,
+  token,
+  serviceId,
+  uniqueName,
+  imageTarPath,
+  fullImageId,
+  progress,
+}) {
+  const baseUrl = `${registryUrl}${uniqueName}/`;
+  // Match C# CLI and backend: use realm PID in headers (backend checks registry using rc.projectId)
+  // uniqueName uses gamePid (matches backend's rc.gameId), but headers use realm PID
+  const headers = {
+    'x-ks-clientid': cid,
+    'x-ks-projectid': pid, // Use realm PID (matches backend's rc.projectId in DockerRegistryClient)
+    'x-ks-token': token, // Access token from login
+  };
+  
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node] [STEP: Upload Docker Image]`);
+  //   console.error(`[beamo-node]   Base URL: ${baseUrl}`);
+  //   console.error(`[beamo-node]   Registry URL: ${registryUrl}`);
+  //   console.error(`[beamo-node]   Unique Name: ${uniqueName}`);
+  //   console.error(`[beamo-node]   Service ID: ${serviceId}`);
+  //   console.error(`[beamo-node]   CID: ${cid}`);
+  //   console.error(`[beamo-node]   Realm PID: ${pid}`);
+  //   console.error(`[beamo-node]   Game PID: ${gamePid}`);
+  //   console.error(`[beamo-node]   Full Image ID: ${fullImageId}`);
+  //   console.error(`[beamo-node]   Upload Headers:`, JSON.stringify(headers, null, 2));
+  // }
+
+  const { manifestEntry, configBuffer, layers } = await readDockerImageTar(imageTarPath);
+
+  // Upload config
+  if (progress) {
+    process.stdout.write(`\r${colors.blue}↑${colors.reset} Uploading config...`);
+  }
+  const configDigestValue = sha256Digest(configBuffer);
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   [SUBSTEP: Upload Config]`);
+  //   console.error(`[beamo-node]     Config Digest: ${configDigestValue}`);
+  //   console.error(`[beamo-node]     Config Size: ${configBuffer.length} bytes`);
+  // }
+  const configDigest = await uploadBlob(baseUrl, configDigestValue, configBuffer, headers);
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]     Config Upload Result:`, JSON.stringify(configDigest, null, 2));
+  // }
+
+  // Upload layers with progress
+  const layerDescriptors = [];
+  const totalLayers = layers.length;
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   [SUBSTEP: Upload Layers]`);
+  //   console.error(`[beamo-node]     Total Layers: ${totalLayers}`);
+  // }
+  for (let i = 0; i < layers.length; i++) {
+    if (progress) {
+      process.stdout.write(`\r${colors.blue}↑${colors.reset} Uploading layers (${i + 1}/${totalLayers})...`);
+    }
+    const layerDigestValue = sha256Digest(layers[i].buffer);
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]     Layer ${i + 1}/${totalLayers}:`);
+    //   console.error(`[beamo-node]       Digest: ${layerDigestValue}`);
+    //   console.error(`[beamo-node]       Size: ${layers[i].buffer.length} bytes`);
+    // }
+    const descriptor = await uploadBlob(baseUrl, layerDigestValue, layers[i].buffer, headers);
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]       Upload Result:`, JSON.stringify(descriptor, null, 2));
+    // }
+    layerDescriptors.push({
+      digest: descriptor.digest,
+      size: descriptor.size,
+      mediaType: LAYER_MEDIA_TYPE,
+    });
+  }
+
+  const uploadManifestJson = {
+    schemaVersion: 2,
+    mediaType: MANIFEST_MEDIA_TYPE,
+    config: {
+      mediaType: CONFIG_MEDIA_TYPE,
+      digest: configDigest.digest,
+      size: configDigest.size,
+    },
+    layers: layerDescriptors,
+  };
+
+  // Upload manifest using short imageId as tag (matching C# CLI behavior)
+  if (progress) {
+    process.stdout.write(`\r${colors.blue}↑${colors.reset} Uploading manifest...`);
+  }
+  const shortImageId = shortDigest(fullImageId);
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   [SUBSTEP: Upload Manifest]`);
+  //   console.error(`[beamo-node]     Short Image ID: ${shortImageId}`);
+  //   console.error(`[beamo-node]     Manifest JSON:`, JSON.stringify(uploadManifestJson, null, 2));
+  // }
+  await uploadManifest(baseUrl, uploadManifestJson, shortImageId, headers);
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]     Manifest Upload Complete`);
+  // }
+  if (progress) {
+    process.stdout.write('\r');
+  }
+}
+
+async function fetchCurrentManifest(apiHost, token, cid, pid) {
+  const response = await fetch(new URL('/api/beamo/manifests/current', apiHost), {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+      'X-BEAM-SCOPE': `${cid}.${pid}`,
+    },
+  });
+  if (response.status === 404) {
+    // No existing manifest (first publish) - return null
+    return null;
+  }
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Failed to fetch current manifest: ${response.status} ${text}`);
+  }
+  return response.json();
+}
+
+async function discoverStorageObjects(srcDir, cwd = process.cwd()) {
+  const storageObjects = [];
+  try {
+    // Resolve src path relative to current working directory (where publish is run from)
+    const srcPath = path.isAbsolute(srcDir) ? srcDir : path.resolve(cwd, srcDir || 'src');
+    
+    console.log(`[beamo-node] Searching for @StorageObject decorators in: ${srcPath}`);
+    
+    // Check if directory exists
+    try {
+      const stats = await fs.stat(srcPath);
+      if (!stats.isDirectory()) {
+        console.warn(`[beamo-node] Warning: ${srcPath} is not a directory`);
+        return storageObjects;
+      }
+    } catch (error) {
+      console.warn(`[beamo-node] Warning: Directory ${srcPath} does not exist`);
+      return storageObjects;
+    }
+    
+    const files = await getAllTypeScriptFiles(srcPath);
+    
+    if (files.length === 0) {
+      console.warn(`[beamo-node] Warning: No TypeScript files found in ${srcPath}`);
+      return storageObjects;
+    }
+    
+    console.log(`[beamo-node] Scanning ${files.length} TypeScript file(s) for @StorageObject decorators...`);
+    
+    for (const file of files) {
+      const content = await fs.readFile(file, 'utf-8');
+      // Match @StorageObject('StorageName') pattern - handle both single and double quotes
+      // Also match multiline patterns where decorator might be on a different line
+      const storageRegex = /@StorageObject\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+      let match;
+      while ((match = storageRegex.exec(content)) !== null) {
+        const storageName = match[1];
+        if (storageName && !storageObjects.find(s => s.id === storageName)) {
+          storageObjects.push({
+            id: storageName,
+            enabled: true,
+            templateId: 'small', // Match C# CLI default (DeploymentService.cs line 1620)
+            checksum: null,
+            archived: false,
+          });
+          console.log(`[beamo-node] ✓ Discovered storage object: ${storageName} (from ${path.relative(cwd, file)})`);
+        }
+      }
+    }
+    
+    if (storageObjects.length === 0) {
+      console.log(`[beamo-node] No @StorageObject decorators found in ${files.length} file(s) in ${srcPath}`);
+      console.log(`[beamo-node] Make sure your storage classes are decorated with @StorageObject('StorageName')`);
+    }
+  } catch (error) {
+    console.warn(`[beamo-node] Error discovering storage objects: ${error instanceof Error ? error.message : String(error)}`);
+    if (error instanceof Error && error.stack) {
+      console.warn(`[beamo-node] Stack: ${error.stack}`);
+    }
+    // If we can't discover storage, that's okay - we'll just use existing ones
+  }
+  return storageObjects;
+}
+
+async function discoverFederationComponents(srcDir) {
+  const components = [];
+  try {
+    const srcPath = path.resolve(srcDir || 'src');
+    const files = await getAllTypeScriptFiles(srcPath);
+    
+    for (const file of files) {
+      const content = await fs.readFile(file, 'utf-8');
+      
+      // Match @FederatedInventory({ identity: IdentityClass }) pattern
+      const federatedInventoryRegex = /@FederatedInventory\s*\(\s*\{\s*identity:\s*(\w+)\s*\}\s*\)/g;
+      let match;
+      while ((match = federatedInventoryRegex.exec(content)) !== null) {
+        const identityClassName = match[1];
+        
+        // Find the identity class definition in the same file or other files
+        // Look for: class IdentityClass implements FederationIdentity { getUniqueName(): string { return 'name'; } }
+        // Use multiline matching to handle class definitions that span multiple lines
+        const identityClassRegex = new RegExp(
+          `class\\s+${identityClassName}[^{]*\\{[\\s\\S]*?getUniqueName\\(\\)[\\s\\S]*?return\\s+['"]([^'"]+)['"]`,
+          's'
+        );
+        let identityMatch = identityClassRegex.exec(content);
+        
+        // If not found in current file, search other files
+        if (!identityMatch) {
+          for (const otherFile of files) {
+            if (otherFile !== file) {
+              const otherContent = await fs.readFile(otherFile, 'utf-8');
+              identityMatch = identityClassRegex.exec(otherContent);
+              if (identityMatch) {
+                break;
+              }
+            }
+          }
+        }
+        
+        if (identityMatch) {
+          const identityName = identityMatch[1];
+          // Add both IFederatedInventory and IFederatedLogin components
+          const inventoryComponent = `IFederatedInventory/${identityName}`;
+          const loginComponent = `IFederatedLogin/${identityName}`;
+          if (!components.includes(inventoryComponent)) {
+            components.push(inventoryComponent);
+          }
+          if (!components.includes(loginComponent)) {
+            components.push(loginComponent);
+          }
+        }
+      }
+    }
+  } catch (error) {
+    // If we can't discover components, that's okay - we'll just use existing ones
+    // Debug logging only
+  }
+  return components;
+}
+
+async function getAllTypeScriptFiles(dir) {
+  const files = [];
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name);
+      if (entry.isDirectory() && entry.name !== 'node_modules' && !entry.name.startsWith('.')) {
+        files.push(...await getAllTypeScriptFiles(fullPath));
+      } else if (entry.isFile() && (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx'))) {
+        files.push(fullPath);
+      }
+    }
+  } catch (error) {
+    // Ignore errors reading directories
+  }
+  return files;
+}
+
+async function updateManifest({
+  apiHost,
+  token,
+  cid,
+  pid,
+  serviceId,
+  shortImageId, // This is now the full image ID (sha256:...) for backend verification
+  comments,
+  existingManifest,
+  discoveredStorage,
+  discoveredComponents,
+  discoveredDependencies,
+}) {
+  const serviceReferences = existingManifest?.serviceReferences?.Value
+    ?? existingManifest?.serviceReferences
+    ?? existingManifest?.manifest
+    ?? [];
+  const storageRefsRaw = existingManifest?.storageReferences?.Value
+    ?? existingManifest?.storageReferences
+    ?? [];
+  const existingStorage = Array.isArray(storageRefsRaw)
+    ? storageRefsRaw.map((reference) => ({
+        id: reference.id?.Value ?? reference.id,
+        storageType: reference.storageType?.Value ?? reference.storageType ?? 'mongov1',
+        enabled: reference.enabled?.Value ?? reference.enabled ?? true,
+        // templateId and archived are optional - only include if present
+        ...(reference.templateId ? { templateId: reference.templateId?.Value ?? reference.templateId } : {}),
+        ...(reference.archived !== undefined ? { archived: reference.archived?.Value ?? reference.archived ?? false } : {}),
+        // Note: checksum is computed by backend, we don't send it
+      }))
+    : [];
+  
+  // Merge discovered storage with existing storage
+  // If a storage object exists in both, keep the existing one (preserves checksum, etc.)
+  // But ensure storageType is always set to 'mongov1' for MongoDB storage
+  const storageMap = new Map();
+  existingStorage.forEach(s => {
+    // Normalize storageType: update 'mongo' to 'mongov1' if present
+    const normalizedStorage = {
+      ...s,
+      storageType: s.storageType === 'mongo' ? 'mongov1' : (s.storageType || 'mongov1'),
+    };
+    storageMap.set(s.id, normalizedStorage);
+  });
+  discoveredStorage.forEach(s => {
+    if (!storageMap.has(s.id)) {
+      // New storage - create ServiceStorageReference matching backend case class:
+      // case class ServiceStorageReference(id: String, storageType: String, enabled: Boolean, templateId: Option[String] = None, archived: Option[Boolean] = None)
+      // Match C# CLI behavior: always set templateId to "small" (DeploymentService.cs line 1620)
+      const newStorage = {
+        id: s.id,
+        storageType: 'mongov1', // All discovered storage uses MongoDB
+        enabled: true,
+        templateId: s.templateId || 'small', // Default to "small" like C# CLI
+        ...(s.archived !== undefined ? { archived: s.archived } : {}),
+      };
+      storageMap.set(s.id, newStorage);
+      console.log(`[beamo-node] Adding new storage to manifest: ${s.id} (type: ${newStorage.storageType}, enabled: ${newStorage.enabled})`);
+    } else {
+      // Update existing storage to ensure storageType is 'mongov1' and format is correct
+      // Match C# CLI behavior: always set templateId to "small" if not present (DeploymentService.cs line 1620)
+      const existing = storageMap.get(s.id);
+      const updatedStorage = {
+        id: existing.id,
+        storageType: 'mongov1',
+        enabled: existing.enabled !== false, // Ensure enabled is true unless explicitly false
+        templateId: existing.templateId || 'small', // Default to "small" like C# CLI
+        ...(existing.archived !== undefined ? { archived: existing.archived } : {}),
+      };
+      storageMap.set(s.id, updatedStorage);
+      console.log(`[beamo-node] Updating existing storage in manifest: ${s.id} (type: mongov1, enabled: ${updatedStorage.enabled})`);
+    }
+  });
+  // Convert to array and remove any extra fields (like checksum) that backend doesn't expect
+  // Ensure templateId is always set to "small" (matching C# CLI behavior)
+  const storageReferences = Array.from(storageMap.values()).map(s => ({
+    id: s.id,
+    storageType: s.storageType,
+    enabled: s.enabled,
+    templateId: s.templateId || 'small', // Always include templateId, default to "small" like C# CLI
+    ...(s.archived !== undefined ? { archived: s.archived } : {}),
+  }));
+
+  // Extract existing components and dependencies for the service
+  const existingServiceRef = serviceReferences.find(
+    (ref) => (ref.serviceName?.Value ?? ref.serviceName) === serviceId
+  );
+  const existingComponents = existingServiceRef?.components?.Value 
+    ?? existingServiceRef?.components 
+    ?? [];
+  const existingDependencies = existingServiceRef?.dependencies?.Value 
+    ?? existingServiceRef?.dependencies 
+    ?? [];
+
+  // Components are ServiceComponent objects with {name: string}
+  // Merge discovered with existing (preserve existing, add new)
+  const componentsMap = new Map();
+  // Add existing components
+  if (Array.isArray(existingComponents)) {
+    existingComponents.forEach(comp => {
+      const name = comp.name?.Value ?? comp.name ?? comp;
+      if (typeof name === 'string') {
+        componentsMap.set(name, { name });
+      }
+    });
+  }
+  // Add discovered components (will overwrite existing if same name)
+  (discoveredComponents || []).forEach(compName => {
+    componentsMap.set(compName, { name: compName });
+  });
+  const components = Array.from(componentsMap.values());
+
+  // Dependencies are objects with {id, storageType}, need to merge by id
+  const dependenciesMap = new Map();
+  // Add existing dependencies
+  if (Array.isArray(existingDependencies)) {
+    existingDependencies.forEach(dep => {
+      const id = dep.id?.Value ?? dep.id ?? dep;
+      if (typeof id === 'string') {
+        let storageType = dep.storageType?.Value ?? dep.storageType ?? 'mongov1';
+        // Normalize: update 'mongo' to 'mongov1' to match C# microservices
+        if (storageType === 'mongo') {
+          storageType = 'mongov1';
+        }
+        dependenciesMap.set(id, { id, storageType });
+      }
+    });
+  }
+  // Add discovered dependencies (will overwrite existing if same id)
+  (discoveredDependencies || []).forEach(dep => {
+    dependenciesMap.set(dep.id, dep);
+  });
+  const dependencies = Array.from(dependenciesMap.values());
+
+  let updated = false;
+  const mappedServices = serviceReferences.map((reference) => {
+    const name = reference.serviceName?.Value ?? reference.serviceName;
+    if (name === serviceId) {
+      updated = true;
+      return {
+        serviceName: serviceId,
+        enabled: true,
+        templateId: reference.templateId?.Value ?? reference.templateId ?? 'small',
+        containerHealthCheckPort: reference.containerHealthCheckPort?.Value ?? reference.containerHealthCheckPort ?? 6565,
+        imageId: shortImageId,
+        imageCpuArch: reference.imageCpuArch?.Value ?? reference.imageCpuArch ?? 'linux/amd64',
+        logProvider: reference.logProvider?.Value ?? reference.logProvider ?? 'Clickhouse',
+        dependencies,
+        components,
+      };
+    }
+    return {
+      serviceName: name,
+      enabled: reference.enabled?.Value ?? reference.enabled ?? true,
+      templateId: reference.templateId?.Value ?? reference.templateId ?? 'small',
+      containerHealthCheckPort: reference.containerHealthCheckPort?.Value ?? reference.containerHealthCheckPort ?? 6565,
+      imageId: reference.imageId?.Value ?? reference.imageId ?? shortImageId,
+      imageCpuArch: reference.imageCpuArch?.Value ?? reference.imageCpuArch ?? 'linux/amd64',
+      logProvider: reference.logProvider?.Value ?? reference.logProvider ?? 'Clickhouse',
+      dependencies: reference.dependencies?.Value ?? reference.dependencies ?? [],
+      components: reference.components?.Value ?? reference.components ?? [],
+    };
+  });
+
+  if (!updated) {
+    mappedServices.push({
+      serviceName: serviceId,
+      enabled: true,
+      templateId: 'small',
+      containerHealthCheckPort: 6565,
+      imageId: shortImageId,
+      imageCpuArch: 'linux/amd64',
+      logProvider: 'Clickhouse',
+      dependencies,
+      components,
+    });
+  }
+
+  const requestBody = {
+    autoDeploy: true,
+    comments: comments ?? '',
+    manifest: mappedServices,
+    storageReferences,
+  };
+  
+  // Log storage references being sent to backend
+  if (storageReferences.length > 0) {
+    console.log(`[beamo-node] Publishing ${storageReferences.length} storage reference(s) in manifest:`);
+    storageReferences.forEach(s => {
+      const details = [
+        `id: ${s.id}`,
+        `storageType: ${s.storageType || 'mongov1'}`,
+        `enabled: ${s.enabled !== false}`,
+        ...(s.templateId ? [`templateId: ${s.templateId}`] : []),
+        ...(s.archived !== undefined ? [`archived: ${s.archived}`] : []),
+      ].join(', ');
+      console.log(`[beamo-node]   - ${details}`);
+    });
+    console.log(`[beamo-node] Storage references JSON: ${JSON.stringify(storageReferences, null, 2)}`);
+  } else {
+    console.warn(`[beamo-node] ⚠️  WARNING: No storage references in manifest. Database will NOT be created automatically.`);
+    console.warn(`[beamo-node] Make sure you have @StorageObject('StorageName') decorators in your code.`);
+  }
+
+  const publishUrl = new URL('/basic/beamo/manifest', apiHost);
+  const publishHeaders = {
+    Authorization: `Bearer ${token}`,
+    Accept: 'application/json',
+    'Content-Type': 'application/json',
+    'X-BEAM-SCOPE': `${cid}.${pid}`,
+  };
+
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node] [STEP: Publish Manifest to Backend]`);
+  //   console.error(`[beamo-node]   URL: ${publishUrl}`);
+  //   console.error(`[beamo-node]   Method: POST`);
+  //   console.error(`[beamo-node]   Headers:`, JSON.stringify(publishHeaders, null, 2));
+  //   console.error(`[beamo-node]   Service: ${serviceId}`);
+  //   console.error(`[beamo-node]   CID: ${cid}`);
+  //   console.error(`[beamo-node]   Realm PID (from X-BEAM-SCOPE): ${pid}`);
+  //   console.error(`[beamo-node]   Short Image ID: ${shortImageId}`);
+  //   console.error(`[beamo-node]   Expected Backend Check:`);
+  //   console.error(`[beamo-node]     - Backend will calculate imageNameMD5 using: rc.cid, rc.gameId, serviceName`);
+  //   console.error(`[beamo-node]     - Backend will check: {registryURI}/{imageNameMD5}/manifests/{imageId}`);
+  //   console.error(`[beamo-node]     - Backend will use headers: X-KS-PROJECTID: rc.projectId (from X-BEAM-SCOPE)`);
+  //   console.error(`[beamo-node]     - NOTE: rc.gameId might differ from realm PID if backend resolves it differently`);
+  //   console.error(`[beamo-node]   Request Body:`, JSON.stringify(requestBody, null, 2));
+  //   console.error(`[beamo-node]   Service Entry in Manifest:`, JSON.stringify(mappedServices.find(s => s.serviceName === serviceId), null, 2));
+  // }
+
+  const response = await fetch(publishUrl, {
+    method: 'POST',
+    headers: publishHeaders,
+    body: JSON.stringify(requestBody),
+  });
+
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   Response Status: ${response.status}`);
+  //   console.error(`[beamo-node]   Response Headers:`, JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
+  // }
+  
+  if (!response.ok) {
+    const text = await response.text();
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   Response Body: ${text}`);
+    //   console.error(`[beamo-node]   Full Request Body (for debugging):`, JSON.stringify(requestBody, null, 2));
+    // }
+    throw new Error(`Failed to publish manifest: ${response.status} ${text}`);
+  }
+  
+  const responseBody = await response.json();
+  // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+  //   console.error(`[beamo-node]   Response Body:`, JSON.stringify(responseBody, null, 2));
+  //   console.error(`[beamo-node]   ✓ Manifest published successfully`);
+  // }
+}
+
+async function prepareDockerContext({ entry, distDir, openapiPath, packageJson, packageLock, nodeVersion }) {
+  const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'beam-node-ms-'));
+  const contextDir = path.join(tempRoot, 'context');
+  const appDir = path.join(contextDir, 'app');
+  await fs.mkdir(appDir, { recursive: true });
+
+  // Read and modify package.json to handle file: dependencies
+  const pkg = JSON.parse(await fs.readFile(packageJson, 'utf8'));
+  const modifiedPkg = { ...pkg };
+  
+  // No need to handle file: dependencies anymore - the runtime is published to npm
+  // Just copy the package.json as-is
+  await fs.copyFile(packageJson, path.join(appDir, 'package.json'));
+  
+  try {
+    await fs.copyFile(packageLock, path.join(appDir, 'package-lock.json'));
+  } catch {
+    // ignore missing package-lock
+  }
+
+  await copyDirectory(distDir, path.join(appDir, 'dist'));
+  try {
+    await fs.copyFile(openapiPath, path.join(appDir, 'beam_openApi.json'));
+  } catch {
+    await fs.writeFile(path.join(appDir, 'beam_openApi.json'), '{}\n');
+  }
+  
+  // Copy beam.env file if it exists (for developer-defined environment variables)
+  let beamEnvFile = null;
+  const beamEnvPath = path.join(path.dirname(packageJson), 'beam.env');
+  const beamEnvHiddenPath = path.join(path.dirname(packageJson), '.beam.env');
+  try {
+    if (await fs.access(beamEnvPath).then(() => true).catch(() => false)) {
+      await fs.copyFile(beamEnvPath, path.join(appDir, 'beam.env'));
+      beamEnvFile = 'beam.env';
+      console.log('Included beam.env file in Docker image');
+    } else if (await fs.access(beamEnvHiddenPath).then(() => true).catch(() => false)) {
+      await fs.copyFile(beamEnvHiddenPath, path.join(appDir, '.beam.env'));
+      beamEnvFile = '.beam.env';
+      console.log('Included .beam.env file in Docker image');
+    }
+  } catch {
+    // beam.env is optional, ignore if not found
+  }
+
+  const dockerfile = `# syntax=docker/dockerfile:1
+ARG NODE_VERSION=${nodeVersion}
+FROM node:${nodeVersion}-alpine
+
+WORKDIR /beam/service
+
+COPY app/package*.json ./
+# Install dependencies (runtime is now on npm, so no special handling needed)
+RUN npm install --omit=dev && npm cache clean --force
+
+# Pre-install OpenTelemetry collector binary and config to avoid runtime download delay (~12 seconds)
+# This is stored in /opt/beam/collectors/ which persists and is checked first by the runtime
+RUN mkdir -p /opt/beam/collectors/1.0.1 && \\
+    apk add --no-cache wget gzip && \\
+    wget https://collectors.beamable.com/version/1.0.1/collector-linux-amd64.gz -O /tmp/collector.gz && \\
+    gunzip /tmp/collector.gz && \\
+    mv /tmp/collector /opt/beam/collectors/1.0.1/collector-linux-amd64 && \\
+    chmod +x /opt/beam/collectors/1.0.1/collector-linux-amd64 && \\
+    wget https://collectors.beamable.com/version/1.0.1/clickhouse-config.yaml.gz -O /tmp/config.gz && \\
+    gunzip /tmp/config.gz && \\
+    mv /tmp/config /opt/beam/collectors/1.0.1/clickhouse-config.yaml && \\
+    rm -f /tmp/collector.gz /tmp/config.gz && \\
+    apk del wget gzip
+
+COPY app/dist ./dist
+COPY app/beam_openApi.json ./beam_openApi.json${beamEnvFile ? `\nCOPY app/${beamEnvFile} ./${beamEnvFile}` : ''}
+
+# Expose health check port (matches C# microservice behavior)
+EXPOSE 6565
+
+ENV NODE_ENV=production
+
+# Add startup script to log what's happening and catch errors
+RUN echo '#!/bin/sh' > /beam/service/start.sh && \\
+    echo 'echo "Starting Node.js microservice..."' >> /beam/service/start.sh && \\
+    echo 'echo "Working directory: $(pwd)"' >> /beam/service/start.sh && \\
+    echo 'echo "Node version: $(node --version)"' >> /beam/service/start.sh && \\
+    echo 'echo "Files in dist:"' >> /beam/service/start.sh && \\
+    echo 'ls -la dist/ || echo "dist directory not found!"' >> /beam/service/start.sh && \\
+    echo 'echo "Starting main.js..."' >> /beam/service/start.sh && \\
+    echo 'exec node dist/main.js' >> /beam/service/start.sh && \\
+    chmod +x /beam/service/start.sh
+
+# Use ENTRYPOINT with startup script to ensure we see what's happening
+ENTRYPOINT ["/beam/service/start.sh"]
+
+# Debug option: uncomment the line below and comment the ENTRYPOINT above
+# to keep the container alive for debugging (like C# Dockerfile does)
+# ENTRYPOINT ["tail", "-f", "/dev/null"]
+`;
+  await fs.writeFile(path.join(contextDir, 'Dockerfile'), dockerfile, 'utf8');
+
+  return { tempRoot, contextDir };
+}
+
+async function main() {
+  // Parse --env-file first so we can load .env before parseArgs reads environment variables
+  // This ensures .env file values are used instead of stale system environment variables
+  const rawArgs = process.argv.slice(2);
+  let envFile = undefined;
+  for (let i = 0; i < rawArgs.length; i++) {
+    if (rawArgs[i] === '--env-file' && i + 1 < rawArgs.length) {
+      envFile = rawArgs[i + 1];
+      break;
+    }
+  }
+  
+  // Load .env file first with override to ensure it takes precedence
+  if (envFile) {
+    dotenv.config({ path: path.resolve(envFile), override: true });
+  } else if (process.env.npm_config_env_file) {
+    dotenv.config({ path: path.resolve(process.env.npm_config_env_file), override: true });
+  }
+
+  // Now parse all args - env vars from .env will be available
+  const args = parseArgs(rawArgs);
+
+  const pkg = await readJson(path.resolve('package.json'));
+  const beamableConfig = pkg.beamable || {};
+
+  const serviceId = args.service || beamableConfig.beamoId || pkg.name;
+  ensure(serviceId, 'Service identifier is required. Provide --service or set beamable.beamoId in package.json.');
+
+  const cid = ensure(args.cid || beamableConfig.cid || process.env.CID, 'CID is required (set CID env var or --cid).');
+  const pid = ensure(args.pid || beamableConfig.pid || process.env.PID, 'PID is required (set PID env var or --pid).');
+  const host = args.host || beamableConfig.host || process.env.HOST || 'wss://api.beamable.com/socket';
+  const apiHost = normalizeApiHost(args.apiHost || beamableConfig.apiHost || process.env.BEAMABLE_API_HOST || host);
+  const token = ensure(args.token || process.env.ACCESS_TOKEN || process.env.BEAMABLE_TOKEN, 'Access token is required (set BEAMABLE_TOKEN env var or --token).');
+  
+  const configuredGamePid = args.gamePid || beamableConfig.gamePid || process.env.BEAMABLE_GAME_PID;
+  const refreshToken = args.refreshToken || process.env.BEAMABLE_REFRESH_TOKEN || process.env.REFRESH_TOKEN;
+
+  if (!apiHost) {
+    throw new Error('API host could not be determined. Set BEAMABLE_API_HOST or provide --api-host.');
+  }
+
+  // Initialize progress bar (8 main steps)
+  const progress = new ProgressBar(8);
+  console.log(`${colors.bright}${colors.cyan}Publishing ${serviceId}...${colors.reset}\n`);
+
+  // Step 1: Build
+  progress.start('Building project');
+  if (!args.skipValidate) {
+    const validateScript = path.resolve(__dirname, 'validate-service.mjs');
+    const validateArgs = ['--entry', args.entry, '--output', args.openapi, '--cid', cid, '--pid', pid, '--host', host];
+    if (args.envFile) {
+      validateArgs.push('--env-file', args.envFile);
+    }
+    if (args.namePrefix) {
+      validateArgs.push('--routing-key', args.namePrefix);
+    }
+    validateArgs.push('--skip-build');
+    await runCommand('npm', ['run', 'build'], { silent: true });
+    await runCommand(process.execPath, [validateScript, ...validateArgs], { shell: false, silent: true });
+  } else {
+    await runCommand('npm', ['run', 'build'], { silent: true });
+  }
+  progress.complete('Build complete');
+
+  const packageJsonPath = path.resolve('package.json');
+  const packageLockPath = path.resolve('package-lock.json');
+  const distDir = path.resolve('dist');
+  const openapiPath = path.resolve(args.openapi);
+  const entryFile = path.resolve(args.entry);
+
+  await fs.access(entryFile);
+  await fs.access(distDir);
+
+  let tempRoot;
+  try {
+    // Step 2: Prepare Docker context
+    progress.start('Preparing Docker context');
+    const context = await prepareDockerContext({
+      entry: entryFile,
+      distDir,
+      openapiPath,
+      packageJson: packageJsonPath,
+      packageLock: packageLockPath,
+      nodeVersion: args.nodeVersion,
+    });
+    tempRoot = context.tempRoot;
+    const { contextDir } = context;
+    progress.complete('Docker context prepared');
+
+    // Step 3: Build Docker image
+    progress.start('Building Docker image');
+    const dockerTag = args.dockerTag || `${serviceId.toLowerCase().replace(/[^a-z0-9-_]/g, '-')}:${Date.now()}`;
+    await runCommand('docker', ['build', '-t', dockerTag, contextDir], { cwd: contextDir, silent: true });
+    progress.complete('Docker image built');
+
+    // Step 4: Extract image ID and save
+    progress.start('Preparing image for upload');
+    const inspect = await runCommand('docker', ['image', 'inspect', '--format', '{{.Id}}', dockerTag], { capture: true });
+    const fullImageId = inspect.stdout.trim();
+    const imageTarPath = path.join(tempRoot, `${serviceId.replace(/[^a-z0-9-_]/gi, '_')}.tar`);
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   // Calculate short digest manually (shortDigest function defined later)
+    //   const longImageId = fullImageId.includes(':') ? fullImageId.split(':')[1] : fullImageId;
+    //   const shortImageIdPreview = longImageId.substring(0, 12);
+    //   console.error(`[beamo-node] [STEP: Extract Image ID]`);
+    //   console.error(`[beamo-node]   Docker Tag: ${dockerTag}`);
+    //   console.error(`[beamo-node]   Full Image ID: ${fullImageId}`);
+    //   console.error(`[beamo-node]   Short Image ID (preview): ${shortImageIdPreview}`);
+    //   console.error(`[beamo-node]   Image Tar Path: ${imageTarPath}`);
+    // }
+    await runCommand('docker', ['image', 'save', dockerTag, '-o', imageTarPath], { silent: true });
+    progress.complete('Image prepared');
+
+    // Step 5: Authenticate and get registry
+    progress.start('Authenticating');
+    const resolvedGamePid = await resolveGamePid(apiHost, token, cid, pid, configuredGamePid);
+    
+    // Verify token is valid (401 means invalid token, 403 might just be permission issue)
+    try {
+      const testUrl = new URL('/basic/accounts/me', apiHost);
+      const testResponse = await fetch(testUrl, {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: 'application/json',
+          'X-BEAM-SCOPE': `${cid}.${pid}`,
+        },
+      });
+      if (testResponse.status === 401) {
+        throw new Error(`Token validation failed: ${testResponse.status} ${await testResponse.text()}`);
+      }
+    } catch (error) {
+      if (error.message.includes('401')) {
+        throw new Error(`Token validation failed: ${error.message}. Please run "beamo-node login" again.`);
+      }
+    }
+    
+    // Match C# CLI: GetDockerImageRegistryUri() uses realm PID from context (X-BEAM-SCOPE)
+    // uniqueName uses gamePid (matches backend's rc.gameId), but registry URL uses realm PID
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node] [STEP: Calculate Registry Path]`);
+    //   console.error(`[beamo-node]   CID: ${cid}`);
+    //   console.error(`[beamo-node]   Realm PID: ${pid}`);
+    //   console.error(`[beamo-node]   Resolved Game PID: ${resolvedGamePid}`);
+    //   console.error(`[beamo-node]   Service ID: ${serviceId}`);
+    // }
+    const registryUrl = await getRegistryUrl(apiHost, token, cid, pid);
+    const uniqueNameInput = `${cid}_${resolvedGamePid}_${serviceId}`;
+    const uniqueName = md5Hex(uniqueNameInput).substring(0, 30);
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   Unique Name Input: ${uniqueNameInput}`);
+    //   console.error(`[beamo-node]   Unique Name (MD5 first 30 chars): ${uniqueName}`);
+    //   console.error(`[beamo-node]   Registry URL: ${registryUrl}`);
+    // }
+    progress.complete('Authenticated');
+
+    // Step 6: Upload Docker image
+    progress.start('Uploading Docker image to registry');
+    await uploadDockerImage({
+      apiHost,
+      registryUrl,
+      cid,
+      pid,
+      gamePid: resolvedGamePid,
+      token,
+      serviceId,
+      uniqueName,
+      imageTarPath,
+      fullImageId,
+      progress,
+    });
+    progress.complete('Image uploaded');
+
+    // Verify image exists in registry before proceeding
+    const shortImageId = shortDigest(fullImageId);
+    const baseUrl = `${registryUrl}${uniqueName}/`;
+    const verifyHeaders = {
+      'x-ks-clientid': cid,
+      'x-ks-projectid': pid, // Use realm PID (matches backend's rc.projectId when checking registry)
+      'x-ks-token': token,
+    };
+    
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node] [STEP: Post-Upload Verification]`);
+    //   console.error(`[beamo-node]   Full Image ID: ${fullImageId}`);
+    //   console.error(`[beamo-node]   Short Image ID: ${shortImageId}`);
+    //   console.error(`[beamo-node]   Base URL: ${baseUrl}`);
+    //   console.error(`[beamo-node]   Verification URL: ${baseUrl}manifests/${shortImageId}`);
+    //   console.error(`[beamo-node]   Verify Headers:`, JSON.stringify(verifyHeaders, null, 2));
+    // }
+    
+    // Wait a moment for registry to propagate
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   Waiting 3 seconds for registry propagation...`);
+    // }
+    await new Promise(resolve => setTimeout(resolve, 3000));
+    
+    const imageExists = await verifyManifestExists(baseUrl, shortImageId, verifyHeaders);
+    if (!imageExists) {
+      throw new Error(`Image verification failed: manifest with tag ${shortImageId} not found in registry at ${baseUrl}manifests/${shortImageId}. The image may not have uploaded successfully.`);
+    }
+    
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node]   ✓ Image verification passed`);
+    // }
+    
+    // CRITICAL: Perform exact backend check simulation
+    // The backend uses HEAD request with specific headers - let's verify it works
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node] [STEP: Backend Check Simulation]`);
+    //   console.error(`[beamo-node]   Simulating exact backend check...`);
+    //   const backendCheckUrl = `${registryUrl}${uniqueName}/manifests/${shortImageId}`;
+    //   console.error(`[beamo-node]   Backend will check: ${backendCheckUrl}`);
+    //   console.error(`[beamo-node]   Backend will use headers:`, JSON.stringify(verifyHeaders, null, 2));
+    //   try {
+    //     const backendCheckResponse = await fetch(backendCheckUrl, {
+    //       method: 'HEAD',
+    //       headers: verifyHeaders,
+    //     });
+    //     console.error(`[beamo-node]   Backend simulation response status: ${backendCheckResponse.status}`);
+    //     if (backendCheckResponse.status !== 200) {
+    //       console.error(`[beamo-node]   ⚠️  Backend simulation FAILED - status ${backendCheckResponse.status}`);
+    //       const responseText = await backendCheckResponse.text().catch(() => '');
+    //       console.error(`[beamo-node]   Response: ${responseText}`);
+    //     } else {
+    //       console.error(`[beamo-node]   ✓ Backend simulation passed`);
+    //     }
+    //   } catch (error) {
+    //     console.error(`[beamo-node]   ⚠️  Backend simulation error: ${error.message}`);
+    //   }
+    // }
+    
+    // CRITICAL: Before publishing, verify using the backend's expected gameId
+    // The backend resolves rc.gameId from the realm hierarchy, which might differ from our resolvedGamePid
+    // We need to check what the backend will actually use
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`[beamo-node] [STEP: Pre-Publish Backend Simulation]`);
+    //   console.error(`[beamo-node]   Simulating backend's imageNameMD5 calculation...`);
+    //   console.error(`[beamo-node]   Backend will use: rc.cid, rc.gameId (resolved from realm hierarchy), serviceName`);
+    //   console.error(`[beamo-node]   Our calculation used: cid=${cid}, gamePid=${resolvedGamePid}, serviceName=${serviceId}`);
+    //   console.error(`[beamo-node]   Our uniqueName: ${uniqueName}`);
+    //   console.error(`[beamo-node]   WARNING: If backend's rc.gameId differs from our resolvedGamePid, the check will fail!`);
+    // }
+    
+    // Try to resolve what the backend's rc.gameId will be by making the same API call the backend would make
+    // The backend resolves gameId from the realm hierarchy when processing X-BEAM-SCOPE
+    // try {
+    //   const backendGamePidCheck = await resolveGamePid(apiHost, token, cid, pid, null); // Force resolution
+    //   if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //     console.error(`[beamo-node]   Backend's expected gameId (resolved from realm hierarchy): ${backendGamePidCheck}`);
+    //     if (backendGamePidCheck !== resolvedGamePid) {
+    //       console.error(`[beamo-node]   ⚠️  MISMATCH DETECTED!`);
+    //       console.error(`[beamo-node]     Our resolvedGamePid: ${resolvedGamePid}`);
+    //       console.error(`[beamo-node]     Backend's expected gameId: ${backendGamePidCheck}`);
+    //       console.error(`[beamo-node]     This will cause imageNameMD5 mismatch!`);
+    //       const backendUniqueNameInput = `${cid}_${backendGamePidCheck}_${serviceId}`;
+    //       const backendUniqueName = md5Hex(backendUniqueNameInput).substring(0, 30);
+    //       console.error(`[beamo-node]     Backend will check: ${registryUrl}${backendUniqueName}/manifests/${shortImageId}`);
+    //       console.error(`[beamo-node]     But we uploaded to: ${registryUrl}${uniqueName}/manifests/${shortImageId}`);
+    //     } else {
+    //       console.error(`[beamo-node]   ✓ Game PID matches - backend should find the image`);
+    //     }
+    //   }
+    // } catch (error) {
+    //   if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //     console.error(`[beamo-node]   Could not verify backend gameId resolution: ${error.message}`);
+    //   }
+    // }
+
+    // Step 7: Discover storage, components, and dependencies
+    progress.start('Discovering storage objects and components');
+    // shortImageId already defined above from verification step
+    const existingManifest = await fetchCurrentManifest(apiHost, token, cid, pid);
+    const discoveredStorage = await discoverStorageObjects('src', process.cwd());
+    const discoveredComponents = await discoverFederationComponents('src');
+    // Dependencies are ServiceDependencyReference objects with id and storageType
+    // storageType should be "mongov1" for MongoDB storage objects (matching C# microservices)
+    const discoveredDependencies = discoveredStorage.map(s => ({
+      id: s.id,
+      storageType: 'mongov1', // MongoDB storage type (matches ServiceStorageReference in backend)
+    }));
+    
+    if (discoveredStorage.length > 0) {
+      console.log(`[beamo-node] Discovered ${discoveredStorage.length} storage object(s): ${discoveredStorage.map(s => s.id).join(', ')}`);
+    }
+    
+    progress.complete('Storage and components discovered');
+
+    // Step 8: Publish manifest
+    progress.start('Publishing manifest');
+    await updateManifest({
+      apiHost,
+      token,
+      cid,
+      pid,
+      serviceId,
+      shortImageId,
+      comments: args.comments,
+      existingManifest,
+      discoveredStorage,
+      discoveredComponents,
+      discoveredDependencies,
+    });
+    progress.complete('Manifest published');
+
+    // Success message
+    console.log(`\n${colors.green}${colors.bright}✓ Publish complete!${colors.reset}`);
+    console.log(`${colors.dim}  Service:${colors.reset} ${serviceId}`);
+    console.log(`${colors.dim}  Image ID:${colors.reset} ${fullImageId}`);
+    console.log(`${colors.dim}  Registry:${colors.reset} ${registryUrl}${uniqueName}`);
+  } finally {
+    if (tempRoot) {
+      await fs.rm(tempRoot, { recursive: true, force: true });
+    }
+  }
+}
+
+main().catch(async (error) => {
+  // Show clean error message
+  console.error(`\n${colors.red}${colors.bright}✗ Publish failed${colors.reset}`);
+  if (error instanceof Error) {
+    console.error(`${colors.red}${error.message}${colors.reset}`);
+    // if (process.env.BEAMO_DEBUG === '1' || process.env.BEAMO_NODE_DEBUG === '1') {
+    //   console.error(`\n${colors.dim}Stack:${colors.reset} ${error.stack}`);
+    //   if (error.cause) {
+    //     console.error(`${colors.dim}Cause:${colors.reset} ${error.cause}`);
+    //   }
+    //   if (error.stdout) {
+    //     console.error(`${colors.dim}stdout:${colors.reset} ${error.stdout}`);
+    //   }
+    //   if (error.stderr) {
+    //     console.error(`${colors.dim}stderr:${colors.reset} ${error.stderr}`);
+    //   }
+    //   console.error(`\n${colors.dim}Full error:${colors.reset}`, JSON.stringify(error, Object.getOwnPropertyNames(error), 2));
+    // }
+  } else {
+    console.error(`${colors.red}${error}${colors.reset}`);
+  }
+  process.exit(1);
+});