hybrid 2.0.1 → 2.1.0

package/dist/index.js

@@ -1,20 +1,1413 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
-// src/cli.ts
-import { existsSync } from "fs";
-import { basename, dirname, resolve } from "path";
+// ../../node_modules/.pnpm/tsup@8.5.0_jiti@2.6.0_postcss@8.5.6_tsx@4.20.5_typescript@5.9.3_yaml@2.8.1/node_modules/tsup/assets/esm_shims.js
+import path from "path";
 import { fileURLToPath } from "url";
+var init_esm_shims = __esm({
+  "../../node_modules/.pnpm/tsup@8.5.0_jiti@2.6.0_postcss@8.5.6_tsx@4.20.5_typescript@5.9.3_yaml@2.8.1/node_modules/tsup/assets/esm_shims.js"() {
+    "use strict";
+  }
+});
+
+// src/deploy/providers/sprite.provider.ts
+var sprite_provider_exports = {};
+__export(sprite_provider_exports, {
+  spriteProvider: () => spriteProvider
+});
+import { execFileSync, spawn } from "child_process";
+import { existsSync, unlinkSync } from "fs";
+import { tmpdir } from "os";
+import { basename, join } from "path";
+var spriteProvider;
+var init_sprite_provider = __esm({
+  "src/deploy/providers/sprite.provider.ts"() {
+    "use strict";
+    init_esm_shims();
+    spriteProvider = {
+      name: "sprites",
+      label: "Sprites.dev (Firecracker)",
+      defaultName(projectDir) {
+        return basename(projectDir).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+      },
+      async authCheck() {
+        try {
+          execFileSync("sprite", ["list"], { stdio: "pipe", timeout: 5e3 });
+        } catch (err) {
+          if (err.code === "ENOENT") {
+            throw new Error(
+              "'sprite' CLI not found.\n   Install: https://sprites.dev/docs/install\n   Or: npm i -g sprite-cli"
+            );
+          }
+          throw new Error(
+            `Sprite CLI authentication failed.
+   Run: sprite login
+   Error: ${err.stderr || err.message}`
+          );
+        }
+      },
+      async provision(name, _opts) {
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(name)) {
+          throw new Error(
+            `Invalid sprite name: ${name}
+Name must start with a letter/digit and contain only letters, digits, hyphens, and underscores.`
+          );
+        }
+        try {
+          const existing = execFileSync("sprite", ["list"], {
+            encoding: "utf-8"
+          });
+          if (existing.includes(name)) {
+            return name;
+          }
+        } catch {
+        }
+        console.log(`
+\u{1F4E6} Creating sprite: ${name}`);
+        try {
+          execFileSync("sprite", ["create", "-skip-console", name], {
+            stdio: "inherit"
+          });
+        } catch {
+          const existing = execFileSync("sprite", ["list"], {
+            encoding: "utf-8"
+          });
+          if (existing.includes(name)) {
+            console.log(`   Sprite ${name} already exists, using it`);
+            return name;
+          }
+          throw new Error("Failed to create sprite");
+        }
+        console.log("\n\u23F3 Waiting for sprite to be ready...");
+        for (let i = 0; i < 30; i++) {
+          try {
+            execFileSync("sprite", ["exec", "-s", name, "--", "echo", "ready"], {
+              stdio: "pipe"
+            });
+            console.log("   \u2713 Sprite ready");
+            return name;
+          } catch {
+            if (i % 5 === 4) {
+              console.log(`   Still waiting... (${i + 1}/30)`);
+            }
+            await new Promise((r) => setTimeout(r, 2e3));
+          }
+        }
+        throw new Error("Sprite did not become ready in time");
+      },
+      async deploy(instanceId, distDir) {
+        console.log("\n\u{1F4E4} Uploading build artifacts...");
+        const tarPath = join(tmpdir(), `hybrid-deploy-${Date.now()}.tar.gz`);
+        execFileSync("tar", ["-czf", tarPath, "-C", distDir, "."], {
+          stdio: "pipe"
+        });
+        execFileSync(
+          "sprite",
+          ["exec", "-s", instanceId, "--", "mkdir", "-p", "/app"],
+          {
+            stdio: "pipe"
+          }
+        );
+        let uploadSuccess = false;
+        for (let attempt = 0; attempt < 3; attempt++) {
+          try {
+            execFileSync(
+              "sprite",
+              [
+                "exec",
+                "-s",
+                instanceId,
+                "-file",
+                `${tarPath}:/tmp/hybrid-deploy.tar.gz`,
+                "--",
+                "tar",
+                "-xzf",
+                "/tmp/hybrid-deploy.tar.gz",
+                "-C",
+                "/app"
+              ],
+              { stdio: "inherit" }
+            );
+            uploadSuccess = true;
+            break;
+          } catch {
+            if (attempt < 2) {
+              console.log(`   Upload failed, retrying... (${attempt + 1}/3)`);
+              await new Promise((r) => setTimeout(r, 5e3));
+            }
+          }
+        }
+        if (existsSync(tarPath)) {
+          try {
+            unlinkSync(tarPath);
+          } catch {
+          }
+        }
+        if (!uploadSuccess) {
+          throw new Error("Failed to upload build artifacts after 3 attempts");
+        }
+        console.log("\n\u{1F4E6} Installing dependencies...");
+        execFileSync(
+          "sprite",
+          [
+            "exec",
+            "-s",
+            instanceId,
+            "--",
+            "bash",
+            "-c",
+            "cd /app && npm install --production"
+          ],
+          { stdio: "inherit" }
+        );
+        console.log("\n\u{1F527} Starting agent...");
+        const { writeFileSync: writeFileSync2 } = await import("fs");
+        const scriptPath = join(tmpdir(), `hybrid-start-${Date.now()}.sh`);
+        const startupScript = `#!/bin/bash
+cd /app
+export NODE_ENV=production
+export AGENT_PORT=8454
+exec nohup node server/index.cjs > /app/agent.log 2>&1 &
+echo $! > /app/agent.pid
+`;
+        writeFileSync2(scriptPath, startupScript, { mode: 493 });
+        execFileSync(
+          "sprite",
+          [
+            "exec",
+            "-s",
+            instanceId,
+            "-file",
+            `${scriptPath}:/app/start-agent.sh`,
+            "--",
+            "chmod",
+            "+x",
+            "/app/start-agent.sh"
+          ],
+          { stdio: "pipe" }
+        );
+        execFileSync(
+          "sprite",
+          ["exec", "-s", instanceId, "--", "bash", "/app/start-agent.sh"],
+          { stdio: "inherit" }
+        );
+        try {
+          unlinkSync(scriptPath);
+        } catch {
+        }
+        console.log("\n\u23F3 Waiting for agent to start...");
+        let ready = false;
+        for (let i = 0; i < 15; i++) {
+          try {
+            const result = execFileSync(
+              "sprite",
+              [
+                "exec",
+                "-s",
+                instanceId,
+                "--",
+                "curl",
+                "-s",
+                "http://localhost:8454/health"
+              ],
+              { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+            );
+            if (result) {
+              ready = true;
+              break;
+            }
+          } catch {
+          }
+          await new Promise((r) => setTimeout(r, 2e3));
+        }
+        if (!ready) {
+          console.log("   \u26A0\uFE0F  Agent may not be fully ready (health check timed out)");
+        } else {
+          console.log("   \u2713 Agent running");
+        }
+      },
+      async status(instanceId) {
+        try {
+          const output = execFileSync("sprite", ["list"], {
+            encoding: "utf-8"
+          });
+          if (!output.includes(instanceId)) {
+            return "stopped";
+          }
+          const lines = output.split("\n");
+          for (const line of lines) {
+            if (line.includes(instanceId)) {
+              if (line.includes("sleeping") || line.includes("paused")) {
+                return "sleeping";
+              }
+              if (line.includes("running")) {
+                return "running";
+              }
+              if (line.includes("stopped") || line.includes("terminated")) {
+                return "stopped";
+              }
+              return "running";
+            }
+          }
+          return "unknown";
+        } catch {
+          return "unknown";
+        }
+      },
+      async sleep(instanceId) {
+        console.log(`
+\u{1F4A4} Sleeping sprite: ${instanceId}`);
+        try {
+          execFileSync("sprite", ["sleep", instanceId], { stdio: "inherit" });
+          console.log("   \u2713 Sprite sleeping");
+        } catch (err) {
+          throw new Error(`Failed to sleep sprite: ${err.stderr || err.message}`);
+        }
+      },
+      async wake(instanceId) {
+        console.log(`
+\u2600\uFE0F  Waking sprite: ${instanceId}`);
+        try {
+          execFileSync("sprite", ["exec", "-s", instanceId, "--", "echo", "wake"], {
+            stdio: "pipe"
+          });
+          console.log("   \u2713 Sprite awake");
+        } catch (err) {
+          throw new Error(`Failed to wake sprite: ${err.stderr || err.message}`);
+        }
+      },
+      async logs(instanceId, follow = true) {
+        const args = follow ? ["logs", "-s", instanceId, "-f"] : ["logs", "-s", instanceId];
+        const child = spawn("sprite", args, { stdio: "inherit" });
+        return new Promise((resolve3, reject) => {
+          child.on("exit", (code) => {
+            if (code === 0) resolve3();
+            else reject(new Error(`sprite logs exited with code ${code}`));
+          });
+        });
+      },
+      async endpoint(instanceId) {
+        return `https://${instanceId}.sprites.dev`;
+      },
+      async teardown(instanceId) {
+        console.log(`
+\u{1F5D1}\uFE0F  Destroying sprite: ${instanceId}`);
+        try {
+          execFileSync("sprite", ["delete", instanceId], { stdio: "inherit" });
+          console.log("   \u2713 Sprite destroyed");
+        } catch (err) {
+          throw new Error(`Failed to destroy sprite: ${err.stderr || err.message}`);
+        }
+      }
+    };
+  }
+});
+
+// src/deploy/providers/e2b.provider.ts
+var e2b_provider_exports = {};
+__export(e2b_provider_exports, {
+  e2bProvider: () => e2bProvider
+});
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync2, unlinkSync as unlinkSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, join as join2 } from "path";
+async function findSandbox(name) {
+  const Sandbox = await getSDK();
+  const paginator = Sandbox.list();
+  while (paginator.hasNext) {
+    const items = await paginator.nextItems();
+    for (const s of items) {
+      const info = s;
+      const meta = info.metadata;
+      if (meta?.["hybrid-name"] === name || info.sandboxId === name || info.sandboxId?.startsWith(name)) {
+        return s;
+      }
+    }
+  }
+  return null;
+}
+async function getSDK() {
+  try {
+    const { Sandbox } = await import("e2b");
+    return Sandbox;
+  } catch {
+    throw new Error(
+      "e2b not installed.\nInstall with: npm install e2b"
+    );
+  }
+}
+function getAPIKey() {
+  const key = process.env.E2B_API_KEY;
+  if (!key) {
+    throw new Error(
+      "E2B_API_KEY not set.\nGet your key: https://e2b.dev/dashboard?tab=keys\nSet with: export E2B_API_KEY=e2b_xxx"
+    );
+  }
+  return key;
+}
+async function getSandbox(name) {
+  const cached = sandboxes.get(name);
+  if (cached) return cached;
+  const found = await findSandbox(name);
+  if (!found) return null;
+  const Sandbox = await getSDK();
+  const sandbox = await Sandbox.connect(found.sandboxId);
+  sandboxes.set(name, sandbox);
+  return sandbox;
+}
+var DEFAULT_TEMPLATE, sandboxes, e2bProvider;
+var init_e2b_provider = __esm({
+  "src/deploy/providers/e2b.provider.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_TEMPLATE = "base";
+    sandboxes = /* @__PURE__ */ new Map();
+    e2bProvider = {
+      name: "e2b",
+      label: "E2B.dev (Firecracker)",
+      defaultName(projectDir) {
+        return basename2(projectDir).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+      },
+      async authCheck() {
+        getAPIKey();
+        const Sandbox = await getSDK();
+        try {
+          const paginator = Sandbox.list();
+          await paginator.nextItems();
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (msg.includes("401") || msg.includes("unauthorized")) {
+            throw new Error(
+              "E2B API key is invalid.\nGet your key: https://e2b.dev/dashboard?tab=keys"
+            );
+          }
+          throw new Error(`E2B connection failed: ${msg}`);
+        }
+      },
+      async provision(name, _opts) {
+        const Sandbox = await getSDK();
+        console.log(`
+\u{1F4E6} Creating E2B sandbox: ${name}`);
+        const existing = await findSandbox(name);
+        if (existing) {
+          const sandbox2 = await Sandbox.connect(
+            existing.sandboxId
+          );
+          sandboxes.set(name, sandbox2);
+          console.log(
+            `   \u2713 Resumed existing sandbox: ${existing.sandboxId}`
+          );
+          return existing.sandboxId;
+        }
+        const sandbox = await Sandbox.create(DEFAULT_TEMPLATE, {
+          metadata: { "hybrid-name": name }
+        });
+        sandboxes.set(name, sandbox);
+        console.log(`   \u2713 Sandbox created: ${sandbox.sandboxId}`);
+        return sandbox.sandboxId;
+      },
+      async deploy(instanceId, distDir) {
+        const sandbox = await getSandbox(instanceId);
+        if (!sandbox) {
+          throw new Error(
+            `Sandbox ${instanceId} not found.
+Run 'hybrid deploy' again to reconnect.`
+          );
+        }
+        console.log("\n\u{1F4E4} Uploading build artifacts...");
+        const tarPath = join2(
+          tmpdir2(),
+          `hybrid-e2b-deploy-${Date.now()}.tar.gz`
+        );
+        execFileSync2("tar", ["-czf", tarPath, "-C", distDir, "."], {
+          stdio: "pipe"
+        });
+        try {
+          const fs = await import("fs/promises");
+          const tarBuffer = await fs.readFile(tarPath);
+          await sandbox.files.write("/tmp/hybrid-deploy.tar.gz", tarBuffer, {
+            onProgress: () => {
+            }
+          });
+          console.log("   \u2713 Upload complete");
+        } catch (err) {
+          throw new Error(
+            `Upload failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        } finally {
+          if (existsSync2(tarPath)) {
+            try {
+              unlinkSync2(tarPath);
+            } catch {
+            }
+          }
+        }
+        console.log("\n\u{1F4E6} Extracting and installing dependencies...");
+        const result = await sandbox.commands.run(
+          "cd /home/user && mkdir -p app && tar -xzf /tmp/hybrid-deploy.tar.gz -C app && cd app && npm install --production 2>&1",
+          { timeout: 12e4 }
+        );
+        if (result.stderr) {
+          console.log(`   \u26A0\uFE0F  ${result.stderr.slice(0, 200)}`);
+        }
+        if (result.exitCode !== 0) {
+          throw new Error(
+            `Dependency installation failed (exit ${result.exitCode})`
+          );
+        }
+        console.log("\n\u{1F527} Starting agent...");
+        await sandbox.commands.run(
+          "cd /home/user/app && export NODE_ENV=production AGENT_PORT=8454 && nohup node server/index.cjs > /tmp/agent.log 2>&1 & echo $! > /tmp/agent.pid",
+          { timeout: 1e4 }
+        );
+        console.log("\n\u23F3 Waiting for agent to start...");
+        let ready = false;
+        for (let i = 0; i < 15; i++) {
+          try {
+            const health = await sandbox.commands.run(
+              "curl -sf http://localhost:8454/health || echo 'not ready'"
+            );
+            if (health.stdout && !health.stdout.includes("not ready")) {
+              ready = true;
+              break;
+            }
+          } catch {
+          }
+          await new Promise((r) => setTimeout(r, 2e3));
+        }
+        if (!ready) {
+          console.log(
+            "   \u26A0\uFE0F  Agent health check timed out (may still be starting)"
+          );
+        } else {
+          console.log("   \u2713 Agent running");
+        }
+      },
+      async status(instanceId) {
+        const info = await findSandbox(instanceId);
+        if (!info) return "stopped";
+        const sbInfo = info;
+        if (sbInfo.status === "paused") return "sleeping";
+        if (sbInfo.status === "running") return "running";
+        return "unknown";
+      },
+      async sleep(instanceId) {
+        const sandbox = await getSandbox(instanceId);
+        if (!sandbox) {
+          throw new Error(
+            `Sandbox ${instanceId} not found.
+Run 'hybrid deploy' again to reconnect.`
+          );
+        }
+        console.log(`
+\u{1F4A4} Pausing E2B sandbox: ${instanceId}`);
+        await sandbox.pause();
+        sandboxes.delete(instanceId);
+        console.log("   \u2713 Sandbox paused (state preserved on disk)");
+      },
+      async wake(instanceId) {
+        const Sandbox = await getSDK();
+        console.log(`
+\u2600\uFE0F  Resuming E2B sandbox: ${instanceId}`);
+        try {
+          const sandbox = await Sandbox.connect(instanceId);
+          sandboxes.set(instanceId, sandbox);
+          console.log("   \u2713 Sandbox resumed");
+        } catch (err) {
+          throw new Error(
+            `Failed to resume sandbox: ${err instanceof Error ? err.message : String(err)}
+The sandbox may have expired (E2B sandboxes have a maximum lifetime).`
+          );
+        }
+      },
+      async logs(instanceId, follow = true) {
+        const sandbox = await getSandbox(instanceId);
+        if (!sandbox) {
+          throw new Error(
+            `Sandbox ${instanceId} not found.
+Run 'hybrid deploy' again to reconnect.`
+          );
+        }
+        if (follow) {
+          let offset = 0;
+          while (true) {
+            try {
+              const result = await sandbox.commands.run(
+                "cat /tmp/agent.log 2>/dev/null || echo 'No logs yet'"
+              );
+              const output = result.stdout || "";
+              if (output.length > offset) {
+                process.stdout.write(output.slice(offset));
+                offset = output.length;
+              }
+              await new Promise((r) => setTimeout(r, 2e3));
+            } catch {
+              await new Promise((r) => setTimeout(r, 2e3));
+            }
+          }
+        } else {
+          const result = await sandbox.commands.run(
+            "cat /tmp/agent.log 2>/dev/null || echo 'No logs yet'"
+          );
+          console.log(result.stdout || "No logs yet");
+        }
+      },
+      async endpoint(instanceId) {
+        const sandbox = sandboxes.get(instanceId);
+        if (!sandbox) return `https://${instanceId}-8454.e2b.dev`;
+        try {
+          const host = await sandbox.getHost(8454);
+          return `https://${host}`;
+        } catch {
+          return `https://${instanceId}-8454.e2b.dev`;
+        }
+      },
+      async teardown(instanceId) {
+        const Sandbox = await getSDK();
+        console.log(`
+\u{1F5D1}\uFE0F  Destroying E2B sandbox: ${instanceId}`);
+        try {
+          const cached = sandboxes.get(instanceId);
+          if (cached) {
+            await cached.kill();
+          } else {
+            const sandbox = await Sandbox.connect(instanceId);
+            await sandbox.kill();
+          }
+          sandboxes.delete(instanceId);
+          console.log("   \u2713 Sandbox destroyed");
+        } catch (err) {
+          throw new Error(
+            `Failed to destroy sandbox: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/deploy/providers/northflank.provider.ts
+var northflank_provider_exports = {};
+__export(northflank_provider_exports, {
+  northflankProvider: () => northflankProvider
+});
+import { execFileSync as execFileSync3, spawn as spawn2 } from "child_process";
+import { existsSync as existsSync3, unlinkSync as unlinkSync3 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename3, join as join3 } from "path";
+function runNf(args) {
+  return execFileSync3(CLI, args, {
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+}
+function runNfInherit(args) {
+  execFileSync3(CLI, args, { stdio: "inherit" });
+}
+var CLI, northflankProvider;
+var init_northflank_provider = __esm({
+  "src/deploy/providers/northflank.provider.ts"() {
+    "use strict";
+    init_esm_shims();
+    CLI = "nf";
+    northflankProvider = {
+      name: "northflank",
+      label: "Northflank (Firecracker / Auto-scale)",
+      defaultName(projectDir) {
+        return basename3(projectDir).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+      },
+      async authCheck() {
+        try {
+          const result = runNf(["auth", "whoami"]);
+          if (!result || result.includes("not logged in")) {
+            throw new Error(
+              "Not authenticated with Northflank.\n    Run: nf auth login"
+            );
+          }
+        } catch (err) {
+          if (err.code === "ENOENT") {
+            throw new Error(
+              "`nf` CLI not found.\n    Install: https://docs.northflank.com/docs/cli\n    Or: npm install -g @northflank/cli"
+            );
+          }
+          throw new Error(
+            `Northflank CLI error: ${err.stderr || err.message}
+Run: nf auth login`
+          );
+        }
+      },
+      async provision(name, opts) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) {
+          throw new Error(
+            "NF_PROJECT_ID not set.\n    Create a project on Northflank and set: export NF_PROJECT_ID=your-project-id"
+          );
+        }
+        try {
+          const existing = runNf(["services", "list", "--projectId", projectId]);
+          if (existing.toLowerCase().includes(name)) {
+            console.log(`   \u2713 Service already exists: ${name}`);
+            return name;
+          }
+        } catch {
+        }
+        const apiUrl = process.env.NF_API_URL || "https://api.northflank.com";
+        const memory = opts?.memory || 512;
+        const cpus = opts?.cpus || 1;
+        console.log(`
+\u{1F4E6} Creating Northflank service: ${name}`);
+        console.log(`   Project: ${projectId}`);
+        console.log(`   Memory: ${memory}MB, CPUs: ${cpus}`);
+        const spec = {
+          name,
+          projectId,
+          type: "service",
+          image: {
+            image: `registry.northflank.com/${projectId}/${name}:latest`
+          },
+          resources: {
+            instances: 1,
+            containerResources: {
+              cpu: {
+                req: cpus,
+                limit: cpus
+              },
+              memory: {
+                req: memory,
+                limit: memory
+              }
+            }
+          },
+          ports: [
+            {
+              name: "default",
+              protocol: "HTTP",
+              containerPort: 8454,
+              ingress: {
+                autoSubdomain: true
+              }
+            }
+          ],
+          autoscaling: {
+            enabled: true,
+            minReplicas: 0,
+            maxReplicas: 1
+          }
+        };
+        const specPath = join3(tmpdir3(), `nf-spec-${Date.now()}.json`);
+        const { writeFileSync: writeFileSync2 } = await import("fs");
+        writeFileSync2(specPath, JSON.stringify(spec, null, 2));
+        try {
+          runNfInherit(["deploy", "service", specPath]);
+        } finally {
+          if (existsSync3(specPath)) {
+            try {
+              unlinkSync3(specPath);
+            } catch {
+            }
+          }
+        }
+        console.log("   \u2713 Service created with auto-scale-to-zero enabled");
+        return name;
+      },
+      async deploy(instanceId, distDir) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) {
+          throw new Error("NF_PROJECT_ID not set.");
+        }
+        console.log("\n\u{1F4E6} Building and pushing Docker image...");
+        const imageTag = `registry.northflank.com/${projectId}/${instanceId}:latest`;
+        runNf(["info"]);
+        console.log("   Building Docker image...");
+        execFileSync3("docker", ["build", "-t", imageTag, "."], {
+          cwd: distDir,
+          stdio: "inherit"
+        });
+        console.log("   Pushing to Northflank registry...");
+        execFileSync3("docker", ["push", imageTag], {
+          stdio: "inherit"
+        });
+        console.log("\n\u{1F527} Deploying service...");
+        try {
+          runNfInherit([
+            "services",
+            "set-image",
+            "--projectId",
+            projectId,
+            "--serviceId",
+            instanceId,
+            "--image",
+            imageTag
+          ]);
+        } catch (err) {
+          console.log("   \u26A0\uFE0F  Service update initiated");
+        }
+        console.log("\n\u23F3 Waiting for deployment to be ready...");
+        for (let i = 0; i < 60; i++) {
+          try {
+            const status = runNf([
+              "services",
+              "status",
+              "--projectId",
+              projectId,
+              "--serviceId",
+              instanceId
+            ]);
+            if (status.toLowerCase().includes("deployed") || status.toLowerCase().includes("running")) {
+              console.log("   \u2713 Service deployed");
+              return;
+            }
+          } catch {
+          }
+          if (i % 10 === 9) {
+            console.log(`   Still deploying... (${i + 1}/60)`);
+          }
+          await new Promise((r) => setTimeout(r, 5e3));
+        }
+        console.log("   \u26A0\uFE0F  Deployment may still be in progress");
+      },
+      async status(instanceId) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) return "unknown";
+        try {
+          const status = runNf([
+            "services",
+            "status",
+            "--projectId",
+            projectId,
+            "--serviceId",
+            instanceId
+          ]);
+          const lower = status.toLowerCase();
+          if (lower.includes("deployed") || lower.includes("running")) {
+            return "running";
+          }
+          if (lower.includes("stopped") || lower.includes("paused")) {
+            return "sleeping";
+          }
+          if (lower.includes("deploying")) {
+            return "provisioning";
+          }
+          return "unknown";
+        } catch {
+          return "stopped";
+        }
+      },
+      async sleep(instanceId) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) {
+          throw new Error("NF_PROJECT_ID not set.");
+        }
+        console.log(`
+\u{1F4A4} Scaling Northflank service to 0: ${instanceId}`);
+        try {
+          runNfInherit([
+            "services",
+            "scale",
+            "--projectId",
+            projectId,
+            "--serviceId",
+            instanceId,
+            "--replicas",
+            "0"
+          ]);
+          console.log("   \u2713 Service scaled to 0 (sleeping)");
+        } catch (err) {
+          throw new Error(`Failed to scale down: ${err.stderr || err.message}`);
+        }
+      },
+      async wake(instanceId) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) {
+          throw new Error("NF_PROJECT_ID not set.");
+        }
+        console.log(`
+\u2600\uFE0F  Scaling Northflank service to 1: ${instanceId}`);
+        try {
+          runNfInherit([
+            "services",
+            "scale",
+            "--projectId",
+            projectId,
+            "--serviceId",
+            instanceId,
+            "--replicas",
+            "1"
+          ]);
+          console.log("   \u2713 Service scaling up (may take 30-60s)");
+        } catch (err) {
+          throw new Error(`Failed to scale up: ${err.stderr || err.message}`);
+        }
+      },
+      async logs(instanceId, follow = true) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) {
+          throw new Error("NF_PROJECT_ID not set.");
+        }
+        const args = [
+          "services",
+          "logs",
+          "--projectId",
+          projectId,
+          "--serviceId",
+          instanceId
+        ];
+        if (follow) args.push("--follow");
+        const child = spawn2(CLI, args, { stdio: "inherit" });
+        return new Promise((resolve3, reject) => {
+          child.on("exit", (code) => {
+            if (code === 0) resolve3();
+            else reject(new Error(`nf logs exited with code ${code}`));
+          });
+        });
+      },
+      async endpoint(instanceId) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) return `https://${instanceId}.northflank.app`;
+        try {
+          const info = runNf([
+            "services",
+            "info",
+            "--projectId",
+            projectId,
+            "--serviceId",
+            instanceId
+          ]);
+          const match = info.match(/https?:\/\/[^\s]+/i);
+          if (match) return match[0];
+        } catch {
+        }
+        return `https://${instanceId}.${projectId}.northflank.app`;
+      },
+      async teardown(instanceId) {
+        const projectId = process.env.NF_PROJECT_ID;
+        if (!projectId) {
+          throw new Error("NF_PROJECT_ID not set.");
+        }
+        console.log(`
+\u{1F5D1}\uFE0F  Destroying Northflank service: ${instanceId}`);
+        try {
+          runNfInherit([
+            "services",
+            "delete",
+            "--projectId",
+            projectId,
+            "--serviceId",
+            instanceId,
+            "--permanent"
+          ]);
+          console.log("   \u2713 Service destroyed");
+        } catch (err) {
+          throw new Error(`Failed to destroy service: ${err.stderr || err.message}`);
+        }
+      }
+    };
+  }
+});
+
+// src/deploy/providers/daytona.provider.ts
+var daytona_provider_exports = {};
+__export(daytona_provider_exports, {
+  daytonaProvider: () => daytonaProvider
+});
+import { execFileSync as execFileSync4, spawn as spawn3 } from "child_process";
+import { existsSync as existsSync4, unlinkSync as unlinkSync4 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { basename as basename4, join as join4 } from "path";
+function runDaytona(args) {
+  return execFileSync4(CLI2, args, {
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+}
+function runDaytonaInherit(args) {
+  execFileSync4(CLI2, args, { stdio: "inherit" });
+}
+var CLI2, daytonaProvider;
+var init_daytona_provider = __esm({
+  "src/deploy/providers/daytona.provider.ts"() {
+    "use strict";
+    init_esm_shims();
+    CLI2 = "daytona";
+    daytonaProvider = {
+      name: "daytona",
+      label: "Daytona.io (Firecracker / Dev Workspace)",
+      defaultName(projectDir) {
+        return basename4(projectDir).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
+      },
+      async authCheck() {
+        try {
+          runDaytona(["info"]);
+        } catch (err) {
+          if (err.code === "ENOENT") {
+            throw new Error(
+              "`daytona` CLI not found.\n    Install: https://www.daytona.io/docs/getting-started/installation/\n    Or: curl -NF https://download.daytona.io/daytona/install.sh | sh"
+            );
+          }
+          throw new Error(`Daytona CLI error: ${err.stderr || err.message}`);
+        }
+      },
+      async provision(name, opts) {
+        try {
+          const existing = runDaytona(["list"]);
+          const lines = existing.split("\n");
+          const found = lines.find((l) => l.includes(name));
+          if (found) {
+            console.log(`   \u26A0\uFE0F  Workspace already exists: ${name}`);
+            return name;
+          }
+        } catch {
+        }
+        console.log(`
+\u{1F4E6} Creating Daytona workspace: ${name}`);
+        const image = opts?.memory ? "node:20" : "node:20";
+        const args = ["create", "--name", name, "--image", image];
+        const provider = process.env.DAYTONA_PROVIDER;
+        if (provider) {
+          args.push("--provider", provider);
+        }
+        runDaytonaInherit(args);
+        console.log("   \u2713 Workspace created");
+        return name;
+      },
+      async deploy(instanceId, distDir) {
+        console.log("\n\u{1F4E4} Uploading build artifacts...");
+        const tarPath = join4(tmpdir4(), `hybrid-daytona-${Date.now()}.tar.gz`);
+        execFileSync4("tar", ["-czf", tarPath, "-C", distDir, "."], {
+          stdio: "pipe"
+        });
+        runDaytonaInherit([
+          "code",
+          instanceId,
+          "--command",
+          "mkdir -p /workspace/app"
+        ]);
+        try {
+          runDaytonaInherit([
+            "cp",
+            tarPath,
+            `${instanceId}:/workspace/app/hybrid-deploy.tar.gz`
+          ]);
+        } catch {
+          throw new Error(
+            `daytona cp failed for instance ${instanceId}.
+Ensure the Daytona CLI supports file copy: daytona cp ${tarPath} ${instanceId}:/workspace/app/hybrid-deploy.tar.gz`
+          );
+        }
+        runDaytonaInherit([
+          "code",
+          instanceId,
+          "--command",
+          "cd /workspace/app && tar -xzf hybrid-deploy.tar.gz && npm install --production"
+        ]);
+        if (existsSync4(tarPath)) {
+          try {
+            unlinkSync4(tarPath);
+          } catch {
+          }
+        }
+        console.log("\n\u{1F527} Starting agent...");
+        runDaytonaInherit([
+          "code",
+          instanceId,
+          "--command",
+          "cd /workspace/app && export NODE_ENV=production AGENT_PORT=8454 && nohup node server/index.cjs > /workspace/app/agent.log 2>&1 &"
+        ]);
+        console.log("\n\u23F3 Waiting for agent to start...");
+        let ready = false;
+        for (let i = 0; i < 15; i++) {
+          try {
+            const result = runDaytona([
+              "code",
+              instanceId,
+              "--command",
+              "curl -sf http://localhost:8454/health || echo not-ready"
+            ]);
+            if (result && !result.includes("not-ready")) {
+              ready = true;
+              break;
+            }
+          } catch {
+          }
+          await new Promise((r) => setTimeout(r, 2e3));
+        }
+        if (!ready) {
+          console.log("   \u26A0\uFE0F  Agent health check timed out");
+        } else {
+          console.log("   \u2713 Agent running");
+        }
+      },
+      async status(instanceId) {
+        try {
+          const list = runDaytona(["list"]);
+          const lines = list.split("\n");
+          const found = lines.find((l) => l.includes(instanceId));
+          if (!found) return "stopped";
+          const lower = found.toLowerCase();
+          if (lower.includes("started") || lower.includes("running")) {
+            return "running";
+          }
+          if (lower.includes("stopped")) {
+            return "stopped";
+          }
+          return "unknown";
+        } catch {
+          return "unknown";
+        }
+      },
+      async sleep(instanceId) {
+        console.log(`
+\u{1F4A4} Stopping Daytona workspace: ${instanceId}`);
+        try {
+          runDaytonaInherit(["stop", instanceId]);
+          console.log("   \u2713 Workspace stopped");
+        } catch (err) {
+          throw new Error(`Failed to stop workspace: ${err.stderr || err.message}`);
+        }
+      },
+      async wake(instanceId) {
+        console.log(`
+\u2600\uFE0F  Starting Daytona workspace: ${instanceId}`);
+        try {
+          runDaytonaInherit(["start", instanceId]);
+          console.log("   \u2713 Workspace starting (~30s)");
+        } catch (err) {
+          throw new Error(`Failed to start workspace: ${err.stderr || err.message}`);
+        }
+      },
+      async logs(instanceId, follow = true) {
+        const args = follow ? ["code", instanceId, "--command", "tail -f /workspace/app/agent.log"] : ["code", instanceId, "--command", "cat /workspace/app/agent.log"];
+        const child = spawn3(CLI2, args, { stdio: "inherit" });
+        return new Promise((resolve3, reject) => {
+          child.on("exit", (code) => {
+            if (code === 0) resolve3();
+            else reject(new Error(`daytona exited with code ${code}`));
+          });
+        });
+      },
+      async endpoint(instanceId) {
+        return `daytona://${instanceId}`;
+      },
+      async teardown(instanceId) {
+        console.log(`
+\u{1F5D1}\uFE0F  Destroying Daytona workspace: ${instanceId}`);
+        try {
+          runDaytonaInherit(["remove", instanceId]);
+          console.log("   \u2713 Workspace destroyed");
+        } catch (err) {
+          throw new Error(
+            `Failed to destroy workspace: ${err.stderr || err.message}`
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/deploy/index.ts
+async function getProvider(name) {
+  const entry = providers[name];
+  if (!entry) {
+    throw new Error(
+      `Provider "${name}" is not yet implemented.
+Available providers: sprites, e2b, northflank, daytona`
+    );
+  }
+  if (typeof entry === "function") {
+    return entry();
+  }
+  return entry;
+}
+var providers;
+var init_deploy = __esm({
+  "src/deploy/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    providers = {
+      sprites: () => Promise.resolve().then(() => (init_sprite_provider(), sprite_provider_exports)).then((m) => m.spriteProvider),
+      e2b: () => Promise.resolve().then(() => (init_e2b_provider(), e2b_provider_exports)).then((m) => m.e2bProvider),
+      northflank: () => Promise.resolve().then(() => (init_northflank_provider(), northflank_provider_exports)).then((m) => m.northflankProvider),
+      daytona: () => Promise.resolve().then(() => (init_daytona_provider(), daytona_provider_exports)).then((m) => m.daytonaProvider)
+    };
+  }
+});
+
+// src/deploy/deploy.ts
+var deploy_exports = {};
+__export(deploy_exports, {
+  runDeploy: () => runDeploy,
+  runLogs: () => runLogs,
+  runSleep: () => runSleep,
+  runStatus: () => runStatus,
+  runTeardown: () => runTeardown,
+  runWake: () => runWake
+});
+import {
+  cpSync,
+  existsSync as existsSync5,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { resolve } from "path";
+async function runDeploy(options, projectRoot2, packageDir2) {
+  const platform = resolvePlatform(options.platform, projectRoot2);
+  const provider = await getProvider(platform);
+  console.log(`
+\u{1F680} Deploying to ${provider.label}...`);
+  try {
+    await provider.authCheck();
+  } catch (err) {
+    console.error(`
+\u274C ${err.message}`);
+    process.exit(1);
+  }
+  if (!options.skipBuild) {
+    await runBuild(projectRoot2, packageDir2);
+  }
+  const distDir = resolve(projectRoot2, "dist");
+  const instanceName = options.name || provider.defaultName(projectRoot2);
+  console.log(`
+\u{1F4CB} Instance: ${instanceName}`);
+  const existingStatus = await provider.status(instanceName);
+  if (options.force) {
+    if (existingStatus === "running" || existingStatus === "sleeping") {
+      await provider.teardown(instanceName);
+    }
+    await provider.provision(instanceName);
+  } else if (existingStatus === "sleeping") {
+    console.log(`   \u2600\uFE0F  Waking sleeping instance...`);
+    await provider.wake(instanceName);
+  } else if (existingStatus === "running") {
+    console.log(`   \u26A0\uFE0F  Instance "${instanceName}" is already running.`);
+    const prompts = (await import("prompts")).default;
+    const choice = await prompts({
+      type: "select",
+      name: "action",
+      message: "What do you want to do?",
+      choices: [
+        { title: "Redeploy (overwrite artifacts)", value: "redeploy" },
+        { title: "Force recreate VM", value: "force" },
+        { title: "Cancel", value: "cancel" }
+      ]
+    });
+    if (choice.action === "cancel") {
+      console.log("\n  Cancelled.\n");
+      process.exit(0);
+    }
+    if (choice.action === "force") {
+      await provider.teardown(instanceName);
+      await provider.provision(instanceName);
+    }
+  } else if (existingStatus === "unknown" || existingStatus === "stopped") {
+    await provider.provision(instanceName);
+  } else if (existingStatus === "provisioning") {
+    console.error(`   \u23F3 Instance still provisioning, try again shortly.`);
+    process.exit(1);
+  } else if (existingStatus === "error") {
+    console.error(`   \u274C Instance in error state. Run 'hybrid deploy teardown ${instanceName}' then retry.`);
+    process.exit(1);
+  }
+  await provider.deploy(instanceName, distDir);
+  const endpoint = await provider.endpoint(instanceName);
+  console.log(`
+   Instance: ${instanceName}`);
+  console.log(`   URL: ${endpoint}`);
+  console.log(`   Health: ${endpoint}/health`);
+  console.log(`   Chat: ${endpoint}/api/chat`);
+  console.log("\n\u2705 Deployed!");
+}
+async function runSleep(name, platform, projectRoot2) {
+  const provider = await getProvider(
+    resolvePlatform(platform, projectRoot2)
+  );
+  await provider.authCheck();
+  await provider.sleep(name);
+}
+async function runWake(name, platform, projectRoot2) {
+  const provider = await getProvider(
+    resolvePlatform(platform, projectRoot2)
+  );
+  await provider.authCheck();
+  await provider.wake(name);
+}
+async function runStatus(name, platform, projectRoot2) {
+  const provider = await getProvider(
+    resolvePlatform(platform, projectRoot2)
+  );
+  await provider.authCheck();
+  const status = await provider.status(name);
+  const endpoint = await provider.endpoint(name);
+  console.log(`
+\u{1F4CB} Instance: ${name}`);
+  console.log(`   Status: ${status}`);
+  console.log(`   URL: ${endpoint}`);
+}
+async function runLogs(name, follow, platform, projectRoot2) {
+  const provider = await getProvider(
+    resolvePlatform(platform, projectRoot2)
+  );
+  await provider.authCheck();
+  await provider.logs(name, follow);
+}
+async function runTeardown(name, platform, projectRoot2) {
+  const provider = await getProvider(
+    resolvePlatform(platform, projectRoot2)
+  );
+  await provider.authCheck();
+  await provider.teardown(name);
+}
+function resolvePlatform(platform, projectRoot2) {
+  if (platform) return platform;
+  if (projectRoot2) {
+    const configPath = resolve(projectRoot2, "hybrid.config.ts");
+    if (existsSync5(configPath)) {
+      const content = readFileSync(configPath, "utf-8");
+      const match = content.match(
+        /(?:platform|deployPlatform)\s*[=:]\s*["']([^"']+)["']/
+      );
+      if (match) return match[1];
+    }
+  }
+  return "sprites";
+}
+async function runBuild(projectRoot2, packageDir2) {
+  const distDir = resolve(projectRoot2, "dist");
+  console.log("\n\u{1F527} Building agent...");
+  if (existsSync5(distDir)) {
+    rmSync(distDir, { recursive: true, force: true });
+  }
+  mkdirSync(distDir, { recursive: true });
+  mkdirSync(resolve(distDir, "server"), { recursive: true });
+  console.log("\u{1F4E6} Copying agent runtime...");
+  const agentDistDir = resolve(packageDir2, "dist");
+  const files = ["server/index.cjs"];
+  for (const file of files) {
+    const src = resolve(agentDistDir, file);
+    if (existsSync5(src)) {
+      cpSync(src, resolve(distDir, file));
+    }
+  }
+  console.log("\u{1F4CB} Copying agent config...");
+  const configFiles = [
+    "SOUL.md",
+    "AGENTS.md",
+    "IDENTITY.md",
+    "TOOLS.md",
+    "BOOT.md",
+    "BOOTSTRAP.md",
+    "HEARTBEAT.md",
+    "USER.md"
+  ];
+  for (const file of configFiles) {
+    const src = resolve(projectRoot2, file);
+    if (existsSync5(src)) {
+      cpSync(src, resolve(distDir, file));
+    }
+  }
+  const credsDir = resolve(projectRoot2, "credentials");
+  if (existsSync5(credsDir)) {
+    cpSync(credsDir, resolve(distDir, "credentials"), { recursive: true });
+  }
+  const deployPkg = {
+    name: "hybrid",
+    version: "1.0.0",
+    type: "module",
+    dependencies: {
+      "@anthropic-ai/claude-agent-sdk": "^0.2.38",
+      "@hono/node-server": "^1.13.5",
+      ai: "^6.0.0",
+      "better-sqlite3": "^11.0.0",
+      dotenv: "^16.4.5",
+      hono: "^4.10.8",
+      "sql.js": "^1.11.0",
+      zod: "^4.0.0"
+    }
+  };
+  writeFileSync(
+    resolve(distDir, "package.json"),
+    JSON.stringify(deployPkg, null, 2)
+  );
+  const present = configFiles.filter(
+    (f) => existsSync5(resolve(distDir, f))
+  );
+  const hasCredentials = existsSync5(resolve(distDir, "credentials"));
+  const configCopy = present.length > 0 ? `COPY ${present.join(" ")} ./` : "";
+  const credCopy = hasCredentials ? "COPY credentials/ ./credentials/" : "COPY .hybrid-deploy.json ./";
+  writeFileSync(
+    resolve(distDir, "Dockerfile"),
+    `FROM node:20-bookworm-slim
+WORKDIR /app
+COPY package.json ./
+RUN npm install --production
+COPY server/ ./server/
+COPY ${configCopy} ./
+${credCopy}
+ENV AGENT_PORT=8454
+ENV NODE_ENV=production
+ENV DATA_ROOT=/app/data
+EXPOSE 8454
+USER node
+CMD ["node", "server/index.cjs"]
+`
+  );
+  writeFileSync(
+    resolve(distDir, "start.sh"),
+    `#!/bin/sh
+node server/index.cjs
+`
+  );
+  writeFileSync(
+    resolve(distDir, ".hybrid-deploy.json"),
+    JSON.stringify(
+      {
+        version: 1,
+        provider: "firecracker",
+        startCommand: "node server/index.cjs",
+        port: 8454,
+        healthPath: "/health"
+      },
+      null,
+      2
+    )
+  );
+  console.log("\n\u2705 Build complete!");
+  console.log(`   Output: ${distDir}`);
+}
+var init_deploy2 = __esm({
+  "src/deploy/deploy.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_deploy();
+  }
+});
+
+// src/cli.ts
+init_esm_shims();
+import { existsSync as existsSync6 } from "fs";
+import { dirname, resolve as resolve2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { config } from "dotenv";
 function findProjectRoot(startDir) {
   const markers = ["package.json", "hybrid.config.ts", "SOUL.md"];
   let current = startDir;
   while (current !== "/") {
     for (const marker of markers) {
-      if (existsSync(resolve(current, marker))) {
+      if (existsSync6(resolve2(current, marker))) {
         return current;
       }
     }
-    const parent = resolve(current, "..");
+    const parent = resolve2(current, "..");
     if (parent === current) break;
     current = parent;
   }
@@ -27,9 +1420,9 @@ if (cwdIndex !== -1 && process.argv[cwdIndex + 1]) {
 }
 var projectRoot = findProjectRoot(process.cwd());
 for (const envFile of [".env", ".env.local"]) {
-  const path = resolve(projectRoot, envFile);
-  if (existsSync(path)) {
-    config({ path });
+  const path2 = resolve2(projectRoot, envFile);
+  if (existsSync6(path2)) {
+    config({ path: path2 });
   }
 }
 var [major] = process.versions.node.split(".").map(Number);
@@ -37,20 +1430,19 @@ if (!major || major < 20) {
   console.error("Error: Node.js version 20 or higher is required");
   process.exit(1);
 }
-var __dirname = dirname(fileURLToPath(import.meta.url));
-var packageDir = resolve(__dirname, "..");
+var __dirname2 = dirname(fileURLToPath2(import.meta.url));
+var packageDir = resolve2(__dirname2, "..");
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
-  if (command === "build") return build(args[1]);
+  if (command === "build") {
+    const targetFlag = args.indexOf("--target");
+    return build(targetFlag !== -1 ? args[targetFlag + 1] : args[1]);
+  }
   if (command === "dev") return dev(args.includes("--docker"));
   if (command === "start") return start();
-  if (command === "deploy") return deploy(args[1], args.includes("--keygen"));
+  if (command === "deploy") return deployCommand(args);
   if (command === "init") return init(args[1]);
-  if (command === "keygen") return keygen(args[1]);
-  if (command === "register") return register();
-  if (command === "revoke") return revoke(args[1]);
-  if (command === "revoke-all") return revokeAll();
   if (command === "owner") {
     const subcommand = args[1];
     if (subcommand === "add") return ownerAdd(args[2]);
@@ -109,17 +1501,24 @@ async function main() {
   console.log("Usage: hybrid <command>");
   console.log("");
   console.log("Commands:");
-  console.log("  init <name>           Initialize a new agent");
-  console.log("  dev                   Start development server");
-  console.log("  build [--target]      Build for deployment (fly, railway)");
-  console.log("  start                 Run built agent");
-  console.log("  deploy [platform]     Deploy (fly, railway)");
+  console.log("  init <name>               Initialize a new agent");
+  console.log("  dev                       Start development server");
+  console.log("  build [--target]          Build for deployment (firecracker)");
+  console.log("  start                     Run built agent");
+  console.log(
+    "  deploy [platform]              Deploy to a Firecracker provider"
+  );
+  console.log("  deploy sleep <name>            Put VM to sleep");
+  console.log("  deploy wake <name>             Wake VM");
+  console.log("  deploy status <name>           Show VM status");
+  console.log("  deploy logs <name>             Stream agent logs");
+  console.log("  deploy teardown <name> [--all] Destroy VM");
   console.log("");
-  console.log("Wallet:");
-  console.log("  keygen [prefix]       Generate a new wallet");
-  console.log("  register              Register wallet on XMTP");
-  console.log("  revoke <inboxId>      Revoke installations");
-  console.log("  revoke-all            Revoke all installations");
+  console.log("Deploy flags:");
+  console.log("  --provider <name>  Override provider (sprites, e2b, northflank, daytona)");
+  console.log("  --name <name>         Override instance name");
+  console.log("  --force               Recreate VM even if it exists");
+  console.log("  --no-build            Skip build step");
   console.log("");
   console.log("Owner:");
   console.log("  owner add <address>     Add an owner");
@@ -225,36 +1624,35 @@ async function init(name) {
     process.exit(1);
   }
   const {
-    cpSync,
-    existsSync: existsSync2,
-    mkdirSync,
-    writeFileSync,
+    cpSync: cpSync2,
+    existsSync: existsSync7,
+    mkdirSync: mkdirSync2,
+    writeFileSync: writeFileSync2,
     readdirSync,
-    readFileSync
+    readFileSync: readFileSync2
   } = await import("fs");
-  const { createInterface } = await import("readline");
-  const templateDir = resolve(packageDir, "templates", "agent");
-  const targetDir = resolve(process.cwd(), name);
-  if (existsSync2(targetDir)) {
+  const templateDir = resolve2(packageDir, "templates", "agent");
+  const targetDir = resolve2(process.cwd(), name);
+  if (existsSync7(targetDir)) {
     console.error(`Error: Directory '${name}' already exists`);
     process.exit(1);
   }
   console.log(`
 \u{1F4E6} Creating agent: ${name}
 `);
-  cpSync(templateDir, targetDir, { recursive: true });
-  const pkgPath = resolve(targetDir, "package.json");
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+  cpSync2(templateDir, targetDir, { recursive: true });
+  const pkgPath = resolve2(targetDir, "package.json");
+  const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
   pkg.name = name;
-  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2));
-  const skillsDir = resolve(packageDir, "skills");
-  const targetSkillsDir = resolve(targetDir, "skills");
-  if (existsSync2(skillsDir)) {
+  writeFileSync2(pkgPath, JSON.stringify(pkg, null, 2));
+  const skillsDir = resolve2(packageDir, "skills");
+  const targetSkillsDir = resolve2(targetDir, "skills");
+  if (existsSync7(skillsDir)) {
     console.log("\u{1F4DA} Copying core skills...");
     const coreSkills = readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
-    mkdirSync(targetSkillsDir, { recursive: true });
+    mkdirSync2(targetSkillsDir, { recursive: true });
     for (const skill of coreSkills) {
-      cpSync(resolve(skillsDir, skill), resolve(targetSkillsDir, skill), {
+      cpSync2(resolve2(skillsDir, skill), resolve2(targetSkillsDir, skill), {
         recursive: true
       });
       console.log(`   \u2713 ${skill}`);
@@ -264,36 +1662,16 @@ async function init(name) {
     for (const skill of coreSkills) {
       lockfile[skill] = { source: "core", installedAt: now };
     }
-    writeFileSync(
-      resolve(targetDir, "skills-lock.json"),
+    writeFileSync2(
+      resolve2(targetDir, "skills-lock.json"),
       JSON.stringify(lockfile, null, 2)
     );
   }
-  const envExamplePath = resolve(targetDir, ".env.example");
-  const envPath = resolve(targetDir, ".env");
-  if (existsSync2(envExamplePath)) {
-    cpSync(envExamplePath, envPath);
+  const envExamplePath = resolve2(targetDir, ".env.example");
+  const envPath = resolve2(targetDir, ".env");
+  if (existsSync7(envExamplePath)) {
+    cpSync2(envExamplePath, envPath);
   }
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const question = (prompt) => {
-    return new Promise((resolve2) => {
-      rl.question(prompt, (answer) => {
-        resolve2(answer.trim());
-      });
-    });
-  };
-  const ownerAddress = await question("\nEnter your wallet address (owner): ");
-  console.log("\n\u{1F511} Generating wallet key...");
-  const { privateKeyToAccount } = await import("viem/accounts");
-  const { randomBytes } = await import("crypto");
-  const walletKey = `0x${randomBytes(32).toString("hex")}`;
-  const account = privateKeyToAccount(walletKey);
-  console.log(`   Address: ${account.address}`);
-  console.log(`   Key: ${walletKey.slice(0, 10)}...${walletKey.slice(-8)}`);
-  rl.close();
   const prompts = (await import("prompts")).default;
   const providerResponse = await prompts({
     type: "select",
@@ -326,22 +1704,28 @@ async function init(name) {
     });
     openrouterKey = keyResponse.key || "";
   }
+  const credentialsDir = resolve2(targetDir, "credentials");
+  mkdirSync2(credentialsDir, { recursive: true });
+  const acl = {
+    version: 1,
+    allowFrom: []
+  };
+  const ownerResponse = await prompts({
+    type: "text",
+    name: "address",
+    message: "Enter your wallet address (owner, optional)"
+  });
+  const ownerAddress = ownerResponse?.address?.trim() || "";
   if (ownerAddress) {
-    const normalized = ownerAddress.toLowerCase();
-    const credentialsDir = resolve(targetDir, "credentials");
-    mkdirSync(credentialsDir, { recursive: true });
-    writeFileSync(
-      resolve(credentialsDir, "xmtp-allowFrom.json"),
-      JSON.stringify({ version: 1, allowFrom: [normalized] }, null, 2)
-    );
+    acl.allowFrom.push(ownerAddress.toLowerCase());
     console.log(`
-\u2705 Added owner: ${normalized}`);
+\u2705 Added owner: ${ownerAddress.toLowerCase()}`);
   }
-  let envContent = readFileSync(envPath, "utf-8");
-  envContent = envContent.replace(
-    /AGENT_WALLET_KEY=.*/,
-    `AGENT_WALLET_KEY=${walletKey}`
+  writeFileSync2(
+    resolve2(credentialsDir, "allowFrom.json"),
+    JSON.stringify(acl, null, 2)
   );
+  let envContent = readFileSync2(envPath, "utf-8");
   if (anthropicKey) {
     envContent = envContent.replace(
       /ANTHROPIC_API_KEY=.*/,
@@ -370,7 +1754,7 @@ async function init(name) {
       (match) => `# ${match}`
     );
   }
-  writeFileSync(envPath, envContent);
+  writeFileSync2(envPath, envContent);
   console.log("\u2705 Updated .env file");
   console.log(`
 \u2705 Created agent at: ${name}/`);
@@ -382,30 +1766,30 @@ async function init(name) {
 async function build(target) {
   const { execSync } = await import("child_process");
   const {
-    cpSync,
-    existsSync: existsSync2,
-    mkdirSync,
-    rmSync,
-    writeFileSync,
+    cpSync: cpSync2,
+    existsSync: existsSync7,
+    mkdirSync: mkdirSync2,
+    rmSync: rmSync2,
+    writeFileSync: writeFileSync2,
     readdirSync,
-    readFileSync
+    readFileSync: readFileSync2
   } = await import("fs");
   const projectDir = projectRoot;
-  const distDir = resolve(projectDir, "dist");
-  const buildTarget = target || "fly";
+  const distDir = resolve2(projectDir, "dist");
+  const buildTarget = target || "firecracker";
   console.log("\n\u{1F527} Building agent...");
-  if (existsSync2(distDir)) {
-    rmSync(distDir, { recursive: true, force: true });
+  if (existsSync7(distDir)) {
+    rmSync2(distDir, { recursive: true, force: true });
   }
-  mkdirSync(distDir, { recursive: true });
-  mkdirSync(resolve(distDir, "server"), { recursive: true });
+  mkdirSync2(distDir, { recursive: true });
+  mkdirSync2(resolve2(distDir, "server"), { recursive: true });
   console.log("\u{1F4E6} Copying agent runtime...");
-  const agentDistDir = resolve(packageDir, "dist");
-  const files = ["server/index.cjs", "xmtp.cjs"];
+  const agentDistDir = resolve2(packageDir, "dist");
+  const files = ["server/index.cjs"];
   for (const file of files) {
-    const src = resolve(agentDistDir, file);
-    if (existsSync2(src)) {
-      cpSync(src, resolve(distDir, file));
+    const src = resolve2(agentDistDir, file);
+    if (existsSync7(src)) {
+      cpSync2(src, resolve2(distDir, file));
     } else {
       console.error(`  Missing: ${file} - run 'pnpm build' in hybrid package`);
     }
@@ -421,41 +1805,41 @@ async function build(target) {
     "HEARTBEAT.md",
     "USER.md"
   ]) {
-    const src = resolve(projectDir, file);
-    if (existsSync2(src)) {
-      cpSync(src, resolve(distDir, file));
+    const src = resolve2(projectDir, file);
+    if (existsSync7(src)) {
+      cpSync2(src, resolve2(distDir, file));
       console.log(`   \u2713 ${file}`);
     }
   }
-  const hybridConfig = resolve(projectDir, "hybrid.config.ts");
-  const openclawConfig = resolve(projectDir, "openclaw.json");
-  const agentConfig = resolve(projectDir, "agent.ts");
-  if (existsSync2(hybridConfig)) {
-    cpSync(hybridConfig, resolve(distDir, "hybrid.config.ts"));
+  const hybridConfig = resolve2(projectDir, "hybrid.config.ts");
+  const openclawConfig = resolve2(projectDir, "openclaw.json");
+  const agentConfig = resolve2(projectDir, "agent.ts");
+  if (existsSync7(hybridConfig)) {
+    cpSync2(hybridConfig, resolve2(distDir, "hybrid.config.ts"));
     console.log("   \u2713 hybrid.config.ts");
-  } else if (existsSync2(openclawConfig)) {
-    const content = readFileSync(openclawConfig, "utf-8");
-    writeFileSync(
-      resolve(projectDir, "hybrid.config.ts"),
+  } else if (existsSync7(openclawConfig)) {
+    const content = readFileSync2(openclawConfig, "utf-8");
+    writeFileSync2(
+      resolve2(projectDir, "hybrid.config.ts"),
       `// Migrated from openclaw.json
 export default ${content}`
     );
     console.log("   \u2713 Migrated openclaw.json \u2192 hybrid.config.ts");
-  } else if (existsSync2(agentConfig)) {
-    cpSync(agentConfig, resolve(distDir, "agent.ts"));
+  } else if (existsSync7(agentConfig)) {
+    cpSync2(agentConfig, resolve2(distDir, "agent.ts"));
     console.log("   \u2713 agent.ts (legacy)");
   }
-  const skillsDir = resolve(projectDir, "skills");
-  if (existsSync2(skillsDir)) {
+  const skillsDir = resolve2(projectDir, "skills");
+  if (existsSync7(skillsDir)) {
     const skills = readdirSync(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
     console.log(`\u{1F4DA} Skills: ${skills.length} in ./skills/`);
   } else {
     console.log("\u26A0\uFE0F  No ./skills/ directory found - run 'hybrid init' first?");
   }
-  const credsDir = resolve(projectDir, "credentials");
-  if (existsSync2(credsDir)) {
-    mkdirSync(resolve(distDir, "credentials"), { recursive: true });
-    cpSync(credsDir, resolve(distDir, "credentials"), { recursive: true });
+  const credsDir = resolve2(projectDir, "credentials");
+  if (existsSync7(credsDir)) {
+    mkdirSync2(resolve2(distDir, "credentials"), { recursive: true });
+    cpSync2(credsDir, resolve2(distDir, "credentials"), { recursive: true });
     console.log("   \u2713 credentials/");
   }
   const deployPkg = {
@@ -465,215 +1849,113 @@ export default ${content}`
     dependencies: {
       "@anthropic-ai/claude-agent-sdk": "^0.2.38",
       "@hono/node-server": "^1.13.5",
-      "@xmtp/agent-sdk": "0.0.14",
-      "@xmtp/node-bindings": "^1.9.1",
-      "@xmtp/node-sdk": "^4.1.0",
       ai: "^6.0.0",
       "better-sqlite3": "^11.0.0",
       dotenv: "^16.4.5",
       hono: "^4.10.8",
       "sql.js": "^1.11.0",
-      viem: "^2.46.2",
       zod: "^4.0.0"
     }
   };
-  writeFileSync(
-    resolve(distDir, "package.json"),
+  writeFileSync2(
+    resolve2(distDir, "package.json"),
     JSON.stringify(deployPkg, null, 2)
   );
-  writeFileSync(resolve(distDir, "Dockerfile"), generateDockerfile(buildTarget));
-  if (buildTarget === "fly") {
-    const projectFlyToml = resolve(projectDir, "fly.toml");
-    if (existsSync2(projectFlyToml)) {
-      cpSync(projectFlyToml, resolve(distDir, "fly.toml"));
-    } else {
-      writeFileSync(resolve(distDir, "fly.toml"), generateFlyToml());
-    }
-  }
-  writeFileSync(
-    resolve(distDir, "start.sh"),
+  writeFileSync2(resolve2(distDir, "Dockerfile"), generateDockerfile(distDir));
+  writeFileSync2(
+    resolve2(distDir, ".hybrid-deploy.json"),
+    JSON.stringify(
+      {
+        version: 1,
+        provider: "firecracker",
+        startCommand: "node server/index.cjs",
+        port: 8454,
+        healthPath: "/health"
+      },
+      null,
+      2
+    )
+  );
+  writeFileSync2(
+    resolve2(distDir, "start.sh"),
     `#!/bin/sh
-node server/index.cjs &
-node xmtp.cjs &
-wait
+node server/index.cjs
 `
   );
   console.log("\n\u2705 Build complete!");
   console.log(`   Output: ${distDir}`);
   console.log(`   Target: ${buildTarget}`);
 }
-function generateDockerfile(target) {
-  if (target === "fly" || target === "railway") {
-    return `FROM node:20
-
+function generateDockerfile(distDir) {
+  const configFiles = [
+    "SOUL.md",
+    "AGENTS.md",
+    "IDENTITY.md",
+    "TOOLS.md",
+    "BOOT.md",
+    "BOOTSTRAP.md",
+    "HEARTBEAT.md",
+    "USER.md"
+  ];
+  const present = configFiles.filter(
+    (f) => existsSync6(resolve2(distDir, f))
+  );
+  const hasCredentials = existsSync6(resolve2(distDir, "credentials"));
+  const configCopy = present.length > 0 ? `COPY ${present.join(" ")} ./` : "";
+  const credCopy = hasCredentials ? "COPY credentials/ ./credentials/" : "";
+  return `FROM node:20-bookworm-slim
 WORKDIR /app
-
-# Copy built agent runtime
-COPY server/ ./server/
-COPY xmtp.cjs ./
-
-# Copy config
-COPY SOUL.md ./
-COPY AGENTS.md ./
-COPY IDENTITY.md ./
-COPY TOOLS.md ./
-COPY BOOTSTRAP.md ./
-COPY HEARTBEAT.md ./
-COPY USER.md ./
-
-# Copy credentials (owner ACL)
-COPY credentials/ ./credentials/
-
-# Copy deployment files
 COPY package.json ./
-COPY start.sh ./
-
-# Install dependencies
 RUN npm install --production
-
-# Create data directories and set ownership
-RUN mkdir -p /app/data/xmtp && \\
-    chown -R node:node /app
-
+COPY server/ ./server/
+${configCopy}
+${credCopy}
 ENV AGENT_PORT=8454
 ENV NODE_ENV=production
+ENV DATA_ROOT=/app/data
 EXPOSE 8454
-
 USER node
-CMD ["sh", "start.sh"]
-`;
-  }
-  return `FROM node:20
-WORKDIR /app
-COPY . ./
-RUN npm install --production
-RUN chown -R node:node /app
-USER node
-CMD ["sh", "start.sh"]
-`;
-}
-function generateFlyToml(appName = "hybrid-agent") {
-  return `# Generated by hybrid build
-app = "${appName}"
-primary_region = "iad"
-
-[build]
-  dockerfile = "Dockerfile"
-  context = "."
-
-[deployment]
-  min_machines = 1
-  max_machines = 1
-
-[env]
-  XMTP_ENV = "production"
-
-[[services]]
-  protocol = "tcp"
-  internal_port = 8454
-
-  [[services.ports]]
-    port = 80
-    handlers = ["http"]
-    force_https = true
-
-  [[services.ports]]
-    port = 443
-    handlers = ["tls", "http"]
-
-[vm]
-  memory = "1gb"
-  cpu_kind = "shared"
-  cpus = 1
+CMD ["node", "server/index.cjs"]
 `;
 }
 async function dev(useDocker) {
   const { execSync } = await import("child_process");
-  const { existsSync: existsSync2, readFileSync } = await import("fs");
-  const { privateKeyToAccount } = await import("viem/accounts");
   if (useDocker) {
     console.log("\n\u{1F433} Docker dev not yet implemented for new structure");
     console.log("Use 'hybrid dev' without --docker for now");
     return;
   }
   const projectDir = projectRoot;
-  const walletKey = process.env.AGENT_WALLET_KEY || process.env.WALLET_KEY;
-  if (walletKey) {
-    const walletKeyFormatted = walletKey.startsWith("0x") ? walletKey : `0x${walletKey}`;
-    const account = privateKeyToAccount(walletKeyFormatted);
-    console.log(`
-\u{1F50D} Checking XMTP registration for ${account.address}...`);
-    try {
-      const result = execSync(
-        `npx tsx -e "
-import { createSigner, createXMTPClient } from './src/client';
-const signer = createSigner('${walletKeyFormatted}');
-const client = await createXMTPClient(signer, { env: 'production' });
-console.log('REGISTERED:', client.inboxId);
-process.exit(0);
-"`,
-        {
-          cwd: resolve(packageDir, "..", "xmtp"),
-          encoding: "utf-8",
-          stdio: ["pipe", "pipe", "pipe"]
-        }
-      );
-      if (result.includes("REGISTERED:")) {
-        const inboxId = result.match(/REGISTERED: (.+)/)?.[1];
-        console.log(`   \u2705 Already registered (inbox: ${inboxId})`);
-      }
-    } catch (err) {
-      const output = err.stdout || err.stderr || "";
-      if (output.includes("not registered") || output.includes("No inbox found") || output.includes("incomplete identity") || err.exitCode) {
-        console.log("   \u274C Not registered");
-        console.log("\n\u{1F4DD} Registering agent on XMTP...");
-        execSync("npx pnpm --filter @hybrd/xmtp register", {
-          cwd: resolve(packageDir, "..", ".."),
-          stdio: "inherit",
-          env: { ...process.env, AGENT_WALLET_KEY: walletKey }
-        });
-      }
-    }
-  }
-  const agentServer = resolve(packageDir, "dist", "server", "index.cjs");
-  const agentXmtp = resolve(packageDir, "dist", "xmtp.cjs");
+  const agentServer = resolve2(packageDir, "dist", "server", "index.cjs");
   console.log("\n\u{1F680} Starting development server...\n");
   console.log(`   Project: ${projectDir}`);
   console.log(`   Runtime: ${packageDir}
 `);
   try {
-    execSync(
-      `npx concurrently --names "server,xmtp" --prefix-colors "cyan,magenta" "node ${agentServer}" "node ${agentXmtp}"`,
-      {
-        cwd: projectDir,
-        stdio: "inherit",
-        env: {
-          ...process.env,
-          AGENT_PROJECT_ROOT: projectDir
-        }
+    execSync(`node ${agentServer}`, {
+      cwd: projectDir,
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        AGENT_PROJECT_ROOT: projectDir
       }
-    );
+    });
   } catch {
     console.error("\n\u274C Failed to start dev server");
     process.exit(1);
   }
 }
 async function start() {
-  const { spawn } = await import("child_process");
-  const { existsSync: existsSync2 } = await import("fs");
+  const { spawn: spawn4 } = await import("child_process");
+  const { existsSync: existsSync7 } = await import("fs");
   const projectDir = projectRoot;
-  const distDir = resolve(projectDir, "dist");
-  if (!existsSync2(resolve(distDir, "server", "simple.cjs"))) {
+  const distDir = resolve2(projectDir, "dist");
+  if (!existsSync7(resolve2(distDir, "server", "simple.cjs"))) {
     console.error("Error: No build found. Run 'hybrid build' first.");
     process.exit(1);
   }
   console.log("\n\u{1F680} Starting agent from ./dist/...\n");
-  const server = spawn("node", [resolve(distDir, "server", "simple.cjs")], {
-    cwd: projectDir,
-    stdio: "inherit",
-    env: { ...process.env, AGENT_PROJECT_ROOT: projectDir }
-  });
-  const xmtp = spawn("node", [resolve(distDir, "xmtp.cjs")], {
+  const server = spawn4("node", [resolve2(distDir, "server", "simple.cjs")], {
     cwd: projectDir,
     stdio: "inherit",
     env: { ...process.env, AGENT_PROJECT_ROOT: projectDir }
@@ -682,395 +1964,188 @@ async function start() {
     if (code !== 0 && code !== null) process.exit(code);
   };
   server.on("exit", exitHandler);
-  xmtp.on("exit", exitHandler);
   process.on("SIGINT", () => {
     server.kill("SIGINT");
-    xmtp.kill("SIGINT");
     process.exit(0);
   });
 }
-async function deploy(platform, keygen2 = false) {
-  const { spawn, execSync } = await import("child_process");
-  const { existsSync: existsSync2, readFileSync, writeFileSync } = await import("fs");
-  const prompts = (await import("prompts")).default;
-  const { privateKeyToAccount } = await import("viem/accounts");
-  const { randomBytes } = await import("crypto");
-  const projectDir = projectRoot;
-  const distDir = resolve(projectDir, "dist");
-  let deployPlatform = platform;
-  if (!deployPlatform) {
-    const hybridConfig = resolve(projectDir, "hybrid.config.ts");
-    if (existsSync2(hybridConfig)) {
-      const configContent = readFileSync(hybridConfig, "utf-8");
-      const match = configContent.match(
-        /deployPlatform\s*[=:]\s*["']([^"']+)["']/
-      );
-      if (match) {
-        deployPlatform = match[1];
-        console.log(`   Using saved platform: ${deployPlatform}`);
-      }
-    }
+var deployModule = null;
+async function loadDeploy() {
+  if (!deployModule) {
+    deployModule = await Promise.resolve().then(() => (init_deploy2(), deploy_exports));
   }
-  if (!deployPlatform) {
-    const choice = await prompts({
-      type: "select",
-      name: "platform",
-      message: "Where do you want to deploy?",
-      choices: [
-        { title: "Fly.io", value: "fly" },
-        { title: "Railway", value: "railway" }
-      ],
-      initial: 0
-    });
-    if (!choice.platform) {
-      console.log("\n  Cancelled.\n");
-      process.exit(0);
-    }
-    deployPlatform = choice.platform;
-    const hybridConfig = resolve(projectDir, "hybrid.config.ts");
-    let configContent = "";
-    if (existsSync2(hybridConfig)) {
-      configContent = readFileSync(hybridConfig, "utf-8");
-    }
-    if (!configContent.includes("deployPlatform")) {
-      const newContent = configContent ? configContent.replace(
-        /export default/,
-        `const deployPlatform = "${deployPlatform}"
-
-export default`
-      ) : `const deployPlatform = "${deployPlatform}"
-
-export default {}`;
-      writeFileSync(hybridConfig, newContent);
+  return deployModule;
+}
+function parseDeployArgs(args) {
+  const skipSet = /* @__PURE__ */ new Set();
+  const valuedFlags = /* @__PURE__ */ new Set([
+    "--provider",
+    "-p",
+    "--name",
+    "-n"
+  ]);
+  for (let i = 0; i < args.length; i++) {
+    if (valuedFlags.has(args[i])) {
+      skipSet.add(i);
+      skipSet.add(i + 1);
     }
   }
-  const flyTomlPath = resolve(distDir, "fly.toml");
-  const projectFlyToml = resolve(projectDir, "fly.toml");
-  const projectName = basename(projectDir);
-  let appName = projectName;
-  if (existsSync2(projectFlyToml)) {
-    const flyToml = readFileSync(projectFlyToml, "utf-8");
-    const match = flyToml.match(/^app\s*=\s*["']([^"']+)["']/m);
-    if (match) appName = match[1];
-  } else {
-    const result = await prompts({
-      type: "text",
-      name: "appName",
-      message: "App name:",
-      initial: projectName
-    });
-    if (result.appName) appName = result.appName;
-  }
-  let walletKey = process.env.AGENT_WALLET_KEY || process.env.WALLET_KEY;
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(appName)) {
-    console.error(`
-\u274C Invalid app name: ${appName}`);
-    console.error("App name must start with a letter/digit and contain only letters, digits, hyphens, and underscores.");
-    process.exit(1);
-  }
-  const { execFileSync } = await import("child_process");
-  let appExists = false;
-  try {
-    execFileSync("fly", ["status", "--app", appName], { stdio: "pipe" });
-    appExists = true;
-  } catch {
+  const providerIdx = args.indexOf("--provider");
+  const providerAltIdx = args.indexOf("-p");
+  const nameIdx = args.indexOf("--name");
+  const nameAltIdx = args.indexOf("-n");
+  const providerFlag = (providerIdx !== -1 ? args[providerIdx + 1] : void 0) || (providerAltIdx !== -1 ? args[providerAltIdx + 1] : void 0);
+  const nameFlag = (nameIdx !== -1 ? args[nameIdx + 1] : void 0) || (nameAltIdx !== -1 ? args[nameAltIdx + 1] : void 0);
+  const name = args.find(
+    (a, i) => i > 1 && !a.startsWith("--") && !a.startsWith("-") && !skipSet.has(i) && a !== "deploy" && a !== "sleep" && a !== "wake" && a !== "status" && a !== "logs" && a !== "teardown" && a !== providerFlag && a !== nameFlag
+  );
+  const skipBuild = args.includes("--no-build");
+  const force = args.includes("--force");
+  const follow = !args.includes("--no-follow");
+  return {
+    platform: providerFlag,
+    name: name || nameFlag,
+    skipBuild,
+    force,
+    follow
+  };
+}
+async function deployCommand(args) {
+  const sub = args[1];
+  const knownProviders = /* @__PURE__ */ new Set([
+    "sprites",
+    "e2b",
+    "daytona",
+    "northflank"
+  ]);
+  const isPlatform = sub && !sub.startsWith("-") && knownProviders.has(sub);
+  if (!sub || sub.startsWith("-") || isPlatform) {
+    const flags = parseDeployArgs(args);
+    const { runDeploy: runDeploy2 } = await loadDeploy();
+    await runDeploy2(
+      {
+        platform: flags.platform || (isPlatform ? sub : void 0),
+        name: flags.name,
+        skipBuild: flags.skipBuild,
+        force: flags.force
+      },
+      projectRoot,
+      packageDir
+    );
+    return;
   }
-  let openRouterKey = process.env.OPENROUTER_API_KEY;
-  if (!appExists) {
-    if (!walletKey || keygen2) {
-      if (keygen2) {
-        console.log("\n\u{1F510} Generating new wallet key...");
-      } else {
-        console.log("\n\u{1F510} No AGENT_WALLET_KEY found. Generating new wallet...");
+  const pIdx = args.indexOf("--provider");
+  const pAlt = args.indexOf("-p");
+  const nIdx = args.indexOf("--name");
+  const nAlt = args.indexOf("-n");
+  const subPlatform = (pIdx !== -1 ? args[pIdx + 1] : void 0) || (pAlt !== -1 ? args[pAlt + 1] : void 0);
+  const subSkipIdx = /* @__PURE__ */ new Set();
+  subSkipIdx.add(pIdx);
+  subSkipIdx.add(pAlt);
+  subSkipIdx.add(nIdx);
+  subSkipIdx.add(nAlt);
+  if (pIdx !== -1) subSkipIdx.add(pIdx + 1);
+  if (pAlt !== -1) subSkipIdx.add(pAlt + 1);
+  if (nIdx !== -1) subSkipIdx.add(nIdx + 1);
+  if (nAlt !== -1) subSkipIdx.add(nAlt + 1);
+  const name = args.find(
+    (a, i) => i > 1 && !a.startsWith("-") && !subSkipIdx.has(i)
+  );
+  switch (sub) {
+    case "sleep": {
+      if (!name) {
+        console.error("Usage: hybrid deploy sleep <name>");
+        process.exit(1);
       }
-      walletKey = await generateVanityWallet(
-        "",
-        privateKeyToAccount,
-        randomBytes
-      );
-      const account = privateKeyToAccount(walletKey);
-      console.log(`\u2705 Wallet: ${account.address}
-`);
+      const { runSleep: runSleep2 } = await loadDeploy();
+      await runSleep2(name, subPlatform, projectRoot);
+      break;
     }
-    if (!openRouterKey) {
-      console.log("\u{1F511} No OPENROUTER_API_KEY found.");
-      while (true) {
-        const result = await prompts({
-          type: "password",
-          name: "key",
-          message: "Paste OpenRouter API key:"
-        });
-        const key = result.key?.trim();
-        if (key && key.length > 0) {
-          openRouterKey = key;
-          break;
-        }
-        console.log("   OpenRouter API key is required. Please enter a value.");
+    case "wake": {
+      if (!name) {
+        console.error("Usage: hybrid deploy wake <name>");
+        process.exit(1);
       }
+      const { runWake: runWake2 } = await loadDeploy();
+      await runWake2(name, subPlatform, projectRoot);
+      break;
     }
-    const aclPath = resolve(projectDir, "credentials", "xmtp-allowFrom.json");
-    if (!existsSync2(aclPath)) {
-      const result = await prompts({
-        type: "text",
-        name: "owner",
-        message: "Your wallet address (owner):",
-        validate: (v) => /^0x[a-fA-F0-9]{40}$/.test(v) || "Enter a valid Ethereum address (0x...)"
-      });
-      if (result.owner) {
-        const { mkdirSync } = await import("fs");
-        mkdirSync(resolve(projectDir, "credentials"), { recursive: true });
-        writeFileSync(
-          aclPath,
-          JSON.stringify(
-            { version: 1, allowFrom: [result.owner.toLowerCase()] },
-            null,
-            "	"
-          )
-        );
-        console.log(`\u2705 Owner set: ${result.owner}
-`);
+    case "status": {
+      if (!name) {
+        console.error("Usage: hybrid deploy status <name>");
+        process.exit(1);
       }
+      const { runStatus: runStatus2 } = await loadDeploy();
+      await runStatus2(name, subPlatform, projectRoot);
+      break;
     }
-  }
-  await build(deployPlatform);
-  if (deployPlatform === "fly") {
-    console.log("\n\u{1F680} Deploying to Fly.io...");
-    if (existsSync2(projectFlyToml)) {
-      const { cpSync } = await import("fs");
-      cpSync(projectFlyToml, resolve(distDir, "fly.toml"));
-    } else {
-      const { writeFileSync: writeFileSync2 } = await import("fs");
-      const flyTomlContent = generateFlyToml(appName);
-      writeFileSync2(resolve(distDir, "fly.toml"), flyTomlContent);
-    }
-    if (!appExists) {
-      console.log(`\u{1F4E6} Creating Fly.io app: ${appName}`);
-      try {
-        execFileSync("fly", ["apps", "create", appName], {
-          cwd: distDir,
-          stdio: "inherit"
-        });
-      } catch {
-        console.log(`   App may already exist, continuing...`);
+    case "logs": {
+      if (!name) {
+        console.error("Usage: hybrid deploy logs <name>");
+        process.exit(1);
       }
+      const follow = !args.includes("--no-follow");
+      const { runLogs: runLogs2 } = await loadDeploy();
+      await runLogs2(name, follow, subPlatform, projectRoot);
+      break;
     }
-    await new Promise((resolve2, reject) => {
-      const deploy2 = spawn("fly", ["deploy", "--config", "fly.toml"], {
-        cwd: distDir,
-        stdio: "inherit"
-      });
-      deploy2.on(
-        "error",
-        (err) => reject(new Error(`Deploy failed: ${err.message}`))
-      );
-      deploy2.on(
-        "close",
-        (code) => code === 0 ? resolve2() : reject(new Error(`Exit ${code}`))
-      );
-    });
-    if (walletKey) {
-      console.log("\n\u{1F510} Setting wallet key as secret...");
-      try {
-        execFileSync(
-          "fly",
-          ["secrets", "set", `AGENT_WALLET_KEY=${walletKey}`, "--app", appName],
-          {
-            cwd: distDir,
-            stdio: "inherit"
-          }
-        );
-      } catch (e) {
-        console.log("   \u26A0\uFE0F  Could not set secret, skipping...");
+    case "teardown": {
+      if (!name) {
+        console.error("Usage: hybrid deploy teardown <name>");
+        process.exit(1);
       }
+      const { runTeardown: runTeardown2 } = await loadDeploy();
+      await runTeardown2(name, subPlatform, projectRoot);
+      break;
     }
-    if (openRouterKey) {
-      console.log("\n\u{1F511} Setting OpenRouter key as secret...");
-      try {
-        execFileSync(
-          "fly",
-          ["secrets", "set", `OPENROUTER_API_KEY=${openRouterKey}`, "--app", appName],
-          {
-            cwd: distDir,
-            stdio: "inherit"
-          }
-        );
-      } catch (e) {
-        console.log("   \u26A0\uFE0F  Could not set secret, skipping...");
-      }
-    }
-    console.log("\n\u2705 Deployed!");
-    console.log(`   Dashboard: https://fly.io/apps/${appName}`);
-    if (!existsSync2(projectFlyToml)) {
-      const { cpSync } = await import("fs");
-      cpSync(resolve(distDir, "fly.toml"), projectFlyToml);
-      console.log(`   Saved fly.toml to project`);
-    }
-    return;
-  }
-  if (deployPlatform === "railway") {
-    console.log("\n\u{1F682} Railway deployment not yet implemented.");
-    console.log("   See https://railway.app for manual deployment.");
-    process.exit(1);
+    default:
+      console.error(`Unknown deploy subcommand: ${sub}`);
+      printDeployHelp();
+      process.exit(1);
   }
-  console.error(`Unknown platform: ${deployPlatform}`);
-  console.error("Supported: fly, railway");
-  process.exit(1);
 }
-async function keygen(prefix) {
-  if (prefix === "-h" || prefix === "--help") {
-    console.log("\nUsage: hybrid keygen [prefix]");
-    console.log("\nGenerate a new wallet key.");
-    console.log(
-      "  prefix    Optional hex prefix for vanity address (max 6 chars)\n"
-    );
-    return;
-  }
-  const { privateKeyToAccount } = await import("viem/accounts");
-  const { randomBytes } = await import("crypto");
-  const targetPrefix = prefix?.toLowerCase() || "";
-  if (targetPrefix && !/^[0-9a-f]+$/.test(targetPrefix)) {
-    console.error("\n\u274C Prefix must be hex characters (0-9, a-f)");
-    process.exit(1);
-  }
-  if (targetPrefix.length > 6) {
-    console.error("\n\u274C Prefix too long (max 6 characters)");
-    process.exit(1);
-  }
-  console.log("\n\u{1F511} Generating wallet...");
-  if (targetPrefix) console.log(`   Looking for 0x${targetPrefix}...`);
-  const walletKey = await generateVanityWallet(
-    targetPrefix,
-    privateKeyToAccount,
-    randomBytes
+function printDeployHelp() {
+  console.error("");
+  console.error("Usage: hybrid deploy <subcommand>");
+  console.error("");
+  console.error("Commands:");
+  console.error(
+    "  deploy [platform]             Deploy to a Firecracker provider"
   );
-  const account = privateKeyToAccount(walletKey);
-  console.log(`
-\u2705 Wallet generated!`);
-  console.log(`   Address: ${account.address}`);
-  console.log(`   Private key: ${walletKey}
-`);
-  console.log("\u26A0\uFE0F  Save this key securely!");
-  console.log(`   Add to .env: AGENT_WALLET_KEY=${walletKey}
-`);
-}
-async function generateVanityWallet(prefix, privateKeyToAccount, randomBytes) {
-  let attempts = 0;
-  const max = prefix ? 1e6 : 1;
-  while (attempts < max) {
-    attempts++;
-    const key = `0x${randomBytes(32).toString("hex")}`;
-    if (!prefix) return key;
-    const { address } = privateKeyToAccount(key);
-    if (address.toLowerCase().startsWith(`0x${prefix}`)) {
-      console.log(`   Found in ${attempts} attempts!`);
-      return key;
-    }
-    if (attempts % 1e3 === 0) {
-      process.stdout.write(
-        `\r   Searching${".".repeat(attempts / 1e3 % 4)}${" ".repeat(3)}${attempts}\r`
-      );
-    }
-  }
-  throw new Error(`No vanity address found after ${max} attempts`);
-}
-async function register() {
-  const { execSync } = await import("child_process");
-  const { existsSync: existsSync2, readFileSync } = await import("fs");
-  const { join } = await import("path");
-  const { privateKeyToAccount } = await import("viem/accounts");
-  const walletKey = process.env.AGENT_WALLET_KEY || process.env.WALLET_KEY;
-  if (!walletKey) {
-    console.error("\n\u274C Set AGENT_WALLET_KEY first");
-    process.exit(1);
-  }
-  const account = privateKeyToAccount(
-    walletKey.startsWith("0x") ? walletKey : `0x${walletKey}`
+  console.error("  deploy sleep <name>            Put VM to sleep");
+  console.error("  deploy wake <name>             Wake VM");
+  console.error("  deploy status <name>           Show VM status");
+  console.error("  deploy logs <name>             Stream agent logs");
+  console.error("  deploy teardown <name> [--all] Destroy VM");
+  console.error("");
+  console.error(
+    "Flags: --provider <name>  --name <name>  --force  --no-build  --no-follow"
   );
-  const projectDir = projectRoot;
-  const aclPath = join(projectDir, "credentials", "xmtp-allowFrom.json");
-  if (!existsSync2(aclPath)) {
-    console.error("\n\u274C No credentials/xmtp-allowFrom.json");
-    console.error("Run 'hybrid init' first");
-    process.exit(1);
-  }
-  try {
-    const acl = JSON.parse(readFileSync(aclPath, "utf-8"));
-    if (!acl.allowFrom?.length) {
-      console.error("\n\u274C No owners in ACL");
-      process.exit(1);
-    }
-  } catch {
-    console.error("\n\u274C Invalid credentials/xmtp-allowFrom.json");
-    process.exit(1);
-  }
-  console.log(`
-\u{1F510} Registering ${account.address} on XMTP...`);
-  try {
-    execSync("npx pnpm --filter @hybrd/xmtp register", {
-      cwd: resolve(packageDir, "..", ".."),
-      stdio: "inherit",
-      env: { ...process.env, AGENT_WALLET_KEY: walletKey }
-    });
-  } catch {
-    console.error("\n\u274C Registration failed");
-    process.exit(1);
-  }
-}
-async function revoke(inboxId) {
-  const { execSync } = await import("child_process");
-  if (!inboxId) {
-    console.log("\nUsage: hybrid revoke <inboxId>");
-    console.log("Or use: hybrid revoke-all\n");
-    process.exit(1);
-  }
-  console.log("\n\u{1F504} Revoking XMTP installations...\n");
-  try {
-    execSync(`npx pnpm --filter @hybrd/xmtp revoke ${inboxId}`, {
-      cwd: resolve(packageDir, "..", ".."),
-      stdio: "inherit"
-    });
-  } catch {
-    console.log("\n\u274C Revoke failed. Check AGENT_WALLET_KEY");
-    process.exit(1);
-  }
-}
-async function revokeAll() {
-  const { execSync } = await import("child_process");
-  console.log("\n\u{1F504} Revoking all XMTP installations...\n");
-  try {
-    execSync("npx pnpm --filter @hybrd/xmtp revoke-all", {
-      cwd: resolve(packageDir, "..", ".."),
-      stdio: "inherit"
-    });
-  } catch {
-    console.log("\n\u274C Revoke failed. Check AGENT_WALLET_KEY");
-    process.exit(1);
-  }
 }
 async function ownerAdd(address) {
-  const { join } = await import("path");
-  const { existsSync: existsSync2, mkdirSync, writeFileSync, readFileSync } = await import("fs");
+  const { join: join5 } = await import("path");
+  const { existsSync: existsSync7, mkdirSync: mkdirSync2, writeFileSync: writeFileSync2, readFileSync: readFileSync2 } = await import("fs");
   if (!address) {
     console.error("Usage: hybrid owner add <address>");
     process.exit(1);
   }
   const projectDir = projectRoot;
-  const aclPath = join(projectDir, "credentials", "xmtp-allowFrom.json");
+  const aclPath = join5(projectDir, "credentials", "allowFrom.json");
   const normalized = address.toLowerCase().trim();
-  mkdirSync(join(projectDir, "credentials"), { recursive: true });
+  mkdirSync2(join5(projectDir, "credentials"), { recursive: true });
   let acl = {
     version: 1,
     allowFrom: []
   };
-  if (existsSync2(aclPath)) {
+  if (existsSync7(aclPath)) {
     try {
-      acl = JSON.parse(readFileSync(aclPath, "utf-8"));
+      acl = JSON.parse(readFileSync2(aclPath, "utf-8"));
     } catch {
     }
   }
   if (!acl.allowFrom.includes(normalized)) {
     acl.allowFrom.push(normalized);
-    writeFileSync(aclPath, JSON.stringify(acl, null, "	"));
+    writeFileSync2(aclPath, JSON.stringify(acl, null, "	"));
     console.log(`
 \u2705 Added owner: ${normalized}`);
   } else {
@@ -1082,20 +2157,20 @@ async function ownerAdd(address) {
   for (const owner of acl.allowFrom) console.log(`  - ${owner}`);
 }
 async function ownerRemove(address) {
-  const { join } = await import("path");
-  const { existsSync: existsSync2, writeFileSync, readFileSync } = await import("fs");
+  const { join: join5 } = await import("path");
+  const { existsSync: existsSync7, writeFileSync: writeFileSync2, readFileSync: readFileSync2 } = await import("fs");
   if (!address) {
     console.error("Usage: hybrid owner remove <address>");
     process.exit(1);
   }
   const projectDir = projectRoot;
-  const aclPath = join(projectDir, "credentials", "xmtp-allowFrom.json");
-  if (!existsSync2(aclPath)) {
-    console.error("No ACL file. Run 'hybrid register' first.");
+  const aclPath = join5(projectDir, "credentials", "allowFrom.json");
+  if (!existsSync7(aclPath)) {
+    console.error("No ACL file. Run 'hybrid init' first.");
     process.exit(1);
   }
   const acl = JSON.parse(
-    readFileSync(aclPath, "utf-8")
+    readFileSync2(aclPath, "utf-8")
   );
   const normalized = address.toLowerCase().trim();
   const index = acl.allowFrom.indexOf(normalized);
@@ -1105,7 +2180,7 @@ async function ownerRemove(address) {
     process.exit(1);
   }
   acl.allowFrom.splice(index, 1);
-  writeFileSync(aclPath, JSON.stringify(acl, null, "	"));
+  writeFileSync2(aclPath, JSON.stringify(acl, null, "	"));
   console.log(`
 \u2705 Removed owner: ${normalized}`);
   if (acl.allowFrom.length > 0) {
@@ -1117,17 +2192,17 @@ async function ownerRemove(address) {
   }
 }
 async function ownerList() {
-  const { join } = await import("path");
-  const { existsSync: existsSync2, readFileSync } = await import("fs");
+  const { join: join5 } = await import("path");
+  const { existsSync: existsSync7, readFileSync: readFileSync2 } = await import("fs");
   const projectDir = projectRoot;
-  const aclPath = join(projectDir, "credentials", "xmtp-allowFrom.json");
-  if (!existsSync2(aclPath)) {
-    console.log("\n\u26A0\uFE0F  No ACL file. Run 'hybrid register' first.");
+  const aclPath = join5(projectDir, "credentials", "allowFrom.json");
+  if (!existsSync7(aclPath)) {
+    console.log("\n\u26A0\uFE0F  No ACL file. Run 'hybrid init' first.");
     console.log("\n  Agent is open to all users.");
     return;
   }
   const acl = JSON.parse(
-    readFileSync(aclPath, "utf-8")
+    readFileSync2(aclPath, "utf-8")
   );
   if (acl.allowFrom.length === 0) {
     console.log("\n\u{1F4CB} No owners. Agent is open to all users.");