@django-stack/cli 0.0.1 → 0.2.0

package/dist/bin.js

@@ -1,5 +1,2285 @@
 #!/usr/bin/env node
-import { VERSION } from "./index.js";
+import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as toProjectName, a as decodePreset, b as CLI_VERSION, c as resolvePreset, d as LOCAL_S3, f as lockBackend, g as timeZones, h as scaffold, i as applies, l as stackOption, m as relativeDirectory, n as NAMED_PRESETS, o as encodePreset, r as STACK_OPTIONS, s as pendingChoices, t as DEFAULT_STACK, v as validateProjectName, w as generateSecret, x as productionEnv, y as validateTimeZone } from "./stack-CTyqYWCV.js";
+import { createRequire } from "node:module";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import pc from "picocolors";
+import tab from "@bomb.sh/tab/commander";
+import * as p from "@clack/prompts";
+import { Command, InvalidArgumentError, Option } from "commander";
+import { homedir } from "node:os";
+// src/deploy/coolify.ts
+/**
+* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
+* token. The project deploys as a Docker Compose application that Coolify
+* builds on the server from the git repository; Coolify's proxy gets the
+* certificate and forwards to the `proxy` service (Caddy) on port 80.
+*/
+/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
+const PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	TRUSTED_PROXIES: "private_ranges",
+	NUM_PROXIES: "2",
+	HTTP_PORT: "127.0.0.1:8080",
+	HTTPS_PORT: "127.0.0.1:8443"
+};
+var CoolifyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var CoolifyApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
+				method,
+				headers: {
+					Authorization: `Bearer ${this.token}`,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new CoolifyError(errorMessage(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (path) => this.request("GET", path);
+	post = (path, body) => this.request("POST", path, body ?? {});
+	patch = (path, body) => this.request("PATCH", path, body);
+};
+function errorMessage(status, text, url) {
+	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? "";
+		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+const enc = encodeURIComponent;
+function deploymentStatus(value) {
+	if (value === "queued") return "queued";
+	if (value === "in_progress") return "building";
+	if (value === "finished") return "finished";
+	if (value.startsWith("cancelled")) return "cancelled";
+	return "failed";
+}
+function appState(value) {
+	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
+	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
+	if (state === "degraded" || state === "restarting") return "degraded";
+	if (state === "exited" || state === "stopped") return "stopped";
+	return "unknown";
+}
+/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
+function parseLog(logs) {
+	if (!logs) return [];
+	let entries;
+	try {
+		entries = JSON.parse(logs);
+	} catch {
+		return logs.split("\n").map((text) => ({
+			text,
+			stderr: false
+		}));
+	}
+	if (!Array.isArray(entries)) return [];
+	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
+		text,
+		stderr: entry.type === "stderr"
+	})));
+}
+/** The domains of a Compose application, by service. */
+function composeDomains(app) {
+	let value = app.docker_compose_domains;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		value = null;
+	}
+	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
+	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
+	return domains.map((domain) => domain.replace(/:\d+$/, ""));
+}
+function appUrl(api, link) {
+	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
+}
+function toDeployment(api, link, item) {
+	const path = item.deployment_url;
+	return {
+		id: item.deployment_uuid,
+		status: deploymentStatus(item.status),
+		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
+		message: item.commit_message?.split("\n")[0] || void 0,
+		createdAt: item.created_at,
+		updatedAt: item.updated_at,
+		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
+		log: parseLog(item.logs)
+	};
+}
+/** Finds a name or uuid in a list. */
+function find(items, wanted) {
+	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+}
+var CoolifyClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new CoolifyApi(url, token, fetchImpl);
+	}
+	async verify() {
+		const version = await this.api.get("/version");
+		await this.api.get("/servers");
+		return String(version).trim();
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		const api = this.api;
+		const servers = await api.get("/servers");
+		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
+		let server;
+		if (options.server) {
+			server = find(servers, options.server);
+			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
+		} else if (servers.length === 1) server = servers[0];
+		else server = find(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+			value: item.uuid,
+			label: item.name,
+			hint: item.ip
+		}))));
+		if (!server) throw new Error("No server chosen.");
+		const projects = await api.get("/projects");
+		let project;
+		const projectName = options.project ?? context.name;
+		project = find(projects, projectName);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const uuid = await ask.select("Coolify project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.uuid,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.uuid ?? NEW);
+			project = uuid === NEW ? void 0 : find(projects, uuid);
+		}
+		if (!project) {
+			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
+			project = {
+				uuid: (await api.post("/projects", {
+					name: projectName,
+					description: "DjangoStack"
+				})).uuid,
+				name: projectName
+			};
+			ask.step(`Created the Coolify project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		if (!environment) {
+			environment = {
+				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let githubApp;
+		if (options.githubApp && options.githubApp !== "public") {
+			const app = find(await api.get("/github-apps"), options.githubApp);
+			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
+			githubApp = app.uuid;
+		} else if (!options.githubApp && ask.interactive) {
+			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
+			if (apps.length) {
+				const choice = await ask.select("How Coolify gets the code", [{
+					value: "public",
+					label: "Public repository",
+					hint: "no access needed"
+				}, ...apps.map((app) => ({
+					value: app.uuid,
+					label: `GitHub App ${app.name}`,
+					hint: "private repository"
+				}))], "public");
+				githubApp = choice === "public" ? void 0 : choice;
+			}
+		}
+		const body = {
+			project_uuid: project.uuid,
+			server_uuid: server.uuid,
+			environment_uuid: environment.uuid,
+			git_repository: context.repository,
+			git_branch: context.branch,
+			build_pack: "dockercompose",
+			docker_compose_location: "/compose.yaml",
+			docker_compose_domains: [{
+				name: "proxy",
+				domain: `https://${context.domain}:80`
+			}],
+			name: context.name,
+			description: "DjangoStack",
+			instant_deploy: false,
+			...githubApp ? { github_app_uuid: githubApp } : {}
+		};
+		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
+		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
+		const link = {
+			provider: "coolify",
+			url: api.url,
+			project: project.uuid,
+			environment: environment.uuid,
+			application: created.uuid
+		};
+		await this.pushEnv(link, context.env);
+		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
+		return {
+			project: link.project,
+			environment: link.environment,
+			application: link.application
+		};
+	}
+	async pushEnv(link, env) {
+		const data = Object.entries(env).map(([key, value]) => ({
+			key,
+			value,
+			is_literal: true,
+			is_preview: false
+		}));
+		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
+	}
+	async deploy(link, options) {
+		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
+		const result = await this.api.post(`/deploy?${query}`);
+		const id = result?.deployments?.[0]?.deployment_uuid;
+		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
+		return id;
+	}
+	async deployment(link, id) {
+		return toDeployment(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
+	}
+	async deployments(link, limit) {
+		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
+		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment(this.api, link, item));
+	}
+	async status(link) {
+		const app = await this.api.get(`/applications/${enc(link.application)}`);
+		return {
+			state: appState(app.status),
+			detail: app.status ?? "unknown",
+			domains: composeDomains(app),
+			branch: app.git_branch,
+			url: appUrl(this.api, link)
+		};
+	}
+};
+const coolify = {
+	id: "coolify",
+	name: "Coolify",
+	tokenEnv: "DSTACK_COOLIFY_TOKEN",
+	platformEnv: PLATFORM_ENV,
+	tokenHelp: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`,
+	setupFlags: [
+		{
+			name: "server",
+			description: "The Coolify server, by name or uuid"
+		},
+		{
+			name: "project",
+			description: "The Coolify project, by name or uuid (default: the project name)"
+		},
+		{
+			name: "environment",
+			description: "The Coolify environment (default: production)"
+		},
+		{
+			name: "githubApp",
+			description: "A Coolify GitHub App for a private repository, or public"
+		}
+	],
+	connect: (url, token) => new CoolifyClient(url, token)
+};
+// src/deploy/credentials.ts
+/**
+* API keys of deploy providers, never in the project: the OS keychain
+* (macOS Keychain, Windows Credential Manager, the Secret Service on Linux),
+* or a file only the user can read where there is no keychain. An
+* environment variable such as DSTACK_COOLIFY_TOKEN overrides both, for CI.
+*/
+const SERVICE = "dstack";
+function systemKeyring() {
+	try {
+		const { Entry } = createRequire(import.meta.url)("@napi-rs/keyring");
+		return {
+			get: (account) => new Entry(SERVICE, account).getPassword() ?? void 0,
+			set: (account, token) => new Entry(SERVICE, account).setPassword(token),
+			delete: (account) => void new Entry(SERVICE, account).deletePassword()
+		};
+	} catch {
+		return null;
+	}
+}
+/** The account a key is saved under: one per provider and instance. */
+function accountFor(provider, url) {
+	return `${provider}:${url}`;
+}
+function credentialsFile() {
+	const base = process.env.XDG_CONFIG_HOME || process.platform === "win32" && process.env.APPDATA || join(homedir(), ".config");
+	return join(base, "dstack", "credentials.json");
+}
+function readFile() {
+	const path = credentialsFile();
+	if (!existsSync(path)) return {};
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {};
+	}
+}
+function writeFile(values) {
+	const path = credentialsFile();
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	writeFileSync(path, `${JSON.stringify(values, null, 2)}\n`, { mode: 384 });
+	chmodSync(path, 384);
+}
+function getToken(provider, url, envName) {
+	const fromEnv = process.env[envName];
+	if (fromEnv) return {
+		token: fromEnv,
+		source: "env"
+	};
+	const account = accountFor(provider, url);
+	const keyring = systemKeyring();
+	if (keyring) try {
+		const token = keyring.get(account);
+		if (token) return {
+			token,
+			source: "keychain"
+		};
+	} catch {}
+	const token = readFile()[account];
+	return token ? {
+		token,
+		source: "file"
+	} : void 0;
+}
+/** Saves a key in the keychain, or in the credentials file when there is none. */
+function saveToken(provider, url, token) {
+	const account = accountFor(provider, url);
+	const keyring = systemKeyring();
+	if (keyring) try {
+		keyring.set(account, token);
+		removeFromFile(account);
+		return "keychain";
+	} catch {}
+	writeFile({
+		...readFile(),
+		[account]: token
+	});
+	return "file";
+}
+function removeFromFile(account) {
+	const values = readFile();
+	if (!(account in values)) return false;
+	delete values[account];
+	writeFile(values);
+	return true;
+}
+/** Removes a key from the keychain and the file; returns whether there was one. */
+function deleteToken(provider, url) {
+	const account = accountFor(provider, url);
+	let removed = false;
+	const keyring = systemKeyring();
+	if (keyring) try {
+		if (keyring.get(account)) {
+			keyring.delete(account);
+			removed = true;
+		}
+	} catch {}
+	return removeFromFile(account) || removed;
+}
+// src/deploy/link.ts
+/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
+const LINK_FILE = ".dstack/deploy.json";
+function readLink(directory) {
+	const path = join(directory, LINK_FILE);
+	if (!existsSync(path)) return void 0;
+	let link;
+	try {
+		link = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new Error(`${LINK_FILE} is not valid JSON.`);
+	}
+	for (const key of [
+		"provider",
+		"url",
+		"project",
+		"environment",
+		"application"
+	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
+	return link;
+}
+function writeLink(directory, link) {
+	const path = join(directory, LINK_FILE);
+	mkdirSync(dirname(path), { recursive: true });
+	const { provider, url, project, environment, application } = link;
+	writeFileSync(path, `${JSON.stringify({
+		provider,
+		url,
+		project,
+		environment,
+		application
+	}, null, 2)}\n`);
+}
+/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
+function httpsRepository(remote) {
+	const value = remote.trim();
+	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
+	let url;
+	if (scp) url = `https://${scp[1]}/${scp[2]}`;
+	else try {
+		const parsed = new URL(value);
+		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
+	} catch {
+		throw new Error(`Cannot read the git remote ${value}.`);
+	}
+	return url.replace(/\.git$/, "").replace(/\/$/, "");
+}
+function git(directory, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: directory,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+}
+function gitRemote(directory, remote = "origin") {
+	return git(directory, [
+		"remote",
+		"get-url",
+		remote
+	]) || void 0;
+}
+function gitBranch(directory) {
+	const branch = git(directory, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return branch && branch !== "HEAD" ? branch : void 0;
+}
+/**
+* Why a deploy of `branch` would not include the local commit, or undefined
+* when origin has it. The platform builds from the remote, not from here.
+*/
+function unpushedReason(directory, branch) {
+	const head = git(directory, ["rev-parse", "HEAD"]);
+	if (!head) return void 0;
+	if (git(directory, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
+	if (git(directory, [
+		"merge-base",
+		"--is-ancestor",
+		head,
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
+}
+// src/deploy/provider.ts
+/** Normalizes an instance URL: https by default, no trailing slash or path. */
+function normalizeUrl(value) {
+	const trimmed = value.trim();
+	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+	let parsed;
+	try {
+		parsed = new URL(withScheme);
+	} catch {
+		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
+	}
+	return `${parsed.protocol}//${parsed.host}`;
+}
+// src/deploy/index.ts
+const DEFAULT_PROVIDER = coolify;
+/** Every deploy provider. */
+const PROVIDERS = [coolify];
+function getProvider(id) {
+	const provider = PROVIDERS.find((item) => item.id === id);
+	if (!provider) throw new Error(`Unknown deploy provider ${id}. Choose one of: ${PROVIDERS.map((p) => p.id).join(", ")}.`);
+	return provider;
+}
+// src/project.ts
+/** The `.env` of `dstack run` on a development machine: the prod profile at https://site.localhost. */
+const RUN_ENV = ".env.run";
+const RUN_DOMAIN = "site.localhost";
+/** The project directory: `start` or the nearest parent with `compose.yaml` and `.env`. */
+function findProjectDirectory(start) {
+	let directory = resolve(start);
+	for (;;) {
+		if (existsSync(join(directory, "compose.yaml")) && existsSync(join(directory, ".env"))) return directory;
+		const parent = dirname(directory);
+		if (parent === directory) return void 0;
+		directory = parent;
+	}
+}
+function parseProfiles(value) {
+	return (value ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
+}
+function projectName(directory) {
+	try {
+		const match = readFileSync(join(directory, "compose.yaml"), "utf8").match(/^name:\s*["']?([\w.-]+)/m);
+		if (match?.[1]) return match[1];
+	} catch {}
+	return basename(directory).toLowerCase();
+}
+function fromEnv(directory, name, envFile, localRun) {
+	const env = parseEnv(readFileSync(join(directory, envFile), "utf8"));
+	const profiles = parseProfiles(env.COMPOSE_PROFILES);
+	const prod = profiles.includes("prod");
+	const suffix = prod ? "-prod" : "";
+	return {
+		directory,
+		name: localRun ? `${name}-run` : name,
+		env,
+		profiles,
+		prod,
+		localRun,
+		services: {
+			backend: `backend${suffix}`,
+			frontend: `frontend${suffix}`,
+			worker: `worker${suffix}`
+		},
+		composeArgs: localRun ? [
+			"--env-file",
+			envFile,
+			"--project-name",
+			`${name}-run`
+		] : [],
+		composeEnv: localRun ? {
+			ENV_FILE: envFile,
+			COMPOSE_PROFILES: env.COMPOSE_PROFILES ?? ""
+		} : {}
+	};
+}
+/** Reads the project in or above `start`. Throws with a one-line reason when there is none. */
+function readProject(start = ".") {
+	const directory = findProjectDirectory(start);
+	if (!directory) throw new Error(`No DjangoStack project in ${resolve(start)}: run this where compose.yaml and .env are.`);
+	return fromEnv(directory, projectName(directory), ".env", false);
+}
+/** The local production run of a development project, when `.env.run` exists. */
+function readLocalRun(project) {
+	if (project.prod || project.localRun || !existsSync(join(project.directory, ".env.run"))) return void 0;
+	return fromEnv(project.directory, projectName(project.directory), RUN_ENV, true);
+}
+/** The `django-stack` section of the project's `package.json`. */
+function projectManifest(project) {
+	try {
+		return JSON.parse(readFileSync(join(project.directory, "package.json"), "utf8"))["django-stack"] ?? {};
+	} catch {
+		return {};
+	}
+}
+/**
+* The project's stack: from the preset `init` saved in `package.json`, or,
+* for projects from before that, the defaults with the storage from `.env`.
+*/
+function projectStack(project) {
+	const { preset } = projectManifest(project);
+	if (preset) try {
+		return decodePreset(preset);
+	} catch {}
+	return {
+		...DEFAULT_STACK,
+		storage: project.profiles.includes("s3") ? "s3" : "local"
+	};
+}
+/** The URLs of a running project. */
+function projectUrls(project) {
+	if (project.prod) {
+		const site = (project.env.SITE_URL ?? "").replace(/\/$/, "");
+		return [{
+			label: "Site",
+			url: `${site}/`
+		}, {
+			label: "Admin",
+			url: `${site}/admin/`
+		}];
+	}
+	const urls = [
+		{
+			label: "Site",
+			url: "http://localhost:3000"
+		},
+		{
+			label: "Admin",
+			url: "http://localhost:3000/admin/"
+		},
+		{
+			label: "Mail",
+			url: "http://localhost:8025"
+		}
+	];
+	if (project.profiles.includes("s3")) urls.push({
+		label: "S3",
+		url: "http://localhost:8333"
+	});
+	return urls;
+}
+/** Runs a command with the terminal attached and returns its exit status. */
+const runInherit = (cmd, args, options) => {
+	const result = spawnSync(cmd, args, {
+		stdio: "inherit",
+		...options
+	});
+	if (result.error) return 127;
+	return result.status ?? 1;
+};
+/** The full `docker compose` argument list for a project. */
+function composeCommand(project, args) {
+	return [
+		"compose",
+		...project.composeArgs,
+		...args
+	];
+}
+function composeOptions(project) {
+	return {
+		cwd: project.directory,
+		env: {
+			...process.env,
+			...project.composeEnv
+		}
+	};
+}
+/** Runs `docker compose <args>` for the project with the terminal attached. */
+function compose(project, args, run = runInherit) {
+	return run("docker", composeCommand(project, args), composeOptions(project));
+}
+/** Runs `docker compose <args>` and captures the output. */
+function composeOutput(project, args) {
+	const result = spawnSync("docker", composeCommand(project, args), {
+		...composeOptions(project),
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	return {
+		status: result.status ?? 1,
+		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
+	};
+}
+/** The running services of the project. */
+function runningServices(project) {
+	const result = spawnSync("docker", composeCommand(project, [
+		"ps",
+		"--services",
+		"--filter",
+		"status=running"
+	]), {
+		...composeOptions(project),
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		]
+	});
+	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
+}
+/**
+* The project a command acts on: the local production run when it is the
+* one running, otherwise the project `.env` describes.
+*/
+function activeProject(project) {
+	const localRun = readLocalRun(project);
+	if (!localRun) return project;
+	if (runningServices(project).length) return project;
+	return runningServices(localRun).length ? localRun : project;
+}
+// src/ui.ts
+/** The DjangoStack badge with the version and an optional title. */
+function intro(title) {
+	const badge = pc.bgGreen(pc.black(pc.bold(" DjangoStack ")));
+	p.intro(`${badge} ${pc.dim(`v${CLI_VERSION}`)}${title ? ` ${pc.bold(title)}` : ""}`);
+}
+function fail(message) {
+	p.cancel(pc.red(message));
+	process.exit(1);
+}
+function unwrap(value) {
+	if (p.isCancel(value)) fail("Cancelled.");
+	return value;
+}
+function has(command, args = ["--version"]) {
+	try {
+		execFileSync(command, args, { stdio: "ignore" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+const url = (value) => pc.cyan(pc.underline(value));
+const command = (value) => pc.cyan(value);
+const secret = (value) => pc.bold(pc.yellow(value));
+/** Prompts only when stdin is a terminal and `--yes` was not passed. */
+function isInteractive(yes) {
+	return !yes && Boolean(process.stdin.isTTY);
+}
+/** Logs a check, with its help lines when it did not pass. */
+function logCheck(check) {
+	const head = check.detail ? `${check.name} ${pc.dim(`- ${check.detail}`)}` : check.name;
+	const help = !check.ok && check.help ? check.help.map((line) => pc.dim(line)) : [];
+	const text = [check.ok ? head : check.warning ? pc.yellow(head) : pc.red(head), ...help].join("\n");
+	if (check.ok) p.log.success(text);
+	else if (check.warning) p.log.warn(text);
+	else p.log.error(text);
+}
+// src/commands/deploy.ts
+const PRODUCTION_ENV = ".env.production";
+function projectOrFail(options) {
+	try {
+		return readProject(options.dir ?? ".");
+	} catch (error) {
+		fail(error.message);
+	}
+}
+function linkOrFail(directory) {
+	let link;
+	try {
+		link = readLink(directory);
+	} catch (error) {
+		fail(error.message);
+	}
+	if (!link) fail(`This project is not set up for deploys yet. Run ${command("dstack deploy setup")}.`);
+	return link;
+}
+function providerOrFail(id) {
+	try {
+		return getProvider(id);
+	} catch (error) {
+		fail(error.message);
+	}
+}
+/** Runs a provider call; a failure ends the command with its one-line reason. */
+async function attempt(work, spinner) {
+	try {
+		return await work;
+	} catch (error) {
+		spinner?.error("Failed");
+		fail(error.message);
+	}
+}
+/** The variables for the platform: .env.production plus what the platform needs. */
+function deployEnv(directory, provider) {
+	let file = join(directory, PRODUCTION_ENV);
+	if (!existsSync(file)) {
+		if (!(parseEnv(readFileSync(join(directory, ".env"), "utf8")).COMPOSE_PROFILES ?? "").split(",").includes("prod")) fail(`${PRODUCTION_ENV} does not exist. Run ${command("dstack production --domain example.com")} first.`);
+		file = join(directory, ".env");
+	}
+	return {
+		...parseEnv(readFileSync(file, "utf8")),
+		...provider.platformEnv
+	};
+}
+async function askToken(provider, instance) {
+	p.log.info(provider.tokenHelp(instance));
+	return unwrap(await p.password({
+		message: `${provider.name} API key`,
+		validate: (value) => value?.trim() ? void 0 : "Paste the API key."
+	})).trim();
+}
+/** Checks a key and saves it; returns it. */
+async function login(provider, instance, token) {
+	const spinner = p.spinner();
+	spinner.start(`Checking the key with ${instance}`);
+	const version = await attempt(provider.connect(instance, token).verify(), spinner);
+	spinner.stop(`${provider.name} ${version} accepts the key`);
+	if (saveToken(provider.id, instance, token) === "keychain") p.log.success("Saved the key in the system keychain.");
+	else p.log.warn(`There is no system keychain here, so the key is in ~/.config/dstack/credentials.json, readable only by you. Set ${provider.tokenEnv} instead to keep it off disk.`);
+	return token;
+}
+/** A client for a provider instance: the saved key, or a new one when the CLI may ask. */
+async function connect(provider, instance, interactive) {
+	const saved = getToken(provider.id, instance, provider.tokenEnv);
+	if (saved) return provider.connect(instance, saved.token);
+	if (!interactive) fail(`No ${provider.name} API key for ${instance}. Run ${command("dstack deploy login")} or set ${provider.tokenEnv}.`);
+	const token = await login(provider, instance, await askToken(provider, instance));
+	return provider.connect(instance, token);
+}
+function promptAsk(interactive) {
+	return {
+		interactive,
+		async select(message, choices, initial) {
+			if (!interactive) {
+				if (initial !== void 0) return initial;
+				fail(`${message}: pass it as a flag; see ${command("dstack deploy setup --help")}.`);
+			}
+			return unwrap(await p.select({
+				message,
+				initialValue: initial,
+				options: choices.map((choice) => ({
+					value: choice.value,
+					label: choice.label,
+					hint: choice.hint
+				}))
+			}));
+		},
+		async text(message, options = {}) {
+			if (!interactive) {
+				if (options.initial) return options.initial;
+				fail(`${message}: pass it as a flag.`);
+			}
+			return unwrap(await p.text({
+				message,
+				placeholder: options.placeholder,
+				initialValue: options.initial
+			}));
+		},
+		async confirm(message, initial = true) {
+			if (!interactive) return initial;
+			return unwrap(await p.confirm({
+				message,
+				initialValue: initial
+			}));
+		},
+		step: (message) => p.log.success(message)
+	};
+}
+/** `dstack deploy setup`: create the application on the platform and link the project to it. */
+async function deploySetup(options) {
+	const interactive = isInteractive(options.yes);
+	const project = projectOrFail(options);
+	intro("Deploy setup");
+	const existing = existsSync(join(project.directory, ".dstack/deploy.json")) ? readLink(project.directory) : void 0;
+	if (existing && !options.force) fail(`This project already deploys to ${existing.url} (${LINK_FILE}). Pass --force to set it up again.`);
+	let providerId = options.provider;
+	if (!providerId) providerId = PROVIDERS.length === 1 || !interactive ? DEFAULT_PROVIDER.id : unwrap(await p.select({
+		message: "Platform",
+		options: PROVIDERS.map((item) => ({
+			value: item.id,
+			label: item.name
+		}))
+	}));
+	const provider = providerOrFail(providerId);
+	let instance = options.url;
+	if (!instance) {
+		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
+		instance = unwrap(await p.text({
+			message: `${provider.name} URL`,
+			placeholder: "https://coolify.example.com",
+			validate: (value) => {
+				try {
+					normalizeUrl(value ?? "");
+				} catch (error) {
+					return error.message;
+				}
+			}
+		}));
+	}
+	try {
+		instance = normalizeUrl(instance);
+	} catch (error) {
+		fail(error.message);
+	}
+	const env = deployEnv(project.directory, provider);
+	const domain = (env.SITE_URL ?? "").replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+	if (!domain || domain.endsWith("localhost")) fail(`SITE_URL in ${PRODUCTION_ENV} is not a public domain. Run ${command("dstack production --domain example.com --force")}.`);
+	let repository = options.repository;
+	if (!repository) {
+		const remote = gitRemote(project.directory);
+		if (!remote) fail("This project has no git remote origin. Push it to GitHub first, or pass --repository.");
+		repository = remote;
+	}
+	try {
+		repository = httpsRepository(repository);
+	} catch (error) {
+		fail(error.message);
+	}
+	const branch = options.branch ?? gitBranch(project.directory) ?? "main";
+	const client = await connect(provider, instance, interactive);
+	await attempt(client.verify());
+	const flags = {};
+	for (const flag of provider.setupFlags) flags[flag.name] = options[flag.name];
+	const ids = await attempt(client.setup({
+		ask: promptAsk(interactive),
+		name: project.name,
+		repository,
+		branch,
+		domain,
+		env,
+		options: flags
+	}));
+	const link = {
+		provider: provider.id,
+		url: instance,
+		...ids
+	};
+	writeLink(project.directory, link);
+	p.log.success(`Wrote ${pc.bold(LINK_FILE)}. It holds no secrets; commit it so others deploy to the same place.`);
+	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.name} server.`, `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
+	if (options.deploy ?? (interactive ? unwrap(await p.confirm({
+		message: "Deploy now?",
+		initialValue: true
+	})) : false)) {
+		await startDeploy(project.directory, link, client, {
+			force: false,
+			wait: true
+		});
+		return;
+	}
+	p.outro(`Deploy with ${command("dstack deploy")}`);
+}
+const STATUS_LABEL = {
+	queued: pc.dim("queued"),
+	building: pc.yellow("building"),
+	finished: pc.green("finished"),
+	failed: pc.red("failed"),
+	cancelled: pc.dim("cancelled")
+};
+const DONE = /* @__PURE__ */ new Set([
+	"finished",
+	"failed",
+	"cancelled"
+]);
+const POLL_MS = 3e3;
+const WAIT_LIMIT_MS = 27e5;
+function printLog(deployment, lines) {
+	const log = lines ? deployment.log.slice(-lines) : deployment.log;
+	for (const line of log) process.stdout.write(`${line.stderr ? pc.red(line.text) : line.text}\n`);
+}
+async function follow(link, client, id) {
+	const spinner = p.spinner();
+	spinner.start("Queued");
+	const started = Date.now();
+	let deployment;
+	for (;;) {
+		deployment = await attempt(client.deployment(link, id), spinner);
+		if (DONE.has(deployment.status)) break;
+		const last = deployment.log.at(-1)?.text.trim().slice(0, 70);
+		const seconds = Math.round((Date.now() - started) / 1e3);
+		spinner.message(`${deployment.status === "queued" ? "Queued" : "Building"} ${pc.dim(`${seconds}s`)}${last ? pc.dim(` ${last}`) : ""}`);
+		if (Date.now() - started > WAIT_LIMIT_MS) {
+			spinner.stop("Still running");
+			fail(`The deploy takes longer than 45 minutes. Follow it with ${command("dstack deploy status")}.`);
+		}
+		await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+	}
+	const seconds = Math.round((Date.now() - started) / 1e3);
+	const summary = `${STATUS_LABEL[deployment.status]} after ${seconds}s`;
+	if (deployment.status === "finished") spinner.stop(summary);
+	else spinner.error(summary);
+	return deployment;
+}
+async function startDeploy(directory, link, client, options) {
+	if (options.pushCheck !== false) {
+		const status = await attempt(client.status(link));
+		const reason = status.branch ? unpushedReason(directory, status.branch) : void 0;
+		if (reason) fail(`${reason} Or pass --no-push-check.`);
+	}
+	const id = await attempt(client.deploy(link, { force: options.force }));
+	if (!options.wait) {
+		const deployment = await attempt(client.deployment(link, id));
+		p.outro(`Started deploy ${pc.bold(id)}: ${url(deployment.url ?? link.url)}`);
+		return;
+	}
+	p.log.message(pc.dim("Ctrl+C stops following; the deploy goes on."));
+	const deployment = await follow(link, client, id);
+	if (deployment.status !== "finished") {
+		printLog(deployment, 40);
+		fail(`The deploy ${deployment.status === "cancelled" ? "was cancelled" : "failed"}. Full log: ${command(`dstack deploy logs ${id}`)}`);
+	}
+	const status = await attempt(client.status(link));
+	p.outro(`Deployed${status.domains.length ? `: ${status.domains.map(url).join(" ")}` : ""}`);
+}
+/** `dstack deploy`: start a deploy and follow it. */
+async function deploy(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro(`Deploy to ${provider.name}`);
+	const client = await connect(provider, link.url, isInteractive(options.yes));
+	await startDeploy(project.directory, link, client, {
+		force: Boolean(options.force),
+		wait: options.wait,
+		pushCheck: options.pushCheck
+	});
+}
+function ago(date) {
+	if (!date) return "";
+	const seconds = Math.max(0, Math.round((Date.now() - new Date(date).getTime()) / 1e3));
+	if (Number.isNaN(seconds)) return "";
+	if (seconds < 60) return `${seconds}s ago`;
+	if (seconds < 3600) return `${Math.round(seconds / 60)} min ago`;
+	if (seconds < 86400) return `${Math.round(seconds / 3600)} h ago`;
+	return `${Math.round(seconds / 86400)} d ago`;
+}
+const STATE_LABEL = {
+	running: pc.green("running"),
+	degraded: pc.yellow("degraded"),
+	stopped: pc.red("stopped"),
+	unknown: pc.dim("unknown")
+};
+/** `dstack deploy status`: the application's state and its last deploys. */
+async function deployStatus(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro(`${provider.name} status`);
+	const client = await connect(provider, link.url, isInteractive(false));
+	const limit = Math.max(1, Number.parseInt(options.limit, 10) || 5);
+	const [status, deployments] = await Promise.all([attempt(client.status(link)), attempt(client.deployments(link, limit))]);
+	p.note([
+		`${pc.bold("State")}   ${STATE_LABEL[status.state]} ${pc.dim(`(${status.detail})`)}`,
+		...status.domains.length ? [`${pc.bold("Site")}    ${status.domains.map(url).join(" ")}`] : [],
+		...status.branch ? [`${pc.bold("Branch")}  ${status.branch}`] : [],
+		...status.url ? [`${pc.bold(provider.name.padEnd(7))} ${url(status.url)}`] : []
+	].join("\n"), project.name);
+	if (deployments.length) p.log.message(deployments.map((item) => [
+		STATUS_LABEL[item.status].padEnd(18),
+		pc.dim(ago(item.createdAt).padEnd(11)),
+		item.commit ? pc.cyan(item.commit) : pc.dim("-------"),
+		item.message ?? ""
+	].join("  ")).join("\n"), { symbol: pc.dim("│") });
+	else p.log.message(pc.dim("No deploys yet."));
+	const running = deployments.find((item) => !DONE.has(item.status));
+	if (running && options.watch) {
+		const deployment = await follow(link, client, running.id);
+		if (deployment.status !== "finished") {
+			printLog(deployment, 40);
+			fail(`The deploy failed. Full log: ${command(`dstack deploy logs ${running.id}`)}`);
+		}
+	} else if (running) {
+		p.outro(`A deploy is ${running.status}. Follow it with ${command("dstack deploy status --watch")}`);
+		return;
+	}
+	p.outro(pc.green("Done"));
+}
+/** `dstack deploy logs [deployment]`: the build log of a deploy, the latest by default. */
+async function deployLogs(id, options) {
+	const link = linkOrFail(projectOrFail(options).directory);
+	const client = await connect(providerOrFail(link.provider), link.url, isInteractive(false));
+	let deploymentId = id;
+	if (!deploymentId) {
+		const [latest] = await attempt(client.deployments(link, 1));
+		if (!latest) fail("There are no deploys yet.");
+		deploymentId = latest.id;
+	}
+	const deployment = await attempt(client.deployment(link, deploymentId));
+	printLog(deployment);
+	process.stderr.write(pc.dim(`Deploy ${deployment.id}: ${deployment.status}\n`));
+	if (deployment.status === "failed") process.exitCode = 1;
+}
+/** `dstack deploy env push`: upload .env.production to the platform again. */
+async function deployEnvPush(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro("Push variables");
+	const interactive = isInteractive(options.yes);
+	const env = deployEnv(project.directory, provider);
+	if (interactive && !unwrap(await p.confirm({ message: `Replace ${Object.keys(env).length} variables in ${provider.name} with the values from ${PRODUCTION_ENV}?` }))) fail("Cancelled.");
+	await attempt((await connect(provider, link.url, interactive)).pushEnv(link, env));
+	p.outro(`Set ${Object.keys(env).length} variables. They apply on the next ${command("dstack deploy")}`);
+}
+async function loginTarget(options, interactive) {
+	let link;
+	try {
+		link = readLink(readProject(options.dir ?? ".").directory);
+	} catch {}
+	const provider = providerOrFail(options.provider ?? link?.provider ?? DEFAULT_PROVIDER.id);
+	let instance = options.url ?? link?.url;
+	if (!instance) {
+		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
+		instance = unwrap(await p.text({
+			message: `${provider.name} URL`,
+			placeholder: "https://coolify.example.com"
+		}));
+	}
+	try {
+		return {
+			provider,
+			instance: normalizeUrl(instance)
+		};
+	} catch (error) {
+		fail(error.message);
+	}
+}
+/** `dstack deploy login`: check and save an API key. */
+async function deployLogin(options) {
+	const interactive = isInteractive(options.yes);
+	intro("Deploy login");
+	const { provider, instance } = await loginTarget(options, interactive);
+	let token = options.token ?? (options.yes ? process.env[provider.tokenEnv] : void 0);
+	if (!token) {
+		if (!interactive) fail(`Pass --token or set ${provider.tokenEnv}.`);
+		token = await askToken(provider, instance);
+	}
+	await login(provider, instance, token);
+	p.outro(pc.green("Done"));
+}
+/** `dstack deploy logout`: remove a saved API key. */
+async function deployLogout(options) {
+	const { provider, instance } = await loginTarget(options, isInteractive(false));
+	if (deleteToken(provider.id, instance)) p.log.success(`Removed the ${provider.name} key for ${instance}.`);
+	else p.log.info(`There was no saved ${provider.name} key for ${instance}.`);
+}
+// src/commands/doctor.ts
+async function doctor(directoryArgument) {
+	const directory = resolve(directoryArgument ?? ".");
+	intro("Doctor");
+	const spinner = p.spinner();
+	spinner.start("Checking the project and its services");
+	const checks = await runDoctor(directory);
+	spinner.clear();
+	for (const check of checks) logCheck(check);
+	const failed = checks.filter((check) => !check.ok && !check.warning).length;
+	if (failed) {
+		p.outro(pc.red(`${failed} ${failed === 1 ? "check" : "checks"} failed`));
+		process.exitCode = 1;
+		return;
+	}
+	p.outro(pc.green("All checks passed"));
+}
+// src/update-check.ts
+const PACKAGE_NAME = "@django-stack/cli";
+const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+const DAY = 864e5;
+/** `$XDG_CACHE_HOME/django-stack/update-check.json`, or under `~/.cache`. */
+function defaultCachePath(env = process.env) {
+	const base = env.XDG_CACHE_HOME || process.platform === "win32" && env.LOCALAPPDATA || join(homedir(), ".cache");
+	return join(base, "django-stack", "update-check.json");
+}
+/** Whether to check at all: never in CI, without a terminal, or when turned off. */
+function updateCheckEnabled(env = process.env, isTTY = Boolean(process.stdout.isTTY)) {
+	if (!isTTY) return false;
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
+	for (const key of ["DJANGO_STACK_NO_UPDATE_CHECK", "NO_UPDATE_NOTIFIER"]) if (env[key] && env[key] !== "0") return false;
+	return true;
+}
+function parse(version) {
+	const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(version.trim());
+	if (!match) return void 0;
+	return [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3]),
+		match[4] ?? ""
+	];
+}
+/** Whether `latest` is a newer version than `current`. Prereleases of `latest` never count. */
+function isNewer(latest, current) {
+	const a = parse(latest);
+	const b = parse(current);
+	if (!a || !b || a[3]) return false;
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+	return b[3] !== "";
+}
+function readCache(path) {
+	try {
+		const data = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof data.checkedAt === "number" && typeof data.latest === "string") return data;
+	} catch {}
+}
+function writeCache(path, cache) {
+	try {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, JSON.stringify(cache));
+	} catch {}
+}
+/**
+* The latest version on npm when it is newer than `current`, otherwise
+* undefined. Uses a cached result for a day; never throws.
+*/
+async function checkForUpdate(options) {
+	const cachePath = options.cachePath ?? defaultCachePath();
+	const now = options.now ?? Date.now;
+	const maxAge = options.maxAge ?? DAY;
+	let latest = readCache(cachePath);
+	if (!latest || now() - latest.checkedAt > maxAge || latest.checkedAt > now()) try {
+		const response = await (options.fetch ?? fetch)(REGISTRY_URL, {
+			headers: { accept: "application/json" },
+			signal: AbortSignal.timeout(options.timeout ?? 1500)
+		});
+		if (!response.ok) return void 0;
+		const { version } = await response.json();
+		if (typeof version !== "string") return void 0;
+		latest = {
+			checkedAt: now(),
+			latest: version
+		};
+		writeCache(cachePath, latest);
+	} catch {
+		return;
+	}
+	return isNewer(latest.latest, options.current) ? latest.latest : void 0;
+}
+/** The command that runs or installs the latest version, depending on how this one was started. */
+function updateCommand(location = import.meta.url, env = process.env) {
+	const path = decodeURIComponent(location).replaceAll("\\", "/");
+	if (path.includes("/_npx/")) return `npx ${PACKAGE_NAME}@latest`;
+	if (path.includes("/dlx/") || path.includes("/dlx-")) return `pnpm dlx ${PACKAGE_NAME}@latest`;
+	if (path.includes("/bunx-")) return `bunx ${PACKAGE_NAME}@latest`;
+	if (path.includes("/pnpm/global/")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
+	if (path.includes("/.bun/install/global/")) return `bun add -g ${PACKAGE_NAME}@latest`;
+	if (env.npm_config_user_agent?.startsWith("pnpm")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
+	return `npm install -g ${PACKAGE_NAME}@latest`;
+}
+// src/global-install.ts
+/** The name of the installed command. */
+const BIN = "dstack";
+const normalize = (value) => decodeURIComponent(value).replaceAll("\\", "/");
+/** Whether a path is in the temporary cache of npx, pnpm dlx or bunx. */
+function isTemporary(path) {
+	return path.includes("/_npx/") || path.includes("/dlx/") || path.includes("/dlx-") || path.includes("/bunx-");
+}
+/**
+* The package manager that runs this copy from its temporary cache (npx,
+* pnpm dlx or bunx), or undefined for an installed copy.
+*/
+function temporaryRunner(location = import.meta.url) {
+	const path = normalize(location);
+	if (path.includes("/_npx/")) return "npm";
+	if (path.includes("/dlx/") || path.includes("/dlx-")) return "pnpm";
+	if (path.includes("/bunx-")) return "bun";
+}
+/** Whether `dstack` is on the `PATH`, leaving out the temporary directories npx and friends add. */
+function isOnPath(env = process.env, platform = process.platform) {
+	const names = platform === "win32" ? [
+		`${BIN}.cmd`,
+		`${BIN}.exe`,
+		`${BIN}.ps1`,
+		BIN
+	] : [BIN];
+	return (env.PATH ?? env.Path ?? "").split(platform === "win32" ? ";" : delimiter).filter((dir) => dir && !isTemporary(normalize(dir)) && !normalize(dir).endsWith("node_modules/.bin")).some((dir) => names.some((name) => existsSync(join(dir, name))));
+}
+/** The command that installs the CLI globally with a package manager. */
+function installCommand(runner = "npm") {
+	if (runner === "pnpm") return [
+		"pnpm",
+		"add",
+		"--global",
+		`${PACKAGE_NAME}@latest`
+	];
+	if (runner === "bun") return [
+		"bun",
+		"add",
+		"--global",
+		`${PACKAGE_NAME}@latest`
+	];
+	return [
+		"npm",
+		"install",
+		"--global",
+		`${PACKAGE_NAME}@latest`
+	];
+}
+/** How to run the CLI from a shell: `dstack` when it is installed, otherwise through the runner. */
+function selfCommand(location = import.meta.url, env = process.env) {
+	const runner = temporaryRunner(location);
+	if (!runner || isOnPath(env)) return BIN;
+	if (runner === "pnpm") return `pnpm dlx ${PACKAGE_NAME}`;
+	if (runner === "bun") return `bunx ${PACKAGE_NAME}`;
+	return `npx ${PACKAGE_NAME}`;
+}
+/** `$XDG_CONFIG_HOME/django-stack/config.json`, or under `~/.config` (`%APPDATA%` on Windows). */
+function defaultConfigPath(env = process.env) {
+	const base = env.XDG_CONFIG_HOME || process.platform === "win32" && env.APPDATA || join(homedir(), ".config");
+	return join(base, "django-stack", "config.json");
+}
+function readInstallAnswer(path = defaultConfigPath()) {
+	try {
+		const answer = JSON.parse(readFileSync(path, "utf8")).globalInstall;
+		if (answer === "installed" || answer === "declined" || answer === "failed") return answer;
+	} catch {}
+}
+function saveInstallAnswer(answer, path = defaultConfigPath()) {
+	try {
+		let config = {};
+		try {
+			config = JSON.parse(readFileSync(path, "utf8"));
+		} catch {}
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, `${JSON.stringify({
+			...config,
+			globalInstall: answer
+		}, null, 2)}\n`);
+	} catch {}
+}
+/** Offer the install only once, only to npx users without `dstack`, and never in CI or scripts. */
+function shouldOffer({ runner, onPath, answer, interactive, env }) {
+	if (!runner || onPath || answer || !interactive) return false;
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
+	const off = env.DJANGO_STACK_NO_INSTALL_PROMPT;
+	return !off || off === "0";
+}
+/** A one-line reason and a fix for a failed install, from the package manager's output. */
+function explainFailure(runner, output) {
+	const manual = command(installCommand(runner).join(" "));
+	if (/ERR_PNPM_NO_GLOBAL_BIN_DIR/.test(output)) return `pnpm has no global bin directory yet. Run ${command("pnpm setup")}, open a new terminal and run ${manual}.`;
+	if (/EACCES|EPERM|permission denied/i.test(output)) return runner === "npm" ? `No permission to write to npm's global directory. Give npm a directory in your home (https://docs.npmjs.com/resolving-eacces-permissions-errors-when-installing-packages-globally), then run ${manual}.` : `No permission to write to ${runner}'s global directory. Fix that, then run ${manual}.`;
+	const last = output.trim().split("\n").pop()?.trim();
+	return `${last ? `${last} ` : ""}Run ${manual} to try again.`;
+}
+function run$1(args) {
+	return new Promise((resolve) => {
+		const [cmd, ...rest] = args;
+		let output = "";
+		const child = spawn(cmd, rest, {
+			shell: process.platform === "win32",
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		child.stdout.on("data", (chunk) => output += chunk);
+		child.stderr.on("data", (chunk) => output += chunk);
+		child.on("error", (error) => resolve({
+			ok: false,
+			output: `${output}\n${error.message}`
+		}));
+		child.on("close", (code) => resolve({
+			ok: code === 0,
+			output
+		}));
+	});
+}
+let offered = false;
+/**
+* Ask to install `dstack` globally when the CLI runs through npx, pnpm dlx
+* or bunx. Asks once per machine, remembers the answer, and never fails the
+* command. Returns whether it installed.
+*/
+async function offerGlobalInstall() {
+	if (offered) return false;
+	offered = true;
+	const runner = temporaryRunner();
+	const context = {
+		runner,
+		onPath: isOnPath(),
+		answer: readInstallAnswer(),
+		interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+		env: process.env
+	};
+	if (!runner || !shouldOffer(context)) return false;
+	const args = installCommand(runner);
+	if (await p.confirm({
+		message: `Install ${command("dstack")} globally, so you can run ${command(`dstack <command>`)} instead of npx?`,
+		initialValue: true
+	}) !== true) {
+		saveInstallAnswer("declined");
+		p.log.message(`You won't be asked again. Install it any time with ${command(args.join(" "))}`);
+		return false;
+	}
+	if (!has(runner)) {
+		saveInstallAnswer("failed");
+		p.log.warn(`${runner} is not on your PATH. Install ${runner}, then run ${command(args.join(" "))}`);
+		return false;
+	}
+	const spinner = p.spinner();
+	spinner.start(`Installing with ${command(args.join(" "))}`);
+	const result = await run$1(args);
+	if (!result.ok) {
+		saveInstallAnswer("failed");
+		spinner.error(`Couldn't install ${BIN}`);
+		p.log.warn(explainFailure(runner, result.output));
+		return false;
+	}
+	saveInstallAnswer("installed");
+	spinner.stop(`Installed ${command(BIN)}`);
+	if (!isOnPath()) p.log.warn(`${BIN} is installed, but ${runner}'s global bin directory is not on your PATH yet. ${runner === "pnpm" ? `Run ${command("pnpm setup")} and o` : "O"}pen a new terminal.`);
+	return true;
+}
+// src/commands/init.ts
+/** The prompt choices of an option; values this version does not generate yet are shown but disabled. */
+function choices(key) {
+	return stackOption(key).values.map((value, index) => ({
+		value: value.value,
+		label: value.label,
+		hint: value.generated || index === 0 ? value.hint : "coming soon",
+		disabled: !value.generated && index > 0
+	}));
+}
+/**
+* The stack from, in order of precedence, the flags, the preset, the prompts
+* and the defaults. `askDatabase` asks for the Postgres version together with
+* the external database choice; it returns the version, or a URL.
+*/
+async function chooseStack(options, interactive, askDatabase) {
+	let preset;
+	if (options.preset) try {
+		preset = resolvePreset(options.preset);
+	} catch (error) {
+		fail(error.message);
+	}
+	const stack = { ...DEFAULT_STACK };
+	let databaseUrl;
+	for (const option of STACK_OPTIONS) {
+		const key = option.key;
+		if (options.fromCli(key)) stack[key] = options[key];
+		else if (key === "storage" && options.fromCli("localS3") && options.localS3) stack[key] = "s3";
+		else if (preset) stack[key] = preset[key];
+		else if (!interactive || !applies(key, stack)) continue;
+		else if (key === "postgres" && askDatabase && !options.databaseUrl) {
+			const answer = await askDatabase(stack[key]);
+			if ("databaseUrl" in answer) databaseUrl = answer.databaseUrl;
+			else stack[key] = answer.postgres;
+		} else if (key === "postgres" && options.databaseUrl) continue;
+		else stack[key] = unwrap(await p.select({
+			message: option.message,
+			options: choices(key),
+			initialValue: stack[key]
+		}));
+	}
+	return {
+		stack,
+		databaseUrl
+	};
+}
+function systemTimeZone() {
+	try {
+		const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+		return zone && !validateTimeZone(zone) ? zone : "UTC";
+	} catch {
+		return "UTC";
+	}
+}
+/**
+* Checks Docker, Node.js and Python before the prompts. Problems only warn:
+* the project is created anyway, and Node.js and Python are for development
+* outside the containers. Returns whether Docker can run the project.
+*/
+function checkComputer(checks = checkTools()) {
+	const passed = checks.filter((check) => check.ok);
+	if (passed.length) p.log.success(passed.map((check) => check.detail ?? check.name).join(", "));
+	for (const check of checks.filter((check) => !check.ok)) logCheck({
+		...check,
+		warning: true
+	});
+	return !checks.some((check) => !check.ok && !check.warning);
+}
+async function init(directoryArgument, options) {
+	const interactive = isInteractive(options.yes);
+	intro("Create a project");
+	const dockerReady = checkComputer();
+	const zoneError = options.timeZone ? validateTimeZone(options.timeZone) : void 0;
+	if (zoneError) fail(zoneError);
+	let directory = directoryArgument;
+	if (!directory) directory = interactive ? unwrap(await p.text({
+		message: "Where should the project go?",
+		placeholder: "my-site",
+		defaultValue: "my-site"
+	})) : "my-site";
+	const target = resolve(directory);
+	let name = options.name ?? toProjectName(basename(target));
+	if (validateProjectName(name)) {
+		if (!interactive) fail(`Pass a valid --name: ${validateProjectName(name)}`);
+		name = unwrap(await p.text({
+			message: "Project name",
+			validate: (value) => validateProjectName(value ?? "")
+		}));
+	}
+	const chosen = await chooseStack(options, interactive, async (initial) => {
+		const choice = unwrap(await p.select({
+			message: "Database",
+			initialValue: initial,
+			options: [...choices("postgres").map((value) => ({
+				...value,
+				label: `Bundled Postgres, ${value.label.toLowerCase()}`
+			})), {
+				value: "external",
+				label: "External Postgres",
+				hint: "a URL to your own server"
+			}]
+		}));
+		if (choice !== "external") return { postgres: choice };
+		return { databaseUrl: unwrap(await p.text({
+			message: "Postgres URL",
+			placeholder: "postgres://user:password@host:5432/name",
+			validate: (value) => value?.startsWith("postgres") ? void 0 : "Enter a postgres:// URL."
+		})) };
+	});
+	const stack = chosen.stack;
+	const databaseUrl = options.databaseUrl ?? chosen.databaseUrl;
+	const pending = pendingChoices(stack);
+	const unavailable = pending.filter((item) => !item.isDefault);
+	if (unavailable.length) fail(`${unavailable.map((item) => item.choice).join(", ")} ${unavailable.length > 1 ? "are" : "is"} not available yet. Leave ${unavailable.length > 1 ? "them" : "it"} at the default.`);
+	let timeZone = options.timeZone;
+	if (!timeZone && interactive) {
+		const detected = systemTimeZone();
+		timeZone = unwrap(await p.autocomplete({
+			message: "Time zone",
+			placeholder: "Type to filter, such as Amsterdam",
+			initialValue: detected,
+			maxItems: 8,
+			options: timeZones().map((zone) => ({
+				value: zone,
+				label: zone,
+				hint: zone === detected ? "this computer" : void 0
+			}))
+		}));
+	}
+	let demoContent = options.demoContent;
+	if (interactive && !options.fromCli("demoContent")) demoContent = unwrap(await p.confirm({
+		message: "Add demo content? (example pages and posts)",
+		initialValue: true
+	}));
+	const spinner = p.spinner();
+	spinner.start("Creating the project");
+	let result;
+	try {
+		result = scaffold({
+			directory: target,
+			name,
+			frontend: "astro",
+			demoContent,
+			databaseUrl,
+			localS3: stack.storage === "s3",
+			preset: encodePreset(stack),
+			timeZone,
+			link: options.link
+		});
+	} catch (error) {
+		spinner.error("The project was not created.");
+		fail(error.message);
+	}
+	spinner.stop(`Created ${pc.bold(relativeDirectory(target))} ${pc.dim(`(${result.files} files)`)}`);
+	if (has("uv")) {
+		spinner.start("Locking the backend dependencies");
+		if (lockBackend(target)) spinner.stop(`Locked the backend dependencies in ${pc.bold("backend/uv.lock")}`);
+		else spinner.error("Could not lock the backend dependencies. The image build resolves them instead.");
+	}
+	if (options.git && has("git")) try {
+		execFileSync("git", ["init", "--quiet"], {
+			cwd: target,
+			stdio: "ignore"
+		});
+		execFileSync("git", ["add", "-A"], {
+			cwd: target,
+			stdio: "ignore"
+		});
+		execFileSync("git", [
+			"commit",
+			"--quiet",
+			"-m",
+			"Create project with DjangoStack"
+		], {
+			cwd: target,
+			stdio: "ignore"
+		});
+		p.log.success("Created a git repository");
+	} catch {
+		p.log.warn("Could not commit the project with git. Commit it yourself.");
+	}
+	p.note([
+		command(`cd ${relativeDirectory(target)}`),
+		command("docker compose up"),
+		"",
+		`${pc.bold("Site")}    ${url("http://localhost:3000")}`,
+		`${pc.bold("Admin")}   ${url("http://localhost:3000/admin/")}`,
+		`${pc.bold("Mail")}    ${url("http://localhost:8025")}`,
+		"",
+		`Admin user ${secret(result.adminUsername)}, password ${secret(result.adminPassword)}`,
+		pc.dim("The password is in .env as ADMIN_PASSWORD. Change it after you sign in.")
+	].join("\n"), "Next steps");
+	if (pending.length) p.log.info(`Coming in a later version, so not in this project yet: ${pending.map((item) => `${stackOption(item.key).message.toLowerCase()} (${stack[item.key]})`).join(", ")}.`);
+	p.log.message(`Create the same stack with ${command(`--preset ${encodePreset(stack)}`)}`);
+	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command("docker compose up")}.`));
+	else if (options.start) {
+		if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
+		p.outro(`Starting the project with ${command("docker compose up")}`);
+		execFileSync("docker", ["compose", "up"], {
+			cwd: target,
+			stdio: "inherit"
+		});
+	} else p.outro(pc.green("Done"));
+}
+// src/commands/preset.ts
+/** Without a code: ask for the stack options and print the code. With one: print its stack. */
+async function preset(code, options) {
+	intro(code ? "Preset" : "Create a preset");
+	if (code) {
+		let stack;
+		try {
+			stack = resolvePreset(code);
+		} catch (error) {
+			fail(error.message);
+		}
+		const lines = STACK_OPTIONS.filter((option) => applies(option.key, stack)).map((option) => {
+			const value = option.values.find((candidate) => candidate.value === stack[option.key]);
+			return `${pc.bold(option.message.padEnd(24))}${value?.label ?? ""}`;
+		});
+		p.note(lines.join("\n"), command(`--preset ${encodePreset(stack)}`));
+		p.outro(`Use it with ${command(`${selfCommand()} init --preset ${code in NAMED_PRESETS ? code : encodePreset(stack)}`)}`);
+		return;
+	}
+	const { stack } = await chooseStack(options, isInteractive(options.yes));
+	const encoded = encodePreset(stack);
+	p.outro(`Create this stack with ${command(`${selfCommand()} init --preset ${encoded}`)}`);
+}
+// src/commands/production.ts
+async function production(directoryArgument, options) {
+	const interactive = isInteractive(options.yes);
+	const directory = resolve(directoryArgument ?? ".");
+	const envPath = join(directory, ".env");
+	const target = join(directory, ".env.production");
+	intro("Production settings");
+	if (!existsSync(envPath)) fail(`${envPath} does not exist. Run this in a project directory.`);
+	if (existsSync(target) && !options.force) fail(`${target} exists. Pass --force to replace it.`);
+	let domain = options.domain;
+	if (!domain) {
+		if (!interactive) fail("Pass --domain, such as --domain example.com.");
+		domain = unwrap(await p.text({
+			message: "Domain of the site",
+			placeholder: "example.com",
+			validate: (v) => validateDomain(v ?? "")
+		}));
+	}
+	let result;
+	try {
+		result = productionEnv(readFileSync(envPath, "utf8"), {
+			domain,
+			emailUrl: options.emailUrl
+		});
+	} catch (error) {
+		fail(error.message);
+	}
+	writeFileSync(target, result.text, { mode: 384 });
+	p.log.success(`Wrote ${pc.bold(relativeDirectory(target))} with new secrets for the server.`);
+	if (result.todo.length) p.note(result.todo.map((item) => `${pc.yellow("•")} ${item}`).join("\n"), "Before the first deploy");
+	p.note([
+		`Copy the project to the server, with ${pc.bold(".env.production")} as ${pc.bold(".env")}, then:`,
+		command("docker compose up -d --build"),
+		"",
+		`${pc.bold("Admin")}  ${url(`https://${domain}/admin/`)}  user ${secret("admin")}, password ${secret(result.adminPassword)}`,
+		pc.dim("Point the domain's DNS at the server first: Caddy needs it for the certificate.")
+	].join("\n"), "Deploy");
+	p.outro(pc.green("Done"));
+}
+// src/config.ts
+/** The options `config` can switch in an existing project. The rest follow with code generation. */
+const SWITCHABLE = ["storage"];
+const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key === "S3_CREATE_BUCKET" ? "0" : ""]));
+/**
+* Applies a new stack to a project's `.env`. Throws with a one-line reason
+* for a change this version cannot make.
+*/
+function applyStack(envText, env, from, to) {
+	let text = envText;
+	const changes = [];
+	const profiles = (env.COMPOSE_PROFILES ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
+	for (const option of STACK_OPTIONS) {
+		const key = option.key;
+		if (from[key] === to[key]) continue;
+		const value = option.values.find((candidate) => candidate.value === to[key]);
+		if (!value) throw new Error(`${JSON.stringify(to[key])} is not a ${option.key}.`);
+		if (!SWITCHABLE.includes(key) || !value.generated) throw new Error(`${option.flag} ${to[key]} can't be set on an existing project in this version yet.`);
+		if (key === "storage") {
+			if (profiles.includes("prod")) throw new Error("--storage only changes development; this .env runs the prod profile.");
+			const endpoint = env.S3_ENDPOINT_URL ?? "";
+			if (endpoint && !endpoint.includes("s3:8333")) throw new Error(`S3_ENDPOINT_URL points at ${endpoint}; change the S3_* values in .env yourself.`);
+			const next = profiles.filter((profile) => profile !== "s3");
+			if (to.storage === "s3") next.push("s3");
+			text = setEnvValues(text, {
+				...to.storage === "s3" ? LOCAL_S3 : EMPTY_S3,
+				COMPOSE_PROFILES: next.join(",")
+			});
+			changes.push(to.storage === "s3" ? "Uploads go to the local S3 service (the s3 profile)." : "Uploads go to a Docker volume; the local S3 service is off.");
+		}
+	}
+	return {
+		env: text,
+		changes
+	};
+}
+/** Sets the preset in the `django-stack` section of a project's `package.json` text. */
+function setManifestPreset(manifestText, preset) {
+	const manifest = JSON.parse(manifestText);
+	manifest["django-stack"] = {
+		...manifest["django-stack"] ?? {},
+		preset
+	};
+	return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+// src/commands/project.ts
+function open(options) {
+	if (!has("docker", ["compose", "version"])) fail("Docker Compose v2 was not found. Install Docker: https://docs.docker.com/get-docker/");
+	try {
+		return readProject(options.dir ?? ".");
+	} catch (error) {
+		fail(error.message);
+	}
+}
+function urlsNote(project, title) {
+	const urls = projectUrls(project);
+	const width = Math.max(...urls.map((item) => item.label.length));
+	p.note(urls.map((item) => `${pc.bold(item.label.padEnd(width))}  ${url(item.url)}`).join("\n"), title);
+}
+const tty = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+/** Exit with the status of a command, but treat Ctrl+C (130) as a normal stop. */
+function exitWith(status) {
+	if (status !== 0 && status !== 130) process.exitCode = status;
+}
+/** Writes `.env.run` for the local production run of a development project, once. */
+function ensureRunEnv(project) {
+	const path = join(project.directory, RUN_ENV);
+	if (!existsSync(path)) {
+		const result = productionEnv(readFileSync(join(project.directory, ".env"), "utf8"), {
+			domain: RUN_DOMAIN,
+			emailUrl: "console://"
+		});
+		writeFileSync(path, result.text, { mode: 384 });
+		p.log.success(`Wrote ${pc.bold(RUN_ENV)}: the prod profile at ${url(`https://${RUN_DOMAIN}`)}, with its own secrets and data.`);
+		p.log.message(`Admin user ${secret("admin")}, password ${secret(result.adminPassword)}`);
+	}
+	const run = readLocalRun(project);
+	if (!run) fail(`Could not read ${RUN_ENV}.`);
+	return run;
+}
+/** `dstack run`: the prod profile in the background, on a server or locally at https://site.localhost. */
+async function run(options) {
+	const base = open(options);
+	intro("Run");
+	const project = base.prod ? base : ensureRunEnv(base);
+	const args = [
+		"up",
+		"--detach",
+		"--wait",
+		"--wait-timeout",
+		"300"
+	];
+	if (options.build) args.push("--build");
+	if (compose(project, args) !== 0) fail(`The project did not start. See ${command("dstack logs")}.`);
+	urlsNote(project, "Running");
+	if (project.localRun) p.log.message(pc.dim(`Caddy signs ${RUN_DOMAIN} with its own local CA, so the browser warns once. The admin password is in ${RUN_ENV}.`));
+	p.outro(`Stop it with ${command("dstack stop")}, follow the logs with ${command("dstack logs")}`);
+}
+/** `dstack dev`: the dev profile in the foreground, with hot reload. */
+async function dev(options) {
+	const project = open(options);
+	if (project.prod) fail(`This .env runs the prod profile. Use ${command("dstack run")}.`);
+	intro("Develop");
+	urlsNote(project, "Starting");
+	p.log.message(pc.dim("Changes in backend/ and frontend/ reload. Press Ctrl+C to stop."));
+	exitWith(compose(project, ["up", ...options.build ? ["--build"] : []]));
+}
+/** `dstack stop`: stop the containers of the project and of its local run; volumes and data stay. */
+async function stop(options) {
+	const project = open(options);
+	for (const target of [project, readLocalRun(project)]) if (target && compose(target, ["down"]) !== 0) fail("The project did not stop.");
+}
+/** `dstack logs [service...]`. */
+async function logs(services, options) {
+	const project = activeProject(open(options));
+	const args = ["logs", ...options.follow ? ["--follow"] : []];
+	if (options.tail) args.push("--tail", options.tail);
+	exitWith(compose(project, [...args, ...services]));
+}
+/** `exec` in a running service, otherwise a one-off container. */
+function inService(project, service, args, interactive = tty()) {
+	const noTty = interactive ? [] : ["-T"];
+	if (runningServices(project).includes(service)) return [
+		"exec",
+		...noTty,
+		service,
+		...args
+	];
+	return [
+		"run",
+		"--rm",
+		...noTty,
+		service,
+		...args
+	];
+}
+/** `dstack manage <args...>`: Django's manage.py in the backend container. */
+async function manage(args, options) {
+	const project = activeProject(open(options));
+	exitWith(compose(project, inService(project, project.services.backend, [
+		"python",
+		"manage.py",
+		...args
+	])));
+}
+/** `dstack shell`: Django's shell in the backend container. */
+async function shell(options) {
+	return manage(["shell"], options);
+}
+/**
+* The project and the service that run the backups: the prod worker, on a
+* server or the local run, or the `backup` service of projects from 0.1.
+*/
+function backupProject(options) {
+	const project = activeProject(open(options));
+	if (!project.prod) fail(`Backups run in the prod profile: on the server, or locally after ${command("dstack run")}.`);
+	const running = runningServices(project);
+	const service = ["backup", project.services.worker].find((name) => running.includes(name));
+	if (!service) fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
+	return {
+		project,
+		service
+	};
+}
+/** `dstack backup`: back up the database and the media now, or list the backups. */
+async function backup(options) {
+	const { project, service } = backupProject(options);
+	const args = [
+		"python",
+		"manage.py",
+		"backup_database"
+	];
+	if (options.list) args.push("--list");
+	else if (!options.media) args.push("--no-media");
+	exitWith(compose(project, [
+		"exec",
+		"-T",
+		service,
+		...args
+	]));
+}
+/** The management command and its options for `dstack restore`. */
+function restoreArgs(name, options) {
+	const yes = options.yes ? ["--yes"] : [];
+	if (name.endsWith(".media.tar.gz")) return [
+		"python",
+		"manage.py",
+		"restore_media",
+		name,
+		...yes
+	];
+	return [
+		"python",
+		"manage.py",
+		"restore_database",
+		name,
+		...options.media ? ["--media"] : [],
+		...yes
+	];
+}
+/** `dstack restore <backup>`: restore a database dump, with --media its media too, or a media archive. */
+async function restore(name, options) {
+	const { project, service } = backupProject(options);
+	const args = restoreArgs(name, options);
+	if (!options.yes && !tty()) fail("Pass --yes to restore without a terminal.");
+	exitWith(compose(project, [
+		"exec",
+		...options.yes ? ["-T"] : [],
+		service,
+		...args
+	]));
+}
+/** `dstack types`: the OpenAPI schema from the backend, and the frontend's types from it. */
+async function types(options) {
+	const project = open(options);
+	if (project.prod) fail("Generate the types in development, then commit them.");
+	intro("Types");
+	if (compose(project, inService(project, project.services.backend, [
+		"python",
+		"manage.py",
+		"generateschema",
+		"--generator_class",
+		"headless.rest.schema.SchemaGenerator",
+		"--format",
+		"openapi-json",
+		"--file",
+		"openapi.json"
+	], false)) !== 0) fail("The backend could not write its schema.");
+	const generate = [
+		"npx",
+		"headless",
+		"generate",
+		"--file",
+		"/schema.json",
+		"--out",
+		"src/lib/headless.ts"
+	];
+	if (compose(project, [
+		"run",
+		"--rm",
+		"--no-deps",
+		"-T",
+		...["-v", "./backend/openapi.json:/schema.json:ro"],
+		project.services.frontend,
+		...generate
+	]) !== 0) fail("The frontend could not generate the types.");
+	p.outro(`Wrote ${pc.bold("frontend/src/lib/headless.ts")}`);
+}
+/** The code checks of `dstack check`. */
+function checkSteps(project, tests) {
+	const steps = [
+		{
+			name: project.prod ? "Django deploy checks" : "Django system checks",
+			service: "backend",
+			args: project.prod ? [
+				"python",
+				"manage.py",
+				"check",
+				"--deploy",
+				"--fail-level",
+				"WARNING"
+			] : [
+				"python",
+				"manage.py",
+				"check"
+			]
+		},
+		{
+			name: "Migrations are up to date",
+			service: "backend",
+			args: [
+				"python",
+				"manage.py",
+				"makemigrations",
+				"--check",
+				"--dry-run"
+			]
+		},
+		{
+			name: "Ruff",
+			service: "backend",
+			args: [
+				"ruff",
+				"check",
+				"."
+			],
+			devOnly: true
+		},
+		{
+			name: "Astro check",
+			service: "frontend",
+			args: [
+				"npm",
+				"run",
+				"--silent",
+				"check"
+			],
+			devOnly: true
+		}
+	];
+	if (tests) steps.push({
+		name: "Backend tests",
+		service: "backend",
+		args: ["pytest", "-q"],
+		devOnly: true
+	}, {
+		name: "Frontend tests",
+		service: "frontend",
+		args: [
+			"npm",
+			"test",
+			"--silent"
+		],
+		devOnly: true
+	});
+	return steps.filter((step) => !(step.devOnly && project.prod));
+}
+/** `dstack check`: the doctor's checks, Django's checks, the linters and, with --tests, the tests. */
+async function check(options) {
+	const project = activeProject(open(options));
+	intro("Check");
+	let failed = 0;
+	const spinner = p.spinner();
+	if (!project.localRun) {
+		spinner.start("Checking the setup");
+		const doctorChecks = await runDoctor(project.directory);
+		spinner.clear();
+		for (const item of doctorChecks) {
+			logCheck(item);
+			if (!item.ok && !item.warning) failed++;
+		}
+	}
+	const running = runningServices(project);
+	for (const step of checkSteps(project, Boolean(options.tests))) {
+		const service = project.services[step.service];
+		const args = running.includes(service) ? [
+			"exec",
+			"-T",
+			service,
+			...step.args
+		] : [
+			"run",
+			"--rm",
+			"-T",
+			...step.service === "frontend" ? ["--no-deps"] : [],
+			service,
+			...step.args
+		];
+		spinner.start(step.name);
+		const result = composeOutput(project, args);
+		if (result.status === 0) {
+			spinner.stop(step.name);
+			continue;
+		}
+		failed++;
+		spinner.error(pc.red(step.name));
+		if (result.output) p.log.message(pc.dim(result.output.split("\n").slice(-40).join("\n")));
+	}
+	if (failed) {
+		p.outro(pc.red(`${failed} ${failed === 1 ? "check" : "checks"} failed`));
+		process.exitCode = 1;
+		return;
+	}
+	p.outro(pc.green("All checks passed"));
+}
+/** The name of the frontend's node_modules volume, which hides new packages after a rebuild. */
+function nodeModulesVolume(project) {
+	const result = composeOutput(project, [
+		"config",
+		"--format",
+		"json"
+	]);
+	if (result.status !== 0) return void 0;
+	try {
+		return JSON.parse(result.output).volumes?.frontend_node_modules?.name;
+	} catch {
+		return;
+	}
+}
+/** `dstack update`: newer images, newer DjangoStack packages, and a restart of what was running. */
+async function update(options) {
+	const project = open(options);
+	intro("Update");
+	const targets = [project, readLocalRun(project)].filter((target) => Boolean(target));
+	const running = targets.filter((target) => runningServices(target).length > 0);
+	const lock = join(project.directory, "backend", "uv.lock");
+	if (existsSync(lock) && has("uv")) {
+		const args = options.all ? ["lock", "--upgrade"] : [
+			"lock",
+			"--upgrade-package",
+			"django-stack"
+		];
+		if (spawnSync("uv", args, {
+			cwd: join(project.directory, "backend"),
+			stdio: "inherit"
+		}).status !== 0) fail("uv could not update backend/uv.lock.");
+		p.log.success(options.all ? "Updated backend/uv.lock" : "Updated django-stack in backend/uv.lock");
+	} else if (existsSync(lock)) p.log.warn("uv is not installed, so backend/uv.lock stays as it is: https://docs.astral.sh/uv/");
+	for (const target of targets) {
+		if (compose(target, ["pull", "--ignore-buildable"]) !== 0) fail("Pulling the images failed.");
+		if (compose(target, [
+			"build",
+			"--pull",
+			...options.cache ? [] : ["--no-cache"]
+		]) !== 0) fail("Building the images failed.");
+	}
+	const volume = project.prod ? void 0 : nodeModulesVolume(project);
+	if (volume) {
+		compose(project, [
+			"rm",
+			"--stop",
+			"--force",
+			project.services.frontend
+		]);
+		spawnSync("docker", [
+			"volume",
+			"rm",
+			"--force",
+			volume
+		], { stdio: "ignore" });
+	}
+	if (options.restart && running.length) {
+		for (const target of running) if (compose(target, [
+			"up",
+			"--detach",
+			"--wait",
+			"--wait-timeout",
+			"300"
+		]) !== 0) fail(`The project did not start again. See ${command("dstack logs")}.`);
+		p.outro(pc.green("Updated and restarted"));
+		return;
+	}
+	p.outro(pc.green(`Updated. Start it with ${command(project.prod ? "dstack run" : "dstack dev")}`));
+}
+/** `dstack config`: change the stack options of an existing project. */
+async function config(options) {
+	let project;
+	try {
+		project = readProject(options.dir ?? ".");
+	} catch (error) {
+		fail(error.message);
+	}
+	const interactive = isInteractive(options.yes);
+	intro("Configure");
+	const current = projectStack(project);
+	const next = { ...current };
+	for (const option of STACK_OPTIONS) {
+		const key = option.key;
+		if (options.fromCli(key)) next[key] = options[key];
+		else if (interactive && SWITCHABLE.includes(key)) next[key] = unwrap(await p.select({
+			message: option.message,
+			initialValue: current[key],
+			options: option.values.map((value) => ({
+				value: value.value,
+				label: value.label,
+				hint: value.generated ? value.hint : "coming soon",
+				disabled: !value.generated && value.value !== current[key]
+			}))
+		}));
+	}
+	const envPath = join(project.directory, ".env");
+	let result;
+	try {
+		result = applyStack(readFileSync(envPath, "utf8"), project.env, current, next);
+	} catch (error) {
+		fail(error.message);
+	}
+	if (!result.changes.length) {
+		p.outro("Nothing changed");
+		return;
+	}
+	writeFileSync(envPath, result.env, { mode: 384 });
+	const manifestPath = join(project.directory, "package.json");
+	if (existsSync(manifestPath)) writeFileSync(manifestPath, setManifestPreset(readFileSync(manifestPath, "utf8"), encodePreset(next)));
+	for (const change of result.changes) p.log.success(change);
+	p.outro(`Restart to apply it: ${command("dstack stop")}, then ${command("dstack dev")}`);
+}
+// src/program.ts
+/** Commands that print machine-readable output, so no update notice. */
+const QUIET_COMMANDS = /* @__PURE__ */ new Set([
+	"secret",
+	"complete",
+	"completion"
+]);
+/** A flag for each stack option, such as `--cache <cache>`. */
+function stackFlags() {
+	return STACK_OPTIONS.map((option) => {
+		const name = option.flag.slice(2);
+		return new Option(`${option.flag} <${name}>`, `${option.description} (default: ${option.values[0].value})`).choices(option.values.map((value) => value.value));
+	});
+}
+function positiveInteger(value) {
+	const number = Number(value);
+	if (!Number.isInteger(number) || number < 1) throw new InvalidArgumentError("Pass a whole number above 0.");
+	return number;
+}
+function createProgram() {
+	const program = new Command(BIN).description("Create and manage DjangoStack projects.").version(CLI_VERSION, "-v, --version", "Print the version").helpOption("-h, --help", "Show help for a command").helpCommand("help [command]", "Show help for a command").option("--no-update-check", "Don't check npm for a newer version").option("--no-install-prompt", `Don't offer to install ${BIN} globally`).showSuggestionAfterError().configureHelp({
+		sortSubcommands: false,
+		styleTitle: (text) => pc.bold(text),
+		styleCommandText: (text) => pc.green(text),
+		styleSubcommandText: (text) => pc.green(text),
+		styleOptionText: (text) => pc.cyan(text),
+		styleArgumentText: (text) => pc.yellow(text),
+		styleDescriptionText: (text) => text
+	}).configureOutput({ outputError: (text, write) => write(pc.red(text)) });
+	const initCommand = program.command("init").alias("create").description("Create a project").argument("[directory]", "Where to create the project").option("--name <name>", "The project name (default: from the directory)").option("--preset <preset>", `A preset code from a previous init, or ${Object.keys(NAMED_PRESETS).join(", ")}`).option("--database-url <url>", "Use an external Postgres instead of the bundled one").option("--time-zone <zone>", "The time zone of the backend, such as Europe/Amsterdam (default: UTC)").addOption(new Option("--local-s3", "Same as --storage s3").hideHelp()).option("--no-demo-content", "Start with an empty site").option("--no-git", "Don't create a git repository").option("--start", "Run `docker compose up` when done").option("-y, --yes", "Accept the defaults without asking").addOption(new Option("--link <repository>", "Take the packages from a DjangoStack checkout").hideHelp()).action((directory, options, cmd) => init(directory, {
+		...options,
+		installPrompt: program.opts().installPrompt,
+		fromCli: (option) => cmd.getOptionValueSource(option) === "cli"
+	}));
+	for (const flag of stackFlags()) initCommand.addOption(flag);
+	const dirOption = () => new Option("-C, --dir <directory>", "The project directory (default: this one or a parent)");
+	program.command("run").description("Run the production setup in the background (locally at https://site.localhost)").addOption(dirOption()).option("--no-build", "Don't build the images first").action(run);
+	program.command("dev").description("Run the development servers with hot reload").addOption(dirOption()).option("--no-build", "Don't build the images first").action(dev);
+	program.command("stop").description("Stop the project; the data stays").addOption(dirOption()).action(stop);
+	program.command("logs").description("Show the logs of the services").argument("[services...]", "Only these services, such as backend").addOption(dirOption()).option("--no-follow", "Print the logs and exit").option("-n, --tail <lines>", "Only the last lines of each service").action(logs);
+	program.command("check").description("Check the project: setup, Django checks, migrations and linters").addOption(dirOption()).option("--tests", "Run the backend and frontend tests too").action(check);
+	program.command("update").description("Pull and rebuild the images and update the DjangoStack packages").addOption(dirOption()).option("--all", "Update every backend package in uv.lock, not only django-stack").option("--no-cache", "Rebuild the images from scratch").option("--no-restart", "Don't restart what was running").action(update);
+	const configCommand = program.command("config").description("Change the stack options of a project").addOption(dirOption()).option("-y, --yes", "Don't ask; change only what the flags set").action((options, cmd) => config({
+		...options,
+		fromCli: (option) => cmd.getOptionValueSource(option) === "cli"
+	}));
+	for (const flag of stackFlags()) configCommand.addOption(flag);
+	program.command("manage").description("Run a Django management command in the backend").argument("<args...>", "The command and its options, such as createsuperuser").addOption(dirOption()).allowUnknownOption().helpOption(false).action((args, options) => manage(args, options));
+	program.command("shell").description("Open Django's shell in the backend").addOption(dirOption()).action(shell);
+	program.command("backup").description("Back up the database and the media now (prod profile)").addOption(dirOption()).option("--list", "List the backups instead").option("--no-media", "Back up only the database").action(backup);
+	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
+	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
+	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
+	const deployCommand = program.command("deploy").description("Deploy to a platform such as Coolify, and show the status");
+	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when the last commit is not pushed").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
+	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
+	const seen = /* @__PURE__ */ new Set();
+	for (const flag of PROVIDERS.flatMap((provider) => provider.setupFlags)) {
+		if (seen.has(flag.name)) continue;
+		seen.add(flag.name);
+		const kebab = flag.name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+		setupCommand.option(`--${kebab} <value>`, flag.description);
+	}
+	deployCommand.command("status").description("Show the state of the site and the last deploys").addOption(dirOption()).option("-n, --limit <count>", "How many deploys to list", "5").option("--watch", "Follow a running deploy until it ends").action(deployStatus);
+	deployCommand.command("logs").description("Print the build log of a deploy").argument("[deployment]", "A deploy id from `dstack deploy status` (default: the latest)").addOption(dirOption()).action(deployLogs);
+	deployCommand.command("env").description("Manage the platform's environment variables").command("push").description("Replace the platform's variables with .env.production").addOption(dirOption()).option("-y, --yes", "Don't ask for confirmation").action(deployEnvPush);
+	deployCommand.command("login").description("Check and save an API key in the system keychain").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").option("--token <token>", "The API key (default: ask, or the provider's environment variable with --yes)").option("-y, --yes", "Don't ask").action(deployLogin);
+	deployCommand.command("logout").description("Remove a saved API key").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").action(deployLogout);
+	const presetCommand = program.command("preset").description("Print the preset code of a stack, or the stack of a code").argument("[preset]", "A preset code or name to show").option("-y, --yes", "Don't ask; use the flags and the defaults").action((code, options, cmd) => preset(code, {
+		...options,
+		fromCli: (option) => cmd.getOptionValueSource(option) === "cli"
+	}));
+	for (const flag of stackFlags()) presetCommand.addOption(flag);
+	program.command("production").description("Write .env.production for a server").argument("[directory]", "The project directory", ".").option("--domain <domain>", "The domain of the site, such as example.com").option("--email-url <url>", "The SMTP server, such as smtp+tls://user:pass@host:587").option("--force", "Overwrite an existing .env.production").option("-y, --yes", "Don't ask; fail when --domain is missing").action(production);
+	program.command("doctor").description("Check a project and its services").argument("[directory]", "The project directory", ".").action(doctor);
+	program.command("secret").description("Print a random secret").argument("[bytes]", "The number of random bytes", positiveInteger, 32).action((bytes) => console.log(generateSecret(bytes)));
+	tab(program, { completionCommandName: "completion" });
+	program.commands.find((cmd) => cmd.name() === "completion")?.description("Print a shell completion script (zsh, bash, fish or powershell)").addHelpText("after", `\nAdd it to your shell, for example in ~/.zshrc:\n  ${pc.cyan("source <(dstack completion zsh)")}`);
+	let update$1;
+	let offerInstall = false;
+	program.hook("preAction", (_root, action) => {
+		if (QUIET_COMMANDS.has(action.name())) return;
+		offerInstall = program.opts().installPrompt !== false && !action.opts().yes;
+		if (program.opts().updateCheck === false || !updateCheckEnabled()) return;
+		update$1 = checkForUpdate({ current: CLI_VERSION });
+	});
+	program.hook("postAction", async () => {
+		if (offerInstall && await offerGlobalInstall()) return;
+		const latest = await update$1;
+		if (!latest) return;
+		p.box([`${pc.dim(CLI_VERSION)} ${pc.dim("→")} ${pc.green(pc.bold(latest))}`, `Run ${pc.cyan(updateCommand())}`].join("\n"), pc.yellow("Update available"), {
+			formatBorder: (text) => pc.yellow(text),
+			contentAlign: "center",
+			titleAlign: "center",
+			width: "auto",
+			rounded: true,
+			withGuide: false
+		});
+	});
+	return program;
+}
 // src/bin.ts
-console.log(`django-stack ${VERSION}\n\nThe init command arrives in the next release.`);
+const program = createProgram();
+if (process.argv.length <= 2) program.outputHelp();
+else program.parseAsync().catch((error) => {
+	console.error(pc.red(error instanceof Error ? error.message : String(error)));
+	process.exit(1);
+});
 export {};