@django-stack/cli 0.1.0 → 0.2.0

package/dist/bin.js

@@ -1,13 +1,742 @@
 #!/usr/bin/env node
-import { D as setEnvValues, E as parseEnv, S as validateDomain, T as runDoctor, _ as toProjectName, a as decodePreset, b as CLI_VERSION, c as resolvePreset, d as LOCAL_S3, f as lockBackend, g as timeZones, h as scaffold, i as applies, l as stackOption, m as relativeDirectory, n as NAMED_PRESETS, o as encodePreset, r as STACK_OPTIONS, s as pendingChoices, t as DEFAULT_STACK, v as validateProjectName, w as generateSecret, x as productionEnv, y as validateTimeZone } from "./stack-OTrWHXrO.js";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as toProjectName, a as decodePreset, b as CLI_VERSION, c as resolvePreset, d as LOCAL_S3, f as lockBackend, g as timeZones, h as scaffold, i as applies, l as stackOption, m as relativeDirectory, n as NAMED_PRESETS, o as encodePreset, r as STACK_OPTIONS, s as pendingChoices, t as DEFAULT_STACK, v as validateProjectName, w as generateSecret, x as productionEnv, y as validateTimeZone } from "./stack-CTyqYWCV.js";
+import { createRequire } from "node:module";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import pc from "picocolors";
 import tab from "@bomb.sh/tab/commander";
 import * as p from "@clack/prompts";
 import { Command, InvalidArgumentError, Option } from "commander";
 import { homedir } from "node:os";
+// src/deploy/coolify.ts
+/**
+* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
+* token. The project deploys as a Docker Compose application that Coolify
+* builds on the server from the git repository; Coolify's proxy gets the
+* certificate and forwards to the `proxy` service (Caddy) on port 80.
+*/
+/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
+const PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	TRUSTED_PROXIES: "private_ranges",
+	NUM_PROXIES: "2",
+	HTTP_PORT: "127.0.0.1:8080",
+	HTTPS_PORT: "127.0.0.1:8443"
+};
+var CoolifyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var CoolifyApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
+				method,
+				headers: {
+					Authorization: `Bearer ${this.token}`,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new CoolifyError(errorMessage(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (path) => this.request("GET", path);
+	post = (path, body) => this.request("POST", path, body ?? {});
+	patch = (path, body) => this.request("PATCH", path, body);
+};
+function errorMessage(status, text, url) {
+	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? "";
+		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+const enc = encodeURIComponent;
+function deploymentStatus(value) {
+	if (value === "queued") return "queued";
+	if (value === "in_progress") return "building";
+	if (value === "finished") return "finished";
+	if (value.startsWith("cancelled")) return "cancelled";
+	return "failed";
+}
+function appState(value) {
+	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
+	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
+	if (state === "degraded" || state === "restarting") return "degraded";
+	if (state === "exited" || state === "stopped") return "stopped";
+	return "unknown";
+}
+/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
+function parseLog(logs) {
+	if (!logs) return [];
+	let entries;
+	try {
+		entries = JSON.parse(logs);
+	} catch {
+		return logs.split("\n").map((text) => ({
+			text,
+			stderr: false
+		}));
+	}
+	if (!Array.isArray(entries)) return [];
+	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
+		text,
+		stderr: entry.type === "stderr"
+	})));
+}
+/** The domains of a Compose application, by service. */
+function composeDomains(app) {
+	let value = app.docker_compose_domains;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		value = null;
+	}
+	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
+	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
+	return domains.map((domain) => domain.replace(/:\d+$/, ""));
+}
+function appUrl(api, link) {
+	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
+}
+function toDeployment(api, link, item) {
+	const path = item.deployment_url;
+	return {
+		id: item.deployment_uuid,
+		status: deploymentStatus(item.status),
+		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
+		message: item.commit_message?.split("\n")[0] || void 0,
+		createdAt: item.created_at,
+		updatedAt: item.updated_at,
+		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
+		log: parseLog(item.logs)
+	};
+}
+/** Finds a name or uuid in a list. */
+function find(items, wanted) {
+	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+}
+var CoolifyClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new CoolifyApi(url, token, fetchImpl);
+	}
+	async verify() {
+		const version = await this.api.get("/version");
+		await this.api.get("/servers");
+		return String(version).trim();
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		const api = this.api;
+		const servers = await api.get("/servers");
+		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
+		let server;
+		if (options.server) {
+			server = find(servers, options.server);
+			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
+		} else if (servers.length === 1) server = servers[0];
+		else server = find(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+			value: item.uuid,
+			label: item.name,
+			hint: item.ip
+		}))));
+		if (!server) throw new Error("No server chosen.");
+		const projects = await api.get("/projects");
+		let project;
+		const projectName = options.project ?? context.name;
+		project = find(projects, projectName);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const uuid = await ask.select("Coolify project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.uuid,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.uuid ?? NEW);
+			project = uuid === NEW ? void 0 : find(projects, uuid);
+		}
+		if (!project) {
+			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
+			project = {
+				uuid: (await api.post("/projects", {
+					name: projectName,
+					description: "DjangoStack"
+				})).uuid,
+				name: projectName
+			};
+			ask.step(`Created the Coolify project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		if (!environment) {
+			environment = {
+				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let githubApp;
+		if (options.githubApp && options.githubApp !== "public") {
+			const app = find(await api.get("/github-apps"), options.githubApp);
+			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
+			githubApp = app.uuid;
+		} else if (!options.githubApp && ask.interactive) {
+			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
+			if (apps.length) {
+				const choice = await ask.select("How Coolify gets the code", [{
+					value: "public",
+					label: "Public repository",
+					hint: "no access needed"
+				}, ...apps.map((app) => ({
+					value: app.uuid,
+					label: `GitHub App ${app.name}`,
+					hint: "private repository"
+				}))], "public");
+				githubApp = choice === "public" ? void 0 : choice;
+			}
+		}
+		const body = {
+			project_uuid: project.uuid,
+			server_uuid: server.uuid,
+			environment_uuid: environment.uuid,
+			git_repository: context.repository,
+			git_branch: context.branch,
+			build_pack: "dockercompose",
+			docker_compose_location: "/compose.yaml",
+			docker_compose_domains: [{
+				name: "proxy",
+				domain: `https://${context.domain}:80`
+			}],
+			name: context.name,
+			description: "DjangoStack",
+			instant_deploy: false,
+			...githubApp ? { github_app_uuid: githubApp } : {}
+		};
+		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
+		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
+		const link = {
+			provider: "coolify",
+			url: api.url,
+			project: project.uuid,
+			environment: environment.uuid,
+			application: created.uuid
+		};
+		await this.pushEnv(link, context.env);
+		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
+		return {
+			project: link.project,
+			environment: link.environment,
+			application: link.application
+		};
+	}
+	async pushEnv(link, env) {
+		const data = Object.entries(env).map(([key, value]) => ({
+			key,
+			value,
+			is_literal: true,
+			is_preview: false
+		}));
+		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
+	}
+	async deploy(link, options) {
+		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
+		const result = await this.api.post(`/deploy?${query}`);
+		const id = result?.deployments?.[0]?.deployment_uuid;
+		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
+		return id;
+	}
+	async deployment(link, id) {
+		return toDeployment(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
+	}
+	async deployments(link, limit) {
+		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
+		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment(this.api, link, item));
+	}
+	async status(link) {
+		const app = await this.api.get(`/applications/${enc(link.application)}`);
+		return {
+			state: appState(app.status),
+			detail: app.status ?? "unknown",
+			domains: composeDomains(app),
+			branch: app.git_branch,
+			url: appUrl(this.api, link)
+		};
+	}
+};
+const coolify = {
+	id: "coolify",
+	name: "Coolify",
+	tokenEnv: "DSTACK_COOLIFY_TOKEN",
+	platformEnv: PLATFORM_ENV,
+	tokenHelp: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`,
+	setupFlags: [
+		{
+			name: "server",
+			description: "The Coolify server, by name or uuid"
+		},
+		{
+			name: "project",
+			description: "The Coolify project, by name or uuid (default: the project name)"
+		},
+		{
+			name: "environment",
+			description: "The Coolify environment (default: production)"
+		},
+		{
+			name: "githubApp",
+			description: "A Coolify GitHub App for a private repository, or public"
+		}
+	],
+	connect: (url, token) => new CoolifyClient(url, token)
+};
+// src/deploy/credentials.ts
+/**
+* API keys of deploy providers, never in the project: the OS keychain
+* (macOS Keychain, Windows Credential Manager, the Secret Service on Linux),
+* or a file only the user can read where there is no keychain. An
+* environment variable such as DSTACK_COOLIFY_TOKEN overrides both, for CI.
+*/
+const SERVICE = "dstack";
+function systemKeyring() {
+	try {
+		const { Entry } = createRequire(import.meta.url)("@napi-rs/keyring");
+		return {
+			get: (account) => new Entry(SERVICE, account).getPassword() ?? void 0,
+			set: (account, token) => new Entry(SERVICE, account).setPassword(token),
+			delete: (account) => void new Entry(SERVICE, account).deletePassword()
+		};
+	} catch {
+		return null;
+	}
+}
+/** The account a key is saved under: one per provider and instance. */
+function accountFor(provider, url) {
+	return `${provider}:${url}`;
+}
+function credentialsFile() {
+	const base = process.env.XDG_CONFIG_HOME || process.platform === "win32" && process.env.APPDATA || join(homedir(), ".config");
+	return join(base, "dstack", "credentials.json");
+}
+function readFile() {
+	const path = credentialsFile();
+	if (!existsSync(path)) return {};
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {};
+	}
+}
+function writeFile(values) {
+	const path = credentialsFile();
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	writeFileSync(path, `${JSON.stringify(values, null, 2)}\n`, { mode: 384 });
+	chmodSync(path, 384);
+}
+function getToken(provider, url, envName) {
+	const fromEnv = process.env[envName];
+	if (fromEnv) return {
+		token: fromEnv,
+		source: "env"
+	};
+	const account = accountFor(provider, url);
+	const keyring = systemKeyring();
+	if (keyring) try {
+		const token = keyring.get(account);
+		if (token) return {
+			token,
+			source: "keychain"
+		};
+	} catch {}
+	const token = readFile()[account];
+	return token ? {
+		token,
+		source: "file"
+	} : void 0;
+}
+/** Saves a key in the keychain, or in the credentials file when there is none. */
+function saveToken(provider, url, token) {
+	const account = accountFor(provider, url);
+	const keyring = systemKeyring();
+	if (keyring) try {
+		keyring.set(account, token);
+		removeFromFile(account);
+		return "keychain";
+	} catch {}
+	writeFile({
+		...readFile(),
+		[account]: token
+	});
+	return "file";
+}
+function removeFromFile(account) {
+	const values = readFile();
+	if (!(account in values)) return false;
+	delete values[account];
+	writeFile(values);
+	return true;
+}
+/** Removes a key from the keychain and the file; returns whether there was one. */
+function deleteToken(provider, url) {
+	const account = accountFor(provider, url);
+	let removed = false;
+	const keyring = systemKeyring();
+	if (keyring) try {
+		if (keyring.get(account)) {
+			keyring.delete(account);
+			removed = true;
+		}
+	} catch {}
+	return removeFromFile(account) || removed;
+}
+// src/deploy/link.ts
+/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
+const LINK_FILE = ".dstack/deploy.json";
+function readLink(directory) {
+	const path = join(directory, LINK_FILE);
+	if (!existsSync(path)) return void 0;
+	let link;
+	try {
+		link = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new Error(`${LINK_FILE} is not valid JSON.`);
+	}
+	for (const key of [
+		"provider",
+		"url",
+		"project",
+		"environment",
+		"application"
+	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
+	return link;
+}
+function writeLink(directory, link) {
+	const path = join(directory, LINK_FILE);
+	mkdirSync(dirname(path), { recursive: true });
+	const { provider, url, project, environment, application } = link;
+	writeFileSync(path, `${JSON.stringify({
+		provider,
+		url,
+		project,
+		environment,
+		application
+	}, null, 2)}\n`);
+}
+/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
+function httpsRepository(remote) {
+	const value = remote.trim();
+	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
+	let url;
+	if (scp) url = `https://${scp[1]}/${scp[2]}`;
+	else try {
+		const parsed = new URL(value);
+		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
+	} catch {
+		throw new Error(`Cannot read the git remote ${value}.`);
+	}
+	return url.replace(/\.git$/, "").replace(/\/$/, "");
+}
+function git(directory, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: directory,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+}
+function gitRemote(directory, remote = "origin") {
+	return git(directory, [
+		"remote",
+		"get-url",
+		remote
+	]) || void 0;
+}
+function gitBranch(directory) {
+	const branch = git(directory, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return branch && branch !== "HEAD" ? branch : void 0;
+}
+/**
+* Why a deploy of `branch` would not include the local commit, or undefined
+* when origin has it. The platform builds from the remote, not from here.
+*/
+function unpushedReason(directory, branch) {
+	const head = git(directory, ["rev-parse", "HEAD"]);
+	if (!head) return void 0;
+	if (git(directory, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
+	if (git(directory, [
+		"merge-base",
+		"--is-ancestor",
+		head,
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
+}
+// src/deploy/provider.ts
+/** Normalizes an instance URL: https by default, no trailing slash or path. */
+function normalizeUrl(value) {
+	const trimmed = value.trim();
+	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+	let parsed;
+	try {
+		parsed = new URL(withScheme);
+	} catch {
+		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
+	}
+	return `${parsed.protocol}//${parsed.host}`;
+}
+// src/deploy/index.ts
+const DEFAULT_PROVIDER = coolify;
+/** Every deploy provider. */
+const PROVIDERS = [coolify];
+function getProvider(id) {
+	const provider = PROVIDERS.find((item) => item.id === id);
+	if (!provider) throw new Error(`Unknown deploy provider ${id}. Choose one of: ${PROVIDERS.map((p) => p.id).join(", ")}.`);
+	return provider;
+}
+// src/project.ts
+/** The `.env` of `dstack run` on a development machine: the prod profile at https://site.localhost. */
+const RUN_ENV = ".env.run";
+const RUN_DOMAIN = "site.localhost";
+/** The project directory: `start` or the nearest parent with `compose.yaml` and `.env`. */
+function findProjectDirectory(start) {
+	let directory = resolve(start);
+	for (;;) {
+		if (existsSync(join(directory, "compose.yaml")) && existsSync(join(directory, ".env"))) return directory;
+		const parent = dirname(directory);
+		if (parent === directory) return void 0;
+		directory = parent;
+	}
+}
+function parseProfiles(value) {
+	return (value ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
+}
+function projectName(directory) {
+	try {
+		const match = readFileSync(join(directory, "compose.yaml"), "utf8").match(/^name:\s*["']?([\w.-]+)/m);
+		if (match?.[1]) return match[1];
+	} catch {}
+	return basename(directory).toLowerCase();
+}
+function fromEnv(directory, name, envFile, localRun) {
+	const env = parseEnv(readFileSync(join(directory, envFile), "utf8"));
+	const profiles = parseProfiles(env.COMPOSE_PROFILES);
+	const prod = profiles.includes("prod");
+	const suffix = prod ? "-prod" : "";
+	return {
+		directory,
+		name: localRun ? `${name}-run` : name,
+		env,
+		profiles,
+		prod,
+		localRun,
+		services: {
+			backend: `backend${suffix}`,
+			frontend: `frontend${suffix}`,
+			worker: `worker${suffix}`
+		},
+		composeArgs: localRun ? [
+			"--env-file",
+			envFile,
+			"--project-name",
+			`${name}-run`
+		] : [],
+		composeEnv: localRun ? {
+			ENV_FILE: envFile,
+			COMPOSE_PROFILES: env.COMPOSE_PROFILES ?? ""
+		} : {}
+	};
+}
+/** Reads the project in or above `start`. Throws with a one-line reason when there is none. */
+function readProject(start = ".") {
+	const directory = findProjectDirectory(start);
+	if (!directory) throw new Error(`No DjangoStack project in ${resolve(start)}: run this where compose.yaml and .env are.`);
+	return fromEnv(directory, projectName(directory), ".env", false);
+}
+/** The local production run of a development project, when `.env.run` exists. */
+function readLocalRun(project) {
+	if (project.prod || project.localRun || !existsSync(join(project.directory, ".env.run"))) return void 0;
+	return fromEnv(project.directory, projectName(project.directory), RUN_ENV, true);
+}
+/** The `django-stack` section of the project's `package.json`. */
+function projectManifest(project) {
+	try {
+		return JSON.parse(readFileSync(join(project.directory, "package.json"), "utf8"))["django-stack"] ?? {};
+	} catch {
+		return {};
+	}
+}
+/**
+* The project's stack: from the preset `init` saved in `package.json`, or,
+* for projects from before that, the defaults with the storage from `.env`.
+*/
+function projectStack(project) {
+	const { preset } = projectManifest(project);
+	if (preset) try {
+		return decodePreset(preset);
+	} catch {}
+	return {
+		...DEFAULT_STACK,
+		storage: project.profiles.includes("s3") ? "s3" : "local"
+	};
+}
+/** The URLs of a running project. */
+function projectUrls(project) {
+	if (project.prod) {
+		const site = (project.env.SITE_URL ?? "").replace(/\/$/, "");
+		return [{
+			label: "Site",
+			url: `${site}/`
+		}, {
+			label: "Admin",
+			url: `${site}/admin/`
+		}];
+	}
+	const urls = [
+		{
+			label: "Site",
+			url: "http://localhost:3000"
+		},
+		{
+			label: "Admin",
+			url: "http://localhost:3000/admin/"
+		},
+		{
+			label: "Mail",
+			url: "http://localhost:8025"
+		}
+	];
+	if (project.profiles.includes("s3")) urls.push({
+		label: "S3",
+		url: "http://localhost:8333"
+	});
+	return urls;
+}
+/** Runs a command with the terminal attached and returns its exit status. */
+const runInherit = (cmd, args, options) => {
+	const result = spawnSync(cmd, args, {
+		stdio: "inherit",
+		...options
+	});
+	if (result.error) return 127;
+	return result.status ?? 1;
+};
+/** The full `docker compose` argument list for a project. */
+function composeCommand(project, args) {
+	return [
+		"compose",
+		...project.composeArgs,
+		...args
+	];
+}
+function composeOptions(project) {
+	return {
+		cwd: project.directory,
+		env: {
+			...process.env,
+			...project.composeEnv
+		}
+	};
+}
+/** Runs `docker compose <args>` for the project with the terminal attached. */
+function compose(project, args, run = runInherit) {
+	return run("docker", composeCommand(project, args), composeOptions(project));
+}
+/** Runs `docker compose <args>` and captures the output. */
+function composeOutput(project, args) {
+	const result = spawnSync("docker", composeCommand(project, args), {
+		...composeOptions(project),
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	return {
+		status: result.status ?? 1,
+		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
+	};
+}
+/** The running services of the project. */
+function runningServices(project) {
+	const result = spawnSync("docker", composeCommand(project, [
+		"ps",
+		"--services",
+		"--filter",
+		"status=running"
+	]), {
+		...composeOptions(project),
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		]
+	});
+	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
+}
+/**
+* The project a command acts on: the local production run when it is the
+* one running, otherwise the project `.env` describes.
+*/
+function activeProject(project) {
+	const localRun = readLocalRun(project);
+	if (!localRun) return project;
+	if (runningServices(project).length) return project;
+	return runningServices(localRun).length ? localRun : project;
+}
 // src/ui.ts
 /** The DjangoStack badge with the version and an optional title. */
 function intro(title) {
@@ -18,24 +747,422 @@ function fail(message) {
 	p.cancel(pc.red(message));
 	process.exit(1);
 }
-function unwrap(value) {
-	if (p.isCancel(value)) fail("Cancelled.");
-	return value;
+function unwrap(value) {
+	if (p.isCancel(value)) fail("Cancelled.");
+	return value;
+}
+function has(command, args = ["--version"]) {
+	try {
+		execFileSync(command, args, { stdio: "ignore" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+const url = (value) => pc.cyan(pc.underline(value));
+const command = (value) => pc.cyan(value);
+const secret = (value) => pc.bold(pc.yellow(value));
+/** Prompts only when stdin is a terminal and `--yes` was not passed. */
+function isInteractive(yes) {
+	return !yes && Boolean(process.stdin.isTTY);
+}
+/** Logs a check, with its help lines when it did not pass. */
+function logCheck(check) {
+	const head = check.detail ? `${check.name} ${pc.dim(`- ${check.detail}`)}` : check.name;
+	const help = !check.ok && check.help ? check.help.map((line) => pc.dim(line)) : [];
+	const text = [check.ok ? head : check.warning ? pc.yellow(head) : pc.red(head), ...help].join("\n");
+	if (check.ok) p.log.success(text);
+	else if (check.warning) p.log.warn(text);
+	else p.log.error(text);
+}
+// src/commands/deploy.ts
+const PRODUCTION_ENV = ".env.production";
+function projectOrFail(options) {
+	try {
+		return readProject(options.dir ?? ".");
+	} catch (error) {
+		fail(error.message);
+	}
+}
+function linkOrFail(directory) {
+	let link;
+	try {
+		link = readLink(directory);
+	} catch (error) {
+		fail(error.message);
+	}
+	if (!link) fail(`This project is not set up for deploys yet. Run ${command("dstack deploy setup")}.`);
+	return link;
+}
+function providerOrFail(id) {
+	try {
+		return getProvider(id);
+	} catch (error) {
+		fail(error.message);
+	}
+}
+/** Runs a provider call; a failure ends the command with its one-line reason. */
+async function attempt(work, spinner) {
+	try {
+		return await work;
+	} catch (error) {
+		spinner?.error("Failed");
+		fail(error.message);
+	}
+}
+/** The variables for the platform: .env.production plus what the platform needs. */
+function deployEnv(directory, provider) {
+	let file = join(directory, PRODUCTION_ENV);
+	if (!existsSync(file)) {
+		if (!(parseEnv(readFileSync(join(directory, ".env"), "utf8")).COMPOSE_PROFILES ?? "").split(",").includes("prod")) fail(`${PRODUCTION_ENV} does not exist. Run ${command("dstack production --domain example.com")} first.`);
+		file = join(directory, ".env");
+	}
+	return {
+		...parseEnv(readFileSync(file, "utf8")),
+		...provider.platformEnv
+	};
+}
+async function askToken(provider, instance) {
+	p.log.info(provider.tokenHelp(instance));
+	return unwrap(await p.password({
+		message: `${provider.name} API key`,
+		validate: (value) => value?.trim() ? void 0 : "Paste the API key."
+	})).trim();
+}
+/** Checks a key and saves it; returns it. */
+async function login(provider, instance, token) {
+	const spinner = p.spinner();
+	spinner.start(`Checking the key with ${instance}`);
+	const version = await attempt(provider.connect(instance, token).verify(), spinner);
+	spinner.stop(`${provider.name} ${version} accepts the key`);
+	if (saveToken(provider.id, instance, token) === "keychain") p.log.success("Saved the key in the system keychain.");
+	else p.log.warn(`There is no system keychain here, so the key is in ~/.config/dstack/credentials.json, readable only by you. Set ${provider.tokenEnv} instead to keep it off disk.`);
+	return token;
+}
+/** A client for a provider instance: the saved key, or a new one when the CLI may ask. */
+async function connect(provider, instance, interactive) {
+	const saved = getToken(provider.id, instance, provider.tokenEnv);
+	if (saved) return provider.connect(instance, saved.token);
+	if (!interactive) fail(`No ${provider.name} API key for ${instance}. Run ${command("dstack deploy login")} or set ${provider.tokenEnv}.`);
+	const token = await login(provider, instance, await askToken(provider, instance));
+	return provider.connect(instance, token);
+}
+function promptAsk(interactive) {
+	return {
+		interactive,
+		async select(message, choices, initial) {
+			if (!interactive) {
+				if (initial !== void 0) return initial;
+				fail(`${message}: pass it as a flag; see ${command("dstack deploy setup --help")}.`);
+			}
+			return unwrap(await p.select({
+				message,
+				initialValue: initial,
+				options: choices.map((choice) => ({
+					value: choice.value,
+					label: choice.label,
+					hint: choice.hint
+				}))
+			}));
+		},
+		async text(message, options = {}) {
+			if (!interactive) {
+				if (options.initial) return options.initial;
+				fail(`${message}: pass it as a flag.`);
+			}
+			return unwrap(await p.text({
+				message,
+				placeholder: options.placeholder,
+				initialValue: options.initial
+			}));
+		},
+		async confirm(message, initial = true) {
+			if (!interactive) return initial;
+			return unwrap(await p.confirm({
+				message,
+				initialValue: initial
+			}));
+		},
+		step: (message) => p.log.success(message)
+	};
+}
+/** `dstack deploy setup`: create the application on the platform and link the project to it. */
+async function deploySetup(options) {
+	const interactive = isInteractive(options.yes);
+	const project = projectOrFail(options);
+	intro("Deploy setup");
+	const existing = existsSync(join(project.directory, ".dstack/deploy.json")) ? readLink(project.directory) : void 0;
+	if (existing && !options.force) fail(`This project already deploys to ${existing.url} (${LINK_FILE}). Pass --force to set it up again.`);
+	let providerId = options.provider;
+	if (!providerId) providerId = PROVIDERS.length === 1 || !interactive ? DEFAULT_PROVIDER.id : unwrap(await p.select({
+		message: "Platform",
+		options: PROVIDERS.map((item) => ({
+			value: item.id,
+			label: item.name
+		}))
+	}));
+	const provider = providerOrFail(providerId);
+	let instance = options.url;
+	if (!instance) {
+		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
+		instance = unwrap(await p.text({
+			message: `${provider.name} URL`,
+			placeholder: "https://coolify.example.com",
+			validate: (value) => {
+				try {
+					normalizeUrl(value ?? "");
+				} catch (error) {
+					return error.message;
+				}
+			}
+		}));
+	}
+	try {
+		instance = normalizeUrl(instance);
+	} catch (error) {
+		fail(error.message);
+	}
+	const env = deployEnv(project.directory, provider);
+	const domain = (env.SITE_URL ?? "").replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+	if (!domain || domain.endsWith("localhost")) fail(`SITE_URL in ${PRODUCTION_ENV} is not a public domain. Run ${command("dstack production --domain example.com --force")}.`);
+	let repository = options.repository;
+	if (!repository) {
+		const remote = gitRemote(project.directory);
+		if (!remote) fail("This project has no git remote origin. Push it to GitHub first, or pass --repository.");
+		repository = remote;
+	}
+	try {
+		repository = httpsRepository(repository);
+	} catch (error) {
+		fail(error.message);
+	}
+	const branch = options.branch ?? gitBranch(project.directory) ?? "main";
+	const client = await connect(provider, instance, interactive);
+	await attempt(client.verify());
+	const flags = {};
+	for (const flag of provider.setupFlags) flags[flag.name] = options[flag.name];
+	const ids = await attempt(client.setup({
+		ask: promptAsk(interactive),
+		name: project.name,
+		repository,
+		branch,
+		domain,
+		env,
+		options: flags
+	}));
+	const link = {
+		provider: provider.id,
+		url: instance,
+		...ids
+	};
+	writeLink(project.directory, link);
+	p.log.success(`Wrote ${pc.bold(LINK_FILE)}. It holds no secrets; commit it so others deploy to the same place.`);
+	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.name} server.`, `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
+	if (options.deploy ?? (interactive ? unwrap(await p.confirm({
+		message: "Deploy now?",
+		initialValue: true
+	})) : false)) {
+		await startDeploy(project.directory, link, client, {
+			force: false,
+			wait: true
+		});
+		return;
+	}
+	p.outro(`Deploy with ${command("dstack deploy")}`);
+}
+const STATUS_LABEL = {
+	queued: pc.dim("queued"),
+	building: pc.yellow("building"),
+	finished: pc.green("finished"),
+	failed: pc.red("failed"),
+	cancelled: pc.dim("cancelled")
+};
+const DONE = /* @__PURE__ */ new Set([
+	"finished",
+	"failed",
+	"cancelled"
+]);
+const POLL_MS = 3e3;
+const WAIT_LIMIT_MS = 27e5;
+function printLog(deployment, lines) {
+	const log = lines ? deployment.log.slice(-lines) : deployment.log;
+	for (const line of log) process.stdout.write(`${line.stderr ? pc.red(line.text) : line.text}\n`);
+}
+async function follow(link, client, id) {
+	const spinner = p.spinner();
+	spinner.start("Queued");
+	const started = Date.now();
+	let deployment;
+	for (;;) {
+		deployment = await attempt(client.deployment(link, id), spinner);
+		if (DONE.has(deployment.status)) break;
+		const last = deployment.log.at(-1)?.text.trim().slice(0, 70);
+		const seconds = Math.round((Date.now() - started) / 1e3);
+		spinner.message(`${deployment.status === "queued" ? "Queued" : "Building"} ${pc.dim(`${seconds}s`)}${last ? pc.dim(` ${last}`) : ""}`);
+		if (Date.now() - started > WAIT_LIMIT_MS) {
+			spinner.stop("Still running");
+			fail(`The deploy takes longer than 45 minutes. Follow it with ${command("dstack deploy status")}.`);
+		}
+		await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+	}
+	const seconds = Math.round((Date.now() - started) / 1e3);
+	const summary = `${STATUS_LABEL[deployment.status]} after ${seconds}s`;
+	if (deployment.status === "finished") spinner.stop(summary);
+	else spinner.error(summary);
+	return deployment;
+}
+async function startDeploy(directory, link, client, options) {
+	if (options.pushCheck !== false) {
+		const status = await attempt(client.status(link));
+		const reason = status.branch ? unpushedReason(directory, status.branch) : void 0;
+		if (reason) fail(`${reason} Or pass --no-push-check.`);
+	}
+	const id = await attempt(client.deploy(link, { force: options.force }));
+	if (!options.wait) {
+		const deployment = await attempt(client.deployment(link, id));
+		p.outro(`Started deploy ${pc.bold(id)}: ${url(deployment.url ?? link.url)}`);
+		return;
+	}
+	p.log.message(pc.dim("Ctrl+C stops following; the deploy goes on."));
+	const deployment = await follow(link, client, id);
+	if (deployment.status !== "finished") {
+		printLog(deployment, 40);
+		fail(`The deploy ${deployment.status === "cancelled" ? "was cancelled" : "failed"}. Full log: ${command(`dstack deploy logs ${id}`)}`);
+	}
+	const status = await attempt(client.status(link));
+	p.outro(`Deployed${status.domains.length ? `: ${status.domains.map(url).join(" ")}` : ""}`);
+}
+/** `dstack deploy`: start a deploy and follow it. */
+async function deploy(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro(`Deploy to ${provider.name}`);
+	const client = await connect(provider, link.url, isInteractive(options.yes));
+	await startDeploy(project.directory, link, client, {
+		force: Boolean(options.force),
+		wait: options.wait,
+		pushCheck: options.pushCheck
+	});
+}
+function ago(date) {
+	if (!date) return "";
+	const seconds = Math.max(0, Math.round((Date.now() - new Date(date).getTime()) / 1e3));
+	if (Number.isNaN(seconds)) return "";
+	if (seconds < 60) return `${seconds}s ago`;
+	if (seconds < 3600) return `${Math.round(seconds / 60)} min ago`;
+	if (seconds < 86400) return `${Math.round(seconds / 3600)} h ago`;
+	return `${Math.round(seconds / 86400)} d ago`;
+}
+const STATE_LABEL = {
+	running: pc.green("running"),
+	degraded: pc.yellow("degraded"),
+	stopped: pc.red("stopped"),
+	unknown: pc.dim("unknown")
+};
+/** `dstack deploy status`: the application's state and its last deploys. */
+async function deployStatus(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro(`${provider.name} status`);
+	const client = await connect(provider, link.url, isInteractive(false));
+	const limit = Math.max(1, Number.parseInt(options.limit, 10) || 5);
+	const [status, deployments] = await Promise.all([attempt(client.status(link)), attempt(client.deployments(link, limit))]);
+	p.note([
+		`${pc.bold("State")}   ${STATE_LABEL[status.state]} ${pc.dim(`(${status.detail})`)}`,
+		...status.domains.length ? [`${pc.bold("Site")}    ${status.domains.map(url).join(" ")}`] : [],
+		...status.branch ? [`${pc.bold("Branch")}  ${status.branch}`] : [],
+		...status.url ? [`${pc.bold(provider.name.padEnd(7))} ${url(status.url)}`] : []
+	].join("\n"), project.name);
+	if (deployments.length) p.log.message(deployments.map((item) => [
+		STATUS_LABEL[item.status].padEnd(18),
+		pc.dim(ago(item.createdAt).padEnd(11)),
+		item.commit ? pc.cyan(item.commit) : pc.dim("-------"),
+		item.message ?? ""
+	].join("  ")).join("\n"), { symbol: pc.dim("│") });
+	else p.log.message(pc.dim("No deploys yet."));
+	const running = deployments.find((item) => !DONE.has(item.status));
+	if (running && options.watch) {
+		const deployment = await follow(link, client, running.id);
+		if (deployment.status !== "finished") {
+			printLog(deployment, 40);
+			fail(`The deploy failed. Full log: ${command(`dstack deploy logs ${running.id}`)}`);
+		}
+	} else if (running) {
+		p.outro(`A deploy is ${running.status}. Follow it with ${command("dstack deploy status --watch")}`);
+		return;
+	}
+	p.outro(pc.green("Done"));
 }
-function has(command, args = ["--version"]) {
+/** `dstack deploy logs [deployment]`: the build log of a deploy, the latest by default. */
+async function deployLogs(id, options) {
+	const link = linkOrFail(projectOrFail(options).directory);
+	const client = await connect(providerOrFail(link.provider), link.url, isInteractive(false));
+	let deploymentId = id;
+	if (!deploymentId) {
+		const [latest] = await attempt(client.deployments(link, 1));
+		if (!latest) fail("There are no deploys yet.");
+		deploymentId = latest.id;
+	}
+	const deployment = await attempt(client.deployment(link, deploymentId));
+	printLog(deployment);
+	process.stderr.write(pc.dim(`Deploy ${deployment.id}: ${deployment.status}\n`));
+	if (deployment.status === "failed") process.exitCode = 1;
+}
+/** `dstack deploy env push`: upload .env.production to the platform again. */
+async function deployEnvPush(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro("Push variables");
+	const interactive = isInteractive(options.yes);
+	const env = deployEnv(project.directory, provider);
+	if (interactive && !unwrap(await p.confirm({ message: `Replace ${Object.keys(env).length} variables in ${provider.name} with the values from ${PRODUCTION_ENV}?` }))) fail("Cancelled.");
+	await attempt((await connect(provider, link.url, interactive)).pushEnv(link, env));
+	p.outro(`Set ${Object.keys(env).length} variables. They apply on the next ${command("dstack deploy")}`);
+}
+async function loginTarget(options, interactive) {
+	let link;
 	try {
-		execFileSync(command, args, { stdio: "ignore" });
-		return true;
-	} catch {
-		return false;
+		link = readLink(readProject(options.dir ?? ".").directory);
+	} catch {}
+	const provider = providerOrFail(options.provider ?? link?.provider ?? DEFAULT_PROVIDER.id);
+	let instance = options.url ?? link?.url;
+	if (!instance) {
+		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
+		instance = unwrap(await p.text({
+			message: `${provider.name} URL`,
+			placeholder: "https://coolify.example.com"
+		}));
+	}
+	try {
+		return {
+			provider,
+			instance: normalizeUrl(instance)
+		};
+	} catch (error) {
+		fail(error.message);
 	}
 }
-const url = (value) => pc.cyan(pc.underline(value));
-const command = (value) => pc.cyan(value);
-const secret = (value) => pc.bold(pc.yellow(value));
-/** Prompts only when stdin is a terminal and `--yes` was not passed. */
-function isInteractive(yes) {
-	return !yes && Boolean(process.stdin.isTTY);
+/** `dstack deploy login`: check and save an API key. */
+async function deployLogin(options) {
+	const interactive = isInteractive(options.yes);
+	intro("Deploy login");
+	const { provider, instance } = await loginTarget(options, interactive);
+	let token = options.token ?? (options.yes ? process.env[provider.tokenEnv] : void 0);
+	if (!token) {
+		if (!interactive) fail(`Pass --token or set ${provider.tokenEnv}.`);
+		token = await askToken(provider, instance);
+	}
+	await login(provider, instance, token);
+	p.outro(pc.green("Done"));
+}
+/** `dstack deploy logout`: remove a saved API key. */
+async function deployLogout(options) {
+	const { provider, instance } = await loginTarget(options, isInteractive(false));
+	if (deleteToken(provider.id, instance)) p.log.success(`Removed the ${provider.name} key for ${instance}.`);
+	else p.log.info(`There was no saved ${provider.name} key for ${instance}.`);
 }
 // src/commands/doctor.ts
 async function doctor(directoryArgument) {
@@ -45,12 +1172,7 @@ async function doctor(directoryArgument) {
 	spinner.start("Checking the project and its services");
 	const checks = await runDoctor(directory);
 	spinner.clear();
-	for (const check of checks) {
-		const line = check.detail ? `${check.name} ${pc.dim(`- ${check.detail}`)}` : check.name;
-		if (check.ok) p.log.success(line);
-		else if (check.warning) p.log.warn(pc.yellow(line));
-		else p.log.error(pc.red(line));
-	}
+	for (const check of checks) logCheck(check);
 	const failed = checks.filter((check) => !check.ok && !check.warning).length;
 	if (failed) {
 		p.outro(pc.red(`${failed} ${failed === 1 ? "check" : "checks"} failed`));
@@ -363,9 +1485,24 @@ function systemTimeZone() {
 		return "UTC";
 	}
 }
+/**
+* Checks Docker, Node.js and Python before the prompts. Problems only warn:
+* the project is created anyway, and Node.js and Python are for development
+* outside the containers. Returns whether Docker can run the project.
+*/
+function checkComputer(checks = checkTools()) {
+	const passed = checks.filter((check) => check.ok);
+	if (passed.length) p.log.success(passed.map((check) => check.detail ?? check.name).join(", "));
+	for (const check of checks.filter((check) => !check.ok)) logCheck({
+		...check,
+		warning: true
+	});
+	return !checks.some((check) => !check.ok && !check.warning);
+}
 async function init(directoryArgument, options) {
 	const interactive = isInteractive(options.yes);
 	intro("Create a project");
+	const dockerReady = checkComputer();
 	const zoneError = options.timeZone ? validateTimeZone(options.timeZone) : void 0;
 	if (zoneError) fail(zoneError);
 	let directory = directoryArgument;
@@ -475,7 +1612,6 @@ async function init(directoryArgument, options) {
 	} catch {
 		p.log.warn("Could not commit the project with git. Commit it yourself.");
 	}
-	if (!has("docker", ["compose", "version"])) p.log.warn(`Docker Compose was not found. Install Docker to run the project: ${url("https://docs.docker.com/get-docker/")}`);
 	p.note([
 		command(`cd ${relativeDirectory(target)}`),
 		command("docker compose up"),
@@ -489,7 +1625,8 @@ async function init(directoryArgument, options) {
 	].join("\n"), "Next steps");
 	if (pending.length) p.log.info(`Coming in a later version, so not in this project yet: ${pending.map((item) => `${stackOption(item.key).message.toLowerCase()} (${stack[item.key]})`).join(", ")}.`);
 	p.log.message(`Create the same stack with ${command(`--preset ${encodePreset(stack)}`)}`);
-	if (options.start) {
+	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command("docker compose up")}.`));
+	else if (options.start) {
 		if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
 		p.outro(`Starting the project with ${command("docker compose up")}`);
 		execFileSync("docker", ["compose", "up"], {
@@ -605,198 +1742,6 @@ function setManifestPreset(manifestText, preset) {
 	};
 	return `${JSON.stringify(manifest, null, 2)}\n`;
 }
-// src/project.ts
-/** The `.env` of `dstack run` on a development machine: the prod profile at https://site.localhost. */
-const RUN_ENV = ".env.run";
-const RUN_DOMAIN = "site.localhost";
-/** The project directory: `start` or the nearest parent with `compose.yaml` and `.env`. */
-function findProjectDirectory(start) {
-	let directory = resolve(start);
-	for (;;) {
-		if (existsSync(join(directory, "compose.yaml")) && existsSync(join(directory, ".env"))) return directory;
-		const parent = dirname(directory);
-		if (parent === directory) return void 0;
-		directory = parent;
-	}
-}
-function parseProfiles(value) {
-	return (value ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
-}
-function projectName(directory) {
-	try {
-		const match = readFileSync(join(directory, "compose.yaml"), "utf8").match(/^name:\s*["']?([\w.-]+)/m);
-		if (match?.[1]) return match[1];
-	} catch {}
-	return basename(directory).toLowerCase();
-}
-function fromEnv(directory, name, envFile, localRun) {
-	const env = parseEnv(readFileSync(join(directory, envFile), "utf8"));
-	const profiles = parseProfiles(env.COMPOSE_PROFILES);
-	const prod = profiles.includes("prod");
-	const suffix = prod ? "-prod" : "";
-	return {
-		directory,
-		name: localRun ? `${name}-run` : name,
-		env,
-		profiles,
-		prod,
-		localRun,
-		services: {
-			backend: `backend${suffix}`,
-			frontend: `frontend${suffix}`,
-			worker: `worker${suffix}`
-		},
-		composeArgs: localRun ? [
-			"--env-file",
-			envFile,
-			"--project-name",
-			`${name}-run`
-		] : [],
-		composeEnv: localRun ? {
-			ENV_FILE: envFile,
-			COMPOSE_PROFILES: env.COMPOSE_PROFILES ?? ""
-		} : {}
-	};
-}
-/** Reads the project in or above `start`. Throws with a one-line reason when there is none. */
-function readProject(start = ".") {
-	const directory = findProjectDirectory(start);
-	if (!directory) throw new Error(`No DjangoStack project in ${resolve(start)}: run this where compose.yaml and .env are.`);
-	return fromEnv(directory, projectName(directory), ".env", false);
-}
-/** The local production run of a development project, when `.env.run` exists. */
-function readLocalRun(project) {
-	if (project.prod || project.localRun || !existsSync(join(project.directory, ".env.run"))) return void 0;
-	return fromEnv(project.directory, projectName(project.directory), RUN_ENV, true);
-}
-/** The `django-stack` section of the project's `package.json`. */
-function projectManifest(project) {
-	try {
-		return JSON.parse(readFileSync(join(project.directory, "package.json"), "utf8"))["django-stack"] ?? {};
-	} catch {
-		return {};
-	}
-}
-/**
-* The project's stack: from the preset `init` saved in `package.json`, or,
-* for projects from before that, the defaults with the storage from `.env`.
-*/
-function projectStack(project) {
-	const { preset } = projectManifest(project);
-	if (preset) try {
-		return decodePreset(preset);
-	} catch {}
-	return {
-		...DEFAULT_STACK,
-		storage: project.profiles.includes("s3") ? "s3" : "local"
-	};
-}
-/** The URLs of a running project. */
-function projectUrls(project) {
-	if (project.prod) {
-		const site = (project.env.SITE_URL ?? "").replace(/\/$/, "");
-		return [{
-			label: "Site",
-			url: `${site}/`
-		}, {
-			label: "Admin",
-			url: `${site}/admin/`
-		}];
-	}
-	const urls = [
-		{
-			label: "Site",
-			url: "http://localhost:3000"
-		},
-		{
-			label: "Admin",
-			url: "http://localhost:3000/admin/"
-		},
-		{
-			label: "Mail",
-			url: "http://localhost:8025"
-		}
-	];
-	if (project.profiles.includes("s3")) urls.push({
-		label: "S3",
-		url: "http://localhost:8333"
-	});
-	return urls;
-}
-/** Runs a command with the terminal attached and returns its exit status. */
-const runInherit = (cmd, args, options) => {
-	const result = spawnSync(cmd, args, {
-		stdio: "inherit",
-		...options
-	});
-	if (result.error) return 127;
-	return result.status ?? 1;
-};
-/** The full `docker compose` argument list for a project. */
-function composeCommand(project, args) {
-	return [
-		"compose",
-		...project.composeArgs,
-		...args
-	];
-}
-function composeOptions(project) {
-	return {
-		cwd: project.directory,
-		env: {
-			...process.env,
-			...project.composeEnv
-		}
-	};
-}
-/** Runs `docker compose <args>` for the project with the terminal attached. */
-function compose(project, args, run = runInherit) {
-	return run("docker", composeCommand(project, args), composeOptions(project));
-}
-/** Runs `docker compose <args>` and captures the output. */
-function composeOutput(project, args) {
-	const result = spawnSync("docker", composeCommand(project, args), {
-		...composeOptions(project),
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	return {
-		status: result.status ?? 1,
-		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
-	};
-}
-/** The running services of the project. */
-function runningServices(project) {
-	const result = spawnSync("docker", composeCommand(project, [
-		"ps",
-		"--services",
-		"--filter",
-		"status=running"
-	]), {
-		...composeOptions(project),
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		]
-	});
-	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
-}
-/**
-* The project a command acts on: the local production run when it is the
-* one running, otherwise the project `.env` describes.
-*/
-function activeProject(project) {
-	const localRun = readLocalRun(project);
-	if (!localRun) return project;
-	if (runningServices(project).length) return project;
-	return runningServices(localRun).length ? localRun : project;
-}
 // src/commands/project.ts
 function open(options) {
 	if (!has("docker", ["compose", "version"])) fail("Docker Compose v2 was not found. Install Docker: https://docs.docker.com/get-docker/");
@@ -901,42 +1846,66 @@ async function manage(args, options) {
 async function shell(options) {
 	return manage(["shell"], options);
 }
-/** The project that runs the backups: the prod profile, on a server or the local run. */
+/**
+* The project and the service that run the backups: the prod worker, on a
+* server or the local run, or the `backup` service of projects from 0.1.
+*/
 function backupProject(options) {
 	const project = activeProject(open(options));
 	if (!project.prod) fail(`Backups run in the prod profile: on the server, or locally after ${command("dstack run")}.`);
-	if (!runningServices(project).includes("backup")) fail(`The backup service is not running. Start the project with ${command("dstack run")}.`);
-	return project;
+	const running = runningServices(project);
+	const service = ["backup", project.services.worker].find((name) => running.includes(name));
+	if (!service) fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
+	return {
+		project,
+		service
+	};
 }
-/** `dstack backup`: back up the database now, or list the backups. */
+/** `dstack backup`: back up the database and the media now, or list the backups. */
 async function backup(options) {
-	exitWith(compose(backupProject(options), [
+	const { project, service } = backupProject(options);
+	const args = [
+		"python",
+		"manage.py",
+		"backup_database"
+	];
+	if (options.list) args.push("--list");
+	else if (!options.media) args.push("--no-media");
+	exitWith(compose(project, [
 		"exec",
 		"-T",
-		"backup",
-		...[
-			"python",
-			"manage.py",
-			"backup_database",
-			...options.list ? ["--list"] : []
-		]
+		service,
+		...args
 	]));
 }
-/** `dstack restore <backup>`: restore a backup over the database. */
-async function restore(name, options) {
-	const project = backupProject(options);
-	const args = [
+/** The management command and its options for `dstack restore`. */
+function restoreArgs(name, options) {
+	const yes = options.yes ? ["--yes"] : [];
+	if (name.endsWith(".media.tar.gz")) return [
+		"python",
+		"manage.py",
+		"restore_media",
+		name,
+		...yes
+	];
+	return [
 		"python",
 		"manage.py",
 		"restore_database",
 		name,
-		...options.yes ? ["--yes"] : []
+		...options.media ? ["--media"] : [],
+		...yes
 	];
+}
+/** `dstack restore <backup>`: restore a database dump, with --media its media too, or a media archive. */
+async function restore(name, options) {
+	const { project, service } = backupProject(options);
+	const args = restoreArgs(name, options);
 	if (!options.yes && !tty()) fail("Pass --yes to restore without a terminal.");
 	exitWith(compose(project, [
 		"exec",
 		...options.yes ? ["-T"] : [],
-		"backup",
+		service,
 		...args
 	]));
 }
@@ -1056,13 +2025,8 @@ async function check(options) {
 		const doctorChecks = await runDoctor(project.directory);
 		spinner.clear();
 		for (const item of doctorChecks) {
-			const line = item.detail ? `${item.name} ${pc.dim(`- ${item.detail}`)}` : item.name;
-			if (item.ok) p.log.success(line);
-			else if (item.warning) p.log.warn(pc.yellow(line));
-			else {
-				p.log.error(pc.red(line));
-				failed++;
-			}
+			logCheck(item);
+			if (!item.ok && !item.warning) failed++;
 		}
 	}
 	const running = runningServices(project);
@@ -1259,9 +2223,25 @@ function createProgram() {
 	for (const flag of stackFlags()) configCommand.addOption(flag);
 	program.command("manage").description("Run a Django management command in the backend").argument("<args...>", "The command and its options, such as createsuperuser").addOption(dirOption()).allowUnknownOption().helpOption(false).action((args, options) => manage(args, options));
 	program.command("shell").description("Open Django's shell in the backend").addOption(dirOption()).action(shell);
-	program.command("backup").description("Back up the database now (prod profile)").addOption(dirOption()).option("--list", "List the backups instead").action(backup);
-	program.command("restore").description("Restore a backup over the database (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("-y, --yes", "Don't ask for confirmation").action(restore);
+	program.command("backup").description("Back up the database and the media now (prod profile)").addOption(dirOption()).option("--list", "List the backups instead").option("--no-media", "Back up only the database").action(backup);
+	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
 	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
+	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
+	const deployCommand = program.command("deploy").description("Deploy to a platform such as Coolify, and show the status");
+	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when the last commit is not pushed").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
+	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
+	const seen = /* @__PURE__ */ new Set();
+	for (const flag of PROVIDERS.flatMap((provider) => provider.setupFlags)) {
+		if (seen.has(flag.name)) continue;
+		seen.add(flag.name);
+		const kebab = flag.name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+		setupCommand.option(`--${kebab} <value>`, flag.description);
+	}
+	deployCommand.command("status").description("Show the state of the site and the last deploys").addOption(dirOption()).option("-n, --limit <count>", "How many deploys to list", "5").option("--watch", "Follow a running deploy until it ends").action(deployStatus);
+	deployCommand.command("logs").description("Print the build log of a deploy").argument("[deployment]", "A deploy id from `dstack deploy status` (default: the latest)").addOption(dirOption()).action(deployLogs);
+	deployCommand.command("env").description("Manage the platform's environment variables").command("push").description("Replace the platform's variables with .env.production").addOption(dirOption()).option("-y, --yes", "Don't ask for confirmation").action(deployEnvPush);
+	deployCommand.command("login").description("Check and save an API key in the system keychain").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").option("--token <token>", "The API key (default: ask, or the provider's environment variable with --yes)").option("-y, --yes", "Don't ask").action(deployLogin);
+	deployCommand.command("logout").description("Remove a saved API key").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").action(deployLogout);
 	const presetCommand = program.command("preset").description("Print the preset code of a stack, or the stack of a code").argument("[preset]", "A preset code or name to show").option("-y, --yes", "Don't ask; use the flags and the defaults").action((code, options, cmd) => preset(code, {
 		...options,
 		fromCli: (option) => cmd.getOptionValueSource(option) === "cli"