@django-stack/cli 0.1.0 → 0.3.0

package/dist/bin.js

@@ -1,13 +1,1484 @@
 #!/usr/bin/env node
-import { D as setEnvValues, E as parseEnv, S as validateDomain, T as runDoctor, _ as toProjectName, a as decodePreset, b as CLI_VERSION, c as resolvePreset, d as LOCAL_S3, f as lockBackend, g as timeZones, h as scaffold, i as applies, l as stackOption, m as relativeDirectory, n as NAMED_PRESETS, o as encodePreset, r as STACK_OPTIONS, s as pendingChoices, t as DEFAULT_STACK, v as validateProjectName, w as generateSecret, x as productionEnv, y as validateTimeZone } from "./stack-OTrWHXrO.js";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as toProjectName, a as decodePreset, b as CLI_VERSION, c as resolvePreset, d as LOCAL_S3, f as lockBackend, g as timeZones, h as scaffold, i as applies, l as stackOption, m as relativeDirectory, n as NAMED_PRESETS, o as encodePreset, r as STACK_OPTIONS, s as pendingChoices, t as DEFAULT_STACK, v as validateProjectName, w as generateSecret, x as productionEnv, y as validateTimeZone } from "./stack-CTyqYWCV.js";
+import { createRequire } from "node:module";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import pc from "picocolors";
 import tab from "@bomb.sh/tab/commander";
 import * as p from "@clack/prompts";
 import { Command, InvalidArgumentError, Option } from "commander";
 import { homedir } from "node:os";
+// src/deploy/provider.ts
+/** The target of a platform with a web API and an API key. */
+function urlTarget(name, placeholder) {
+	return {
+		label: `${name} URL`,
+		placeholder,
+		normalize: normalizeUrl
+	};
+}
+/** Normalizes an instance URL: https by default, no trailing slash or path. */
+function normalizeUrl(value) {
+	const trimmed = value.trim();
+	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+	let parsed;
+	try {
+		parsed = new URL(withScheme);
+	} catch {
+		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
+	}
+	return `${parsed.protocol}//${parsed.host}`;
+}
+// src/deploy/coolify.ts
+/**
+* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
+* token. The project deploys as a Docker Compose application that Coolify
+* builds on the server from the git repository; Coolify's proxy gets the
+* certificate and forwards to the `proxy` service (Caddy) on port 80.
+*/
+/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
+const PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	TRUSTED_PROXIES: "private_ranges",
+	NUM_PROXIES: "2",
+	HTTP_PORT: "127.0.0.1:8080",
+	HTTPS_PORT: "127.0.0.1:8443"
+};
+/** Setup flags Coolify and Dokploy share; `deploy setup` shows each flag once. */
+const SHARED_SETUP_FLAGS = [
+	{
+		name: "server",
+		description: "The server on the platform, by name or id (Dokploy: dokploy for its own)"
+	},
+	{
+		name: "project",
+		description: "The platform's project, by name or id (default: the project name)"
+	},
+	{
+		name: "environment",
+		description: "The platform's environment (default: production)"
+	}
+];
+var CoolifyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var CoolifyApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
+				method,
+				headers: {
+					Authorization: `Bearer ${this.token}`,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new CoolifyError(errorMessage$1(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (path) => this.request("GET", path);
+	post = (path, body) => this.request("POST", path, body ?? {});
+	patch = (path, body) => this.request("PATCH", path, body);
+};
+function errorMessage$1(status, text, url) {
+	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? "";
+		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+const enc = encodeURIComponent;
+function deploymentStatus(value) {
+	if (value === "queued") return "queued";
+	if (value === "in_progress") return "building";
+	if (value === "finished") return "finished";
+	if (value.startsWith("cancelled")) return "cancelled";
+	return "failed";
+}
+function appState(value) {
+	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
+	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
+	if (state === "degraded" || state === "restarting") return "degraded";
+	if (state === "exited" || state === "stopped") return "stopped";
+	return "unknown";
+}
+/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
+function parseLog(logs) {
+	if (!logs) return [];
+	let entries;
+	try {
+		entries = JSON.parse(logs);
+	} catch {
+		return logs.split("\n").map((text) => ({
+			text,
+			stderr: false
+		}));
+	}
+	if (!Array.isArray(entries)) return [];
+	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
+		text,
+		stderr: entry.type === "stderr"
+	})));
+}
+/** The domains of a Compose application, by service. */
+function composeDomains(app) {
+	let value = app.docker_compose_domains;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		value = null;
+	}
+	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
+	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
+	return domains.map((domain) => domain.replace(/:\d+$/, ""));
+}
+function appUrl(api, link) {
+	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
+}
+function toDeployment$1(api, link, item) {
+	const path = item.deployment_url;
+	return {
+		id: item.deployment_uuid,
+		status: deploymentStatus(item.status),
+		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
+		message: item.commit_message?.split("\n")[0] || void 0,
+		createdAt: item.created_at,
+		updatedAt: item.updated_at,
+		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
+		log: parseLog(item.logs)
+	};
+}
+/** Finds a name or uuid in a list. */
+function find$1(items, wanted) {
+	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+}
+var CoolifyClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new CoolifyApi(url, token, fetchImpl);
+	}
+	async verify() {
+		const version = await this.api.get("/version");
+		await this.api.get("/servers");
+		return String(version).trim();
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		if (!context.repository) throw new Error("Coolify builds from a git repository; pass --repository.");
+		const api = this.api;
+		const servers = await api.get("/servers");
+		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
+		let server;
+		if (options.server) {
+			server = find$1(servers, options.server);
+			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
+		} else if (servers.length === 1) server = servers[0];
+		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+			value: item.uuid,
+			label: item.name,
+			hint: item.ip
+		}))));
+		if (!server) throw new Error("No server chosen.");
+		const projects = await api.get("/projects");
+		let project;
+		const projectName = options.project ?? context.name;
+		project = find$1(projects, projectName);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const uuid = await ask.select("Coolify project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.uuid,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.uuid ?? NEW);
+			project = uuid === NEW ? void 0 : find$1(projects, uuid);
+		}
+		if (!project) {
+			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
+			project = {
+				uuid: (await api.post("/projects", {
+					name: projectName,
+					description: "DjangoStack"
+				})).uuid,
+				name: projectName
+			};
+			ask.step(`Created the Coolify project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		if (!environment) {
+			environment = {
+				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let githubApp;
+		if (options.githubApp && options.githubApp !== "public") {
+			const app = find$1(await api.get("/github-apps"), options.githubApp);
+			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
+			githubApp = app.uuid;
+		} else if (!options.githubApp && ask.interactive) {
+			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
+			if (apps.length) {
+				const choice = await ask.select("How Coolify gets the code", [{
+					value: "public",
+					label: "Public repository",
+					hint: "no access needed"
+				}, ...apps.map((app) => ({
+					value: app.uuid,
+					label: `GitHub App ${app.name}`,
+					hint: "private repository"
+				}))], "public");
+				githubApp = choice === "public" ? void 0 : choice;
+			}
+		}
+		const body = {
+			project_uuid: project.uuid,
+			server_uuid: server.uuid,
+			environment_uuid: environment.uuid,
+			git_repository: context.repository,
+			git_branch: context.branch,
+			build_pack: "dockercompose",
+			docker_compose_location: "/compose.yaml",
+			docker_compose_domains: [{
+				name: "proxy",
+				domain: `https://${context.domain}:80`
+			}],
+			name: context.name,
+			description: "DjangoStack",
+			instant_deploy: false,
+			...githubApp ? { github_app_uuid: githubApp } : {}
+		};
+		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
+		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
+		const link = {
+			provider: "coolify",
+			url: api.url,
+			project: project.uuid,
+			environment: environment.uuid,
+			application: created.uuid
+		};
+		await this.pushEnv(link, context.env);
+		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
+		return {
+			project: link.project,
+			environment: link.environment,
+			application: link.application
+		};
+	}
+	async pushEnv(link, env) {
+		const data = Object.entries(env).map(([key, value]) => ({
+			key,
+			value,
+			is_literal: true,
+			is_preview: false
+		}));
+		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
+	}
+	async deploy(link, options) {
+		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
+		const result = await this.api.post(`/deploy?${query}`);
+		const id = result?.deployments?.[0]?.deployment_uuid;
+		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
+		return id;
+	}
+	async deployment(link, id) {
+		return toDeployment$1(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
+	}
+	async deployments(link, limit) {
+		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
+		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment$1(this.api, link, item));
+	}
+	async status(link) {
+		const app = await this.api.get(`/applications/${enc(link.application)}`);
+		return {
+			state: appState(app.status),
+			detail: app.status ?? "unknown",
+			domains: composeDomains(app),
+			branch: app.git_branch,
+			url: appUrl(this.api, link)
+		};
+	}
+};
+const coolify = {
+	id: "coolify",
+	name: "Coolify",
+	auth: {
+		kind: "token",
+		env: "DSTACK_COOLIFY_TOKEN",
+		help: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`
+	},
+	source: "remote",
+	target: urlTarget("Coolify", "https://coolify.example.com"),
+	platformEnv: PLATFORM_ENV,
+	setupFlags: [...SHARED_SETUP_FLAGS, {
+		name: "githubApp",
+		description: "A Coolify GitHub App for a private repository, or public"
+	}],
+	connect: (url, token) => {
+		if (!token) throw new Error("Coolify needs an API key.");
+		return new CoolifyClient(url, token);
+	}
+};
+const systemSsh = (args, input) => new Promise((resolve, reject) => {
+	const child = spawn("ssh", args, { stdio: [
+		"pipe",
+		"pipe",
+		"pipe"
+	] });
+	const stdout = [];
+	const stderr = [];
+	child.stdout.on("data", (chunk) => stdout.push(chunk));
+	child.stderr.on("data", (chunk) => stderr.push(chunk));
+	child.on("error", (error) => reject(/* @__PURE__ */ new Error(error.code === "ENOENT" ? "There is no ssh command here. Install OpenSSH." : `Could not run ssh: ${error.message}`)));
+	child.on("close", (code) => resolve({
+		code: code ?? 1,
+		stdout: Buffer.concat(stdout).toString("utf8"),
+		stderr: Buffer.concat(stderr).toString("utf8")
+	}));
+	child.stdin.on("error", () => {});
+	child.stdin.end(input);
+});
+const USER = /^[a-z_][\w.-]*$/i;
+const HOST = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$|^\[[0-9a-f:.]+\]$/i;
+/** Reads deploy@example.com, example.com:2222 or ssh://deploy@example.com:2222. */
+function parseTarget(value) {
+	const match = value.trim().replace(/^ssh:\/\//i, "").replace(/\/$/, "").match(/^(?:([^@\s]+)@)?(\[[^\]]+\]|[^:@\s]+)(?::(\d+))?$/);
+	const reason = `${value} is not an SSH target. Enter one such as deploy@example.com or deploy@example.com:2222.`;
+	if (!match) throw new Error(reason);
+	const [, user, host = "", port] = match;
+	if (user && !USER.test(user) || !HOST.test(host)) throw new Error(reason);
+	const number = port ? Number(port) : void 0;
+	if (number !== void 0 && (number < 1 || number > 65535)) throw new Error(reason);
+	return {
+		user,
+		host,
+		port: number
+	};
+}
+function formatTarget(target) {
+	return `ssh://${target.user ? `${target.user}@` : ""}${target.host}${target.port ? `:${target.port}` : ""}`;
+}
+/** Quotes a value for the remote POSIX shell. */
+function shellQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** A Compose project name: lower case letters, digits, dashes and underscores. */
+function composeName(name) {
+	return name.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[^a-z0-9]+|-+$/g, "") || "site";
+}
+/** A deploy id that sorts by time: 20261105-183000-abc1234. */
+function deployId(date, suffix) {
+	const pad = (value) => String(value).padStart(2, "0");
+	return `${`${date.getUTCFullYear()}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}`}-${`${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}`}-${suffix}`;
+}
+const ID = /^[\w.-]+$/;
+/** The status file: building, finished or failed, and whether the deploy's process lives. */
+function recordStatus(status, alive) {
+	const value = status.trim();
+	if (value === "finished") return "finished";
+	if (value === "failed") return "failed";
+	if (value === "queued") return alive ? "queued" : "failed";
+	if (value === "building") return alive ? "building" : "failed";
+	return "failed";
+}
+/** `docker compose ps --format json` prints an array (older) or one object per line (newer). */
+function parseComposePs(output) {
+	const text = output.trim();
+	if (!text) return [];
+	if (text.startsWith("[")) return JSON.parse(text);
+	return text.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+}
+function composeState(containers) {
+	if (!containers.length) return {
+		state: "stopped",
+		detail: "no containers"
+	};
+	const running = containers.filter((item) => item.State === "running");
+	const unhealthy = containers.filter((item) => item.Health === "unhealthy" || item.State === "restarting");
+	const summary = `${running.length}/${containers.length} running`;
+	if (!running.length) return {
+		state: "stopped",
+		detail: summary
+	};
+	if (unhealthy.length) return {
+		state: "degraded",
+		detail: `${summary}, unhealthy: ${unhealthy.map((item) => item.Service).join(", ")}`
+	};
+	if (running.length < containers.length) return {
+		state: "degraded",
+		detail: `${summary}, not running: ${containers.filter((item) => item.State !== "running").map((item) => item.Service).join(", ")}`
+	};
+	return {
+		state: "running",
+		detail: summary
+	};
+}
+/** Splits the output of a remote command whose parts are separated by MARK lines. */
+const MARK = "--dstack-8f2c--";
+function parts(output) {
+	return output.split(`\n${MARK}\n`);
+}
+/**
+* The script that runs a deploy on the server, detached. It builds and
+* starts the release, moves `current` to it on success and removes the
+* oldest releases beyond KEEP_RELEASES.
+*/
+function deployScript(path, project, id, release, force) {
+	const q = shellQuote;
+	const compose = `docker compose -p ${q(project)}`;
+	return `#!/bin/sh
+set -u
+app=${q(path)}
+status="$app/deploys/${id}.status"
+trap 'rm -rf "$app/deploy.lock"' EXIT
+cd "$app/releases/${release}" || { echo failed > "$status"; exit 1; }
+echo building > "$status"
+echo "Deploy ${id}: release ${release}"
+${force ? `${compose} build --no-cache --pull && ` : ""}${compose} up -d --build --remove-orphans --wait --wait-timeout 600
+code=$?
+if [ "$code" -ne 0 ]; then
+  echo "docker compose exited with $code"
+  ${compose} ps --all
+  echo failed > "$status"
+  exit "$code"
+fi
+ln -sfn "releases/${release}" "$app/current"
+cd "$app/releases"
+ls -1 | sort -r | tail -n +6 | while read -r old; do
+  [ "$old" = ${q(release)} ] || rm -rf -- "$old"
+done
+echo "Started release ${release}"
+echo finished > "$status"
+`;
+}
+var SshClient = class {
+	run;
+	git;
+	target;
+	constructor(target, run = systemSsh, git = defaultGit) {
+		this.run = run;
+		this.git = git;
+		this.target = parseTarget(target);
+	}
+	get destination() {
+		return `${this.target.user ? `${this.target.user}@` : ""}${this.target.host.replace(/^\[|\]$/g, "")}`;
+	}
+	/** Runs a POSIX shell script on the server; fails with a one-line reason. */
+	async sh(script, input) {
+		const args = [
+			"-o",
+			"BatchMode=yes",
+			"-o",
+			"ConnectTimeout=15",
+			...this.target.port ? ["-p", String(this.target.port)] : [],
+			"--",
+			this.destination,
+			`sh -c ${shellQuote(script)}`
+		];
+		const result = await this.run(args, input);
+		if (result.code === 0) return result.stdout;
+		throw new Error(this.errorMessage(result));
+	}
+	errorMessage(result) {
+		const stderr = result.stderr.trim();
+		const where = formatTarget(this.target);
+		if (/REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(stderr)) return `The host key of ${where} changed. If you reinstalled the server, remove the old key with ssh-keygen -R ${this.target.host}; otherwise do not connect.`;
+		if (/Host key verification failed|No .* host key is known/i.test(stderr)) return `${where} is not in your known_hosts yet. Connect once with ssh ${this.destination}${this.target.port ? ` -p ${this.target.port}` : ""}, check the fingerprint and answer yes, then try again.`;
+		if (/Permission denied/i.test(stderr)) return `${where} refused your SSH key. Add it with ssh-copy-id ${this.destination}, or load it into the agent with ssh-add.`;
+		if (result.code === 255) return `Could not connect to ${where}: ${stderr.split("\n").at(-1) || "ssh failed"}`;
+		const last = (stderr || result.stdout.trim()).split("\n").at(-1) ?? "";
+		return `The command on ${where} failed (exit ${result.code})${last ? `: ${last}` : "."}`;
+	}
+	/** Checks the connection and Docker; returns their versions. */
+	async verify() {
+		const output = await this.sh(`
+command -v docker >/dev/null 2>&1 || { echo missing:docker; exit 0; }
+docker compose version --short 2>/dev/null || echo missing:compose
+docker info --format '{{.ServerVersion}}' 2>/dev/null || echo missing:permission
+`);
+		if (output.includes("missing:docker")) throw new Error(`${formatTarget(this.target)} has no Docker. Install Docker Engine with the Compose plugin: https://docs.docker.com/engine/install/`);
+		if (output.includes("missing:compose")) throw new Error(`${formatTarget(this.target)} has Docker without the Compose plugin. Install docker-compose-plugin: https://docs.docker.com/compose/install/linux/`);
+		if (output.includes("missing:permission")) throw new Error(`${this.destination} may not use Docker on the server. Run sudo usermod -aG docker ${this.target.user ?? "$USER"} there and connect again.`);
+		const [compose = "", engine = ""] = output.trim().split("\n");
+		return `Docker ${engine.trim()}, Compose ${compose.trim().replace(/^v/, "")}`;
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		let path = options.path ?? `/srv/${composeName(context.name)}`;
+		if (path.startsWith("~/")) path = `${(await this.sh("printf %s \"$HOME\"")).trim()}/${path.slice(2)}`;
+		if (!path.startsWith("/")) throw new Error(`Give --path as an absolute path, such as /srv/${composeName(context.name)}.`);
+		path = path.replace(/\/+$/, "");
+		const q = shellQuote;
+		if (!(await this.sh(`
+if mkdir -p ${q(`${path}/releases`)} ${q(`${path}/shared`)} ${q(`${path}/deploys`)} 2>/dev/null && [ -w ${q(path)} ]; then echo ok; fi
+`)).includes("ok")) {
+			const home = (await this.sh("printf %s \"$HOME\"")).trim();
+			throw new Error(`${this.destination} cannot write to ${path} on the server. Create it there with sudo mkdir -p ${path} && sudo chown ${this.target.user ?? "$USER"} ${path}, or pass a directory you own, such as --path ${home}/${composeName(context.name)}.`);
+		}
+		ask.step(`Created ${path} on the server`);
+		const project = composeName(context.name);
+		const link = {
+			project: path,
+			environment: "production",
+			application: project
+		};
+		await this.pushEnv({
+			provider: "ssh",
+			url: formatTarget(this.target),
+			...link
+		}, context.env);
+		ask.step("Uploaded the variables as shared/.env");
+		return link;
+	}
+	async pushEnv(link, env) {
+		const text = Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n");
+		const file = shellQuote(`${link.project}/shared/.env`);
+		await this.sh(`umask 077 && cat > ${file}.new && chmod 600 ${file}.new && mv ${file}.new ${file}`, `${text}\n`);
+	}
+	async deploy(link, options) {
+		const { directory } = options;
+		const [commit = "", message = ""] = this.git([
+			"-C",
+			directory,
+			"log",
+			"-1",
+			"--format=%h%n%s"
+		]).toString("utf8").split("\n");
+		const id = deployId(/* @__PURE__ */ new Date(), commit || "local");
+		await this.lock(link, id);
+		const archive = this.git([
+			"-C",
+			directory,
+			"archive",
+			"--format=tar",
+			"HEAD"
+		]);
+		const release = shellQuote(`${link.project}/releases/${id}`);
+		await this.sh(`mkdir -p ${release} && tar -x -C ${release} && ln -sfn ../../shared/.env ${release}/.env`, archive);
+		await this.start(link, {
+			id,
+			release: id,
+			commit,
+			message,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, options.force);
+		return id;
+	}
+	async rollback(link, to) {
+		const deployments = await this.records(link, 50);
+		const current = (await this.sh(`readlink ${shellQuote(`${link.project}/current`)} || true`)).trim().replace(/^releases\//, "");
+		const releases = new Set((await this.sh(`ls -1 ${shellQuote(`${link.project}/releases`)}`)).split("\n").filter(Boolean));
+		let target;
+		if (to) {
+			target = deployments.find((item) => item.record.id === to)?.record;
+			if (!target) throw new Error(`There is no deploy ${to} on the server.`);
+		} else {
+			target = deployments.find((item) => item.status === "finished" && item.record.release !== current && releases.has(item.record.release))?.record;
+			if (!target) throw new Error("There is no earlier release on the server to roll back to.");
+		}
+		if (!releases.has(target.release)) throw new Error(`The release of ${target.id} is no longer on the server; only the last 5 are kept.`);
+		const id = deployId(/* @__PURE__ */ new Date(), "rollback");
+		await this.lock(link, id);
+		await this.start(link, {
+			id,
+			release: target.release,
+			commit: target.commit,
+			message: `Rollback to ${target.id}`,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			rollbackOf: target.id
+		}, false);
+		return id;
+	}
+	/** Takes the server's deploy lock, or fails when a deploy is running. */
+	async lock(link, id) {
+		const lock = shellQuote(`${link.project}/deploy.lock`);
+		const output = await this.sh(`
+if mkdir ${lock} 2>/dev/null; then echo ${id} > ${lock}/id; echo ok; exit 0; fi
+pid=$(cat ${lock}/pid 2>/dev/null)
+if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then echo "busy:$(cat ${lock}/id 2>/dev/null)"; exit 0; fi
+rm -rf ${lock} && mkdir ${lock} && echo ${id} > ${lock}/id && echo ok
+`);
+		const busy = output.match(/busy:(\S*)/);
+		if (busy) throw new Error(`Deploy ${busy[1]} is still running on the server. Follow it with dstack deploy status --watch.`);
+		if (!output.includes("ok")) throw new Error("Could not take the deploy lock on the server.");
+	}
+	async start(link, record, force) {
+		if (!ID.test(record.id) || !ID.test(record.release)) throw new Error(`Invalid deploy id ${record.id}.`);
+		const deploys = `${link.project}/deploys`;
+		const q = shellQuote;
+		const script = deployScript(link.project, link.application, record.id, record.release, force);
+		await this.sh(`
+cd ${q(deploys)} || exit 1
+cat > ${q(`${record.id}.sh`)}
+printf '%s\\n' ${q(JSON.stringify(record))} > ${q(`${record.id}.json`)}
+echo queued > ${q(`${record.id}.status`)}
+nohup sh ${q(`${record.id}.sh`)} > ${q(`${record.id}.log`)} 2>&1 < /dev/null &
+echo $! > ${q(`${record.id}.pid`)}
+echo $! > ${q(`${link.project}/deploy.lock/pid`)}
+`, script);
+	}
+	/** The newest deploy records first, with their status. */
+	async records(link, limit) {
+		const output = await this.sh(`
+cd ${shellQuote(`${link.project}/deploys`)} 2>/dev/null || exit 0
+for file in $(ls -1 *.json 2>/dev/null | sort -r | head -n ${Math.max(1, Math.floor(limit))}); do
+  id="\${file%.json}"
+  cat "$file"
+  pid=$(cat "$id.pid" 2>/dev/null)
+  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
+  printf '%s %s %s\\n' "$(cat "$id.status" 2>/dev/null || echo failed)" "$alive" "$(date -u -r "$id.status" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
+  echo ${MARK}
+done
+`);
+		const items = [];
+		for (const part of parts(`\n${output}`)) {
+			const lines = part.trim().split("\n");
+			if (lines.length < 2) continue;
+			try {
+				const record = JSON.parse(lines[0] ?? "");
+				const [status = "", alive = "0", updatedAt] = (lines[1] ?? "").split(" ");
+				items.push({
+					record,
+					status: recordStatus(status, alive === "1"),
+					updatedAt: updatedAt || void 0
+				});
+			} catch {}
+		}
+		return items;
+	}
+	async deployment(link, id) {
+		if (!ID.test(id)) throw new Error(`Invalid deploy id ${id}.`);
+		const deploys = shellQuote(`${link.project}/deploys`);
+		const output = await this.sh(`
+cd ${deploys} || exit 1
+[ -f ${shellQuote(`${id}.json`)} ] || { echo missing; exit 0; }
+cat ${shellQuote(`${id}.json`)}
+pid=$(cat ${shellQuote(`${id}.pid`)} 2>/dev/null)
+if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
+printf '%s %s %s\\n' "$(cat ${shellQuote(`${id}.status`)} 2>/dev/null || echo failed)" "$alive" "$(date -u -r ${shellQuote(`${id}.status`)} +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
+echo ${MARK}
+cat ${shellQuote(`${id}.log`)} 2>/dev/null
+`);
+		if (output.trim() === "missing") throw new Error(`There is no deploy ${id} on the server.`);
+		const [head = "", log = ""] = output.split(`\n${MARK}\n`);
+		const [json = "{}", state = ""] = head.split("\n");
+		const record = JSON.parse(json);
+		const [status = "", alive = "0", updatedAt] = state.split(" ");
+		return {
+			...toDeployment(record, recordStatus(status, alive === "1"), updatedAt || void 0),
+			log: log ? log.replace(/\n$/, "").split("\n").map((text) => ({
+				text,
+				stderr: false
+			})) : []
+		};
+	}
+	async deployments(link, limit) {
+		return (await this.records(link, limit)).map((item) => ({
+			...toDeployment(item.record, item.status, item.updatedAt),
+			log: []
+		}));
+	}
+	async status(link) {
+		const [ps = "", site = ""] = parts(await this.sh(`
+docker compose -p ${shellQuote(link.application)} ps --all --format json
+echo ${MARK}
+sed -n 's/^SITE_URL=//p' ${shellQuote(`${link.project}/shared/.env`)} 2>/dev/null
+`));
+		const { state, detail } = composeState(parseComposePs(ps));
+		const domain = site.trim().replace(/^["']|["']$/g, "");
+		return {
+			state,
+			detail,
+			domains: domain ? [domain] : []
+		};
+	}
+};
+function toDeployment(record, status, updatedAt) {
+	return {
+		id: record.id,
+		status,
+		commit: record.commit,
+		message: record.message,
+		createdAt: record.createdAt,
+		updatedAt
+	};
+}
+/**
+* A value for a Compose .env line: bare when safe, else single-quoted (taken
+* literally), or double-quoted with escapes when it holds a single quote.
+*/
+function envValue(value) {
+	if (/^[\w@%+=:,./-]*$/.test(value)) return value;
+	if (!value.includes("'") && !value.includes("\n")) return `'${value}'`;
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "$$$$").replace(/\n/g, "\\n")}"`;
+}
+function defaultGit(args) {
+	return execFileSync("git", args, {
+		maxBuffer: 1073741824,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+}
+const ssh = {
+	id: "ssh",
+	name: "SSH server",
+	auth: { kind: "ssh" },
+	source: "local",
+	target: {
+		label: "Server",
+		placeholder: "deploy@example.com",
+		normalize: (value) => formatTarget(parseTarget(value))
+	},
+	platformEnv: {},
+	setupFlags: [{
+		name: "path",
+		description: "The project directory on the server (default: /srv/<project>)"
+	}],
+	connect: (target) => new SshClient(target)
+};
+// src/deploy/dokploy.ts
+var DokployError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var DokployApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, procedure, input) {
+		let path = `${this.url}/api/${procedure}`;
+		if (method === "GET" && input) {
+			const query = new URLSearchParams();
+			for (const [key, value] of Object.entries(input)) if (value !== void 0) query.set(key, String(value));
+			path += `?${query}`;
+		}
+		let response;
+		try {
+			response = await this.fetchImpl(path, {
+				method,
+				headers: {
+					"x-api-key": this.token,
+					Accept: "application/json",
+					...method === "POST" ? { "Content-Type": "application/json" } : {}
+				},
+				body: method === "POST" ? JSON.stringify(input ?? {}) : void 0,
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new DokployError(`Could not reach Dokploy at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new DokployError(errorMessage(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (procedure, input) => this.request("GET", procedure, input);
+	post = (procedure, input) => this.request("POST", procedure, input);
+};
+function errorMessage(status, text, url) {
+	if (status === 401) return `Dokploy at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Create it as a user who may manage projects in Dokploy.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Dokploy; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? body.error?.message ?? "";
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Dokploy answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+/** A deployment's status: running, done, error or cancelled in Dokploy. */
+function dokployDeploymentStatus(value) {
+	if (value === "done") return "finished";
+	if (value === "running") return "building";
+	if (value === "queued" || value === "idle") return "queued";
+	if (value === "cancelled") return "cancelled";
+	return "failed";
+}
+/** The service state from the compose status, which tracks the last deploy. */
+function dokployAppState(value) {
+	if (value === "done") return "running";
+	if (value === "error") return "degraded";
+	if (value === "idle") return "stopped";
+	return "unknown";
+}
+/** A .env text for Dokploy, which writes it next to compose.yaml. */
+function envText(env) {
+	return Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n");
+}
+function composeUrl(api, link) {
+	return `${api.url}/dashboard/project/${link.project}/environment/${link.environment}/services/compose/${link.application}`;
+}
+/** Finds a name or id in a list. */
+function find(items, wanted, id, name) {
+	return items.find((item) => id(item) === wanted) ?? items.find((item) => name(item) === wanted);
+}
+const LOCAL_SERVER = "dokploy";
+var DokployClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new DokployApi(url, token, fetchImpl);
+	}
+	async verify() {
+		await this.api.get("project.all");
+		const version = await this.api.get("settings.getDokployVersion").catch(() => void 0);
+		return typeof version === "string" && version.trim() ? version.trim() : "(version unknown)";
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		if (!context.repository) throw new Error("Dokploy builds from a git repository; pass --repository.");
+		const api = this.api;
+		const servers = await api.get("server.all").catch(() => []) ?? [];
+		let serverId;
+		if (options.server && options.server !== LOCAL_SERVER) {
+			const server = find(servers, options.server, (item) => item.serverId, (item) => item.name);
+			if (!server) throw new Error(`Dokploy has no server ${options.server}.`);
+			serverId = server.serverId;
+		} else if (!options.server && servers.length && ask.interactive) {
+			const choice = await ask.select("Server to deploy to", [{
+				value: LOCAL_SERVER,
+				label: "The Dokploy server"
+			}, ...servers.map((item) => ({
+				value: item.serverId,
+				label: item.name,
+				hint: item.ipAddress
+			}))], LOCAL_SERVER);
+			serverId = choice === LOCAL_SERVER ? void 0 : choice;
+		}
+		const projects = await api.get("project.all") ?? [];
+		const projectName = options.project ?? context.name;
+		let project = find(projects, projectName, (item) => item.projectId, (item) => item.name);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const id = await ask.select("Dokploy project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.projectId,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.projectId ?? NEW);
+			project = id === NEW ? void 0 : find(projects, id, (item) => item.projectId, (item) => item.name);
+		}
+		if (!project) {
+			const created = await api.post("project.create", {
+				name: projectName,
+				description: "DjangoStack"
+			});
+			const projectId = created?.project?.projectId ?? created?.projectId;
+			if (!projectId) throw new Error("Dokploy created the project but did not return its id.");
+			project = {
+				projectId,
+				name: projectName
+			};
+			ask.step(`Created the Dokploy project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find(await api.get("environment.byProjectId", { projectId: project.projectId }).catch((error) => {
+			if (error.status === 404) throw new Error("This Dokploy has no environments; update Dokploy to a version with environments.");
+			throw error;
+		}) ?? [], environmentName, (item) => item.environmentId, (item) => item.name);
+		if (!environment) {
+			const environmentId = (await api.post("environment.create", {
+				name: environmentName,
+				projectId: project.projectId
+			}))?.environmentId ?? (await api.get("environment.byProjectId", { projectId: project.projectId })).find((item) => item.name === environmentName)?.environmentId;
+			if (!environmentId) throw new Error("Dokploy created the environment but did not return its id.");
+			environment = {
+				environmentId,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let composeId = (await api.post("compose.create", {
+			name: context.name,
+			environmentId: environment.environmentId,
+			projectId: project.projectId,
+			composeType: "docker-compose",
+			description: "DjangoStack",
+			...serverId ? { serverId } : {}
+		}))?.composeId;
+		if (!composeId) composeId = ((await api.get("environment.one", { environmentId: environment.environmentId }))?.compose ?? []).filter((item) => item.name === context.name).at(-1)?.composeId;
+		if (!composeId) throw new Error("Dokploy created the compose service but did not return its id.");
+		await api.post("compose.update", {
+			composeId,
+			sourceType: "git",
+			customGitUrl: context.repository,
+			customGitBranch: context.branch,
+			composePath: "./compose.yaml",
+			env: envText(context.env)
+		});
+		ask.step(`Created the compose service ${context.name} from ${context.repository} (${context.branch})`);
+		if (!(await api.get("domain.byComposeId", { composeId }).catch(() => []) ?? []).some((item) => item.host === context.domain)) await api.post("domain.create", {
+			host: context.domain,
+			path: "/",
+			port: 80,
+			https: true,
+			certificateType: "letsencrypt",
+			composeId,
+			serviceName: "proxy",
+			domainType: "compose"
+		});
+		ask.step(`Gave the proxy service https://${context.domain}`);
+		return {
+			project: project.projectId,
+			environment: environment.environmentId,
+			application: composeId
+		};
+	}
+	async pushEnv(link, env) {
+		await this.api.post("compose.update", {
+			composeId: link.application,
+			env: envText(env)
+		});
+	}
+	async deploy(link) {
+		const before = new Set((await this.raw(link)).map((item) => item.deploymentId));
+		await this.api.post("compose.deploy", {
+			composeId: link.application,
+			title: "dstack deploy"
+		});
+		for (let attempt = 0; attempt < 20; attempt++) {
+			const fresh = (await this.raw(link)).find((item) => !before.has(item.deploymentId));
+			if (fresh) return fresh.deploymentId;
+			await new Promise((resolve) => setTimeout(resolve, this.pollMs));
+		}
+		throw new Error(`Dokploy took the deploy but shows no deployment for it yet. See ${composeUrl(this.api, link)}`);
+	}
+	/** How long `deploy` waits between looks for the new deployment; tests set it to 0. */
+	pollMs = 1e3;
+	/** The deployments, newest first. */
+	async raw(link) {
+		return [...await this.api.get("deployment.allByCompose", { composeId: link.application }) ?? []].sort((a, b) => String(b.createdAt ?? "").localeCompare(String(a.createdAt ?? "")));
+	}
+	toDeployment(link, item) {
+		const status = dokployDeploymentStatus(item.status);
+		const url = composeUrl(this.api, link);
+		return {
+			id: item.deploymentId,
+			status,
+			message: item.title && item.title !== "dstack deploy" ? item.title : (item.description ?? void 0) || void 0,
+			createdAt: item.createdAt,
+			updatedAt: item.finishedAt ?? item.startedAt ?? void 0,
+			url,
+			log: [...item.errorMessage ? [{
+				text: item.errorMessage,
+				stderr: true
+			}] : [], {
+				text: `Dokploy shows the build log in its dashboard: ${url} (Deployments)`,
+				stderr: false
+			}]
+		};
+	}
+	async deployment(link, id) {
+		const item = (await this.raw(link)).find((deployment) => deployment.deploymentId === id);
+		if (!item) throw new Error(`Dokploy has no deployment ${id} for this service.`);
+		return this.toDeployment(link, item);
+	}
+	async deployments(link, limit) {
+		return (await this.raw(link)).slice(0, limit).map((item) => ({
+			...this.toDeployment(link, item),
+			log: []
+		}));
+	}
+	async status(link) {
+		const compose = await this.api.get("compose.one", { composeId: link.application });
+		const domains = (compose.domains ?? []).map((item) => `${item.https === false ? "http" : "https"}://${item.host}`);
+		return {
+			state: dokployAppState(compose.composeStatus),
+			detail: compose.composeStatus ?? "unknown",
+			domains,
+			branch: compose.customGitBranch ?? void 0,
+			url: composeUrl(this.api, link)
+		};
+	}
+};
+const dokploy = {
+	id: "dokploy",
+	name: "Dokploy",
+	auth: {
+		kind: "token",
+		env: "DSTACK_DOKPLOY_TOKEN",
+		help: (url) => `Create one in Dokploy under Settings › Profile › API/CLI (${url}/dashboard/settings/profile), as a user who may create projects.`
+	},
+	source: "remote",
+	target: urlTarget("Dokploy", "https://dokploy.example.com"),
+	platformEnv: PLATFORM_ENV,
+	setupFlags: SHARED_SETUP_FLAGS,
+	connect: (url, token) => {
+		if (!token) throw new Error("Dokploy needs an API key.");
+		return new DokployClient(url, token);
+	}
+};
+// src/deploy/credentials.ts
+/**
+* API keys of deploy providers, never in the project: the OS keychain
+* (macOS Keychain, Windows Credential Manager, the Secret Service on Linux),
+* or a file only the user can read where there is no keychain. An
+* environment variable such as DSTACK_COOLIFY_TOKEN overrides both, for CI.
+*/
+const SERVICE = "dstack";
+function systemKeyring() {
+	try {
+		const { Entry } = createRequire(import.meta.url)("@napi-rs/keyring");
+		return {
+			get: (account) => new Entry(SERVICE, account).getPassword() ?? void 0,
+			set: (account, token) => new Entry(SERVICE, account).setPassword(token),
+			delete: (account) => void new Entry(SERVICE, account).deletePassword()
+		};
+	} catch {
+		return null;
+	}
+}
+/** The account a key is saved under: one per provider and instance. */
+function accountFor(provider, url) {
+	return `${provider}:${url}`;
+}
+function credentialsFile() {
+	const base = process.env.XDG_CONFIG_HOME || process.platform === "win32" && process.env.APPDATA || join(homedir(), ".config");
+	return join(base, "dstack", "credentials.json");
+}
+function readFile() {
+	const path = credentialsFile();
+	if (!existsSync(path)) return {};
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {};
+	}
+}
+function writeFile(values) {
+	const path = credentialsFile();
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	writeFileSync(path, `${JSON.stringify(values, null, 2)}\n`, { mode: 384 });
+	chmodSync(path, 384);
+}
+function getToken(provider, url, envName) {
+	const fromEnv = process.env[envName];
+	if (fromEnv) return {
+		token: fromEnv,
+		source: "env"
+	};
+	const account = accountFor(provider, url);
+	const keyring = systemKeyring();
+	if (keyring) try {
+		const token = keyring.get(account);
+		if (token) return {
+			token,
+			source: "keychain"
+		};
+	} catch {}
+	const token = readFile()[account];
+	return token ? {
+		token,
+		source: "file"
+	} : void 0;
+}
+/** Saves a key in the keychain, or in the credentials file when there is none. */
+function saveToken(provider, url, token) {
+	const account = accountFor(provider, url);
+	const keyring = systemKeyring();
+	if (keyring) try {
+		keyring.set(account, token);
+		removeFromFile(account);
+		return "keychain";
+	} catch {}
+	writeFile({
+		...readFile(),
+		[account]: token
+	});
+	return "file";
+}
+function removeFromFile(account) {
+	const values = readFile();
+	if (!(account in values)) return false;
+	delete values[account];
+	writeFile(values);
+	return true;
+}
+/** Removes a key from the keychain and the file; returns whether there was one. */
+function deleteToken(provider, url) {
+	const account = accountFor(provider, url);
+	let removed = false;
+	const keyring = systemKeyring();
+	if (keyring) try {
+		if (keyring.get(account)) {
+			keyring.delete(account);
+			removed = true;
+		}
+	} catch {}
+	return removeFromFile(account) || removed;
+}
+// src/deploy/link.ts
+/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
+const LINK_FILE = ".dstack/deploy.json";
+function readLink(directory) {
+	const path = join(directory, LINK_FILE);
+	if (!existsSync(path)) return void 0;
+	let link;
+	try {
+		link = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new Error(`${LINK_FILE} is not valid JSON.`);
+	}
+	for (const key of [
+		"provider",
+		"url",
+		"project",
+		"environment",
+		"application"
+	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
+	return link;
+}
+function writeLink(directory, link) {
+	const path = join(directory, LINK_FILE);
+	mkdirSync(dirname(path), { recursive: true });
+	const { provider, url, project, environment, application } = link;
+	writeFileSync(path, `${JSON.stringify({
+		provider,
+		url,
+		project,
+		environment,
+		application
+	}, null, 2)}\n`);
+}
+/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
+function httpsRepository(remote) {
+	const value = remote.trim();
+	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
+	let url;
+	if (scp) url = `https://${scp[1]}/${scp[2]}`;
+	else try {
+		const parsed = new URL(value);
+		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
+	} catch {
+		throw new Error(`Cannot read the git remote ${value}.`);
+	}
+	return url.replace(/\.git$/, "").replace(/\/$/, "");
+}
+function git(directory, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: directory,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+}
+function gitRemote(directory, remote = "origin") {
+	return git(directory, [
+		"remote",
+		"get-url",
+		remote
+	]) || void 0;
+}
+function gitBranch(directory) {
+	const branch = git(directory, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return branch && branch !== "HEAD" ? branch : void 0;
+}
+/**
+* Why a deploy of `branch` would not include the local commit, or undefined
+* when origin has it. The platform builds from the remote, not from here.
+*/
+function unpushedReason(directory, branch) {
+	const head = git(directory, ["rev-parse", "HEAD"]);
+	if (!head) return void 0;
+	if (git(directory, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
+	if (git(directory, [
+		"merge-base",
+		"--is-ancestor",
+		head,
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
+}
+/**
+* Why an upload of HEAD would not match the working tree, or undefined when
+* it does. Providers that upload the local commit deploy HEAD only, so
+* changes to tracked files must be committed first.
+*/
+function uncommittedReason(directory) {
+	if (git(directory, ["rev-parse", "HEAD"]) === void 0) return "This project has no commit yet. Commit it first: git add -A && git commit";
+	if (git(directory, [
+		"status",
+		"--porcelain",
+		"--untracked-files=no"
+	])) return "You have uncommitted changes, so the deploy would not include them. Commit first.";
+}
+// src/deploy/index.ts
+const DEFAULT_PROVIDER = coolify;
+/** Every deploy provider. */
+const PROVIDERS = [
+	coolify,
+	dokploy,
+	ssh
+];
+function getProvider(id) {
+	const provider = PROVIDERS.find((item) => item.id === id);
+	if (!provider) throw new Error(`Unknown deploy provider ${id}. Choose one of: ${PROVIDERS.map((p) => p.id).join(", ")}.`);
+	return provider;
+}
+// src/project.ts
+/** The `.env` of `dstack run` on a development machine: the prod profile at https://site.localhost. */
+const RUN_ENV = ".env.run";
+const RUN_DOMAIN = "site.localhost";
+/** The project directory: `start` or the nearest parent with `compose.yaml` and `.env`. */
+function findProjectDirectory(start) {
+	let directory = resolve(start);
+	for (;;) {
+		if (existsSync(join(directory, "compose.yaml")) && existsSync(join(directory, ".env"))) return directory;
+		const parent = dirname(directory);
+		if (parent === directory) return void 0;
+		directory = parent;
+	}
+}
+function parseProfiles(value) {
+	return (value ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
+}
+function projectName(directory) {
+	try {
+		const match = readFileSync(join(directory, "compose.yaml"), "utf8").match(/^name:\s*["']?([\w.-]+)/m);
+		if (match?.[1]) return match[1];
+	} catch {}
+	return basename(directory).toLowerCase();
+}
+function fromEnv(directory, name, envFile, localRun) {
+	const env = parseEnv(readFileSync(join(directory, envFile), "utf8"));
+	const profiles = parseProfiles(env.COMPOSE_PROFILES);
+	const prod = profiles.includes("prod");
+	const suffix = prod ? "-prod" : "";
+	return {
+		directory,
+		name: localRun ? `${name}-run` : name,
+		env,
+		profiles,
+		prod,
+		localRun,
+		services: {
+			backend: `backend${suffix}`,
+			frontend: `frontend${suffix}`,
+			worker: `worker${suffix}`
+		},
+		composeArgs: localRun ? [
+			"--env-file",
+			envFile,
+			"--project-name",
+			`${name}-run`
+		] : [],
+		composeEnv: localRun ? {
+			ENV_FILE: envFile,
+			COMPOSE_PROFILES: env.COMPOSE_PROFILES ?? ""
+		} : {}
+	};
+}
+/** Reads the project in or above `start`. Throws with a one-line reason when there is none. */
+function readProject(start = ".") {
+	const directory = findProjectDirectory(start);
+	if (!directory) throw new Error(`No DjangoStack project in ${resolve(start)}: run this where compose.yaml and .env are.`);
+	return fromEnv(directory, projectName(directory), ".env", false);
+}
+/** The local production run of a development project, when `.env.run` exists. */
+function readLocalRun(project) {
+	if (project.prod || project.localRun || !existsSync(join(project.directory, ".env.run"))) return void 0;
+	return fromEnv(project.directory, projectName(project.directory), RUN_ENV, true);
+}
+/** The `django-stack` section of the project's `package.json`. */
+function projectManifest(project) {
+	try {
+		return JSON.parse(readFileSync(join(project.directory, "package.json"), "utf8"))["django-stack"] ?? {};
+	} catch {
+		return {};
+	}
+}
+/**
+* The project's stack: from the preset `init` saved in `package.json`, or,
+* for projects from before that, the defaults with the storage from `.env`.
+*/
+function projectStack(project) {
+	const { preset } = projectManifest(project);
+	if (preset) try {
+		return decodePreset(preset);
+	} catch {}
+	return {
+		...DEFAULT_STACK,
+		storage: project.profiles.includes("s3") ? "s3" : "local"
+	};
+}
+/** The URLs of a running project. */
+function projectUrls(project) {
+	if (project.prod) {
+		const site = (project.env.SITE_URL ?? "").replace(/\/$/, "");
+		return [{
+			label: "Site",
+			url: `${site}/`
+		}, {
+			label: "Admin",
+			url: `${site}/admin/`
+		}];
+	}
+	const urls = [
+		{
+			label: "Site",
+			url: "http://localhost:3000"
+		},
+		{
+			label: "Admin",
+			url: "http://localhost:3000/admin/"
+		},
+		{
+			label: "Mail",
+			url: "http://localhost:8025"
+		}
+	];
+	if (project.profiles.includes("s3")) urls.push({
+		label: "S3",
+		url: "http://localhost:8333"
+	});
+	return urls;
+}
+/** Runs a command with the terminal attached and returns its exit status. */
+const runInherit = (cmd, args, options) => {
+	const result = spawnSync(cmd, args, {
+		stdio: "inherit",
+		...options
+	});
+	if (result.error) return 127;
+	return result.status ?? 1;
+};
+/** The full `docker compose` argument list for a project. */
+function composeCommand(project, args) {
+	return [
+		"compose",
+		...project.composeArgs,
+		...args
+	];
+}
+function composeOptions(project) {
+	return {
+		cwd: project.directory,
+		env: {
+			...process.env,
+			...project.composeEnv
+		}
+	};
+}
+/** Runs `docker compose <args>` for the project with the terminal attached. */
+function compose(project, args, run = runInherit) {
+	return run("docker", composeCommand(project, args), composeOptions(project));
+}
+/** Runs `docker compose <args>` and captures the output. */
+function composeOutput(project, args) {
+	const result = spawnSync("docker", composeCommand(project, args), {
+		...composeOptions(project),
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	return {
+		status: result.status ?? 1,
+		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
+	};
+}
+/** The running services of the project. */
+function runningServices(project) {
+	const result = spawnSync("docker", composeCommand(project, [
+		"ps",
+		"--services",
+		"--filter",
+		"status=running"
+	]), {
+		...composeOptions(project),
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		]
+	});
+	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
+}
+/**
+* The project a command acts on: the local production run when it is the
+* one running, otherwise the project `.env` describes.
+*/
+function activeProject(project) {
+	const localRun = readLocalRun(project);
+	if (!localRun) return project;
+	if (runningServices(project).length) return project;
+	return runningServices(localRun).length ? localRun : project;
+}
 // src/ui.ts
 /** The DjangoStack badge with the version and an optional title. */
 function intro(title) {
@@ -18,24 +1489,454 @@ function fail(message) {
 	p.cancel(pc.red(message));
 	process.exit(1);
 }
-function unwrap(value) {
-	if (p.isCancel(value)) fail("Cancelled.");
-	return value;
+function unwrap(value) {
+	if (p.isCancel(value)) fail("Cancelled.");
+	return value;
+}
+function has(command, args = ["--version"]) {
+	try {
+		execFileSync(command, args, { stdio: "ignore" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+const url = (value) => pc.cyan(pc.underline(value));
+const command = (value) => pc.cyan(value);
+const secret = (value) => pc.bold(pc.yellow(value));
+/** Prompts only when stdin is a terminal and `--yes` was not passed. */
+function isInteractive(yes) {
+	return !yes && Boolean(process.stdin.isTTY);
+}
+/** Logs a check, with its help lines when it did not pass. */
+function logCheck(check) {
+	const head = check.detail ? `${check.name} ${pc.dim(`- ${check.detail}`)}` : check.name;
+	const help = !check.ok && check.help ? check.help.map((line) => pc.dim(line)) : [];
+	const text = [check.ok ? head : check.warning ? pc.yellow(head) : pc.red(head), ...help].join("\n");
+	if (check.ok) p.log.success(text);
+	else if (check.warning) p.log.warn(text);
+	else p.log.error(text);
+}
+// src/commands/deploy.ts
+const PRODUCTION_ENV = ".env.production";
+function projectOrFail(options) {
+	try {
+		return readProject(options.dir ?? ".");
+	} catch (error) {
+		fail(error.message);
+	}
+}
+function linkOrFail(directory) {
+	let link;
+	try {
+		link = readLink(directory);
+	} catch (error) {
+		fail(error.message);
+	}
+	if (!link) fail(`This project is not set up for deploys yet. Run ${command("dstack deploy setup")}.`);
+	return link;
+}
+function providerOrFail(id) {
+	try {
+		return getProvider(id);
+	} catch (error) {
+		fail(error.message);
+	}
+}
+/** Runs a provider call; a failure ends the command with its one-line reason. */
+async function attempt(work, spinner) {
+	try {
+		return await work;
+	} catch (error) {
+		spinner?.error("Failed");
+		fail(error.message);
+	}
+}
+/** The variables for the platform: .env.production plus what the platform needs. */
+function deployEnv(directory, provider) {
+	let file = join(directory, PRODUCTION_ENV);
+	if (!existsSync(file)) {
+		if (!(parseEnv(readFileSync(join(directory, ".env"), "utf8")).COMPOSE_PROFILES ?? "").split(",").includes("prod")) fail(`${PRODUCTION_ENV} does not exist. Run ${command("dstack production --domain example.com")} first.`);
+		file = join(directory, ".env");
+	}
+	return {
+		...parseEnv(readFileSync(file, "utf8")),
+		...provider.platformEnv
+	};
+}
+/** The API key settings of a provider, or a one-line failure for one that uses SSH. */
+function tokenAuth(provider) {
+	if (provider.auth.kind !== "token") fail(`${provider.name} uses your SSH keys and ~/.ssh/config; there is no API key to save.`);
+	return provider.auth;
+}
+async function askToken(provider, instance) {
+	p.log.info(tokenAuth(provider).help(instance));
+	return unwrap(await p.password({
+		message: `${provider.name} API key`,
+		validate: (value) => value?.trim() ? void 0 : "Paste the API key."
+	})).trim();
+}
+/** Checks a key and saves it; returns it. */
+async function login(provider, instance, token) {
+	const spinner = p.spinner();
+	spinner.start(`Checking the key with ${instance}`);
+	const version = await attempt(provider.connect(instance, token).verify(), spinner);
+	spinner.stop(`${provider.name} ${version} accepts the key`);
+	if (saveToken(provider.id, instance, token) === "keychain") p.log.success("Saved the key in the system keychain.");
+	else p.log.warn(`There is no system keychain here, so the key is in ~/.config/dstack/credentials.json, readable only by you. Set ${tokenAuth(provider).env} instead to keep it off disk.`);
+	return token;
+}
+/** A client for a provider target: the saved key, or a new one when the CLI may ask. */
+async function connect(provider, instance, interactive) {
+	if (provider.auth.kind === "ssh") return attempt(Promise.resolve().then(() => provider.connect(instance)));
+	const saved = getToken(provider.id, instance, provider.auth.env);
+	if (saved) return provider.connect(instance, saved.token);
+	if (!interactive) fail(`No ${provider.name} API key for ${instance}. Run ${command("dstack deploy login")} or set ${provider.auth.env}.`);
+	const token = await login(provider, instance, await askToken(provider, instance));
+	return provider.connect(instance, token);
+}
+function promptAsk(interactive) {
+	return {
+		interactive,
+		async select(message, choices, initial) {
+			if (!interactive) {
+				if (initial !== void 0) return initial;
+				fail(`${message}: pass it as a flag; see ${command("dstack deploy setup --help")}.`);
+			}
+			return unwrap(await p.select({
+				message,
+				initialValue: initial,
+				options: choices.map((choice) => ({
+					value: choice.value,
+					label: choice.label,
+					hint: choice.hint
+				}))
+			}));
+		},
+		async text(message, options = {}) {
+			if (!interactive) {
+				if (options.initial) return options.initial;
+				fail(`${message}: pass it as a flag.`);
+			}
+			return unwrap(await p.text({
+				message,
+				placeholder: options.placeholder,
+				initialValue: options.initial
+			}));
+		},
+		async confirm(message, initial = true) {
+			if (!interactive) return initial;
+			return unwrap(await p.confirm({
+				message,
+				initialValue: initial
+			}));
+		},
+		step: (message) => p.log.success(message)
+	};
+}
+/** `dstack deploy setup`: create the application on the platform and link the project to it. */
+async function deploySetup(options) {
+	const interactive = isInteractive(options.yes);
+	const project = projectOrFail(options);
+	intro("Deploy setup");
+	const existing = existsSync(join(project.directory, ".dstack/deploy.json")) ? readLink(project.directory) : void 0;
+	if (existing && !options.force) fail(`This project already deploys to ${existing.url} (${LINK_FILE}). Pass --force to set it up again.`);
+	let providerId = options.provider;
+	if (!providerId) providerId = PROVIDERS.length === 1 || !interactive ? DEFAULT_PROVIDER.id : unwrap(await p.select({
+		message: "Platform",
+		options: PROVIDERS.map((item) => ({
+			value: item.id,
+			label: item.name
+		}))
+	}));
+	const provider = providerOrFail(providerId);
+	let instance = options.url;
+	if (!instance) {
+		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
+		instance = unwrap(await p.text({
+			message: provider.target.label,
+			placeholder: provider.target.placeholder,
+			validate: (value) => {
+				try {
+					provider.target.normalize(value ?? "");
+				} catch (error) {
+					return error.message;
+				}
+			}
+		}));
+	}
+	try {
+		instance = provider.target.normalize(instance);
+	} catch (error) {
+		fail(error.message);
+	}
+	const env = deployEnv(project.directory, provider);
+	const domain = (env.SITE_URL ?? "").replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+	if (!domain || domain.endsWith("localhost")) fail(`SITE_URL in ${PRODUCTION_ENV} is not a public domain. Run ${command("dstack production --domain example.com --force")}.`);
+	let repository = options.repository;
+	if (provider.source === "remote") {
+		if (!repository) {
+			const remote = gitRemote(project.directory);
+			if (!remote) fail("This project has no git remote origin. Push it to GitHub first, or pass --repository.");
+			repository = remote;
+		}
+		try {
+			repository = httpsRepository(repository);
+		} catch (error) {
+			fail(error.message);
+		}
+	}
+	const branch = options.branch ?? gitBranch(project.directory) ?? "main";
+	const client = await connect(provider, instance, interactive);
+	await attempt(client.verify());
+	const flags = {};
+	for (const flag of provider.setupFlags) flags[flag.name] = options[flag.name];
+	const ids = await attempt(client.setup({
+		ask: promptAsk(interactive),
+		name: project.name,
+		repository,
+		branch,
+		domain,
+		env,
+		options: flags
+	}));
+	const link = {
+		provider: provider.id,
+		url: instance,
+		...ids
+	};
+	writeLink(project.directory, link);
+	p.log.success(`Wrote ${pc.bold(LINK_FILE)}. It holds no secrets; commit it so others deploy to the same place.`);
+	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.auth.kind === "ssh" ? "" : `${provider.name} `}server.`, provider.auth.kind === "ssh" ? `To change variables, edit ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.` : `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
+	if (options.deploy ?? (interactive ? unwrap(await p.confirm({
+		message: "Deploy now?",
+		initialValue: true
+	})) : false)) {
+		await startDeploy(project.directory, provider, link, client, {
+			force: false,
+			wait: true
+		});
+		return;
+	}
+	p.outro(`Deploy with ${command("dstack deploy")}`);
+}
+const STATUS_LABEL = {
+	queued: pc.dim("queued"),
+	building: pc.yellow("building"),
+	finished: pc.green("finished"),
+	failed: pc.red("failed"),
+	cancelled: pc.dim("cancelled")
+};
+const DONE = /* @__PURE__ */ new Set([
+	"finished",
+	"failed",
+	"cancelled"
+]);
+const POLL_MS = 3e3;
+const WAIT_LIMIT_MS = 27e5;
+function printLog(deployment, lines) {
+	const log = lines ? deployment.log.slice(-lines) : deployment.log;
+	for (const line of log) process.stdout.write(`${line.stderr ? pc.red(line.text) : line.text}\n`);
+}
+async function follow(link, client, id) {
+	const spinner = p.spinner();
+	spinner.start("Queued");
+	const started = Date.now();
+	let deployment;
+	for (;;) {
+		deployment = await attempt(client.deployment(link, id), spinner);
+		if (DONE.has(deployment.status)) break;
+		const last = deployment.log.at(-1)?.text.trim().slice(0, 70);
+		const seconds = Math.round((Date.now() - started) / 1e3);
+		spinner.message(`${deployment.status === "queued" ? "Queued" : "Building"} ${pc.dim(`${seconds}s`)}${last ? pc.dim(` ${last}`) : ""}`);
+		if (Date.now() - started > WAIT_LIMIT_MS) {
+			spinner.stop("Still running");
+			fail(`The deploy takes longer than 45 minutes. Follow it with ${command("dstack deploy status")}.`);
+		}
+		await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+	}
+	const seconds = Math.round((Date.now() - started) / 1e3);
+	const summary = `${STATUS_LABEL[deployment.status]} after ${seconds}s`;
+	if (deployment.status === "finished") spinner.stop(summary);
+	else spinner.error(summary);
+	return deployment;
+}
+/** Why the deploy would not include the local work, or undefined. */
+async function notDeployedReason(directory, provider, link, client) {
+	if (provider.source === "local") return uncommittedReason(directory);
+	const status = await attempt(client.status(link));
+	return status.branch ? unpushedReason(directory, status.branch) : void 0;
+}
+async function startDeploy(directory, provider, link, client, options) {
+	if (options.pushCheck !== false) {
+		const reason = await notDeployedReason(directory, provider, link, client);
+		if (reason) fail(`${reason} Or pass --no-push-check.`);
+	}
+	await finishDeploy(link, client, await attempt(client.deploy(link, {
+		force: options.force,
+		directory
+	})), options.wait);
+}
+/** Follows a started deploy, or reports where it runs when not waiting. */
+async function finishDeploy(link, client, id, wait) {
+	if (!wait) {
+		const deployment = await attempt(client.deployment(link, id));
+		p.outro(`Started deploy ${pc.bold(id)}${deployment.url ? `: ${url(deployment.url)}` : ""}. Follow it with ${command("dstack deploy status --watch")}`);
+		return;
+	}
+	p.log.message(pc.dim("Ctrl+C stops following; the deploy goes on."));
+	const deployment = await follow(link, client, id);
+	if (deployment.status !== "finished") {
+		printLog(deployment, 40);
+		fail(`The deploy ${deployment.status === "cancelled" ? "was cancelled" : "failed"}. Full log: ${command(`dstack deploy logs ${id}`)}`);
+	}
+	const status = await attempt(client.status(link));
+	p.outro(`Deployed${status.domains.length ? `: ${status.domains.map(url).join(" ")}` : ""}`);
+}
+/** `dstack deploy`: start a deploy and follow it. */
+async function deploy(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro(`Deploy to ${provider.name}`);
+	const client = await connect(provider, link.url, isInteractive(options.yes));
+	await startDeploy(project.directory, provider, link, client, {
+		force: Boolean(options.force),
+		wait: options.wait,
+		pushCheck: options.pushCheck
+	});
+}
+function ago(date) {
+	if (!date) return "";
+	const seconds = Math.max(0, Math.round((Date.now() - new Date(date).getTime()) / 1e3));
+	if (Number.isNaN(seconds)) return "";
+	if (seconds < 60) return `${seconds}s ago`;
+	if (seconds < 3600) return `${Math.round(seconds / 60)} min ago`;
+	if (seconds < 86400) return `${Math.round(seconds / 3600)} h ago`;
+	return `${Math.round(seconds / 86400)} d ago`;
+}
+const STATE_LABEL = {
+	running: pc.green("running"),
+	degraded: pc.yellow("degraded"),
+	stopped: pc.red("stopped"),
+	unknown: pc.dim("unknown")
+};
+/** `dstack deploy status`: the application's state and its last deploys. */
+async function deployStatus(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro(`${provider.name} status`);
+	const client = await connect(provider, link.url, isInteractive(false));
+	const limit = Math.max(1, Number.parseInt(options.limit, 10) || 5);
+	const [status, deployments] = await Promise.all([attempt(client.status(link)), attempt(client.deployments(link, limit))]);
+	p.note([
+		`${pc.bold("State")}   ${STATE_LABEL[status.state]} ${pc.dim(`(${status.detail})`)}`,
+		...status.domains.length ? [`${pc.bold("Site")}    ${status.domains.map(url).join(" ")}`] : [],
+		...status.branch ? [`${pc.bold("Branch")}  ${status.branch}`] : [],
+		...status.url ? [`${pc.bold(provider.name.padEnd(7))} ${url(status.url)}`] : []
+	].join("\n"), project.name);
+	if (deployments.length) p.log.message(deployments.map((item) => [
+		STATUS_LABEL[item.status].padEnd(18),
+		pc.dim(ago(item.createdAt).padEnd(11)),
+		item.commit ? pc.cyan(item.commit) : pc.dim("-------"),
+		item.message ?? ""
+	].join("  ")).join("\n"), { symbol: pc.dim("│") });
+	else p.log.message(pc.dim("No deploys yet."));
+	const running = deployments.find((item) => !DONE.has(item.status));
+	if (running && options.watch) {
+		const deployment = await follow(link, client, running.id);
+		if (deployment.status !== "finished") {
+			printLog(deployment, 40);
+			fail(`The deploy failed. Full log: ${command(`dstack deploy logs ${running.id}`)}`);
+		}
+	} else if (running) {
+		p.outro(`A deploy is ${running.status}. Follow it with ${command("dstack deploy status --watch")}`);
+		return;
+	}
+	p.outro(pc.green("Done"));
+}
+/** `dstack deploy logs [deployment]`: the build log of a deploy, the latest by default. */
+async function deployLogs(id, options) {
+	const link = linkOrFail(projectOrFail(options).directory);
+	const client = await connect(providerOrFail(link.provider), link.url, isInteractive(false));
+	let deploymentId = id;
+	if (!deploymentId) {
+		const [latest] = await attempt(client.deployments(link, 1));
+		if (!latest) fail("There are no deploys yet.");
+		deploymentId = latest.id;
+	}
+	const deployment = await attempt(client.deployment(link, deploymentId));
+	printLog(deployment);
+	process.stderr.write(pc.dim(`Deploy ${deployment.id}: ${deployment.status}\n`));
+	if (deployment.status === "failed") process.exitCode = 1;
+}
+/** `dstack deploy rollback [deployment]`: run an earlier release again. */
+async function deployRollback(id, options) {
+	const link = linkOrFail(projectOrFail(options).directory);
+	const provider = providerOrFail(link.provider);
+	intro(`Roll back on ${provider.name}`);
+	const client = await connect(provider, link.url, isInteractive(options.yes));
+	if (!client.rollback) fail(`${provider.name} keeps no releases to roll back to. Deploy an earlier commit, or roll back in ${provider.name}.`);
+	const rollbackId = await attempt(client.rollback(link, id));
+	p.log.info(pc.dim("The database is not rolled back; migrations of the newer release stay applied."));
+	await finishDeploy(link, client, rollbackId, options.wait);
+}
+/** `dstack deploy env push`: upload .env.production to the platform again. */
+async function deployEnvPush(options) {
+	const project = projectOrFail(options);
+	const link = linkOrFail(project.directory);
+	const provider = providerOrFail(link.provider);
+	intro("Push variables");
+	const interactive = isInteractive(options.yes);
+	const env = deployEnv(project.directory, provider);
+	if (interactive && !unwrap(await p.confirm({ message: `Replace ${Object.keys(env).length} variables in ${provider.name} with the values from ${PRODUCTION_ENV}?` }))) fail("Cancelled.");
+	await attempt((await connect(provider, link.url, interactive)).pushEnv(link, env));
+	p.outro(`Set ${Object.keys(env).length} variables. They apply on the next ${command("dstack deploy")}`);
 }
-function has(command, args = ["--version"]) {
+async function loginTarget(options, interactive) {
+	let link;
 	try {
-		execFileSync(command, args, { stdio: "ignore" });
-		return true;
-	} catch {
-		return false;
+		link = readLink(readProject(options.dir ?? ".").directory);
+	} catch {}
+	const provider = providerOrFail(options.provider ?? link?.provider ?? DEFAULT_PROVIDER.id);
+	tokenAuth(provider);
+	let instance = options.url ?? link?.url;
+	if (!instance) {
+		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
+		instance = unwrap(await p.text({
+			message: provider.target.label,
+			placeholder: provider.target.placeholder
+		}));
+	}
+	try {
+		return {
+			provider,
+			instance: provider.target.normalize(instance)
+		};
+	} catch (error) {
+		fail(error.message);
 	}
 }
-const url = (value) => pc.cyan(pc.underline(value));
-const command = (value) => pc.cyan(value);
-const secret = (value) => pc.bold(pc.yellow(value));
-/** Prompts only when stdin is a terminal and `--yes` was not passed. */
-function isInteractive(yes) {
-	return !yes && Boolean(process.stdin.isTTY);
+/** `dstack deploy login`: check and save an API key. */
+async function deployLogin(options) {
+	const interactive = isInteractive(options.yes);
+	intro("Deploy login");
+	const { provider, instance } = await loginTarget(options, interactive);
+	const auth = tokenAuth(provider);
+	let token = options.token ?? (options.yes ? process.env[auth.env] : void 0);
+	if (!token) {
+		if (!interactive) fail(`Pass --token or set ${auth.env}.`);
+		token = await askToken(provider, instance);
+	}
+	await login(provider, instance, token);
+	p.outro(pc.green("Done"));
+}
+/** `dstack deploy logout`: remove a saved API key. */
+async function deployLogout(options) {
+	const { provider, instance } = await loginTarget(options, isInteractive(false));
+	if (deleteToken(provider.id, instance)) p.log.success(`Removed the ${provider.name} key for ${instance}.`);
+	else p.log.info(`There was no saved ${provider.name} key for ${instance}.`);
 }
 // src/commands/doctor.ts
 async function doctor(directoryArgument) {
@@ -45,12 +1946,7 @@ async function doctor(directoryArgument) {
 	spinner.start("Checking the project and its services");
 	const checks = await runDoctor(directory);
 	spinner.clear();
-	for (const check of checks) {
-		const line = check.detail ? `${check.name} ${pc.dim(`- ${check.detail}`)}` : check.name;
-		if (check.ok) p.log.success(line);
-		else if (check.warning) p.log.warn(pc.yellow(line));
-		else p.log.error(pc.red(line));
-	}
+	for (const check of checks) logCheck(check);
 	const failed = checks.filter((check) => !check.ok && !check.warning).length;
 	if (failed) {
 		p.outro(pc.red(`${failed} ${failed === 1 ? "check" : "checks"} failed`));
@@ -141,7 +2037,7 @@ function updateCommand(location = import.meta.url, env = process.env) {
 	if (path.includes("/pnpm/global/")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
 	if (path.includes("/.bun/install/global/")) return `bun add -g ${PACKAGE_NAME}@latest`;
 	if (env.npm_config_user_agent?.startsWith("pnpm")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
-	return `npm install -g ${PACKAGE_NAME}@latest`;
+	return `npm i -g ${PACKAGE_NAME}@latest`;
 }
 // src/global-install.ts
 /** The name of the installed command. */
@@ -187,8 +2083,8 @@ function installCommand(runner = "npm") {
 	];
 	return [
 		"npm",
-		"install",
-		"--global",
+		"i",
+		"-g",
 		`${PACKAGE_NAME}@latest`
 	];
 }
@@ -363,9 +2259,24 @@ function systemTimeZone() {
 		return "UTC";
 	}
 }
+/**
+* Checks Docker, Node.js and Python before the prompts. Problems only warn:
+* the project is created anyway, and Node.js and Python are for development
+* outside the containers. Returns whether Docker can run the project.
+*/
+function checkComputer(checks = checkTools()) {
+	const passed = checks.filter((check) => check.ok);
+	if (passed.length) p.log.success(passed.map((check) => check.detail ?? check.name).join(", "));
+	for (const check of checks.filter((check) => !check.ok)) logCheck({
+		...check,
+		warning: true
+	});
+	return !checks.some((check) => !check.ok && !check.warning);
+}
 async function init(directoryArgument, options) {
 	const interactive = isInteractive(options.yes);
 	intro("Create a project");
+	const dockerReady = checkComputer();
 	const zoneError = options.timeZone ? validateTimeZone(options.timeZone) : void 0;
 	if (zoneError) fail(zoneError);
 	let directory = directoryArgument;
@@ -475,7 +2386,6 @@ async function init(directoryArgument, options) {
 	} catch {
 		p.log.warn("Could not commit the project with git. Commit it yourself.");
 	}
-	if (!has("docker", ["compose", "version"])) p.log.warn(`Docker Compose was not found. Install Docker to run the project: ${url("https://docs.docker.com/get-docker/")}`);
 	p.note([
 		command(`cd ${relativeDirectory(target)}`),
 		command("docker compose up"),
@@ -489,7 +2399,8 @@ async function init(directoryArgument, options) {
 	].join("\n"), "Next steps");
 	if (pending.length) p.log.info(`Coming in a later version, so not in this project yet: ${pending.map((item) => `${stackOption(item.key).message.toLowerCase()} (${stack[item.key]})`).join(", ")}.`);
 	p.log.message(`Create the same stack with ${command(`--preset ${encodePreset(stack)}`)}`);
-	if (options.start) {
+	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command("docker compose up")}.`));
+	else if (options.start) {
 		if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
 		p.outro(`Starting the project with ${command("docker compose up")}`);
 		execFileSync("docker", ["compose", "up"], {
@@ -605,198 +2516,6 @@ function setManifestPreset(manifestText, preset) {
 	};
 	return `${JSON.stringify(manifest, null, 2)}\n`;
 }
-// src/project.ts
-/** The `.env` of `dstack run` on a development machine: the prod profile at https://site.localhost. */
-const RUN_ENV = ".env.run";
-const RUN_DOMAIN = "site.localhost";
-/** The project directory: `start` or the nearest parent with `compose.yaml` and `.env`. */
-function findProjectDirectory(start) {
-	let directory = resolve(start);
-	for (;;) {
-		if (existsSync(join(directory, "compose.yaml")) && existsSync(join(directory, ".env"))) return directory;
-		const parent = dirname(directory);
-		if (parent === directory) return void 0;
-		directory = parent;
-	}
-}
-function parseProfiles(value) {
-	return (value ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
-}
-function projectName(directory) {
-	try {
-		const match = readFileSync(join(directory, "compose.yaml"), "utf8").match(/^name:\s*["']?([\w.-]+)/m);
-		if (match?.[1]) return match[1];
-	} catch {}
-	return basename(directory).toLowerCase();
-}
-function fromEnv(directory, name, envFile, localRun) {
-	const env = parseEnv(readFileSync(join(directory, envFile), "utf8"));
-	const profiles = parseProfiles(env.COMPOSE_PROFILES);
-	const prod = profiles.includes("prod");
-	const suffix = prod ? "-prod" : "";
-	return {
-		directory,
-		name: localRun ? `${name}-run` : name,
-		env,
-		profiles,
-		prod,
-		localRun,
-		services: {
-			backend: `backend${suffix}`,
-			frontend: `frontend${suffix}`,
-			worker: `worker${suffix}`
-		},
-		composeArgs: localRun ? [
-			"--env-file",
-			envFile,
-			"--project-name",
-			`${name}-run`
-		] : [],
-		composeEnv: localRun ? {
-			ENV_FILE: envFile,
-			COMPOSE_PROFILES: env.COMPOSE_PROFILES ?? ""
-		} : {}
-	};
-}
-/** Reads the project in or above `start`. Throws with a one-line reason when there is none. */
-function readProject(start = ".") {
-	const directory = findProjectDirectory(start);
-	if (!directory) throw new Error(`No DjangoStack project in ${resolve(start)}: run this where compose.yaml and .env are.`);
-	return fromEnv(directory, projectName(directory), ".env", false);
-}
-/** The local production run of a development project, when `.env.run` exists. */
-function readLocalRun(project) {
-	if (project.prod || project.localRun || !existsSync(join(project.directory, ".env.run"))) return void 0;
-	return fromEnv(project.directory, projectName(project.directory), RUN_ENV, true);
-}
-/** The `django-stack` section of the project's `package.json`. */
-function projectManifest(project) {
-	try {
-		return JSON.parse(readFileSync(join(project.directory, "package.json"), "utf8"))["django-stack"] ?? {};
-	} catch {
-		return {};
-	}
-}
-/**
-* The project's stack: from the preset `init` saved in `package.json`, or,
-* for projects from before that, the defaults with the storage from `.env`.
-*/
-function projectStack(project) {
-	const { preset } = projectManifest(project);
-	if (preset) try {
-		return decodePreset(preset);
-	} catch {}
-	return {
-		...DEFAULT_STACK,
-		storage: project.profiles.includes("s3") ? "s3" : "local"
-	};
-}
-/** The URLs of a running project. */
-function projectUrls(project) {
-	if (project.prod) {
-		const site = (project.env.SITE_URL ?? "").replace(/\/$/, "");
-		return [{
-			label: "Site",
-			url: `${site}/`
-		}, {
-			label: "Admin",
-			url: `${site}/admin/`
-		}];
-	}
-	const urls = [
-		{
-			label: "Site",
-			url: "http://localhost:3000"
-		},
-		{
-			label: "Admin",
-			url: "http://localhost:3000/admin/"
-		},
-		{
-			label: "Mail",
-			url: "http://localhost:8025"
-		}
-	];
-	if (project.profiles.includes("s3")) urls.push({
-		label: "S3",
-		url: "http://localhost:8333"
-	});
-	return urls;
-}
-/** Runs a command with the terminal attached and returns its exit status. */
-const runInherit = (cmd, args, options) => {
-	const result = spawnSync(cmd, args, {
-		stdio: "inherit",
-		...options
-	});
-	if (result.error) return 127;
-	return result.status ?? 1;
-};
-/** The full `docker compose` argument list for a project. */
-function composeCommand(project, args) {
-	return [
-		"compose",
-		...project.composeArgs,
-		...args
-	];
-}
-function composeOptions(project) {
-	return {
-		cwd: project.directory,
-		env: {
-			...process.env,
-			...project.composeEnv
-		}
-	};
-}
-/** Runs `docker compose <args>` for the project with the terminal attached. */
-function compose(project, args, run = runInherit) {
-	return run("docker", composeCommand(project, args), composeOptions(project));
-}
-/** Runs `docker compose <args>` and captures the output. */
-function composeOutput(project, args) {
-	const result = spawnSync("docker", composeCommand(project, args), {
-		...composeOptions(project),
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	return {
-		status: result.status ?? 1,
-		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
-	};
-}
-/** The running services of the project. */
-function runningServices(project) {
-	const result = spawnSync("docker", composeCommand(project, [
-		"ps",
-		"--services",
-		"--filter",
-		"status=running"
-	]), {
-		...composeOptions(project),
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		]
-	});
-	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
-}
-/**
-* The project a command acts on: the local production run when it is the
-* one running, otherwise the project `.env` describes.
-*/
-function activeProject(project) {
-	const localRun = readLocalRun(project);
-	if (!localRun) return project;
-	if (runningServices(project).length) return project;
-	return runningServices(localRun).length ? localRun : project;
-}
 // src/commands/project.ts
 function open(options) {
 	if (!has("docker", ["compose", "version"])) fail("Docker Compose v2 was not found. Install Docker: https://docs.docker.com/get-docker/");
@@ -901,42 +2620,66 @@ async function manage(args, options) {
 async function shell(options) {
 	return manage(["shell"], options);
 }
-/** The project that runs the backups: the prod profile, on a server or the local run. */
+/**
+* The project and the service that run the backups: the prod worker, on a
+* server or the local run, or the `backup` service of projects from 0.1.
+*/
 function backupProject(options) {
 	const project = activeProject(open(options));
 	if (!project.prod) fail(`Backups run in the prod profile: on the server, or locally after ${command("dstack run")}.`);
-	if (!runningServices(project).includes("backup")) fail(`The backup service is not running. Start the project with ${command("dstack run")}.`);
-	return project;
+	const running = runningServices(project);
+	const service = ["backup", project.services.worker].find((name) => running.includes(name));
+	if (!service) fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
+	return {
+		project,
+		service
+	};
 }
-/** `dstack backup`: back up the database now, or list the backups. */
+/** `dstack backup`: back up the database and the media now, or list the backups. */
 async function backup(options) {
-	exitWith(compose(backupProject(options), [
+	const { project, service } = backupProject(options);
+	const args = [
+		"python",
+		"manage.py",
+		"backup_database"
+	];
+	if (options.list) args.push("--list");
+	else if (!options.media) args.push("--no-media");
+	exitWith(compose(project, [
 		"exec",
 		"-T",
-		"backup",
-		...[
-			"python",
-			"manage.py",
-			"backup_database",
-			...options.list ? ["--list"] : []
-		]
+		service,
+		...args
 	]));
 }
-/** `dstack restore <backup>`: restore a backup over the database. */
-async function restore(name, options) {
-	const project = backupProject(options);
-	const args = [
+/** The management command and its options for `dstack restore`. */
+function restoreArgs(name, options) {
+	const yes = options.yes ? ["--yes"] : [];
+	if (name.endsWith(".media.tar.gz")) return [
+		"python",
+		"manage.py",
+		"restore_media",
+		name,
+		...yes
+	];
+	return [
 		"python",
 		"manage.py",
 		"restore_database",
 		name,
-		...options.yes ? ["--yes"] : []
+		...options.media ? ["--media"] : [],
+		...yes
 	];
+}
+/** `dstack restore <backup>`: restore a database dump, with --media its media too, or a media archive. */
+async function restore(name, options) {
+	const { project, service } = backupProject(options);
+	const args = restoreArgs(name, options);
 	if (!options.yes && !tty()) fail("Pass --yes to restore without a terminal.");
 	exitWith(compose(project, [
 		"exec",
 		...options.yes ? ["-T"] : [],
-		"backup",
+		service,
 		...args
 	]));
 }
@@ -1056,13 +2799,8 @@ async function check(options) {
 		const doctorChecks = await runDoctor(project.directory);
 		spinner.clear();
 		for (const item of doctorChecks) {
-			const line = item.detail ? `${item.name} ${pc.dim(`- ${item.detail}`)}` : item.name;
-			if (item.ok) p.log.success(line);
-			else if (item.warning) p.log.warn(pc.yellow(line));
-			else {
-				p.log.error(pc.red(line));
-				failed++;
-			}
+			logCheck(item);
+			if (!item.ok && !item.warning) failed++;
 		}
 	}
 	const running = runningServices(project);
@@ -1259,9 +2997,26 @@ function createProgram() {
 	for (const flag of stackFlags()) configCommand.addOption(flag);
 	program.command("manage").description("Run a Django management command in the backend").argument("<args...>", "The command and its options, such as createsuperuser").addOption(dirOption()).allowUnknownOption().helpOption(false).action((args, options) => manage(args, options));
 	program.command("shell").description("Open Django's shell in the backend").addOption(dirOption()).action(shell);
-	program.command("backup").description("Back up the database now (prod profile)").addOption(dirOption()).option("--list", "List the backups instead").action(backup);
-	program.command("restore").description("Restore a backup over the database (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("-y, --yes", "Don't ask for confirmation").action(restore);
+	program.command("backup").description("Back up the database and the media now (prod profile)").addOption(dirOption()).option("--list", "List the backups instead").option("--no-media", "Back up only the database").action(backup);
+	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
 	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
+	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
+	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy or a server over SSH, and show the status");
+	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when it would not include your local commits or changes").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
+	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com, or the server, such as deploy@example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
+	const seen = /* @__PURE__ */ new Set();
+	for (const flag of PROVIDERS.flatMap((provider) => provider.setupFlags)) {
+		if (seen.has(flag.name)) continue;
+		seen.add(flag.name);
+		const kebab = flag.name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+		setupCommand.option(`--${kebab} <value>`, flag.description);
+	}
+	deployCommand.command("status").description("Show the state of the site and the last deploys").addOption(dirOption()).option("-n, --limit <count>", "How many deploys to list", "5").option("--watch", "Follow a running deploy until it ends").action(deployStatus);
+	deployCommand.command("logs").description("Print the build log of a deploy").argument("[deployment]", "A deploy id from `dstack deploy status` (default: the latest)").addOption(dirOption()).action(deployLogs);
+	deployCommand.command("rollback").description("Run an earlier release again (servers over SSH)").argument("[deployment]", "A deploy id from `dstack deploy status` (default: the one before the running one)").addOption(dirOption()).option("--no-wait", "Don't follow the rollback; return once it started").option("-y, --yes", "Don't ask").action(deployRollback);
+	deployCommand.command("env").description("Manage the platform's environment variables").command("push").description("Replace the platform's variables with .env.production").addOption(dirOption()).option("-y, --yes", "Don't ask for confirmation").action(deployEnvPush);
+	deployCommand.command("login").description("Check and save an API key in the system keychain").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").option("--token <token>", "The API key (default: ask, or the provider's environment variable with --yes)").option("-y, --yes", "Don't ask").action(deployLogin);
+	deployCommand.command("logout").description("Remove a saved API key").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address (default: the one in .dstack/deploy.json)").action(deployLogout);
 	const presetCommand = program.command("preset").description("Print the preset code of a stack, or the stack of a code").argument("[preset]", "A preset code or name to show").option("-y, --yes", "Don't ask; use the flags and the defaults").action((code, options, cmd) => preset(code, {
 		...options,
 		fromCli: (option) => cmd.getOptionValueSource(option) === "cli"