@django-stack/cli 0.4.0 → 0.6.0

package/dist/bin.js

@@ -1,360 +1,410 @@
 #!/usr/bin/env node
-import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as encodePreset, a as relativeDirectory, b as stackOption, c as toProjectName, d as CLI_VERSION, f as DEFAULT_STACK, g as decodePreset, h as applies, l as validateProjectName, m as STACK_OPTIONS, n as LOCAL_S3, o as scaffold, p as NAMED_PRESETS, r as lockBackend, s as timeZones, u as validateTimeZone, v as pendingChoices, w as generateSecret, x as productionEnv, y as resolvePreset } from "./scaffold-DbgGYEsc.js";
+import { C as stackOption, D as checkTools, E as runDoctor, O as parseEnv, S as resolvePreset, T as generateSecret, _ as STACK_OPTIONS, a as lockBackend, b as encodePreset, c as scaffold, d as umamiEnv, f as validateProjectName, g as NAMED_PRESETS, h as DEFAULT_STACK, i as LOCAL_S3, k as setEnvValues, l as timeZones, m as CLI_VERSION, n as validateDomain, p as validateTimeZone, s as relativeDirectory, t as productionEnv$1, u as toProjectName, v as applies, w as generateProjectSecrets, x as pendingChoices, y as decodePreset } from "./production-DIj9yRcg.js";
 import { createRequire } from "node:module";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import pc from "picocolors";
 import tab from "@bomb.sh/tab/commander";
 import * as p from "@clack/prompts";
 import { Command, InvalidArgumentError, Option } from "commander";
-import { homedir } from "node:os";
-// src/deploy/provider.ts
-/** The target of a platform with a web API and an API key. */
-function urlTarget(name, placeholder) {
+import { homedir, tmpdir } from "node:os";
+// src/deploy/bunny-compose.ts
+/** Volumes that are not needed on Bunny: its CDN holds the certificate, uploads and backups go to S3. */
+const DROPPED_VOLUMES = /* @__PURE__ */ new Set([
+	"caddy_data",
+	"caddy_config",
+	"backups",
+	"media"
+]);
+/** Compose keys that do not apply on Bunny: its gVisor sandbox isolates the app instead. */
+const IGNORED_KEYS = [
+	"read_only",
+	"tmpfs",
+	"cap_add",
+	"cap_drop",
+	"security_opt",
+	"user",
+	"deploy",
+	"restart",
+	"depends_on"
+];
+/** Images whose port is set with PORT, so a clash with another service can move them. */
+const PORT_ENV_IMAGES = [/(^|\/)umami(-software)?\/umami/i, /^umamisoftware\/umami/i];
+/** Parses a Compose duration such as 5s, 1m0s or 500ms into seconds. */
+function durationSeconds(value, fallback) {
+	if (!value) return fallback;
+	let total = 0;
+	let matched = false;
+	for (const [, amount, unit] of value.matchAll(/(\d+(?:\.\d+)?)(ms|us|ns|h|m|s)/g)) {
+		matched = true;
+		const number = Number(amount);
+		total += unit === "h" ? number * 3600 : unit === "m" ? number * 60 : unit === "s" ? number : unit === "ms" ? number / 1e3 : 0;
+	}
+	return matched ? total : fallback;
+}
+/** Reads a public image reference: postgres:17-alpine, valkey/valkey:8, ghcr.io/owner/name:tag. */
+function parsePublicImage(reference) {
+	let rest = reference.trim();
+	let digest;
+	const at = rest.indexOf("@");
+	if (at >= 0) {
+		digest = rest.slice(at + 1);
+		rest = rest.slice(0, at);
+	}
+	let source = "dockerHub";
+	const slash = rest.indexOf("/");
+	const first = slash >= 0 ? rest.slice(0, slash) : "";
+	if (first && (first.includes(".") || first.includes(":") || first === "localhost")) {
+		if (first === "docker.io" || first === "index.docker.io") source = "dockerHub";
+		else if (first === "ghcr.io") source = "gitHub";
+		else throw new Error(`Bunny pulls public images from Docker Hub and GitHub only; ${reference} is on ${first}. Push it to one of them, or build it in compose.yaml.`);
+		rest = rest.slice(slash + 1);
+	}
+	const colon = rest.lastIndexOf(":");
+	const tag = colon > rest.lastIndexOf("/") ? rest.slice(colon + 1) : "latest";
+	const path = colon > rest.lastIndexOf("/") ? rest.slice(0, colon) : rest;
+	const parts = path.split("/");
+	const name = parts.pop() ?? path;
+	const namespace = parts.join("/") || (source === "dockerHub" ? "library" : "");
+	if (!name || !namespace) throw new Error(`Cannot read the image ${reference}.`);
 	return {
-		label: `${name} URL`,
-		placeholder,
-		normalize: normalizeUrl
+		source,
+		namespace,
+		name,
+		tag,
+		...digest ? { digest } : {}
 	};
 }
-/** Normalizes an instance URL: https by default, no trailing slash or path. */
-function normalizeUrl(value) {
-	const trimmed = value.trim();
-	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
-	let parsed;
-	try {
-		parsed = new URL(withScheme);
-	} catch {
-		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
-	}
-	return `${parsed.protocol}//${parsed.host}`;
+/** A repository name for Bunny Container Registry. */
+function repositoryName(value) {
+	return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, "") || "app";
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Matches `name:port` where name is a whole host name, such as backend:8000 in http://backend:8000/api. */
+function hostPattern(name) {
+	return new RegExp(`(^|[^\\w.-])${escapeRegExp(name)}:(\\d{1,5})(?!\\d)`, "g");
+}
+/** The names other services reach a service by: its name and its network aliases. */
+function hostNames(service, definition) {
+	const names = /* @__PURE__ */ new Set([service]);
+	for (const network of Object.values(definition.networks ?? {})) for (const alias of network?.aliases ?? []) names.add(alias);
+	return [...names];
+}
+/** Replaces service host names with 127.0.0.1, which is the pod on Bunny. */
+function rewriteHosts(text, names) {
+	let result = text;
+	for (const name of names) result = result.replace(hostPattern(name), (_whole, before, port) => `${before}127.0.0.1:${port}`);
+	return result;
+}
+function containerName(service, taken) {
+	let name = service.replace(/-prod$/, "").slice(0, 50) || service;
+	for (let index = 2; taken.has(name); index++) name = `${service.slice(0, 46)}-${index}`;
+	taken.add(name);
+	return name;
+}
+function healthUrl(test) {
+	const match = (test ?? []).join(" ").match(/https?:\/\/(?:localhost|127\.0\.0\.1)(?::(\d+))?(\/[^\s'"]*)?/);
+	if (!match) return void 0;
+	return {
+		port: Number(match[1] ?? 80),
+		path: match[2] ?? "/"
+	};
 }
-// src/deploy/coolify.ts
-/**
-* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
-* token. The project deploys as a Docker Compose application that Coolify
-* builds on the server from the git repository; Coolify's proxy gets the
-* certificate and forwards to the `proxy` service (Caddy) on port 80.
-*/
-/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
-const PLATFORM_ENV = {
-	CADDY_ADDRESS: ":80",
-	TRUSTED_PROXIES: "private_ranges",
-	NUM_PROXIES: "2",
-	HTTP_PORT: "127.0.0.1:8080",
-	HTTPS_PORT: "127.0.0.1:8443"
-};
-/** Setup flags Coolify and Dokploy share; `deploy setup` shows each flag once. */
-const SHARED_SETUP_FLAGS = [
-	{
-		name: "server",
-		description: "The server on the platform, by name or id (Dokploy: dokploy for its own)"
-	},
-	{
-		name: "project",
-		description: "The platform's project, by name or id (default: the project name)"
-	},
-	{
-		name: "environment",
-		description: "The platform's environment (default: production)"
-	}
-];
-var CoolifyError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.status = status;
+function probeFor(definition, ports) {
+	const check = definition.healthcheck;
+	if (check?.disable) return void 0;
+	const url = check?.test ? healthUrl(check.test) : void 0;
+	const port = url?.port ?? ports[0];
+	if (port === void 0) return void 0;
+	const period = Math.max(1, Math.round(durationSeconds(check?.interval, 10)));
+	const timeout = Math.max(1, Math.round(durationSeconds(check?.timeout, 5)));
+	const retries = Math.max(1, check?.retries ?? 3);
+	const start = durationSeconds(check?.start_period, 0);
+	return {
+		...url ? { http: {
+			path: url.path,
+			port
+		} } : { tcp: { port } },
+		periodSeconds: period,
+		timeoutSeconds: Math.min(timeout, period),
+		failureThreshold: Math.min(3, retries),
+		startupThreshold: Math.min(1e3, Math.ceil(start / period) + retries)
+	};
+}
+/** Plans the Bunny app for a resolved Compose project. */
+function planApp(project, options) {
+	const entries = Object.entries(project.services).sort(([a], [b]) => a.localeCompare(b));
+	if (!entries.length) throw new Error("compose.yaml has no services for production.");
+	const names = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) names.set(service, hostNames(service, definition));
+	const allNames = [...names.values()].flat();
+	const builds = /* @__PURE__ */ new Map();
+	const baked = /* @__PURE__ */ new Map();
+	const ignored = /* @__PURE__ */ new Set();
+	const volumes = /* @__PURE__ */ new Set();
+	const texts = [];
+	for (const [, definition] of entries) for (const value of Object.values(definition.environment ?? {})) if (value) texts.push(value);
+	for (const [service, definition] of entries) {
+		const binds = (definition.volumes ?? []).filter((mount) => mount.type === "bind");
+		if (!binds.length) continue;
+		if (definition.build || !definition.image) throw new Error(`${service} bind-mounts ${binds[0]?.source}; Bunny has no bind mounts. Copy the file into the image in its Dockerfile.`);
+		const files = binds.map((mount) => {
+			let content;
+			try {
+				content = options.readFile(mount.source ?? "");
+			} catch {
+				throw new Error(`${service} bind-mounts ${mount.source}, which is not a file; Bunny has no bind mounts, so only files can be copied into the image.`);
+			}
+			texts.push(content);
+			return {
+				source: mount.source ?? "",
+				target: mount.target,
+				content
+			};
+		});
+		const repository = repositoryName(`${project.name}-${service.replace(/-prod$/, "")}`);
+		builds.set(repository, {
+			kind: "bake",
+			repository,
+			from: definition.image,
+			files
+		});
+		baked.set(service, repository);
 	}
-};
-var CoolifyApi = class {
-	url;
-	token;
-	fetchImpl;
-	constructor(url, token, fetchImpl = fetch) {
-		this.url = url;
-		this.token = token;
-		this.fetchImpl = fetchImpl;
+	const portsOf = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) {
+		const found = /* @__PURE__ */ new Set();
+		for (const name of names.get(service) ?? []) for (const text of texts) for (const match of text.matchAll(hostPattern(name))) found.add(Number(match[2]));
+		const own = definition.healthcheck?.test ? healthUrl(definition.healthcheck.test) : void 0;
+		if (own) found.add(own.port);
+		for (const port of definition.ports ?? []) found.add(port.target);
+		portsOf.set(service, [...found].sort((a, b) => a - b));
 	}
-	async request(method, path, body) {
-		let response;
-		try {
-			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
-				method,
-				headers: {
-					Authorization: `Bearer ${this.token}`,
-					Accept: "application/json",
-					...body === void 0 ? {} : { "Content-Type": "application/json" }
-				},
-				body: body === void 0 ? void 0 : JSON.stringify(body),
-				signal: AbortSignal.timeout(3e4)
+	const owner = /* @__PURE__ */ new Map();
+	const moved = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) {
+		const ports = portsOf.get(service) ?? [];
+		for (const [index, port] of ports.entries()) {
+			const other = owner.get(port);
+			if (!other) {
+				owner.set(port, service);
+				continue;
+			}
+			if (!(ports.length === 1 && PORT_ENV_IMAGES.some((pattern) => pattern.test(definition.image ?? "")))) throw new Error(`${other} and ${service} both listen on port ${port}. Bunny runs all containers of an app in one pod, so give one of them another port.`);
+			let to = port + 1;
+			while (owner.has(to)) to++;
+			owner.set(to, service);
+			ports[index] = to;
+			moved.set(service, {
+				from: port,
+				to
 			});
-		} catch (error) {
-			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
 		}
-		const text = await response.text();
-		if (!response.ok) throw new CoolifyError(errorMessage$1(response.status, text, this.url), response.status);
-		if (!text) return void 0;
-		try {
-			return JSON.parse(text);
-		} catch {
-			return text;
+	}
+	const published = entries.filter(([, definition]) => (definition.ports ?? []).length);
+	if (published.length !== 1) throw new Error(published.length ? `${published.map(([service]) => service).join(" and ")} publish ports; Bunny gives an app one public endpoint, so only the proxy may.` : "No service publishes a port, so there is nothing for Bunny's CDN to send requests to.");
+	const [entryService, entryDefinition] = published[0];
+	const entryPorts = (entryDefinition.ports ?? []).map((port) => port.target);
+	const endpointPort = entryPorts.includes(80) ? 80 : entryPorts[0];
+	const rewrite = (text) => {
+		let result = text;
+		for (const [service, move] of moved) for (const name of names.get(service) ?? []) result = result.replace(hostPattern(name), (whole, before, port) => Number(port) === move.from ? `${before}${name}:${move.to}` : whole);
+		return rewriteHosts(result, allNames);
+	};
+	for (const build of builds.values()) if (build.kind === "bake") for (const file of build.files) file.content = rewrite(file.content);
+	const s3 = entries.some(([, definition]) => Boolean(definition.environment?.S3_BUCKET));
+	const taken = /* @__PURE__ */ new Set();
+	const containers = [];
+	for (const [service, definition] of entries) {
+		for (const key of IGNORED_KEYS) if (definition[key] !== void 0 && definition[key] !== null) ignored.add(key);
+		let image;
+		const bake = baked.get(service);
+		if (bake) image = {
+			source: "push",
+			repository: bake
+		};
+		else if (definition.build) {
+			const repository = repositoryName(definition.image ?? `${project.name}-${service}`);
+			const existing = builds.get(repository);
+			const build = {
+				kind: "build",
+				repository,
+				context: definition.build.context,
+				dockerfile: definition.build.dockerfile,
+				target: definition.build.target,
+				args: definition.build.args
+			};
+			if (existing && JSON.stringify(existing) !== JSON.stringify(build)) throw new Error(`Two services build the image ${repository} differently; give them their own image names.`);
+			builds.set(repository, build);
+			image = {
+				source: "push",
+				repository
+			};
+		} else if (definition.image) image = parsePublicImage(definition.image);
+		else throw new Error(`${service} has neither an image nor a build.`);
+		const env = {};
+		for (const [key, value] of Object.entries(definition.environment ?? {})) {
+			if (value === null || value === void 0 || key === "COMPOSE_PROFILES" || key === "ENV_FILE") continue;
+			env[key] = rewrite(value);
+		}
+		const move = moved.get(service);
+		if (move) env.PORT = String(move.to);
+		const volumeMounts = [];
+		for (const mount of definition.volumes ?? []) {
+			if (mount.type === "tmpfs") continue;
+			if (mount.type !== "volume" || !mount.source) {
+				if (mount.type === "bind") continue;
+				throw new Error(`${service} mounts a ${mount.type} volume, which Bunny does not have.`);
+			}
+			if (mount.source === "media" && !s3) throw new Error("Uploads must be in S3 on Bunny: its volumes belong to one pod and are not backed up. Set S3_BUCKET and the other S3_ variables in .env.production (see the docs on media).");
+			if (DROPPED_VOLUMES.has(mount.source)) continue;
+			volumes.add(mount.source);
+			volumeMounts.push({
+				name: mount.source,
+				mountPath: mount.target
+			});
+			if (mount.target === "/var/lib/postgresql/data" && !env.PGDATA) env.PGDATA = `${mount.target}/pgdata`;
 		}
+		const ports = portsOf.get(service) ?? [];
+		containers.push({
+			service,
+			name: containerName(service, taken),
+			image,
+			env,
+			...definition.entrypoint?.length ? { command: definition.entrypoint } : {},
+			...definition.command?.length ? { args: definition.command } : {},
+			...definition.working_dir ? { workingDir: definition.working_dir } : {},
+			ports,
+			probe: probeFor(definition, move ? [move.to] : ports.filter((port) => port !== 443)),
+			volumeMounts,
+			...service === entryService ? { endpoint: endpointPort } : {}
+		});
 	}
-	get = (path) => this.request("GET", path);
-	post = (path, body) => this.request("POST", path, body ?? {});
-	patch = (path, body) => this.request("PATCH", path, body);
-};
-function errorMessage$1(status, text, url) {
-	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
-	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
-	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
-	let message = "";
+	if (volumes.size > 2) throw new Error(`Bunny allows 2 volumes per app, and this project needs ${volumes.size}: ${[...volumes].join(", ")}. Use an external Postgres or S3 for some of them.`);
+	return {
+		name: project.name,
+		containers,
+		volumes: [...volumes],
+		builds: [...builds.values()],
+		ignored: [...ignored].sort()
+	};
+}
+// src/deploy/link.ts
+/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
+const LINK_FILE = ".dstack/deploy.json";
+function readLink(directory) {
+	const path = join(directory, LINK_FILE);
+	if (!existsSync(path)) return void 0;
+	let link;
 	try {
-		const body = JSON.parse(text);
-		message = body.message ?? "";
-		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+		link = JSON.parse(readFileSync(path, "utf8"));
 	} catch {
-		message = text.slice(0, 200);
+		throw new Error(`${LINK_FILE} is not valid JSON.`);
 	}
-	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
-}
-const enc = encodeURIComponent;
-function deploymentStatus(value) {
-	if (value === "queued") return "queued";
-	if (value === "in_progress") return "building";
-	if (value === "finished") return "finished";
-	if (value.startsWith("cancelled")) return "cancelled";
-	return "failed";
+	for (const key of [
+		"provider",
+		"url",
+		"project",
+		"environment",
+		"application"
+	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
+	return {
+		...link,
+		directory
+	};
 }
-function appState(value) {
-	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
-	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
-	if (state === "degraded" || state === "restarting") return "degraded";
-	if (state === "exited" || state === "stopped") return "stopped";
-	return "unknown";
+function writeLink(directory, link) {
+	const path = join(directory, LINK_FILE);
+	mkdirSync(dirname(path), { recursive: true });
+	const { provider, url, project, environment, application } = link;
+	writeFileSync(path, `${JSON.stringify({
+		provider,
+		url,
+		project,
+		environment,
+		application
+	}, null, 2)}\n`);
 }
-/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
-function parseLog(logs) {
-	if (!logs) return [];
-	let entries;
-	try {
-		entries = JSON.parse(logs);
+/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
+function httpsRepository(remote) {
+	const value = remote.trim();
+	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
+	let url;
+	if (scp) url = `https://${scp[1]}/${scp[2]}`;
+	else try {
+		const parsed = new URL(value);
+		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
 	} catch {
-		return logs.split("\n").map((text) => ({
-			text,
-			stderr: false
-		}));
+		throw new Error(`Cannot read the git remote ${value}.`);
 	}
-	if (!Array.isArray(entries)) return [];
-	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
-		text,
-		stderr: entry.type === "stderr"
-	})));
+	return url.replace(/\.git$/, "").replace(/\/$/, "");
 }
-/** The domains of a Compose application, by service. */
-function composeDomains(app) {
-	let value = app.docker_compose_domains;
-	if (typeof value === "string") try {
-		value = JSON.parse(value);
+function git(directory, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: directory,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
 	} catch {
-		value = null;
+		return;
 	}
-	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
-	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
-	return domains.map((domain) => domain.replace(/:\d+$/, ""));
-}
-function appUrl(api, link) {
-	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
 }
-function toDeployment$1(api, link, item) {
-	const path = item.deployment_url;
-	return {
-		id: item.deployment_uuid,
-		status: deploymentStatus(item.status),
-		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
-		message: item.commit_message?.split("\n")[0] || void 0,
-		createdAt: item.created_at,
-		updatedAt: item.updated_at,
-		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
-		log: parseLog(item.logs)
-	};
+function gitRemote(directory, remote = "origin") {
+	return git(directory, [
+		"remote",
+		"get-url",
+		remote
+	]) || void 0;
 }
-/** Finds a name or uuid in a list. */
-function find$1(items, wanted) {
-	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+function gitBranch(directory) {
+	const branch = git(directory, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return branch && branch !== "HEAD" ? branch : void 0;
+}
+/**
+* Why a deploy of `branch` would not include the local commit, or undefined
+* when origin has it. The platform builds from the remote, not from here.
+*/
+function unpushedReason(directory, branch) {
+	const head = git(directory, ["rev-parse", "HEAD"]);
+	if (!head) return void 0;
+	if (git(directory, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
+	if (git(directory, [
+		"merge-base",
+		"--is-ancestor",
+		head,
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
+}
+/**
+* Why an upload of HEAD would not match the working tree, or undefined when
+* it does. Providers that upload the local commit deploy HEAD only, so
+* changes to tracked files must be committed first.
+*/
+function uncommittedReason(directory) {
+	if (git(directory, ["rev-parse", "HEAD"]) === void 0) return "This project has no commit yet. Commit it first: git add -A && git commit";
+	if (git(directory, [
+		"status",
+		"--porcelain",
+		"--untracked-files=no"
+	])) return "You have uncommitted changes, so the deploy would not include them. Commit first.";
 }
-var CoolifyClient = class {
-	api;
-	constructor(url, token, fetchImpl) {
-		this.api = new CoolifyApi(url, token, fetchImpl);
-	}
-	async verify() {
-		const version = await this.api.get("/version");
-		await this.api.get("/servers");
-		return String(version).trim();
-	}
-	async setup(context) {
-		const { ask, options } = context;
-		if (!context.repository) throw new Error("Coolify builds from a git repository; pass --repository.");
-		const api = this.api;
-		const servers = await api.get("/servers");
-		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
-		let server;
-		if (options.server) {
-			server = find$1(servers, options.server);
-			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
-		} else if (servers.length === 1) server = servers[0];
-		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
-			value: item.uuid,
-			label: item.name,
-			hint: item.ip
-		}))));
-		if (!server) throw new Error("No server chosen.");
-		const projects = await api.get("/projects");
-		let project;
-		const projectName = options.project ?? context.name;
-		project = find$1(projects, projectName);
-		if (!options.project && ask.interactive && projects.length) {
-			const NEW = "";
-			const uuid = await ask.select("Coolify project", [...project ? [] : [{
-				value: NEW,
-				label: `Create ${projectName}`
-			}], ...projects.map((item) => ({
-				value: item.uuid,
-				label: item.name,
-				hint: item.description ?? void 0
-			}))], project?.uuid ?? NEW);
-			project = uuid === NEW ? void 0 : find$1(projects, uuid);
-		}
-		if (!project) {
-			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
-			project = {
-				uuid: (await api.post("/projects", {
-					name: projectName,
-					description: "DjangoStack"
-				})).uuid,
-				name: projectName
-			};
-			ask.step(`Created the Coolify project ${projectName}`);
-		}
-		const environmentName = options.environment ?? "production";
-		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
-		if (!environment) {
-			environment = {
-				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
-				name: environmentName
-			};
-			ask.step(`Created the environment ${environmentName}`);
-		}
-		let githubApp;
-		if (options.githubApp && options.githubApp !== "public") {
-			const app = find$1(await api.get("/github-apps"), options.githubApp);
-			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
-			githubApp = app.uuid;
-		} else if (!options.githubApp && ask.interactive) {
-			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
-			if (apps.length) {
-				const choice = await ask.select("How Coolify gets the code", [{
-					value: "public",
-					label: "Public repository",
-					hint: "no access needed"
-				}, ...apps.map((app) => ({
-					value: app.uuid,
-					label: `GitHub App ${app.name}`,
-					hint: "private repository"
-				}))], "public");
-				githubApp = choice === "public" ? void 0 : choice;
-			}
-		}
-		const body = {
-			project_uuid: project.uuid,
-			server_uuid: server.uuid,
-			environment_uuid: environment.uuid,
-			git_repository: context.repository,
-			git_branch: context.branch,
-			build_pack: "dockercompose",
-			docker_compose_location: "/compose.yaml",
-			docker_compose_domains: [{
-				name: "proxy",
-				domain: `https://${context.domain}:80`
-			}],
-			name: context.name,
-			description: "DjangoStack",
-			instant_deploy: false,
-			...githubApp ? { github_app_uuid: githubApp } : {}
-		};
-		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
-		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
-		const link = {
-			provider: "coolify",
-			url: api.url,
-			project: project.uuid,
-			environment: environment.uuid,
-			application: created.uuid
-		};
-		await this.pushEnv(link, context.env);
-		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
-		return {
-			project: link.project,
-			environment: link.environment,
-			application: link.application
-		};
-	}
-	async pushEnv(link, env) {
-		const data = Object.entries(env).map(([key, value]) => ({
-			key,
-			value,
-			is_literal: true,
-			is_preview: false
-		}));
-		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
-	}
-	async deploy(link, options) {
-		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
-		const result = await this.api.post(`/deploy?${query}`);
-		const id = result?.deployments?.[0]?.deployment_uuid;
-		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
-		return id;
-	}
-	async deployment(link, id) {
-		return toDeployment$1(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
-	}
-	async deployments(link, limit) {
-		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
-		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment$1(this.api, link, item));
-	}
-	async status(link) {
-		const app = await this.api.get(`/applications/${enc(link.application)}`);
-		return {
-			state: appState(app.status),
-			detail: app.status ?? "unknown",
-			domains: composeDomains(app),
-			branch: app.git_branch,
-			url: appUrl(this.api, link)
-		};
-	}
-};
-const coolify = {
-	id: "coolify",
-	name: "Coolify",
-	auth: {
-		kind: "token",
-		env: "DSTACK_COOLIFY_TOKEN",
-		help: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`
-	},
-	source: "remote",
-	target: urlTarget("Coolify", "https://coolify.example.com"),
-	platformEnv: PLATFORM_ENV,
-	setupFlags: [...SHARED_SETUP_FLAGS, {
-		name: "githubApp",
-		description: "A Coolify GitHub App for a private repository, or public"
-	}],
-	connect: (url, token) => {
-		if (!token) throw new Error("Coolify needs an API key.");
-		return new CoolifyClient(url, token);
-	}
-};
 const systemSsh = (args, input) => new Promise((resolve, reject) => {
 	const child = spawn("ssh", args, { stdio: [
 		"pipe",
@@ -653,127 +703,1393 @@ echo $! > ${q(`${record.id}.pid`)}
 echo $! > ${q(`${link.project}/deploy.lock/pid`)}
 `, script);
 	}
-	/** The newest deploy records first, with their status. */
-	async records(link, limit) {
-		const output = await this.sh(`
-cd ${shellQuote(`${link.project}/deploys`)} 2>/dev/null || exit 0
-for file in $(ls -1 *.json 2>/dev/null | sort -r | head -n ${Math.max(1, Math.floor(limit))}); do
-  id="\${file%.json}"
-  cat "$file"
-  pid=$(cat "$id.pid" 2>/dev/null)
-  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
-  printf '%s %s %s\\n' "$(cat "$id.status" 2>/dev/null || echo failed)" "$alive" "$(date -u -r "$id.status" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
-  echo ${MARK}
-done
-`);
-		const items = [];
-		for (const part of parts(`\n${output}`)) {
-			const lines = part.trim().split("\n");
-			if (lines.length < 2) continue;
-			try {
-				const record = JSON.parse(lines[0] ?? "");
-				const [status = "", alive = "0", updatedAt] = (lines[1] ?? "").split(" ");
-				items.push({
-					record,
-					status: recordStatus(status, alive === "1"),
-					updatedAt: updatedAt || void 0
-				});
-			} catch {}
-		}
-		return items;
+	/** The newest deploy records first, with their status. */
+	async records(link, limit) {
+		const output = await this.sh(`
+cd ${shellQuote(`${link.project}/deploys`)} 2>/dev/null || exit 0
+for file in $(ls -1 *.json 2>/dev/null | sort -r | head -n ${Math.max(1, Math.floor(limit))}); do
+  id="\${file%.json}"
+  cat "$file"
+  pid=$(cat "$id.pid" 2>/dev/null)
+  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
+  printf '%s %s %s\\n' "$(cat "$id.status" 2>/dev/null || echo failed)" "$alive" "$(date -u -r "$id.status" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
+  echo ${MARK}
+done
+`);
+		const items = [];
+		for (const part of parts(`\n${output}`)) {
+			const lines = part.trim().split("\n");
+			if (lines.length < 2) continue;
+			try {
+				const record = JSON.parse(lines[0] ?? "");
+				const [status = "", alive = "0", updatedAt] = (lines[1] ?? "").split(" ");
+				items.push({
+					record,
+					status: recordStatus(status, alive === "1"),
+					updatedAt: updatedAt || void 0
+				});
+			} catch {}
+		}
+		return items;
+	}
+	async deployment(link, id) {
+		if (!ID.test(id)) throw new Error(`Invalid deploy id ${id}.`);
+		const deploys = shellQuote(`${link.project}/deploys`);
+		const output = await this.sh(`
+cd ${deploys} || exit 1
+[ -f ${shellQuote(`${id}.json`)} ] || { echo missing; exit 0; }
+cat ${shellQuote(`${id}.json`)}
+pid=$(cat ${shellQuote(`${id}.pid`)} 2>/dev/null)
+if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
+printf '%s %s %s\\n' "$(cat ${shellQuote(`${id}.status`)} 2>/dev/null || echo failed)" "$alive" "$(date -u -r ${shellQuote(`${id}.status`)} +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
+echo ${MARK}
+cat ${shellQuote(`${id}.log`)} 2>/dev/null
+`);
+		if (output.trim() === "missing") throw new Error(`There is no deploy ${id} on the server.`);
+		const [head = "", log = ""] = output.split(`\n${MARK}\n`);
+		const [json = "{}", state = ""] = head.split("\n");
+		const record = JSON.parse(json);
+		const [status = "", alive = "0", updatedAt] = state.split(" ");
+		return {
+			...toDeployment$2(record, recordStatus(status, alive === "1"), updatedAt || void 0),
+			log: log ? log.replace(/\n$/, "").split("\n").map((text) => ({
+				text,
+				stderr: false
+			})) : []
+		};
+	}
+	async deployments(link, limit) {
+		return (await this.records(link, limit)).map((item) => ({
+			...toDeployment$2(item.record, item.status, item.updatedAt),
+			log: []
+		}));
+	}
+	async status(link) {
+		const [ps = "", site = ""] = parts(await this.sh(`
+docker compose -p ${shellQuote(link.application)} ps --all --format json
+echo ${MARK}
+sed -n 's/^SITE_URL=//p' ${shellQuote(`${link.project}/shared/.env`)} 2>/dev/null
+`));
+		const { state, detail } = composeState(parseComposePs(ps));
+		const domain = site.trim().replace(/^["']|["']$/g, "");
+		return {
+			state,
+			detail,
+			domains: domain ? [domain] : []
+		};
+	}
+};
+function toDeployment$2(record, status, updatedAt) {
+	return {
+		id: record.id,
+		status,
+		commit: record.commit,
+		message: record.message,
+		createdAt: record.createdAt,
+		updatedAt
+	};
+}
+/**
+* A value for a Compose .env line: bare when safe, else single-quoted (taken
+* literally), or double-quoted with escapes when it holds a single quote.
+*/
+function envValue(value) {
+	if (/^[\w@%+=:,./-]*$/.test(value)) return value;
+	if (!value.includes("'") && !value.includes("\n")) return `'${value}'`;
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "$$$$").replace(/\n/g, "\\n")}"`;
+}
+function defaultGit(args) {
+	return execFileSync("git", args, {
+		maxBuffer: 1073741824,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+}
+const ssh = {
+	id: "ssh",
+	name: "SSH server",
+	auth: { kind: "ssh" },
+	source: "local",
+	target: {
+		label: "Server",
+		placeholder: "deploy@example.com",
+		normalize: (value) => formatTarget(parseTarget(value))
+	},
+	platformEnv: {},
+	setupFlags: [{
+		name: "path",
+		description: "The project directory on the server (default: /srv/<project>)"
+	}],
+	connect: (target) => new SshClient(target)
+};
+// src/deploy/bunny.ts
+/**
+* Bunny Magic Containers (https://bunny.net/magic-containers), through the
+* API at https://api.bunny.net/mc with the account API key in the AccessKey
+* header. Bunny has no Compose: the CLI reads the resolved compose.yaml,
+* builds the images of the local commit for linux/amd64, pushes them to
+* Bunny Container Registry and creates one app whose containers are the
+* production services, in one pod on localhost. A CDN endpoint on the
+* proxy carries the site's domain; Bunny's CDN holds the certificate, so
+* Caddy serves plain HTTP on port 80. A deploy pushes new images tagged with
+* the commit and changes the containers' tags, which starts Bunny's rolling
+* update.
+*
+* Link ids: project = the app id, environment = the account's registry
+* namespace, application = the CDN pull zone id.
+*/
+const BUNNY_API = "https://api.bunny.net";
+const BUNNY_REGISTRY = "registry.bunny.net";
+/** Variables that put Caddy behind Bunny's CDN. TRUSTED_PROXIES is Bunny's edge list, set in setup. */
+const BUNNY_PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	NUM_PROXIES: "2"
+};
+/** Where a deploy's record and log are kept, in the project. Bunny keeps no deploy history. */
+const BUNNY_DEPLOYS_DIR = ".dstack/deploys";
+const systemRunner = (command, args, options = {}) => new Promise((resolvePromise, reject) => {
+	const child = spawn(command, args, {
+		cwd: options.cwd,
+		env: options.env ? {
+			...process.env,
+			...options.env
+		} : process.env,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	const stdout = [];
+	const stderr = [];
+	child.stdout.on("data", (chunk) => {
+		stdout.push(chunk);
+		if (options.stream) process.stderr.write(chunk);
+	});
+	child.stderr.on("data", (chunk) => {
+		stderr.push(chunk);
+		if (options.stream) process.stderr.write(chunk);
+	});
+	child.on("error", (error) => reject(/* @__PURE__ */ new Error(error.code === "ENOENT" ? `There is no ${command} command here.${command === "docker" ? " Install Docker: https://docs.docker.com/get-docker/" : ""}` : `Could not run ${command}: ${error.message}`)));
+	child.on("close", (code) => resolvePromise({
+		code: code ?? 1,
+		stdout: Buffer.concat(stdout).toString("utf8"),
+		stderr: Buffer.concat(stderr).toString("utf8")
+	}));
+	child.stdin.on("error", () => {});
+	child.stdin.end(options.input);
+});
+var BunnyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/** The items of a list response: an array, or an object with items, data or a similar key. */
+function listOf(value) {
+	if (Array.isArray(value)) return value;
+	if (value && typeof value === "object") for (const key of [
+		"items",
+		"Items",
+		"data",
+		"applications",
+		"registries",
+		"containerRegistries",
+		"endpoints",
+		"regions"
+	]) {
+		const items = value[key];
+		if (Array.isArray(items)) return items;
+	}
+	return [];
+}
+function text(value) {
+	return typeof value === "string" && value ? value : typeof value === "number" ? String(value) : void 0;
+}
+/** The first value under a key that matches, searched depth first. */
+function findKey(value, pattern) {
+	if (!value || typeof value !== "object") return void 0;
+	for (const [key, item] of Object.entries(value)) if (pattern.test(key) && item != null && item !== "") return item;
+	for (const item of Object.values(value)) {
+		const found = findKey(item, pattern);
+		if (found !== void 0) return found;
+	}
+}
+var BunnyApi = class {
+	token;
+	fetchImpl;
+	base;
+	constructor(token, fetchImpl = fetch, base = BUNNY_API) {
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+		this.base = base;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.base}${path}`, {
+				method,
+				headers: {
+					AccessKey: this.token,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body)
+			});
+		} catch (error) {
+			throw new Error(`Could not reach ${this.base}: ${error.message}`);
+		}
+		const raw = await response.text();
+		let data;
+		try {
+			data = raw ? JSON.parse(raw) : void 0;
+		} catch {
+			data = raw;
+		}
+		if (response.ok) return data;
+		if (response.status === 401 || response.status === 403 && !raw) throw new BunnyError("Bunny refused the API key. Use the key of your account (not a sub-user's) from https://dash.bunny.net/account/api-key.", response.status);
+		throw new BunnyError(`Bunny answered ${response.status} to ${method} ${path}: ${errorText(data)}`, response.status);
+	}
+	/** The Magic Containers API. */
+	mc(method, path, body) {
+		return this.request(method, `/mc${path}`, body);
+	}
+};
+function errorText(data) {
+	if (typeof data === "string") return data.slice(0, 300) || "no details";
+	if (data && typeof data === "object") {
+		const value = data;
+		const parts = [
+			value.title,
+			value.detail,
+			value.message,
+			value.Message,
+			value.error
+		].map((item) => text(item)).filter(Boolean);
+		const errors = value.errors;
+		if (errors && typeof errors === "object") for (const [key, messages] of Object.entries(errors)) parts.push(`${key}: ${Array.isArray(messages) ? messages.join(" ") : String(messages)}`);
+		if (parts.length) return parts.join("; ");
+	}
+	return "no details";
+}
+/** A Bunny probe from a planned one. */
+function probeRequest(probe, failureThreshold) {
+	const check = probe.http ? { httpGet: {
+		request: {
+			path: probe.http.path,
+			portNumber: probe.http.port
+		},
+		response: { expectedStatusCode: "ok" }
+	} } : { tcpSocket: { request: { portNumber: probe.tcp?.port } } };
+	return {
+		initialDelaySeconds: 1,
+		periodSeconds: probe.periodSeconds,
+		timeoutSeconds: probe.timeoutSeconds,
+		failureThreshold,
+		successThreshold: 1,
+		...check
+	};
+}
+/** The image fields of a container. */
+function imageFields(container, options) {
+	const { image } = container;
+	if (image.source === "push") return {
+		imageRegistryId: options.registries.bunny,
+		imageNamespace: options.namespace,
+		imageName: image.repository,
+		imageTag: options.tag
+	};
+	const registry = image.source === "gitHub" ? options.registries.gitHub : options.registries.dockerHub;
+	if (!registry) throw new Error(`There is no public ${image.source === "gitHub" ? "GitHub" : "Docker Hub"} registry in Bunny.`);
+	return {
+		imageRegistryId: registry,
+		imageNamespace: image.namespace,
+		imageName: image.name,
+		imageTag: image.tag,
+		...image.digest ? { imageDigest: image.digest } : {}
+	};
+}
+/** The body of POST /apps for a planned app. */
+function appRequest(plan, options) {
+	return {
+		name: plan.name.replace(/[^A-Za-z0-9-\s]+/g, "-").slice(0, 100),
+		runtimeType: "shared",
+		autoScaling: {
+			min: 1,
+			max: 1
+		},
+		regionSettings: {
+			allowedRegionIds: [options.region],
+			requiredRegionIds: [options.region],
+			maxAllowedRegions: 1
+		},
+		containerTemplates: plan.containers.map((container) => ({
+			name: container.name,
+			...imageFields(container, options),
+			imagePullPolicy: "ifNotPresent",
+			...container.command || container.args || container.workingDir ? { entryPoint: {
+				...container.command ? { commandArray: container.command } : {},
+				...container.args ? { argumentsArray: container.args } : {},
+				...container.workingDir ? { workingDirectory: container.workingDir } : {}
+			} } : {},
+			environmentVariables: envList(container.env),
+			...container.probe ? { probes: {
+				startup: probeRequest(container.probe, container.probe.startupThreshold),
+				readiness: probeRequest(container.probe, container.probe.failureThreshold)
+			} } : {},
+			...container.endpoint ? { endpoints: [{
+				displayName: "site",
+				cdn: {
+					isSslEnabled: false,
+					portMappings: [{ containerPort: container.endpoint }]
+				}
+			}] } : {},
+			...container.volumeMounts.length ? { volumeMounts: container.volumeMounts } : {}
+		})),
+		...plan.volumes.length ? { volumes: plan.volumes.map((name) => ({
+			name,
+			size: options.volumeSize
+		})) } : {}
+	};
+}
+function envList(env) {
+	return Object.entries(env).map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+/** Bunny's word for an app's state, read from the fields its API returns. */
+function bunnyState(value) {
+	const word = (value ?? "").toLowerCase();
+	if (!word) return "unknown";
+	if (/fail|error|crash|unhealthy|degrad/.test(word)) return "degraded";
+	if (/stop|suspend|undeploy|inactive|paused|deleted/.test(word)) return "stopped";
+	if (/run|active|healthy|^ok$|ready|deployed|online/.test(word)) return "running";
+	return "unknown";
+}
+/** Whether Bunny is still rolling out. */
+function bunnyBusy(value) {
+	return /deploying|progress|updat|pending|creat|start|provision|rolling|scaling/i.test(value ?? "");
+}
+function appContainers(app) {
+	const value = app;
+	return listOf(value?.containerTemplates ?? value?.containers ?? []).map((item) => ({
+		id: text(item.id) ?? "",
+		name: text(item.name) ?? "",
+		imageNamespace: text(item.imageNamespace),
+		imageName: text(item.imageName),
+		imageTag: text(item.imageTag)
+	})).filter((item) => item.id && item.name);
+}
+function appStatusText(app) {
+	const value = app;
+	for (const key of [
+		"status",
+		"state",
+		"appStatus",
+		"displayStatus",
+		"deploymentStatus"
+	]) {
+		const item = value?.[key];
+		if (typeof item === "string") return item;
+		if (item && typeof item === "object") {
+			const nested = text(item.status ?? item.state ?? item.name);
+			if (nested) return nested;
+		}
+	}
+}
+var BunnyClient = class {
+	fetchImpl;
+	api;
+	token;
+	run;
+	now;
+	readFile;
+	edgeServersImpl;
+	constructor(token, fetchImpl = fetch, options = {}) {
+		this.fetchImpl = fetchImpl;
+		this.api = new BunnyApi(token, fetchImpl);
+		this.token = token;
+		this.run = options.run ?? systemRunner;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+		this.edgeServersImpl = options.edgeServers ?? (() => this.defaultEdgeServers());
+	}
+	async verify() {
+		const apps = listOf(await this.api.mc("GET", "/apps"));
+		return `Magic Containers (${apps.length} app${apps.length === 1 ? "" : "s"})`;
+	}
+	async docker(args, options = {}) {
+		const result = await this.run("docker", args, options);
+		if (result.code === 0) return result.stdout;
+		const last = (result.stderr.trim() || result.stdout.trim()).split("\n").at(-1) ?? "";
+		throw new Error(`docker ${args[0]} failed (exit ${result.code})${last ? `: ${last}` : "."}`);
+	}
+	async git(directory, args) {
+		return this.run("git", [
+			"-C",
+			directory,
+			...args
+		]);
+	}
+	/** The short commit and its subject. */
+	async commit(directory) {
+		const result = await this.git(directory, [
+			"log",
+			"-1",
+			"--format=%h%n%s"
+		]);
+		if (result.code !== 0) throw new Error("This project has no commit yet. Commit it first: git add -A && git commit");
+		const [commit = "", message = ""] = result.stdout.trim().split("\n");
+		return {
+			commit,
+			message
+		};
+	}
+	/** Extracts the local commit into a temporary directory, so the images match the commit. */
+	async checkout(directory) {
+		const target = mkdtempSync(join(tmpdir(), "dstack-bunny-"));
+		const archive = await this.git(directory, [
+			"archive",
+			"--format=tar",
+			"-o",
+			join(target, ".archive.tar"),
+			"HEAD"
+		]);
+		if (archive.code !== 0) {
+			rmSync(target, {
+				recursive: true,
+				force: true
+			});
+			throw new Error(`git archive failed: ${archive.stderr.trim().split("\n").at(-1) ?? ""}`);
+		}
+		const extract = await this.run("tar", [
+			"-x",
+			"-f",
+			".archive.tar"
+		], { cwd: target });
+		rmSync(join(target, ".archive.tar"), { force: true });
+		if (extract.code !== 0) {
+			rmSync(target, {
+				recursive: true,
+				force: true
+			});
+			throw new Error(`Could not extract the commit: ${extract.stderr.trim()}`);
+		}
+		return target;
+	}
+	/** The production Compose project, resolved with the variables, as JSON. */
+	async composeConfig(directory, env) {
+		const folder = mkdtempSync(join(tmpdir(), "dstack-env-"));
+		const file = join(folder, ".env");
+		writeFileSync(file, `${Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n")}\n`, { mode: 384 });
+		try {
+			const output = await this.docker([
+				"compose",
+				"--env-file",
+				file,
+				"config",
+				"--format",
+				"json"
+			], {
+				cwd: directory,
+				env: {
+					...env,
+					ENV_FILE: file
+				}
+			});
+			return JSON.parse(output);
+		} finally {
+			rmSync(folder, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async plan(directory, env) {
+		return planApp(await this.composeConfig(directory, env), { readFile: this.readFile });
+	}
+	/** Builds an image for linux/amd64 and pushes it to Bunny Container Registry. */
+	async buildAndPush(build, reference, directory) {
+		if (build.kind === "build") await this.docker([
+			"build",
+			"--platform",
+			"linux/amd64",
+			...build.target ? ["--target", build.target] : [],
+			...build.dockerfile ? ["-f", resolve(build.context, build.dockerfile)] : [],
+			...Object.entries(build.args ?? {}).flatMap(([key, value]) => ["--build-arg", `${key}=${value}`]),
+			"-t",
+			reference,
+			build.context
+		], {
+			cwd: directory,
+			stream: true
+		});
+		else {
+			const context = mkdtempSync(join(tmpdir(), "dstack-bake-"));
+			try {
+				const lines = [`FROM ${build.from}`];
+				build.files.forEach((file, index) => {
+					writeFileSync(join(context, `file-${index}`), file.content);
+					lines.push(`COPY file-${index} ${file.target}`);
+				});
+				writeFileSync(join(context, "Dockerfile"), `${lines.join("\n")}\n`);
+				await this.docker([
+					"build",
+					"--platform",
+					"linux/amd64",
+					"-t",
+					reference,
+					context
+				], { stream: true });
+			} finally {
+				rmSync(context, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		const config = mkdtempSync(join(tmpdir(), "dstack-docker-"));
+		try {
+			await this.docker([
+				"login",
+				BUNNY_REGISTRY,
+				"--username",
+				"token",
+				"--password-stdin"
+			], {
+				env: { DOCKER_CONFIG: config },
+				input: this.token
+			});
+			await this.docker(["push", reference], {
+				env: { DOCKER_CONFIG: config },
+				stream: true
+			});
+		} finally {
+			rmSync(config, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	/** Builds and pushes every image of the local commit; returns the plan of the commit. */
+	async pushImages(directory, env, namespace, tag, log) {
+		const checkout = await this.checkout(directory);
+		try {
+			const plan = await this.plan(checkout, env);
+			for (const build of plan.builds) {
+				const reference = `${BUNNY_REGISTRY}/${namespace}/${build.repository}:${tag}`;
+				log(`Building and pushing ${reference}`);
+				await this.buildAndPush(build, reference, checkout);
+			}
+			return plan;
+		} finally {
+			rmSync(checkout, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async registries() {
+		const list = listOf(await this.api.mc("GET", "/registries"));
+		const registries = {};
+		let namespace;
+		for (const item of list) {
+			const type = (text(item.type) ?? "").toLowerCase();
+			const id = text(item.id);
+			if (!id) continue;
+			if (type === "dockerhub" && !registries.dockerHub) registries.dockerHub = id;
+			else if (type === "github" && !registries.gitHub) registries.gitHub = id;
+			else if ((type === "bunnyregistry" || type === "bunny") && !registries.bunny) {
+				registries.bunny = id;
+				namespace = text(item.namespace ?? item.accountId ?? item.userName ?? item.username);
+			}
+		}
+		return {
+			registries,
+			namespace
+		};
+	}
+	async ensureRegistries() {
+		const found = await this.registries();
+		if (!found.registries.dockerHub) throw new Error("Bunny lists no public Docker Hub registry for this account. Check Magic Containers › Image Registries.");
+		if (!found.registries.bunny) {
+			const created = await this.api.mc("POST", "/registries", {
+				displayName: "Bunny Container Registry",
+				type: "bunnyRegistry"
+			});
+			const id = text(created?.id) ?? text(findKey(created, /^id$/i));
+			if (!id) throw new Error("Could not add Bunny Container Registry to Magic Containers.");
+			found.registries.bunny = id;
+		}
+		return {
+			registries: found.registries,
+			namespace: found.namespace
+		};
+	}
+	async app(link) {
+		return await this.api.mc("GET", `/apps/${encodeURIComponent(link.project)}`) ?? {};
+	}
+	async defaultEdgeServers() {
+		const addresses = [];
+		for (const path of ["/system/edgeserverlist", "/system/edgeserverlist/ipv6"]) {
+			const response = await this.fetchImpl(`${BUNNY_API}${path}`, { headers: { Accept: "application/json" } });
+			if (!response.ok) throw new Error(`Bunny answered ${response.status} to ${path}`);
+			const list = await response.json();
+			if (Array.isArray(list)) {
+				for (const item of list) if (typeof item === "string") addresses.push(item);
+			}
+		}
+		return addresses;
+	}
+	/** TRUSTED_PROXIES for Caddy: the addresses Bunny's CDN connects from. */
+	async trustedProxies() {
+		try {
+			const addresses = await this.edgeServersImpl();
+			return addresses.length ? addresses.join(" ") : void 0;
+		} catch {
+			return;
+		}
+	}
+	async pullZoneId(appId) {
+		for (let attempt = 0; attempt < 10; attempt++) {
+			const id = text(findKey(await this.api.mc("GET", `/apps/${encodeURIComponent(appId)}/endpoints`), /^pull_?zone_?id$/i));
+			if (id && id !== "0") return id;
+			await new Promise((done) => setTimeout(done, attempt ? 3e3 : 1e3));
+		}
+	}
+	async pullZone(id) {
+		return await this.api.request("GET", `/pullzone/${encodeURIComponent(id)}`) ?? {};
+	}
+	/** The custom hostname, its certificate and a cache bypass for pages that must not be cached. */
+	async setupPullZone(id, domain, step) {
+		const zone = `/pullzone/${encodeURIComponent(id)}`;
+		await this.api.request("POST", zone, { AddHostHeader: true });
+		if (!listOf((await this.pullZone(id)).Hostnames).map((item) => text(item.Value)?.toLowerCase()).includes(domain.toLowerCase())) {
+			await this.api.request("POST", `${zone}/addHostname`, { Hostname: domain });
+			step(`Added ${domain} to the CDN pull zone`);
+		}
+		await this.api.request("POST", `${zone}/edgerules/addOrUpdate`, {
+			ActionType: 3,
+			ActionParameter1: "0",
+			ActionParameter2: "0",
+			Triggers: [{
+				Type: 0,
+				PatternMatches: [
+					"*/admin",
+					"*/admin/*",
+					"*/api",
+					"*/api/*",
+					"*/_a/*"
+				],
+				PatternMatchingType: 0
+			}],
+			TriggerMatchingType: 0,
+			Description: "dstack: do not cache the admin, the API and analytics",
+			Enabled: true
+		});
+		await this.certificate(id, domain);
+	}
+	/** Requests the free certificate once DNS points at the CDN; returns whether it is active. */
+	async certificate(id, domain) {
+		if (listOf((await this.pullZone(id)).Hostnames).find((item) => text(item.Value)?.toLowerCase() === domain.toLowerCase())?.HasCertificate === true) return true;
+		try {
+			await this.api.request("GET", `/pullzone/loadFreeCertificate?hostname=${encodeURIComponent(domain)}`);
+			await this.api.request("POST", `/pullzone/${encodeURIComponent(id)}/setForceSSL`, {
+				Hostname: domain,
+				ForceSSL: true
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async cname(id) {
+		const name = text((await this.pullZone(id)).Name);
+		return name ? `${name}.b-cdn.net` : void 0;
+	}
+	recordsDir(directory) {
+		const folder = join(directory, BUNNY_DEPLOYS_DIR);
+		if (!existsSync(folder)) {
+			mkdirSync(folder, { recursive: true });
+			writeFileSync(join(folder, ".gitignore"), "*\n");
+		}
+		return folder;
+	}
+	writeRecord(directory, record, log) {
+		const folder = this.recordsDir(directory);
+		writeFileSync(join(folder, `${record.id}.json`), `${JSON.stringify(record, null, 2)}\n`);
+		writeFileSync(join(folder, `${record.id}.log`), log.length ? `${log.join("\n")}\n` : "");
+	}
+	records(directory) {
+		const folder = join(directory, BUNNY_DEPLOYS_DIR);
+		if (!existsSync(folder)) return [];
+		const records = [];
+		for (const file of readdirSync(folder)) {
+			if (!file.endsWith(".json")) continue;
+			try {
+				records.push(JSON.parse(readFileSync(join(folder, file), "utf8")));
+			} catch {}
+		}
+		return records.sort((a, b) => b.id.localeCompare(a.id));
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		const { directory } = context;
+		const volumeSize = Number.parseInt(options.volumeSize ?? "10", 10);
+		if (!Number.isFinite(volumeSize) || volumeSize < 1 || volumeSize > 100) throw new Error("Give --volume-size in GB, from 1 to 100.");
+		const env = { ...context.env };
+		const trusted = await this.trustedProxies();
+		if (trusted) env.TRUSTED_PROXIES = trusted;
+		else ask.step("Could not read Bunny's edge server list; Django may see the CDN's address instead of the client's. Run dstack deploy env push later.");
+		const local = await this.plan(directory, env);
+		if (local.ignored.length) ask.step(`Bunny runs the app in a gVisor sandbox; not applied from compose.yaml: ${local.ignored.join(", ")}`);
+		const { registries, namespace: found } = await this.ensureRegistries();
+		let namespace = options.account ?? found;
+		if (!namespace) namespace = (await ask.text("Bunny account id (Magic Containers › Image Registries, or bunny whoami)", { placeholder: "123456" })).trim();
+		if (!/^[\w.-]+$/.test(namespace)) throw new Error(`${namespace} is not a Bunny account id.`);
+		let region = options.region;
+		if (!region) {
+			const optimal = text(findKey(await this.api.mc("GET", "/regions/optimal").catch(() => void 0), /^id$|regionid/i));
+			const regions = listOf(await this.api.mc("GET", "/regions")).map((item) => ({
+				value: text(item.id) ?? "",
+				label: text(item.name) ?? text(item.id) ?? ""
+			})).filter((item) => item.value);
+			if (regions.length) region = await ask.select("Region", regions, optimal ?? regions[0]?.value);
+			else region = optimal;
+		}
+		if (!region) throw new Error("Pass --region, such as DE.");
+		const { commit, message } = await this.commit(directory);
+		const uncommitted = uncommittedReason(directory);
+		if (uncommitted) ask.step(`Building the last commit, ${commit}: ${uncommitted.replace(/ Commit first\.$/, "")}`);
+		const log = [];
+		const plan = await this.pushImages(directory, env, namespace, commit, (line) => {
+			log.push(line);
+			ask.step(line);
+		});
+		const appId = text((await this.api.mc("POST", "/apps", appRequest(plan, {
+			registries,
+			namespace,
+			tag: commit,
+			region,
+			volumeSize
+		})))?.id);
+		if (!appId) throw new Error("Bunny created the app but returned no id.");
+		ask.step(`Created the app ${plan.name} in ${region}`);
+		try {
+			await this.api.mc("POST", `/apps/${encodeURIComponent(appId)}/deploy`);
+		} catch (error) {
+			if (!(error instanceof BunnyError && [400, 409].includes(error.status))) throw error;
+		}
+		const zone = await this.pullZoneId(appId);
+		if (!zone) throw new Error(`Bunny has not created the CDN endpoint of app ${appId} yet. Run dstack deploy setup --force later.`);
+		await this.setupPullZone(zone, context.domain, ask.step);
+		const target = await this.cname(zone);
+		ask.step(`Add this DNS record: ${context.domain} CNAME ${target ?? "the pull zone's b-cdn.net address"}${context.domain.split(".").length === 2 ? " (an apex domain needs Bunny DNS, or use www and redirect)" : ""}`);
+		this.writeRecord(directory, {
+			id: deployId(this.now(), commit),
+			tag: commit,
+			commit,
+			message,
+			createdAt: this.now().toISOString()
+		}, log);
+		return {
+			project: appId,
+			environment: namespace,
+			application: zone
+		};
+	}
+	async pushEnv(link, env) {
+		const directory = projectDirectory(link);
+		const values = { ...env };
+		const trusted = await this.trustedProxies();
+		if (trusted) values.TRUSTED_PROXIES = trusted;
+		const plan = await this.plan(directory, values);
+		const containers = appContainers(await this.app(link));
+		for (const container of plan.containers) {
+			const remote = containers.find((item) => item.name === container.name);
+			if (!remote) throw new Error(missingContainer(container.name));
+			await this.api.mc("PUT", `/apps/${encodeURIComponent(link.project)}/containers/${encodeURIComponent(remote.id)}/env`, { environmentVariables: envList(container.env) });
+		}
+	}
+	async deploy(link, options) {
+		const { directory } = options;
+		const { commit, message } = await this.commit(directory);
+		const id = deployId(this.now(), commit);
+		const log = [];
+		const record = {
+			id,
+			tag: commit,
+			commit,
+			message,
+			createdAt: this.now().toISOString()
+		};
+		const containers = appContainers(await this.app(link));
+		const env = {
+			...productionEnv(directory),
+			...BUNNY_PLATFORM_ENV
+		};
+		try {
+			const local = await this.plan(directory, env);
+			const pushed = local.containers.filter((container) => container.image.source === "push");
+			for (const container of local.containers) if (!containers.some((item) => item.name === container.name)) throw new Error(missingContainer(container.name));
+			if (pushed.every((container) => containers.find((item) => item.name === container.name)?.imageTag === commit)) {
+				if (options.force) {
+					await this.api.mc("POST", `/apps/${encodeURIComponent(link.project)}/restart`);
+					log.push(`Restarted the app on ${commit}`);
+				} else log.push(`The app already runs ${commit}; nothing to deploy. Pass --force to restart it.`);
+			} else {
+				await this.pushImages(directory, env, link.environment, commit, (line) => {
+					log.push(line);
+					process.stderr.write(`${line}\n`);
+				});
+				await this.retag(link, containers, pushed.map((container) => container.name), commit);
+				log.push(`Bunny is rolling out ${commit}`);
+			}
+			if (link.application) {
+				const domain = (env.SITE_URL ?? "").replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+				if (domain) await this.certificate(link.application, domain).catch(() => false);
+			}
+		} catch (error) {
+			log.push(error.message);
+			this.writeRecord(directory, {
+				...record,
+				failed: true
+			}, log);
+			throw error;
+		}
+		this.writeRecord(directory, record, log);
+		this.prune(directory);
+		return id;
+	}
+	/** Points the containers of pushed images at a tag; Bunny starts a rolling update. */
+	async retag(link, remote, names, tag) {
+		for (const name of names) {
+			const item = remote.find((entry) => entry.name === name);
+			if (!item || item.imageTag === tag) continue;
+			await this.api.mc("PATCH", `/apps/${encodeURIComponent(link.project)}/containers/${encodeURIComponent(item.id)}`, { imageTag: tag });
+		}
+	}
+	/** Removes records beyond KEEP_DEPLOYS. Their images stay in the registry. */
+	prune(directory) {
+		const folder = join(directory, BUNNY_DEPLOYS_DIR);
+		for (const record of this.records(directory).slice(20)) {
+			rmSync(join(folder, `${record.id}.json`), { force: true });
+			rmSync(join(folder, `${record.id}.log`), { force: true });
+		}
+	}
+	async rollback(link, to) {
+		const directory = projectDirectory(link);
+		const records = this.records(directory);
+		const containers = appContainers(await this.app(link));
+		const pushed = containers.filter((item) => isPushed(item, link));
+		const currentTag = pushed[0]?.imageTag;
+		let target;
+		if (to) {
+			target = records.find((item) => item.id === to || item.tag === to);
+			if (!target) throw new Error(`There is no deploy ${to} in ${BUNNY_DEPLOYS_DIR}.`);
+		} else {
+			target = records.find((item) => !item.failed && item.tag !== currentTag);
+			if (!target) throw new Error("There is no earlier deploy to roll back to.");
+		}
+		if (target.failed) throw new Error(`Deploy ${target.id} failed, so its images may not exist.`);
+		const id = deployId(this.now(), "rollback");
+		await this.retag(link, containers, pushed.map((item) => item.name), target.tag);
+		this.writeRecord(directory, {
+			id,
+			tag: target.tag,
+			commit: target.commit,
+			message: `Rollback to ${target.id}`,
+			createdAt: this.now().toISOString(),
+			rollbackOf: target.id
+		}, [`Bunny is rolling out ${target.tag}`]);
+		return id;
+	}
+	/** The tag the app's own images run, and Bunny's state. */
+	async current(link) {
+		const app = await this.app(link);
+		return {
+			tag: appContainers(app).filter((item) => isPushed(item, link))[0]?.imageTag,
+			status: appStatusText(app)
+		};
+	}
+	statusOf(record, latest, current) {
+		if (record.failed) return "failed";
+		if (record.tag === current.tag && latest) {
+			if (bunnyBusy(current.status)) return "building";
+			const state = bunnyState(current.status);
+			if (state === "running" || state === "unknown") return "finished";
+			return "failed";
+		}
+		if (latest) return this.now().getTime() - new Date(record.createdAt).getTime() < 12e4 ? "queued" : "failed";
+		return "finished";
+	}
+	async deployment(link, id) {
+		const directory = projectDirectory(link);
+		const records = this.records(directory);
+		const record = records.find((item) => item.id === id);
+		if (!record) throw new Error(`There is no deploy ${id} in ${BUNNY_DEPLOYS_DIR}.`);
+		const current = await this.current(link);
+		const logFile = join(directory, BUNNY_DEPLOYS_DIR, `${id}.log`);
+		const log = existsSync(logFile) ? readFileSync(logFile, "utf8").replace(/\n$/, "") : "";
+		return {
+			...toDeployment$1(record, this.statusOf(record, records[0]?.id === id, current), link),
+			log: log ? log.split("\n").map((line) => ({
+				text: line,
+				stderr: false
+			})) : []
+		};
+	}
+	async deployments(link, limit) {
+		const records = this.records(projectDirectory(link)).slice(0, Math.max(1, limit));
+		if (!records.length) return [];
+		const current = await this.current(link);
+		return records.map((record, index) => ({
+			...toDeployment$1(record, this.statusOf(record, index === 0, current), link),
+			log: []
+		}));
+	}
+	async status(link) {
+		const word = appStatusText(await this.app(link));
+		const state = bunnyBusy(word) ? "degraded" : bunnyState(word);
+		const details = [word ?? "no status"];
+		const domains = [];
+		if (link.application) try {
+			const zone = await this.pullZone(link.application);
+			for (const item of listOf(zone.Hostnames)) {
+				const host = text(item.Value);
+				if (!host || item.IsSystemHostname === true || host.endsWith(".b-cdn.net")) continue;
+				domains.push(`https://${host}`);
+				if (item.HasCertificate !== true) details.push(`no certificate for ${host} yet: check its DNS record`);
+			}
+		} catch {
+			details.push("could not read the CDN pull zone");
+		}
+		return {
+			state,
+			detail: details.join(", "),
+			domains,
+			url: dashboardUrl(link)
+		};
+	}
+};
+function missingContainer(name) {
+	return `The app on Bunny has no container ${name}. compose.yaml changed since setup: run dstack deploy setup --force to create the app again.`;
+}
+/** Whether a Bunny container runs an image this project pushes: one in the account's namespace. */
+function isPushed(container, link) {
+	return container.imageNamespace === link.environment;
+}
+/** The project directory, where the deploy records are. */
+function projectDirectory(link) {
+	return link.directory ?? process.cwd();
+}
+function dashboardUrl(link) {
+	return `https://dash.bunny.net/magic-containers/apps/${encodeURIComponent(link.project)}`;
+}
+function toDeployment$1(record, status, link) {
+	return {
+		id: record.id,
+		status,
+		commit: record.commit,
+		message: record.message,
+		createdAt: record.createdAt,
+		url: dashboardUrl(link)
+	};
+}
+/** The variables of .env.production, or of .env on a machine where that is the production one. */
+function productionEnv(directory) {
+	for (const name of [".env.production", ".env"]) {
+		const file = join(directory, name);
+		if (existsSync(file)) return parseEnv(readFileSync(file, "utf8"));
+	}
+	throw new Error(".env.production does not exist. Run dstack production --domain example.com first.");
+}
+const bunny = {
+	id: "bunny",
+	name: "Bunny Magic Containers",
+	auth: {
+		kind: "token",
+		env: "DSTACK_BUNNY_TOKEN",
+		help: () => "Copy the API key of your bunny.net account from https://dash.bunny.net/account/api-key. It also logs in to Bunny Container Registry."
+	},
+	source: "local",
+	target: {
+		label: "Bunny API",
+		placeholder: BUNNY_API,
+		fixed: BUNNY_API,
+		normalize: () => BUNNY_API
+	},
+	platformEnv: BUNNY_PLATFORM_ENV,
+	setupFlags: [
+		{
+			name: "region",
+			description: "Bunny: the region of the app, such as DE (default: the closest)"
+		},
+		{
+			name: "volumeSize",
+			description: "Bunny: the size of the database volume in GB (default: 10)"
+		},
+		{
+			name: "account",
+			description: "Bunny: the account id, the namespace in Bunny Container Registry"
+		}
+	],
+	printsDns: true,
+	connect: (_target, token) => {
+		if (!token) throw new Error("Bunny needs an API key.");
+		return new BunnyClient(token);
+	}
+};
+// src/deploy/provider.ts
+/** The target of a platform with a web API and an API key. */
+function urlTarget(name, placeholder) {
+	return {
+		label: `${name} URL`,
+		placeholder,
+		normalize: normalizeUrl
+	};
+}
+/** Normalizes an instance URL: https by default, no trailing slash or path. */
+function normalizeUrl(value) {
+	const trimmed = value.trim();
+	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+	let parsed;
+	try {
+		parsed = new URL(withScheme);
+	} catch {
+		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
+	}
+	return `${parsed.protocol}//${parsed.host}`;
+}
+// src/deploy/coolify.ts
+/**
+* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
+* token. The project deploys as a Docker Compose application that Coolify
+* builds on the server from the git repository; Coolify's proxy gets the
+* certificate and forwards to the `proxy` service (Caddy) on port 80.
+*/
+/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
+const PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	TRUSTED_PROXIES: "private_ranges",
+	NUM_PROXIES: "2",
+	HTTP_PORT: "127.0.0.1:8080",
+	HTTPS_PORT: "127.0.0.1:8443"
+};
+/** Setup flags Coolify and Dokploy share; `deploy setup` shows each flag once. */
+const SHARED_SETUP_FLAGS = [
+	{
+		name: "server",
+		description: "The server on the platform, by name or id (Dokploy: dokploy for its own)"
+	},
+	{
+		name: "project",
+		description: "The platform's project, by name or id (default: the project name)"
+	},
+	{
+		name: "environment",
+		description: "The platform's environment (default: production)"
+	}
+];
+var CoolifyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var CoolifyApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
+				method,
+				headers: {
+					Authorization: `Bearer ${this.token}`,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new CoolifyError(errorMessage$1(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (path) => this.request("GET", path);
+	post = (path, body) => this.request("POST", path, body ?? {});
+	patch = (path, body) => this.request("PATCH", path, body);
+};
+function errorMessage$1(status, text, url) {
+	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? "";
+		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+const enc = encodeURIComponent;
+function deploymentStatus(value) {
+	if (value === "queued") return "queued";
+	if (value === "in_progress") return "building";
+	if (value === "finished") return "finished";
+	if (value.startsWith("cancelled")) return "cancelled";
+	return "failed";
+}
+function appState(value) {
+	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
+	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
+	if (state === "degraded" || state === "restarting") return "degraded";
+	if (state === "exited" || state === "stopped") return "stopped";
+	return "unknown";
+}
+/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
+function parseLog(logs) {
+	if (!logs) return [];
+	let entries;
+	try {
+		entries = JSON.parse(logs);
+	} catch {
+		return logs.split("\n").map((text) => ({
+			text,
+			stderr: false
+		}));
+	}
+	if (!Array.isArray(entries)) return [];
+	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
+		text,
+		stderr: entry.type === "stderr"
+	})));
+}
+/** The domains of a Compose application, by service. */
+function composeDomains(app) {
+	let value = app.docker_compose_domains;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		value = null;
+	}
+	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
+	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
+	return domains.map((domain) => domain.replace(/:\d+$/, ""));
+}
+function appUrl(api, link) {
+	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
+}
+function toDeployment(api, link, item) {
+	const path = item.deployment_url;
+	return {
+		id: item.deployment_uuid,
+		status: deploymentStatus(item.status),
+		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
+		message: item.commit_message?.split("\n")[0] || void 0,
+		createdAt: item.created_at,
+		updatedAt: item.updated_at,
+		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
+		log: parseLog(item.logs)
+	};
+}
+/** Finds a name or uuid in a list. */
+function find$1(items, wanted) {
+	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+}
+var CoolifyClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new CoolifyApi(url, token, fetchImpl);
+	}
+	async verify() {
+		const version = await this.api.get("/version");
+		await this.api.get("/servers");
+		return String(version).trim();
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		if (!context.repository) throw new Error("Coolify builds from a git repository; pass --repository.");
+		const api = this.api;
+		const servers = await api.get("/servers");
+		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
+		let server;
+		if (options.server) {
+			server = find$1(servers, options.server);
+			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
+		} else if (servers.length === 1) server = servers[0];
+		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+			value: item.uuid,
+			label: item.name,
+			hint: item.ip
+		}))));
+		if (!server) throw new Error("No server chosen.");
+		const projects = await api.get("/projects");
+		let project;
+		const projectName = options.project ?? context.name;
+		project = find$1(projects, projectName);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const uuid = await ask.select("Coolify project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.uuid,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.uuid ?? NEW);
+			project = uuid === NEW ? void 0 : find$1(projects, uuid);
+		}
+		if (!project) {
+			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
+			project = {
+				uuid: (await api.post("/projects", {
+					name: projectName,
+					description: "DjangoStack"
+				})).uuid,
+				name: projectName
+			};
+			ask.step(`Created the Coolify project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		if (!environment) {
+			environment = {
+				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let githubApp;
+		if (options.githubApp && options.githubApp !== "public") {
+			const app = find$1(await api.get("/github-apps"), options.githubApp);
+			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
+			githubApp = app.uuid;
+		} else if (!options.githubApp && ask.interactive) {
+			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
+			if (apps.length) {
+				const choice = await ask.select("How Coolify gets the code", [{
+					value: "public",
+					label: "Public repository",
+					hint: "no access needed"
+				}, ...apps.map((app) => ({
+					value: app.uuid,
+					label: `GitHub App ${app.name}`,
+					hint: "private repository"
+				}))], "public");
+				githubApp = choice === "public" ? void 0 : choice;
+			}
+		}
+		const body = {
+			project_uuid: project.uuid,
+			server_uuid: server.uuid,
+			environment_uuid: environment.uuid,
+			git_repository: context.repository,
+			git_branch: context.branch,
+			build_pack: "dockercompose",
+			docker_compose_location: "/compose.yaml",
+			docker_compose_domains: [{
+				name: "proxy",
+				domain: `https://${context.domain}:80`
+			}],
+			name: context.name,
+			description: "DjangoStack",
+			instant_deploy: false,
+			...githubApp ? { github_app_uuid: githubApp } : {}
+		};
+		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
+		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
+		const link = {
+			provider: "coolify",
+			url: api.url,
+			project: project.uuid,
+			environment: environment.uuid,
+			application: created.uuid
+		};
+		await this.pushEnv(link, context.env);
+		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
+		return {
+			project: link.project,
+			environment: link.environment,
+			application: link.application
+		};
+	}
+	async pushEnv(link, env) {
+		const data = Object.entries(env).map(([key, value]) => ({
+			key,
+			value,
+			is_literal: true,
+			is_preview: false
+		}));
+		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
+	}
+	async deploy(link, options) {
+		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
+		const result = await this.api.post(`/deploy?${query}`);
+		const id = result?.deployments?.[0]?.deployment_uuid;
+		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
+		return id;
 	}
 	async deployment(link, id) {
-		if (!ID.test(id)) throw new Error(`Invalid deploy id ${id}.`);
-		const deploys = shellQuote(`${link.project}/deploys`);
-		const output = await this.sh(`
-cd ${deploys} || exit 1
-[ -f ${shellQuote(`${id}.json`)} ] || { echo missing; exit 0; }
-cat ${shellQuote(`${id}.json`)}
-pid=$(cat ${shellQuote(`${id}.pid`)} 2>/dev/null)
-if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then alive=1; else alive=0; fi
-printf '%s %s %s\\n' "$(cat ${shellQuote(`${id}.status`)} 2>/dev/null || echo failed)" "$alive" "$(date -u -r ${shellQuote(`${id}.status`)} +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"
-echo ${MARK}
-cat ${shellQuote(`${id}.log`)} 2>/dev/null
-`);
-		if (output.trim() === "missing") throw new Error(`There is no deploy ${id} on the server.`);
-		const [head = "", log = ""] = output.split(`\n${MARK}\n`);
-		const [json = "{}", state = ""] = head.split("\n");
-		const record = JSON.parse(json);
-		const [status = "", alive = "0", updatedAt] = state.split(" ");
-		return {
-			...toDeployment(record, recordStatus(status, alive === "1"), updatedAt || void 0),
-			log: log ? log.replace(/\n$/, "").split("\n").map((text) => ({
-				text,
-				stderr: false
-			})) : []
-		};
+		return toDeployment(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
 	}
 	async deployments(link, limit) {
-		return (await this.records(link, limit)).map((item) => ({
-			...toDeployment(item.record, item.status, item.updatedAt),
-			log: []
-		}));
+		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
+		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment(this.api, link, item));
 	}
 	async status(link) {
-		const [ps = "", site = ""] = parts(await this.sh(`
-docker compose -p ${shellQuote(link.application)} ps --all --format json
-echo ${MARK}
-sed -n 's/^SITE_URL=//p' ${shellQuote(`${link.project}/shared/.env`)} 2>/dev/null
-`));
-		const { state, detail } = composeState(parseComposePs(ps));
-		const domain = site.trim().replace(/^["']|["']$/g, "");
+		const app = await this.api.get(`/applications/${enc(link.application)}`);
 		return {
-			state,
-			detail,
-			domains: domain ? [domain] : []
+			state: appState(app.status),
+			detail: app.status ?? "unknown",
+			domains: composeDomains(app),
+			branch: app.git_branch,
+			url: appUrl(this.api, link)
 		};
 	}
 };
-function toDeployment(record, status, updatedAt) {
-	return {
-		id: record.id,
-		status,
-		commit: record.commit,
-		message: record.message,
-		createdAt: record.createdAt,
-		updatedAt
-	};
-}
-/**
-* A value for a Compose .env line: bare when safe, else single-quoted (taken
-* literally), or double-quoted with escapes when it holds a single quote.
-*/
-function envValue(value) {
-	if (/^[\w@%+=:,./-]*$/.test(value)) return value;
-	if (!value.includes("'") && !value.includes("\n")) return `'${value}'`;
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "$$$$").replace(/\n/g, "\\n")}"`;
-}
-function defaultGit(args) {
-	return execFileSync("git", args, {
-		maxBuffer: 1073741824,
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-}
-const ssh = {
-	id: "ssh",
-	name: "SSH server",
-	auth: { kind: "ssh" },
-	source: "local",
-	target: {
-		label: "Server",
-		placeholder: "deploy@example.com",
-		normalize: (value) => formatTarget(parseTarget(value))
+const coolify = {
+	id: "coolify",
+	name: "Coolify",
+	auth: {
+		kind: "token",
+		env: "DSTACK_COOLIFY_TOKEN",
+		help: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`
 	},
-	platformEnv: {},
-	setupFlags: [{
-		name: "path",
-		description: "The project directory on the server (default: /srv/<project>)"
+	source: "remote",
+	target: urlTarget("Coolify", "https://coolify.example.com"),
+	platformEnv: PLATFORM_ENV,
+	setupFlags: [...SHARED_SETUP_FLAGS, {
+		name: "githubApp",
+		description: "A Coolify GitHub App for a private repository, or public"
 	}],
-	connect: (target) => new SshClient(target)
+	connect: (url, token) => {
+		if (!token) throw new Error("Coolify needs an API key.");
+		return new CoolifyClient(url, token);
+	}
 };
 // src/deploy/dokploy.ts
 var DokployError = class extends Error {
@@ -1164,123 +2480,14 @@ function deleteToken(provider, url) {
 	} catch {}
 	return removeFromFile(account) || removed;
 }
-// src/deploy/link.ts
-/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
-const LINK_FILE = ".dstack/deploy.json";
-function readLink(directory) {
-	const path = join(directory, LINK_FILE);
-	if (!existsSync(path)) return void 0;
-	let link;
-	try {
-		link = JSON.parse(readFileSync(path, "utf8"));
-	} catch {
-		throw new Error(`${LINK_FILE} is not valid JSON.`);
-	}
-	for (const key of [
-		"provider",
-		"url",
-		"project",
-		"environment",
-		"application"
-	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
-	return link;
-}
-function writeLink(directory, link) {
-	const path = join(directory, LINK_FILE);
-	mkdirSync(dirname(path), { recursive: true });
-	const { provider, url, project, environment, application } = link;
-	writeFileSync(path, `${JSON.stringify({
-		provider,
-		url,
-		project,
-		environment,
-		application
-	}, null, 2)}\n`);
-}
-/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
-function httpsRepository(remote) {
-	const value = remote.trim();
-	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
-	let url;
-	if (scp) url = `https://${scp[1]}/${scp[2]}`;
-	else try {
-		const parsed = new URL(value);
-		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
-	} catch {
-		throw new Error(`Cannot read the git remote ${value}.`);
-	}
-	return url.replace(/\.git$/, "").replace(/\/$/, "");
-}
-function git(directory, args) {
-	try {
-		return execFileSync("git", args, {
-			cwd: directory,
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return;
-	}
-}
-function gitRemote(directory, remote = "origin") {
-	return git(directory, [
-		"remote",
-		"get-url",
-		remote
-	]) || void 0;
-}
-function gitBranch(directory) {
-	const branch = git(directory, [
-		"rev-parse",
-		"--abbrev-ref",
-		"HEAD"
-	]);
-	return branch && branch !== "HEAD" ? branch : void 0;
-}
-/**
-* Why a deploy of `branch` would not include the local commit, or undefined
-* when origin has it. The platform builds from the remote, not from here.
-*/
-function unpushedReason(directory, branch) {
-	const head = git(directory, ["rev-parse", "HEAD"]);
-	if (!head) return void 0;
-	if (git(directory, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		`refs/remotes/origin/${branch}`
-	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
-	if (git(directory, [
-		"merge-base",
-		"--is-ancestor",
-		head,
-		`refs/remotes/origin/${branch}`
-	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
-}
-/**
-* Why an upload of HEAD would not match the working tree, or undefined when
-* it does. Providers that upload the local commit deploy HEAD only, so
-* changes to tracked files must be committed first.
-*/
-function uncommittedReason(directory) {
-	if (git(directory, ["rev-parse", "HEAD"]) === void 0) return "This project has no commit yet. Commit it first: git add -A && git commit";
-	if (git(directory, [
-		"status",
-		"--porcelain",
-		"--untracked-files=no"
-	])) return "You have uncommitted changes, so the deploy would not include them. Commit first.";
-}
 // src/deploy/index.ts
 const DEFAULT_PROVIDER = coolify;
 /** Every deploy provider. */
 const PROVIDERS = [
 	coolify,
 	dokploy,
-	ssh
+	ssh,
+	bunny
 ];
 function getProvider(id) {
 	const provider = PROVIDERS.find((item) => item.id === id);
@@ -1362,14 +2569,21 @@ function projectManifest(project) {
 /**
 * The project's stack: from the preset `init` saved in `package.json`, or,
 * for projects from before that, the defaults with the storage from `.env`.
+* Analytics follow the `analytics` profile: projects from before Umami was
+* generated have the default in their preset without running it.
 */
 function projectStack(project) {
+	const analytics = project.profiles.includes("analytics") ? "umami" : "off";
 	const { preset } = projectManifest(project);
 	if (preset) try {
-		return decodePreset(preset);
+		return {
+			...decodePreset(preset),
+			analytics
+		};
 	} catch {}
 	return {
 		...DEFAULT_STACK,
+		analytics,
 		storage: project.profiles.includes("s3") ? "s3" : "local"
 	};
 }
@@ -1650,7 +2864,7 @@ async function deploySetup(options) {
 		}))
 	}));
 	const provider = providerOrFail(providerId);
-	let instance = options.url;
+	let instance = options.url ?? provider.target.fixed;
 	if (!instance) {
 		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
 		instance = unwrap(await p.text({
@@ -1693,6 +2907,7 @@ async function deploySetup(options) {
 	for (const flag of provider.setupFlags) flags[flag.name] = options[flag.name];
 	const ids = await attempt(client.setup({
 		ask: promptAsk(interactive),
+		directory: project.directory,
 		name: project.name,
 		repository,
 		branch,
@@ -1703,11 +2918,12 @@ async function deploySetup(options) {
 	const link = {
 		provider: provider.id,
 		url: instance,
-		...ids
+		...ids,
+		directory: project.directory
 	};
 	writeLink(project.directory, link);
 	p.log.success(`Wrote ${pc.bold(LINK_FILE)}. It holds no secrets; commit it so others deploy to the same place.`);
-	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.auth.kind === "ssh" ? "" : `${provider.name} `}server.`, provider.auth.kind === "ssh" ? `To change variables, edit ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.` : `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
+	p.note([...provider.printsDns ? [] : [`Point the DNS of ${pc.bold(domain)} at the ${provider.auth.kind === "ssh" ? "" : `${provider.name} `}server.`], provider.auth.kind === "ssh" ? `To change variables, edit ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.` : `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
 	if (options.deploy ?? (interactive ? unwrap(await p.confirm({
 		message: "Deploy now?",
 		initialValue: true
@@ -1901,7 +3117,7 @@ async function loginTarget(options, interactive) {
 	} catch {}
 	const provider = providerOrFail(options.provider ?? link?.provider ?? DEFAULT_PROVIDER.id);
 	tokenAuth(provider);
-	let instance = options.url ?? link?.url;
+	let instance = options.url ?? link?.url ?? provider.target.fixed;
 	if (!instance) {
 		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
 		instance = unwrap(await p.text({
@@ -2350,6 +3566,7 @@ async function init(directoryArgument, options) {
 			demoContent,
 			databaseUrl,
 			localS3: stack.storage === "s3",
+			analytics: stack.analytics === "umami",
 			preset: encodePreset(stack),
 			timeZone,
 			link: options.link
@@ -2452,7 +3669,7 @@ async function production(directoryArgument, options) {
 	}
 	let result;
 	try {
-		result = productionEnv(readFileSync(envPath, "utf8"), {
+		result = productionEnv$1(readFileSync(envPath, "utf8"), {
 			domain,
 			emailUrl: options.emailUrl
 		});
@@ -2473,7 +3690,7 @@ async function production(directoryArgument, options) {
 }
 // src/config.ts
 /** The options `config` can switch in an existing project. The rest follow with code generation. */
-const SWITCHABLE = ["storage"];
+const SWITCHABLE = ["storage", "analytics"];
 const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key === "S3_CREATE_BUCKET" ? "0" : ""]));
 /**
 * Applies a new stack to a project's `.env`. Throws with a one-line reason
@@ -2482,7 +3699,7 @@ const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key
 function applyStack(envText, env, from, to) {
 	let text = envText;
 	const changes = [];
-	const profiles = (env.COMPOSE_PROFILES ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
+	let profiles = (env.COMPOSE_PROFILES ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
 	for (const option of STACK_OPTIONS) {
 		const key = option.key;
 		if (from[key] === to[key]) continue;
@@ -2493,14 +3710,33 @@ function applyStack(envText, env, from, to) {
 			if (profiles.includes("prod")) throw new Error("--storage only changes development; this .env runs the prod profile.");
 			const endpoint = env.S3_ENDPOINT_URL ?? "";
 			if (endpoint && !endpoint.includes("s3:8333")) throw new Error(`S3_ENDPOINT_URL points at ${endpoint}; change the S3_* values in .env yourself.`);
-			const next = profiles.filter((profile) => profile !== "s3");
-			if (to.storage === "s3") next.push("s3");
+			profiles = profiles.filter((profile) => profile !== "s3");
+			if (to.storage === "s3") profiles.push("s3");
 			text = setEnvValues(text, {
 				...to.storage === "s3" ? LOCAL_S3 : EMPTY_S3,
-				COMPOSE_PROFILES: next.join(",")
+				COMPOSE_PROFILES: profiles.join(",")
 			});
 			changes.push(to.storage === "s3" ? "Uploads go to the local S3 service (the s3 profile)." : "Uploads go to a Docker volume; the local S3 service is off.");
 		}
+		if (key === "analytics") {
+			profiles = profiles.filter((profile) => profile !== "analytics");
+			if (to.analytics === "umami") {
+				profiles.push("analytics");
+				const fresh = umamiEnv(env.DATABASE_URL ?? "", generateProjectSecrets());
+				const kept = Object.fromEntries(Object.entries(fresh).filter(([name]) => name === "UMAMI_URL" || !env[name]));
+				text = setEnvValues(text, {
+					...kept,
+					COMPOSE_PROFILES: profiles.join(",")
+				});
+				changes.push("Page analytics with Umami are on (the analytics profile).");
+			} else {
+				text = setEnvValues(text, {
+					UMAMI_URL: "",
+					COMPOSE_PROFILES: profiles.join(",")
+				});
+				changes.push("Page analytics are off; Umami's data stays in the database.");
+			}
+		}
 	}
 	return {
 		env: text,
@@ -2539,7 +3775,7 @@ function exitWith(status) {
 function ensureRunEnv(project) {
 	const path = join(project.directory, RUN_ENV);
 	if (!existsSync(path)) {
-		const result = productionEnv(readFileSync(join(project.directory, ".env"), "utf8"), {
+		const result = productionEnv$1(readFileSync(join(project.directory, ".env"), "utf8"), {
 			domain: RUN_DOMAIN,
 			emailUrl: "console://"
 		});
@@ -2931,6 +4167,10 @@ async function config(options) {
 			}))
 		}));
 	}
+	if (next.analytics === "umami" && current.analytics !== "umami") {
+		const compose = join(project.directory, "compose.yaml");
+		if (!existsSync(compose) || !/^ {2}umami:/m.test(readFileSync(compose, "utf8"))) fail("compose.yaml has no umami service. Add it as the analytics docs describe, then run this again.");
+	}
 	const envPath = join(project.directory, ".env");
 	let result;
 	try {
@@ -3001,7 +4241,7 @@ function createProgram() {
 	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
 	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
 	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
-	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy or a server over SSH, and show the status");
+	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy, Bunny or a server over SSH, and show the status");
 	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when it would not include your local commits or changes").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
 	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com, or the server, such as deploy@example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
 	const seen = /* @__PURE__ */ new Set();