@django-stack/cli 0.5.0 → 0.7.0

package/dist/bin.js

@@ -1,360 +1,410 @@
 #!/usr/bin/env node
-import { D as parseEnv, E as checkTools, O as setEnvValues, S as validateDomain, T as runDoctor, _ as encodePreset, a as relativeDirectory, b as stackOption, c as toProjectName, d as CLI_VERSION, f as DEFAULT_STACK, g as decodePreset, h as applies, l as validateProjectName, m as STACK_OPTIONS, n as LOCAL_S3, o as scaffold, p as NAMED_PRESETS, r as lockBackend, s as timeZones, u as validateTimeZone, v as pendingChoices, w as generateSecret, x as productionEnv, y as resolvePreset } from "./scaffold-DbgGYEsc.js";
+import { A as generateSecret, B as isDockerDown, C as applies, D as resolvePreset, E as pendingChoices, F as portValues, H as quoteEnvValue, I as runDoctor, L as checkTools, M as chooseFreePorts, N as describeMove, O as stackOption, P as envPorts, R as dockerNotRunning, S as STACK_OPTIONS, T as encodePreset, U as setEnvValues, V as parseEnv, _ as validateTimeZone, a as LOCAL_S3, b as NAMED_PRESETS, c as lockBackend, d as scaffold, f as timeZones, g as validateProjectName, h as usesValkey, j as DEV_PORTS, k as generateProjectSecrets, m as umamiEnv, n as productionEnv$1, o as cacheEnv, p as toProjectName, r as validateDomain, s as localS3, t as missingS3, u as relativeDirectory, v as CLI_VERSION, w as decodePreset, x as PROMPT_ORDER, y as DEFAULT_STACK, z as dockerRunning } from "./production-DBpWWx6i.js";
 import { createRequire } from "node:module";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, delimiter, dirname, join, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { basename, delimiter, dirname, join, relative, resolve } from "node:path";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import pc from "picocolors";
 import tab from "@bomb.sh/tab/commander";
 import * as p from "@clack/prompts";
 import { Command, InvalidArgumentError, Option } from "commander";
-import { homedir } from "node:os";
-// src/deploy/provider.ts
-/** The target of a platform with a web API and an API key. */
-function urlTarget(name, placeholder) {
+import { homedir, tmpdir } from "node:os";
+// src/deploy/bunny-compose.ts
+/** Volumes that are not needed on Bunny: its CDN holds the certificate, uploads and backups go to S3. */
+const DROPPED_VOLUMES = /* @__PURE__ */ new Set([
+	"caddy_data",
+	"caddy_config",
+	"backups",
+	"media"
+]);
+/** Compose keys that do not apply on Bunny: its gVisor sandbox isolates the app instead. */
+const IGNORED_KEYS = [
+	"read_only",
+	"tmpfs",
+	"cap_add",
+	"cap_drop",
+	"security_opt",
+	"user",
+	"deploy",
+	"restart",
+	"depends_on"
+];
+/** Images whose port is set with PORT, so a clash with another service can move them. */
+const PORT_ENV_IMAGES = [/(^|\/)umami(-software)?\/umami/i, /^umamisoftware\/umami/i];
+/** Parses a Compose duration such as 5s, 1m0s or 500ms into seconds. */
+function durationSeconds(value, fallback) {
+	if (!value) return fallback;
+	let total = 0;
+	let matched = false;
+	for (const [, amount, unit] of value.matchAll(/(\d+(?:\.\d+)?)(ms|us|ns|h|m|s)/g)) {
+		matched = true;
+		const number = Number(amount);
+		total += unit === "h" ? number * 3600 : unit === "m" ? number * 60 : unit === "s" ? number : unit === "ms" ? number / 1e3 : 0;
+	}
+	return matched ? total : fallback;
+}
+/** Reads a public image reference: postgres:17-alpine, valkey/valkey:8, ghcr.io/owner/name:tag. */
+function parsePublicImage(reference) {
+	let rest = reference.trim();
+	let digest;
+	const at = rest.indexOf("@");
+	if (at >= 0) {
+		digest = rest.slice(at + 1);
+		rest = rest.slice(0, at);
+	}
+	let source = "dockerHub";
+	const slash = rest.indexOf("/");
+	const first = slash >= 0 ? rest.slice(0, slash) : "";
+	if (first && (first.includes(".") || first.includes(":") || first === "localhost")) {
+		if (first === "docker.io" || first === "index.docker.io") source = "dockerHub";
+		else if (first === "ghcr.io") source = "gitHub";
+		else throw new Error(`Bunny pulls public images from Docker Hub and GitHub only; ${reference} is on ${first}. Push it to one of them, or build it in compose.yaml.`);
+		rest = rest.slice(slash + 1);
+	}
+	const colon = rest.lastIndexOf(":");
+	const tag = colon > rest.lastIndexOf("/") ? rest.slice(colon + 1) : "latest";
+	const path = colon > rest.lastIndexOf("/") ? rest.slice(0, colon) : rest;
+	const parts = path.split("/");
+	const name = parts.pop() ?? path;
+	const namespace = parts.join("/") || (source === "dockerHub" ? "library" : "");
+	if (!name || !namespace) throw new Error(`Cannot read the image ${reference}.`);
 	return {
-		label: `${name} URL`,
-		placeholder,
-		normalize: normalizeUrl
+		source,
+		namespace,
+		name,
+		tag,
+		...digest ? { digest } : {}
 	};
 }
-/** Normalizes an instance URL: https by default, no trailing slash or path. */
-function normalizeUrl(value) {
-	const trimmed = value.trim();
-	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
-	let parsed;
-	try {
-		parsed = new URL(withScheme);
-	} catch {
-		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
-	}
-	return `${parsed.protocol}//${parsed.host}`;
+/** A repository name for Bunny Container Registry. */
+function repositoryName(value) {
+	return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, "") || "app";
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Matches `name:port` where name is a whole host name, such as backend:8000 in http://backend:8000/api. */
+function hostPattern(name) {
+	return new RegExp(`(^|[^\\w.-])${escapeRegExp(name)}:(\\d{1,5})(?!\\d)`, "g");
+}
+/** The names other services reach a service by: its name and its network aliases. */
+function hostNames(service, definition) {
+	const names = /* @__PURE__ */ new Set([service]);
+	for (const network of Object.values(definition.networks ?? {})) for (const alias of network?.aliases ?? []) names.add(alias);
+	return [...names];
+}
+/** Replaces service host names with 127.0.0.1, which is the pod on Bunny. */
+function rewriteHosts(text, names) {
+	let result = text;
+	for (const name of names) result = result.replace(hostPattern(name), (_whole, before, port) => `${before}127.0.0.1:${port}`);
+	return result;
+}
+function containerName(service, taken) {
+	let name = service.replace(/-prod$/, "").slice(0, 50) || service;
+	for (let index = 2; taken.has(name); index++) name = `${service.slice(0, 46)}-${index}`;
+	taken.add(name);
+	return name;
+}
+function healthUrl(test) {
+	const match = (test ?? []).join(" ").match(/https?:\/\/(?:localhost|127\.0\.0\.1)(?::(\d+))?(\/[^\s'"]*)?/);
+	if (!match) return void 0;
+	return {
+		port: Number(match[1] ?? 80),
+		path: match[2] ?? "/"
+	};
 }
-// src/deploy/coolify.ts
-/**
-* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
-* token. The project deploys as a Docker Compose application that Coolify
-* builds on the server from the git repository; Coolify's proxy gets the
-* certificate and forwards to the `proxy` service (Caddy) on port 80.
-*/
-/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
-const PLATFORM_ENV = {
-	CADDY_ADDRESS: ":80",
-	TRUSTED_PROXIES: "private_ranges",
-	NUM_PROXIES: "2",
-	HTTP_PORT: "127.0.0.1:8080",
-	HTTPS_PORT: "127.0.0.1:8443"
-};
-/** Setup flags Coolify and Dokploy share; `deploy setup` shows each flag once. */
-const SHARED_SETUP_FLAGS = [
-	{
-		name: "server",
-		description: "The server on the platform, by name or id (Dokploy: dokploy for its own)"
-	},
-	{
-		name: "project",
-		description: "The platform's project, by name or id (default: the project name)"
-	},
-	{
-		name: "environment",
-		description: "The platform's environment (default: production)"
-	}
-];
-var CoolifyError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.status = status;
+function probeFor(definition, ports) {
+	const check = definition.healthcheck;
+	if (check?.disable) return void 0;
+	const url = check?.test ? healthUrl(check.test) : void 0;
+	const port = url?.port ?? ports[0];
+	if (port === void 0) return void 0;
+	const period = Math.max(1, Math.round(durationSeconds(check?.interval, 10)));
+	const timeout = Math.max(1, Math.round(durationSeconds(check?.timeout, 5)));
+	const retries = Math.max(1, check?.retries ?? 3);
+	const start = durationSeconds(check?.start_period, 0);
+	return {
+		...url ? { http: {
+			path: url.path,
+			port
+		} } : { tcp: { port } },
+		periodSeconds: period,
+		timeoutSeconds: Math.min(timeout, period),
+		failureThreshold: Math.min(3, retries),
+		startupThreshold: Math.min(1e3, Math.ceil(start / period) + retries)
+	};
+}
+/** Plans the Bunny app for a resolved Compose project. */
+function planApp(project, options) {
+	const entries = Object.entries(project.services).filter(([, definition]) => definition.deploy?.replicas !== 0).sort(([a], [b]) => a.localeCompare(b));
+	if (!entries.length) throw new Error("compose.yaml has no services for production.");
+	const names = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) names.set(service, hostNames(service, definition));
+	const allNames = [...names.values()].flat();
+	const builds = /* @__PURE__ */ new Map();
+	const baked = /* @__PURE__ */ new Map();
+	const ignored = /* @__PURE__ */ new Set();
+	const volumes = /* @__PURE__ */ new Set();
+	const texts = [];
+	for (const [, definition] of entries) for (const value of Object.values(definition.environment ?? {})) if (value) texts.push(value);
+	for (const [service, definition] of entries) {
+		const binds = (definition.volumes ?? []).filter((mount) => mount.type === "bind");
+		if (!binds.length) continue;
+		if (definition.build || !definition.image) throw new Error(`${service} bind-mounts ${binds[0]?.source}; Bunny has no bind mounts. Copy the file into the image in its Dockerfile.`);
+		const files = binds.map((mount) => {
+			let content;
+			try {
+				content = options.readFile(mount.source ?? "");
+			} catch {
+				throw new Error(`${service} bind-mounts ${mount.source}, which is not a file; Bunny has no bind mounts, so only files can be copied into the image.`);
+			}
+			texts.push(content);
+			return {
+				source: mount.source ?? "",
+				target: mount.target,
+				content
+			};
+		});
+		const repository = repositoryName(`${project.name}-${service.replace(/-prod$/, "")}`);
+		builds.set(repository, {
+			kind: "bake",
+			repository,
+			from: definition.image,
+			files
+		});
+		baked.set(service, repository);
 	}
-};
-var CoolifyApi = class {
-	url;
-	token;
-	fetchImpl;
-	constructor(url, token, fetchImpl = fetch) {
-		this.url = url;
-		this.token = token;
-		this.fetchImpl = fetchImpl;
+	const portsOf = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) {
+		const found = /* @__PURE__ */ new Set();
+		for (const name of names.get(service) ?? []) for (const text of texts) for (const match of text.matchAll(hostPattern(name))) found.add(Number(match[2]));
+		const own = definition.healthcheck?.test ? healthUrl(definition.healthcheck.test) : void 0;
+		if (own) found.add(own.port);
+		for (const port of definition.ports ?? []) found.add(port.target);
+		portsOf.set(service, [...found].sort((a, b) => a - b));
 	}
-	async request(method, path, body) {
-		let response;
-		try {
-			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
-				method,
-				headers: {
-					Authorization: `Bearer ${this.token}`,
-					Accept: "application/json",
-					...body === void 0 ? {} : { "Content-Type": "application/json" }
-				},
-				body: body === void 0 ? void 0 : JSON.stringify(body),
-				signal: AbortSignal.timeout(3e4)
+	const owner = /* @__PURE__ */ new Map();
+	const moved = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) {
+		const ports = portsOf.get(service) ?? [];
+		for (const [index, port] of ports.entries()) {
+			const other = owner.get(port);
+			if (!other) {
+				owner.set(port, service);
+				continue;
+			}
+			if (!(ports.length === 1 && PORT_ENV_IMAGES.some((pattern) => pattern.test(definition.image ?? "")))) throw new Error(`${other} and ${service} both listen on port ${port}. Bunny runs all containers of an app in one pod, so give one of them another port.`);
+			let to = port + 1;
+			while (owner.has(to)) to++;
+			owner.set(to, service);
+			ports[index] = to;
+			moved.set(service, {
+				from: port,
+				to
 			});
-		} catch (error) {
-			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
 		}
-		const text = await response.text();
-		if (!response.ok) throw new CoolifyError(errorMessage$1(response.status, text, this.url), response.status);
-		if (!text) return void 0;
-		try {
-			return JSON.parse(text);
-		} catch {
-			return text;
+	}
+	const published = entries.filter(([, definition]) => (definition.ports ?? []).length);
+	if (published.length !== 1) throw new Error(published.length ? `${published.map(([service]) => service).join(" and ")} publish ports; Bunny gives an app one public endpoint, so only the proxy may.` : "No service publishes a port, so there is nothing for Bunny's CDN to send requests to.");
+	const [entryService, entryDefinition] = published[0];
+	const entryPorts = (entryDefinition.ports ?? []).map((port) => port.target);
+	const endpointPort = entryPorts.includes(80) ? 80 : entryPorts[0];
+	const rewrite = (text) => {
+		let result = text;
+		for (const [service, move] of moved) for (const name of names.get(service) ?? []) result = result.replace(hostPattern(name), (whole, before, port) => Number(port) === move.from ? `${before}${name}:${move.to}` : whole);
+		return rewriteHosts(result, allNames);
+	};
+	for (const build of builds.values()) if (build.kind === "bake") for (const file of build.files) file.content = rewrite(file.content);
+	const s3 = entries.some(([, definition]) => Boolean(definition.environment?.S3_BUCKET));
+	const taken = /* @__PURE__ */ new Set();
+	const containers = [];
+	for (const [service, definition] of entries) {
+		for (const key of IGNORED_KEYS) if (definition[key] !== void 0 && definition[key] !== null) ignored.add(key);
+		let image;
+		const bake = baked.get(service);
+		if (bake) image = {
+			source: "push",
+			repository: bake
+		};
+		else if (definition.build) {
+			const repository = repositoryName(definition.image ?? `${project.name}-${service}`);
+			const existing = builds.get(repository);
+			const build = {
+				kind: "build",
+				repository,
+				context: definition.build.context,
+				dockerfile: definition.build.dockerfile,
+				target: definition.build.target,
+				args: definition.build.args
+			};
+			if (existing && JSON.stringify(existing) !== JSON.stringify(build)) throw new Error(`Two services build the image ${repository} differently; give them their own image names.`);
+			builds.set(repository, build);
+			image = {
+				source: "push",
+				repository
+			};
+		} else if (definition.image) image = parsePublicImage(definition.image);
+		else throw new Error(`${service} has neither an image nor a build.`);
+		const env = {};
+		for (const [key, value] of Object.entries(definition.environment ?? {})) {
+			if (value === null || value === void 0 || key === "COMPOSE_PROFILES" || key === "ENV_FILE") continue;
+			env[key] = rewrite(value);
+		}
+		const move = moved.get(service);
+		if (move) env.PORT = String(move.to);
+		const volumeMounts = [];
+		for (const mount of definition.volumes ?? []) {
+			if (mount.type === "tmpfs") continue;
+			if (mount.type !== "volume" || !mount.source) {
+				if (mount.type === "bind") continue;
+				throw new Error(`${service} mounts a ${mount.type} volume, which Bunny does not have.`);
+			}
+			if (mount.source === "media" && !s3) throw new Error("Uploads must be in S3 on Bunny: its volumes belong to one pod and are not backed up. Set S3_BUCKET and the other S3_ variables in .env.production (see the docs on media).");
+			if (DROPPED_VOLUMES.has(mount.source)) continue;
+			volumes.add(mount.source);
+			volumeMounts.push({
+				name: mount.source,
+				mountPath: mount.target
+			});
+			if (mount.target === "/var/lib/postgresql/data" && !env.PGDATA) env.PGDATA = `${mount.target}/pgdata`;
 		}
+		const ports = portsOf.get(service) ?? [];
+		containers.push({
+			service,
+			name: containerName(service, taken),
+			image,
+			env,
+			...definition.entrypoint?.length ? { command: definition.entrypoint } : {},
+			...definition.command?.length ? { args: definition.command } : {},
+			...definition.working_dir ? { workingDir: definition.working_dir } : {},
+			ports,
+			probe: probeFor(definition, move ? [move.to] : ports.filter((port) => port !== 443)),
+			volumeMounts,
+			...service === entryService ? { endpoint: endpointPort } : {}
+		});
 	}
-	get = (path) => this.request("GET", path);
-	post = (path, body) => this.request("POST", path, body ?? {});
-	patch = (path, body) => this.request("PATCH", path, body);
-};
-function errorMessage$1(status, text, url) {
-	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
-	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
-	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
-	let message = "";
+	if (volumes.size > 2) throw new Error(`Bunny allows 2 volumes per app, and this project needs ${volumes.size}: ${[...volumes].join(", ")}. Use an external Postgres or S3 for some of them.`);
+	return {
+		name: project.name,
+		containers,
+		volumes: [...volumes],
+		builds: [...builds.values()],
+		ignored: [...ignored].sort()
+	};
+}
+// src/deploy/link.ts
+/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
+const LINK_FILE = ".dstack/deploy.json";
+function readLink(directory) {
+	const path = join(directory, LINK_FILE);
+	if (!existsSync(path)) return void 0;
+	let link;
 	try {
-		const body = JSON.parse(text);
-		message = body.message ?? "";
-		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+		link = JSON.parse(readFileSync(path, "utf8"));
 	} catch {
-		message = text.slice(0, 200);
+		throw new Error(`${LINK_FILE} is not valid JSON.`);
 	}
-	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
-}
-const enc = encodeURIComponent;
-function deploymentStatus(value) {
-	if (value === "queued") return "queued";
-	if (value === "in_progress") return "building";
-	if (value === "finished") return "finished";
-	if (value.startsWith("cancelled")) return "cancelled";
-	return "failed";
+	for (const key of [
+		"provider",
+		"url",
+		"project",
+		"environment",
+		"application"
+	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
+	return {
+		...link,
+		directory
+	};
 }
-function appState(value) {
-	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
-	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
-	if (state === "degraded" || state === "restarting") return "degraded";
-	if (state === "exited" || state === "stopped") return "stopped";
-	return "unknown";
+function writeLink(directory, link) {
+	const path = join(directory, LINK_FILE);
+	mkdirSync(dirname(path), { recursive: true });
+	const { provider, url, project, environment, application } = link;
+	writeFileSync(path, `${JSON.stringify({
+		provider,
+		url,
+		project,
+		environment,
+		application
+	}, null, 2)}\n`);
 }
-/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
-function parseLog(logs) {
-	if (!logs) return [];
-	let entries;
-	try {
-		entries = JSON.parse(logs);
+/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
+function httpsRepository(remote) {
+	const value = remote.trim();
+	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
+	let url;
+	if (scp) url = `https://${scp[1]}/${scp[2]}`;
+	else try {
+		const parsed = new URL(value);
+		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
 	} catch {
-		return logs.split("\n").map((text) => ({
-			text,
-			stderr: false
-		}));
+		throw new Error(`Cannot read the git remote ${value}.`);
 	}
-	if (!Array.isArray(entries)) return [];
-	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
-		text,
-		stderr: entry.type === "stderr"
-	})));
+	return url.replace(/\.git$/, "").replace(/\/$/, "");
 }
-/** The domains of a Compose application, by service. */
-function composeDomains(app) {
-	let value = app.docker_compose_domains;
-	if (typeof value === "string") try {
-		value = JSON.parse(value);
+function git(directory, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: directory,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
 	} catch {
-		value = null;
+		return;
 	}
-	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
-	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
-	return domains.map((domain) => domain.replace(/:\d+$/, ""));
-}
-function appUrl(api, link) {
-	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
 }
-function toDeployment$1(api, link, item) {
-	const path = item.deployment_url;
-	return {
-		id: item.deployment_uuid,
-		status: deploymentStatus(item.status),
-		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
-		message: item.commit_message?.split("\n")[0] || void 0,
-		createdAt: item.created_at,
-		updatedAt: item.updated_at,
-		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
-		log: parseLog(item.logs)
-	};
+function gitRemote(directory, remote = "origin") {
+	return git(directory, [
+		"remote",
+		"get-url",
+		remote
+	]) || void 0;
 }
-/** Finds a name or uuid in a list. */
-function find$1(items, wanted) {
-	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+function gitBranch(directory) {
+	const branch = git(directory, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return branch && branch !== "HEAD" ? branch : void 0;
+}
+/**
+* Why a deploy of `branch` would not include the local commit, or undefined
+* when origin has it. The platform builds from the remote, not from here.
+*/
+function unpushedReason(directory, branch) {
+	const head = git(directory, ["rev-parse", "HEAD"]);
+	if (!head) return void 0;
+	if (git(directory, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
+	if (git(directory, [
+		"merge-base",
+		"--is-ancestor",
+		head,
+		`refs/remotes/origin/${branch}`
+	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
+}
+/**
+* Why an upload of HEAD would not match the working tree, or undefined when
+* it does. Providers that upload the local commit deploy HEAD only, so
+* changes to tracked files must be committed first.
+*/
+function uncommittedReason(directory) {
+	if (git(directory, ["rev-parse", "HEAD"]) === void 0) return "This project has no commit yet. Commit it first: git add -A && git commit";
+	if (git(directory, [
+		"status",
+		"--porcelain",
+		"--untracked-files=no"
+	])) return "You have uncommitted changes, so the deploy would not include them. Commit first.";
 }
-var CoolifyClient = class {
-	api;
-	constructor(url, token, fetchImpl) {
-		this.api = new CoolifyApi(url, token, fetchImpl);
-	}
-	async verify() {
-		const version = await this.api.get("/version");
-		await this.api.get("/servers");
-		return String(version).trim();
-	}
-	async setup(context) {
-		const { ask, options } = context;
-		if (!context.repository) throw new Error("Coolify builds from a git repository; pass --repository.");
-		const api = this.api;
-		const servers = await api.get("/servers");
-		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
-		let server;
-		if (options.server) {
-			server = find$1(servers, options.server);
-			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
-		} else if (servers.length === 1) server = servers[0];
-		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
-			value: item.uuid,
-			label: item.name,
-			hint: item.ip
-		}))));
-		if (!server) throw new Error("No server chosen.");
-		const projects = await api.get("/projects");
-		let project;
-		const projectName = options.project ?? context.name;
-		project = find$1(projects, projectName);
-		if (!options.project && ask.interactive && projects.length) {
-			const NEW = "";
-			const uuid = await ask.select("Coolify project", [...project ? [] : [{
-				value: NEW,
-				label: `Create ${projectName}`
-			}], ...projects.map((item) => ({
-				value: item.uuid,
-				label: item.name,
-				hint: item.description ?? void 0
-			}))], project?.uuid ?? NEW);
-			project = uuid === NEW ? void 0 : find$1(projects, uuid);
-		}
-		if (!project) {
-			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
-			project = {
-				uuid: (await api.post("/projects", {
-					name: projectName,
-					description: "DjangoStack"
-				})).uuid,
-				name: projectName
-			};
-			ask.step(`Created the Coolify project ${projectName}`);
-		}
-		const environmentName = options.environment ?? "production";
-		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
-		if (!environment) {
-			environment = {
-				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
-				name: environmentName
-			};
-			ask.step(`Created the environment ${environmentName}`);
-		}
-		let githubApp;
-		if (options.githubApp && options.githubApp !== "public") {
-			const app = find$1(await api.get("/github-apps"), options.githubApp);
-			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
-			githubApp = app.uuid;
-		} else if (!options.githubApp && ask.interactive) {
-			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
-			if (apps.length) {
-				const choice = await ask.select("How Coolify gets the code", [{
-					value: "public",
-					label: "Public repository",
-					hint: "no access needed"
-				}, ...apps.map((app) => ({
-					value: app.uuid,
-					label: `GitHub App ${app.name}`,
-					hint: "private repository"
-				}))], "public");
-				githubApp = choice === "public" ? void 0 : choice;
-			}
-		}
-		const body = {
-			project_uuid: project.uuid,
-			server_uuid: server.uuid,
-			environment_uuid: environment.uuid,
-			git_repository: context.repository,
-			git_branch: context.branch,
-			build_pack: "dockercompose",
-			docker_compose_location: "/compose.yaml",
-			docker_compose_domains: [{
-				name: "proxy",
-				domain: `https://${context.domain}:80`
-			}],
-			name: context.name,
-			description: "DjangoStack",
-			instant_deploy: false,
-			...githubApp ? { github_app_uuid: githubApp } : {}
-		};
-		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
-		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
-		const link = {
-			provider: "coolify",
-			url: api.url,
-			project: project.uuid,
-			environment: environment.uuid,
-			application: created.uuid
-		};
-		await this.pushEnv(link, context.env);
-		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
-		return {
-			project: link.project,
-			environment: link.environment,
-			application: link.application
-		};
-	}
-	async pushEnv(link, env) {
-		const data = Object.entries(env).map(([key, value]) => ({
-			key,
-			value,
-			is_literal: true,
-			is_preview: false
-		}));
-		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
-	}
-	async deploy(link, options) {
-		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
-		const result = await this.api.post(`/deploy?${query}`);
-		const id = result?.deployments?.[0]?.deployment_uuid;
-		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
-		return id;
-	}
-	async deployment(link, id) {
-		return toDeployment$1(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
-	}
-	async deployments(link, limit) {
-		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
-		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment$1(this.api, link, item));
-	}
-	async status(link) {
-		const app = await this.api.get(`/applications/${enc(link.application)}`);
-		return {
-			state: appState(app.status),
-			detail: app.status ?? "unknown",
-			domains: composeDomains(app),
-			branch: app.git_branch,
-			url: appUrl(this.api, link)
-		};
-	}
-};
-const coolify = {
-	id: "coolify",
-	name: "Coolify",
-	auth: {
-		kind: "token",
-		env: "DSTACK_COOLIFY_TOKEN",
-		help: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`
-	},
-	source: "remote",
-	target: urlTarget("Coolify", "https://coolify.example.com"),
-	platformEnv: PLATFORM_ENV,
-	setupFlags: [...SHARED_SETUP_FLAGS, {
-		name: "githubApp",
-		description: "A Coolify GitHub App for a private repository, or public"
-	}],
-	connect: (url, token) => {
-		if (!token) throw new Error("Coolify needs an API key.");
-		return new CoolifyClient(url, token);
-	}
-};
 const systemSsh = (args, input) => new Promise((resolve, reject) => {
 	const child = spawn("ssh", args, { stdio: [
 		"pipe",
@@ -701,7 +751,7 @@ cat ${shellQuote(`${id}.log`)} 2>/dev/null
 		const record = JSON.parse(json);
 		const [status = "", alive = "0", updatedAt] = state.split(" ");
 		return {
-			...toDeployment(record, recordStatus(status, alive === "1"), updatedAt || void 0),
+			...toDeployment$2(record, recordStatus(status, alive === "1"), updatedAt || void 0),
 			log: log ? log.replace(/\n$/, "").split("\n").map((text) => ({
 				text,
 				stderr: false
@@ -710,7 +760,7 @@ cat ${shellQuote(`${id}.log`)} 2>/dev/null
 	}
 	async deployments(link, limit) {
 		return (await this.records(link, limit)).map((item) => ({
-			...toDeployment(item.record, item.status, item.updatedAt),
+			...toDeployment$2(item.record, item.status, item.updatedAt),
 			log: []
 		}));
 	}
@@ -729,7 +779,7 @@ sed -n 's/^SITE_URL=//p' ${shellQuote(`${link.project}/shared/.env`)} 2>/dev/nul
 		};
 	}
 };
-function toDeployment(record, status, updatedAt) {
+function toDeployment$2(record, status, updatedAt) {
 	return {
 		id: record.id,
 		status,
@@ -768,12 +818,1279 @@ const ssh = {
 		placeholder: "deploy@example.com",
 		normalize: (value) => formatTarget(parseTarget(value))
 	},
-	platformEnv: {},
-	setupFlags: [{
-		name: "path",
-		description: "The project directory on the server (default: /srv/<project>)"
+	platformEnv: {},
+	setupFlags: [{
+		name: "path",
+		description: "The project directory on the server (default: /srv/<project>)"
+	}],
+	connect: (target) => new SshClient(target)
+};
+// src/deploy/bunny.ts
+/**
+* Bunny Magic Containers (https://bunny.net/magic-containers), through the
+* API at https://api.bunny.net/mc with the account API key in the AccessKey
+* header. Bunny has no Compose: the CLI reads the resolved compose.yaml,
+* builds the images of the local commit for linux/amd64, pushes them to
+* Bunny Container Registry and creates one app whose containers are the
+* production services, in one pod on localhost. A CDN endpoint on the
+* proxy carries the site's domain; Bunny's CDN holds the certificate, so
+* Caddy serves plain HTTP on port 80. A deploy pushes new images tagged with
+* the commit and changes the containers' tags, which starts Bunny's rolling
+* update.
+*
+* Link ids: project = the app id, environment = the account's registry
+* namespace, application = the CDN pull zone id.
+*/
+const BUNNY_API = "https://api.bunny.net";
+const BUNNY_REGISTRY = "registry.bunny.net";
+/** Variables that put Caddy behind Bunny's CDN. TRUSTED_PROXIES is Bunny's edge list, set in setup. */
+const BUNNY_PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	NUM_PROXIES: "2"
+};
+/** Where a deploy's record and log are kept, in the project. Bunny keeps no deploy history. */
+const BUNNY_DEPLOYS_DIR = ".dstack/deploys";
+const systemRunner = (command, args, options = {}) => new Promise((resolvePromise, reject) => {
+	const child = spawn(command, args, {
+		cwd: options.cwd,
+		env: options.env ? {
+			...process.env,
+			...options.env
+		} : process.env,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	const stdout = [];
+	const stderr = [];
+	child.stdout.on("data", (chunk) => {
+		stdout.push(chunk);
+		if (options.stream) process.stderr.write(chunk);
+	});
+	child.stderr.on("data", (chunk) => {
+		stderr.push(chunk);
+		if (options.stream) process.stderr.write(chunk);
+	});
+	child.on("error", (error) => reject(/* @__PURE__ */ new Error(error.code === "ENOENT" ? `There is no ${command} command here.${command === "docker" ? " Install Docker: https://docs.docker.com/get-docker/" : ""}` : `Could not run ${command}: ${error.message}`)));
+	child.on("close", (code) => resolvePromise({
+		code: code ?? 1,
+		stdout: Buffer.concat(stdout).toString("utf8"),
+		stderr: Buffer.concat(stderr).toString("utf8")
+	}));
+	child.stdin.on("error", () => {});
+	child.stdin.end(options.input);
+});
+var BunnyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+/** The items of a list response: an array, or an object with items, data or a similar key. */
+function listOf(value) {
+	if (Array.isArray(value)) return value;
+	if (value && typeof value === "object") for (const key of [
+		"items",
+		"Items",
+		"data",
+		"applications",
+		"registries",
+		"containerRegistries",
+		"endpoints",
+		"regions"
+	]) {
+		const items = value[key];
+		if (Array.isArray(items)) return items;
+	}
+	return [];
+}
+function text(value) {
+	return typeof value === "string" && value ? value : typeof value === "number" ? String(value) : void 0;
+}
+/** The first value under a key that matches, searched depth first. */
+function findKey(value, pattern) {
+	if (!value || typeof value !== "object") return void 0;
+	for (const [key, item] of Object.entries(value)) if (pattern.test(key) && item != null && item !== "") return item;
+	for (const item of Object.values(value)) {
+		const found = findKey(item, pattern);
+		if (found !== void 0) return found;
+	}
+}
+var BunnyApi = class {
+	token;
+	fetchImpl;
+	base;
+	constructor(token, fetchImpl = fetch, base = BUNNY_API) {
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+		this.base = base;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.base}${path}`, {
+				method,
+				headers: {
+					AccessKey: this.token,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body)
+			});
+		} catch (error) {
+			throw new Error(`Could not reach ${this.base}: ${error.message}`);
+		}
+		const raw = await response.text();
+		let data;
+		try {
+			data = raw ? JSON.parse(raw) : void 0;
+		} catch {
+			data = raw;
+		}
+		if (response.ok) return data;
+		if (response.status === 401 || response.status === 403 && !raw) throw new BunnyError("Bunny refused the API key. Use the key of your account (not a sub-user's) from https://dash.bunny.net/account/api-key.", response.status);
+		throw new BunnyError(`Bunny answered ${response.status} to ${method} ${path}: ${errorText(data)}`, response.status);
+	}
+	/** The Magic Containers API. */
+	mc(method, path, body) {
+		return this.request(method, `/mc${path}`, body);
+	}
+};
+function errorText(data) {
+	if (typeof data === "string") return data.slice(0, 300) || "no details";
+	if (data && typeof data === "object") {
+		const value = data;
+		const parts = [
+			value.title,
+			value.detail,
+			value.message,
+			value.Message,
+			value.error
+		].map((item) => text(item)).filter(Boolean);
+		const errors = value.errors;
+		if (errors && typeof errors === "object") for (const [key, messages] of Object.entries(errors)) parts.push(`${key}: ${Array.isArray(messages) ? messages.join(" ") : String(messages)}`);
+		if (parts.length) return parts.join("; ");
+	}
+	return "no details";
+}
+/** A Bunny probe from a planned one. */
+function probeRequest(probe, failureThreshold) {
+	const check = probe.http ? { httpGet: {
+		request: {
+			path: probe.http.path,
+			portNumber: probe.http.port
+		},
+		response: { expectedStatusCode: "ok" }
+	} } : { tcpSocket: { request: { portNumber: probe.tcp?.port } } };
+	return {
+		initialDelaySeconds: 1,
+		periodSeconds: probe.periodSeconds,
+		timeoutSeconds: probe.timeoutSeconds,
+		failureThreshold,
+		successThreshold: 1,
+		...check
+	};
+}
+/** The image fields of a container. */
+function imageFields(container, options) {
+	const { image } = container;
+	if (image.source === "push") return {
+		imageRegistryId: options.registries.bunny,
+		imageNamespace: options.namespace,
+		imageName: image.repository,
+		imageTag: options.tag
+	};
+	const registry = image.source === "gitHub" ? options.registries.gitHub : options.registries.dockerHub;
+	if (!registry) throw new Error(`There is no public ${image.source === "gitHub" ? "GitHub" : "Docker Hub"} registry in Bunny.`);
+	return {
+		imageRegistryId: registry,
+		imageNamespace: image.namespace,
+		imageName: image.name,
+		imageTag: image.tag,
+		...image.digest ? { imageDigest: image.digest } : {}
+	};
+}
+/** The body of POST /apps for a planned app. */
+function appRequest(plan, options) {
+	return {
+		name: plan.name.replace(/[^A-Za-z0-9-\s]+/g, "-").slice(0, 100),
+		runtimeType: "shared",
+		autoScaling: {
+			min: 1,
+			max: 1
+		},
+		regionSettings: {
+			allowedRegionIds: [options.region],
+			requiredRegionIds: [options.region],
+			maxAllowedRegions: 1
+		},
+		containerTemplates: plan.containers.map((container) => ({
+			name: container.name,
+			...imageFields(container, options),
+			imagePullPolicy: "ifNotPresent",
+			...container.command || container.args || container.workingDir ? { entryPoint: {
+				...container.command ? { commandArray: container.command } : {},
+				...container.args ? { argumentsArray: container.args } : {},
+				...container.workingDir ? { workingDirectory: container.workingDir } : {}
+			} } : {},
+			environmentVariables: envList(container.env),
+			...container.probe ? { probes: {
+				startup: probeRequest(container.probe, container.probe.startupThreshold),
+				readiness: probeRequest(container.probe, container.probe.failureThreshold)
+			} } : {},
+			...container.endpoint ? { endpoints: [{
+				displayName: "site",
+				cdn: {
+					isSslEnabled: false,
+					portMappings: [{ containerPort: container.endpoint }]
+				}
+			}] } : {},
+			...container.volumeMounts.length ? { volumeMounts: container.volumeMounts } : {}
+		})),
+		...plan.volumes.length ? { volumes: plan.volumes.map((name) => ({
+			name,
+			size: options.volumeSize
+		})) } : {}
+	};
+}
+function envList(env) {
+	return Object.entries(env).map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+/** Bunny's word for an app's state, read from the fields its API returns. */
+function bunnyState(value) {
+	const word = (value ?? "").toLowerCase();
+	if (!word) return "unknown";
+	if (/fail|error|crash|unhealthy|degrad/.test(word)) return "degraded";
+	if (/stop|suspend|undeploy|inactive|paused|deleted/.test(word)) return "stopped";
+	if (/run|active|healthy|^ok$|ready|deployed|online/.test(word)) return "running";
+	return "unknown";
+}
+/** Whether Bunny is still rolling out. */
+function bunnyBusy(value) {
+	return /deploying|progress|updat|pending|creat|start|provision|rolling|scaling/i.test(value ?? "");
+}
+function appContainers(app) {
+	const value = app;
+	return listOf(value?.containerTemplates ?? value?.containers ?? []).map((item) => ({
+		id: text(item.id) ?? "",
+		name: text(item.name) ?? "",
+		imageNamespace: text(item.imageNamespace),
+		imageName: text(item.imageName),
+		imageTag: text(item.imageTag)
+	})).filter((item) => item.id && item.name);
+}
+function appStatusText(app) {
+	const value = app;
+	for (const key of [
+		"status",
+		"state",
+		"appStatus",
+		"displayStatus",
+		"deploymentStatus"
+	]) {
+		const item = value?.[key];
+		if (typeof item === "string") return item;
+		if (item && typeof item === "object") {
+			const nested = text(item.status ?? item.state ?? item.name);
+			if (nested) return nested;
+		}
+	}
+}
+var BunnyClient = class {
+	fetchImpl;
+	api;
+	token;
+	run;
+	now;
+	readFile;
+	edgeServersImpl;
+	constructor(token, fetchImpl = fetch, options = {}) {
+		this.fetchImpl = fetchImpl;
+		this.api = new BunnyApi(token, fetchImpl);
+		this.token = token;
+		this.run = options.run ?? systemRunner;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+		this.edgeServersImpl = options.edgeServers ?? (() => this.defaultEdgeServers());
+	}
+	async verify() {
+		const apps = listOf(await this.api.mc("GET", "/apps"));
+		return `Magic Containers (${apps.length} app${apps.length === 1 ? "" : "s"})`;
+	}
+	async docker(args, options = {}) {
+		const result = await this.run("docker", args, options);
+		if (result.code === 0) return result.stdout;
+		if (isDockerDown(`${result.stderr}\n${result.stdout}`)) throw new Error(dockerNotRunning());
+		const last = (result.stderr.trim() || result.stdout.trim()).split("\n").at(-1) ?? "";
+		throw new Error(`docker ${args[0]} failed (exit ${result.code})${last ? `: ${last}` : "."}`);
+	}
+	async git(directory, args) {
+		return this.run("git", [
+			"-C",
+			directory,
+			...args
+		]);
+	}
+	/** The short commit and its subject. */
+	async commit(directory) {
+		const result = await this.git(directory, [
+			"log",
+			"-1",
+			"--format=%h%n%s"
+		]);
+		if (result.code !== 0) throw new Error("This project has no commit yet. Commit it first: git add -A && git commit");
+		const [commit = "", message = ""] = result.stdout.trim().split("\n");
+		return {
+			commit,
+			message
+		};
+	}
+	/** Extracts the local commit into a temporary directory, so the images match the commit. */
+	async checkout(directory) {
+		const target = mkdtempSync(join(tmpdir(), "dstack-bunny-"));
+		const archive = await this.git(directory, [
+			"archive",
+			"--format=tar",
+			"-o",
+			join(target, ".archive.tar"),
+			"HEAD"
+		]);
+		if (archive.code !== 0) {
+			rmSync(target, {
+				recursive: true,
+				force: true
+			});
+			throw new Error(`git archive failed: ${archive.stderr.trim().split("\n").at(-1) ?? ""}`);
+		}
+		const extract = await this.run("tar", [
+			"-x",
+			"-f",
+			".archive.tar"
+		], { cwd: target });
+		rmSync(join(target, ".archive.tar"), { force: true });
+		if (extract.code !== 0) {
+			rmSync(target, {
+				recursive: true,
+				force: true
+			});
+			throw new Error(`Could not extract the commit: ${extract.stderr.trim()}`);
+		}
+		return target;
+	}
+	/** The production Compose project, resolved with the variables, as JSON. */
+	async composeConfig(directory, env) {
+		const folder = mkdtempSync(join(tmpdir(), "dstack-env-"));
+		const file = join(folder, ".env");
+		writeFileSync(file, `${Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n")}\n`, { mode: 384 });
+		try {
+			const output = await this.docker([
+				"compose",
+				"--env-file",
+				file,
+				"config",
+				"--format",
+				"json"
+			], {
+				cwd: directory,
+				env: {
+					...env,
+					ENV_FILE: file
+				}
+			});
+			return JSON.parse(output);
+		} finally {
+			rmSync(folder, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async plan(directory, env) {
+		return planApp(await this.composeConfig(directory, env), { readFile: this.readFile });
+	}
+	/** Builds an image for linux/amd64 and pushes it to Bunny Container Registry. */
+	async buildAndPush(build, reference, directory) {
+		if (build.kind === "build") await this.docker([
+			"build",
+			"--platform",
+			"linux/amd64",
+			...build.target ? ["--target", build.target] : [],
+			...build.dockerfile ? ["-f", resolve(build.context, build.dockerfile)] : [],
+			...Object.entries(build.args ?? {}).flatMap(([key, value]) => ["--build-arg", `${key}=${value}`]),
+			"-t",
+			reference,
+			build.context
+		], {
+			cwd: directory,
+			stream: true
+		});
+		else {
+			const context = mkdtempSync(join(tmpdir(), "dstack-bake-"));
+			try {
+				const lines = [`FROM ${build.from}`];
+				build.files.forEach((file, index) => {
+					writeFileSync(join(context, `file-${index}`), file.content);
+					lines.push(`COPY file-${index} ${file.target}`);
+				});
+				writeFileSync(join(context, "Dockerfile"), `${lines.join("\n")}\n`);
+				await this.docker([
+					"build",
+					"--platform",
+					"linux/amd64",
+					"-t",
+					reference,
+					context
+				], { stream: true });
+			} finally {
+				rmSync(context, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		const config = mkdtempSync(join(tmpdir(), "dstack-docker-"));
+		try {
+			await this.docker([
+				"login",
+				BUNNY_REGISTRY,
+				"--username",
+				"token",
+				"--password-stdin"
+			], {
+				env: { DOCKER_CONFIG: config },
+				input: this.token
+			});
+			await this.docker(["push", reference], {
+				env: { DOCKER_CONFIG: config },
+				stream: true
+			});
+		} finally {
+			rmSync(config, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	/** Builds and pushes every image of the local commit; returns the plan of the commit. */
+	async pushImages(directory, env, namespace, tag, log) {
+		const checkout = await this.checkout(directory);
+		try {
+			const plan = await this.plan(checkout, env);
+			for (const build of plan.builds) {
+				const reference = `${BUNNY_REGISTRY}/${namespace}/${build.repository}:${tag}`;
+				log(`Building and pushing ${reference}`);
+				await this.buildAndPush(build, reference, checkout);
+			}
+			return plan;
+		} finally {
+			rmSync(checkout, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	async registries() {
+		const list = listOf(await this.api.mc("GET", "/registries"));
+		const registries = {};
+		let namespace;
+		for (const item of list) {
+			const type = (text(item.type) ?? "").toLowerCase();
+			const id = text(item.id);
+			if (!id) continue;
+			if (type === "dockerhub" && !registries.dockerHub) registries.dockerHub = id;
+			else if (type === "github" && !registries.gitHub) registries.gitHub = id;
+			else if ((type === "bunnyregistry" || type === "bunny") && !registries.bunny) {
+				registries.bunny = id;
+				namespace = text(item.namespace ?? item.accountId ?? item.userName ?? item.username);
+			}
+		}
+		return {
+			registries,
+			namespace
+		};
+	}
+	async ensureRegistries() {
+		const found = await this.registries();
+		if (!found.registries.dockerHub) throw new Error("Bunny lists no public Docker Hub registry for this account. Check Magic Containers › Image Registries.");
+		if (!found.registries.bunny) {
+			const created = await this.api.mc("POST", "/registries", {
+				displayName: "Bunny Container Registry",
+				type: "bunnyRegistry"
+			});
+			const id = text(created?.id) ?? text(findKey(created, /^id$/i));
+			if (!id) throw new Error("Could not add Bunny Container Registry to Magic Containers.");
+			found.registries.bunny = id;
+		}
+		return {
+			registries: found.registries,
+			namespace: found.namespace
+		};
+	}
+	async app(link) {
+		return await this.api.mc("GET", `/apps/${encodeURIComponent(link.project)}`) ?? {};
+	}
+	async defaultEdgeServers() {
+		const addresses = [];
+		for (const path of ["/system/edgeserverlist", "/system/edgeserverlist/ipv6"]) {
+			const response = await this.fetchImpl(`${BUNNY_API}${path}`, { headers: { Accept: "application/json" } });
+			if (!response.ok) throw new Error(`Bunny answered ${response.status} to ${path}`);
+			const list = await response.json();
+			if (Array.isArray(list)) {
+				for (const item of list) if (typeof item === "string") addresses.push(item);
+			}
+		}
+		return addresses;
+	}
+	/** TRUSTED_PROXIES for Caddy: the addresses Bunny's CDN connects from. */
+	async trustedProxies() {
+		try {
+			const addresses = await this.edgeServersImpl();
+			return addresses.length ? addresses.join(" ") : void 0;
+		} catch {
+			return;
+		}
+	}
+	async pullZoneId(appId) {
+		for (let attempt = 0; attempt < 10; attempt++) {
+			const id = text(findKey(await this.api.mc("GET", `/apps/${encodeURIComponent(appId)}/endpoints`), /^pull_?zone_?id$/i));
+			if (id && id !== "0") return id;
+			await new Promise((done) => setTimeout(done, attempt ? 3e3 : 1e3));
+		}
+	}
+	async pullZone(id) {
+		return await this.api.request("GET", `/pullzone/${encodeURIComponent(id)}`) ?? {};
+	}
+	/** The custom hostname, its certificate and a cache bypass for pages that must not be cached. */
+	async setupPullZone(id, domain, step) {
+		const zone = `/pullzone/${encodeURIComponent(id)}`;
+		await this.api.request("POST", zone, { AddHostHeader: true });
+		if (!listOf((await this.pullZone(id)).Hostnames).map((item) => text(item.Value)?.toLowerCase()).includes(domain.toLowerCase())) {
+			await this.api.request("POST", `${zone}/addHostname`, { Hostname: domain });
+			step(`Added ${domain} to the CDN pull zone`);
+		}
+		await this.api.request("POST", `${zone}/edgerules/addOrUpdate`, {
+			ActionType: 3,
+			ActionParameter1: "0",
+			ActionParameter2: "0",
+			Triggers: [{
+				Type: 0,
+				PatternMatches: [
+					"*/admin",
+					"*/admin/*",
+					"*/api",
+					"*/api/*",
+					"*/_a/*"
+				],
+				PatternMatchingType: 0
+			}],
+			TriggerMatchingType: 0,
+			Description: "dstack: do not cache the admin, the API and analytics",
+			Enabled: true
+		});
+		await this.certificate(id, domain);
+	}
+	/** Requests the free certificate once DNS points at the CDN; returns whether it is active. */
+	async certificate(id, domain) {
+		if (listOf((await this.pullZone(id)).Hostnames).find((item) => text(item.Value)?.toLowerCase() === domain.toLowerCase())?.HasCertificate === true) return true;
+		try {
+			await this.api.request("GET", `/pullzone/loadFreeCertificate?hostname=${encodeURIComponent(domain)}`);
+			await this.api.request("POST", `/pullzone/${encodeURIComponent(id)}/setForceSSL`, {
+				Hostname: domain,
+				ForceSSL: true
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async cname(id) {
+		const name = text((await this.pullZone(id)).Name);
+		return name ? `${name}.b-cdn.net` : void 0;
+	}
+	recordsDir(directory) {
+		const folder = join(directory, BUNNY_DEPLOYS_DIR);
+		if (!existsSync(folder)) {
+			mkdirSync(folder, { recursive: true });
+			writeFileSync(join(folder, ".gitignore"), "*\n");
+		}
+		return folder;
+	}
+	writeRecord(directory, record, log) {
+		const folder = this.recordsDir(directory);
+		writeFileSync(join(folder, `${record.id}.json`), `${JSON.stringify(record, null, 2)}\n`);
+		writeFileSync(join(folder, `${record.id}.log`), log.length ? `${log.join("\n")}\n` : "");
+	}
+	records(directory) {
+		const folder = join(directory, BUNNY_DEPLOYS_DIR);
+		if (!existsSync(folder)) return [];
+		const records = [];
+		for (const file of readdirSync(folder)) {
+			if (!file.endsWith(".json")) continue;
+			try {
+				records.push(JSON.parse(readFileSync(join(folder, file), "utf8")));
+			} catch {}
+		}
+		return records.sort((a, b) => b.id.localeCompare(a.id));
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		const { directory } = context;
+		const volumeSize = Number.parseInt(options.volumeSize ?? "10", 10);
+		if (!Number.isFinite(volumeSize) || volumeSize < 1 || volumeSize > 100) throw new Error("Give --volume-size in GB, from 1 to 100.");
+		const env = { ...context.env };
+		const trusted = await this.trustedProxies();
+		if (trusted) env.TRUSTED_PROXIES = trusted;
+		else ask.step("Could not read Bunny's edge server list; Django may see the CDN's address instead of the client's. Run dstack deploy env push later.");
+		const local = await this.plan(directory, env);
+		if (local.ignored.length) ask.step(`Bunny runs the app in a gVisor sandbox; not applied from compose.yaml: ${local.ignored.join(", ")}`);
+		const { registries, namespace: found } = await this.ensureRegistries();
+		let namespace = options.account ?? found;
+		if (!namespace) namespace = (await ask.text("Bunny account id (Magic Containers › Image Registries, or bunny whoami)", { placeholder: "123456" })).trim();
+		if (!/^[\w.-]+$/.test(namespace)) throw new Error(`${namespace} is not a Bunny account id.`);
+		let region = options.region;
+		if (!region) {
+			const optimal = text(findKey(await this.api.mc("GET", "/regions/optimal").catch(() => void 0), /^id$|regionid/i));
+			const regions = listOf(await this.api.mc("GET", "/regions")).map((item) => ({
+				value: text(item.id) ?? "",
+				label: text(item.name) ?? text(item.id) ?? ""
+			})).filter((item) => item.value);
+			if (regions.length) region = await ask.select("Region", regions, optimal ?? regions[0]?.value);
+			else region = optimal;
+		}
+		if (!region) throw new Error("Pass --region, such as DE.");
+		const { commit, message } = await this.commit(directory);
+		const uncommitted = uncommittedReason(directory);
+		if (uncommitted) ask.step(`Building the last commit, ${commit}: ${uncommitted.replace(/ Commit first\.$/, "")}`);
+		const log = [];
+		const plan = await this.pushImages(directory, env, namespace, commit, (line) => {
+			log.push(line);
+			ask.step(line);
+		});
+		const appId = text((await this.api.mc("POST", "/apps", appRequest(plan, {
+			registries,
+			namespace,
+			tag: commit,
+			region,
+			volumeSize
+		})))?.id);
+		if (!appId) throw new Error("Bunny created the app but returned no id.");
+		ask.step(`Created the app ${plan.name} in ${region}`);
+		try {
+			await this.api.mc("POST", `/apps/${encodeURIComponent(appId)}/deploy`);
+		} catch (error) {
+			if (!(error instanceof BunnyError && [400, 409].includes(error.status))) throw error;
+		}
+		const zone = await this.pullZoneId(appId);
+		if (!zone) throw new Error(`Bunny has not created the CDN endpoint of app ${appId} yet. Run dstack deploy setup --force later.`);
+		await this.setupPullZone(zone, context.domain, ask.step);
+		const target = await this.cname(zone);
+		ask.step(`Add this DNS record: ${context.domain} CNAME ${target ?? "the pull zone's b-cdn.net address"}${context.domain.split(".").length === 2 ? " (an apex domain needs Bunny DNS, or use www and redirect)" : ""}`);
+		this.writeRecord(directory, {
+			id: deployId(this.now(), commit),
+			tag: commit,
+			commit,
+			message,
+			createdAt: this.now().toISOString()
+		}, log);
+		return {
+			project: appId,
+			environment: namespace,
+			application: zone
+		};
+	}
+	async pushEnv(link, env) {
+		const directory = projectDirectory(link);
+		const values = { ...env };
+		const trusted = await this.trustedProxies();
+		if (trusted) values.TRUSTED_PROXIES = trusted;
+		const plan = await this.plan(directory, values);
+		const containers = appContainers(await this.app(link));
+		for (const container of plan.containers) {
+			const remote = containers.find((item) => item.name === container.name);
+			if (!remote) throw new Error(missingContainer(container.name));
+			await this.api.mc("PUT", `/apps/${encodeURIComponent(link.project)}/containers/${encodeURIComponent(remote.id)}/env`, { environmentVariables: envList(container.env) });
+		}
+	}
+	async deploy(link, options) {
+		const { directory } = options;
+		const { commit, message } = await this.commit(directory);
+		const id = deployId(this.now(), commit);
+		const log = [];
+		const record = {
+			id,
+			tag: commit,
+			commit,
+			message,
+			createdAt: this.now().toISOString()
+		};
+		const containers = appContainers(await this.app(link));
+		const env = {
+			...productionEnv(directory),
+			...BUNNY_PLATFORM_ENV
+		};
+		try {
+			const local = await this.plan(directory, env);
+			const pushed = local.containers.filter((container) => container.image.source === "push");
+			for (const container of local.containers) if (!containers.some((item) => item.name === container.name)) throw new Error(missingContainer(container.name));
+			if (pushed.every((container) => containers.find((item) => item.name === container.name)?.imageTag === commit)) {
+				if (options.force) {
+					await this.api.mc("POST", `/apps/${encodeURIComponent(link.project)}/restart`);
+					log.push(`Restarted the app on ${commit}`);
+				} else log.push(`The app already runs ${commit}; nothing to deploy. Pass --force to restart it.`);
+			} else {
+				await this.pushImages(directory, env, link.environment, commit, (line) => {
+					log.push(line);
+					process.stderr.write(`${line}\n`);
+				});
+				await this.retag(link, containers, pushed.map((container) => container.name), commit);
+				log.push(`Bunny is rolling out ${commit}`);
+			}
+			if (link.application) {
+				const domain = (env.SITE_URL ?? "").replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+				if (domain) await this.certificate(link.application, domain).catch(() => false);
+			}
+		} catch (error) {
+			log.push(error.message);
+			this.writeRecord(directory, {
+				...record,
+				failed: true
+			}, log);
+			throw error;
+		}
+		this.writeRecord(directory, record, log);
+		this.prune(directory);
+		return id;
+	}
+	/** Points the containers of pushed images at a tag; Bunny starts a rolling update. */
+	async retag(link, remote, names, tag) {
+		for (const name of names) {
+			const item = remote.find((entry) => entry.name === name);
+			if (!item || item.imageTag === tag) continue;
+			await this.api.mc("PATCH", `/apps/${encodeURIComponent(link.project)}/containers/${encodeURIComponent(item.id)}`, { imageTag: tag });
+		}
+	}
+	/** Removes records beyond KEEP_DEPLOYS. Their images stay in the registry. */
+	prune(directory) {
+		const folder = join(directory, BUNNY_DEPLOYS_DIR);
+		for (const record of this.records(directory).slice(20)) {
+			rmSync(join(folder, `${record.id}.json`), { force: true });
+			rmSync(join(folder, `${record.id}.log`), { force: true });
+		}
+	}
+	async rollback(link, to) {
+		const directory = projectDirectory(link);
+		const records = this.records(directory);
+		const containers = appContainers(await this.app(link));
+		const pushed = containers.filter((item) => isPushed(item, link));
+		const currentTag = pushed[0]?.imageTag;
+		let target;
+		if (to) {
+			target = records.find((item) => item.id === to || item.tag === to);
+			if (!target) throw new Error(`There is no deploy ${to} in ${BUNNY_DEPLOYS_DIR}.`);
+		} else {
+			target = records.find((item) => !item.failed && item.tag !== currentTag);
+			if (!target) throw new Error("There is no earlier deploy to roll back to.");
+		}
+		if (target.failed) throw new Error(`Deploy ${target.id} failed, so its images may not exist.`);
+		const id = deployId(this.now(), "rollback");
+		await this.retag(link, containers, pushed.map((item) => item.name), target.tag);
+		this.writeRecord(directory, {
+			id,
+			tag: target.tag,
+			commit: target.commit,
+			message: `Rollback to ${target.id}`,
+			createdAt: this.now().toISOString(),
+			rollbackOf: target.id
+		}, [`Bunny is rolling out ${target.tag}`]);
+		return id;
+	}
+	/** The tag the app's own images run, and Bunny's state. */
+	async current(link) {
+		const app = await this.app(link);
+		return {
+			tag: appContainers(app).filter((item) => isPushed(item, link))[0]?.imageTag,
+			status: appStatusText(app)
+		};
+	}
+	statusOf(record, latest, current) {
+		if (record.failed) return "failed";
+		if (record.tag === current.tag && latest) {
+			if (bunnyBusy(current.status)) return "building";
+			const state = bunnyState(current.status);
+			if (state === "running" || state === "unknown") return "finished";
+			return "failed";
+		}
+		if (latest) return this.now().getTime() - new Date(record.createdAt).getTime() < 12e4 ? "queued" : "failed";
+		return "finished";
+	}
+	async deployment(link, id) {
+		const directory = projectDirectory(link);
+		const records = this.records(directory);
+		const record = records.find((item) => item.id === id);
+		if (!record) throw new Error(`There is no deploy ${id} in ${BUNNY_DEPLOYS_DIR}.`);
+		const current = await this.current(link);
+		const logFile = join(directory, BUNNY_DEPLOYS_DIR, `${id}.log`);
+		const log = existsSync(logFile) ? readFileSync(logFile, "utf8").replace(/\n$/, "") : "";
+		return {
+			...toDeployment$1(record, this.statusOf(record, records[0]?.id === id, current), link),
+			log: log ? log.split("\n").map((line) => ({
+				text: line,
+				stderr: false
+			})) : []
+		};
+	}
+	async deployments(link, limit) {
+		const records = this.records(projectDirectory(link)).slice(0, Math.max(1, limit));
+		if (!records.length) return [];
+		const current = await this.current(link);
+		return records.map((record, index) => ({
+			...toDeployment$1(record, this.statusOf(record, index === 0, current), link),
+			log: []
+		}));
+	}
+	async status(link) {
+		const word = appStatusText(await this.app(link));
+		const state = bunnyBusy(word) ? "degraded" : bunnyState(word);
+		const details = [word ?? "no status"];
+		const domains = [];
+		if (link.application) try {
+			const zone = await this.pullZone(link.application);
+			for (const item of listOf(zone.Hostnames)) {
+				const host = text(item.Value);
+				if (!host || item.IsSystemHostname === true || host.endsWith(".b-cdn.net")) continue;
+				domains.push(`https://${host}`);
+				if (item.HasCertificate !== true) details.push(`no certificate for ${host} yet: check its DNS record`);
+			}
+		} catch {
+			details.push("could not read the CDN pull zone");
+		}
+		return {
+			state,
+			detail: details.join(", "),
+			domains,
+			url: dashboardUrl(link)
+		};
+	}
+};
+function missingContainer(name) {
+	return `The app on Bunny has no container ${name}. compose.yaml changed since setup: run dstack deploy setup --force to create the app again.`;
+}
+/** Whether a Bunny container runs an image this project pushes: one in the account's namespace. */
+function isPushed(container, link) {
+	return container.imageNamespace === link.environment;
+}
+/** The project directory, where the deploy records are. */
+function projectDirectory(link) {
+	return link.directory ?? process.cwd();
+}
+function dashboardUrl(link) {
+	return `https://dash.bunny.net/magic-containers/apps/${encodeURIComponent(link.project)}`;
+}
+function toDeployment$1(record, status, link) {
+	return {
+		id: record.id,
+		status,
+		commit: record.commit,
+		message: record.message,
+		createdAt: record.createdAt,
+		url: dashboardUrl(link)
+	};
+}
+/** The variables of .env.production, or of .env on a machine where that is the production one. */
+function productionEnv(directory) {
+	for (const name of [".env.production", ".env"]) {
+		const file = join(directory, name);
+		if (existsSync(file)) return parseEnv(readFileSync(file, "utf8"));
+	}
+	throw new Error(".env.production does not exist. Run dstack production --domain example.com first.");
+}
+const bunny = {
+	id: "bunny",
+	name: "Bunny Magic Containers",
+	auth: {
+		kind: "token",
+		env: "DSTACK_BUNNY_TOKEN",
+		help: () => "Copy the API key of your bunny.net account from https://dash.bunny.net/account/api-key. It also logs in to Bunny Container Registry."
+	},
+	source: "local",
+	target: {
+		label: "Bunny API",
+		placeholder: BUNNY_API,
+		fixed: BUNNY_API,
+		normalize: () => BUNNY_API
+	},
+	platformEnv: BUNNY_PLATFORM_ENV,
+	setupFlags: [
+		{
+			name: "region",
+			description: "Bunny: the region of the app, such as DE (default: the closest)"
+		},
+		{
+			name: "volumeSize",
+			description: "Bunny: the size of the database volume in GB (default: 10)"
+		},
+		{
+			name: "account",
+			description: "Bunny: the account id, the namespace in Bunny Container Registry"
+		}
+	],
+	printsDns: true,
+	connect: (_target, token) => {
+		if (!token) throw new Error("Bunny needs an API key.");
+		return new BunnyClient(token);
+	}
+};
+// src/deploy/provider.ts
+/** The target of a platform with a web API and an API key. */
+function urlTarget(name, placeholder) {
+	return {
+		label: `${name} URL`,
+		placeholder,
+		normalize: normalizeUrl
+	};
+}
+/** Normalizes an instance URL: https by default, no trailing slash or path. */
+function normalizeUrl(value) {
+	const trimmed = value.trim();
+	const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+	let parsed;
+	try {
+		parsed = new URL(withScheme);
+	} catch {
+		throw new Error(`${value} is not a URL. Enter one such as https://coolify.example.com.`);
+	}
+	return `${parsed.protocol}//${parsed.host}`;
+}
+// src/deploy/coolify.ts
+/**
+* Coolify (https://coolify.io), through its API at /api/v1 with a bearer
+* token. The project deploys as a Docker Compose application that Coolify
+* builds on the server from the git repository; Coolify's proxy gets the
+* certificate and forwards to the `proxy` service (Caddy) on port 80.
+*/
+/** Variables that put Caddy behind Coolify's proxy. See the docs page on platforms. */
+const PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	TRUSTED_PROXIES: "private_ranges",
+	NUM_PROXIES: "2",
+	HTTP_PORT: "127.0.0.1:8080",
+	HTTPS_PORT: "127.0.0.1:8443"
+};
+/** Setup flags Coolify and Dokploy share; `deploy setup` shows each flag once. */
+const SHARED_SETUP_FLAGS = [
+	{
+		name: "server",
+		description: "The server on the platform, by name or id (Dokploy: dokploy for its own)"
+	},
+	{
+		name: "project",
+		description: "The platform's project, by name or id (default: the project name)"
+	},
+	{
+		name: "environment",
+		description: "The platform's environment (default: production)"
+	}
+];
+var CoolifyError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var CoolifyApi = class {
+	url;
+	token;
+	fetchImpl;
+	constructor(url, token, fetchImpl = fetch) {
+		this.url = url;
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+	}
+	async request(method, path, body) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.url}/api/v1${path}`, {
+				method,
+				headers: {
+					Authorization: `Bearer ${this.token}`,
+					Accept: "application/json",
+					...body === void 0 ? {} : { "Content-Type": "application/json" }
+				},
+				body: body === void 0 ? void 0 : JSON.stringify(body),
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new CoolifyError(`Could not reach Coolify at ${this.url}: ${error.message}`, 0);
+		}
+		const text = await response.text();
+		if (!response.ok) throw new CoolifyError(errorMessage$1(response.status, text, this.url), response.status);
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			return text;
+		}
+	}
+	get = (path) => this.request("GET", path);
+	post = (path, body) => this.request("POST", path, body ?? {});
+	patch = (path, body) => this.request("PATCH", path, body);
+};
+function errorMessage$1(status, text, url) {
+	if (status === 401) return `Coolify at ${url} rejected the API key. Run dstack deploy login to enter a new one.`;
+	if (status === 403) return "The API key may not do this. Give it the read, write and deploy permissions in Coolify under Keys & Tokens.";
+	if (status === 404 && text.includes("<html")) return `${url} does not answer like Coolify; check the URL.`;
+	let message = "";
+	try {
+		const body = JSON.parse(text);
+		message = body.message ?? "";
+		if (body.errors) message += ` ${Object.values(body.errors).flat().join(" ")}`;
+	} catch {
+		message = text.slice(0, 200);
+	}
+	return `Coolify answered ${status}${message ? `: ${message.trim()}` : "."}`;
+}
+const enc = encodeURIComponent;
+function deploymentStatus(value) {
+	if (value === "queued") return "queued";
+	if (value === "in_progress") return "building";
+	if (value === "finished") return "finished";
+	if (value.startsWith("cancelled")) return "cancelled";
+	return "failed";
+}
+function appState(value) {
+	const [state = "", health = ""] = (value ?? "").split(/[:(]/);
+	if (state === "running") return health.startsWith("unhealthy") ? "degraded" : "running";
+	if (state === "degraded" || state === "restarting") return "degraded";
+	if (state === "exited" || state === "stopped") return "stopped";
+	return "unknown";
+}
+/** Coolify keeps the log as JSON text: a list of { output, type, hidden }. */
+function parseLog(logs) {
+	if (!logs) return [];
+	let entries;
+	try {
+		entries = JSON.parse(logs);
+	} catch {
+		return logs.split("\n").map((text) => ({
+			text,
+			stderr: false
+		}));
+	}
+	if (!Array.isArray(entries)) return [];
+	return entries.filter((entry) => !entry.hidden && entry.output).flatMap((entry) => String(entry.output).split("\n").map((text) => ({
+		text,
+		stderr: entry.type === "stderr"
+	})));
+}
+/** The domains of a Compose application, by service. */
+function composeDomains(app) {
+	let value = app.docker_compose_domains;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		value = null;
+	}
+	const domains = Object.values(value ?? {}).flatMap((service) => (service?.domain ?? "").split(",")).map((domain) => domain.trim()).filter(Boolean);
+	if (!domains.length && app.fqdn) domains.push(...app.fqdn.split(",").map((d) => d.trim()));
+	return domains.map((domain) => domain.replace(/:\d+$/, ""));
+}
+function appUrl(api, link) {
+	return `${api.url}/project/${link.project}/environment/${link.environment}/application/${link.application}`;
+}
+function toDeployment(api, link, item) {
+	const path = item.deployment_url;
+	return {
+		id: item.deployment_uuid,
+		status: deploymentStatus(item.status),
+		commit: item.commit && item.commit !== "HEAD" ? item.commit.slice(0, 7) : void 0,
+		message: item.commit_message?.split("\n")[0] || void 0,
+		createdAt: item.created_at,
+		updatedAt: item.updated_at,
+		url: path ? `${api.url}${path.startsWith("/") ? "" : "/"}${path}` : `${appUrl(api, link)}/deployment/${item.deployment_uuid}`,
+		log: parseLog(item.logs)
+	};
+}
+/** Finds a name or uuid in a list. */
+function find$1(items, wanted) {
+	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
+}
+var CoolifyClient = class {
+	api;
+	constructor(url, token, fetchImpl) {
+		this.api = new CoolifyApi(url, token, fetchImpl);
+	}
+	async verify() {
+		const version = await this.api.get("/version");
+		await this.api.get("/servers");
+		return String(version).trim();
+	}
+	async setup(context) {
+		const { ask, options } = context;
+		if (!context.repository) throw new Error("Coolify builds from a git repository; pass --repository.");
+		const api = this.api;
+		const servers = await api.get("/servers");
+		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
+		let server;
+		if (options.server) {
+			server = find$1(servers, options.server);
+			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
+		} else if (servers.length === 1) server = servers[0];
+		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+			value: item.uuid,
+			label: item.name,
+			hint: item.ip
+		}))));
+		if (!server) throw new Error("No server chosen.");
+		const projects = await api.get("/projects");
+		let project;
+		const projectName = options.project ?? context.name;
+		project = find$1(projects, projectName);
+		if (!options.project && ask.interactive && projects.length) {
+			const NEW = "";
+			const uuid = await ask.select("Coolify project", [...project ? [] : [{
+				value: NEW,
+				label: `Create ${projectName}`
+			}], ...projects.map((item) => ({
+				value: item.uuid,
+				label: item.name,
+				hint: item.description ?? void 0
+			}))], project?.uuid ?? NEW);
+			project = uuid === NEW ? void 0 : find$1(projects, uuid);
+		}
+		if (!project) {
+			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
+			project = {
+				uuid: (await api.post("/projects", {
+					name: projectName,
+					description: "DjangoStack"
+				})).uuid,
+				name: projectName
+			};
+			ask.step(`Created the Coolify project ${projectName}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		if (!environment) {
+			environment = {
+				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
+				name: environmentName
+			};
+			ask.step(`Created the environment ${environmentName}`);
+		}
+		let githubApp;
+		if (options.githubApp && options.githubApp !== "public") {
+			const app = find$1(await api.get("/github-apps"), options.githubApp);
+			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
+			githubApp = app.uuid;
+		} else if (!options.githubApp && ask.interactive) {
+			const apps = (await api.get("/github-apps").catch(() => [])).filter((app) => app.uuid && app.name);
+			if (apps.length) {
+				const choice = await ask.select("How Coolify gets the code", [{
+					value: "public",
+					label: "Public repository",
+					hint: "no access needed"
+				}, ...apps.map((app) => ({
+					value: app.uuid,
+					label: `GitHub App ${app.name}`,
+					hint: "private repository"
+				}))], "public");
+				githubApp = choice === "public" ? void 0 : choice;
+			}
+		}
+		const body = {
+			project_uuid: project.uuid,
+			server_uuid: server.uuid,
+			environment_uuid: environment.uuid,
+			git_repository: context.repository,
+			git_branch: context.branch,
+			build_pack: "dockercompose",
+			docker_compose_location: "/compose.yaml",
+			docker_compose_domains: [{
+				name: "proxy",
+				domain: `https://${context.domain}:80`
+			}],
+			name: context.name,
+			description: "DjangoStack",
+			instant_deploy: false,
+			...githubApp ? { github_app_uuid: githubApp } : {}
+		};
+		const created = await api.post(githubApp ? "/applications/private-github-app" : "/applications/public", body);
+		ask.step(`Created the application ${context.name} from ${context.repository} (${context.branch})`);
+		const link = {
+			provider: "coolify",
+			url: api.url,
+			project: project.uuid,
+			environment: environment.uuid,
+			application: created.uuid
+		};
+		await this.pushEnv(link, context.env);
+		ask.step(`Set ${Object.keys(context.env).length} environment variables`);
+		return {
+			project: link.project,
+			environment: link.environment,
+			application: link.application
+		};
+	}
+	async pushEnv(link, env) {
+		const data = Object.entries(env).map(([key, value]) => ({
+			key,
+			value,
+			is_literal: true,
+			is_preview: false
+		}));
+		await this.api.patch(`/applications/${enc(link.application)}/envs/bulk`, { data });
+	}
+	async deploy(link, options) {
+		const query = `uuid=${enc(link.application)}${options.force ? "&force=true" : ""}`;
+		const result = await this.api.post(`/deploy?${query}`);
+		const id = result?.deployments?.[0]?.deployment_uuid;
+		if (!id) throw new Error(result?.deployments?.[0]?.message ?? "Coolify did not start a deployment.");
+		return id;
+	}
+	async deployment(link, id) {
+		return toDeployment(this.api, link, await this.api.get(`/deployments/${enc(id)}`));
+	}
+	async deployments(link, limit) {
+		const result = await this.api.get(`/deployments/applications/${enc(link.application)}?take=${limit}`);
+		return (Array.isArray(result) ? result : result?.deployments ?? []).map((item) => toDeployment(this.api, link, item));
+	}
+	async status(link) {
+		const app = await this.api.get(`/applications/${enc(link.application)}`);
+		return {
+			state: appState(app.status),
+			detail: app.status ?? "unknown",
+			domains: composeDomains(app),
+			branch: app.git_branch,
+			url: appUrl(this.api, link)
+		};
+	}
+};
+const coolify = {
+	id: "coolify",
+	name: "Coolify",
+	auth: {
+		kind: "token",
+		env: "DSTACK_COOLIFY_TOKEN",
+		help: (url) => `Create one in Coolify under Keys & Tokens › API tokens (${url}/security/api-tokens) with the read, write and deploy permissions. API access must be on under Settings › Advanced.`
+	},
+	source: "remote",
+	target: urlTarget("Coolify", "https://coolify.example.com"),
+	platformEnv: PLATFORM_ENV,
+	setupFlags: [...SHARED_SETUP_FLAGS, {
+		name: "githubApp",
+		description: "A Coolify GitHub App for a private repository, or public"
 	}],
-	connect: (target) => new SshClient(target)
+	connect: (url, token) => {
+		if (!token) throw new Error("Coolify needs an API key.");
+		return new CoolifyClient(url, token);
+	}
 };
 // src/deploy/dokploy.ts
 var DokployError = class extends Error {
@@ -1164,123 +2481,14 @@ function deleteToken(provider, url) {
 	} catch {}
 	return removeFromFile(account) || removed;
 }
-// src/deploy/link.ts
-/** Where a project deploys, relative to the project directory. It holds no secrets and can be committed. */
-const LINK_FILE = ".dstack/deploy.json";
-function readLink(directory) {
-	const path = join(directory, LINK_FILE);
-	if (!existsSync(path)) return void 0;
-	let link;
-	try {
-		link = JSON.parse(readFileSync(path, "utf8"));
-	} catch {
-		throw new Error(`${LINK_FILE} is not valid JSON.`);
-	}
-	for (const key of [
-		"provider",
-		"url",
-		"project",
-		"environment",
-		"application"
-	]) if (typeof link[key] !== "string" || !link[key]) throw new Error(`${LINK_FILE} has no ${key}.`);
-	return link;
-}
-function writeLink(directory, link) {
-	const path = join(directory, LINK_FILE);
-	mkdirSync(dirname(path), { recursive: true });
-	const { provider, url, project, environment, application } = link;
-	writeFileSync(path, `${JSON.stringify({
-		provider,
-		url,
-		project,
-		environment,
-		application
-	}, null, 2)}\n`);
-}
-/** An https URL for a git remote: git@github.com:owner/repo.git becomes https://github.com/owner/repo. */
-function httpsRepository(remote) {
-	const value = remote.trim();
-	const scp = value.match(/^[\w.-]+@([\w.-]+):(.+)$/);
-	let url;
-	if (scp) url = `https://${scp[1]}/${scp[2]}`;
-	else try {
-		const parsed = new URL(value);
-		url = `https://${parsed.host.replace(/:\d+$/, "")}${parsed.pathname}`;
-	} catch {
-		throw new Error(`Cannot read the git remote ${value}.`);
-	}
-	return url.replace(/\.git$/, "").replace(/\/$/, "");
-}
-function git(directory, args) {
-	try {
-		return execFileSync("git", args, {
-			cwd: directory,
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return;
-	}
-}
-function gitRemote(directory, remote = "origin") {
-	return git(directory, [
-		"remote",
-		"get-url",
-		remote
-	]) || void 0;
-}
-function gitBranch(directory) {
-	const branch = git(directory, [
-		"rev-parse",
-		"--abbrev-ref",
-		"HEAD"
-	]);
-	return branch && branch !== "HEAD" ? branch : void 0;
-}
-/**
-* Why a deploy of `branch` would not include the local commit, or undefined
-* when origin has it. The platform builds from the remote, not from here.
-*/
-function unpushedReason(directory, branch) {
-	const head = git(directory, ["rev-parse", "HEAD"]);
-	if (!head) return void 0;
-	if (git(directory, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		`refs/remotes/origin/${branch}`
-	]) === void 0) return `origin has no branch ${branch}. Push it first: git push -u origin ${branch}`;
-	if (git(directory, [
-		"merge-base",
-		"--is-ancestor",
-		head,
-		`refs/remotes/origin/${branch}`
-	]) === void 0) return `Your last commit is not on origin/${branch}, so the deploy would not include it. Push first: git push`;
-}
-/**
-* Why an upload of HEAD would not match the working tree, or undefined when
-* it does. Providers that upload the local commit deploy HEAD only, so
-* changes to tracked files must be committed first.
-*/
-function uncommittedReason(directory) {
-	if (git(directory, ["rev-parse", "HEAD"]) === void 0) return "This project has no commit yet. Commit it first: git add -A && git commit";
-	if (git(directory, [
-		"status",
-		"--porcelain",
-		"--untracked-files=no"
-	])) return "You have uncommitted changes, so the deploy would not include them. Commit first.";
-}
 // src/deploy/index.ts
 const DEFAULT_PROVIDER = coolify;
 /** Every deploy provider. */
 const PROVIDERS = [
 	coolify,
 	dokploy,
-	ssh
+	ssh,
+	bunny
 ];
 function getProvider(id) {
 	const provider = PROVIDERS.find((item) => item.id === id);
@@ -1362,17 +2570,45 @@ function projectManifest(project) {
 /**
 * The project's stack: from the preset `init` saved in `package.json`, or,
 * for projects from before that, the defaults with the storage from `.env`.
+* Analytics follow the `analytics` profile: projects from before Umami was
+* generated have the default in their preset without running it.
 */
 function projectStack(project) {
+	const fromEnv = {
+		analytics: project.profiles.includes("analytics") ? "umami" : "off",
+		...project.env.CACHE_URL === void 0 ? {} : cacheStack(project.env)
+	};
 	const { preset } = projectManifest(project);
 	if (preset) try {
-		return decodePreset(preset);
+		return {
+			...decodePreset(preset),
+			...fromEnv
+		};
 	} catch {}
 	return {
 		...DEFAULT_STACK,
+		...fromEnv,
 		storage: project.profiles.includes("s3") ? "s3" : "local"
 	};
 }
+const REDIS = /^(redis|rediss|valkey|valkeys):/;
+/**
+* The cache and the tasks a project's `.env` runs. Projects from before 0.7
+* have no TASKS_URL: their tasks follow a Redis cache, like the backend does.
+*/
+function cacheStack(env) {
+	const cacheUrl = env.CACHE_URL ?? "";
+	const cache = cacheUrl.startsWith("db:") ? "database" : REDIS.test(cacheUrl) ? "valkey" : "off";
+	const tasksUrl = env.TASKS_URL || (cache === "valkey" ? cacheUrl : "immediate://");
+	if (tasksUrl.startsWith("immediate:")) return {
+		cache,
+		tasks: "off"
+	};
+	return {
+		cache,
+		tasks: REDIS.test(tasksUrl) && cache !== "valkey" ? "huey-valkey" : "huey"
+	};
+}
 /** The URLs of a running project. */
 function projectUrls(project) {
 	if (project.prod) {
@@ -1385,23 +2621,25 @@ function projectUrls(project) {
 			url: `${site}/admin/`
 		}];
 	}
+	const ports = envPorts(project.env);
+	const site = (project.env.SITE_URL || `http://localhost:${ports.SITE_PORT}`).replace(/\/$/, "");
 	const urls = [
 		{
 			label: "Site",
-			url: "http://localhost:3000"
+			url: site
 		},
 		{
 			label: "Admin",
-			url: "http://localhost:3000/admin/"
+			url: `${site}/admin/`
 		},
 		{
 			label: "Mail",
-			url: "http://localhost:8025"
+			url: `http://localhost:${ports.MAIL_PORT}`
 		}
 	];
 	if (project.profiles.includes("s3")) urls.push({
 		label: "S3",
-		url: "http://localhost:8333"
+		url: `http://localhost:${ports.S3_PORT}`
 	});
 	return urls;
 }
@@ -1650,7 +2888,7 @@ async function deploySetup(options) {
 		}))
 	}));
 	const provider = providerOrFail(providerId);
-	let instance = options.url;
+	let instance = options.url ?? provider.target.fixed;
 	if (!instance) {
 		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
 		instance = unwrap(await p.text({
@@ -1693,6 +2931,7 @@ async function deploySetup(options) {
 	for (const flag of provider.setupFlags) flags[flag.name] = options[flag.name];
 	const ids = await attempt(client.setup({
 		ask: promptAsk(interactive),
+		directory: project.directory,
 		name: project.name,
 		repository,
 		branch,
@@ -1703,11 +2942,12 @@ async function deploySetup(options) {
 	const link = {
 		provider: provider.id,
 		url: instance,
-		...ids
+		...ids,
+		directory: project.directory
 	};
 	writeLink(project.directory, link);
 	p.log.success(`Wrote ${pc.bold(LINK_FILE)}. It holds no secrets; commit it so others deploy to the same place.`);
-	p.note([`Point the DNS of ${pc.bold(domain)} at the ${provider.auth.kind === "ssh" ? "" : `${provider.name} `}server.`, provider.auth.kind === "ssh" ? `To change variables, edit ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.` : `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
+	p.note([...provider.printsDns ? [] : [`Point the DNS of ${pc.bold(domain)} at the ${provider.auth.kind === "ssh" ? "" : `${provider.name} `}server.`], provider.auth.kind === "ssh" ? `To change variables, edit ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.` : `Change variables in ${provider.name}, or in ${PRODUCTION_ENV} and run ${command("dstack deploy env push")}.`].join("\n"), "Next");
 	if (options.deploy ?? (interactive ? unwrap(await p.confirm({
 		message: "Deploy now?",
 		initialValue: true
@@ -1901,7 +3141,7 @@ async function loginTarget(options, interactive) {
 	} catch {}
 	const provider = providerOrFail(options.provider ?? link?.provider ?? DEFAULT_PROVIDER.id);
 	tokenAuth(provider);
-	let instance = options.url ?? link?.url;
+	let instance = options.url ?? link?.url ?? provider.target.fixed;
 	if (!instance) {
 		if (!interactive) fail(`Pass --url, the address of your ${provider.name}.`);
 		instance = unwrap(await p.text({
@@ -2206,14 +3446,23 @@ async function offerGlobalInstall() {
 	return true;
 }
 // src/commands/init.ts
-/** The prompt choices of an option; values this version does not generate yet are shown but disabled. */
-function choices(key) {
-	return stackOption(key).values.map((value, index) => ({
-		value: value.value,
-		label: value.label,
-		hint: value.generated || index === 0 ? value.hint : "coming soon",
-		disabled: !value.generated && index > 0
-	}));
+/**
+* The prompt choices of an option; values this version does not generate yet
+* are shown but disabled. The tasks follow the cache chosen before them: Huey
+* keeps its queue in the database, or in Valkey with the Valkey cache.
+*/
+function choices(key, stack = {}) {
+	return stackOption(key).values.flatMap((value, index) => {
+		let hint = value.generated || index === 0 ? value.hint : "coming soon";
+		if (key === "tasks" && value.value === "huey") hint = stack.cache === "valkey" ? "a worker container, the queue in Valkey" : "a worker container, the queue in Postgres";
+		if (key === "tasks" && value.value === "huey-valkey" && stack.cache === "valkey") return [];
+		return [{
+			value: value.value,
+			label: value.label,
+			hint,
+			disabled: !value.generated && index > 0
+		}];
+	});
 }
 /**
 * The stack from, in order of precedence, the flags, the preset, the prompts
@@ -2229,8 +3478,8 @@ async function chooseStack(options, interactive, askDatabase) {
 	}
 	const stack = { ...DEFAULT_STACK };
 	let databaseUrl;
-	for (const option of STACK_OPTIONS) {
-		const key = option.key;
+	for (const key of PROMPT_ORDER) {
+		const option = stackOption(key);
 		if (options.fromCli(key)) stack[key] = options[key];
 		else if (key === "storage" && options.fromCli("localS3") && options.localS3) stack[key] = "s3";
 		else if (preset) stack[key] = preset[key];
@@ -2240,11 +3489,14 @@ async function chooseStack(options, interactive, askDatabase) {
 			if ("databaseUrl" in answer) databaseUrl = answer.databaseUrl;
 			else stack[key] = answer.postgres;
 		} else if (key === "postgres" && options.databaseUrl) continue;
-		else stack[key] = unwrap(await p.select({
-			message: option.message,
-			options: choices(key),
-			initialValue: stack[key]
-		}));
+		else {
+			const initialValue = key === "storage" && stack.media === "s3" ? "s3" : stack[key];
+			stack[key] = unwrap(await p.select({
+				message: option.message,
+				options: choices(key, stack),
+				initialValue
+			}));
+		}
 	}
 	return {
 		stack,
@@ -2339,6 +3591,8 @@ async function init(directoryArgument, options) {
 		message: "Add demo content? (example pages and posts)",
 		initialValue: true
 	}));
+	const ports = await chooseFreePorts({}, stack.storage === "s3" ? ["s3"] : []);
+	for (const move of ports.moves) p.log.info(describeMove(move));
 	const spinner = p.spinner();
 	spinner.start("Creating the project");
 	let result;
@@ -2350,8 +3604,12 @@ async function init(directoryArgument, options) {
 			demoContent,
 			databaseUrl,
 			localS3: stack.storage === "s3",
+			analytics: stack.analytics === "umami",
+			cache: stack.cache,
+			tasks: stack.tasks,
 			preset: encodePreset(stack),
 			timeZone,
+			ports: ports.ports,
 			link: options.link
 		});
 	} catch (error) {
@@ -2386,22 +3644,24 @@ async function init(directoryArgument, options) {
 	} catch {
 		p.log.warn("Could not commit the project with git. Commit it yourself.");
 	}
+	if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
+	const startCommand = isOnPath() ? "dstack dev" : "docker compose up";
 	p.note([
 		command(`cd ${relativeDirectory(target)}`),
-		command("docker compose up"),
+		command(startCommand),
 		"",
-		`${pc.bold("Site")}    ${url("http://localhost:3000")}`,
-		`${pc.bold("Admin")}   ${url("http://localhost:3000/admin/")}`,
-		`${pc.bold("Mail")}    ${url("http://localhost:8025")}`,
+		`${pc.bold("Site")}    ${url(`http://localhost:${ports.ports.SITE_PORT}`)}`,
+		`${pc.bold("Admin")}   ${url(`http://localhost:${ports.ports.SITE_PORT}/admin/`)}`,
+		`${pc.bold("Mail")}    ${url(`http://localhost:${ports.ports.MAIL_PORT}`)}`,
 		"",
 		`Admin user ${secret(result.adminUsername)}, password ${secret(result.adminPassword)}`,
 		pc.dim("The password is in .env as ADMIN_PASSWORD. Change it after you sign in.")
 	].join("\n"), "Next steps");
 	if (pending.length) p.log.info(`Coming in a later version, so not in this project yet: ${pending.map((item) => `${stackOption(item.key).message.toLowerCase()} (${stack[item.key]})`).join(", ")}.`);
+	if (stack.media === "s3") p.log.info(`Uploads go to S3 in production. Before the first deploy, ${command("dstack production")} asks for the S3 settings; ${command("dstack settings")} changes them later.`);
 	p.log.message(`Create the same stack with ${command(`--preset ${encodePreset(stack)}`)}`);
-	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command("docker compose up")}.`));
+	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command(startCommand)}.`));
 	else if (options.start) {
-		if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
 		p.outro(`Starting the project with ${command("docker compose up")}`);
 		execFileSync("docker", ["compose", "up"], {
 			cwd: target,
@@ -2420,8 +3680,9 @@ async function preset(code, options) {
 		} catch (error) {
 			fail(error.message);
 		}
-		const lines = STACK_OPTIONS.filter((option) => applies(option.key, stack)).map((option) => {
-			const value = option.values.find((candidate) => candidate.value === stack[option.key]);
+		const lines = PROMPT_ORDER.filter((key) => applies(key, stack)).map((key) => {
+			const option = stackOption(key);
+			const value = option.values.find((candidate) => candidate.value === stack[key]);
 			return `${pc.bold(option.message.padEnd(24))}${value?.label ?? ""}`;
 		});
 		p.note(lines.join("\n"), command(`--preset ${encodePreset(stack)}`));
@@ -2432,6 +3693,295 @@ async function preset(code, options) {
 	const encoded = encodePreset(stack);
 	p.outro(`Create this stack with ${command(`${selfCommand()} init --preset ${encoded}`)}`);
 }
+// src/settings.ts
+function validateEmail(value) {
+	return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) ? void 0 : "Enter an email address, such as you@example.com.";
+}
+function validateHost(value) {
+	return /^[a-z0-9.-]+$/i.test(value) && value.includes(".") ? void 0 : "Enter a host name, such as smtp.example.com.";
+}
+function validatePort(value) {
+	const port = Number(value);
+	return Number.isInteger(port) && port > 0 && port < 65536 ? void 0 : "Enter a port, such as 587.";
+}
+function validateUrl(value) {
+	if (!value) return void 0;
+	return /^https?:\/\/[^\s/]+/.test(value) ? void 0 : "Enter a URL that starts with https://.";
+}
+const required = (label) => (value) => value.trim() ? void 0 : `Enter the ${label}.`;
+/**
+* An SMTP URL for EMAIL_URL: smtps:// on port 465, smtp:// on 25, otherwise
+* smtp+tls:// (STARTTLS), with the user name and password URL-encoded.
+*/
+function smtpUrl(parts) {
+	const port = Number(parts.port || "587");
+	const scheme = port === 465 ? "smtps" : port === 25 ? "smtp" : "smtp+tls";
+	const user = parts.username ? encodeURIComponent(parts.username) : "";
+	const password = parts.password ? `:${encodeURIComponent(parts.password)}` : "";
+	return `${scheme}://${user ? `${user}${password}@` : ""}${parts.host}:${port}`;
+}
+/** The parts of an SMTP URL, for the current answers. */
+function smtpParts(value) {
+	try {
+		const url = new URL(value ?? "");
+		return {
+			host: url.hostname,
+			port: url.port,
+			username: decodeURIComponent(url.username),
+			password: decodeURIComponent(url.password)
+		};
+	} catch {
+		return {};
+	}
+}
+const placeholderMail = (value) => !value || value.includes("mailpit") || value.includes("example.com") || value.startsWith("console:");
+const SETTING_GROUPS = [
+	{
+		title: "Admin email",
+		names: ["ADMIN_EMAIL"],
+		applies: () => true,
+		missing: (env) => !env.ADMIN_EMAIL || env.ADMIN_EMAIL.endsWith("@example.com") ? ["ADMIN_EMAIL"] : [],
+		fields: [{
+			name: "ADMIN_EMAIL",
+			message: "Your email address, for the admin user",
+			placeholder: "you@example.com",
+			validate: validateEmail
+		}],
+		values: (answers) => ({ ADMIN_EMAIL: answers.ADMIN_EMAIL ?? "" })
+	},
+	{
+		title: "Outgoing mail",
+		names: ["EMAIL_URL"],
+		applies: () => true,
+		missing: (env) => placeholderMail(env.EMAIL_URL) ? ["EMAIL_URL"] : [],
+		fields: [
+			{
+				name: "host",
+				message: "SMTP server",
+				placeholder: "smtp.example.com",
+				validate: validateHost
+			},
+			{
+				name: "port",
+				message: "SMTP port",
+				defaultValue: "587",
+				validate: validatePort
+			},
+			{
+				name: "username",
+				message: "SMTP user name",
+				optional: true
+			},
+			{
+				name: "password",
+				message: "SMTP password",
+				secret: true,
+				optional: true
+			}
+		],
+		current: (env, field) => placeholderMail(env.EMAIL_URL) ? void 0 : smtpParts(env.EMAIL_URL)[field],
+		values: (answers) => ({ EMAIL_URL: smtpUrl({
+			host: answers.host ?? "",
+			port: answers.port ?? "587",
+			username: answers.username,
+			password: answers.password
+		}) })
+	},
+	{
+		title: "S3 for uploads",
+		names: [
+			"S3_BUCKET",
+			"S3_ENDPOINT_URL",
+			"S3_REGION",
+			"S3_ACCESS_KEY_ID",
+			"S3_SECRET_ACCESS_KEY",
+			"S3_PUBLIC_URL"
+		],
+		applies: (env, context) => context.media === "s3" || Boolean(env.S3_BUCKET),
+		missing: missingS3,
+		fields: [
+			{
+				name: "S3_BUCKET",
+				message: "S3 bucket",
+				placeholder: "example-media",
+				validate: required("bucket")
+			},
+			{
+				name: "S3_ENDPOINT_URL",
+				message: "S3 endpoint, empty for AWS",
+				placeholder: "https://fsn1.your-objectstorage.com",
+				optional: true,
+				validate: validateUrl
+			},
+			{
+				name: "S3_REGION",
+				message: "S3 region",
+				placeholder: "eu-central-1",
+				validate: required("region")
+			},
+			{
+				name: "S3_ACCESS_KEY_ID",
+				message: "S3 access key ID",
+				validate: required("access key ID")
+			},
+			{
+				name: "S3_SECRET_ACCESS_KEY",
+				message: "S3 secret access key",
+				secret: true,
+				validate: required("secret access key")
+			},
+			{
+				name: "S3_PUBLIC_URL",
+				message: "Public URL of the files, empty when it is the endpoint",
+				placeholder: "https://media.example.com",
+				optional: true,
+				validate: validateUrl
+			}
+		],
+		current: (env, field) => env[field],
+		values: (answers) => Object.fromEntries([
+			"S3_BUCKET",
+			"S3_ENDPOINT_URL",
+			"S3_REGION",
+			"S3_ACCESS_KEY_ID",
+			"S3_SECRET_ACCESS_KEY",
+			"S3_PUBLIC_URL"
+		].map((name) => [name, answers[name] ?? ""]))
+	}
+];
+/** The groups of a production `.env` to ask for: the missing ones, or with `all` every one that applies. */
+function settingsToAsk(env, context, all = false) {
+	return SETTING_GROUPS.filter((group) => group.applies(env, context) && (all || group.missing(env).length));
+}
+/** Every `.env` variable `--set` takes. */
+const SETTING_NAMES = SETTING_GROUPS.flatMap((group) => group.names);
+/** Parses `--set NAME=value` arguments. Throws with a one-line reason. */
+function parseAssignments(items) {
+	const values = {};
+	for (const item of items) {
+		const index = item.indexOf("=");
+		const name = index > 0 ? item.slice(0, index) : "";
+		if (!SETTING_NAMES.includes(name)) throw new Error(`${JSON.stringify(item)} is not NAME=value for one of ${SETTING_NAMES.join(", ")}.`);
+		const value = item.slice(index + 1);
+		if (/[\r\n]/.test(value)) throw new Error(`The value of ${name} has a line break.`);
+		if (name === "ADMIN_EMAIL" && validateEmail(value)) throw new Error(`ADMIN_EMAIL: ${validateEmail(value)}`);
+		values[name] = value;
+	}
+	return values;
+}
+/** The items of `production`'s to-do list that the settings now in `env` have done. */
+function remainingTodo(todo, env) {
+	return todo.filter((item) => {
+		const group = SETTING_GROUPS.find((candidate) => candidate.names.some((name) => item.includes(name.startsWith("S3_") ? "S3_" : name)));
+		return !group || group.missing(env).length > 0;
+	});
+}
+// src/commands/settings.ts
+/** The `media` stack option of the project, from the preset in package.json. */
+function projectContext(directory) {
+	try {
+		return { media: projectStack(readProject(directory)).media };
+	} catch {
+		return {};
+	}
+}
+/** Asks for each field of the groups; returns the `.env` values. */
+async function askSettings(groups, env) {
+	const values = {};
+	for (const group of groups) {
+		p.log.step(pc.bold(group.title));
+		const answers = {};
+		for (const field of group.fields) {
+			const current = group.current?.(env, field.name);
+			const check = (value) => {
+				const text = (value ?? "").trim();
+				if (!text && (field.optional || field.defaultValue || field.secret && current)) return void 0;
+				return field.validate?.(text) ?? (text ? void 0 : `Enter the ${field.message.toLowerCase()}.`);
+			};
+			let answer;
+			if (field.secret) {
+				answer = unwrap(await p.password({
+					message: current ? `${field.message} (empty keeps the current one)` : field.message,
+					validate: check
+				}));
+				if (!answer && current) answer = current;
+			} else answer = unwrap(await p.text({
+				message: field.message,
+				placeholder: field.placeholder ?? field.defaultValue,
+				initialValue: current,
+				defaultValue: field.defaultValue,
+				validate: check
+			}));
+			answers[field.name] = (answer ?? field.defaultValue ?? "").trim();
+		}
+		Object.assign(values, group.values(answers));
+	}
+	return values;
+}
+/** Writes values to a `.env` file, quoted where Compose needs it. Throws for a value it can't write. */
+function writeSettings(path, values) {
+	const quoted = Object.fromEntries(Object.entries(values).map(([name, value]) => [name, quoteEnvValue(value)]));
+	writeFileSync(path, setEnvValues(readFileSync(path, "utf8"), quoted), { mode: 384 });
+}
+/** The production `.env` of a project: `--file`, `.env.production`, or `.env` on a server. */
+function targetFile(directory, file) {
+	if (file) {
+		const path = join(directory, file);
+		if (!existsSync(path)) fail(`${path} does not exist.`);
+		return path;
+	}
+	const production = join(directory, ".env.production");
+	if (existsSync(production)) return production;
+	const env = join(directory, ".env");
+	if (existsSync(env) && parseProfiles(parseEnv(readFileSync(env, "utf8")).COMPOSE_PROFILES).includes("prod")) return env;
+	fail(`There is no .env.production yet. Write it with ${command("dstack production")}.`);
+}
+/** `dstack settings`: ask for the missing production settings and credentials, and save them. */
+async function settings(options) {
+	const interactive = isInteractive(options.yes);
+	intro("Production settings");
+	const directory = findProjectDirectory(options.dir ?? ".");
+	if (!directory) fail("No DjangoStack project here: run this where compose.yaml and .env are.");
+	const target = targetFile(directory, options.file);
+	const name = relative(directory, target);
+	let assigned;
+	try {
+		assigned = parseAssignments(options.set ?? []);
+	} catch (error) {
+		fail(error.message);
+	}
+	const env = {
+		...parseEnv(readFileSync(target, "utf8")),
+		...assigned
+	};
+	const context = projectContext(directory);
+	const missing = settingsToAsk(env, context);
+	let values = assigned;
+	if (interactive) {
+		const groups = settingsToAsk(env, context, options.all);
+		if (!groups.length && !Object.keys(assigned).length) {
+			p.outro(pc.green(`Nothing is missing in ${name}`));
+			return;
+		}
+		if (groups.length && !options.all) p.log.info(`${name} needs ${groups.map((group) => group.title.toLowerCase()).join(", ")}.`);
+		values = {
+			...assigned,
+			...await askSettings(groups, env)
+		};
+	} else if (missing.length) fail(`${name} misses ${missing.flatMap((group) => group.missing(env)).join(", ")}. Pass them with --set NAME=value.`);
+	else if (!Object.keys(assigned).length) {
+		p.outro(pc.green(`Nothing is missing in ${name}`));
+		return;
+	}
+	try {
+		writeSettings(target, values);
+	} catch (error) {
+		fail(error.message);
+	}
+	p.log.success(`Saved ${Object.keys(values).join(", ")} in ${pc.bold(name)}`);
+	if (existsSync(join(directory, ".dstack", "deploy.json")) && target.endsWith(".env.production")) p.outro(`Send them to the platform with ${command("dstack deploy env push")}`);
+	else p.outro(pc.green("Done"));
+}
 // src/commands/production.ts
 async function production(directoryArgument, options) {
 	const interactive = isInteractive(options.yes);
@@ -2450,18 +4000,36 @@ async function production(directoryArgument, options) {
 			validate: (v) => validateDomain(v ?? "")
 		}));
 	}
+	const context = projectContext(directory);
 	let result;
 	try {
-		result = productionEnv(readFileSync(envPath, "utf8"), {
+		result = productionEnv$1(readFileSync(envPath, "utf8"), {
 			domain,
-			emailUrl: options.emailUrl
+			emailUrl: options.emailUrl,
+			media: context.media
 		});
 	} catch (error) {
 		fail(error.message);
 	}
 	writeFileSync(target, result.text, { mode: 384 });
 	p.log.success(`Wrote ${pc.bold(relativeDirectory(target))} with new secrets for the server.`);
-	if (result.todo.length) p.note(result.todo.map((item) => `${pc.yellow("•")} ${item}`).join("\n"), "Before the first deploy");
+	let todo = result.todo;
+	const missing = settingsToAsk(parseEnv(result.text), context);
+	if (interactive && missing.length) {
+		if (unwrap(await p.confirm({
+			message: `Set the ${missing.map((group) => group.title.toLowerCase()).join(", ")} now?`,
+			initialValue: true
+		}))) {
+			try {
+				writeSettings(target, await askSettings(missing, parseEnv(result.text)));
+			} catch (error) {
+				fail(error.message);
+			}
+			todo = remainingTodo(todo, parseEnv(readFileSync(target, "utf8")));
+		}
+	}
+	if (todo.some((item) => SETTING_NAMES.some((name) => item.includes(name.startsWith("S3_") ? "S3_" : name)))) todo = [...todo, `Run ${command("dstack settings")} to set them.`];
+	if (todo.length) p.note(todo.map((item) => `${pc.yellow("•")} ${item}`).join("\n"), "Before the first deploy");
 	p.note([
 		`Copy the project to the server, with ${pc.bold(".env.production")} as ${pc.bold(".env")}, then:`,
 		command("docker compose up -d --build"),
@@ -2473,7 +4041,13 @@ async function production(directoryArgument, options) {
 }
 // src/config.ts
 /** The options `config` can switch in an existing project. The rest follow with code generation. */
-const SWITCHABLE = ["storage"];
+const SWITCHABLE = [
+	"storage",
+	"analytics",
+	"media",
+	"cache",
+	"tasks"
+];
 const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key === "S3_CREATE_BUCKET" ? "0" : ""]));
 /**
 * Applies a new stack to a project's `.env`. Throws with a one-line reason
@@ -2482,7 +4056,7 @@ const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key
 function applyStack(envText, env, from, to) {
 	let text = envText;
 	const changes = [];
-	const profiles = (env.COMPOSE_PROFILES ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
+	let profiles = (env.COMPOSE_PROFILES ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
 	for (const option of STACK_OPTIONS) {
 		const key = option.key;
 		if (from[key] === to[key]) continue;
@@ -2493,14 +4067,53 @@ function applyStack(envText, env, from, to) {
 			if (profiles.includes("prod")) throw new Error("--storage only changes development; this .env runs the prod profile.");
 			const endpoint = env.S3_ENDPOINT_URL ?? "";
 			if (endpoint && !endpoint.includes("s3:8333")) throw new Error(`S3_ENDPOINT_URL points at ${endpoint}; change the S3_* values in .env yourself.`);
-			const next = profiles.filter((profile) => profile !== "s3");
-			if (to.storage === "s3") next.push("s3");
+			profiles = profiles.filter((profile) => profile !== "s3");
+			if (to.storage === "s3") profiles.push("s3");
 			text = setEnvValues(text, {
-				...to.storage === "s3" ? LOCAL_S3 : EMPTY_S3,
-				COMPOSE_PROFILES: next.join(",")
+				...to.storage === "s3" ? localS3(envPorts(env).S3_PORT) : EMPTY_S3,
+				COMPOSE_PROFILES: profiles.join(",")
 			});
 			changes.push(to.storage === "s3" ? "Uploads go to the local S3 service (the s3 profile)." : "Uploads go to a Docker volume; the local S3 service is off.");
 		}
+		if (key === "cache") {
+			text = setEnvValues(text, { CACHE_URL: cacheEnv(to).CACHE_URL ?? "" });
+			changes.push({
+				database: "The cache is a table in the database.",
+				valkey: "The cache is in Valkey (the valkey profile).",
+				off: "The cache is per process; nothing is shared."
+			}[to.cache]);
+		}
+		if (key === "tasks" || key === "cache" && from.tasks === "huey" && to.tasks === "huey") {
+			const { CACHE_URL: _, ...tasks } = cacheEnv(to);
+			const before = parseEnv(text).TASKS_URL;
+			text = setEnvValues(text, tasks);
+			if (before !== tasks.TASKS_URL) changes.push(to.tasks === "off" ? "Tasks run in the request; the worker is off, so there are no daily backups." : `The worker keeps its task queue in ${tasks.TASKS_URL === "db://" ? "the database" : "Valkey"}.`);
+		}
+		if (key === "cache" || key === "tasks") {
+			profiles = profiles.filter((profile) => profile !== "valkey");
+			if (usesValkey(parseEnv(text))) profiles.push("valkey");
+			text = setEnvValues(text, { COMPOSE_PROFILES: profiles.join(",") });
+		}
+		if (key === "analytics") {
+			profiles = profiles.filter((profile) => profile !== "analytics");
+			if (to.analytics === "umami") {
+				profiles.push("analytics");
+				const fresh = umamiEnv(env.DATABASE_URL ?? "", generateProjectSecrets());
+				const kept = Object.fromEntries(Object.entries(fresh).filter(([name]) => name === "UMAMI_URL" || !env[name]));
+				text = setEnvValues(text, {
+					...kept,
+					COMPOSE_PROFILES: profiles.join(",")
+				});
+				changes.push("Page analytics with Umami are on (the analytics profile).");
+			} else {
+				text = setEnvValues(text, {
+					UMAMI_URL: "",
+					COMPOSE_PROFILES: profiles.join(",")
+				});
+				changes.push("Page analytics are off; Umami's data stays in the database.");
+			}
+		}
+		if (key === "media") changes.push(to.media === "s3" ? "Uploads in production go to S3; dstack settings asks for the S3 settings." : "Uploads in production stay on the server.");
 	}
 	return {
 		env: text,
@@ -2519,6 +4132,7 @@ function setManifestPreset(manifestText, preset) {
 // src/commands/project.ts
 function open(options) {
 	if (!has("docker", ["compose", "version"])) fail("Docker Compose v2 was not found. Install Docker: https://docs.docker.com/get-docker/");
+	if (!dockerRunning()) fail(dockerNotRunning());
 	try {
 		return readProject(options.dir ?? ".");
 	} catch (error) {
@@ -2539,7 +4153,7 @@ function exitWith(status) {
 function ensureRunEnv(project) {
 	const path = join(project.directory, RUN_ENV);
 	if (!existsSync(path)) {
-		const result = productionEnv(readFileSync(join(project.directory, ".env"), "utf8"), {
+		const result = productionEnv$1(readFileSync(join(project.directory, ".env"), "utf8"), {
 			domain: RUN_DOMAIN,
 			emailUrl: "console://"
 		});
@@ -2569,11 +4183,33 @@ async function run(options) {
 	if (project.localRun) p.log.message(pc.dim(`Caddy signs ${RUN_DOMAIN} with its own local CA, so the browser warns once. The admin password is in ${RUN_ENV}.`));
 	p.outro(`Stop it with ${command("dstack stop")}, follow the logs with ${command("dstack logs")}`);
 }
+/**
+* Moves the development services to free ports when theirs are in use, in
+* `.env`, unless the project already runs. compose.yaml from before the
+* *_PORT variables has fixed ports, so it can only say which one is in use.
+*/
+async function freeDevPorts(project) {
+	if (runningServices(project).length) return project;
+	const { ports, moves, stuck } = await chooseFreePorts(project.env, project.profiles);
+	const [blocked] = stuck;
+	if (blocked) fail(`Port ${envPorts(project.env)[blocked.name]} of the ${blocked.label} is in use. Stop what uses it.`);
+	if (!moves.length) return project;
+	const composeText = readFileSync(join(project.directory, "compose.yaml"), "utf8");
+	for (const move of moves) {
+		const item = DEV_PORTS.find((candidate) => candidate.label === move.label);
+		if (item && !composeText.includes(`\${${item.name}`)) fail(`Port ${move.from} of the ${move.label} is in use. Stop what uses it, or publish another port in compose.yaml.`);
+	}
+	const envPath = join(project.directory, ".env");
+	writeFileSync(envPath, setEnvValues(readFileSync(envPath, "utf8"), portValues(project.env, ports)), { mode: 384 });
+	for (const move of moves) p.log.info(`${describeMove(move)} Saved in .env.`);
+	return readProject(project.directory);
+}
 /** `dstack dev`: the dev profile in the foreground, with hot reload. */
 async function dev(options) {
-	const project = open(options);
+	let project = open(options);
 	if (project.prod) fail(`This .env runs the prod profile. Use ${command("dstack run")}.`);
 	intro("Develop");
+	project = await freeDevPorts(project);
 	urlsNote(project, "Starting");
 	p.log.message(pc.dim("Changes in backend/ and frontend/ reload. Press Ctrl+C to stop."));
 	exitWith(compose(project, ["up", ...options.build ? ["--build"] : []]));
@@ -2621,23 +4257,34 @@ async function shell(options) {
 	return manage(["shell"], options);
 }
 /**
-* The project and the service that run the backups: the prod worker, on a
+* The project and how to run a backup command: in the prod worker, on a
 * server or the local run, or the `backup` service of projects from 0.1.
+* Without a running worker (tasks off, TASK_WORKERS=0) in a one-off worker
+* container, while the backend runs.
 */
 function backupProject(options) {
 	const project = activeProject(open(options));
 	if (!project.prod) fail(`Backups run in the prod profile: on the server, or locally after ${command("dstack run")}.`);
 	const running = runningServices(project);
 	const service = ["backup", project.services.worker].find((name) => running.includes(name));
-	if (!service) fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
-	return {
+	if (service) return {
+		project,
+		run: ["exec", service]
+	};
+	if (project.env.TASK_WORKERS === "0" && running.includes(project.services.backend)) return {
 		project,
-		service
+		run: [
+			"run",
+			"--rm",
+			"--no-deps",
+			project.services.worker
+		]
 	};
+	fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
 }
 /** `dstack backup`: back up the database and the media now, or list the backups. */
 async function backup(options) {
-	const { project, service } = backupProject(options);
+	const { project, run } = backupProject(options);
 	const args = [
 		"python",
 		"manage.py",
@@ -2646,9 +4293,9 @@ async function backup(options) {
 	if (options.list) args.push("--list");
 	else if (!options.media) args.push("--no-media");
 	exitWith(compose(project, [
-		"exec",
+		run[0],
 		"-T",
-		service,
+		...run.slice(1),
 		...args
 	]));
 }
@@ -2673,13 +4320,13 @@ function restoreArgs(name, options) {
 }
 /** `dstack restore <backup>`: restore a database dump, with --media its media too, or a media archive. */
 async function restore(name, options) {
-	const { project, service } = backupProject(options);
+	const { project, run } = backupProject(options);
 	const args = restoreArgs(name, options);
 	if (!options.yes && !tty()) fail("Pass --yes to restore without a terminal.");
 	exitWith(compose(project, [
-		"exec",
+		run[0],
 		...options.yes ? ["-T"] : [],
-		service,
+		...run.slice(1),
 		...args
 	]));
 }
@@ -2917,19 +4564,15 @@ async function config(options) {
 	intro("Configure");
 	const current = projectStack(project);
 	const next = { ...current };
-	for (const option of STACK_OPTIONS) {
-		const key = option.key;
-		if (options.fromCli(key)) next[key] = options[key];
-		else if (interactive && SWITCHABLE.includes(key)) next[key] = unwrap(await p.select({
-			message: option.message,
-			initialValue: current[key],
-			options: option.values.map((value) => ({
-				value: value.value,
-				label: value.label,
-				hint: value.generated ? value.hint : "coming soon",
-				disabled: !value.generated && value.value !== current[key]
-			}))
-		}));
+	for (const key of PROMPT_ORDER) if (options.fromCli(key)) next[key] = options[key];
+	else if (interactive && SWITCHABLE.includes(key)) next[key] = unwrap(await p.select({
+		message: stackOption(key).message,
+		initialValue: current[key],
+		options: choices(key, next)
+	}));
+	if (next.analytics === "umami" && current.analytics !== "umami") {
+		const compose = join(project.directory, "compose.yaml");
+		if (!existsSync(compose) || !/^ {2}umami:/m.test(readFileSync(compose, "utf8"))) fail("compose.yaml has no umami service. Add it as the analytics docs describe, then run this again.");
 	}
 	const envPath = join(project.directory, ".env");
 	let result;
@@ -2942,11 +4585,13 @@ async function config(options) {
 		p.outro("Nothing changed");
 		return;
 	}
-	writeFileSync(envPath, result.env, { mode: 384 });
+	const envText = readFileSync(envPath, "utf8");
+	if (result.env !== envText) writeFileSync(envPath, result.env, { mode: 384 });
 	const manifestPath = join(project.directory, "package.json");
 	if (existsSync(manifestPath)) writeFileSync(manifestPath, setManifestPreset(readFileSync(manifestPath, "utf8"), encodePreset(next)));
 	for (const change of result.changes) p.log.success(change);
-	p.outro(`Restart to apply it: ${command("dstack stop")}, then ${command("dstack dev")}`);
+	if (result.env === envText) p.outro(pc.green("Done"));
+	else p.outro(`Restart to apply it: ${command("dstack stop")}, then ${command("dstack dev")}`);
 }
 // src/program.ts
 /** Commands that print machine-readable output, so no update notice. */
@@ -3001,7 +4646,7 @@ function createProgram() {
 	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
 	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
 	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
-	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy or a server over SSH, and show the status");
+	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy, Bunny or a server over SSH, and show the status");
 	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when it would not include your local commits or changes").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
 	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com, or the server, such as deploy@example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
 	const seen = /* @__PURE__ */ new Set();
@@ -3023,6 +4668,7 @@ function createProgram() {
 	}));
 	for (const flag of stackFlags()) presetCommand.addOption(flag);
 	program.command("production").description("Write .env.production for a server").argument("[directory]", "The project directory", ".").option("--domain <domain>", "The domain of the site, such as example.com").option("--email-url <url>", "The SMTP server, such as smtp+tls://user:pass@host:587").option("--force", "Overwrite an existing .env.production").option("-y, --yes", "Don't ask; fail when --domain is missing").action(production);
+	program.command("settings").description("Ask for the missing production settings and credentials, and save them").addOption(dirOption()).option("--file <file>", "The file to change (default: .env.production, or .env on a server)").option("--set <NAME=value>", "Set a value without asking, such as --set ADMIN_EMAIL=you@example.com", (value, previous = []) => [...previous, value]).option("--all", "Ask for every setting, also the ones that are set").option("-y, --yes", "Don't ask; fail when a setting is still missing").action(settings);
 	program.command("doctor").description("Check a project and its services").argument("[directory]", "The project directory", ".").action(doctor);
 	program.command("secret").description("Print a random secret").argument("[bytes]", "The number of random bytes", positiveInteger, 32).action((bytes) => console.log(generateSecret(bytes)));
 	tab(program, { completionCommandName: "completion" });