@django-stack/cli 0.6.0 → 0.8.0

package/dist/bin.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { C as stackOption, D as checkTools, E as runDoctor, O as parseEnv, S as resolvePreset, T as generateSecret, _ as STACK_OPTIONS, a as lockBackend, b as encodePreset, c as scaffold, d as umamiEnv, f as validateProjectName, g as NAMED_PRESETS, h as DEFAULT_STACK, i as LOCAL_S3, k as setEnvValues, l as timeZones, m as CLI_VERSION, n as validateDomain, p as validateTimeZone, s as relativeDirectory, t as productionEnv$1, u as toProjectName, v as applies, w as generateProjectSecrets, x as pendingChoices, y as decodePreset } from "./production-DIj9yRcg.js";
+import { $ as isDockerDown, A as projectUrls, B as encodePreset, C as RUN_ENV, D as findProjectDirectory, E as composeOutput, F as NAMED_PRESETS, G as chooseFreePorts, H as resolvePreset, I as PROMPT_ORDER, J as portValues, K as describeMove, L as STACK_OPTIONS, M as readProject, N as runningServices, O as parseProfiles, P as DEFAULT_STACK, Q as dockerRunning, R as applies, S as RUN_DOMAIN, T as compose, U as stackOption, V as pendingChoices, W as DEV_PORTS, X as checkTools, Y as runDoctor, Z as dockerNotRunning, _ as validateTimeZone, a as LOCAL_S3, b as generateProjectSecrets, c as lockBackend, d as scaffold, et as parseEnv, f as timeZones, g as validateProjectName, h as usesValkey, j as readLocalRun, k as projectStack, m as umamiEnv, n as productionEnv$1, nt as setEnvValues, o as cacheEnv, p as toProjectName, q as envPorts, r as validateDomain, s as localS3, t as missingS3, tt as quoteEnvValue, u as relativeDirectory, v as CLI_VERSION, w as activeProject, x as generateSecret, y as PACKAGE_NAME } from "./production-CGkI7oNe.js";
 import { createRequire } from "node:module";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { basename, delimiter, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, relative, resolve } from "node:path";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import pc from "picocolors";
 import tab from "@bomb.sh/tab/commander";
 import * as p from "@clack/prompts";
@@ -136,7 +137,7 @@ function probeFor(definition, ports) {
 }
 /** Plans the Bunny app for a resolved Compose project. */
 function planApp(project, options) {
-	const entries = Object.entries(project.services).sort(([a], [b]) => a.localeCompare(b));
+	const entries = Object.entries(project.services).filter(([, definition]) => definition.deploy?.replicas !== 0).sort(([a], [b]) => a.localeCompare(b));
 	if (!entries.length) throw new Error("compose.yaml has no services for production.");
 	const names = /* @__PURE__ */ new Map();
 	for (const [service, definition] of entries) names.set(service, hostNames(service, definition));
@@ -1126,6 +1127,7 @@ var BunnyClient = class {
 	async docker(args, options = {}) {
 		const result = await this.run("docker", args, options);
 		if (result.code === 0) return result.stdout;
+		if (isDockerDown(`${result.stderr}\n${result.stdout}`)) throw new Error(dockerNotRunning());
 		const last = (result.stderr.trim() || result.stdout.trim()).split("\n").at(-1) ?? "";
 		throw new Error(`docker ${args[0]} failed (exit ${result.code})${last ? `: ${last}` : "."}`);
 	}
@@ -2494,205 +2496,6 @@ function getProvider(id) {
 	if (!provider) throw new Error(`Unknown deploy provider ${id}. Choose one of: ${PROVIDERS.map((p) => p.id).join(", ")}.`);
 	return provider;
 }
-// src/project.ts
-/** The `.env` of `dstack run` on a development machine: the prod profile at https://site.localhost. */
-const RUN_ENV = ".env.run";
-const RUN_DOMAIN = "site.localhost";
-/** The project directory: `start` or the nearest parent with `compose.yaml` and `.env`. */
-function findProjectDirectory(start) {
-	let directory = resolve(start);
-	for (;;) {
-		if (existsSync(join(directory, "compose.yaml")) && existsSync(join(directory, ".env"))) return directory;
-		const parent = dirname(directory);
-		if (parent === directory) return void 0;
-		directory = parent;
-	}
-}
-function parseProfiles(value) {
-	return (value ?? "").split(",").map((profile) => profile.trim()).filter(Boolean);
-}
-function projectName(directory) {
-	try {
-		const match = readFileSync(join(directory, "compose.yaml"), "utf8").match(/^name:\s*["']?([\w.-]+)/m);
-		if (match?.[1]) return match[1];
-	} catch {}
-	return basename(directory).toLowerCase();
-}
-function fromEnv(directory, name, envFile, localRun) {
-	const env = parseEnv(readFileSync(join(directory, envFile), "utf8"));
-	const profiles = parseProfiles(env.COMPOSE_PROFILES);
-	const prod = profiles.includes("prod");
-	const suffix = prod ? "-prod" : "";
-	return {
-		directory,
-		name: localRun ? `${name}-run` : name,
-		env,
-		profiles,
-		prod,
-		localRun,
-		services: {
-			backend: `backend${suffix}`,
-			frontend: `frontend${suffix}`,
-			worker: `worker${suffix}`
-		},
-		composeArgs: localRun ? [
-			"--env-file",
-			envFile,
-			"--project-name",
-			`${name}-run`
-		] : [],
-		composeEnv: localRun ? {
-			ENV_FILE: envFile,
-			COMPOSE_PROFILES: env.COMPOSE_PROFILES ?? ""
-		} : {}
-	};
-}
-/** Reads the project in or above `start`. Throws with a one-line reason when there is none. */
-function readProject(start = ".") {
-	const directory = findProjectDirectory(start);
-	if (!directory) throw new Error(`No DjangoStack project in ${resolve(start)}: run this where compose.yaml and .env are.`);
-	return fromEnv(directory, projectName(directory), ".env", false);
-}
-/** The local production run of a development project, when `.env.run` exists. */
-function readLocalRun(project) {
-	if (project.prod || project.localRun || !existsSync(join(project.directory, ".env.run"))) return void 0;
-	return fromEnv(project.directory, projectName(project.directory), RUN_ENV, true);
-}
-/** The `django-stack` section of the project's `package.json`. */
-function projectManifest(project) {
-	try {
-		return JSON.parse(readFileSync(join(project.directory, "package.json"), "utf8"))["django-stack"] ?? {};
-	} catch {
-		return {};
-	}
-}
-/**
-* The project's stack: from the preset `init` saved in `package.json`, or,
-* for projects from before that, the defaults with the storage from `.env`.
-* Analytics follow the `analytics` profile: projects from before Umami was
-* generated have the default in their preset without running it.
-*/
-function projectStack(project) {
-	const analytics = project.profiles.includes("analytics") ? "umami" : "off";
-	const { preset } = projectManifest(project);
-	if (preset) try {
-		return {
-			...decodePreset(preset),
-			analytics
-		};
-	} catch {}
-	return {
-		...DEFAULT_STACK,
-		analytics,
-		storage: project.profiles.includes("s3") ? "s3" : "local"
-	};
-}
-/** The URLs of a running project. */
-function projectUrls(project) {
-	if (project.prod) {
-		const site = (project.env.SITE_URL ?? "").replace(/\/$/, "");
-		return [{
-			label: "Site",
-			url: `${site}/`
-		}, {
-			label: "Admin",
-			url: `${site}/admin/`
-		}];
-	}
-	const urls = [
-		{
-			label: "Site",
-			url: "http://localhost:3000"
-		},
-		{
-			label: "Admin",
-			url: "http://localhost:3000/admin/"
-		},
-		{
-			label: "Mail",
-			url: "http://localhost:8025"
-		}
-	];
-	if (project.profiles.includes("s3")) urls.push({
-		label: "S3",
-		url: "http://localhost:8333"
-	});
-	return urls;
-}
-/** Runs a command with the terminal attached and returns its exit status. */
-const runInherit = (cmd, args, options) => {
-	const result = spawnSync(cmd, args, {
-		stdio: "inherit",
-		...options
-	});
-	if (result.error) return 127;
-	return result.status ?? 1;
-};
-/** The full `docker compose` argument list for a project. */
-function composeCommand(project, args) {
-	return [
-		"compose",
-		...project.composeArgs,
-		...args
-	];
-}
-function composeOptions(project) {
-	return {
-		cwd: project.directory,
-		env: {
-			...process.env,
-			...project.composeEnv
-		}
-	};
-}
-/** Runs `docker compose <args>` for the project with the terminal attached. */
-function compose(project, args, run = runInherit) {
-	return run("docker", composeCommand(project, args), composeOptions(project));
-}
-/** Runs `docker compose <args>` and captures the output. */
-function composeOutput(project, args) {
-	const result = spawnSync("docker", composeCommand(project, args), {
-		...composeOptions(project),
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	return {
-		status: result.status ?? 1,
-		output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
-	};
-}
-/** The running services of the project. */
-function runningServices(project) {
-	const result = spawnSync("docker", composeCommand(project, [
-		"ps",
-		"--services",
-		"--filter",
-		"status=running"
-	]), {
-		...composeOptions(project),
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"ignore"
-		]
-	});
-	return result.status === 0 ? result.stdout.split("\n").filter(Boolean) : [];
-}
-/**
-* The project a command acts on: the local production run when it is the
-* one running, otherwise the project `.env` describes.
-*/
-function activeProject(project) {
-	const localRun = readLocalRun(project);
-	if (!localRun) return project;
-	if (runningServices(project).length) return project;
-	return runningServices(localRun).length ? localRun : project;
-}
 // src/ui.ts
 /** The DjangoStack badge with the version and an optional title. */
 function intro(title) {
@@ -3171,90 +2974,6 @@ async function doctor(directoryArgument) {
 	}
 	p.outro(pc.green("All checks passed"));
 }
-// src/update-check.ts
-const PACKAGE_NAME = "@django-stack/cli";
-const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
-const DAY = 864e5;
-/** `$XDG_CACHE_HOME/django-stack/update-check.json`, or under `~/.cache`. */
-function defaultCachePath(env = process.env) {
-	const base = env.XDG_CACHE_HOME || process.platform === "win32" && env.LOCALAPPDATA || join(homedir(), ".cache");
-	return join(base, "django-stack", "update-check.json");
-}
-/** Whether to check at all: never in CI, without a terminal, or when turned off. */
-function updateCheckEnabled(env = process.env, isTTY = Boolean(process.stdout.isTTY)) {
-	if (!isTTY) return false;
-	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
-	for (const key of ["DJANGO_STACK_NO_UPDATE_CHECK", "NO_UPDATE_NOTIFIER"]) if (env[key] && env[key] !== "0") return false;
-	return true;
-}
-function parse(version) {
-	const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(version.trim());
-	if (!match) return void 0;
-	return [
-		Number(match[1]),
-		Number(match[2]),
-		Number(match[3]),
-		match[4] ?? ""
-	];
-}
-/** Whether `latest` is a newer version than `current`. Prereleases of `latest` never count. */
-function isNewer(latest, current) {
-	const a = parse(latest);
-	const b = parse(current);
-	if (!a || !b || a[3]) return false;
-	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
-	return b[3] !== "";
-}
-function readCache(path) {
-	try {
-		const data = JSON.parse(readFileSync(path, "utf8"));
-		if (typeof data.checkedAt === "number" && typeof data.latest === "string") return data;
-	} catch {}
-}
-function writeCache(path, cache) {
-	try {
-		mkdirSync(dirname(path), { recursive: true });
-		writeFileSync(path, JSON.stringify(cache));
-	} catch {}
-}
-/**
-* The latest version on npm when it is newer than `current`, otherwise
-* undefined. Uses a cached result for a day; never throws.
-*/
-async function checkForUpdate(options) {
-	const cachePath = options.cachePath ?? defaultCachePath();
-	const now = options.now ?? Date.now;
-	const maxAge = options.maxAge ?? DAY;
-	let latest = readCache(cachePath);
-	if (!latest || now() - latest.checkedAt > maxAge || latest.checkedAt > now()) try {
-		const response = await (options.fetch ?? fetch)(REGISTRY_URL, {
-			headers: { accept: "application/json" },
-			signal: AbortSignal.timeout(options.timeout ?? 1500)
-		});
-		if (!response.ok) return void 0;
-		const { version } = await response.json();
-		if (typeof version !== "string") return void 0;
-		latest = {
-			checkedAt: now(),
-			latest: version
-		};
-		writeCache(cachePath, latest);
-	} catch {
-		return;
-	}
-	return isNewer(latest.latest, options.current) ? latest.latest : void 0;
-}
-/** The command that runs or installs the latest version, depending on how this one was started. */
-function updateCommand(location = import.meta.url, env = process.env) {
-	const path = decodeURIComponent(location).replaceAll("\\", "/");
-	if (path.includes("/_npx/")) return `npx ${PACKAGE_NAME}@latest`;
-	if (path.includes("/dlx/") || path.includes("/dlx-")) return `pnpm dlx ${PACKAGE_NAME}@latest`;
-	if (path.includes("/bunx-")) return `bunx ${PACKAGE_NAME}@latest`;
-	if (path.includes("/pnpm/global/")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
-	if (path.includes("/.bun/install/global/")) return `bun add -g ${PACKAGE_NAME}@latest`;
-	if (env.npm_config_user_agent?.startsWith("pnpm")) return `pnpm add -g ${PACKAGE_NAME}@latest`;
-	return `npm i -g ${PACKAGE_NAME}@latest`;
-}
 // src/global-install.ts
 /** The name of the installed command. */
 const BIN = "dstack";
@@ -3273,6 +2992,37 @@ function temporaryRunner(location = import.meta.url) {
 	if (path.includes("/dlx/") || path.includes("/dlx-")) return "pnpm";
 	if (path.includes("/bunx-")) return "bun";
 }
+/** How this copy runs, and with which package manager, from where its files are. */
+function installation(location = import.meta.url, env = process.env) {
+	const temporary = temporaryRunner(location);
+	if (temporary) return {
+		kind: "temporary",
+		runner: temporary
+	};
+	const path = normalize(location);
+	if (!path.includes("/node_modules/")) return { kind: "checkout" };
+	const lower = path.toLowerCase();
+	if (lower.includes("/pnpm/global/")) return {
+		kind: "installed",
+		runner: "pnpm"
+	};
+	if (lower.includes("/.bun/install/global/")) return {
+		kind: "installed",
+		runner: "bun"
+	};
+	if (lower.includes("/yarn/global/") || lower.includes("/yarn/data/global/")) return {
+		kind: "installed",
+		runner: "yarn"
+	};
+	if (env.npm_config_user_agent?.startsWith("pnpm")) return {
+		kind: "installed",
+		runner: "pnpm"
+	};
+	return {
+		kind: "installed",
+		runner: "npm"
+	};
+}
 /** Whether `dstack` is on the `PATH`, leaving out the temporary directories npx and friends add. */
 function isOnPath(env = process.env, platform = process.platform) {
 	const names = platform === "win32" ? [
@@ -3297,6 +3047,12 @@ function installCommand(runner = "npm") {
 		"--global",
 		`${PACKAGE_NAME}@latest`
 	];
+	if (runner === "yarn") return [
+		"yarn",
+		"global",
+		"add",
+		`${PACKAGE_NAME}@latest`
+	];
 	return [
 		"npm",
 		"i",
@@ -3351,7 +3107,7 @@ function explainFailure(runner, output) {
 	const last = output.trim().split("\n").pop()?.trim();
 	return `${last ? `${last} ` : ""}Run ${manual} to try again.`;
 }
-function run$1(args) {
+function runInstall(args) {
 	return new Promise((resolve) => {
 		const [cmd, ...rest] = args;
 		let output = "";
@@ -3409,7 +3165,7 @@ async function offerGlobalInstall() {
 	}
 	const spinner = p.spinner();
 	spinner.start(`Installing with ${command(args.join(" "))}`);
-	const result = await run$1(args);
+	const result = await runInstall(args);
 	if (!result.ok) {
 		saveInstallAnswer("failed");
 		spinner.error(`Couldn't install ${BIN}`);
@@ -3422,14 +3178,23 @@ async function offerGlobalInstall() {
 	return true;
 }
 // src/commands/init.ts
-/** The prompt choices of an option; values this version does not generate yet are shown but disabled. */
-function choices(key) {
-	return stackOption(key).values.map((value, index) => ({
-		value: value.value,
-		label: value.label,
-		hint: value.generated || index === 0 ? value.hint : "coming soon",
-		disabled: !value.generated && index > 0
-	}));
+/**
+* The prompt choices of an option; values this version does not generate yet
+* are shown but disabled. The tasks follow the cache chosen before them: Huey
+* keeps its queue in the database, or in Valkey with the Valkey cache.
+*/
+function choices(key, stack = {}) {
+	return stackOption(key).values.flatMap((value, index) => {
+		let hint = value.generated || index === 0 ? value.hint : "coming soon";
+		if (key === "tasks" && value.value === "huey") hint = stack.cache === "valkey" ? "a worker container, the queue in Valkey" : "a worker container, the queue in Postgres";
+		if (key === "tasks" && value.value === "huey-valkey" && stack.cache === "valkey") return [];
+		return [{
+			value: value.value,
+			label: value.label,
+			hint,
+			disabled: !value.generated && index > 0
+		}];
+	});
 }
 /**
 * The stack from, in order of precedence, the flags, the preset, the prompts
@@ -3445,8 +3210,8 @@ async function chooseStack(options, interactive, askDatabase) {
 	}
 	const stack = { ...DEFAULT_STACK };
 	let databaseUrl;
-	for (const option of STACK_OPTIONS) {
-		const key = option.key;
+	for (const key of PROMPT_ORDER) {
+		const option = stackOption(key);
 		if (options.fromCli(key)) stack[key] = options[key];
 		else if (key === "storage" && options.fromCli("localS3") && options.localS3) stack[key] = "s3";
 		else if (preset) stack[key] = preset[key];
@@ -3456,11 +3221,14 @@ async function chooseStack(options, interactive, askDatabase) {
 			if ("databaseUrl" in answer) databaseUrl = answer.databaseUrl;
 			else stack[key] = answer.postgres;
 		} else if (key === "postgres" && options.databaseUrl) continue;
-		else stack[key] = unwrap(await p.select({
-			message: option.message,
-			options: choices(key),
-			initialValue: stack[key]
-		}));
+		else {
+			const initialValue = key === "storage" && stack.media === "s3" ? "s3" : stack[key];
+			stack[key] = unwrap(await p.select({
+				message: option.message,
+				options: choices(key, stack),
+				initialValue
+			}));
+		}
 	}
 	return {
 		stack,
@@ -3555,6 +3323,8 @@ async function init(directoryArgument, options) {
 		message: "Add demo content? (example pages and posts)",
 		initialValue: true
 	}));
+	const ports = await chooseFreePorts({}, stack.storage === "s3" ? ["s3"] : []);
+	for (const move of ports.moves) p.log.info(describeMove(move));
 	const spinner = p.spinner();
 	spinner.start("Creating the project");
 	let result;
@@ -3567,8 +3337,11 @@ async function init(directoryArgument, options) {
 			databaseUrl,
 			localS3: stack.storage === "s3",
 			analytics: stack.analytics === "umami",
+			cache: stack.cache,
+			tasks: stack.tasks,
 			preset: encodePreset(stack),
 			timeZone,
+			ports: ports.ports,
 			link: options.link
 		});
 	} catch (error) {
@@ -3603,22 +3376,24 @@ async function init(directoryArgument, options) {
 	} catch {
 		p.log.warn("Could not commit the project with git. Commit it yourself.");
 	}
+	if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
+	const startCommand = isOnPath() ? "dstack dev" : "docker compose up";
 	p.note([
 		command(`cd ${relativeDirectory(target)}`),
-		command("docker compose up"),
+		command(startCommand),
 		"",
-		`${pc.bold("Site")}    ${url("http://localhost:3000")}`,
-		`${pc.bold("Admin")}   ${url("http://localhost:3000/admin/")}`,
-		`${pc.bold("Mail")}    ${url("http://localhost:8025")}`,
+		`${pc.bold("Site")}    ${url(`http://localhost:${ports.ports.SITE_PORT}`)}`,
+		`${pc.bold("Admin")}   ${url(`http://localhost:${ports.ports.SITE_PORT}/admin/`)}`,
+		`${pc.bold("Mail")}    ${url(`http://localhost:${ports.ports.MAIL_PORT}`)}`,
 		"",
 		`Admin user ${secret(result.adminUsername)}, password ${secret(result.adminPassword)}`,
 		pc.dim("The password is in .env as ADMIN_PASSWORD. Change it after you sign in.")
 	].join("\n"), "Next steps");
 	if (pending.length) p.log.info(`Coming in a later version, so not in this project yet: ${pending.map((item) => `${stackOption(item.key).message.toLowerCase()} (${stack[item.key]})`).join(", ")}.`);
+	if (stack.media === "s3") p.log.info(`Uploads go to S3 in production. Before the first deploy, ${command("dstack production")} asks for the S3 settings; ${command("dstack settings")} changes them later.`);
 	p.log.message(`Create the same stack with ${command(`--preset ${encodePreset(stack)}`)}`);
-	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command("docker compose up")}.`));
+	if (options.start && !dockerReady) p.outro(pc.yellow(`Docker is not ready, so the project was not started. Fix the warnings above and run ${command(startCommand)}.`));
 	else if (options.start) {
-		if (options.installPrompt !== false && !options.yes) await offerGlobalInstall();
 		p.outro(`Starting the project with ${command("docker compose up")}`);
 		execFileSync("docker", ["compose", "up"], {
 			cwd: target,
@@ -3637,8 +3412,9 @@ async function preset(code, options) {
 		} catch (error) {
 			fail(error.message);
 		}
-		const lines = STACK_OPTIONS.filter((option) => applies(option.key, stack)).map((option) => {
-			const value = option.values.find((candidate) => candidate.value === stack[option.key]);
+		const lines = PROMPT_ORDER.filter((key) => applies(key, stack)).map((key) => {
+			const option = stackOption(key);
+			const value = option.values.find((candidate) => candidate.value === stack[key]);
 			return `${pc.bold(option.message.padEnd(24))}${value?.label ?? ""}`;
 		});
 		p.note(lines.join("\n"), command(`--preset ${encodePreset(stack)}`));
@@ -3649,6 +3425,295 @@ async function preset(code, options) {
 	const encoded = encodePreset(stack);
 	p.outro(`Create this stack with ${command(`${selfCommand()} init --preset ${encoded}`)}`);
 }
+// src/settings.ts
+function validateEmail(value) {
+	return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) ? void 0 : "Enter an email address, such as you@example.com.";
+}
+function validateHost(value) {
+	return /^[a-z0-9.-]+$/i.test(value) && value.includes(".") ? void 0 : "Enter a host name, such as smtp.example.com.";
+}
+function validatePort(value) {
+	const port = Number(value);
+	return Number.isInteger(port) && port > 0 && port < 65536 ? void 0 : "Enter a port, such as 587.";
+}
+function validateUrl(value) {
+	if (!value) return void 0;
+	return /^https?:\/\/[^\s/]+/.test(value) ? void 0 : "Enter a URL that starts with https://.";
+}
+const required = (label) => (value) => value.trim() ? void 0 : `Enter the ${label}.`;
+/**
+* An SMTP URL for EMAIL_URL: smtps:// on port 465, smtp:// on 25, otherwise
+* smtp+tls:// (STARTTLS), with the user name and password URL-encoded.
+*/
+function smtpUrl(parts) {
+	const port = Number(parts.port || "587");
+	const scheme = port === 465 ? "smtps" : port === 25 ? "smtp" : "smtp+tls";
+	const user = parts.username ? encodeURIComponent(parts.username) : "";
+	const password = parts.password ? `:${encodeURIComponent(parts.password)}` : "";
+	return `${scheme}://${user ? `${user}${password}@` : ""}${parts.host}:${port}`;
+}
+/** The parts of an SMTP URL, for the current answers. */
+function smtpParts(value) {
+	try {
+		const url = new URL(value ?? "");
+		return {
+			host: url.hostname,
+			port: url.port,
+			username: decodeURIComponent(url.username),
+			password: decodeURIComponent(url.password)
+		};
+	} catch {
+		return {};
+	}
+}
+const placeholderMail = (value) => !value || value.includes("mailpit") || value.includes("example.com") || value.startsWith("console:");
+const SETTING_GROUPS = [
+	{
+		title: "Admin email",
+		names: ["ADMIN_EMAIL"],
+		applies: () => true,
+		missing: (env) => !env.ADMIN_EMAIL || env.ADMIN_EMAIL.endsWith("@example.com") ? ["ADMIN_EMAIL"] : [],
+		fields: [{
+			name: "ADMIN_EMAIL",
+			message: "Your email address, for the admin user",
+			placeholder: "you@example.com",
+			validate: validateEmail
+		}],
+		values: (answers) => ({ ADMIN_EMAIL: answers.ADMIN_EMAIL ?? "" })
+	},
+	{
+		title: "Outgoing mail",
+		names: ["EMAIL_URL"],
+		applies: () => true,
+		missing: (env) => placeholderMail(env.EMAIL_URL) ? ["EMAIL_URL"] : [],
+		fields: [
+			{
+				name: "host",
+				message: "SMTP server",
+				placeholder: "smtp.example.com",
+				validate: validateHost
+			},
+			{
+				name: "port",
+				message: "SMTP port",
+				defaultValue: "587",
+				validate: validatePort
+			},
+			{
+				name: "username",
+				message: "SMTP user name",
+				optional: true
+			},
+			{
+				name: "password",
+				message: "SMTP password",
+				secret: true,
+				optional: true
+			}
+		],
+		current: (env, field) => placeholderMail(env.EMAIL_URL) ? void 0 : smtpParts(env.EMAIL_URL)[field],
+		values: (answers) => ({ EMAIL_URL: smtpUrl({
+			host: answers.host ?? "",
+			port: answers.port ?? "587",
+			username: answers.username,
+			password: answers.password
+		}) })
+	},
+	{
+		title: "S3 for uploads",
+		names: [
+			"S3_BUCKET",
+			"S3_ENDPOINT_URL",
+			"S3_REGION",
+			"S3_ACCESS_KEY_ID",
+			"S3_SECRET_ACCESS_KEY",
+			"S3_PUBLIC_URL"
+		],
+		applies: (env, context) => context.media === "s3" || Boolean(env.S3_BUCKET),
+		missing: missingS3,
+		fields: [
+			{
+				name: "S3_BUCKET",
+				message: "S3 bucket",
+				placeholder: "example-media",
+				validate: required("bucket")
+			},
+			{
+				name: "S3_ENDPOINT_URL",
+				message: "S3 endpoint, empty for AWS",
+				placeholder: "https://fsn1.your-objectstorage.com",
+				optional: true,
+				validate: validateUrl
+			},
+			{
+				name: "S3_REGION",
+				message: "S3 region",
+				placeholder: "eu-central-1",
+				validate: required("region")
+			},
+			{
+				name: "S3_ACCESS_KEY_ID",
+				message: "S3 access key ID",
+				validate: required("access key ID")
+			},
+			{
+				name: "S3_SECRET_ACCESS_KEY",
+				message: "S3 secret access key",
+				secret: true,
+				validate: required("secret access key")
+			},
+			{
+				name: "S3_PUBLIC_URL",
+				message: "Public URL of the files, empty when it is the endpoint",
+				placeholder: "https://media.example.com",
+				optional: true,
+				validate: validateUrl
+			}
+		],
+		current: (env, field) => env[field],
+		values: (answers) => Object.fromEntries([
+			"S3_BUCKET",
+			"S3_ENDPOINT_URL",
+			"S3_REGION",
+			"S3_ACCESS_KEY_ID",
+			"S3_SECRET_ACCESS_KEY",
+			"S3_PUBLIC_URL"
+		].map((name) => [name, answers[name] ?? ""]))
+	}
+];
+/** The groups of a production `.env` to ask for: the missing ones, or with `all` every one that applies. */
+function settingsToAsk(env, context, all = false) {
+	return SETTING_GROUPS.filter((group) => group.applies(env, context) && (all || group.missing(env).length));
+}
+/** Every `.env` variable `--set` takes. */
+const SETTING_NAMES = SETTING_GROUPS.flatMap((group) => group.names);
+/** Parses `--set NAME=value` arguments. Throws with a one-line reason. */
+function parseAssignments(items) {
+	const values = {};
+	for (const item of items) {
+		const index = item.indexOf("=");
+		const name = index > 0 ? item.slice(0, index) : "";
+		if (!SETTING_NAMES.includes(name)) throw new Error(`${JSON.stringify(item)} is not NAME=value for one of ${SETTING_NAMES.join(", ")}.`);
+		const value = item.slice(index + 1);
+		if (/[\r\n]/.test(value)) throw new Error(`The value of ${name} has a line break.`);
+		if (name === "ADMIN_EMAIL" && validateEmail(value)) throw new Error(`ADMIN_EMAIL: ${validateEmail(value)}`);
+		values[name] = value;
+	}
+	return values;
+}
+/** The items of `production`'s to-do list that the settings now in `env` have done. */
+function remainingTodo(todo, env) {
+	return todo.filter((item) => {
+		const group = SETTING_GROUPS.find((candidate) => candidate.names.some((name) => item.includes(name.startsWith("S3_") ? "S3_" : name)));
+		return !group || group.missing(env).length > 0;
+	});
+}
+// src/commands/settings.ts
+/** The `media` stack option of the project, from the preset in package.json. */
+function projectContext(directory) {
+	try {
+		return { media: projectStack(readProject(directory)).media };
+	} catch {
+		return {};
+	}
+}
+/** Asks for each field of the groups; returns the `.env` values. */
+async function askSettings(groups, env) {
+	const values = {};
+	for (const group of groups) {
+		p.log.step(pc.bold(group.title));
+		const answers = {};
+		for (const field of group.fields) {
+			const current = group.current?.(env, field.name);
+			const check = (value) => {
+				const text = (value ?? "").trim();
+				if (!text && (field.optional || field.defaultValue || field.secret && current)) return void 0;
+				return field.validate?.(text) ?? (text ? void 0 : `Enter the ${field.message.toLowerCase()}.`);
+			};
+			let answer;
+			if (field.secret) {
+				answer = unwrap(await p.password({
+					message: current ? `${field.message} (empty keeps the current one)` : field.message,
+					validate: check
+				}));
+				if (!answer && current) answer = current;
+			} else answer = unwrap(await p.text({
+				message: field.message,
+				placeholder: field.placeholder ?? field.defaultValue,
+				initialValue: current,
+				defaultValue: field.defaultValue,
+				validate: check
+			}));
+			answers[field.name] = (answer ?? field.defaultValue ?? "").trim();
+		}
+		Object.assign(values, group.values(answers));
+	}
+	return values;
+}
+/** Writes values to a `.env` file, quoted where Compose needs it. Throws for a value it can't write. */
+function writeSettings(path, values) {
+	const quoted = Object.fromEntries(Object.entries(values).map(([name, value]) => [name, quoteEnvValue(value)]));
+	writeFileSync(path, setEnvValues(readFileSync(path, "utf8"), quoted), { mode: 384 });
+}
+/** The production `.env` of a project: `--file`, `.env.production`, or `.env` on a server. */
+function targetFile(directory, file) {
+	if (file) {
+		const path = join(directory, file);
+		if (!existsSync(path)) fail(`${path} does not exist.`);
+		return path;
+	}
+	const production = join(directory, ".env.production");
+	if (existsSync(production)) return production;
+	const env = join(directory, ".env");
+	if (existsSync(env) && parseProfiles(parseEnv(readFileSync(env, "utf8")).COMPOSE_PROFILES).includes("prod")) return env;
+	fail(`There is no .env.production yet. Write it with ${command("dstack production")}.`);
+}
+/** `dstack settings`: ask for the missing production settings and credentials, and save them. */
+async function settings(options) {
+	const interactive = isInteractive(options.yes);
+	intro("Production settings");
+	const directory = findProjectDirectory(options.dir ?? ".");
+	if (!directory) fail("No DjangoStack project here: run this where compose.yaml and .env are.");
+	const target = targetFile(directory, options.file);
+	const name = relative(directory, target);
+	let assigned;
+	try {
+		assigned = parseAssignments(options.set ?? []);
+	} catch (error) {
+		fail(error.message);
+	}
+	const env = {
+		...parseEnv(readFileSync(target, "utf8")),
+		...assigned
+	};
+	const context = projectContext(directory);
+	const missing = settingsToAsk(env, context);
+	let values = assigned;
+	if (interactive) {
+		const groups = settingsToAsk(env, context, options.all);
+		if (!groups.length && !Object.keys(assigned).length) {
+			p.outro(pc.green(`Nothing is missing in ${name}`));
+			return;
+		}
+		if (groups.length && !options.all) p.log.info(`${name} needs ${groups.map((group) => group.title.toLowerCase()).join(", ")}.`);
+		values = {
+			...assigned,
+			...await askSettings(groups, env)
+		};
+	} else if (missing.length) fail(`${name} misses ${missing.flatMap((group) => group.missing(env)).join(", ")}. Pass them with --set NAME=value.`);
+	else if (!Object.keys(assigned).length) {
+		p.outro(pc.green(`Nothing is missing in ${name}`));
+		return;
+	}
+	try {
+		writeSettings(target, values);
+	} catch (error) {
+		fail(error.message);
+	}
+	p.log.success(`Saved ${Object.keys(values).join(", ")} in ${pc.bold(name)}`);
+	if (existsSync(join(directory, ".dstack", "deploy.json")) && target.endsWith(".env.production")) p.outro(`Send them to the platform with ${command("dstack deploy env push")}`);
+	else p.outro(pc.green("Done"));
+}
 // src/commands/production.ts
 async function production(directoryArgument, options) {
 	const interactive = isInteractive(options.yes);
@@ -3667,18 +3732,36 @@ async function production(directoryArgument, options) {
 			validate: (v) => validateDomain(v ?? "")
 		}));
 	}
+	const context = projectContext(directory);
 	let result;
 	try {
 		result = productionEnv$1(readFileSync(envPath, "utf8"), {
 			domain,
-			emailUrl: options.emailUrl
+			emailUrl: options.emailUrl,
+			media: context.media
 		});
 	} catch (error) {
 		fail(error.message);
 	}
 	writeFileSync(target, result.text, { mode: 384 });
 	p.log.success(`Wrote ${pc.bold(relativeDirectory(target))} with new secrets for the server.`);
-	if (result.todo.length) p.note(result.todo.map((item) => `${pc.yellow("•")} ${item}`).join("\n"), "Before the first deploy");
+	let todo = result.todo;
+	const missing = settingsToAsk(parseEnv(result.text), context);
+	if (interactive && missing.length) {
+		if (unwrap(await p.confirm({
+			message: `Set the ${missing.map((group) => group.title.toLowerCase()).join(", ")} now?`,
+			initialValue: true
+		}))) {
+			try {
+				writeSettings(target, await askSettings(missing, parseEnv(result.text)));
+			} catch (error) {
+				fail(error.message);
+			}
+			todo = remainingTodo(todo, parseEnv(readFileSync(target, "utf8")));
+		}
+	}
+	if (todo.some((item) => SETTING_NAMES.some((name) => item.includes(name.startsWith("S3_") ? "S3_" : name)))) todo = [...todo, `Run ${command("dstack settings")} to set them.`];
+	if (todo.length) p.note(todo.map((item) => `${pc.yellow("•")} ${item}`).join("\n"), "Before the first deploy");
 	p.note([
 		`Copy the project to the server, with ${pc.bold(".env.production")} as ${pc.bold(".env")}, then:`,
 		command("docker compose up -d --build"),
@@ -3690,7 +3773,13 @@ async function production(directoryArgument, options) {
 }
 // src/config.ts
 /** The options `config` can switch in an existing project. The rest follow with code generation. */
-const SWITCHABLE = ["storage", "analytics"];
+const SWITCHABLE = [
+	"storage",
+	"analytics",
+	"media",
+	"cache",
+	"tasks"
+];
 const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key === "S3_CREATE_BUCKET" ? "0" : ""]));
 /**
 * Applies a new stack to a project's `.env`. Throws with a one-line reason
@@ -3713,11 +3802,30 @@ function applyStack(envText, env, from, to) {
 			profiles = profiles.filter((profile) => profile !== "s3");
 			if (to.storage === "s3") profiles.push("s3");
 			text = setEnvValues(text, {
-				...to.storage === "s3" ? LOCAL_S3 : EMPTY_S3,
+				...to.storage === "s3" ? localS3(envPorts(env).S3_PORT) : EMPTY_S3,
 				COMPOSE_PROFILES: profiles.join(",")
 			});
 			changes.push(to.storage === "s3" ? "Uploads go to the local S3 service (the s3 profile)." : "Uploads go to a Docker volume; the local S3 service is off.");
 		}
+		if (key === "cache") {
+			text = setEnvValues(text, { CACHE_URL: cacheEnv(to).CACHE_URL ?? "" });
+			changes.push({
+				database: "The cache is a table in the database.",
+				valkey: "The cache is in Valkey (the valkey profile).",
+				off: "The cache is per process; nothing is shared."
+			}[to.cache]);
+		}
+		if (key === "tasks" || key === "cache" && from.tasks === "huey" && to.tasks === "huey") {
+			const { CACHE_URL: _, ...tasks } = cacheEnv(to);
+			const before = parseEnv(text).TASKS_URL;
+			text = setEnvValues(text, tasks);
+			if (before !== tasks.TASKS_URL) changes.push(to.tasks === "off" ? "Tasks run in the request; the worker is off, so there are no daily backups." : `The worker keeps its task queue in ${tasks.TASKS_URL === "db://" ? "the database" : "Valkey"}.`);
+		}
+		if (key === "cache" || key === "tasks") {
+			profiles = profiles.filter((profile) => profile !== "valkey");
+			if (usesValkey(parseEnv(text))) profiles.push("valkey");
+			text = setEnvValues(text, { COMPOSE_PROFILES: profiles.join(",") });
+		}
 		if (key === "analytics") {
 			profiles = profiles.filter((profile) => profile !== "analytics");
 			if (to.analytics === "umami") {
@@ -3737,6 +3845,7 @@ function applyStack(envText, env, from, to) {
 				changes.push("Page analytics are off; Umami's data stays in the database.");
 			}
 		}
+		if (key === "media") changes.push(to.media === "s3" ? "Uploads in production go to S3; dstack settings asks for the S3 settings." : "Uploads in production stay on the server.");
 	}
 	return {
 		env: text,
@@ -3755,6 +3864,7 @@ function setManifestPreset(manifestText, preset) {
 // src/commands/project.ts
 function open(options) {
 	if (!has("docker", ["compose", "version"])) fail("Docker Compose v2 was not found. Install Docker: https://docs.docker.com/get-docker/");
+	if (!dockerRunning()) fail(dockerNotRunning());
 	try {
 		return readProject(options.dir ?? ".");
 	} catch (error) {
@@ -3805,11 +3915,33 @@ async function run(options) {
 	if (project.localRun) p.log.message(pc.dim(`Caddy signs ${RUN_DOMAIN} with its own local CA, so the browser warns once. The admin password is in ${RUN_ENV}.`));
 	p.outro(`Stop it with ${command("dstack stop")}, follow the logs with ${command("dstack logs")}`);
 }
+/**
+* Moves the development services to free ports when theirs are in use, in
+* `.env`, unless the project already runs. compose.yaml from before the
+* *_PORT variables has fixed ports, so it can only say which one is in use.
+*/
+async function freeDevPorts(project) {
+	if (runningServices(project).length) return project;
+	const { ports, moves, stuck } = await chooseFreePorts(project.env, project.profiles);
+	const [blocked] = stuck;
+	if (blocked) fail(`Port ${envPorts(project.env)[blocked.name]} of the ${blocked.label} is in use. Stop what uses it.`);
+	if (!moves.length) return project;
+	const composeText = readFileSync(join(project.directory, "compose.yaml"), "utf8");
+	for (const move of moves) {
+		const item = DEV_PORTS.find((candidate) => candidate.label === move.label);
+		if (item && !composeText.includes(`\${${item.name}`)) fail(`Port ${move.from} of the ${move.label} is in use. Stop what uses it, or publish another port in compose.yaml.`);
+	}
+	const envPath = join(project.directory, ".env");
+	writeFileSync(envPath, setEnvValues(readFileSync(envPath, "utf8"), portValues(project.env, ports)), { mode: 384 });
+	for (const move of moves) p.log.info(`${describeMove(move)} Saved in .env.`);
+	return readProject(project.directory);
+}
 /** `dstack dev`: the dev profile in the foreground, with hot reload. */
 async function dev(options) {
-	const project = open(options);
+	let project = open(options);
 	if (project.prod) fail(`This .env runs the prod profile. Use ${command("dstack run")}.`);
 	intro("Develop");
+	project = await freeDevPorts(project);
 	urlsNote(project, "Starting");
 	p.log.message(pc.dim("Changes in backend/ and frontend/ reload. Press Ctrl+C to stop."));
 	exitWith(compose(project, ["up", ...options.build ? ["--build"] : []]));
@@ -3857,23 +3989,34 @@ async function shell(options) {
 	return manage(["shell"], options);
 }
 /**
-* The project and the service that run the backups: the prod worker, on a
+* The project and how to run a backup command: in the prod worker, on a
 * server or the local run, or the `backup` service of projects from 0.1.
+* Without a running worker (tasks off, TASK_WORKERS=0) in a one-off worker
+* container, while the backend runs.
 */
 function backupProject(options) {
 	const project = activeProject(open(options));
 	if (!project.prod) fail(`Backups run in the prod profile: on the server, or locally after ${command("dstack run")}.`);
 	const running = runningServices(project);
 	const service = ["backup", project.services.worker].find((name) => running.includes(name));
-	if (!service) fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
-	return {
+	if (service) return {
 		project,
-		service
+		run: ["exec", service]
 	};
+	if (project.env.TASK_WORKERS === "0" && running.includes(project.services.backend)) return {
+		project,
+		run: [
+			"run",
+			"--rm",
+			"--no-deps",
+			project.services.worker
+		]
+	};
+	fail(`The ${project.services.worker} service is not running. Start the project with ${command("dstack run")}.`);
 }
 /** `dstack backup`: back up the database and the media now, or list the backups. */
 async function backup(options) {
-	const { project, service } = backupProject(options);
+	const { project, run } = backupProject(options);
 	const args = [
 		"python",
 		"manage.py",
@@ -3882,9 +4025,9 @@ async function backup(options) {
 	if (options.list) args.push("--list");
 	else if (!options.media) args.push("--no-media");
 	exitWith(compose(project, [
-		"exec",
+		run[0],
 		"-T",
-		service,
+		...run.slice(1),
 		...args
 	]));
 }
@@ -3909,13 +4052,13 @@ function restoreArgs(name, options) {
 }
 /** `dstack restore <backup>`: restore a database dump, with --media its media too, or a media archive. */
 async function restore(name, options) {
-	const { project, service } = backupProject(options);
+	const { project, run } = backupProject(options);
 	const args = restoreArgs(name, options);
 	if (!options.yes && !tty()) fail("Pass --yes to restore without a terminal.");
 	exitWith(compose(project, [
-		"exec",
+		run[0],
 		...options.yes ? ["-T"] : [],
-		service,
+		...run.slice(1),
 		...args
 	]));
 }
@@ -4026,7 +4169,8 @@ function checkSteps(project, tests) {
 }
 /** `dstack check`: the doctor's checks, Django's checks, the linters and, with --tests, the tests. */
 async function check(options) {
-	const project = activeProject(open(options));
+	const base = open(options);
+	const project = activeProject(base);
 	intro("Check");
 	let failed = 0;
 	const spinner = p.spinner();
@@ -4107,11 +4251,12 @@ async function update(options) {
 	} else if (existsSync(lock)) p.log.warn("uv is not installed, so backend/uv.lock stays as it is: https://docs.astral.sh/uv/");
 	for (const target of targets) {
 		if (compose(target, ["pull", "--ignore-buildable"]) !== 0) fail("Pulling the images failed.");
-		if (compose(target, [
+		const build = [
 			"build",
 			"--pull",
 			...options.cache ? [] : ["--no-cache"]
-		]) !== 0) fail("Building the images failed.");
+		];
+		if (compose(target, build) !== 0) fail("Building the images failed.");
 	}
 	const volume = project.prod ? void 0 : nodeModulesVolume(project);
 	if (volume) {
@@ -4153,20 +4298,12 @@ async function config(options) {
 	intro("Configure");
 	const current = projectStack(project);
 	const next = { ...current };
-	for (const option of STACK_OPTIONS) {
-		const key = option.key;
-		if (options.fromCli(key)) next[key] = options[key];
-		else if (interactive && SWITCHABLE.includes(key)) next[key] = unwrap(await p.select({
-			message: option.message,
-			initialValue: current[key],
-			options: option.values.map((value) => ({
-				value: value.value,
-				label: value.label,
-				hint: value.generated ? value.hint : "coming soon",
-				disabled: !value.generated && value.value !== current[key]
-			}))
-		}));
-	}
+	for (const key of PROMPT_ORDER) if (options.fromCli(key)) next[key] = options[key];
+	else if (interactive && SWITCHABLE.includes(key)) next[key] = unwrap(await p.select({
+		message: stackOption(key).message,
+		initialValue: current[key],
+		options: choices(key, next)
+	}));
 	if (next.analytics === "umami" && current.analytics !== "umami") {
 		const compose = join(project.directory, "compose.yaml");
 		if (!existsSync(compose) || !/^ {2}umami:/m.test(readFileSync(compose, "utf8"))) fail("compose.yaml has no umami service. Add it as the analytics docs describe, then run this again.");
@@ -4182,18 +4319,192 @@ async function config(options) {
 		p.outro("Nothing changed");
 		return;
 	}
-	writeFileSync(envPath, result.env, { mode: 384 });
+	const envText = readFileSync(envPath, "utf8");
+	if (result.env !== envText) writeFileSync(envPath, result.env, { mode: 384 });
 	const manifestPath = join(project.directory, "package.json");
 	if (existsSync(manifestPath)) writeFileSync(manifestPath, setManifestPreset(readFileSync(manifestPath, "utf8"), encodePreset(next)));
 	for (const change of result.changes) p.log.success(change);
-	p.outro(`Restart to apply it: ${command("dstack stop")}, then ${command("dstack dev")}`);
+	if (result.env === envText) p.outro(pc.green("Done"));
+	else p.outro(`Restart to apply it: ${command("dstack stop")}, then ${command("dstack dev")}`);
+}
+// src/update-check.ts
+const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+const DAY = 864e5;
+/** `$XDG_CACHE_HOME/django-stack/update-check.json`, or under `~/.cache`. */
+function defaultCachePath(env = process.env) {
+	const base = env.XDG_CACHE_HOME || process.platform === "win32" && env.LOCALAPPDATA || join(homedir(), ".cache");
+	return join(base, "django-stack", "update-check.json");
+}
+/** Whether to check at all: never in CI, without a terminal, or when turned off. */
+function updateCheckEnabled(env = process.env, isTTY = Boolean(process.stdout.isTTY)) {
+	if (!isTTY) return false;
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
+	for (const key of ["DJANGO_STACK_NO_UPDATE_CHECK", "NO_UPDATE_NOTIFIER"]) if (env[key] && env[key] !== "0") return false;
+	return true;
+}
+function parse(version) {
+	const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(version.trim());
+	if (!match) return void 0;
+	return [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3]),
+		match[4] ?? ""
+	];
+}
+/** Whether `latest` is a newer version than `current`. Prereleases of `latest` never count. */
+function isNewer(latest, current) {
+	const a = parse(latest);
+	const b = parse(current);
+	if (!a || !b || a[3]) return false;
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+	return b[3] !== "";
+}
+function readCache(path) {
+	try {
+		const data = JSON.parse(readFileSync(path, "utf8"));
+		if (typeof data.checkedAt === "number" && typeof data.latest === "string") return data;
+	} catch {}
+}
+function writeCache(path, cache) {
+	try {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, JSON.stringify(cache));
+	} catch {}
+}
+/** The latest version on npm. Throws when the registry can't be reached. */
+async function fetchLatestVersion(options = {}) {
+	const response = await (options.fetch ?? fetch)(REGISTRY_URL, {
+		headers: { accept: "application/json" },
+		signal: AbortSignal.timeout(options.timeout ?? 1500)
+	});
+	if (!response.ok) throw new Error(`The npm registry answered ${response.status}.`);
+	const { version } = await response.json();
+	if (typeof version !== "string") throw new Error("The npm registry sent no version.");
+	return version;
+}
+/**
+* The latest version on npm when it is newer than `current`, otherwise
+* undefined. Uses a cached result for a day; never throws.
+*/
+async function checkForUpdate(options) {
+	const cachePath = options.cachePath ?? defaultCachePath();
+	const now = options.now ?? Date.now;
+	const maxAge = options.maxAge ?? DAY;
+	let latest = readCache(cachePath);
+	if (!latest || now() - latest.checkedAt > maxAge || latest.checkedAt > now()) try {
+		latest = {
+			checkedAt: now(),
+			latest: await fetchLatestVersion(options)
+		};
+		writeCache(cachePath, latest);
+	} catch {
+		return;
+	}
+	return isNewer(latest.latest, options.current) ? latest.latest : void 0;
+}
+/**
+* The command that gets the latest version: through the runner for npx,
+* pnpm dlx and bunx, otherwise `dstack self-update`.
+*/
+function updateCommand(location = import.meta.url, env = process.env) {
+	const install = installation(location, env);
+	if (install.kind === "temporary") {
+		if (install.runner === "pnpm") return `pnpm dlx ${PACKAGE_NAME}@latest`;
+		if (install.runner === "bun") return `bunx ${PACKAGE_NAME}@latest`;
+		return `npx ${PACKAGE_NAME}@latest`;
+	}
+	if (install.kind === "checkout") return "git pull";
+	return "dstack self-update";
+}
+// src/commands/self-update.ts
+/** The command each package manager runs a package with, without installing it. */
+const RUN_WITHOUT_INSTALL = {
+	npm: "npx",
+	pnpm: "pnpm dlx",
+	bun: "bunx",
+	yarn: "yarn dlx"
+};
+/**
+* The npm prefix this copy is installed in, such as `/usr/local` for
+* `/usr/local/lib/node_modules/@django-stack/cli`, so the update replaces this
+* copy even when another Node.js version's npm comes first on the `PATH`.
+*/
+function npmPrefix(location = import.meta.url) {
+	if (!location.startsWith("file:")) return void 0;
+	const path = fileURLToPath(location);
+	return /^(.+)\/lib\/node_modules\/@django-stack\/cli\//.exec(path)?.[1];
+}
+/** The version of the `dstack` on the `PATH`, or undefined when there is none. */
+function versionOnPath() {
+	try {
+		return execFileSync(BIN, ["--version"], {
+			encoding: "utf8",
+			shell: process.platform === "win32",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			env: {
+				...process.env,
+				DJANGO_STACK_NO_UPDATE_CHECK: "1"
+			}
+		}).trim();
+	} catch {
+		return;
+	}
+}
+/** Update the installed CLI to the latest version on npm, with the package manager that installed it. */
+async function selfUpdate() {
+	intro("Self-update");
+	const install = installation();
+	if (install.kind === "checkout") fail(`This ${BIN} runs from a DjangoStack checkout. Update it with git pull and pnpm build.`);
+	if (install.kind === "temporary") {
+		const runWith = RUN_WITHOUT_INSTALL[install.runner];
+		fail(`This ${BIN} runs through ${runWith} and is not installed. Run ${runWith} ${PACKAGE_NAME}@latest for the latest version, or install it with ${installCommand(install.runner).join(" ")}.`);
+	}
+	const { runner } = install;
+	const spinner = p.spinner();
+	spinner.start("Checking npm for the latest version");
+	let latest;
+	try {
+		latest = await fetchLatestVersion({ timeout: 1e4 });
+	} catch (error) {
+		spinner.error("Couldn't check npm");
+		fail(`Couldn't reach the npm registry: ${error.message}`);
+	}
+	if (!isNewer(latest, CLI_VERSION)) {
+		spinner.stop(`${BIN} ${CLI_VERSION} is the latest version`);
+		p.outro(pc.green("Nothing to update"));
+		return;
+	}
+	spinner.stop(`Version ${pc.green(pc.bold(latest))} is available`);
+	const prefix = runner === "npm" ? npmPrefix() : void 0;
+	const args = prefix ? [
+		...installCommand(runner),
+		"--prefix",
+		prefix
+	] : installCommand(runner);
+	if (!has(runner)) fail(`${runner} installed ${BIN} but is not on your PATH. Run ${args.join(" ")} yourself.`);
+	spinner.start(`Updating with ${command(args.join(" "))}`);
+	const result = await runInstall(args);
+	if (!result.ok) {
+		spinner.error(`Couldn't update ${BIN}`);
+		fail(explainFailure(runner, result.output));
+	}
+	spinner.stop(`Updated ${BIN} ${pc.dim(CLI_VERSION)} ${pc.dim("→")} ${pc.green(pc.bold(latest))}`);
+	const onPath = versionOnPath();
+	if (onPath && onPath !== latest) p.log.warn(`The ${command(BIN)} on your PATH is still ${onPath}: another install comes first. Remove it, or update it with its own package manager.`);
+	p.outro(pc.green("Done"));
 }
 // src/program.ts
-/** Commands that print machine-readable output, so no update notice. */
+/** Commands that print machine-readable output or update the CLI, so no update notice. */
 const QUIET_COMMANDS = /* @__PURE__ */ new Set([
 	"secret",
 	"complete",
-	"completion"
+	"completion",
+	"self-update"
 ]);
 /** A flag for each stack option, such as `--cache <cache>`. */
 function stackFlags() {
@@ -4263,7 +4574,9 @@ function createProgram() {
 	}));
 	for (const flag of stackFlags()) presetCommand.addOption(flag);
 	program.command("production").description("Write .env.production for a server").argument("[directory]", "The project directory", ".").option("--domain <domain>", "The domain of the site, such as example.com").option("--email-url <url>", "The SMTP server, such as smtp+tls://user:pass@host:587").option("--force", "Overwrite an existing .env.production").option("-y, --yes", "Don't ask; fail when --domain is missing").action(production);
+	program.command("settings").description("Ask for the missing production settings and credentials, and save them").addOption(dirOption()).option("--file <file>", "The file to change (default: .env.production, or .env on a server)").option("--set <NAME=value>", "Set a value without asking, such as --set ADMIN_EMAIL=you@example.com", (value, previous = []) => [...previous, value]).option("--all", "Ask for every setting, also the ones that are set").option("-y, --yes", "Don't ask; fail when a setting is still missing").action(settings);
 	program.command("doctor").description("Check a project and its services").argument("[directory]", "The project directory", ".").action(doctor);
+	program.command("self-update").description(`Update ${BIN} to the latest version on npm`).action(selfUpdate);
 	program.command("secret").description("Print a random secret").argument("[bytes]", "The number of random bytes", positiveInteger, 32).action((bytes) => console.log(generateSecret(bytes)));
 	tab(program, { completionCommandName: "completion" });
 	program.commands.find((cmd) => cmd.name() === "completion")?.description("Print a shell completion script (zsh, bash, fish or powershell)").addHelpText("after", `\nAdd it to your shell, for example in ~/.zshrc:\n  ${pc.cyan("source <(dstack completion zsh)")}`);