@django-stack/cli 0.8.1 → 0.10.0

package/dist/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as isDockerDown, A as projectUrls, B as encodePreset, C as RUN_ENV, D as findProjectDirectory, E as composeOutput, F as NAMED_PRESETS, G as chooseFreePorts, H as resolvePreset, I as PROMPT_ORDER, J as portValues, K as describeMove, L as STACK_OPTIONS, M as readProject, N as runningServices, O as parseProfiles, P as DEFAULT_STACK, Q as dockerRunning, R as applies, S as RUN_DOMAIN, T as compose, U as stackOption, V as pendingChoices, W as DEV_PORTS, X as checkTools, Y as runDoctor, Z as dockerNotRunning, _ as validateTimeZone, a as LOCAL_S3, b as generateProjectSecrets, c as lockBackend, d as scaffold, et as parseEnv, f as timeZones, g as validateProjectName, h as usesValkey, j as readLocalRun, k as projectStack, m as umamiEnv, n as productionEnv$1, nt as setEnvValues, o as cacheEnv, p as toProjectName, q as envPorts, r as validateDomain, s as localS3, t as missingS3, tt as quoteEnvValue, u as relativeDirectory, v as CLI_VERSION, w as activeProject, x as generateSecret, y as PACKAGE_NAME } from "./production-CGkI7oNe.js";
+import { $ as envPorts, A as compose, B as NAMED_PRESETS, C as PACKAGE_NAME, D as RUN_DOMAIN, E as CAPTCHA_APP, F as projectUrls, H as PROMPT_ORDER, I as readLocalRun, J as resolvePreset, K as encodePreset, L as readProject, M as findProjectDirectory, N as parseProfiles, O as RUN_ENV, P as projectStack, Q as describeMove, R as runningServices, S as CLI_VERSION, T as generateSecret, U as STACK_OPTIONS, V as NODE_FRONTENDS, W as applies, X as DEV_PORTS, Y as stackOption, Z as chooseFreePorts, _ as umamiEnv, a as LOCAL_S3, at as isDockerDown, b as validateProjectName, c as localS3, ct as setEnvValues, et as portValues, f as relativeDirectory, g as toProjectName, h as timeZones, it as dockerRunning, j as composeOutput, k as activeProject, l as lockBackend, m as setNotificationsApp, n as productionEnv$1, nt as checkTools, o as cacheEnv, ot as parseEnv, p as scaffold, q as pendingChoices, r as validateDomain, rt as dockerNotRunning, s as frontendPackageManager, st as quoteEnvValue, t as missingS3, tt as runDoctor, u as lockFrontend, v as updateFrontendLock, w as generateProjectSecrets, x as validateTimeZone, y as usesValkey, z as DEFAULT_STACK } from "./production-Ct_qoeXk.js";
 import { createRequire } from "node:module";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { basename, delimiter, dirname, join, relative, resolve } from "node:path";
+import { basename, delimiter, dirname, join, posix, relative, resolve, sep } from "node:path";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import pc from "picocolors";
@@ -19,7 +19,7 @@ const DROPPED_VOLUMES = /* @__PURE__ */ new Set([
 	"media"
 ]);
 /** Compose keys that do not apply on Bunny: its gVisor sandbox isolates the app instead. */
-const IGNORED_KEYS = [
+const IGNORED_KEYS$1 = [
 	"read_only",
 	"tmpfs",
 	"cap_add",
@@ -81,15 +81,15 @@ function parsePublicImage(reference) {
 function repositoryName(value) {
 	return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, "") || "app";
 }
-function escapeRegExp(value) {
+function escapeRegExp$1(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 /** Matches `name:port` where name is a whole host name, such as backend:8000 in http://backend:8000/api. */
-function hostPattern(name) {
-	return new RegExp(`(^|[^\\w.-])${escapeRegExp(name)}:(\\d{1,5})(?!\\d)`, "g");
+function hostPattern$1(name) {
+	return new RegExp(`(^|[^\\w.-])${escapeRegExp$1(name)}:(\\d{1,5})(?!\\d)`, "g");
 }
 /** The names other services reach a service by: its name and its network aliases. */
-function hostNames(service, definition) {
+function hostNames$1(service, definition) {
 	const names = /* @__PURE__ */ new Set([service]);
 	for (const network of Object.values(definition.networks ?? {})) for (const alias of network?.aliases ?? []) names.add(alias);
 	return [...names];
@@ -97,7 +97,7 @@ function hostNames(service, definition) {
 /** Replaces service host names with 127.0.0.1, which is the pod on Bunny. */
 function rewriteHosts(text, names) {
 	let result = text;
-	for (const name of names) result = result.replace(hostPattern(name), (_whole, before, port) => `${before}127.0.0.1:${port}`);
+	for (const name of names) result = result.replace(hostPattern$1(name), (_whole, before, port) => `${before}127.0.0.1:${port}`);
 	return result;
 }
 function containerName(service, taken) {
@@ -140,7 +140,7 @@ function planApp(project, options) {
 	const entries = Object.entries(project.services).filter(([, definition]) => definition.deploy?.replicas !== 0).sort(([a], [b]) => a.localeCompare(b));
 	if (!entries.length) throw new Error("compose.yaml has no services for production.");
 	const names = /* @__PURE__ */ new Map();
-	for (const [service, definition] of entries) names.set(service, hostNames(service, definition));
+	for (const [service, definition] of entries) names.set(service, hostNames$1(service, definition));
 	const allNames = [...names.values()].flat();
 	const builds = /* @__PURE__ */ new Map();
 	const baked = /* @__PURE__ */ new Map();
@@ -178,7 +178,7 @@ function planApp(project, options) {
 	const portsOf = /* @__PURE__ */ new Map();
 	for (const [service, definition] of entries) {
 		const found = /* @__PURE__ */ new Set();
-		for (const name of names.get(service) ?? []) for (const text of texts) for (const match of text.matchAll(hostPattern(name))) found.add(Number(match[2]));
+		for (const name of names.get(service) ?? []) for (const text of texts) for (const match of text.matchAll(hostPattern$1(name))) found.add(Number(match[2]));
 		const own = definition.healthcheck?.test ? healthUrl(definition.healthcheck.test) : void 0;
 		if (own) found.add(own.port);
 		for (const port of definition.ports ?? []) found.add(port.target);
@@ -212,7 +212,7 @@ function planApp(project, options) {
 	const endpointPort = entryPorts.includes(80) ? 80 : entryPorts[0];
 	const rewrite = (text) => {
 		let result = text;
-		for (const [service, move] of moved) for (const name of names.get(service) ?? []) result = result.replace(hostPattern(name), (whole, before, port) => Number(port) === move.from ? `${before}${name}:${move.to}` : whole);
+		for (const [service, move] of moved) for (const name of names.get(service) ?? []) result = result.replace(hostPattern$1(name), (whole, before, port) => Number(port) === move.from ? `${before}${name}:${move.to}` : whole);
 		return rewriteHosts(result, allNames);
 	};
 	for (const build of builds.values()) if (build.kind === "bake") for (const file of build.files) file.content = rewrite(file.content);
@@ -220,7 +220,7 @@ function planApp(project, options) {
 	const taken = /* @__PURE__ */ new Set();
 	const containers = [];
 	for (const [service, definition] of entries) {
-		for (const key of IGNORED_KEYS) if (definition[key] !== void 0 && definition[key] !== null) ignored.add(key);
+		for (const key of IGNORED_KEYS$1) if (definition[key] !== void 0 && definition[key] !== null) ignored.add(key);
 		let image;
 		const bake = baked.get(service);
 		if (bake) image = {
@@ -883,6 +883,40 @@ const systemRunner = (command, args, options = {}) => new Promise((resolvePromis
 	child.stdin.on("error", () => {});
 	child.stdin.end(options.input);
 });
+/** The production Compose project, resolved with the variables, as JSON. */
+async function resolveCompose(run, directory, env) {
+	const folder = mkdtempSync(join(tmpdir(), "dstack-env-"));
+	const file = join(folder, ".env");
+	writeFileSync(file, `${Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n")}\n`, { mode: 384 });
+	const args = [
+		"compose",
+		"--env-file",
+		file,
+		"config",
+		"--format",
+		"json"
+	];
+	try {
+		const result = await run("docker", args, {
+			cwd: directory,
+			env: {
+				...env,
+				ENV_FILE: file
+			}
+		});
+		if (result.code !== 0) {
+			if (isDockerDown(`${result.stderr}\n${result.stdout}`)) throw new Error(dockerNotRunning());
+			const last = (result.stderr.trim() || result.stdout.trim()).split("\n").at(-1) ?? "";
+			throw new Error(`docker compose failed (exit ${result.code})${last ? `: ${last}` : "."}`);
+		}
+		return JSON.parse(result.stdout);
+	} finally {
+		rmSync(folder, {
+			recursive: true,
+			force: true
+		});
+	}
+}
 var BunnyError = class extends Error {
 	status;
 	constructor(message, status) {
@@ -1186,31 +1220,7 @@ var BunnyClient = class {
 	}
 	/** The production Compose project, resolved with the variables, as JSON. */
 	async composeConfig(directory, env) {
-		const folder = mkdtempSync(join(tmpdir(), "dstack-env-"));
-		const file = join(folder, ".env");
-		writeFileSync(file, `${Object.entries(env).map(([key, value]) => `${key}=${envValue(value)}`).join("\n")}\n`, { mode: 384 });
-		try {
-			const output = await this.docker([
-				"compose",
-				"--env-file",
-				file,
-				"config",
-				"--format",
-				"json"
-			], {
-				cwd: directory,
-				env: {
-					...env,
-					ENV_FILE: file
-				}
-			});
-			return JSON.parse(output);
-		} finally {
-			rmSync(folder, {
-				recursive: true,
-				force: true
-			});
-		}
+		return resolveCompose(this.run, directory, env);
 	}
 	async plan(directory, env) {
 		return planApp(await this.composeConfig(directory, env), { readFile: this.readFile });
@@ -1919,7 +1929,7 @@ function toDeployment(api, link, item) {
 	};
 }
 /** Finds a name or uuid in a list. */
-function find$1(items, wanted) {
+function find$2(items, wanted) {
 	return items.find((item) => item.uuid === wanted) ?? items.find((item) => item.name === wanted);
 }
 var CoolifyClient = class {
@@ -1940,10 +1950,10 @@ var CoolifyClient = class {
 		if (!servers.length) throw new Error("This Coolify has no servers. Add one in Coolify first.");
 		let server;
 		if (options.server) {
-			server = find$1(servers, options.server);
+			server = find$2(servers, options.server);
 			if (!server) throw new Error(`Coolify has no server ${options.server}.`);
 		} else if (servers.length === 1) server = servers[0];
-		else server = find$1(servers, await ask.select("Server to deploy to", servers.map((item) => ({
+		else server = find$2(servers, await ask.select("Server to deploy to", servers.map((item) => ({
 			value: item.uuid,
 			label: item.name,
 			hint: item.ip
@@ -1952,7 +1962,7 @@ var CoolifyClient = class {
 		const projects = await api.get("/projects");
 		let project;
 		const projectName = options.project ?? context.name;
-		project = find$1(projects, projectName);
+		project = find$2(projects, projectName);
 		if (!options.project && ask.interactive && projects.length) {
 			const NEW = "";
 			const uuid = await ask.select("Coolify project", [...project ? [] : [{
@@ -1963,7 +1973,7 @@ var CoolifyClient = class {
 				label: item.name,
 				hint: item.description ?? void 0
 			}))], project?.uuid ?? NEW);
-			project = uuid === NEW ? void 0 : find$1(projects, uuid);
+			project = uuid === NEW ? void 0 : find$2(projects, uuid);
 		}
 		if (!project) {
 			if (options.project && /^[a-z0-9]{20,}$/.test(options.project)) throw new Error(`Coolify has no project ${options.project}.`);
@@ -1977,7 +1987,7 @@ var CoolifyClient = class {
 			ask.step(`Created the Coolify project ${projectName}`);
 		}
 		const environmentName = options.environment ?? "production";
-		let environment = find$1(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
+		let environment = find$2(await api.get(`/projects/${enc(project.uuid)}/environments`), environmentName);
 		if (!environment) {
 			environment = {
 				uuid: (await api.post(`/projects/${enc(project.uuid)}/environments`, { name: environmentName })).uuid,
@@ -1987,7 +1997,7 @@ var CoolifyClient = class {
 		}
 		let githubApp;
 		if (options.githubApp && options.githubApp !== "public") {
-			const app = find$1(await api.get("/github-apps"), options.githubApp);
+			const app = find$2(await api.get("/github-apps"), options.githubApp);
 			if (!app) throw new Error(`Coolify has no GitHub App ${options.githubApp}.`);
 			githubApp = app.uuid;
 		} else if (!options.githubApp && ask.interactive) {
@@ -2180,7 +2190,7 @@ function composeUrl(api, link) {
 	return `${api.url}/dashboard/project/${link.project}/environment/${link.environment}/services/compose/${link.application}`;
 }
 /** Finds a name or id in a list. */
-function find(items, wanted, id, name) {
+function find$1(items, wanted, id, name) {
 	return items.find((item) => id(item) === wanted) ?? items.find((item) => name(item) === wanted);
 }
 const LOCAL_SERVER = "dokploy";
@@ -2201,7 +2211,7 @@ var DokployClient = class {
 		const servers = await api.get("server.all").catch(() => []) ?? [];
 		let serverId;
 		if (options.server && options.server !== LOCAL_SERVER) {
-			const server = find(servers, options.server, (item) => item.serverId, (item) => item.name);
+			const server = find$1(servers, options.server, (item) => item.serverId, (item) => item.name);
 			if (!server) throw new Error(`Dokploy has no server ${options.server}.`);
 			serverId = server.serverId;
 		} else if (!options.server && servers.length && ask.interactive) {
@@ -2217,7 +2227,7 @@ var DokployClient = class {
 		}
 		const projects = await api.get("project.all") ?? [];
 		const projectName = options.project ?? context.name;
-		let project = find(projects, projectName, (item) => item.projectId, (item) => item.name);
+		let project = find$1(projects, projectName, (item) => item.projectId, (item) => item.name);
 		if (!options.project && ask.interactive && projects.length) {
 			const NEW = "";
 			const id = await ask.select("Dokploy project", [...project ? [] : [{
@@ -2228,7 +2238,7 @@ var DokployClient = class {
 				label: item.name,
 				hint: item.description ?? void 0
 			}))], project?.projectId ?? NEW);
-			project = id === NEW ? void 0 : find(projects, id, (item) => item.projectId, (item) => item.name);
+			project = id === NEW ? void 0 : find$1(projects, id, (item) => item.projectId, (item) => item.name);
 		}
 		if (!project) {
 			const created = await api.post("project.create", {
@@ -2244,7 +2254,7 @@ var DokployClient = class {
 			ask.step(`Created the Dokploy project ${projectName}`);
 		}
 		const environmentName = options.environment ?? "production";
-		let environment = find(await api.get("environment.byProjectId", { projectId: project.projectId }).catch((error) => {
+		let environment = find$1(await api.get("environment.byProjectId", { projectId: project.projectId }).catch((error) => {
 			if (error.status === 404) throw new Error("This Dokploy has no environments; update Dokploy to a version with environments.");
 			throw error;
 		}) ?? [], environmentName, (item) => item.environmentId, (item) => item.name);
@@ -2380,6 +2390,726 @@ const dokploy = {
 		return new DokployClient(url, token);
 	}
 };
+// src/deploy/railway-compose.ts
+/**
+* Turns the resolved Compose project (`docker compose config --format json`)
+* into Railway services. Railway runs each service on its own and reaches it
+* at `<name>.railway.internal` on the private network; a service has at most
+* one volume and no bind mounts, and Railway builds a service from a
+* directory of the git repository. This module is pure, so it is tested on
+* the template's output.
+*/
+/** Volumes not needed on Railway: its edge holds the certificate, uploads and backups go to S3. */
+const RAILWAY_DROPPED_VOLUMES = /* @__PURE__ */ new Set([
+	"caddy_data",
+	"caddy_config",
+	"backups",
+	"media"
+]);
+/** Compose keys that do not apply on Railway. */
+const IGNORED_KEYS = [
+	"read_only",
+	"tmpfs",
+	"cap_add",
+	"cap_drop",
+	"security_opt",
+	"user",
+	"restart",
+	"depends_on"
+];
+/** Railway's Postgres image, which its own Postgres template runs. */
+const RAILWAY_POSTGRES_IMAGE = "ghcr.io/railwayapp-templates/postgres-ssl";
+/**
+* The default command of images whose bind-mounted file the CLI writes before
+* it starts them; Railway's start command replaces the image's command.
+*/
+const IMAGE_COMMANDS = [{
+	pattern: /^(docker\.io\/)?(library\/)?caddy(:|@|$)/,
+	command: [
+		"caddy",
+		"run",
+		"--config",
+		"/etc/caddy/Caddyfile",
+		"--adapter",
+		"caddyfile"
+	]
+}];
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Matches `name:port` where name is a whole host name, such as backend:8000 in http://backend:8000/api. */
+function hostPattern(name) {
+	return new RegExp(`(^|[^\\w.-])${escapeRegExp(name)}:(\\d{1,5})(?!\\d)`, "g");
+}
+/** Replaces Compose host names with the private host names of the Railway services. */
+function railwayHosts(text, hosts) {
+	let result = text;
+	for (const [name, service] of Object.entries(hosts)) result = result.replace(hostPattern(name), (_whole, before, port) => `${before}${service}.railway.internal:${port}`);
+	return result;
+}
+/** A Railway service name: lower case letters, digits and dashes. */
+function railwayName(service) {
+	return service.replace(/-prod$/, "").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32) || "service";
+}
+/** Quotes a word of a start command only when it needs it. */
+function commandWord(value) {
+	if (/^[\w@%+=:,./-]+$/.test(value)) return value;
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** The variable that holds a bind-mounted file, such as DSTACK_FILE_CADDYFILE. */
+function fileVariable(target) {
+	return `DSTACK_FILE_${(posix.basename(target) || "file").toUpperCase().replace(/[^A-Z0-9]+/g, "_")}`;
+}
+/** The last stage of a Dockerfile, which Railway builds. */
+function lastStage(dockerfile) {
+	let stage;
+	for (const match of dockerfile.matchAll(/^\s*FROM\s+(?:--\S+\s+)*\S+(?:\s+AS\s+(\S+))?\s*$/gim)) stage = match[1]?.toLowerCase() ?? "";
+	return stage;
+}
+function healthPath(definition) {
+	if (definition.healthcheck?.disable) return void 0;
+	const match = (definition.healthcheck?.test ?? []).join(" ").match(/https?:\/\/(?:localhost|127\.0\.0\.1)(?::(\d+))?(\/[^\s'"]*)?/);
+	if (!match) return void 0;
+	return {
+		port: Number(match[1] ?? 80),
+		path: match[2] ?? "/"
+	};
+}
+/** The names other services reach a service by: its name and its network aliases. */
+function hostNames(service, definition) {
+	const names = /* @__PURE__ */ new Set([service]);
+	for (const network of Object.values(definition.networks ?? {})) for (const alias of network?.aliases ?? []) names.add(alias);
+	return [...names];
+}
+/** Plans the Railway services for a resolved Compose project. */
+function planRailway(project, options) {
+	const entries = Object.entries(project.services).filter(([, definition]) => definition.deploy?.replicas !== 0).sort(([a], [b]) => a.localeCompare(b));
+	if (!entries.length) throw new Error("compose.yaml has no services for production.");
+	const names = /* @__PURE__ */ new Map();
+	const taken = /* @__PURE__ */ new Set();
+	for (const [service] of entries) {
+		let name = railwayName(service);
+		for (let index = 2; taken.has(name); index++) name = `${railwayName(service).slice(0, 29)}-${index}`;
+		taken.add(name);
+		names.set(service, name);
+	}
+	const hosts = {};
+	for (const [service, definition] of entries) for (const host of hostNames(service, definition)) hosts[host] = names.get(service);
+	const texts = [];
+	for (const [, definition] of entries) for (const value of Object.values(definition.environment ?? {})) if (value) texts.push(value);
+	const files = /* @__PURE__ */ new Map();
+	for (const [service, definition] of entries) {
+		const binds = (definition.volumes ?? []).filter((mount) => mount.type === "bind");
+		if (!binds.length) continue;
+		files.set(service, binds.map((mount) => {
+			let content;
+			try {
+				content = options.readFile(mount.source ?? "");
+			} catch {
+				throw new Error(`${service} bind-mounts ${mount.source}, which is not a file; Railway has no bind mounts, so only files can be passed to the service.`);
+			}
+			texts.push(content);
+			return {
+				target: mount.target,
+				content
+			};
+		}));
+	}
+	const published = entries.filter(([, definition]) => (definition.ports ?? []).length);
+	if (published.length !== 1) throw new Error(published.length ? `${published.map(([service]) => service).join(" and ")} publish ports; Railway gives the site one domain, so only the proxy may.` : "No service publishes a port, so there is nothing for Railway's domain to send requests to.");
+	const publicService = published[0]?.[0];
+	const s3 = entries.some(([, definition]) => Boolean(definition.environment?.S3_BUCKET));
+	const ignored = /* @__PURE__ */ new Set();
+	const services = [];
+	for (const [service, definition] of entries) {
+		const name = names.get(service);
+		for (const key of IGNORED_KEYS) if (definition[key] !== void 0 && definition[key] !== null) ignored.add(key);
+		if (definition.deploy?.resources) ignored.add("deploy.resources");
+		const found = /* @__PURE__ */ new Set();
+		for (const host of hostNames(service, definition)) for (const text of texts) for (const match of text.matchAll(hostPattern(host))) found.add(Number(match[2]));
+		const health = healthPath(definition);
+		if (health) found.add(health.port);
+		const ports = (definition.ports ?? []).map((port) => port.target);
+		let port;
+		if (service === publicService) port = ports.includes(80) ? 80 : ports[0];
+		else if (found.size > 1) throw new Error(`${service} is reached on ports ${[...found].join(" and ")}; Railway routes one port per service.`);
+		else port = [...found][0];
+		const env = {};
+		for (const [key, value] of Object.entries(definition.environment ?? {})) {
+			if (value === null || value === void 0 || key === "COMPOSE_PROFILES" || key === "ENV_FILE") continue;
+			env[key] = railwayHosts(value, hosts);
+		}
+		if (port !== void 0 && !env.PORT) env.PORT = String(port);
+		let source;
+		let watchPatterns;
+		if (definition.build) {
+			const context = relative(options.directory, definition.build.context).split(sep).join("/");
+			if (context.startsWith("..")) throw new Error(`${service} builds ${definition.build.context}, outside the project.`);
+			const dockerfile = definition.build.dockerfile ?? "Dockerfile";
+			const target = definition.build.target;
+			if (target) {
+				let text;
+				try {
+					text = options.readFile(posix.join(definition.build.context, dockerfile));
+				} catch {}
+				const last = text === void 0 ? void 0 : lastStage(text);
+				if (last !== void 0 && last !== target.toLowerCase()) throw new Error(`${service} builds the ${target} stage of ${context || "."}/${dockerfile}, and Railway builds the last stage only. Make ${target} the last stage.`);
+			}
+			for (const [key, value] of Object.entries(definition.build.args ?? {})) if (env[key] === void 0 && value != null) env[key] = String(value);
+			const rootDirectory = `/${context}`.replace(/\/$/, "") || "/";
+			source = {
+				kind: "repo",
+				rootDirectory,
+				...dockerfile !== "Dockerfile" ? { dockerfile } : {}
+			};
+			watchPatterns = [rootDirectory === "/" ? "/**" : `${rootDirectory}/**`];
+		} else if (definition.image) {
+			let image = definition.image;
+			const postgres = image.match(/^(?:docker\.io\/)?(?:library\/)?postgres:(\d+)(?:[.-][\w.-]*)?$/);
+			if (postgres) image = `${RAILWAY_POSTGRES_IMAGE}:${postgres[1]}`;
+			source = {
+				kind: "image",
+				image
+			};
+		} else throw new Error(`${service} has neither an image nor a build.`);
+		let startCommand = definition.entrypoint?.length || definition.command?.length ? [...definition.entrypoint ?? [], ...definition.command ?? []] : void 0;
+		const bound = files.get(service);
+		if (bound) {
+			if (definition.build) throw new Error(`${service} bind-mounts a file; Railway has no bind mounts. Copy the file into the image in its Dockerfile.`);
+			const command = startCommand ?? IMAGE_COMMANDS.find((item) => item.pattern.test(definition.image ?? ""))?.command;
+			if (!command) throw new Error(`${service} bind-mounts ${bound[0]?.target}; Railway has no bind mounts. Give the service a command in compose.yaml, or build an image with the file.`);
+			startCommand = [
+				"/bin/sh",
+				"-c",
+				[...bound.map((file) => {
+					const variable = fileVariable(file.target);
+					env[variable] = railwayHosts(file.content, hosts);
+					return `printf %s "$${variable}" > ${commandWord(file.target)}`;
+				}), `exec ${command.map(commandWord).join(" ")}`].join(" && ")
+			];
+		}
+		let volume;
+		for (const mount of definition.volumes ?? []) {
+			if (mount.type === "tmpfs" || mount.type === "bind") continue;
+			if (mount.type !== "volume" || !mount.source) throw new Error(`${service} mounts a ${mount.type} volume, which Railway does not have.`);
+			if (mount.source === "media" && !s3) throw new Error("Uploads must be in S3 on Railway: a Railway volume belongs to one service, and the backend, the worker and Caddy all need the uploads. Set S3_BUCKET and the other S3_ variables in .env.production (see the docs on media).");
+			if (RAILWAY_DROPPED_VOLUMES.has(mount.source)) continue;
+			if (volume) throw new Error(`${service} mounts two volumes, ${volume} and ${mount.target}; Railway gives a service one volume.`);
+			volume = mount.target;
+			if (mount.target === "/var/lib/postgresql/data" && !env.PGDATA) env.PGDATA = `${mount.target}/pgdata`;
+		}
+		const replicas = definition.deploy?.replicas ?? 1;
+		services.push({
+			service,
+			name,
+			source,
+			env,
+			...startCommand ? { startCommand: startCommand.map(commandWord).join(" ") } : {},
+			...port !== void 0 ? { port } : {},
+			...health && health.port === port ? { healthcheckPath: health.path } : {},
+			replicas: volume ? 1 : Math.max(1, replicas),
+			...volume ? { volume } : {},
+			...watchPatterns ? { watchPatterns } : {},
+			public: service === publicService
+		});
+	}
+	return {
+		name: project.name,
+		services,
+		ignored: [...ignored].sort()
+	};
+}
+// src/deploy/railway.ts
+/**
+* Railway (https://railway.com), through its GraphQL API with an account or
+* workspace token. Railway has no Compose: the CLI reads the resolved
+* compose.yaml and creates one Railway service per production service in a
+* Railway project. Railway builds the backend and the frontend from their
+* directories in the GitHub repository (through the Railway GitHub App) and
+* deploys again on every push; Postgres runs Railway's own Postgres image
+* with a volume, and Caddy gets the Caddyfile through a variable. Railway's
+* edge holds the certificate of the site's domain and forwards to Caddy on
+* port 80, which routes to the other services on the private network.
+*
+* Link ids: project = the Railway project, environment = its environment,
+* application = the service with the domain (the proxy).
+*/
+const RAILWAY_API = "https://backboard.railway.com/graphql/v2";
+/** Variables that put Caddy behind Railway's edge. */
+const RAILWAY_PLATFORM_ENV = {
+	CADDY_ADDRESS: ":80",
+	TRUSTED_PROXIES: "0.0.0.0/0 ::/0",
+	NUM_PROXIES: "2"
+};
+var RailwayError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var RailwayApi = class {
+	token;
+	fetchImpl;
+	url;
+	constructor(token, fetchImpl = fetch, url = RAILWAY_API) {
+		this.token = token;
+		this.fetchImpl = fetchImpl;
+		this.url = url;
+	}
+	async query(query, variables = {}) {
+		let response;
+		try {
+			response = await this.fetchImpl(this.url, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${this.token}`,
+					"Content-Type": "application/json",
+					Accept: "application/json"
+				},
+				body: JSON.stringify({
+					query,
+					variables
+				}),
+				signal: AbortSignal.timeout(3e4)
+			});
+		} catch (error) {
+			throw new RailwayError(`Could not reach Railway: ${error.message}`, 0);
+		}
+		const raw = await response.text();
+		let body;
+		try {
+			body = raw ? JSON.parse(raw) : void 0;
+		} catch {}
+		const message = body?.errors?.map((item) => item.message).filter(Boolean).join("; ");
+		if (response.status === 401 || response.status === 403 || /not authori[sz]ed/i.test(message ?? "")) throw new RailwayError("Railway refused the token. Create an account or workspace token at https://railway.com/account/tokens and run dstack deploy login.", response.status);
+		if (!response.ok || message || !body?.data) throw new RailwayError(`Railway answered ${response.status}: ${message || raw.slice(0, 200) || "no details"}`, response.status);
+		return body.data;
+	}
+};
+/** A deployment's status in Railway's words. */
+function railwayDeploymentStatus(value) {
+	switch (value) {
+		case "SUCCESS":
+		case "SLEEPING":
+		case "REMOVED":
+		case "REMOVING": return "finished";
+		case "BUILDING":
+		case "DEPLOYING": return "building";
+		case "QUEUED":
+		case "WAITING":
+		case "INITIALIZING":
+		case "NEEDS_APPROVAL": return "queued";
+		case "SKIPPED": return "cancelled";
+		default: return "failed";
+	}
+}
+/** The state of one deploy across services: failed when one failed, done when all are. */
+function groupStatus(statuses) {
+	if (statuses.includes("failed")) return "failed";
+	if (statuses.includes("building")) return "building";
+	if (statuses.includes("queued")) return "queued";
+	if (statuses.length && statuses.every((status) => status === "cancelled")) return "cancelled";
+	return "finished";
+}
+const DEPLOYMENT_FIELDS = "id status createdAt updatedAt meta";
+const PROJECT_QUERY = `query Project($id: String!) {
+  project(id: $id) {
+    id name
+    services { edges { node { id name } } }
+    environments { edges { node { id name serviceInstances { edges { node {
+      serviceId serviceName
+      source { repo image }
+      latestDeployment { ${DEPLOYMENT_FIELDS} }
+      domains { customDomains { domain } serviceDomains { domain } }
+    } } } } } }
+  }
+}`;
+/** owner/name of a GitHub repository URL; Railway builds from GitHub only. */
+function githubRepository(url) {
+	const match = url.match(/^https:\/\/github\.com\/([\w.-]+\/[\w.-]+?)(?:\.git)?\/?$/);
+	if (!match?.[1]) throw new Error(`Railway builds from GitHub repositories only, and ${url} is not one. Push the project to GitHub first.`);
+	return match[1];
+}
+function commitOf(deployment) {
+	const value = deployment.meta?.commitHash;
+	return typeof value === "string" && value ? value : void 0;
+}
+function metaText(deployment, key) {
+	const value = deployment.meta?.[key];
+	return typeof value === "string" && value ? value : void 0;
+}
+function railwayDashboardUrl(link) {
+	return `https://railway.com/project/${encodeURIComponent(link.project)}?environmentId=${encodeURIComponent(link.environment)}`;
+}
+function find(items, wanted) {
+	return items.find((item) => item.id === wanted) ?? items.find((item) => item.name === wanted);
+}
+var RailwayClient = class {
+	api;
+	run;
+	readFile;
+	constructor(token, fetchImpl, options = {}) {
+		this.api = new RailwayApi(token, fetchImpl);
+		this.run = options.run ?? systemRunner;
+		this.readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+	}
+	/** How long `deploy` and `rollback` wait between looks for a new deployment; tests set it to 0. */
+	pollMs = 1e3;
+	async verify() {
+		const data = await this.api.query("query { me { name email } }");
+		const who = data.me?.email ?? data.me?.name;
+		return who ? `API (${who})` : "API";
+	}
+	async plan(directory, env) {
+		return planRailway(await resolveCompose(this.run, directory, env), {
+			directory,
+			readFile: this.readFile
+		});
+	}
+	async project(id) {
+		return (await this.api.query(PROJECT_QUERY, { id })).project;
+	}
+	/** The service instances of the link's environment. */
+	async instances(link) {
+		const environment = (await this.project(link.project)).environments.edges.find((edge) => edge.node.id === link.environment);
+		if (!environment) throw new Error(`The Railway project has no environment ${link.environment}.`);
+		return environment.node.serviceInstances.edges.map((edge) => edge.node);
+	}
+	/** The services Railway builds from the repository; the first one is the one deploys are listed by. */
+	async built(link) {
+		const items = (await this.instances(link)).filter((item) => item.source?.repo);
+		if (!items.length) throw new Error("No service of the Railway project builds from the repository.");
+		return items.sort((a, b) => a.serviceName === "backend" ? -1 : b.serviceName === "backend" ? 1 : a.serviceName.localeCompare(b.serviceName));
+	}
+	async workspace(wanted, context) {
+		const workspaces = (await this.api.query("query { me { workspaces { id name } } }")).me.workspaces ?? [];
+		if (wanted) {
+			const workspace = find(workspaces, wanted);
+			if (!workspace) throw new Error(`Railway has no workspace ${wanted}.`);
+			return workspace.id;
+		}
+		if (workspaces.length === 1) return workspaces[0]?.id;
+		if (!workspaces.length) throw new Error("This Railway token sees no workspace; pass --workspace.");
+		return context.ask.select("Railway workspace", workspaces.map((item) => ({
+			value: item.id,
+			label: item.name
+		})), workspaces[0]?.id);
+	}
+	async projects(workspaceId) {
+		return (((await this.api.query("query { me { workspaces { id projects(first: 500) { edges { node { id name } } } } } }")).me.workspaces ?? []).find((item) => item.id === workspaceId)?.projects?.edges ?? []).map((edge) => edge.node);
+	}
+	async setup(context) {
+		const { ask, options, directory } = context;
+		if (!context.repository) throw new Error("Railway builds from a GitHub repository; pass --repository.");
+		const repo = githubRepository(context.repository);
+		const plan = await this.plan(directory, context.env);
+		if (plan.ignored.length) ask.step(`Railway does not apply these settings of compose.yaml: ${plan.ignored.join(", ")}`);
+		const workspaceId = await this.workspace(options.workspace, context);
+		let projectId;
+		if (options.project) {
+			const project = find(await this.projects(workspaceId), options.project);
+			if (!project) throw new Error(`The Railway workspace has no project ${options.project}.`);
+			projectId = project.id;
+		} else {
+			projectId = (await this.api.query(`mutation ($input: ProjectCreateInput!) { projectCreate(input: $input) { id } }`, { input: {
+				name: context.name,
+				description: "DjangoStack",
+				workspaceId
+			} })).projectCreate.id;
+			ask.step(`Created the Railway project ${context.name}`);
+		}
+		const environmentName = options.environment ?? "production";
+		let project = await this.project(projectId);
+		let environmentId = project.environments.edges.find((edge) => edge.node.id === environmentName || edge.node.name === environmentName)?.node.id;
+		if (!environmentId) {
+			environmentId = (await this.api.query(`mutation ($input: EnvironmentCreateInput!) { environmentCreate(input: $input) { id } }`, { input: {
+				projectId,
+				name: environmentName
+			} })).environmentCreate.id;
+			ask.step(`Created the environment ${environmentName}`);
+			project = await this.project(projectId);
+		}
+		const existing = project.services.edges.map((edge) => edge.node);
+		for (const name of plan.services.map((item) => item.name)) if (existing.some((item) => item.name === name)) throw new Error(`The Railway project already has a service ${name}. Set up a new project, or delete the service in Railway first.`);
+		let publicId;
+		for (const service of plan.services) {
+			const serviceId = (await this.api.query(`mutation ($input: ServiceCreateInput!) { serviceCreate(input: $input) { id } }`, { input: {
+				projectId,
+				environmentId,
+				name: service.name
+			} })).serviceCreate.id;
+			if (service.public) publicId = serviceId;
+			const env = { ...service.env };
+			if (service.source.kind === "repo" && service.source.dockerfile) env.RAILWAY_DOCKERFILE_PATH = service.source.dockerfile;
+			await this.upsertVariables(projectId, environmentId, serviceId, env, true);
+			await this.api.query(`mutation ($serviceId: String!, $environmentId: String, $input: ServiceInstanceUpdateInput!) {
+          serviceInstanceUpdate(serviceId: $serviceId, environmentId: $environmentId, input: $input)
+        }`, {
+				serviceId,
+				environmentId,
+				input: {
+					...service.source.kind === "repo" ? { rootDirectory: service.source.rootDirectory } : {},
+					...service.startCommand ? { startCommand: service.startCommand } : {},
+					...service.healthcheckPath ? { healthcheckPath: service.healthcheckPath } : {},
+					...service.watchPatterns ? { watchPatterns: service.watchPatterns } : {},
+					numReplicas: service.replicas
+				}
+			});
+			if (service.volume) await this.api.query(`mutation ($input: VolumeCreateInput!) { volumeCreate(input: $input) { id } }`, { input: {
+				projectId,
+				environmentId,
+				serviceId,
+				mountPath: service.volume
+			} });
+			await this.api.query(`mutation ($id: String!, $input: ServiceConnectInput!) { serviceConnect(id: $id, input: $input) { id } }`, {
+				id: serviceId,
+				input: service.source.kind === "repo" ? {
+					repo,
+					branch: context.branch
+				} : { image: service.source.image }
+			});
+			ask.step(`Created the service ${service.name} ${service.source.kind === "repo" ? `from ${repo}${service.source.rootDirectory} (${context.branch})` : `from ${service.source.image}`}${service.volume ? ` with a volume at ${service.volume}` : ""}`);
+		}
+		if (!publicId) throw new Error("The plan has no public service.");
+		const domain = await this.api.query(`mutation ($input: CustomDomainCreateInput!) {
+        customDomainCreate(input: $input) { id status { dnsRecords { hostlabel fqdn recordType requiredValue } } }
+      }`, { input: {
+			projectId,
+			environmentId,
+			serviceId: publicId,
+			domain: context.domain,
+			targetPort: plan.services.find((item) => item.public)?.port ?? 80
+		} });
+		ask.step(`Gave the ${plan.services.find((item) => item.public)?.name} service https://${context.domain}`);
+		const records = domain.customDomainCreate.status?.dnsRecords ?? [];
+		if (records.length) for (const record of records) ask.step(`Add this DNS record: ${record.fqdn ?? record.hostlabel ?? context.domain} ${record.recordType?.replace(/^DNS_RECORD_TYPE_/, "") ?? "CNAME"} ${record.requiredValue ?? ""}`.trim());
+		else ask.step(`Add the DNS record Railway shows for ${context.domain} under the proxy service's settings.`);
+		return {
+			project: projectId,
+			environment: environmentId,
+			application: publicId
+		};
+	}
+	async upsertVariables(projectId, environmentId, serviceId, variables, skipDeploys) {
+		await this.api.query(`mutation ($input: VariableCollectionUpsertInput!) { variableCollectionUpsert(input: $input) }`, { input: {
+			projectId,
+			environmentId,
+			serviceId,
+			variables,
+			skipDeploys
+		} });
+	}
+	async pushEnv(link, env) {
+		const directory = link.directory ?? process.cwd();
+		const plan = await this.plan(directory, env);
+		const instances = await this.instances(link);
+		for (const service of plan.services) {
+			const instance = instances.find((item) => item.serviceName === service.name);
+			if (!instance) throw new Error(missingService(service.name));
+			await this.upsertVariables(link.project, link.environment, instance.serviceId, service.env, false);
+		}
+	}
+	async deploy(link) {
+		const services = await this.built(link);
+		let primary;
+		for (const service of services) {
+			const data = await this.api.query(`mutation ($serviceId: String!, $environmentId: String!) {
+          serviceInstanceDeployV2(serviceId: $serviceId, environmentId: $environmentId)
+        }`, {
+				serviceId: service.serviceId,
+				environmentId: link.environment
+			});
+			primary ??= typeof data.serviceInstanceDeployV2 === "string" ? data.serviceInstanceDeployV2 : void 0;
+		}
+		if (primary) return primary;
+		return this.newest(link, services[0]?.serviceId, services[0]?.latestDeployment?.id);
+	}
+	/** Waits for a deployment newer than `before` of a service; returns its id. */
+	async newest(link, serviceId, before) {
+		for (let attempt = 0; attempt < 20; attempt++) {
+			const [latest] = await this.raw(link, serviceId, 1);
+			if (latest && latest.id !== before) return latest.id;
+			await new Promise((resolve) => setTimeout(resolve, this.pollMs));
+		}
+		throw new Error(`Railway took the deploy but shows no deployment for it yet. See ${railwayDashboardUrl(link)}`);
+	}
+	/** A service's deployments, newest first. */
+	async raw(link, serviceId, limit) {
+		return (await this.api.query(`query ($input: DeploymentListInput!, $first: Int) {
+        deployments(input: $input, first: $first) { edges { node { ${DEPLOYMENT_FIELDS} } } }
+      }`, {
+			input: {
+				projectId: link.project,
+				environmentId: link.environment,
+				serviceId
+			},
+			first: limit
+		})).deployments.edges.map((edge) => edge.node).sort((a, b) => String(b.createdAt ?? "").localeCompare(String(a.createdAt ?? "")));
+	}
+	/** The deployments of the other built services that belong to a deployment of the first one. */
+	siblings(primary, others) {
+		const commit = commitOf(primary);
+		const time = new Date(primary.createdAt ?? 0).getTime();
+		const result = [];
+		for (const { service, deployments } of others) {
+			const match = commit ? deployments.find((item) => commitOf(item) === commit) : deployments.filter((item) => Math.abs(new Date(item.createdAt ?? 0).getTime() - time) < 6e5).sort((a, b) => Math.abs(new Date(a.createdAt ?? 0).getTime() - time) - Math.abs(new Date(b.createdAt ?? 0).getTime() - time))[0];
+			if (match) result.push({
+				service,
+				deployment: match
+			});
+		}
+		return result;
+	}
+	async group(link, limit) {
+		const [first, ...rest] = await this.built(link);
+		if (!first) throw new Error("No service of the Railway project builds from the repository.");
+		return {
+			first,
+			primary: await this.raw(link, first.serviceId, limit),
+			others: await Promise.all(rest.map(async (service) => ({
+				service,
+				deployments: await this.raw(link, service.serviceId, Math.max(limit, 10) * 2)
+			})))
+		};
+	}
+	toDeployment(link, primary, siblings) {
+		const statuses = [primary, ...siblings.map((item) => item.deployment)].map((item) => railwayDeploymentStatus(item.status));
+		const commit = commitOf(primary);
+		return {
+			id: primary.id,
+			status: groupStatus(statuses),
+			commit: commit?.slice(0, 7),
+			message: metaText(primary, "commitMessage")?.split("\n")[0],
+			createdAt: primary.createdAt,
+			updatedAt: primary.updatedAt,
+			url: railwayDashboardUrl(link),
+			log: []
+		};
+	}
+	async deployment(link, id) {
+		const { first, primary, others } = await this.group(link, 20);
+		let item = primary.find((deployment) => deployment.id === id);
+		if (!item) item = (await this.api.query(`query ($id: String!) { deployment(id: $id) { ${DEPLOYMENT_FIELDS} } }`, { id }).catch(() => void 0))?.deployment;
+		if (!item) throw new Error(`Railway has no deployment ${id} for this project.`);
+		const siblings = this.siblings(item, others);
+		const deployment = this.toDeployment(link, item, siblings);
+		const log = [];
+		for (const [service, part] of [[first, item], ...siblings.map((sibling) => [sibling.service, sibling.deployment])]) {
+			const lines = await this.logs(part).catch(() => []);
+			for (const line of lines) log.push({
+				...line,
+				text: `${service.serviceName} | ${line.text}`
+			});
+		}
+		return {
+			...deployment,
+			log
+		};
+	}
+	/** The build log of a deployment, and its deploy log once it runs. */
+	async logs(deployment) {
+		const toLines = (items) => items.map((item) => ({
+			text: item.message ?? "",
+			stderr: /error/i.test(item.severity ?? "")
+		}));
+		const lines = toLines((await this.api.query(`query ($deploymentId: String!, $limit: Int) { buildLogs(deploymentId: $deploymentId, limit: $limit) { message severity } }`, {
+			deploymentId: deployment.id,
+			limit: 500
+		})).buildLogs ?? []);
+		if ([
+			"DEPLOYING",
+			"SUCCESS",
+			"CRASHED",
+			"FAILED"
+		].includes(deployment.status ?? "")) {
+			const run = await this.api.query(`query ($deploymentId: String!, $limit: Int) { deploymentLogs(deploymentId: $deploymentId, limit: $limit) { message severity } }`, {
+				deploymentId: deployment.id,
+				limit: 200
+			}).catch(() => ({ deploymentLogs: [] }));
+			lines.push(...toLines(run.deploymentLogs ?? []));
+		}
+		return lines;
+	}
+	async deployments(link, limit) {
+		const { primary, others } = await this.group(link, Math.max(1, limit));
+		return primary.slice(0, limit).map((item) => this.toDeployment(link, item, this.siblings(item, others)));
+	}
+	async rollback(link, to) {
+		const { first, primary, others } = await this.group(link, 20);
+		let target;
+		if (to) {
+			target = primary.find((item) => item.id === to);
+			if (!target) throw new Error(`Railway has no deployment ${to} among the last 20.`);
+		} else {
+			const running = primary.findIndex((item) => item.status === "SUCCESS");
+			target = primary.slice(running + 1).find((item) => ["SUCCESS", "REMOVED"].includes(item.status ?? "") && running >= 0);
+			if (!target) throw new Error("There is no earlier deploy to roll back to.");
+		}
+		if (railwayDeploymentStatus(target.status) !== "finished") throw new Error(`Deploy ${target.id} did not finish, so it cannot be rolled back to.`);
+		const before = primary[0]?.id;
+		for (const deployment of [target, ...this.siblings(target, others).map((item) => item.deployment)]) await this.api.query(`mutation ($id: String!) { deploymentRollback(id: $id) }`, { id: deployment.id });
+		return this.newest(link, first.serviceId, before);
+	}
+	async status(link) {
+		const instances = await this.instances(link);
+		const states = instances.map((item) => item.latestDeployment?.status);
+		let state = "unknown";
+		if (!states.some(Boolean)) state = "stopped";
+		else if (states.every((value) => value === "SUCCESS" || value === "SLEEPING")) state = "running";
+		else if (states.some((value) => value === "FAILED" || value === "CRASHED" || value === "REMOVED")) state = "degraded";
+		else if (states.some((value) => railwayDeploymentStatus(value ?? "") !== "finished")) state = "degraded";
+		const detail = instances.map((item) => `${item.serviceName}:${(item.latestDeployment?.status ?? "none").toLowerCase()}`).join(", ");
+		const domains = (instances.find((item) => item.serviceId === link.application)?.domains?.customDomains ?? []).map((item) => `https://${item.domain}`);
+		const branch = (instances.find((item) => item.source?.repo && item.serviceName === "backend") ?? instances.find((item) => item.source?.repo))?.latestDeployment;
+		return {
+			state,
+			detail: detail || "no services",
+			domains,
+			branch: branch ? metaText(branch, "branch") : void 0,
+			url: railwayDashboardUrl(link)
+		};
+	}
+};
+function missingService(name) {
+	return `The Railway project has no service ${name}. compose.yaml changed since setup: add the service in Railway, or run dstack deploy setup --provider railway --force to create a new project.`;
+}
+const railway = {
+	id: "railway",
+	name: "Railway",
+	auth: {
+		kind: "token",
+		env: "DSTACK_RAILWAY_TOKEN",
+		help: () => "Create an account token, or a token of the workspace to deploy to, at https://railway.com/account/tokens. Connect the Railway GitHub App to the repository too: Railway builds from GitHub."
+	},
+	source: "remote",
+	target: {
+		label: "Railway API",
+		placeholder: RAILWAY_API,
+		fixed: RAILWAY_API,
+		normalize: () => RAILWAY_API
+	},
+	platformEnv: RAILWAY_PLATFORM_ENV,
+	setupFlags: [
+		{
+			name: "workspace",
+			description: "Railway: the workspace, by name or id (default: the only one)"
+		},
+		{
+			name: "project",
+			description: "The platform's project, by name or id (default: the project name)"
+		},
+		{
+			name: "environment",
+			description: "The platform's environment (default: production)"
+		}
+	],
+	printsDns: true,
+	connect: (_target, token) => {
+		if (!token) throw new Error("Railway needs an API key.");
+		return new RailwayClient(token);
+	}
+};
 // src/deploy/credentials.ts
 /**
 * API keys of deploy providers, never in the project: the OS keychain
@@ -2489,7 +3219,8 @@ const PROVIDERS = [
 	coolify,
 	dokploy,
 	ssh,
-	bunny
+	bunny,
+	railway
 ];
 function getProvider(id) {
 	const provider = PROVIDERS.find((item) => item.id === id);
@@ -3338,6 +4069,10 @@ async function init(directoryArgument, options) {
 			localS3: stack.storage === "s3",
 			analytics: stack.analytics === "umami",
 			cache: stack.cache,
+			notifications: stack.notifications === "on",
+			captcha: stack.captcha === "on",
+			packageManager: stack.packageManager,
+			errors: stack.errors,
 			tasks: stack.tasks,
 			preset: encodePreset(stack),
 			timeZone,
@@ -3354,6 +4089,16 @@ async function init(directoryArgument, options) {
 		if (lockBackend(target)) spinner.stop(`Locked the backend dependencies in ${pc.bold("backend/uv.lock")}`);
 		else spinner.error("Could not lock the backend dependencies. The image build resolves them instead.");
 	}
+	if (NODE_FRONTENDS.includes(stack.frontend)) {
+		const lockfile = {
+			pnpm: "pnpm-lock.yaml",
+			npm: "package-lock.json",
+			bun: "bun.lock"
+		}[stack.packageManager];
+		spinner.start(`Locking the frontend dependencies with ${stack.packageManager}`);
+		if (lockFrontend(target, stack.packageManager)) spinner.stop(`Locked the frontend dependencies in ${pc.bold(`frontend/${lockfile}`)}`);
+		else spinner.error("Could not lock the frontend dependencies. The image build resolves them instead.");
+	}
 	if (options.git && has("git")) try {
 		execFileSync("git", ["init", "--quiet"], {
 			cwd: target,
@@ -3778,7 +4523,9 @@ const SWITCHABLE = [
 	"analytics",
 	"media",
 	"cache",
-	"tasks"
+	"tasks",
+	"notifications",
+	"captcha"
 ];
 const EMPTY_S3 = Object.fromEntries(Object.keys(LOCAL_S3).map((key) => [key, key === "S3_CREATE_BUCKET" ? "0" : ""]));
 /**
@@ -3845,6 +4592,11 @@ function applyStack(envText, env, from, to) {
 				changes.push("Page analytics are off; Umami's data stays in the database.");
 			}
 		}
+		if (key === "notifications") changes.push(to.notifications === "on" ? "Notifications are on: content_studio.notifications is in INSTALLED_APPS." : "Notifications are off: content_studio.notifications is out of INSTALLED_APPS; its tables stay.");
+		if (key === "captcha") {
+			text = setEnvValues(text, { CAPTCHA: to.captcha });
+			changes.push(to.captcha === "on" ? "The captcha of the contact form is on." : "The captcha is off: public forms need no captcha token.");
+		}
 		if (key === "media") changes.push(to.media === "s3" ? "Uploads in production go to S3; dstack settings asks for the S3 settings." : "Uploads in production stay on the server.");
 	}
 	return {
@@ -3984,6 +4736,20 @@ async function manage(args, options) {
 		...args
 	])));
 }
+/** `dstack status`: the containers, then the database, cache, worker and backup checks. */
+async function status(options) {
+	const project = activeProject(open(options));
+	if (!runningServices(project).includes(project.services.backend)) fail(`The ${project.services.backend} service is not running.`);
+	compose(project, ["ps"]);
+	exitWith(compose(project, [
+		"exec",
+		"-T",
+		project.services.backend,
+		"python",
+		"manage.py",
+		"health"
+	]));
+}
 /** `dstack shell`: Django's shell in the backend container. */
 async function shell(options) {
 	return manage(["shell"], options);
@@ -4249,6 +5015,11 @@ async function update(options) {
 		}).status !== 0) fail("uv could not update backend/uv.lock.");
 		p.log.success(options.all ? "Updated backend/uv.lock" : "Updated django-stack in backend/uv.lock");
 	} else if (existsSync(lock)) p.log.warn("uv is not installed, so backend/uv.lock stays as it is: https://docs.astral.sh/uv/");
+	if (frontendPackageManager(project.directory)) {
+		const lockfile = updateFrontendLock(project.directory, options.all);
+		if (!lockfile) fail("The package manager could not update the frontend's lockfile.");
+		p.log.success(options.all ? `Updated frontend/${lockfile}` : `Updated the @django-stack packages in frontend/${lockfile}`);
+	}
 	for (const target of targets) {
 		if (compose(target, ["pull", "--ignore-buildable"]) !== 0) fail("Pulling the images failed.");
 		const build = [
@@ -4308,6 +5079,19 @@ async function config(options) {
 		const compose = join(project.directory, "compose.yaml");
 		if (!existsSync(compose) || !/^ {2}umami:/m.test(readFileSync(compose, "utf8"))) fail("compose.yaml has no umami service. Add it as the analytics docs describe, then run this again.");
 	}
+	const settingsPath = join(project.directory, "backend", "config", "settings.py");
+	if (next.captcha === "on" && current.captcha !== "on") {
+		if (!existsSync(settingsPath) || !CAPTCHA_APP.test(readFileSync(settingsPath, "utf8"))) fail("The backend has no django_stack.contrib.captcha. Add it and the widget as the captcha docs describe, then run this again.");
+	}
+	let settingsText;
+	if (next.notifications !== current.notifications) {
+		if (!existsSync(settingsPath)) fail("This project has no backend/config/settings.py.");
+		try {
+			settingsText = setNotificationsApp(readFileSync(settingsPath, "utf8"), next.notifications === "on");
+		} catch (error) {
+			fail(error.message);
+		}
+	}
 	const envPath = join(project.directory, ".env");
 	let result;
 	try {
@@ -4321,10 +5105,11 @@ async function config(options) {
 	}
 	const envText = readFileSync(envPath, "utf8");
 	if (result.env !== envText) writeFileSync(envPath, result.env, { mode: 384 });
+	if (settingsText !== void 0) writeFileSync(settingsPath, settingsText);
 	const manifestPath = join(project.directory, "package.json");
 	if (existsSync(manifestPath)) writeFileSync(manifestPath, setManifestPreset(readFileSync(manifestPath, "utf8"), encodePreset(next)));
 	for (const change of result.changes) p.log.success(change);
-	if (result.env === envText) p.outro(pc.green("Done"));
+	if (result.env === envText && settingsText === void 0) p.outro(pc.green("Done"));
 	else p.outro(`Restart to apply it: ${command("dstack stop")}, then ${command("dstack dev")}`);
 }
 // src/update-check.ts
@@ -4539,8 +5324,9 @@ function createProgram() {
 	program.command("dev").description("Run the development servers with hot reload").addOption(dirOption()).option("--no-build", "Don't build the images first").action(dev);
 	program.command("stop").description("Stop the project; the data stays").addOption(dirOption()).action(stop);
 	program.command("logs").description("Show the logs of the services").argument("[services...]", "Only these services, such as backend").addOption(dirOption()).option("--no-follow", "Print the logs and exit").option("-n, --tail <lines>", "Only the last lines of each service").action(logs);
+	program.command("status").description("Show the containers and whether the database, cache, worker and backups are healthy").addOption(dirOption()).action(status);
 	program.command("check").description("Check the project: setup, Django checks, migrations and linters").addOption(dirOption()).option("--tests", "Run the backend and frontend tests too").action(check);
-	program.command("update").description("Pull and rebuild the images and update the DjangoStack packages").addOption(dirOption()).option("--all", "Update every backend package in uv.lock, not only django-stack").option("--no-cache", "Rebuild the images from scratch").option("--no-restart", "Don't restart what was running").action(update);
+	program.command("update").description("Pull and rebuild the images and update the DjangoStack packages").addOption(dirOption()).option("--all", "Update every package in the lockfiles, not only DjangoStack's").option("--no-cache", "Rebuild the images from scratch").option("--no-restart", "Don't restart what was running").action(update);
 	const configCommand = program.command("config").description("Change the stack options of a project").addOption(dirOption()).option("-y, --yes", "Don't ask; change only what the flags set").action((options, cmd) => config({
 		...options,
 		fromCli: (option) => cmd.getOptionValueSource(option) === "cli"
@@ -4552,7 +5338,7 @@ function createProgram() {
 	program.command("restore").description("Restore a backup over the database or the media (prod profile)").argument("<backup>", "A file name from `dstack backup --list`").addOption(dirOption()).option("--media", "Also restore the media backed up with this database dump").option("-y, --yes", "Don't ask for confirmation").action(restore);
 	program.command("types").description("Generate the frontend's API types from the backend's schema").addOption(dirOption()).action(types);
 	const providerOption = () => new Option("--provider <provider>", `The platform (default: ${DEFAULT_PROVIDER.id})`).choices(PROVIDERS.map((provider) => provider.id));
-	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy, Bunny or a server over SSH, and show the status");
+	const deployCommand = program.command("deploy").description("Deploy to Coolify, Dokploy, Bunny, Railway or a server over SSH, and show the status");
 	deployCommand.command("start", { isDefault: true }).description("Start a deploy and follow it; the same as `dstack deploy`").addOption(dirOption()).option("--force", "Rebuild the images without cache").option("--no-wait", "Don't follow the deploy; return once it started").option("--no-push-check", "Deploy even when it would not include your local commits or changes").option("-y, --yes", "Don't ask; fail when no API key is saved").action(deploy);
 	const setupCommand = deployCommand.command("setup").description("Create the project on the platform and link it to this directory").addOption(dirOption()).addOption(providerOption()).option("--url <url>", "The platform's address, such as https://coolify.example.com, or the server, such as deploy@example.com").option("--repository <url>", "The git repository the platform builds (default: the origin remote)").option("--branch <branch>", "The branch to deploy (default: the current one)").option("--deploy", "Deploy when done").option("--no-deploy", "Don't offer to deploy when done").option("--force", `Set up again, replacing the link in .dstack/deploy.json`).option("-y, --yes", "Don't ask; use the flags and the defaults").action(deploySetup);
 	const seen = /* @__PURE__ */ new Set();