@fabioplunser/epd 0.1.0

package/dist/cli.js

@@ -0,0 +1,3855 @@
+// @bun
+// src/cli.ts
+import { parseArgs } from "util";
+
+// src/util/log.ts
+var useColor = process.stdout.isTTY && process.env.NO_COLOR === undefined;
+var wrap = (code) => (s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s;
+var c = {
+  dim: wrap("2"),
+  bold: wrap("1"),
+  red: wrap("31"),
+  green: wrap("32"),
+  yellow: wrap("33"),
+  blue: wrap("34"),
+  magenta: wrap("35"),
+  cyan: wrap("36"),
+  gray: wrap("90")
+};
+var verbose = false;
+function setVerbose(v) {
+  verbose = v;
+}
+var started = Date.now();
+function stamp() {
+  const s = ((Date.now() - started) / 1000).toFixed(1).padStart(5, " ");
+  return c.gray(`${s}s`);
+}
+var log = {
+  step(msg) {
+    console.log(`${stamp()} ${c.blue("\u203A")} ${c.bold(msg)}`);
+  },
+  info(msg) {
+    console.log(`${stamp()}   ${msg}`);
+  },
+  ok(msg) {
+    console.log(`${stamp()} ${c.green("\u2713")} ${msg}`);
+  },
+  warn(msg) {
+    console.log(`${stamp()} ${c.yellow("!")} ${msg}`);
+  },
+  error(msg) {
+    console.error(`${stamp()} ${c.red("\u2717")} ${msg}`);
+  },
+  debug(msg) {
+    if (verbose)
+      console.log(`${stamp()} ${c.gray("\xB7")} ${c.gray(msg)}`);
+  },
+  plain(msg) {
+    console.log(msg);
+  },
+  host(host, msg) {
+    const p = c.magenta(host.padEnd(15).slice(0, 15));
+    for (const line of msg.split(`
+`))
+      if (line.length)
+        console.log(`${stamp()} ${p} ${line}`);
+  }
+};
+
+class EpdError extends Error {
+  hint;
+  constructor(message, hint) {
+    super(message);
+    this.hint = hint;
+    this.name = "EpdError";
+  }
+}
+
+// src/config/load.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { homedir } from "os";
+
+// src/util/misc.ts
+function hash32(s) {
+  let h = 2166136261;
+  for (let i = 0;i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+function shq(s) {
+  return `'${String(s).replaceAll("'", `'\\''`)}'`;
+}
+async function pool(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+    for (;; ) {
+      const i = next++;
+      if (i >= items.length)
+        return;
+      out[i] = await fn(items[i], i);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+function timestamp() {
+  const d = new Date;
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${d.getUTCFullYear()}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}` + `${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}`;
+}
+function dur(ms) {
+  if (ms < 1000)
+    return `${ms}ms`;
+  const s = ms / 1000;
+  if (s < 60)
+    return `${s.toFixed(1)}s`;
+  return `${Math.floor(s / 60)}m${String(Math.round(s % 60)).padStart(2, "0")}s`;
+}
+
+// src/config/load.ts
+var CONFIG_NAMES = ["epd.yml", "epd.yaml", ".epd.yml", "config/epd.yml"];
+function findConfigFile(startDir) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    for (const name of CONFIG_NAMES) {
+      const p = join(dir, name);
+      if (existsSync(p))
+        return p;
+    }
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function parseDotenv(text) {
+  const out = {};
+  for (let line of text.split(`
+`)) {
+    line = line.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    if (line.startsWith("export "))
+      line = line.slice(7).trim();
+    const eq = line.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = line.slice(0, eq).trim();
+    let val = line.slice(eq + 1).trim();
+    if (val.startsWith('"') && val.endsWith('"') && val.length > 1) {
+      val = val.slice(1, -1).replaceAll("\\n", `
+`).replaceAll("\\\"", '"');
+    } else if (val.startsWith("'") && val.endsWith("'") && val.length > 1) {
+      val = val.slice(1, -1);
+    } else {
+      const hash = val.indexOf(" #");
+      if (hash !== -1)
+        val = val.slice(0, hash).trim();
+    }
+    if (key)
+      out[key] = val;
+  }
+  return out;
+}
+function loadEnvironment(root, destination) {
+  const files = [".env", ".env.local"];
+  if (destination)
+    files.push(`.env.${destination}`, `.env.${destination}.local`);
+  const env = {};
+  for (const [k, v] of Object.entries(process.env))
+    if (v !== undefined)
+      env[k] = v;
+  for (const f of files) {
+    const p = join(root, f);
+    if (!existsSync(p))
+      continue;
+    for (const [k, v] of Object.entries(parseDotenv(readFileSync(p, "utf8")))) {
+      if (process.env[k] === undefined)
+        env[k] = v;
+    }
+  }
+  return env;
+}
+function interpolateText(text, env, file) {
+  return text.replace(/\$(\$?)\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (_m, escape, name, dflt) => {
+    if (escape)
+      return `\${${name}${dflt !== undefined ? `:-${dflt}` : ""}}`;
+    const v = env[name];
+    if (v !== undefined && v !== "")
+      return v;
+    if (dflt !== undefined)
+      return dflt;
+    throw new EpdError(`${file}: environment variable \${${name}} is not set`, `Export it, add it to .env, or write \${${name}:-fallback}.`);
+  });
+}
+function deepMerge(base, overlay) {
+  const out = Array.isArray(base) ? [...base] : { ...base };
+  for (const [k, v] of Object.entries(overlay)) {
+    const prev = out[k];
+    if (v && typeof v === "object" && !Array.isArray(v) && prev && typeof prev === "object" && !Array.isArray(prev)) {
+      out[k] = deepMerge(prev, v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function fail(path, msg, hint) {
+  throw new EpdError(`${path}: ${msg}`, hint);
+}
+function asString(v, path, dflt) {
+  if (v === undefined || v === null) {
+    if (dflt !== undefined)
+      return dflt;
+    fail(path, "is required");
+  }
+  if (typeof v === "string")
+    return v;
+  if (typeof v === "number" || typeof v === "boolean")
+    return String(v);
+  fail(path, `expected a string, got ${Array.isArray(v) ? "a list" : typeof v}`);
+}
+function asNumber(v, path, dflt) {
+  if (v === undefined || v === null) {
+    if (dflt !== undefined)
+      return dflt;
+    fail(path, "is required");
+  }
+  const n = typeof v === "number" ? v : Number(v);
+  if (!Number.isFinite(n))
+    fail(path, `expected a number, got ${JSON.stringify(v)}`);
+  return n;
+}
+function asBool(v, path, dflt) {
+  if (v === undefined || v === null)
+    return dflt;
+  if (typeof v === "boolean")
+    return v;
+  if (v === "true" || v === "yes" || v === 1)
+    return true;
+  if (v === "false" || v === "no" || v === 0)
+    return false;
+  fail(path, `expected true or false, got ${JSON.stringify(v)}`);
+}
+function asList(v, path) {
+  if (v === undefined || v === null)
+    return [];
+  if (typeof v === "string")
+    return [v];
+  if (Array.isArray(v))
+    return v.map((x, i) => asString(x, `${path}[${i}]`));
+  fail(path, "expected a string or a list of strings");
+}
+function asDict(v, path) {
+  if (v === undefined || v === null)
+    return {};
+  if (Array.isArray(v)) {
+    const out = {};
+    for (const [i, item] of v.entries()) {
+      const s = asString(item, `${path}[${i}]`);
+      const eq = s.indexOf("=");
+      if (eq === -1)
+        fail(`${path}[${i}]`, `expected "KEY=value", got ${JSON.stringify(s)}`);
+      out[s.slice(0, eq)] = s.slice(eq + 1);
+    }
+    return out;
+  }
+  if (typeof v === "object") {
+    const out = {};
+    for (const [k, val] of Object.entries(v))
+      out[k] = asString(val, `${path}.${k}`);
+    return out;
+  }
+  fail(path, "expected a mapping");
+}
+function checkKeys(obj, allowed, path) {
+  for (const k of Object.keys(obj)) {
+    if (!allowed.includes(k)) {
+      const near = allowed.map((a) => [a, levenshtein(a, k)]).sort((a, b) => a[1] - b[1]).filter(([, d]) => d <= 3)[0];
+      fail(`${path}.${k}`, "is not a known option", near ? `Did you mean "${near[0]}"?` : `Known options: ${allowed.join(", ")}`);
+    }
+  }
+}
+function levenshtein(a, b) {
+  const m = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+  for (let i = 0;i <= a.length; i++)
+    m[i][0] = i;
+  for (let j = 0;j <= b.length; j++)
+    m[0][j] = j;
+  for (let i = 1;i <= a.length; i++)
+    for (let j = 1;j <= b.length; j++)
+      m[i][j] = Math.min(m[i - 1][j] + 1, m[i][j - 1] + 1, m[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+  return m[a.length][b.length];
+}
+function expandHome(p) {
+  return p.startsWith("~/") ? join(homedir(), p.slice(2)) : p;
+}
+function parseRoute(raw, path, defaults) {
+  if (typeof raw === "string") {
+    const s = raw.trim();
+    const slash = s.indexOf("/");
+    const host = slash === -1 ? s : s.slice(0, slash);
+    const p = slash === -1 ? undefined : s.slice(slash);
+    return {
+      hosts: host === "*" || host === "" ? [] : [host],
+      path: p && p !== "/" ? p : undefined,
+      stripPath: false,
+      port: defaults.port,
+      ssl: defaults.ssl && host !== "*" && host !== "",
+      headers: {},
+      basicAuth: [],
+      sticky: false
+    };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    fail(path, "expected a domain string or a mapping");
+  const o = raw;
+  checkKeys(o, [
+    "host",
+    "hosts",
+    "domain",
+    "domains",
+    "path",
+    "strip_path",
+    "port",
+    "entrypoint",
+    "ssl",
+    "redirect",
+    "permanent",
+    "headers",
+    "basic_auth",
+    "priority",
+    "sticky"
+  ], path);
+  const hosts = [
+    ...asList(o.host ?? o.domain, `${path}.host`),
+    ...asList(o.hosts ?? o.domains, `${path}.hosts`)
+  ].filter((h) => h !== "*");
+  const redirectTo = o.redirect ? asString(o.redirect, `${path}.redirect`) : undefined;
+  return {
+    hosts,
+    path: o.path ? asString(o.path, `${path}.path`) : undefined,
+    stripPath: asBool(o.strip_path, `${path}.strip_path`, false),
+    port: asNumber(o.port, `${path}.port`, defaults.port),
+    entrypoint: o.entrypoint ? asString(o.entrypoint, `${path}.entrypoint`) : undefined,
+    ssl: asBool(o.ssl, `${path}.ssl`, defaults.ssl && hosts.length > 0),
+    redirect: redirectTo ? { to: redirectTo, permanent: asBool(o.permanent, `${path}.permanent`, true) } : undefined,
+    headers: asDict(o.headers, `${path}.headers`),
+    basicAuth: asList(o.basic_auth, `${path}.basic_auth`),
+    priority: o.priority !== undefined ? asNumber(o.priority, `${path}.priority`) : undefined,
+    sticky: asBool(o.sticky, `${path}.sticky`, false)
+  };
+}
+function parseHealth(raw, path, dflt) {
+  if (raw === undefined || raw === null)
+    return dflt;
+  if (raw === false)
+    return { ...dflt, path: null };
+  if (typeof raw === "string")
+    return { ...dflt, path: raw };
+  if (typeof raw !== "object")
+    fail(path, "expected a mapping, a path string, or false");
+  const o = raw;
+  checkKeys(o, ["path", "port", "status", "timeout", "interval", "delay", "host"], path);
+  return {
+    path: o.path === false || o.path === null ? null : asString(o.path, `${path}.path`, dflt.path ?? "/"),
+    port: o.port !== undefined ? asNumber(o.port, `${path}.port`) : dflt.port,
+    status: asString(o.status, `${path}.status`, dflt.status),
+    timeout: asNumber(o.timeout, `${path}.timeout`, dflt.timeout),
+    interval: asNumber(o.interval, `${path}.interval`, dflt.interval),
+    delay: asNumber(o.delay, `${path}.delay`, dflt.delay),
+    hostHeader: o.host ? asString(o.host, `${path}.host`) : dflt.hostHeader
+  };
+}
+function loadConfig(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = opts.file ? resolve(cwd, opts.file) : findConfigFile(cwd) ?? fail("epd.yml", "not found", "Run `epd init` to create one.");
+  if (!existsSync(configPath))
+    throw new EpdError(`config file not found: ${configPath}`);
+  const root = dirname(configPath);
+  const destination = opts.destination;
+  const env = loadEnvironment(root, destination);
+  let raw = parseYaml(configPath, env);
+  if (destination) {
+    const overlays = [
+      join(root, `epd.${destination}.yml`),
+      join(root, `epd.${destination}.yaml`),
+      join(root, "config", `epd.${destination}.yml`)
+    ].filter(existsSync);
+    if (!overlays.length) {
+      throw new EpdError(`no config found for destination "${destination}"`, `Create ${join(root, `epd.${destination}.yml`)} with the values that differ.`);
+    }
+    raw = deepMerge(raw, parseYaml(overlays[0], env));
+  }
+  return { config: normalize(raw, configPath, root, destination), env, raw };
+}
+function parseYaml(file, env) {
+  const text = interpolateText(readFileSync(file, "utf8"), env, file);
+  let parsed;
+  try {
+    parsed = Bun.YAML.parse(text);
+  } catch (e) {
+    throw new EpdError(`${file}: invalid YAML`, e instanceof Error ? e.message : String(e));
+  }
+  if (parsed === null || parsed === undefined)
+    return {};
+  if (typeof parsed !== "object" || Array.isArray(parsed))
+    throw new EpdError(`${file}: expected a mapping at the top level`);
+  return parsed;
+}
+var TOP_LEVEL_KEYS = [
+  "name",
+  "mode",
+  "image",
+  "registry",
+  "build",
+  "ssh",
+  "servers",
+  "services",
+  "proxy",
+  "accessories",
+  "env",
+  "volumes",
+  "hooks",
+  "process",
+  "port_base",
+  "strategy",
+  "keep_releases",
+  "remote_root",
+  "hosts",
+  "host",
+  "replicas",
+  "port",
+  "domain",
+  "domains",
+  "routes",
+  "command",
+  "healthcheck",
+  "health",
+  "labels",
+  "drain",
+  "stop_timeout",
+  "docker_options"
+];
+function normalize(raw, configPath, root, destination) {
+  checkKeys(raw, TOP_LEVEL_KEYS, "epd.yml");
+  const name = asString(raw.name, "epd.yml.name");
+  if (!/^[a-z0-9][a-z0-9_-]*$/i.test(name)) {
+    fail("epd.yml.name", "must be alphanumeric with dashes or underscores", `Got ${JSON.stringify(name)}.`);
+  }
+  const mode = asString(raw.mode, "epd.yml.mode", "docker");
+  if (mode !== "docker" && mode !== "process")
+    fail("epd.yml.mode", `expected "docker" or "process", got ${JSON.stringify(mode)}`);
+  const proxyRaw = raw.proxy ?? {};
+  checkKeys(proxyRaw, [
+    "enabled",
+    "image",
+    "version",
+    "network",
+    "ssl",
+    "email",
+    "challenge",
+    "dns_provider",
+    "dns_env",
+    "acme_server",
+    "entrypoints",
+    "https_redirect",
+    "dashboard",
+    "dashboard_host",
+    "log_level",
+    "access_log",
+    "cross_host",
+    "trusted_ips",
+    "private_ips",
+    "reload_wait",
+    "extra"
+  ], "epd.yml.proxy");
+  const ssl = asBool(proxyRaw.ssl, "epd.yml.proxy.ssl", true);
+  const entrypoints = {
+    web: 80,
+    ...ssl ? { websecure: 443 } : {}
+  };
+  for (const [k, v] of Object.entries(asDict(proxyRaw.entrypoints, "epd.yml.proxy.entrypoints"))) {
+    entrypoints[k] = asNumber(v, `epd.yml.proxy.entrypoints.${k}`);
+  }
+  const proxy = {
+    enabled: asBool(proxyRaw.enabled, "epd.yml.proxy.enabled", true),
+    image: asString(proxyRaw.image, "epd.yml.proxy.image", "traefik:v3.3"),
+    version: proxyRaw.version ? asString(proxyRaw.version, "epd.yml.proxy.version") : undefined,
+    network: asString(proxyRaw.network, "epd.yml.proxy.network", "epd"),
+    ssl,
+    email: proxyRaw.email ? asString(proxyRaw.email, "epd.yml.proxy.email") : undefined,
+    challenge: asString(proxyRaw.challenge, "epd.yml.proxy.challenge", "http"),
+    dnsProvider: proxyRaw.dns_provider ? asString(proxyRaw.dns_provider, "epd.yml.proxy.dns_provider") : undefined,
+    dnsEnv: asList(proxyRaw.dns_env, "epd.yml.proxy.dns_env"),
+    acmeServer: proxyRaw.acme_server ? asString(proxyRaw.acme_server, "epd.yml.proxy.acme_server") : undefined,
+    entrypoints,
+    httpsRedirect: asBool(proxyRaw.https_redirect, "epd.yml.proxy.https_redirect", ssl),
+    dashboard: asBool(proxyRaw.dashboard, "epd.yml.proxy.dashboard", false),
+    dashboardHost: proxyRaw.dashboard_host ? asString(proxyRaw.dashboard_host, "epd.yml.proxy.dashboard_host") : undefined,
+    logLevel: asString(proxyRaw.log_level, "epd.yml.proxy.log_level", "INFO"),
+    accessLog: asBool(proxyRaw.access_log, "epd.yml.proxy.access_log", false),
+    crossHost: asBool(proxyRaw.cross_host, "epd.yml.proxy.cross_host", false),
+    reloadWait: asNumber(proxyRaw.reload_wait, "epd.yml.proxy.reload_wait", 3),
+    trustedIps: asList(proxyRaw.trusted_ips, "epd.yml.proxy.trusted_ips"),
+    privateIps: asDict(proxyRaw.private_ips, "epd.yml.proxy.private_ips"),
+    extra: proxyRaw.extra ?? {}
+  };
+  if (!["http", "dns", "tlsalpn"].includes(proxy.challenge)) {
+    fail("epd.yml.proxy.challenge", `expected "http", "dns" or "tlsalpn", got ${JSON.stringify(proxy.challenge)}`);
+  }
+  if (proxy.challenge === "dns" && !proxy.dnsProvider) {
+    fail("epd.yml.proxy.dns_provider", 'is required when challenge is "dns"', "For example: dns_provider: cloudflare");
+  }
+  const globalEnv = raw.env;
+  const envClear = asDict(globalEnv?.clear ?? (globalEnv && !("clear" in globalEnv) && !("secret" in globalEnv) ? globalEnv : {}), "epd.yml.env");
+  const envSecret = asList(globalEnv?.secret, "epd.yml.env.secret");
+  const defaultHealth = {
+    path: "/",
+    status: "200-399",
+    timeout: 60,
+    interval: 2,
+    delay: 1
+  };
+  const rootHealth = parseHealth(raw.healthcheck ?? raw.health, "epd.yml.healthcheck", defaultHealth);
+  let servicesRaw = raw.services ?? raw.servers;
+  const inlineKeys = ["hosts", "host", "replicas", "port", "domain", "domains", "routes", "command", "labels", "volumes", "drain", "stop_timeout", "docker_options"];
+  const hasInline = inlineKeys.some((k) => raw[k] !== undefined);
+  if (hasInline) {
+    const inline = {};
+    for (const k of inlineKeys)
+      if (raw[k] !== undefined)
+        inline[k] = raw[k];
+    if (raw.healthcheck ?? raw.health)
+      inline.healthcheck = raw.healthcheck ?? raw.health;
+    servicesRaw = { web: inline, ...servicesRaw ?? {} };
+  }
+  if (!servicesRaw || !Object.keys(servicesRaw).length) {
+    fail("epd.yml.servers", "no servers defined", `Add:
+  servers:
+    web:
+      hosts: [1.2.3.4]
+      port: 3000
+      domains: [example.com]`);
+  }
+  const services = Object.entries(servicesRaw).map(([svcName, rawSvc]) => {
+    const p = `epd.yml.servers.${svcName}`;
+    let o;
+    if (Array.isArray(rawSvc))
+      o = { hosts: rawSvc };
+    else if (typeof rawSvc === "string")
+      o = { hosts: [rawSvc] };
+    else if (rawSvc && typeof rawSvc === "object")
+      o = rawSvc;
+    else
+      return fail(p, "expected a mapping or a list of hosts");
+    checkKeys(o, [
+      "hosts",
+      "host",
+      "replicas",
+      "port",
+      "command",
+      "routes",
+      "domain",
+      "domains",
+      "env",
+      "volumes",
+      "labels",
+      "healthcheck",
+      "health",
+      "docker_options",
+      "cpus",
+      "memory",
+      "drain",
+      "stop_timeout"
+    ], p);
+    const hosts = [...asList(o.host, `${p}.host`), ...asList(o.hosts, `${p}.hosts`)];
+    if (!hosts.length)
+      fail(`${p}.hosts`, "at least one host is required");
+    const port = asNumber(o.port, `${p}.port`, asNumber(raw.port, "epd.yml.port", 3000));
+    const routes = [];
+    for (const d of [...asList(o.domain, `${p}.domain`), ...asList(o.domains, `${p}.domains`)]) {
+      routes.push(parseRoute(d, `${p}.domains`, { port, ssl: proxy.ssl }));
+    }
+    const rawRoutes = o.routes === undefined ? [] : Array.isArray(o.routes) ? o.routes : [o.routes];
+    rawRoutes.forEach((r, i) => routes.push(parseRoute(r, `${p}.routes[${i}]`, { port, ssl: proxy.ssl })));
+    const svcEnvRaw = o.env;
+    const svcEnv = asDict(svcEnvRaw?.clear ?? (svcEnvRaw && !("clear" in svcEnvRaw) && !("secret" in svcEnvRaw) ? svcEnvRaw : {}), `${p}.env`);
+    return {
+      name: svcName,
+      hosts,
+      replicas: asNumber(o.replicas, `${p}.replicas`, 1),
+      port,
+      command: o.command === undefined ? undefined : asString(o.command, `${p}.command`),
+      routes,
+      env: { ...envClear, ...svcEnv },
+      secrets: [...envSecret, ...asList(svcEnvRaw?.secret, `${p}.env.secret`)],
+      volumes: [...asList(raw.volumes, "epd.yml.volumes"), ...asList(o.volumes, `${p}.volumes`)],
+      labels: { ...asDict(raw.labels, "epd.yml.labels"), ...asDict(o.labels, `${p}.labels`) },
+      health: parseHealth(o.healthcheck ?? o.health, `${p}.healthcheck`, { ...rootHealth, port: rootHealth.port ?? port }),
+      dockerOptions: [...asList(raw.docker_options, "epd.yml.docker_options"), ...asList(o.docker_options, `${p}.docker_options`)],
+      cpus: o.cpus ? asString(o.cpus, `${p}.cpus`) : undefined,
+      memory: o.memory ? asString(o.memory, `${p}.memory`) : undefined,
+      proxied: routes.length > 0,
+      drain: asNumber(o.drain, `${p}.drain`, asNumber(raw.drain, "epd.yml.drain", 10)),
+      stopTimeout: asNumber(o.stop_timeout, `${p}.stop_timeout`, asNumber(raw.stop_timeout, "epd.yml.stop_timeout", 30))
+    };
+  });
+  const accessories = Object.entries(raw.accessories ?? {}).map(([accName, rawAcc]) => {
+    const p = `epd.yml.accessories.${accName}`;
+    const o = rawAcc ?? {};
+    checkKeys(o, ["image", "host", "env", "volumes", "ports", "command", "docker_options", "routes", "domain", "domains", "port"], p);
+    const accPort = o.port !== undefined ? asNumber(o.port, `${p}.port`) : undefined;
+    const accEnvRaw = o.env;
+    const routes = [];
+    for (const d of [...asList(o.domain, `${p}.domain`), ...asList(o.domains, `${p}.domains`)]) {
+      routes.push(parseRoute(d, `${p}.domains`, { port: accPort ?? 80, ssl: proxy.ssl }));
+    }
+    const rawRoutes = o.routes === undefined ? [] : Array.isArray(o.routes) ? o.routes : [o.routes];
+    rawRoutes.forEach((r, i) => routes.push(parseRoute(r, `${p}.routes[${i}]`, { port: accPort ?? 80, ssl: proxy.ssl })));
+    return {
+      name: accName,
+      image: asString(o.image, `${p}.image`),
+      host: asString(o.host, `${p}.host`),
+      env: asDict(accEnvRaw?.clear ?? (accEnvRaw && !("clear" in accEnvRaw) && !("secret" in accEnvRaw) ? accEnvRaw : {}), `${p}.env`),
+      secrets: asList(accEnvRaw?.secret, `${p}.env.secret`),
+      volumes: asList(o.volumes, `${p}.volumes`),
+      ports: asList(o.ports, `${p}.ports`),
+      command: o.command === undefined ? undefined : asString(o.command, `${p}.command`),
+      dockerOptions: asList(o.docker_options, `${p}.docker_options`),
+      routes,
+      port: accPort
+    };
+  });
+  const regRaw = raw.registry;
+  let registry;
+  if (regRaw) {
+    checkKeys(regRaw, ["server", "username", "password"], "epd.yml.registry");
+    const pw = regRaw.password;
+    const passwordEnv = Array.isArray(pw) ? asString(pw[0], "epd.yml.registry.password[0]") : asString(pw, "epd.yml.registry.password");
+    registry = {
+      server: regRaw.server ? asString(regRaw.server, "epd.yml.registry.server") : undefined,
+      username: asString(regRaw.username, "epd.yml.registry.username"),
+      passwordEnv
+    };
+  }
+  const image = asString(raw.image, "epd.yml.image", registry ? `${registry.server ? registry.server + "/" : ""}${registry.username}/${name}` : name);
+  const buildRaw = raw.build ?? {};
+  checkKeys(buildRaw, ["dockerfile", "context", "platform", "target", "args", "secrets", "cache", "remote"], "epd.yml.build");
+  const sshRaw = raw.ssh ?? {};
+  checkKeys(sshRaw, ["user", "port", "key", "options", "proxy_jump", "control_persist"], "epd.yml.ssh");
+  const procRaw = raw.process ?? {};
+  checkKeys(procRaw, ["exclude", "install", "build", "start", "path", "path_prepend", "source"], "epd.yml.process");
+  const processCfg = {
+    exclude: asList(procRaw.exclude, "epd.yml.process.exclude").length ? asList(procRaw.exclude, "epd.yml.process.exclude") : [".git", "node_modules", ".env", ".env.*", "dist", ".next/cache", "tmp", "*.log"],
+    install: procRaw.install ? asString(procRaw.install, "epd.yml.process.install") : undefined,
+    build: procRaw.build ? asString(procRaw.build, "epd.yml.process.build") : undefined,
+    start: asString(procRaw.start, "epd.yml.process.start", mode === "process" ? "" : "-"),
+    path: procRaw.path ? asString(procRaw.path, "epd.yml.process.path") : undefined,
+    pathPrepend: asList(procRaw.path_prepend, "epd.yml.process.path_prepend").length ? asList(procRaw.path_prepend, "epd.yml.process.path_prepend") : ["$HOME/.bun/bin", "$HOME/.local/bin", "/usr/local/bin"],
+    source: asString(procRaw.source, "epd.yml.process.source", "rsync")
+  };
+  if (mode === "process" && !processCfg.start) {
+    fail("epd.yml.process.start", "is required in process mode", `For example:
+  process:
+    start: bun run start`);
+  }
+  const hooksRaw = raw.hooks ?? {};
+  checkKeys(hooksRaw, ["pre_build", "pre_deploy", "post_deploy", "on_failure"], "epd.yml.hooks");
+  const strategy = asString(raw.strategy, "epd.yml.strategy", "rolling");
+  if (strategy !== "rolling" && strategy !== "parallel")
+    fail("epd.yml.strategy", 'expected "rolling" or "parallel"');
+  const cfg = {
+    name,
+    mode,
+    destination,
+    configPath,
+    root,
+    image,
+    registry,
+    build: {
+      dockerfile: asString(buildRaw.dockerfile, "epd.yml.build.dockerfile", "Dockerfile"),
+      context: asString(buildRaw.context, "epd.yml.build.context", "."),
+      platform: asString(buildRaw.platform, "epd.yml.build.platform", "linux/amd64"),
+      target: buildRaw.target ? asString(buildRaw.target, "epd.yml.build.target") : undefined,
+      args: asDict(buildRaw.args, "epd.yml.build.args"),
+      secrets: asDict(buildRaw.secrets, "epd.yml.build.secrets"),
+      cache: asBool(buildRaw.cache, "epd.yml.build.cache", true),
+      remote: asBool(buildRaw.remote, "epd.yml.build.remote", false)
+    },
+    ssh: {
+      user: asString(sshRaw.user, "epd.yml.ssh.user", "root"),
+      port: asNumber(sshRaw.port, "epd.yml.ssh.port", 22),
+      key: sshRaw.key ? expandHome(asString(sshRaw.key, "epd.yml.ssh.key")) : undefined,
+      options: asList(sshRaw.options, "epd.yml.ssh.options"),
+      proxyJump: sshRaw.proxy_jump ? asString(sshRaw.proxy_jump, "epd.yml.ssh.proxy_jump") : undefined,
+      controlPersist: asString(sshRaw.control_persist, "epd.yml.ssh.control_persist", "60s")
+    },
+    services,
+    proxy,
+    accessories,
+    env: envClear,
+    secrets: envSecret,
+    volumes: asList(raw.volumes, "epd.yml.volumes"),
+    hooks: {
+      preBuild: hooksRaw.pre_build ? asString(hooksRaw.pre_build, "epd.yml.hooks.pre_build") : undefined,
+      preDeploy: hooksRaw.pre_deploy ? asString(hooksRaw.pre_deploy, "epd.yml.hooks.pre_deploy") : undefined,
+      postDeploy: hooksRaw.post_deploy ? asString(hooksRaw.post_deploy, "epd.yml.hooks.post_deploy") : undefined,
+      onFailure: hooksRaw.on_failure ? asString(hooksRaw.on_failure, "epd.yml.hooks.on_failure") : undefined
+    },
+    process: processCfg,
+    portBase: asNumber(raw.port_base, "epd.yml.port_base", 20000 + hash32(name) % 117 * 256),
+    strategy,
+    keepReleases: asNumber(raw.keep_releases, "epd.yml.keep_releases", 5),
+    remoteRoot: asString(raw.remote_root, "epd.yml.remote_root", "/var/lib/epd")
+  };
+  validateCrossReferences(cfg);
+  return cfg;
+}
+function validateCrossReferences(cfg) {
+  const entrypointNames = Object.keys(cfg.proxy.entrypoints);
+  const seen = new Map;
+  for (const svc of cfg.services) {
+    for (const route of svc.routes) {
+      if (route.entrypoint && !entrypointNames.includes(route.entrypoint)) {
+        fail(`epd.yml.servers.${svc.name}.routes`, `entrypoint "${route.entrypoint}" is not defined`, `Define it under proxy.entrypoints, e.g.
+  proxy:
+    entrypoints:
+      ${route.entrypoint}: 8080`);
+      }
+      if (route.ssl && !cfg.proxy.ssl) {
+        fail(`epd.yml.servers.${svc.name}.routes`, "route requests TLS but proxy.ssl is false");
+      }
+      for (const host of route.hosts) {
+        const key = `${host}${route.path ?? ""}`;
+        const owner = `${svc.name}`;
+        if (seen.has(key) && seen.get(key) !== owner) {
+          fail("epd.yml.servers", `"${key}" is routed by both ${seen.get(key)} and ${owner}`, "Give each route a distinct host or path.");
+        }
+        seen.set(key, owner);
+      }
+    }
+  }
+  if (cfg.mode === "process" || cfg.proxy.crossHost) {
+    for (const svc of cfg.services) {
+      for (const route of svc.routes) {
+        if (route.port !== svc.port) {
+          fail(`epd.yml.servers.${svc.name}.routes`, `route port ${route.port} differs from the server port ${svc.port}`, `${cfg.mode === "process" ? "Process mode" : "proxy.cross_host"} publishes one port per replica.
+` + `Give the route port ${svc.port}, or add a second server entry that listens on ${route.port}.`);
+        }
+      }
+    }
+  }
+  if (cfg.proxy.ssl && cfg.proxy.challenge !== "dns" && !cfg.proxy.email) {
+    const anySsl = cfg.services.some((s) => s.routes.some((r) => r.ssl));
+    if (anySsl)
+      fail("epd.yml.proxy.email", "is required for Let's Encrypt certificates", `proxy:
+  email: you@example.com`);
+  }
+  if (cfg.mode === "docker" && !cfg.registry && cfg.services.some((s) => s.hosts.length > 1)) {}
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { basename, join as join2 } from "path";
+
+// src/util/prompt.ts
+var isTTY = process.stdin.isTTY && process.stdout.isTTY;
+function interactive() {
+  return Boolean(isTTY);
+}
+async function readLine() {
+  for await (const line of console)
+    return line;
+  return "";
+}
+async function ask(question, dflt) {
+  if (!isTTY)
+    return dflt ?? "";
+  process.stdout.write(`${c.cyan("?")} ${question}${dflt ? c.gray(` (${dflt})`) : ""} `);
+  const answer = (await readLine()).trim();
+  return answer || dflt || "";
+}
+async function confirm(question, dflt = false) {
+  if (!isTTY)
+    return dflt;
+  const answer = (await ask(`${question} ${dflt ? "[Y/n]" : "[y/N]"}`)).toLowerCase();
+  if (!answer)
+    return dflt;
+  return answer === "y" || answer === "yes";
+}
+async function choose(question, options, dflt) {
+  if (!isTTY)
+    return dflt;
+  console.log(`${c.cyan("?")} ${question}`);
+  options.forEach((o, i) => console.log(`  ${i + 1}) ${o.label}${o.value === dflt ? c.gray(" (default)") : ""}`));
+  const answer = (await ask("Choose", String(options.findIndex((o) => o.value === dflt) + 1))).trim();
+  const idx = Number(answer) - 1;
+  return options[idx]?.value ?? dflt;
+}
+
+// src/commands/init.ts
+function detect(root) {
+  const name = basename(root).toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+  const hasDockerfile = existsSync2(join2(root, "Dockerfile"));
+  const pkgPath = join2(root, "package.json");
+  if (existsSync2(pkgPath)) {
+    let pkg = {};
+    try {
+      pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+    } catch {}
+    const bun = existsSync2(join2(root, "bun.lockb")) || existsSync2(join2(root, "bun.lock"));
+    const scripts = pkg.scripts ?? {};
+    const runner = bun ? "bun" : "npm";
+    return {
+      name: (pkg.name ?? name).replace(/^@[^/]+\//, "").replace(/[^a-z0-9_-]/gi, "-"),
+      runtime: bun ? "bun" : "node",
+      port: 3000,
+      install: bun ? "bun install --frozen-lockfile" : "npm ci --omit=dev",
+      build: scripts.build ? `${runner} run build` : undefined,
+      start: scripts.start ? `${runner} run start` : bun ? "bun run index.ts" : "node index.js",
+      hasDockerfile
+    };
+  }
+  if (existsSync2(join2(root, "pyproject.toml")) || existsSync2(join2(root, "requirements.txt"))) {
+    return { name, runtime: "python", port: 8000, install: "pip install -r requirements.txt", start: "python -m uvicorn main:app --host 127.0.0.1 --port $PORT", hasDockerfile };
+  }
+  if (existsSync2(join2(root, "Gemfile"))) {
+    return { name, runtime: "ruby", port: 3000, install: "bundle install --deployment", start: "bundle exec rails server -p $PORT", hasDockerfile };
+  }
+  if (existsSync2(join2(root, "go.mod"))) {
+    return { name, runtime: "go", port: 8080, build: "go build -o server .", start: "./server", hasDockerfile };
+  }
+  return { name, runtime: "unknown", port: 3000, hasDockerfile };
+}
+function template(o) {
+  const list = (xs) => `[${xs.map((x) => JSON.stringify(x)).join(", ")}]`;
+  const portBase = 20000 + hash32(o.name) % 117 * 256;
+  const registry = o.registryUser ? `
+# Where built images live. Leave this out entirely and epd will copy the image
+# to each server over SSH instead (slower, but no registry account needed).
+registry:
+  ${o.registryServer ? `server: ${o.registryServer}
+  ` : ""}username: ${o.registryUser}
+  password: \${EPD_REGISTRY_PASSWORD}
+` : `
+# No registry configured: epd ships the built image to each server over SSH.
+# Add one once you have more than a couple of servers:
+#
+# registry:
+#   server: ghcr.io
+#   username: your-user
+#   password: \${GITHUB_TOKEN}
+`;
+  const processBlock = o.mode === "process" ? `
+# No Docker: each replica is started with pm2 and gets a unique $PORT.
+process:
+  ${o.detected.install ? `install: ${o.detected.install}` : "# install: bun install --frozen-lockfile"}
+  ${o.detected.build ? `build: ${o.detected.build}` : "# build: bun run build"}
+  start: ${o.detected.start ?? "bun run start"}
+  # Files that never need to reach the server.
+  exclude: [".git", "node_modules", ".env", "dist", "*.log"]
+` : "";
+  return `# ${o.name} \u2014 deployed with epd (https://github.com/you/epd)
+#
+#   epd setup     prepare the servers and deploy for the first time
+#   epd deploy    build and deploy the current commit
+#   epd status    see what is running where
+#   epd rollback  go back to the previous version
+#
+name: ${o.name}
+
+# "docker" builds an image from your Dockerfile. "process" uploads the project
+# and runs it with pm2 \u2014 no Docker on the server at all.
+mode: ${o.mode}
+${o.mode === "docker" ? `
+# Image name. Tagged with the git sha of every deploy.
+image: ${o.image ?? o.name}
+${registry}` : ""}${processBlock}
+# One entry per group of processes. Add more (worker, cron, \u2026) as you need them.
+servers:
+  web:
+    hosts: ${list(o.hosts)}
+    # Replicas per host. Traefik load balances across all of them, and across
+    # every host when proxy.cross_host is on.
+    replicas: ${o.replicas}
+    port: ${o.port}
+    domains: ${list(o.domains)}
+    # Routes give you finer control \u2014 several sites, paths and ports per app:
+    #
+    # routes:
+    #   - host: ${o.domains[0] ?? "example.com"}
+    #   - host: api.${o.domains[0] ?? "example.com"}
+    #     port: 8080
+    #   - host: ${o.domains[0] ?? "example.com"}
+    #     path: /admin
+    #     port: 4000
+    #     basic_auth: ["admin:$apr1$..."]
+
+  # worker:
+  #   hosts: ${list(o.hosts.slice(0, 1))}
+  #   command: bun run worker.ts
+
+# Traefik runs once per server and is shared by every epd app on it, so you can
+# host as many sites on one machine as you like.
+proxy:
+  ssl: true
+  email: ${o.email || "you@example.com"}
+  # Route to replicas on *other* servers too, so one machine can serve while
+  # another is down. Needs the app port reachable between servers.
+  cross_host: false
+  # private_ips: { "203.0.113.10": "10.0.0.10" }
+
+# Zero-downtime health check for the new version before traffic moves to it.
+healthcheck:
+  path: /
+  timeout: 60
+
+env:
+  clear:
+    NODE_ENV: production
+  # Read from your shell or .env at deploy time and written to the server
+  # as a 0600 file. Never committed.
+  secret:
+    # - DATABASE_URL
+
+# Long-lived containers epd starts but never rebuilds, like a database.
+# accessories:
+#   db:
+#     image: postgres:17
+#     host: ${o.hosts[0] ?? "203.0.113.10"}
+#     env:
+#       clear:
+#         POSTGRES_DB: ${o.name}
+#       secret:
+#         - POSTGRES_PASSWORD
+#     volumes:
+#       - /var/lib/epd/volumes/${o.name}-db:/var/lib/postgresql/data
+
+# hooks:
+#   pre_deploy: ./bin/run-tests
+#   post_deploy: ./bin/notify-slack
+
+# Host ports epd reserves on each server (only used in process mode or with
+# cross_host). Change it if two apps ever collide.
+port_base: ${portBase}
+`;
+}
+var DOCKERFILES = {
+  bun: `# syntax=docker/dockerfile:1
+FROM oven/bun:1 AS base
+WORKDIR /app
+
+FROM base AS deps
+COPY package.json bun.lock* bun.lockb* ./
+RUN bun install --frozen-lockfile
+
+FROM base AS build
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN bun run build || true
+
+FROM base AS run
+ENV NODE_ENV=production
+COPY --from=build /app ./
+EXPOSE 3000
+CMD ["bun", "run", "start"]
+`,
+  node: `# syntax=docker/dockerfile:1
+FROM node:22-slim AS base
+WORKDIR /app
+
+FROM base AS deps
+COPY package*.json ./
+RUN npm ci
+
+FROM base AS build
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN npm run build --if-present
+
+FROM base AS run
+ENV NODE_ENV=production
+COPY --from=build /app ./
+RUN npm prune --omit=dev
+EXPOSE 3000
+CMD ["npm", "run", "start"]
+`
+};
+var init = {
+  name: "init",
+  summary: "Create an epd.yml for this project",
+  options: {
+    name: { type: "string" },
+    mode: { type: "string" },
+    host: { type: "string", multiple: true },
+    domain: { type: "string", multiple: true },
+    port: { type: "string" },
+    email: { type: "string" },
+    replicas: { type: "string" },
+    force: { type: "boolean" },
+    dockerfile: { type: "boolean" }
+  },
+  help: () => `${c.bold("epd init")} \u2014 create an epd.yml for this project
+
+Options
+  --name <name>        App name (default: the directory name)
+  --mode <docker|process>
+  --host <ip>          Server to deploy to (repeatable)
+  --domain <domain>    Domain to serve (repeatable)
+  --port <port>        Port your app listens on
+  --email <email>      Contact address for Let's Encrypt
+  --replicas <n>       Replicas per host (default 1)
+  --dockerfile         Also write a starter Dockerfile
+  --force              Overwrite an existing epd.yml`,
+  async run(ctx) {
+    const root = process.cwd();
+    const target = join2(root, "epd.yml");
+    if (existsSync2(target) && !ctx.values.force) {
+      throw new EpdError("epd.yml already exists", "Pass --force to overwrite it.");
+    }
+    const detected = detect(root);
+    log.info(`Detected ${c.bold(detected.runtime)} project${detected.hasDockerfile ? " with a Dockerfile" : ""}`);
+    const name = ctx.values.name ?? await ask("App name", detected.name);
+    const mode = ctx.values.mode ?? await choose("How should it run on the server?", [
+      { value: "docker", label: "Docker \u2014 build an image, run containers" },
+      { value: "process", label: "Process \u2014 upload the code, run it with pm2" }
+    ], detected.hasDockerfile || detected.runtime === "unknown" ? "docker" : "docker");
+    if (mode !== "docker" && mode !== "process")
+      throw new EpdError(`--mode must be "docker" or "process"`);
+    const hosts = (ctx.values.host ?? []).length ? ctx.values.host : (await ask("Server IPs or hostnames (comma separated)", "203.0.113.10")).split(",").map((s) => s.trim()).filter(Boolean);
+    const domains = (ctx.values.domain ?? []).length ? ctx.values.domain : (await ask("Domains to serve (comma separated)", `${name}.example.com`)).split(",").map((s) => s.trim()).filter(Boolean);
+    const port = Number(ctx.values.port ?? await ask("Port your app listens on", String(detected.port)));
+    const email = ctx.values.email ?? await ask("Email for Let's Encrypt", "");
+    const replicas = Number(ctx.values.replicas ?? 1);
+    let registryUser;
+    let registryServer;
+    let image;
+    if (mode === "docker" && interactive() && await confirm("Push images to a registry (ghcr.io, Docker Hub, \u2026)?", false)) {
+      registryServer = await ask("Registry server", "ghcr.io") || undefined;
+      registryUser = await ask("Registry username", process.env.USER ?? "");
+      image = `${registryServer ? `${registryServer}/` : ""}${registryUser}/${name}`;
+    }
+    writeFileSync(target, template({ name, mode, hosts, domains, port, email, image, registryServer, registryUser, detected, replicas }));
+    log.ok(`wrote ${c.bold("epd.yml")}`);
+    const wantDockerfile = mode === "docker" && !detected.hasDockerfile && (Boolean(ctx.values.dockerfile) || await confirm("No Dockerfile here. Write a starter one?", true));
+    if (wantDockerfile) {
+      const df = DOCKERFILES[detected.runtime];
+      if (df) {
+        writeFileSync(join2(root, "Dockerfile"), df);
+        log.ok(`wrote ${c.bold("Dockerfile")} \u2014 check the build and start commands`);
+      } else {
+        log.warn(`no Dockerfile template for ${detected.runtime}; write one yourself or use \`mode: process\``);
+      }
+    }
+    console.log(`
+${c.bold("Next")}
+  1. Edit ${c.cyan("epd.yml")} \u2014 servers, domains, env.
+  2. Point your domains' A records at ${hosts.join(", ")}.
+  3. ${c.cyan("epd setup")}   installs what the servers need and deploys.
+  4. ${c.cyan("epd deploy")}  every time after that.
+`);
+  }
+};
+
+// src/util/proc.ts
+async function run(cmd, opts = {}) {
+  const label = opts.label ?? cmd.join(" ");
+  log.debug(`local: ${cmd.join(" ")}`);
+  const proc = Bun.spawn(cmd, {
+    cwd: opts.cwd,
+    env: opts.env ? { ...process.env, ...opts.env } : process.env,
+    stdin: opts.input !== undefined ? new TextEncoder().encode(opts.input) : "inherit",
+    stdout: opts.stream ? "inherit" : "pipe",
+    stderr: opts.stream ? "inherit" : "pipe"
+  });
+  const [stdout, stderr, code] = await Promise.all([
+    opts.stream ? Promise.resolve("") : new Response(proc.stdout).text(),
+    opts.stream ? Promise.resolve("") : new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const result = { code, stdout: stdout.trim(), stderr: stderr.trim() };
+  if (code !== 0 && !opts.allowFailure) {
+    throw new EpdError(`command failed (exit ${code}): ${label}`, result.stderr || result.stdout || undefined);
+  }
+  return result;
+}
+async function runShell(script, opts = {}) {
+  return run(["/bin/sh", "-c", script], { ...opts, label: opts.label ?? script });
+}
+async function which(bin) {
+  const r = await run(["/bin/sh", "-c", `command -v ${bin}`], { allowFailure: true });
+  return r.code === 0 && r.stdout ? r.stdout.split(`
+`)[0].trim() : null;
+}
+async function requireLocal(bin, hint) {
+  if (!await which(bin))
+    throw new EpdError(`\`${bin}\` was not found on this machine`, hint);
+}
+
+// src/config/types.ts
+function allHosts(cfg) {
+  const s = new Set;
+  for (const svc of cfg.services)
+    for (const h of svc.hosts)
+      s.add(h);
+  for (const a of cfg.accessories)
+    s.add(a.host);
+  return [...s];
+}
+function proxyHosts(cfg) {
+  if (!cfg.proxy.enabled)
+    return [];
+  const s = new Set;
+  for (const svc of cfg.services)
+    if (svc.routes.length)
+      for (const h of svc.hosts)
+        s.add(h);
+  for (const a of cfg.accessories)
+    if (a.routes.length)
+      s.add(a.host);
+  return [...s];
+}
+
+// src/core/names.ts
+var SLOTS = ["blue", "green"];
+var otherSlot = (s) => s === "blue" ? "green" : "blue";
+var MAX_REPLICAS = 16;
+var PORTS_PER_SERVICE = 32;
+var MAX_SERVICES = 8;
+var containerName = (app, svc, slot, i) => `epd-${app}-${svc}-${slot}-${i}`;
+var accessoryContainer = (app, name) => `epd-${app}-acc-${name}`;
+var processName = (app, svc, slot, i) => `epd-${app}-${svc}-${slot}-${i}`;
+var PROXY_CONTAINER = "epd-proxy";
+var PROXY_PROCESS = "epd-proxy";
+function paths(cfg) {
+  const root = cfg.remoteRoot;
+  const app = `${root}/apps/${cfg.name}`;
+  return {
+    root,
+    app,
+    envFile: `${app}/env`,
+    state: `${app}/state.json`,
+    lock: `${app}/lock`,
+    releases: `${app}/releases`,
+    current: `${app}/current`,
+    shared: `${app}/shared`,
+    proxyDir: `${root}/proxy`,
+    proxyStatic: `${root}/proxy/traefik.yml`,
+    proxyDynamicDir: `${root}/proxy/dynamic`,
+    proxyAppsDir: `${root}/proxy/apps`,
+    proxyApp: `${root}/proxy/apps/${cfg.name}.json`,
+    proxyEnv: `${root}/proxy/env`,
+    proxyDynamic: `${root}/proxy/dynamic/${cfg.name}.yml`,
+    acmeDir: `${root}/proxy/acme`,
+    portsDir: `${root}/ports`,
+    proxyBin: `${root}/proxy/bin/traefik`,
+    proxyEcosystem: `${root}/proxy/pm2.json`,
+    proxyLogDir: `${root}/proxy/log`
+  };
+}
+function serviceIndex(cfg, svc) {
+  const names = cfg.services.map((s) => s.name).sort();
+  const idx = names.indexOf(svc.name);
+  if (idx >= MAX_SERVICES) {
+    throw new EpdError(`too many servers: epd reserves ports for ${MAX_SERVICES} per app`, "Split the extra ones into their own epd.yml.");
+  }
+  return idx;
+}
+function hostPort(cfg, svc, slot, replica) {
+  if (replica >= MAX_REPLICAS) {
+    throw new EpdError(`${svc.name}: at most ${MAX_REPLICAS} replicas per server are supported`, "Add more servers instead, or run several epd apps.");
+  }
+  const j = serviceIndex(cfg, svc);
+  const s = SLOTS.indexOf(slot);
+  return cfg.portBase + j * PORTS_PER_SERVICE + s * MAX_REPLICAS + replica;
+}
+function portBlock(cfg) {
+  return { from: cfg.portBase, to: cfg.portBase + MAX_SERVICES * PORTS_PER_SERVICE - 1 };
+}
+function usesHostPorts(cfg) {
+  return cfg.mode === "process" || cfg.proxy.crossHost;
+}
+function privateAddress(cfg, host) {
+  return cfg.proxy.privateIps[host] ?? host;
+}
+function bindAddress(cfg, host) {
+  return cfg.proxy.privateIps[host] ?? "0.0.0.0";
+}
+function endpointsFor(cfg, svc, slot, serverHost, containerIp) {
+  const out = [];
+  for (let i = 0;i < svc.replicas; i++) {
+    if (cfg.mode === "process") {
+      const port = hostPort(cfg, svc, slot, i);
+      out.push({
+        url: `http://127.0.0.1:${port}`,
+        probeHost: "127.0.0.1",
+        probePort: port,
+        id: processName(cfg.name, svc.name, slot, i),
+        replica: i
+      });
+    } else if (cfg.proxy.crossHost) {
+      const port = hostPort(cfg, svc, slot, i);
+      out.push({
+        url: `http://${privateAddress(cfg, serverHost)}:${port}`,
+        probeHost: "127.0.0.1",
+        probePort: port,
+        id: containerName(cfg.name, svc.name, slot, i),
+        replica: i
+      });
+    } else {
+      const id = containerName(cfg.name, svc.name, slot, i);
+      out.push({
+        url: `http://${id}:${svc.port}`,
+        probeHost: containerIp?.(id) ?? id,
+        probePort: svc.port,
+        id,
+        replica: i
+      });
+    }
+  }
+  return out;
+}
+
+// src/core/bootstrap.ts
+async function ensureDirs(host, cfg) {
+  const p = paths(cfg);
+  await host.exec(`mkdir -p ${shq(p.app)} ${shq(p.proxyDynamicDir)} ${shq(p.proxyAppsDir)} ${shq(p.acmeDir)} ${shq(p.portsDir)} ${shq(p.releases)} ${shq(p.shared)}
+chmod 700 ${shq(p.acmeDir)}`);
+}
+async function reservePorts(host, cfg) {
+  if (!usesHostPorts(cfg))
+    return;
+  const { from, to } = portBlock(cfg);
+  const file = `${paths(cfg).portsDir}/${from}`;
+  const owner = await host.capture(`mkdir -p ${shq(paths(cfg).portsDir)}
+if [ -f ${shq(file)} ]; then cat ${shq(file)}; else printf '%s' ${shq(cfg.name)} > ${shq(file)}; printf '%s' ${shq(cfg.name)}; fi`);
+  if (owner.trim() !== cfg.name) {
+    throw new EpdError(`${host.name}: ports ${from}-${to} are already reserved by "${owner.trim()}"`, `Pick a different block in epd.yml, for example:
+  port_base: ${from + 256}`);
+  }
+}
+async function hasDocker(host) {
+  return host.test("command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1");
+}
+async function installDocker(host) {
+  if (await hasDocker(host)) {
+    log.host(host.name, "docker is already installed");
+    return;
+  }
+  log.host(host.name, "installing docker (get.docker.com)\u2026");
+  await host.exec(`if command -v docker >/dev/null 2>&1; then
+  systemctl enable --now docker 2>/dev/null || true
+else
+  export DEBIAN_FRONTEND=noninteractive
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL https://get.docker.com -o /tmp/epd-get-docker.sh
+  else
+    (apt-get update -qq && apt-get install -y -qq curl) >/dev/null 2>&1 || true
+    curl -fsSL https://get.docker.com -o /tmp/epd-get-docker.sh
+  fi
+  sh /tmp/epd-get-docker.sh
+  rm -f /tmp/epd-get-docker.sh
+  systemctl enable --now docker 2>/dev/null || true
+fi
+docker info >/dev/null`, { stream: true });
+  log.host(host.name, "docker ready");
+}
+async function ensureNetwork(host, cfg) {
+  const net = cfg.proxy.network;
+  await host.exec(`docker network inspect ${shq(net)} >/dev/null 2>&1 || docker network create ${shq(net)} >/dev/null`);
+}
+async function verifyHost(host, cfg) {
+  await host.ping();
+  if (cfg.mode === "docker") {
+    if (!await hasDocker(host)) {
+      throw new EpdError(`${host.name}: docker is not installed or not usable by ${host.target}`, "Run `epd setup` to install it.");
+    }
+  } else {
+    const missing = [];
+    for (const bin of ["rsync", "pm2"]) {
+      if (!await host.test(`${pathPrelude(cfg)} command -v ${bin} >/dev/null 2>&1`))
+        missing.push(bin);
+    }
+    if (missing.length) {
+      throw new EpdError(`${host.name}: missing ${missing.join(", ")}`, "Run `epd setup` to install the process-mode runtime.");
+    }
+  }
+  await ensureDirs(host, cfg);
+  await reservePorts(host, cfg);
+}
+function pathPrelude(cfg) {
+  const extra = cfg.process.pathPrepend.join(":");
+  return `PATH="${extra}:$PATH"`;
+}
+async function installProcessRuntime(host, cfg) {
+  log.host(host.name, "preparing process-mode runtime\u2026");
+  await host.exec(`export DEBIAN_FRONTEND=noninteractive
+${pathPrelude(cfg)}
+
+# bun runs most process-mode apps and can install pm2 without npm's huge
+# dependency tree. node is installed too because pm2 itself is a node program.
+if ! command -v bun >/dev/null 2>&1; then
+  curl -fsSL https://bun.sh/install | bash >/dev/null 2>&1     || echo "note: bun could not be installed; your start command must use another runtime" >&2
+fi
+
+${pathPrelude(cfg)}
+if ! command -v pm2 >/dev/null 2>&1; then
+  if command -v bun >/dev/null 2>&1; then bun install -g pm2 >/dev/null
+  elif command -v npm >/dev/null 2>&1; then npm install -g pm2 >/dev/null
+  else echo "neither bun nor npm is available to install pm2" >&2; exit 1
+  fi
+fi
+
+${pathPrelude(cfg)}
+command -v node >/dev/null 2>&1 || { echo "node is required to run pm2" >&2; exit 1; }
+command -v pm2 >/dev/null 2>&1 || { echo "pm2 was installed but is not on PATH" >&2; exit 1; }
+pm2 ping >/dev/null 2>&1 || true
+echo "node $(node --version), pm2 $(pm2 --version 2>/dev/null | tail -n 1)$(command -v bun >/dev/null 2>&1 && echo ", bun $(bun --version)")"`, { sudo: false, stream: true, label: `${host.name}: install process runtime` });
+  log.host(host.name, "process runtime ready");
+}
+async function installSystemPackages(host) {
+  await host.exec(`export DEBIAN_FRONTEND=noninteractive
+missing=""
+for bin in rsync curl tar unzip; do command -v "$bin" >/dev/null 2>&1 || missing="$missing $bin"; done
+command -v node >/dev/null 2>&1 || missing="$missing nodejs"
+if [ -n "$missing" ]; then
+  if command -v apt-get >/dev/null 2>&1; then apt-get update -qq && apt-get install -y -qq $missing
+  elif command -v dnf >/dev/null 2>&1; then dnf install -y -q $missing
+  elif command -v apk >/dev/null 2>&1; then apk add --no-cache $missing
+  elif command -v pacman >/dev/null 2>&1; then pacman -Sy --noconfirm $missing
+  fi
+fi
+true`, { allowFailure: true, stream: true, label: `${host.name}: install packages` });
+}
+
+// src/core/ssh.ts
+import { mkdirSync } from "fs";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+var controlDir = join3(tmpdir(), `epd-${process.getuid?.() ?? 0}`);
+mkdirSync(controlDir, { recursive: true, mode: 448 });
+
+class Host {
+  name;
+  cfg;
+  sudo;
+  constructor(name, cfg) {
+    this.name = name;
+    this.cfg = cfg;
+    this.sudo = cfg.user !== "root";
+  }
+  sshOptions() {
+    const socket = join3(controlDir, `${hash32(`${this.cfg.user}@${this.name}:${this.cfg.port}`).toString(36)}.sock`);
+    const args = [
+      "-o",
+      "BatchMode=yes",
+      "-o",
+      "StrictHostKeyChecking=accept-new",
+      "-o",
+      "ConnectTimeout=10",
+      "-o",
+      "ServerAliveInterval=15",
+      "-o",
+      "ControlMaster=auto",
+      "-o",
+      `ControlPath=${socket}`,
+      "-o",
+      `ControlPersist=${this.cfg.controlPersist}`,
+      "-p",
+      String(this.cfg.port)
+    ];
+    if (this.cfg.key)
+      args.push("-i", this.cfg.key, "-o", "IdentitiesOnly=yes");
+    if (this.cfg.proxyJump)
+      args.push("-J", this.cfg.proxyJump);
+    for (const o of this.cfg.options)
+      args.push("-o", o);
+    return args;
+  }
+  get target() {
+    return `${this.cfg.user}@${this.name}`;
+  }
+  rsyncShell() {
+    return ["ssh", ...this.sshOptions()].map((a) => /[^\w@%+=:,./-]/.test(a) ? shq(a) : a).join(" ");
+  }
+  async exec(script, opts = {}) {
+    const prelude = ["set -euo pipefail"];
+    for (const [k, v] of Object.entries(opts.env ?? {}))
+      prelude.push(`export ${k}=${shq(v)}`);
+    const body = `${prelude.join(`
+`)}
+${script}
+`;
+    log.debug(`${this.name}: ${script.split(`
+`).filter(Boolean)[0] ?? ""}`);
+    const useSudo = opts.sudo ?? this.sudo;
+    const remote = useSudo ? ["sudo", "-n", "bash", "-s"] : ["bash", "-s"];
+    const res = await run(["ssh", ...this.sshOptions(), this.target, "--", ...remote], {
+      input: body,
+      stream: opts.stream,
+      allowFailure: true,
+      label: opts.label ?? `${this.name}: ${script.split(`
+`).filter(Boolean)[0]}`
+    });
+    if (res.code !== 0 && !opts.allowFailure) {
+      const detail = [res.stdout, res.stderr].filter(Boolean).join(`
+`).trim();
+      throw new EpdError(`${this.name}: remote command failed (exit ${res.code})`, detail || (res.code === 255 ? "ssh could not connect. Check the host, port, user and key." : undefined));
+    }
+    return res;
+  }
+  async capture(script, opts = {}) {
+    return (await this.exec(script, opts)).stdout;
+  }
+  async test(script) {
+    return (await this.exec(script, { allowFailure: true })).code === 0;
+  }
+  async interactive(command, opts = {}) {
+    const wrapped = opts.sudo ?? this.sudo ? `sudo -n bash -lc ${shq(command)}` : `bash -lc ${shq(command)}`;
+    const proc = Bun.spawn(["ssh", "-tt", ...this.sshOptions(), this.target, "--", wrapped], {
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit"
+    });
+    return await proc.exited;
+  }
+  async writeFile(path, content, mode = "644") {
+    const marker = `EPD_EOF_${hash32(path + content.length).toString(36)}`;
+    await this.exec(`mkdir -p ${shq(dirnameOf(path))}
+umask 077
+cat > ${shq(path)}.tmp <<'${marker}'
+${content}
+${marker}
+chmod ${mode} ${shq(path)}.tmp
+mv -f ${shq(path)}.tmp ${shq(path)}`, { label: `${this.name}: write ${path}` });
+  }
+  async readFile(path) {
+    const res = await this.exec(`cat ${shq(path)} 2>/dev/null || true`, { allowFailure: true });
+    return res.stdout || null;
+  }
+  async pipeInto(remoteCommand, localCommand) {
+    const remote = this.sudo ? `sudo -n bash -c ${shq(remoteCommand)}` : `bash -c ${shq(remoteCommand)}`;
+    const sshArgs = ["ssh", ...this.sshOptions(), this.target, "--", remote];
+    const script = `set -euo pipefail; ${localCommand.map((a) => shq(a)).join(" ")} | ${sshArgs.map((a) => shq(a)).join(" ")}`;
+    await run(["/bin/sh", "-c", script], { stream: true, label: `pipe \u2192 ${this.name}` });
+  }
+  async ping() {
+    const res = await this.exec("echo epd-ok", { allowFailure: true });
+    if (res.code !== 0 || !res.stdout.includes("epd-ok")) {
+      throw new EpdError(`cannot reach ${this.target}:${this.cfg.port}`, res.stderr || "Check that the host is up and your SSH key is authorized.");
+    }
+  }
+}
+function dirnameOf(p) {
+  const i = p.lastIndexOf("/");
+  return i <= 0 ? "/" : p.slice(0, i);
+}
+var cache = new Map;
+function host(name, cfg) {
+  const key = `${cfg.user}@${name}:${cfg.port}`;
+  let h = cache.get(key);
+  if (!h) {
+    h = new Host(name, cfg);
+    cache.set(key, h);
+  }
+  return h;
+}
+
+// src/proxy/traefik.ts
+var CERT_RESOLVER = "epd";
+function declFor(cfg) {
+  return {
+    app: cfg.name,
+    image: cfg.proxy.image,
+    version: cfg.proxy.version,
+    network: cfg.proxy.network,
+    entrypoints: cfg.proxy.entrypoints,
+    ssl: cfg.proxy.ssl,
+    email: cfg.proxy.email,
+    challenge: cfg.proxy.challenge,
+    dnsProvider: cfg.proxy.dnsProvider,
+    dnsEnv: cfg.proxy.dnsEnv,
+    acmeServer: cfg.proxy.acmeServer,
+    logLevel: cfg.proxy.logLevel,
+    accessLog: cfg.proxy.accessLog,
+    dashboard: cfg.proxy.dashboard,
+    dashboardHost: cfg.proxy.dashboardHost,
+    trustedIps: cfg.proxy.trustedIps,
+    extra: cfg.proxy.extra
+  };
+}
+async function readDecls(host2, cfg) {
+  const dir = paths(cfg).proxyAppsDir;
+  const out = await host2.capture(`for f in ${shq(dir)}/*.json; do [ -f "$f" ] || continue; echo "###EPD_FILE"; cat "$f"; done`, { allowFailure: true });
+  const decls = [];
+  for (const chunk of out.split("###EPD_FILE")) {
+    const t = chunk.trim();
+    if (!t)
+      continue;
+    try {
+      decls.push(JSON.parse(t));
+    } catch {
+      log.warn(`${host2.name}: ignoring an unreadable proxy declaration`);
+    }
+  }
+  return decls;
+}
+function mergeDecls(decls) {
+  const base = {
+    app: "*",
+    image: "traefik:v3.3",
+    network: "epd",
+    entrypoints: {},
+    ssl: false,
+    challenge: "http",
+    dnsEnv: [],
+    logLevel: "INFO",
+    accessLog: false,
+    dashboard: false,
+    trustedIps: [],
+    extra: {}
+  };
+  const owners = {};
+  for (const d of decls) {
+    for (const [name, port] of Object.entries(d.entrypoints)) {
+      const existing = base.entrypoints[name];
+      if (existing !== undefined && existing !== port) {
+        throw new EpdError(`proxy entrypoint "${name}" is port ${existing} for ${owners[name]} but ${port} for ${d.app}`, "Entrypoints are shared by every app on the server. Give this one a different name.");
+      }
+      base.entrypoints[name] = port;
+      owners[name] ??= d.app;
+    }
+    base.ssl ||= d.ssl;
+    base.email ??= d.email;
+    base.acmeServer ??= d.acmeServer;
+    base.dnsProvider ??= d.dnsProvider;
+    base.dnsEnv = [...new Set([...base.dnsEnv, ...d.dnsEnv])];
+    base.trustedIps = [...new Set([...base.trustedIps, ...d.trustedIps])];
+    base.accessLog ||= d.accessLog;
+    base.dashboard ||= d.dashboard;
+    base.dashboardHost ??= d.dashboardHost;
+    base.extra = { ...base.extra, ...d.extra };
+    base.image = d.image;
+    base.version = d.version ?? base.version;
+    base.network = d.network;
+    base.logLevel = d.logLevel;
+    if (d.ssl)
+      base.challenge = d.challenge;
+  }
+  return base;
+}
+var CONTAINER_PATHS = { dynamicDir: "/etc/traefik/dynamic", acmeFile: "/acme/acme.json" };
+function staticConfig(d, where = CONTAINER_PATHS) {
+  const entryPoints = {};
+  for (const [name, port] of Object.entries(d.entrypoints)) {
+    entryPoints[name] = {
+      address: `:${port}`,
+      ...d.trustedIps.length ? { forwardedHeaders: { trustedIPs: d.trustedIps } } : {}
+    };
+  }
+  const acme = {
+    storage: where.acmeFile,
+    ...d.email ? { email: d.email } : {},
+    ...d.acmeServer ? { caServer: d.acmeServer } : {}
+  };
+  if (d.challenge === "dns") {
+    acme.dnsChallenge = { provider: d.dnsProvider, resolvers: ["1.1.1.1:53", "8.8.8.8:53"] };
+  } else if (d.challenge === "tlsalpn") {
+    acme.tlsChallenge = {};
+  } else {
+    acme.httpChallenge = { entryPoint: "web" };
+  }
+  return {
+    global: { checkNewVersion: false, sendAnonymousUsage: false },
+    log: { level: d.logLevel },
+    ...d.accessLog ? { accessLog: {} } : {},
+    ...d.dashboard ? { api: { dashboard: true } } : {},
+    entryPoints,
+    providers: {
+      file: { directory: where.dynamicDir, watch: true },
+      providersThrottleDuration: "1s"
+    },
+    ...d.ssl ? { certificatesResolvers: { [CERT_RESOLVER]: { acme } } } : {},
+    ...d.extra
+  };
+}
+function ruleFor(route) {
+  const parts = [];
+  if (route.hosts.length) {
+    const hosts = route.hosts.map((h) => h.startsWith("*.") ? `HostRegexp(\`^[a-z0-9-]+\\.${escapeRegex(h.slice(2))}$\`)` : `Host(\`${h}\`)`);
+    parts.push(hosts.length > 1 ? `(${hosts.join(" || ")})` : hosts[0]);
+  }
+  if (route.path)
+    parts.push(`PathPrefix(\`${route.path}\`)`);
+  if (!parts.length)
+    return "PathPrefix(`/`)";
+  return parts.join(" && ");
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function dynamicConfig(cfg, endpoints, accessories = []) {
+  const routers = {};
+  const services = {};
+  const middlewares = {};
+  const app = cfg.name;
+  const owners = [];
+  for (const svc of cfg.services) {
+    if (!svc.routes.length)
+      continue;
+    owners.push({
+      key: `${app}-${svc.name}`,
+      routes: svc.routes,
+      defaultPort: svc.port,
+      health: svc.health,
+      urlsFor: (port) => endpoints[svc.name]?.[port] ?? []
+    });
+  }
+  for (const { acc, urls } of accessories) {
+    if (!acc.routes.length)
+      continue;
+    owners.push({
+      key: `${app}-acc-${acc.name}`,
+      routes: acc.routes,
+      defaultPort: acc.port ?? 80,
+      urlsFor: (port) => urls[port] ?? []
+    });
+  }
+  for (const owner of owners) {
+    owner.routes.forEach((route, i) => {
+      const routerKey = `${owner.key}-${i}`;
+      const entrypoint = route.entrypoint ?? (route.ssl ? "websecure" : "web");
+      const mws = [];
+      if (route.path && route.stripPath) {
+        const key = `${routerKey}-strip`;
+        middlewares[key] = { stripPrefix: { prefixes: [route.path] } };
+        mws.push(key);
+      }
+      if (Object.keys(route.headers).length) {
+        const key = `${routerKey}-headers`;
+        middlewares[key] = { headers: { customRequestHeaders: route.headers } };
+        mws.push(key);
+      }
+      if (route.basicAuth.length) {
+        const key = `${routerKey}-auth`;
+        middlewares[key] = { basicAuth: { users: route.basicAuth } };
+        mws.push(key);
+      }
+      const rule = ruleFor(route);
+      if (route.redirect) {
+        const key = `${routerKey}-redirect`;
+        middlewares[key] = {
+          redirectRegex: { regex: "^https?://[^/]+(.*)", replacement: `${route.redirect.to.replace(/\/$/, "")}$1`, permanent: route.redirect.permanent }
+        };
+        const svcKey2 = `${owner.key}-${route.port}`;
+        ensureService(services, svcKey2, owner.urlsFor(route.port), route, owner.health);
+        routers[routerKey] = {
+          rule,
+          entryPoints: [entrypoint],
+          middlewares: [...mws, key],
+          service: svcKey2,
+          ...route.ssl ? { tls: tlsFor(route) } : {},
+          ...route.priority !== undefined ? { priority: route.priority } : {}
+        };
+        if (route.ssl && cfg.proxy.httpsRedirect) {
+          routers[`${routerKey}-http`] = { rule, entryPoints: ["web"], middlewares: [key], service: svcKey2 };
+        }
+        return;
+      }
+      const svcKey = `${owner.key}-${route.port}`;
+      ensureService(services, svcKey, owner.urlsFor(route.port), route, owner.health);
+      routers[routerKey] = {
+        rule,
+        entryPoints: [entrypoint],
+        service: svcKey,
+        ...mws.length ? { middlewares: mws } : {},
+        ...route.ssl ? { tls: tlsFor(route) } : {},
+        ...route.priority !== undefined ? { priority: route.priority } : {}
+      };
+      if (route.ssl && cfg.proxy.httpsRedirect && entrypoint !== "web") {
+        const key = `${app}-to-https`;
+        middlewares[key] = { redirectScheme: { scheme: "https", permanent: true } };
+        routers[`${routerKey}-http`] = {
+          rule,
+          entryPoints: ["web"],
+          middlewares: [key],
+          service: svcKey,
+          ...route.priority !== undefined ? { priority: route.priority } : {}
+        };
+      }
+    });
+  }
+  const http = {};
+  if (Object.keys(routers).length)
+    http.routers = routers;
+  if (Object.keys(services).length)
+    http.services = services;
+  if (Object.keys(middlewares).length)
+    http.middlewares = middlewares;
+  return { http };
+}
+function tlsFor(route) {
+  const wildcards = route.hosts.filter((h) => h.startsWith("*."));
+  return {
+    certResolver: CERT_RESOLVER,
+    ...wildcards.length ? { domains: wildcards.map((w) => ({ main: w.slice(2), sans: [w] })) } : {}
+  };
+}
+function ensureService(services, key, urls, route, health) {
+  if (services[key])
+    return;
+  services[key] = {
+    loadBalancer: {
+      servers: urls.map((url) => ({ url })),
+      passHostHeader: true,
+      ...route.sticky ? { sticky: { cookie: { name: "epd_lb", httpOnly: true, secure: route.ssl } } } : {},
+      ...health?.path ? { healthCheck: { path: health.path, interval: "10s", timeout: "3s", ...health.hostHeader ? { hostname: health.hostHeader } : {} } } : {}
+    }
+  };
+}
+function containerSpec(d, cfg, staticHash) {
+  const p = paths(cfg);
+  const args = [
+    "docker",
+    "run",
+    "-d",
+    "--name",
+    PROXY_CONTAINER,
+    "--restart",
+    "unless-stopped",
+    "--network",
+    d.network,
+    "--label",
+    "epd.role=proxy",
+    "--label",
+    `epd.spec=${staticHash}`,
+    "-v",
+    `${p.proxyStatic}:/etc/traefik/traefik.yml:ro`,
+    "-v",
+    `${p.proxyDynamicDir}:/etc/traefik/dynamic:ro`,
+    "-v",
+    `${p.acmeDir}:/acme`
+  ];
+  for (const port of Object.values(d.entrypoints))
+    args.push("-p", `${port}:${port}`);
+  if (d.dnsEnv.length)
+    args.push("--env-file", p.proxyEnv);
+  args.push(d.image);
+  return args;
+}
+async function ensureProxy(host2, cfg, opts = {}) {
+  if (!cfg.proxy.enabled)
+    return;
+  const p = paths(cfg);
+  const containerMode = cfg.mode === "docker";
+  await host2.writeFile(p.proxyApp, JSON.stringify(declFor(cfg), null, 2), "644");
+  const merged = mergeDecls(await readDecls(host2, cfg));
+  if (!Object.keys(merged.entrypoints).length)
+    merged.entrypoints = cfg.proxy.entrypoints;
+  const where = containerMode ? CONTAINER_PATHS : { dynamicDir: p.proxyDynamicDir, acmeFile: `${p.acmeDir}/acme.json` };
+  const staticJson = JSON.stringify(staticConfig(merged, where), null, 2);
+  await host2.writeFile(p.proxyStatic, staticJson, "644");
+  if (merged.dnsEnv.length) {
+    const lines = merged.dnsEnv.map((name) => {
+      const value = opts.secrets?.[name];
+      if (value === undefined) {
+        throw new EpdError(`proxy.dns_env: ${name} is not set locally`, "Export it or add it to .env \u2014 traefik needs it to answer the DNS challenge.");
+      }
+      return `${name}=${value}`;
+    });
+    await host2.writeFile(p.proxyEnv, lines.join(`
+`), "600");
+  }
+  if (merged.dashboard && merged.dashboardHost) {
+    const dash = {
+      http: {
+        routers: {
+          "epd-dashboard": {
+            rule: `Host(\`${merged.dashboardHost}\`)`,
+            entryPoints: [merged.ssl ? "websecure" : "web"],
+            service: "api@internal",
+            ...merged.ssl ? { tls: { certResolver: CERT_RESOLVER } } : {}
+          }
+        }
+      }
+    };
+    await host2.writeFile(`${p.proxyDynamicDir}/_dashboard.yml`, JSON.stringify(dash, null, 2), "644");
+  }
+  const specHash = hash32(staticJson + JSON.stringify(merged)).toString(36);
+  if (containerMode)
+    await ensureProxyContainer(host2, cfg, merged, specHash, opts);
+  else
+    await ensureProxyProcess(host2, cfg, merged, specHash, opts);
+}
+async function ensureProxyContainer(host2, cfg, merged, specHash, opts) {
+  const spec = containerSpec(merged, cfg, specHash);
+  const state = await host2.capture(`docker inspect -f '{{.State.Running}} {{index .Config.Labels "epd.spec"}}' ${PROXY_CONTAINER} 2>/dev/null || echo "missing"`);
+  const [running, currentHash] = state.split(/\s+/);
+  if (!opts.force && running === "true" && currentHash === specHash) {
+    log.host(host2.name, "proxy is up to date");
+    return;
+  }
+  await host2.exec(`docker network inspect ${shq(merged.network)} >/dev/null 2>&1 || docker network create ${shq(merged.network)} >/dev/null
+docker rm -f ${PROXY_CONTAINER} >/dev/null 2>&1 || true
+docker pull ${shq(merged.image)} >/dev/null
+${spec.map((a) => shq(a)).join(" ")} >/dev/null
+sleep 1
+docker inspect -f '{{.State.Running}}' ${PROXY_CONTAINER} | grep -q true || {
+  echo "traefik failed to start:" >&2
+  docker logs --tail 40 ${PROXY_CONTAINER} >&2 || true
+  exit 1
+}`, { label: `${host2.name}: start proxy` });
+  log.host(host2.name, `proxy running (${entrypointSummary(merged)})`);
+}
+var TRAEFIK_FALLBACK_VERSION = "v3.3.7";
+async function ensureProxyProcess(host2, cfg, merged, specHash, opts) {
+  const p = paths(cfg);
+  const wanted = merged.version ?? (/^traefik:(v\d+\.\d+\.\d+)$/.exec(merged.image)?.[1] ?? "");
+  const needsPrivilegedPort = Object.values(merged.entrypoints).some((port) => port < 1024);
+  await host2.exec(`mkdir -p ${shq(`${p.proxyDir}/bin`)} ${shq(p.proxyLogDir)}
+want=${shq(wanted)}
+if [ -z "$want" ]; then
+  # Piping curl straight into grep -m1 closes the pipe early, which pipefail
+  # reports as a failure \u2014 capture first, then match.
+  release_json=$(curl -fsSL --max-time 10 https://api.github.com/repos/traefik/traefik/releases/latest 2>/dev/null || true)
+  want=$(printf '%s' "$release_json" | grep -m1 '"tag_name"' | cut -d'"' -f4 || true)
+fi
+[ -z "$want" ] && want=${TRAEFIK_FALLBACK_VERSION}
+
+have=""
+if [ -x ${shq(p.proxyBin)} ]; then
+  version_out=$(${shq(p.proxyBin)} version 2>/dev/null || true)
+  have=$(printf '%s' "$version_out" | awk '/[Vv]ersion:/ {print $2; exit}' || true)
+  [ -n "$have" ] && have="v\${have#v}"
+fi
+
+if [ "$have" != "$want" ]; then
+  case "$(uname -m)" in
+    x86_64|amd64) arch=amd64 ;;
+    aarch64|arm64) arch=arm64 ;;
+    armv7l) arch=armv7 ;;
+    *) echo "unsupported architecture $(uname -m) for the traefik binary" >&2; exit 1 ;;
+  esac
+  tmp=$(mktemp -d)
+  url="https://github.com/traefik/traefik/releases/download/\${want}/traefik_\${want}_linux_\${arch}.tar.gz"
+  echo "downloading traefik \${want} (\${arch})"
+  curl -fsSL "$url" -o "$tmp/traefik.tgz"
+  tar -xzf "$tmp/traefik.tgz" -C "$tmp" traefik
+  install -m 0755 "$tmp/traefik" ${shq(p.proxyBin)}
+  rm -rf "$tmp"
+fi
+${needsPrivilegedPort ? `command -v setcap >/dev/null 2>&1 && setcap 'cap_net_bind_service=+ep' ${shq(p.proxyBin)} 2>/dev/null || echo "note: could not grant the traefik binary permission to bind ports below 1024" >&2` : ""}
+true`, { stream: true, label: `${host2.name}: install traefik` });
+  const ecosystem = {
+    apps: [
+      {
+        name: PROXY_PROCESS,
+        script: p.proxyBin,
+        args: [`--configFile=${p.proxyStatic}`],
+        interpreter: "none",
+        exec_mode: "fork",
+        autorestart: true,
+        max_restarts: 20,
+        restart_delay: 2000,
+        merge_logs: true,
+        time: true,
+        out_file: `${p.proxyLogDir}/out.log`,
+        error_file: `${p.proxyLogDir}/err.log`,
+        env: { EPD_PROXY_SPEC: specHash, ...Object.fromEntries(merged.dnsEnv.map((n) => [n, opts.secrets?.[n] ?? ""])) }
+      }
+    ]
+  };
+  await host2.writeFile(p.proxyEcosystem, JSON.stringify(ecosystem, null, 2), "600");
+  const jlist = await host2.capture(`${pathPrelude(cfg)} pm2 jlist 2>/dev/null || echo '[]'`, {
+    sudo: false,
+    allowFailure: true
+  });
+  const running = await host2.test(`${pathPrelude(cfg)} pm2 describe ${PROXY_PROCESS} >/dev/null 2>&1`);
+  if (!opts.force && running && jlist.includes(specHash)) {
+    log.host(host2.name, "proxy is up to date");
+    return;
+  }
+  await host2.exec(`${pathPrelude(cfg)} pm2 delete ${PROXY_PROCESS} >/dev/null 2>&1 || true
+${pathPrelude(cfg)} pm2 start ${shq(p.proxyEcosystem)} --update-env
+${pathPrelude(cfg)} pm2 save --force >/dev/null 2>&1 || true
+sleep 2
+${pathPrelude(cfg)} pm2 describe ${PROXY_PROCESS} | grep -q online || {
+  echo "traefik failed to start:" >&2
+  tail -n 40 ${shq(`${p.proxyLogDir}/err.log`)} >&2 2>/dev/null || true
+  exit 1
+}`, { sudo: false, label: `${host2.name}: start proxy` });
+  log.host(host2.name, `proxy running (${entrypointSummary(merged)})`);
+}
+function entrypointSummary(d) {
+  return Object.entries(d.entrypoints).map(([name, port]) => `${name}:${port}`).join(" ");
+}
+async function writeRoutes(host2, cfg, endpoints, accessories = []) {
+  if (!cfg.proxy.enabled)
+    return;
+  const doc = dynamicConfig(cfg, endpoints, accessories);
+  await host2.writeFile(paths(cfg).proxyDynamic, JSON.stringify(doc, null, 2), "644");
+  await host2.exec(`sleep ${Math.max(1, cfg.proxy.reloadWait)}`);
+}
+async function removeRoutes(host2, cfg) {
+  await host2.exec(`rm -f ${shq(paths(cfg).proxyDynamic)} ${shq(paths(cfg).proxyApp)}`, { allowFailure: true });
+}
+async function proxyState(host2, cfg) {
+  if (cfg.mode === "docker") {
+    const out2 = await host2.capture(`docker inspect -f '{{.State.Running}}|{{.Config.Image}}|{{.State.Status}}' ${PROXY_CONTAINER} 2>/dev/null || echo 'false||absent'`, { allowFailure: true });
+    const [running, image, status2] = out2.split("|");
+    return { running: running === "true", image: image ?? "", status: status2 ?? "absent" };
+  }
+  const out = await host2.capture(`describe=$(${pathPrelude(cfg)} pm2 describe ${PROXY_PROCESS} 2>/dev/null || true)
+printf '%s' "$describe" | awk -F'\u2502' '/status/ {gsub(/ /,"",$3); print $3; exit}' || true
+version_out=$(${shq(paths(cfg).proxyBin)} version 2>/dev/null || true)
+printf '%s' "$version_out" | awk '/[Vv]ersion:/ {print "traefik " $2; exit}' || true`, { sudo: false, allowFailure: true });
+  const lines = out.split(`
+`).map((l) => l.trim()).filter(Boolean);
+  const status = lines.find((l) => !l.startsWith("traefik")) ?? "absent";
+  return { running: status === "online", image: lines.find((l) => l.startsWith("traefik")) ?? "", status };
+}
+
+// src/core/lock.ts
+function who() {
+  return `${process.env.USER ?? process.env.LOGNAME ?? "someone"}@${process.env.HOSTNAME ?? "local"}`;
+}
+
+class DeployLock {
+  cfg;
+  hosts;
+  held = [];
+  constructor(cfg, hosts) {
+    this.cfg = cfg;
+    this.hosts = hosts;
+  }
+  async acquire(what) {
+    const dir = paths(this.cfg).lock;
+    const info = { by: who(), at: new Date().toISOString(), what };
+    for (const host2 of this.hosts) {
+      const res = await host2.exec(`mkdir -p ${shq(paths(this.cfg).app)}
+if mkdir ${shq(dir)} 2>/dev/null; then
+  printf '%s' ${shq(JSON.stringify(info))} > ${shq(dir)}/info
+  echo acquired
+else
+  cat ${shq(dir)}/info 2>/dev/null || echo '{}'
+  exit 9
+fi`, { allowFailure: true });
+      if (res.code !== 0) {
+        await this.release();
+        let held = {};
+        try {
+          held = JSON.parse(res.stdout || "{}");
+        } catch {}
+        throw new EpdError(`${this.cfg.name} is locked on ${host2.name}`, held.by ? `Held by ${held.by} since ${held.at} (${held.what}).
+If that deploy died, run: epd lock release` : "Run `epd lock release` if a previous deploy was interrupted.");
+      }
+      this.held.push(host2);
+    }
+    log.debug(`lock acquired on ${this.held.length} host(s)`);
+  }
+  async release() {
+    const dir = paths(this.cfg).lock;
+    for (const host2 of this.held.splice(0)) {
+      await host2.exec(`rm -rf ${shq(dir)}`, { allowFailure: true });
+    }
+  }
+  static async forceRelease(cfg, hosts) {
+    for (const host2 of hosts)
+      await host2.exec(`rm -rf ${shq(paths(cfg).lock)}`, { allowFailure: true });
+  }
+  static async status(cfg, hosts) {
+    const out = [];
+    for (const host2 of hosts) {
+      const raw = await host2.readFile(`${paths(cfg).lock}/info`);
+      let info = null;
+      if (raw) {
+        try {
+          info = JSON.parse(raw);
+        } catch {
+          info = { by: "unknown", at: "unknown", what: "unknown" };
+        }
+      }
+      out.push({ host: host2.name, info });
+    }
+    return out;
+  }
+}
+async function withLock(cfg, hosts, what, skip, fn) {
+  if (skip)
+    return fn();
+  const lock = new DeployLock(cfg, hosts);
+  await lock.acquire(what);
+  try {
+    return await fn();
+  } finally {
+    await lock.release();
+  }
+}
+
+// src/core/probe.ts
+function statusCondition(spec) {
+  const parts = spec.split(",").map((s) => s.trim()).filter(Boolean);
+  if (!parts.length)
+    throw new EpdError(`healthcheck.status is empty`);
+  const tests = parts.map((p) => {
+    const m = /^(\d{3})\s*-\s*(\d{3})$/.exec(p);
+    if (m)
+      return `{ [ "$code" -ge ${m[1]} ] && [ "$code" -le ${m[2]} ]; }`;
+    if (/^\d{3}$/.test(p))
+      return `[ "$code" -eq ${p} ]`;
+    throw new EpdError(`healthcheck.status: cannot parse ${JSON.stringify(p)}`, 'Use "200", "200-399" or a comma separated list.');
+  });
+  return tests.join(" || ");
+}
+function healthScript(targets, health) {
+  const list = targets.map((t) => `${t.label} ${t.address} ${t.port}`).join(`
+`);
+  const tcpOnly = health.path === null;
+  const path = health.path ?? "/";
+  const hostHeader = health.hostHeader ?? "";
+  return `
+EPD_TIMEOUT=${health.timeout}
+EPD_INTERVAL=${health.interval}
+EPD_PATH=${shq(path)}
+EPD_HOSTHDR=${shq(hostHeader)}
+
+check_tcp() {
+  (exec 3<>"/dev/tcp/$1/$2") >/dev/null 2>&1 && echo 200 || echo 000
+}
+
+check_http() {
+  addr="$1"; port="$2"
+  hdr_host="\${EPD_HOSTHDR:-$addr}"
+  if command -v curl >/dev/null 2>&1; then
+    curl -s -o /dev/null -w '%{http_code}' --max-time 5 -H "Host: $hdr_host" \\
+      "http://$addr:$port$EPD_PATH" 2>/dev/null || echo 000
+  elif command -v wget >/dev/null 2>&1; then
+    code=$(wget -q -S -O /dev/null --timeout=5 --header="Host: $hdr_host" \\
+      "http://$addr:$port$EPD_PATH" 2>&1 | awk '/^[[:space:]]*HTTP\\//{c=$2} END{print c+0}')
+    echo "\${code:-000}"
+  else
+    if ! (exec 3<>"/dev/tcp/$addr/$port") 2>/dev/null; then echo 000; return; fi
+    exec 3<>"/dev/tcp/$addr/$port"
+    printf 'GET %s HTTP/1.1\\r\\nHost: %s\\r\\nConnection: close\\r\\nUser-Agent: epd\\r\\n\\r\\n' \\
+      "$EPD_PATH" "$hdr_host" >&3
+    line=$(head -n 1 <&3 2>/dev/null || true)
+    exec 3<&- 3>&- 2>/dev/null || true
+    echo "$line" | awk '{print $2+0}'
+  fi
+}
+
+deadline=$(( $(date +%s) + EPD_TIMEOUT ))
+sleep ${health.delay}
+last=""
+while :; do
+  pending=""
+  last=""
+  while read -r name addr port; do
+    [ -z "\${name:-}" ] && continue
+    code=$(${tcpOnly ? 'check_tcp "$addr" "$port"' : 'check_http "$addr" "$port"'})
+    if ${statusCondition(health.status)}; then
+      :
+    else
+      pending="$pending $name"
+      last="$name -> $code"
+    fi
+  done <<'EPD_TARGETS'
+${list}
+EPD_TARGETS
+  if [ -z "$pending" ]; then
+    echo "EPD_HEALTHY"
+    exit 0
+  fi
+  if [ "$(date +%s)" -ge "$deadline" ]; then
+    echo "EPD_UNHEALTHY:$pending (last: $last)"
+    exit 1
+  fi
+  sleep $EPD_INTERVAL
+done
+`;
+}
+async function waitHealthy(host2, targets, health) {
+  if (!targets.length)
+    return;
+  const res = await host2.exec(healthScript(targets, health), {
+    allowFailure: true,
+    label: `${host2.name}: health check`
+  });
+  if (res.code === 0 && res.stdout.includes("EPD_HEALTHY"))
+    return;
+  const detail = res.stdout.replace("EPD_UNHEALTHY:", "").trim() || res.stderr;
+  throw new EpdError(`${host2.name}: new version did not become healthy within ${health.timeout}s`, `Still failing:${detail ? ` ${detail}` : ""}
+Check \`epd logs\` \u2014 the old version is still serving traffic.`);
+}
+
+// src/core/state.ts
+async function readState(host2, cfg) {
+  const raw = await host2.readFile(paths(cfg).state);
+  if (!raw)
+    return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    log.warn(`${host2.name}: state file is corrupt, treating this host as fresh`);
+    return null;
+  }
+}
+async function writeState(host2, cfg, state) {
+  await host2.writeFile(paths(cfg).state, JSON.stringify(state, null, 2), "644");
+}
+function emptyState(cfg) {
+  return {
+    app: cfg.name,
+    mode: cfg.mode,
+    version: "",
+    updatedAt: new Date().toISOString(),
+    destination: cfg.destination,
+    services: {},
+    history: []
+  };
+}
+function recordDeploy(state, version, by, keep) {
+  const history = [{ version, at: new Date().toISOString(), by }, ...state.history.filter((h) => h.version !== version)];
+  return { ...state, version, updatedAt: new Date().toISOString(), history: history.slice(0, Math.max(keep, 2) * 2) };
+}
+
+// src/deploy/image.ts
+import { existsSync as existsSync3 } from "fs";
+import { join as join4 } from "path";
+async function resolveVersion(cfg, explicit) {
+  if (explicit)
+    return { id: explicit, source: "explicit", dirty: false };
+  if (existsSync3(join4(cfg.root, ".git")) && await which("git")) {
+    const sha = await run(["git", "-C", cfg.root, "rev-parse", "--short=12", "HEAD"], { allowFailure: true });
+    if (sha.code === 0 && sha.stdout) {
+      const status = await run(["git", "-C", cfg.root, "status", "--porcelain"], { allowFailure: true });
+      const dirty = status.stdout.length > 0;
+      return { id: dirty ? `${sha.stdout}-dirty-${timestamp()}` : sha.stdout, source: "git", dirty };
+    }
+  }
+  return { id: timestamp(), source: "timestamp", dirty: false };
+}
+var imageRef = (cfg, version) => `${cfg.image}:${version}`;
+async function hasBuildx() {
+  return (await run(["docker", "buildx", "version"], { allowFailure: true })).code === 0;
+}
+async function buildImage(cfg, version, env) {
+  const dockerfile = join4(cfg.root, cfg.build.dockerfile);
+  if (!existsSync3(dockerfile)) {
+    throw new EpdError(`${cfg.build.dockerfile} not found`, "Add a Dockerfile, point build.dockerfile at yours, or switch to `mode: process`.");
+  }
+  const ref = imageRef(cfg, version);
+  log.step(`Building ${ref}`);
+  if (await hasBuildx())
+    await buildWithBuildx(cfg, ref, version, env);
+  else
+    await buildWithLegacyDocker(cfg, ref, version, env);
+}
+async function buildWithBuildx(cfg, ref, version, env) {
+  const args = ["docker", "buildx", "build"];
+  args.push("--platform", cfg.build.platform);
+  args.push("--file", join4(cfg.root, cfg.build.dockerfile));
+  args.push("--tag", ref, "--tag", `${cfg.image}:latest`);
+  if (cfg.build.target)
+    args.push("--target", cfg.build.target);
+  for (const [k, v] of Object.entries(cfg.build.args))
+    args.push("--build-arg", `${k}=${v}`);
+  for (const [id, envName] of Object.entries(cfg.build.secrets)) {
+    if (env[envName] === undefined)
+      throw new EpdError(`build.secrets: ${envName} is not set`);
+    args.push("--secret", `id=${id},env=${envName}`);
+  }
+  args.push("--label", `epd.app=${cfg.name}`, "--label", `epd.version=${version}`);
+  if (cfg.registry) {
+    args.push("--push");
+    if (cfg.build.cache) {
+      args.push("--cache-from", `type=registry,ref=${cfg.image}:buildcache`);
+      args.push("--cache-to", `type=registry,ref=${cfg.image}:buildcache,mode=max`);
+    }
+  } else {
+    args.push("--load");
+  }
+  args.push(cfg.build.context);
+  await ensureBuilder();
+  await run(args, { cwd: cfg.root, stream: true, env, label: "docker buildx build" });
+}
+async function buildWithLegacyDocker(cfg, ref, version, env) {
+  if (Object.keys(cfg.build.secrets).length) {
+    throw new EpdError("build.secrets needs BuildKit", "Install the docker buildx plugin: https://docs.docker.com/go/buildx/");
+  }
+  const localPlatform = `linux/${process.arch === "arm64" ? "arm64" : "amd64"}`;
+  if (cfg.build.platform !== localPlatform) {
+    log.warn(`buildx is not installed, so the image is built for ${localPlatform} rather than ${cfg.build.platform}. ` + `Install buildx to cross-build, or set build.platform: ${localPlatform}.`);
+  }
+  const args = ["docker", "build", "--file", join4(cfg.root, cfg.build.dockerfile), "--tag", ref, "--tag", `${cfg.image}:latest`];
+  if (cfg.build.target)
+    args.push("--target", cfg.build.target);
+  for (const [k, v] of Object.entries(cfg.build.args))
+    args.push("--build-arg", `${k}=${v}`);
+  args.push("--label", `epd.app=${cfg.name}`, "--label", `epd.version=${version}`);
+  args.push(cfg.build.context);
+  await run(args, { cwd: cfg.root, stream: true, env, label: "docker build" });
+  if (cfg.registry) {
+    log.step(`Pushing ${ref}`);
+    await run(["docker", "push", ref], { stream: true });
+    await run(["docker", "push", `${cfg.image}:latest`], { stream: true, allowFailure: true });
+  }
+}
+async function ensureBuilder() {
+  const res = await run(["docker", "buildx", "inspect", "epd"], { allowFailure: true });
+  if (res.code === 0) {
+    await run(["docker", "buildx", "use", "epd"], { allowFailure: true });
+    return;
+  }
+  log.info('creating buildx builder "epd"');
+  await run(["docker", "buildx", "create", "--name", "epd", "--use", "--bootstrap"], { stream: true });
+}
+async function loginRegistry(host2, cfg, env) {
+  if (!cfg.registry)
+    return;
+  const password = env[cfg.registry.passwordEnv];
+  if (!password) {
+    throw new EpdError(`registry password: ${cfg.registry.passwordEnv} is not set`, "Export it, or put it in .env next to epd.yml.");
+  }
+  const server = cfg.registry.server ?? "";
+  await host2.exec(`printf '%s' ${shq(password)} | docker login ${server ? shq(server) + " " : ""}--username ${shq(cfg.registry.username)} --password-stdin >/dev/null`, { label: `${host2.name}: docker login` });
+}
+async function ensureImage(host2, cfg, version) {
+  const ref = imageRef(cfg, version);
+  if (await host2.test(`docker image inspect ${shq(ref)} >/dev/null 2>&1`)) {
+    log.host(host2.name, `image ${version} already present`);
+    return;
+  }
+  if (cfg.registry) {
+    log.host(host2.name, `pulling ${ref}`);
+    await host2.exec(`docker pull ${shq(ref)} >/dev/null`, { label: `${host2.name}: docker pull` });
+  } else {
+    log.host(host2.name, `shipping ${ref} over ssh (no registry configured)`);
+    await host2.pipeInto("gunzip | docker load", ["/bin/sh", "-c", `docker save ${shq(ref)} | gzip -1`]);
+  }
+}
+async function pruneImages(host2, cfg, keep, inUse) {
+  const keepRefs = inUse.map((v) => imageRef(cfg, v));
+  await host2.exec(`keep=${shq(keepRefs.join(" "))}
+docker images --filter "label=epd.app=${cfg.name}" --format '{{.Repository}}:{{.Tag}} {{.CreatedAt}}' 2>/dev/null \\
+  | sort -k2 -r | tail -n +$(( ${keep} + 1 )) | awk '{print $1}' | while read -r img; do
+    case " $keep " in *" $img "*) continue;; esac
+    case "$img" in *:latest|*:buildcache) continue;; esac
+    docker rmi "$img" >/dev/null 2>&1 || true
+  done
+docker image prune -f --filter "label=epd.app=${cfg.name}" >/dev/null 2>&1 || true`, { allowFailure: true });
+}
+
+// src/deploy/docker.ts
+function parseCommand(cmd) {
+  if (/[|&;<>$`(){}[\]*?~\\]/.test(cmd))
+    return ["sh", "-c", cmd];
+  return cmd.trim().split(/\s+/);
+}
+function resolveSecrets(names, env, where) {
+  const out = {};
+  const missing = [];
+  for (const name of names) {
+    const v = env[name];
+    if (v === undefined)
+      missing.push(name);
+    else
+      out[name] = v;
+  }
+  if (missing.length) {
+    throw new EpdError(`${where}: missing secret${missing.length > 1 ? "s" : ""} ${missing.join(", ")}`, "Export them, or add them to .env next to epd.yml. epd never stores secrets in the repo.");
+  }
+  return out;
+}
+function envFileContent(vars) {
+  return Object.entries(vars).map(([k, v]) => `${k}=${v}`).join(`
+`);
+}
+async function writeServiceEnv(host2, cfg, svc, env) {
+  const secrets = resolveSecrets(svc.secrets, env, `servers.${svc.name}`);
+  const file = `${paths(cfg).app}/env.${svc.name}`;
+  await host2.writeFile(file, envFileContent({ ...svc.env, ...secrets }), "600");
+  return file;
+}
+function dockerRunArgs(o) {
+  const { cfg, svc, slot, version, replica, serverHost, envFile } = o;
+  const name = containerName(cfg.name, svc.name, slot, replica);
+  const args = ["docker", "run"];
+  if (o.detach !== false)
+    args.push("-d");
+  args.push("--name", name, "--hostname", `${name}.${cfg.name}`, "--restart", "unless-stopped", "--network", cfg.proxy.network, "--label", `epd.app=${cfg.name}`, "--label", `epd.service=${svc.name}`, "--label", `epd.slot=${slot}`, "--label", `epd.version=${version}`, "--label", `epd.replica=${replica}`, "--label", "epd.managed=true", "--env-file", envFile, "--env", `PORT=${svc.port}`, "--env", `EPD_APP=${cfg.name}`, "--env", `EPD_SERVICE=${svc.name}`, "--env", `EPD_REPLICA=${replica}`, "--env", `EPD_VERSION=${version}`, "--stop-timeout", String(svc.stopTimeout), "--log-opt", "max-size=10m", "--log-opt", "max-file=3");
+  for (const [k, v] of Object.entries(svc.labels))
+    args.push("--label", `${k}=${v}`);
+  for (const v of svc.volumes)
+    args.push("--volume", v);
+  if (svc.cpus)
+    args.push("--cpus", svc.cpus);
+  if (svc.memory)
+    args.push("--memory", svc.memory);
+  if (usesHostPorts(cfg)) {
+    args.push("--publish", `${bindAddress(cfg, serverHost)}:${hostPort(cfg, svc, slot, replica)}:${svc.port}`);
+  }
+  args.push(...svc.dockerOptions);
+  args.push(imageRef(cfg, version));
+  if (svc.command)
+    args.push(...parseCommand(svc.command));
+  return args;
+}
+async function startSlot(host2, cfg, svc, slot, version, envFile) {
+  const names = [];
+  const lines = [
+    `old=$(docker ps -a -q --filter "label=epd.app=${cfg.name}" --filter "label=epd.service=${svc.name}" --filter "label=epd.slot=${slot}")`,
+    `[ -n "$old" ] && docker rm -f $old >/dev/null 2>&1 || true`
+  ];
+  for (let i = 0;i < svc.replicas; i++) {
+    const name = containerName(cfg.name, svc.name, slot, i);
+    names.push(name);
+    const args = dockerRunArgs({ cfg, svc, slot, version, replica: i, serverHost: host2.name, envFile });
+    lines.push(`docker rm -f ${shq(name)} >/dev/null 2>&1 || true`);
+    lines.push(`${args.map((a) => shq(a)).join(" ")} >/dev/null`);
+  }
+  await host2.exec(lines.join(`
+`), { label: `${host2.name}: start ${svc.name}/${slot}` });
+  return names;
+}
+async function containerIps(host2, cfg, names) {
+  if (!names.length)
+    return {};
+  const tpl = `{{ with (index .NetworkSettings.Networks ${JSON.stringify(cfg.proxy.network)}) }}{{ .IPAddress }}{{ end }}`;
+  const out = await host2.capture(names.map((n) => `echo "${n} $(docker inspect -f ${shq(tpl)} ${shq(n)} 2>/dev/null)"`).join(`
+`));
+  const map = {};
+  for (const line of out.split(`
+`)) {
+    const [name, ip] = line.trim().split(/\s+/);
+    if (name && ip)
+      map[name] = ip;
+  }
+  return map;
+}
+async function stopSlot(host2, cfg, svc, slot, opts) {
+  const teardown = `names=$(docker ps -a -q --filter "label=epd.app=${cfg.name}" --filter "label=epd.service=${svc.name}" --filter "label=epd.slot=${slot}")
+if [ -n "$names" ]; then
+  sleep ${opts.drain}
+  docker stop --timeout ${svc.stopTimeout} $names >/dev/null 2>&1 || true
+  ${opts.remove ? "docker rm -f $names >/dev/null 2>&1 || true" : ""}
+fi`;
+  await host2.exec(opts.detach ? `nohup setsid bash -c ${shq(teardown)} >/dev/null 2>&1 < /dev/null &
+disown 2>/dev/null || true` : teardown, { allowFailure: true, label: `${host2.name}: stop ${svc.name}/${slot}` });
+}
+async function removeApp(host2, cfg) {
+  await host2.exec(`ids=$(docker ps -a -q --filter "label=epd.app=${cfg.name}")
+[ -n "$ids" ] && docker rm -f $ids >/dev/null 2>&1 || true`, { allowFailure: true });
+}
+async function listContainers(host2, cfg) {
+  const fmt = [
+    "{{.Names}}",
+    '{{.Label "epd.service"}}',
+    '{{.Label "epd.slot"}}',
+    '{{.Label "epd.version"}}',
+    '{{.Label "epd.replica"}}',
+    "{{.Status}}",
+    "{{.State}}",
+    "{{.Image}}",
+    "{{.CreatedAt}}"
+  ].join("\t");
+  const out = await host2.capture(`docker ps -a --filter "label=epd.app=${cfg.name}" --format ${shq(fmt)} 2>/dev/null || true`, { allowFailure: true });
+  return out.split(`
+`).filter(Boolean).map((line) => {
+    const [name, service, slot, version, replica, status, state, image, created] = line.split("\t");
+    return {
+      name: name ?? "",
+      service: service ?? "",
+      slot: slot ?? "",
+      version: version ?? "",
+      replica: replica ?? "",
+      status: status ?? "",
+      running: state === "running",
+      image: image ?? "",
+      created: created ?? ""
+    };
+  });
+}
+async function startAccessory(host2, cfg, acc, env, opts) {
+  const name = accessoryContainer(cfg.name, acc.name);
+  const secrets = resolveSecrets(acc.secrets, env, `accessories.${acc.name}`);
+  const envFile = `${paths(cfg).app}/env.acc.${acc.name}`;
+  await host2.writeFile(envFile, envFileContent({ ...acc.env, ...secrets }), "600");
+  const args = [
+    "docker",
+    "run",
+    "-d",
+    "--name",
+    name,
+    "--restart",
+    "unless-stopped",
+    "--network",
+    cfg.proxy.network,
+    "--label",
+    `epd.app=${cfg.name}`,
+    "--label",
+    `epd.accessory=${acc.name}`,
+    "--label",
+    "epd.managed=true",
+    "--env-file",
+    envFile,
+    "--log-opt",
+    "max-size=10m",
+    "--log-opt",
+    "max-file=3"
+  ];
+  for (const v of acc.volumes)
+    args.push("--volume", v);
+  for (const p of acc.ports)
+    args.push("--publish", p);
+  args.push(...acc.dockerOptions, acc.image);
+  if (acc.command)
+    args.push(...parseCommand(acc.command));
+  await host2.exec(`if docker inspect ${shq(name)} >/dev/null 2>&1; then
+  ${opts.recreate ? `docker rm -f ${shq(name)} >/dev/null` : `docker start ${shq(name)} >/dev/null 2>&1 || true; exit 0`}
+fi
+docker pull ${shq(acc.image)} >/dev/null
+${args.map((a) => shq(a)).join(" ")} >/dev/null`, { label: `${host2.name}: accessory ${acc.name}` });
+  log.host(host2.name, `accessory ${acc.name} running`);
+}
+
+// src/deploy/process.ts
+import { existsSync as existsSync4 } from "fs";
+import { join as join5 } from "path";
+var asUser = { sudo: false };
+var pm2 = (cfg, args) => `${pathPrelude(cfg)} pm2 ${args}`;
+function releaseDir(cfg, version) {
+  return `${paths(cfg).releases}/${version}`;
+}
+async function uploadSource(host2, cfg, version) {
+  const dest = releaseDir(cfg, version);
+  const p = paths(cfg);
+  await host2.exec(`mkdir -p ${shq(p.releases)} ${shq(p.shared)}`, asUser);
+  if (cfg.process.source === "git") {
+    if (!existsSync4(join5(cfg.root, ".git")))
+      throw new EpdError('process.source is "git" but this is not a git repository');
+    log.host(host2.name, `uploading HEAD as ${version}`);
+    await host2.pipeInto(`mkdir -p ${shq(dest)} && tar -x -C ${shq(dest)}`, ["/bin/sh", "-c", `git -C ${shq(cfg.root)} archive --format=tar HEAD`]);
+    return;
+  }
+  const previous = await host2.capture(`ls -1dt ${shq(p.releases)}/*/ 2>/dev/null | head -n 1 || true`, { ...asUser, allowFailure: true });
+  const args = ["rsync", "-az", "--delete", "--human-readable", "--info=stats1"];
+  for (const ex of cfg.process.exclude)
+    args.push("--exclude", ex);
+  if (previous)
+    args.push("--link-dest", previous.replace(/\/$/, ""));
+  args.push("-e", host2.rsyncShell());
+  args.push(`${cfg.root.replace(/\/$/, "")}/`, `${host2.target}:${dest}/`);
+  await host2.exec(`mkdir -p ${shq(dest)}`, asUser);
+  log.host(host2.name, `uploading ${version}`);
+  await run(args, { cwd: cfg.root, label: `rsync \u2192 ${host2.name}` });
+}
+async function buildRelease(host2, cfg, version, env) {
+  const dest = releaseDir(cfg, version);
+  const secrets = resolveSecrets(cfg.secrets, env, "env.secret");
+  const envFile = paths(cfg).envFile;
+  await host2.writeFile(envFile, Object.entries({ ...cfg.env, ...secrets }).map(([k, v]) => `${k}=${v}`).join(`
+`), "600");
+  const steps = [`cd ${shq(dest)}`, pathPrelude(cfg), `set -a; . ${shq(envFile)}; set +a`];
+  if (cfg.process.install)
+    steps.push(cfg.process.install);
+  if (cfg.process.build)
+    steps.push(cfg.process.build);
+  if (steps.length > 3) {
+    log.host(host2.name, "installing and building");
+    await host2.exec(steps.join(`
+`), { ...asUser, stream: true, label: `${host2.name}: build` });
+  }
+}
+function ecosystem(cfg, svc, slot, version, env) {
+  const dir = releaseDir(cfg, version);
+  const command = svc.command ?? cfg.process.start;
+  const argv = parseCommand(command);
+  const apps = [];
+  for (let i = 0;i < svc.replicas; i++) {
+    apps.push({
+      name: processName(cfg.name, svc.name, slot, i),
+      cwd: dir,
+      script: argv[0],
+      args: argv.slice(1),
+      interpreter: "none",
+      exec_mode: "fork",
+      autorestart: true,
+      max_restarts: 10,
+      restart_delay: 1000,
+      kill_timeout: svc.stopTimeout * 1000,
+      merge_logs: true,
+      time: true,
+      env: {
+        ...env,
+        NODE_ENV: env.NODE_ENV ?? "production",
+        PORT: String(hostPort(cfg, svc, slot, i)),
+        HOST: "127.0.0.1",
+        EPD_APP: cfg.name,
+        EPD_SERVICE: svc.name,
+        EPD_REPLICA: String(i),
+        EPD_VERSION: version,
+        ...svc.memory ? {} : {}
+      },
+      ...svc.memory ? { max_memory_restart: svc.memory } : {}
+    });
+  }
+  return { apps };
+}
+async function startSlot2(host2, cfg, svc, slot, version, env) {
+  const secrets = resolveSecrets(svc.secrets, env, `servers.${svc.name}`);
+  const doc = ecosystem(cfg, svc, slot, version, { ...svc.env, ...secrets });
+  const file = `${paths(cfg).app}/pm2.${svc.name}.${slot}.json`;
+  await host2.writeFile(file, JSON.stringify(doc, null, 2), "600");
+  const stale = Array.from({ length: 16 }, (_, i) => processName(cfg.name, svc.name, slot, i));
+  await host2.exec(`for name in ${stale.map((n) => shq(n)).join(" ")}; do ${pathPrelude(cfg)} pm2 delete "$name" >/dev/null 2>&1 || true; done
+${pm2(cfg, `start ${shq(file)} --update-env`)}
+${pm2(cfg, "save --force")} >/dev/null 2>&1 || true`, { ...asUser, label: `${host2.name}: pm2 start ${svc.name}/${slot}` });
+}
+async function stopSlot2(host2, cfg, svc, slot, drain, opts = {}) {
+  const names = Array.from({ length: 16 }, (_, i) => processName(cfg.name, svc.name, slot, i));
+  const teardown = `sleep ${drain}
+for name in ${names.map((n) => shq(n)).join(" ")}; do
+  ${pathPrelude(cfg)} pm2 delete "$name" >/dev/null 2>&1 || true
+done
+${pm2(cfg, "save --force")} >/dev/null 2>&1 || true`;
+  await host2.exec(opts.detach ? `nohup setsid bash -c ${shq(teardown)} >/dev/null 2>&1 < /dev/null &
+disown 2>/dev/null || true` : teardown, { ...asUser, allowFailure: true, label: `${host2.name}: pm2 stop ${svc.name}/${slot}` });
+}
+async function removeApp2(host2, cfg) {
+  await host2.exec(`${pathPrelude(cfg)} pm2 jlist 2>/dev/null | tr ',' '\\n' | grep -o '"name":"epd-${cfg.name}-[^"]*"' | cut -d'"' -f4 | sort -u | while read -r n; do
+  ${pathPrelude(cfg)} pm2 delete "$n" >/dev/null 2>&1 || true
+done
+${pm2(cfg, "save --force")} >/dev/null 2>&1 || true`, { ...asUser, allowFailure: true });
+}
+async function listProcesses(host2, cfg) {
+  const out = await host2.capture(`${pm2(cfg, "jlist")} 2>/dev/null || echo '[]'`, { ...asUser, allowFailure: true });
+  const jsonStart = out.indexOf("[");
+  let parsed = [];
+  try {
+    parsed = JSON.parse(jsonStart >= 0 ? out.slice(jsonStart) : "[]");
+  } catch {
+    return [];
+  }
+  return parsed.filter((p) => typeof p?.name === "string" && p.name.startsWith(`epd-${cfg.name}-`)).map((p) => ({
+    name: p.name,
+    status: p.pm2_env?.status ?? "unknown",
+    restarts: p.pm2_env?.restart_time ?? 0,
+    uptime: p.pm2_env?.pm_uptime ?? 0,
+    cpu: p.monit?.cpu ?? 0,
+    memory: p.monit?.memory ?? 0
+  }));
+}
+async function finalizeRelease(host2, cfg, version) {
+  const p = paths(cfg);
+  await host2.exec(`ln -sfn ${shq(releaseDir(cfg, version))} ${shq(p.current)}.tmp && mv -Tf ${shq(p.current)}.tmp ${shq(p.current)}
+ls -1dt ${shq(p.releases)}/*/ 2>/dev/null | tail -n +$(( ${cfg.keepReleases} + 1 )) | while read -r d; do
+  case "$d" in *${shq(version)}*) continue;; esac
+  rm -rf "$d"
+done`, { ...asUser, allowFailure: true });
+}
+
+// src/deploy/deploy.ts
+async function deploy(loaded, opts = {}) {
+  const { config: cfg, env } = loaded;
+  const started2 = Date.now();
+  const services = selectServices(cfg, opts.onlyServices);
+  const targetHosts = selectHosts(cfg, services, opts.onlyHosts);
+  const hosts = targetHosts.map((h) => host(h, cfg.ssh));
+  const version = (await resolveVersion(cfg, opts.version)).id;
+  log.step(`Deploying ${c.bold(cfg.name)} ${c.cyan(version)}${cfg.destination ? ` \u2192 ${cfg.destination}` : ""} to ${targetHosts.length} host(s)`);
+  if (!opts.skipHooks && cfg.hooks.preBuild)
+    await hook(cfg, "pre_build", cfg.hooks.preBuild, version);
+  if (cfg.mode === "docker" && !opts.reuse) {
+    await buildImage(cfg, version, env);
+    if (!cfg.registry)
+      log.warn("no registry configured \u2014 the image is copied to each server over SSH");
+  }
+  if (!opts.skipHooks && cfg.hooks.preDeploy)
+    await hook(cfg, "pre_deploy", cfg.hooks.preDeploy, version);
+  await withLock(cfg, hosts, `deploy ${version}`, opts.skipLock ?? false, async () => {
+    log.step("Preparing servers");
+    await pool(hosts, 8, async (host2) => {
+      await verifyHost(host2, cfg);
+      if (cfg.mode === "docker")
+        await ensureNetwork(host2, cfg);
+    });
+    await deployAccessories(cfg, env, opts.recreateAccessories ?? false);
+    if (cfg.proxy.enabled && proxyHosts(cfg).length) {
+      log.step("Checking proxy");
+      await pool(proxyHosts(cfg).filter((h) => targetHosts.includes(h)).map((h) => host(h, cfg.ssh)), 4, (host2) => ensureProxy(host2, cfg, { secrets: env }));
+    }
+    const live = new Map;
+    for (const h of allHosts(cfg)) {
+      const state = await readState(host(h, cfg.ssh), cfg);
+      const m = new Map;
+      for (const [svc, s] of Object.entries(state?.services ?? {}))
+        m.set(svc, s.slot);
+      live.set(h, m);
+    }
+    const deployHost = async (host2) => {
+      await deployToHost({ cfg, env, host: host2, services, version, opts, live });
+    };
+    if (cfg.strategy === "parallel") {
+      await pool(hosts, hosts.length, deployHost);
+    } else {
+      for (const host2 of hosts)
+        await deployHost(host2);
+    }
+    if (cfg.proxy.crossHost) {
+      log.step("Syncing routes across hosts");
+      await pool(proxyHosts(cfg).map((h) => host(h, cfg.ssh)), 4, async (host2) => {
+        await writeRoutes(host2, cfg, buildEndpoints(cfg, host2.name, live), buildAccessoryEndpoints(cfg, host2.name));
+      });
+    }
+  });
+  if (!opts.skipHooks && cfg.hooks.postDeploy)
+    await hook(cfg, "post_deploy", cfg.hooks.postDeploy, version);
+  log.ok(`Deployed ${cfg.name} ${version} in ${dur(Date.now() - started2)}`);
+  printUrls(cfg);
+}
+async function deployToHost(d) {
+  const { cfg, env, host: host2, version, opts, live } = d;
+  const services = d.services.filter((s) => s.hosts.includes(host2.name));
+  if (!services.length)
+    return;
+  log.step(`${host2.name}: deploying ${services.map((s) => s.name).join(", ")}`);
+  if (cfg.mode === "docker") {
+    await loginRegistry(host2, cfg, env);
+    await ensureImage(host2, cfg, version);
+  } else if (!opts.reuse) {
+    await uploadSource(host2, cfg, version);
+    await buildRelease(host2, cfg, version, env);
+  } else {
+    const dir = releaseDir(cfg, version);
+    if (!await host2.test(`[ -d ${JSON.stringify(dir)} ]`)) {
+      throw new EpdError(`${host2.name}: release ${version} is not on this server`, "Deploy it normally first.");
+    }
+  }
+  const state = await readState(host2, cfg) ?? emptyState(cfg);
+  const previous = new Map;
+  const started2 = [];
+  try {
+    for (const svc of services) {
+      const current = state.services[svc.name]?.slot;
+      if (current)
+        previous.set(svc.name, current);
+      const slot = current ? otherSlot(current) : "blue";
+      log.host(host2.name, `${svc.name}: starting ${svc.replicas} replica(s) on ${slot}`);
+      let probes = [];
+      if (cfg.mode === "docker") {
+        const envFile = await writeServiceEnv(host2, cfg, svc, env);
+        const names = await startSlot(host2, cfg, svc, slot, version, envFile);
+        started2.push({ svc, slot });
+        const ips = usesHostPorts(cfg) ? {} : await containerIps(host2, cfg, names);
+        probes = names.map((name, i) => ({
+          label: name,
+          address: usesHostPorts(cfg) ? "127.0.0.1" : ips[name] ?? "",
+          port: usesHostPorts(cfg) ? hostPort(cfg, svc, slot, i) : svc.health.port ?? svc.port
+        }));
+        const noIp = probes.find((p) => !p.address);
+        if (noIp)
+          throw new EpdError(`${host2.name}: ${noIp.label} did not get an IP on the ${cfg.proxy.network} network`, "Check `epd logs`.");
+      } else {
+        await startSlot2(host2, cfg, svc, slot, version, env);
+        started2.push({ svc, slot });
+        probes = Array.from({ length: svc.replicas }, (_, i) => ({
+          label: `${svc.name}#${i}`,
+          address: "127.0.0.1",
+          port: hostPort(cfg, svc, slot, i)
+        }));
+      }
+      if (!opts.skipHealth && svc.proxied) {
+        log.host(host2.name, `${svc.name}: waiting for health check${svc.health.path ? ` ${svc.health.path}` : " (tcp)"}`);
+        await waitHealthy(host2, probes, svc.health);
+        log.host(host2.name, `${svc.name}: healthy`);
+      } else if (!opts.skipHealth) {
+        await confirmUp(host2, cfg, svc, slot);
+      }
+      live.get(host2.name)?.set(svc.name, slot) ?? live.set(host2.name, new Map([[svc.name, slot]]));
+      state.services[svc.name] = {
+        slot,
+        replicas: svc.replicas,
+        version,
+        endpoints: endpointsFor(cfg, svc, slot, host2.name).map((e) => e.url)
+      };
+    }
+    const hasSvcRoutes = services.some((s) => s.routes.length);
+    const hasAccRoutes = cfg.accessories.some((a) => a.routes.length && (cfg.proxy.crossHost || a.host === host2.name));
+    if (cfg.proxy.enabled && (hasSvcRoutes || hasAccRoutes)) {
+      await writeRoutes(host2, cfg, buildEndpoints(cfg, host2.name, live), buildAccessoryEndpoints(cfg, host2.name));
+      log.host(host2.name, "routes updated");
+    }
+    for (const svc of services) {
+      const old = previous.get(svc.name);
+      if (!old)
+        continue;
+      const drain = Math.max(svc.drain, cfg.proxy.reloadWait + 2);
+      log.host(host2.name, `${svc.name}: retiring ${old} (${drain}s drain, in the background)`);
+      if (cfg.mode === "docker")
+        await stopSlot(host2, cfg, svc, old, { drain, remove: true, detach: true });
+      else
+        await stopSlot2(host2, cfg, svc, old, drain, { detach: true });
+    }
+    await writeState(host2, cfg, recordDeploy(state, version, process.env.USER ?? "epd", cfg.keepReleases));
+    if (cfg.mode === "docker") {
+      await pruneImages(host2, cfg, cfg.keepReleases, [version, ...state.history.slice(0, 2).map((h) => h.version)]);
+    } else {
+      await finalizeRelease(host2, cfg, version);
+    }
+    log.host(host2.name, c.green("done"));
+  } catch (error) {
+    log.error(`${host2.name}: deploy failed, rolling back this host`);
+    for (const { svc, slot } of started2) {
+      try {
+        if (cfg.mode === "docker")
+          await stopSlot(host2, cfg, svc, slot, { drain: 0, remove: true });
+        else
+          await stopSlot2(host2, cfg, svc, slot, 0);
+      } catch {}
+    }
+    if (!d.opts.skipHooks && cfg.hooks.onFailure) {
+      await hook(cfg, "on_failure", cfg.hooks.onFailure, version).catch(() => {
+        return;
+      });
+    }
+    throw error;
+  }
+}
+async function confirmUp(host2, cfg, svc, slot) {
+  if (cfg.mode === "docker") {
+    const containers = await listContainers(host2, cfg);
+    const bad = containers.filter((ct) => ct.service === svc.name && ct.slot === slot && !ct.running);
+    if (bad.length) {
+      throw new EpdError(`${host2.name}: ${bad.map((b) => b.name).join(", ")} exited right after starting`, `Run: epd logs --service ${svc.name}`);
+    }
+  } else {
+    const procs = await listProcesses(host2, cfg);
+    const bad = procs.filter((p) => p.name.includes(`-${svc.name}-${slot}-`) && p.status !== "online");
+    if (bad.length) {
+      throw new EpdError(`${host2.name}: ${bad.map((b) => b.name).join(", ")} is ${bad[0].status}`, `Run: epd logs --service ${svc.name}`);
+    }
+  }
+}
+function urlsForPort(cfg, svc, slot, serverHost, port) {
+  const eps = endpointsFor(cfg, svc, slot, serverHost);
+  if (port === svc.port || !usesHostPorts(cfg)) {
+    return eps.map((e) => port === svc.port ? e.url : e.url.replace(/:\d+$/, `:${port}`));
+  }
+  throw new EpdError(`servers.${svc.name}: route port ${port} differs from the service port ${svc.port}`, "With process mode or proxy.cross_host, epd publishes a single port per replica. Give the route the same port, or run a second server entry.");
+}
+function buildEndpoints(cfg, targetHost, live) {
+  const out = {};
+  for (const svc of cfg.services) {
+    if (!svc.routes.length)
+      continue;
+    const sourceHosts = cfg.proxy.crossHost ? svc.hosts : svc.hosts.filter((h) => h === targetHost);
+    const ports = new Set([svc.port, ...svc.routes.map((r) => r.port)]);
+    const byPort = {};
+    for (const port of ports) {
+      const urls = [];
+      for (const h of sourceHosts) {
+        const slot = live.get(h)?.get(svc.name);
+        if (!slot)
+          continue;
+        urls.push(...urlsForPort(cfg, svc, slot, h, port));
+      }
+      byPort[port] = urls;
+    }
+    out[svc.name] = byPort;
+  }
+  return out;
+}
+function buildAccessoryEndpoints(cfg, targetHost) {
+  return cfg.accessories.filter((acc) => acc.routes.length > 0 && (cfg.proxy.crossHost || acc.host === targetHost)).map((acc) => {
+    const ports = new Set([acc.port ?? 80, ...acc.routes.map((r) => r.port)]);
+    const urls = {};
+    const name = accessoryContainer(cfg.name, acc.name);
+    for (const port of ports) {
+      if (acc.host === targetHost) {
+        urls[port] = [`http://${name}:${port}`];
+      } else {
+        const addr = cfg.proxy.privateIps[acc.host] ?? acc.host;
+        urls[port] = [`http://${addr}:${port}`];
+      }
+    }
+    return { acc, urls };
+  });
+}
+async function deployAccessories(cfg, env, recreate) {
+  if (!cfg.accessories.length)
+    return;
+  log.step("Accessories");
+  for (const acc of cfg.accessories) {
+    const host2 = host(acc.host, cfg.ssh);
+    if (cfg.mode === "process" && !await hasDocker(host2)) {
+      throw new EpdError(`accessories.${acc.name} needs docker on ${acc.host}`, "Accessories always run as containers. Install docker there, or run this dependency yourself.");
+    }
+    await ensureDirs(host2, cfg);
+    await ensureNetwork(host2, cfg);
+    await startAccessory(host2, cfg, acc, env, { recreate });
+  }
+}
+function selectServices(cfg, only) {
+  if (!only?.length)
+    return cfg.services;
+  const known = cfg.services.map((s) => s.name);
+  for (const name of only) {
+    if (!known.includes(name))
+      throw new EpdError(`unknown server "${name}"`, `Known: ${known.join(", ")}`);
+  }
+  return cfg.services.filter((s) => only.includes(s.name));
+}
+function selectHosts(cfg, services, only) {
+  const all = [...new Set(services.flatMap((s) => s.hosts))];
+  if (!only?.length)
+    return all;
+  for (const h of only) {
+    if (!all.includes(h))
+      throw new EpdError(`unknown host "${h}"`, `Known: ${all.join(", ")}`);
+  }
+  return all.filter((h) => only.includes(h));
+}
+async function hook(cfg, name, script, version) {
+  log.step(`Hook ${name}`);
+  await runShell(script, {
+    cwd: cfg.root,
+    stream: true,
+    env: {
+      EPD_APP: cfg.name,
+      EPD_VERSION: version,
+      EPD_DESTINATION: cfg.destination ?? "",
+      EPD_MODE: cfg.mode,
+      EPD_HOSTS: allHosts(cfg).join(",")
+    },
+    label: `hook ${name}`
+  });
+}
+function printUrls(cfg) {
+  const urls = new Set;
+  for (const svc of cfg.services) {
+    for (const route of svc.routes) {
+      for (const h of route.hosts)
+        urls.add(`${route.ssl ? "https" : "http"}://${h}${route.path ?? ""}`);
+    }
+  }
+  for (const acc of cfg.accessories) {
+    for (const route of acc.routes) {
+      for (const h of route.hosts)
+        urls.add(`${route.ssl ? "https" : "http"}://${h}${route.path ?? ""}`);
+    }
+  }
+  for (const u of urls)
+    log.info(c.cyan(u));
+}
+
+// src/commands/setup.ts
+var setup = {
+  name: "setup",
+  summary: "Prepare the servers, then deploy for the first time",
+  options: {
+    "skip-deploy": { type: "boolean" },
+    host: { type: "string", multiple: true }
+  },
+  help: () => `${c.bold("epd setup")} \u2014 get servers ready and run the first deploy
+
+Installs Docker (or rsync + pm2 in process mode), creates the shared network,
+starts Traefik and then deploys. Safe to run again at any time.
+
+Options
+  --skip-deploy   Only prepare the servers
+  --host <ip>     Only this host (repeatable)`,
+  async run(ctx) {
+    const loaded = ctx.load();
+    const cfg = loaded.config;
+    const only = ctx.values.host;
+    const names = allHosts(cfg).filter((h) => !only?.length || only.includes(h));
+    const hosts = names.map((h) => host(h, cfg.ssh));
+    log.step(`Preparing ${hosts.length} host(s) for ${c.bold(cfg.name)}`);
+    if (cfg.mode === "docker")
+      await requireLocal("docker", "Install Docker Desktop or the docker engine to build images.");
+    await pool(hosts, 4, async (host2) => {
+      await host2.ping();
+      log.host(host2.name, "reachable");
+      if (cfg.mode === "docker") {
+        await installDocker(host2);
+        await ensureNetwork(host2, cfg);
+      } else {
+        await installSystemPackages(host2);
+        await installProcessRuntime(host2, cfg);
+      }
+      await ensureDirs(host2, cfg);
+      await reservePorts(host2, cfg);
+    });
+    if (cfg.proxy.enabled && proxyHosts(cfg).length) {
+      log.step("Starting the proxy");
+      await pool(proxyHosts(cfg).filter((h) => names.includes(h)).map((h) => host(h, cfg.ssh)), 4, (host2) => ensureProxy(host2, cfg, { secrets: loaded.env, force: true }));
+    }
+    log.ok("servers are ready");
+    if (ctx.values["skip-deploy"]) {
+      log.info(`run ${c.cyan("epd deploy")} when you are ready`);
+      return;
+    }
+    await deploy(loaded, { onlyHosts: only });
+  }
+};
+
+// src/commands/deploy.ts
+var shared = {
+  version: { type: "string" },
+  service: { type: "string", multiple: true },
+  host: { type: "string", multiple: true },
+  "skip-health": { type: "boolean" },
+  "skip-hooks": { type: "boolean" },
+  "skip-lock": { type: "boolean" },
+  "recreate-accessories": { type: "boolean" }
+};
+var deploy2 = {
+  name: "deploy",
+  summary: "Build and deploy the current project",
+  options: { ...shared, build: { type: "boolean", default: true } },
+  help: () => `${c.bold("epd deploy")} \u2014 build and deploy the current project
+
+Zero downtime: the new version starts alongside the old one, has to pass its
+health check, and only then does the proxy move traffic over.
+
+Options
+  --version <v>            Deploy this version instead of the current git sha
+  --no-build               Skip the build and reuse a version already on the servers
+  --service <name>         Only this server group (repeatable)
+  --host <ip>              Only this host (repeatable)
+  --skip-health            Do not wait for the health check
+  --skip-hooks             Do not run pre/post deploy hooks
+  --skip-lock              Do not take the deploy lock
+  --recreate-accessories   Recreate accessory containers instead of leaving them alone
+  -d, --destination <d>    Use the epd.<d>.yml overlay`,
+  async run(ctx) {
+    const loaded = ctx.load();
+    await deploy(loaded, {
+      version: ctx.values.version,
+      reuse: ctx.values.build === false,
+      onlyServices: ctx.values.service,
+      onlyHosts: ctx.values.host,
+      skipHealth: Boolean(ctx.values["skip-health"]),
+      skipHooks: Boolean(ctx.values["skip-hooks"]),
+      skipLock: Boolean(ctx.values["skip-lock"]),
+      recreateAccessories: Boolean(ctx.values["recreate-accessories"])
+    });
+  }
+};
+var redeploy = {
+  name: "redeploy",
+  summary: "Deploy again without rebuilding",
+  options: shared,
+  help: () => `${c.bold("epd redeploy")} \u2014 restart the current version everywhere
+
+Same as \`epd deploy --no-build\`: no build, no upload, just a fresh set of
+containers or processes from the version already on the servers.`,
+  async run(ctx) {
+    const loaded = ctx.load();
+    await deploy(loaded, {
+      version: ctx.values.version,
+      reuse: true,
+      onlyServices: ctx.values.service,
+      onlyHosts: ctx.values.host,
+      skipHealth: Boolean(ctx.values["skip-health"]),
+      skipHooks: true,
+      skipLock: Boolean(ctx.values["skip-lock"])
+    });
+  }
+};
+
+// src/commands/rollback.ts
+var rollback = {
+  name: "rollback",
+  summary: "Deploy the previous version again",
+  options: {
+    service: { type: "string", multiple: true },
+    host: { type: "string", multiple: true },
+    "skip-health": { type: "boolean" },
+    list: { type: "boolean" }
+  },
+  help: () => `${c.bold("epd rollback [version]")} \u2014 go back to a version already on the servers
+
+With no argument it picks the version deployed before the current one. Nothing
+is rebuilt: the image (or release directory) is still there, so this is fast.
+
+Options
+  --list           Show the versions available to roll back to
+  --service <name> Only this server group
+  --host <ip>      Only this host`,
+  async run(ctx) {
+    const loaded = ctx.load();
+    const cfg = loaded.config;
+    const hosts = allHosts(cfg).map((h) => host(h, cfg.ssh));
+    const first = hosts[0];
+    if (!first)
+      throw new EpdError("no hosts configured");
+    const state = await readState(first, cfg);
+    if (!state?.history.length) {
+      throw new EpdError(`${cfg.name} has no deploy history on ${first.name}`, "Deploy it at least twice before rolling back.");
+    }
+    if (ctx.values.list) {
+      log.plain(`${c.bold("Versions on")} ${first.name}`);
+      state.history.forEach((h, i) => {
+        const marker = h.version === state.version ? c.green(" \u2190 current") : "";
+        log.plain(`  ${String(i + 1).padStart(2)}. ${c.cyan(h.version)}  ${c.gray(h.at)}${h.by ? c.gray(` by ${h.by}`) : ""}${marker}`);
+      });
+      return;
+    }
+    const explicit = ctx.positionals[0];
+    const target = explicit ?? state.history.find((h) => h.version !== state.version)?.version;
+    if (!target)
+      throw new EpdError("no previous version to roll back to", "Run `epd rollback --list` to see what is available.");
+    if (!explicit)
+      log.info(`rolling back ${c.cyan(state.version)} \u2192 ${c.cyan(target)}`);
+    await deploy(loaded, {
+      version: target,
+      reuse: true,
+      skipHooks: true,
+      onlyServices: ctx.values.service,
+      onlyHosts: ctx.values.host,
+      skipHealth: Boolean(ctx.values["skip-health"])
+    });
+  }
+};
+
+// src/commands/status.ts
+function table(rows, head) {
+  const all = [head, ...rows];
+  const widths = head.map((_, i) => Math.max(...all.map((r) => stripAnsi(r[i] ?? "").length)));
+  const line = (r) => r.map((cell, i) => cell + " ".repeat(Math.max(0, widths[i] - stripAnsi(cell).length))).join("  ").trimEnd();
+  return [c.gray(line(head)), ...rows.map(line)].join(`
+`);
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "");
+}
+var status = {
+  name: "status",
+  aliases: ["ps"],
+  summary: "Show what is running on every server",
+  options: { json: { type: "boolean" } },
+  help: () => `${c.bold("epd status")} \u2014 what is running, where, and on which version
+
+Shows every replica, the live blue/green slot, the proxy state and the URLs
+each server answers on.
+
+Options
+  --json   Machine readable output`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    const names = allHosts(cfg);
+    const proxied = new Set(proxyHosts(cfg));
+    const report = await pool(names, 8, async (name) => {
+      const host2 = host(name, cfg.ssh);
+      try {
+        const state = await readState(host2, cfg);
+        const containers = cfg.mode === "docker" ? await listContainers(host2, cfg) : [];
+        const processes = cfg.mode === "process" ? await listProcesses(host2, cfg) : [];
+        const proxy = proxied.has(name) && cfg.proxy.enabled ? await proxyState(host2, cfg) : null;
+        return { name, ok: true, state, containers, processes, proxy };
+      } catch (error) {
+        return { name, ok: false, error: error instanceof Error ? error.message : String(error) };
+      }
+    });
+    if (ctx.values.json) {
+      console.log(JSON.stringify({ app: cfg.name, mode: cfg.mode, hosts: report }, null, 2));
+      return;
+    }
+    log.plain(`${c.bold(cfg.name)} ${c.gray(`(${cfg.mode}${cfg.destination ? `, ${cfg.destination}` : ""})`)}`);
+    for (const r of report) {
+      log.plain("");
+      if (!r.ok) {
+        log.plain(`${c.magenta(r.name)}  ${c.red("unreachable")} ${c.gray(r.error)}`);
+        continue;
+      }
+      const version = r.state?.version ? c.cyan(r.state.version) : c.gray("nothing deployed");
+      const proxyBit = r.proxy ? r.proxy.running ? c.green("proxy up") : c.red(`proxy ${r.proxy.status}`) : c.gray("no proxy");
+      log.plain(`${c.magenta(r.name)}  ${version}  ${proxyBit}`);
+      if (cfg.mode === "docker") {
+        const live = new Set(Object.values(r.state?.services ?? {}).map((s) => s.slot));
+        const rows = r.containers.filter((ct) => ct.service).sort((a, b) => a.name.localeCompare(b.name)).map((ct) => [
+          ct.running ? c.green("\u25CF") : c.red("\u25CB"),
+          ct.service,
+          live.has(ct.slot) ? c.bold(ct.slot) : c.gray(ct.slot),
+          ct.version,
+          ct.status
+        ]);
+        const accessories = r.containers.filter((ct) => !ct.service && ct.name.includes("-acc-"));
+        for (const a of accessories)
+          rows.push([a.running ? c.green("\u25CF") : c.red("\u25CB"), c.gray("accessory"), a.name.split("-acc-")[1] ?? "", "", a.status]);
+        log.plain(rows.length ? table(rows, ["", "server", "slot", "version", "status"]) : c.gray("  no containers"));
+      } else {
+        const rows = r.processes.map((p) => [
+          p.status === "online" ? c.green("\u25CF") : c.red("\u25CB"),
+          p.name.replace(`epd-${cfg.name}-`, ""),
+          p.status,
+          `${p.restarts} restarts`,
+          `${Math.round(p.memory / 1024 / 1024)}MB`
+        ]);
+        log.plain(rows.length ? table(rows, ["", "process", "status", "", "memory"]) : c.gray("  no processes"));
+      }
+    }
+    const urls = new Set;
+    for (const svc of cfg.services)
+      for (const route of svc.routes)
+        for (const h of route.hosts)
+          urls.add(`${route.ssl ? "https" : "http"}://${h}${route.path ?? ""} ${c.gray(`\u2192 ${svc.name}:${route.port}`)}`);
+    for (const acc of cfg.accessories)
+      for (const route of acc.routes)
+        for (const h of route.hosts)
+          urls.add(`${route.ssl ? "https" : "http"}://${h}${route.path ?? ""} ${c.gray(`\u2192 ${acc.name}:${route.port}`)}`);
+    if (urls.size) {
+      log.plain(`
+${c.bold("Routes")}`);
+      for (const u of urls)
+        log.plain(`  ${u}`);
+    }
+  }
+};
+
+// src/commands/logs.ts
+var logs = {
+  name: "logs",
+  summary: "Show or follow logs from every replica",
+  options: {
+    follow: { type: "boolean", short: "f" },
+    lines: { type: "string", short: "n" },
+    service: { type: "string" },
+    accessory: { type: "string" },
+    host: { type: "string" },
+    grep: { type: "string" },
+    since: { type: "string" }
+  },
+  help: () => `${c.bold("epd logs")} \u2014 logs from every replica, prefixed with where they came from
+
+Options
+  -f, --follow        Stream new lines (one host at a time)
+  -n, --lines <n>     Lines per replica (default 100)
+      --service <s>   Only this server group
+      --accessory <a> Only this accessory
+      --host <ip>     Only this host
+      --grep <text>   Only lines containing this
+      --since <time>  docker --since value, e.g. 10m`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    const lines = String(ctx.values.lines ?? "100");
+    const service = ctx.values.service;
+    const accessory = ctx.values.accessory;
+    const grep = ctx.values.grep;
+    const since = ctx.values.since;
+    const follow = Boolean(ctx.values.follow);
+    let names = allHosts(cfg);
+    if (accessory) {
+      const acc = cfg.accessories.find((a) => a.name === accessory);
+      if (!acc) {
+        const known = cfg.accessories.map((a) => a.name);
+        throw new EpdError(`no such accessory "${accessory}"`, known.length ? `Known: ${known.join(", ")}` : "No accessories configured.");
+      }
+      if (!ctx.values.host)
+        names = [acc.host];
+    }
+    if (ctx.values.host)
+      names = names.filter((h) => h === ctx.values.host);
+    if (!names.length)
+      throw new EpdError(`no host matches "${ctx.values.host}"`);
+    if (follow && names.length > 1 && !ctx.values.host) {
+      log.warn(`following ${names[0]} only \u2014 pass --host to pick another`);
+      names = [names[0]];
+    }
+    const filter = [
+      `--filter "label=epd.app=${cfg.name}"`,
+      service ? `--filter "label=epd.service=${service}"` : "",
+      accessory ? `--filter "label=epd.accessory=${accessory}"` : ""
+    ].filter(Boolean).join(" ");
+    for (const name of names) {
+      const host2 = host(name, cfg.ssh);
+      if (cfg.mode === "docker") {
+        const script = `for ct in $(docker ps -q ${filter}); do
+  n=$(docker inspect -f '{{.Name}}' "$ct" | sed 's|^/||')
+  docker logs ${follow ? "-f " : ""}--tail ${lines} ${since ? `--since ${shq(since)} ` : ""}"$ct" 2>&1 | sed "s|^|$n | " &
+done
+wait`;
+        const piped = grep ? `{ ${script} ; } | grep --line-buffered ${shq(grep)}` : script;
+        if (follow) {
+          log.info(`following ${name} \u2014 Ctrl-C to stop`);
+          await host2.interactive(piped);
+        } else {
+          const out = await host2.exec(piped, { allowFailure: true });
+          log.plain(`${c.magenta(name)}`);
+          log.plain(out.stdout || c.gray("  no output"));
+        }
+      } else {
+        const pattern = `epd-${cfg.name}-${service ? `${service}-` : ""}`;
+        const cmd = `${pathPrelude(cfg)} pm2 logs --nostream --lines ${lines} 2>/dev/null | grep -a ${shq(pattern)}${grep ? ` | grep -a ${shq(grep)}` : ""} || true`;
+        if (follow) {
+          log.info(`following ${name} \u2014 Ctrl-C to stop`);
+          await host2.interactive(`${pathPrelude(cfg)} pm2 logs --lines ${lines}`, { sudo: false });
+        } else {
+          const out = await host2.exec(cmd, { allowFailure: true, sudo: false });
+          log.plain(`${c.magenta(name)}`);
+          log.plain(out.stdout || c.gray("  no output"));
+        }
+      }
+    }
+  }
+};
+
+// src/commands/exec.ts
+async function pickHost(ctx, cfg) {
+  const names = allHosts(cfg);
+  const chosen = ctx.values.host ?? names[0];
+  if (!chosen || !names.includes(chosen))
+    throw new EpdError(`no such host "${chosen}"`, `Known: ${names.join(", ")}`);
+  return host(chosen, cfg.ssh);
+}
+var exec = {
+  name: "exec",
+  summary: "Run a one-off command with the app's image and environment",
+  options: {
+    host: { type: "string" },
+    service: { type: "string" },
+    accessory: { type: "string" },
+    reuse: { type: "boolean" },
+    interactive: { type: "boolean", short: "i" }
+  },
+  help: () => `${c.bold("epd exec [--] <command\u2026>")} \u2014 run a command against the deployed app
+
+By default this starts a throwaway container from the deployed image with the
+same environment. With --reuse it runs inside a container that is already
+serving traffic.
+
+Options
+      --host <ip>        Which host (default: the first one)
+      --service <s>      Which server group (default: the first one)
+      --accessory <a>    Run inside an accessory container
+      --reuse            Run inside the running container instead of a new one
+  -i, --interactive      Attach a terminal
+
+Examples
+  epd exec -- bun run db:migrate
+  epd exec --reuse -i -- sh
+  epd exec --accessory db -i -- psql -U blog`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    const command = ctx.positionals.join(" ").trim();
+    if (!command)
+      throw new EpdError("nothing to run", "epd exec -- <command>");
+    const cmdArgs = ctx.positionals.map(shq).join(" ");
+    const accName = ctx.values.accessory;
+    if (accName) {
+      const acc = cfg.accessories.find((a) => a.name === accName);
+      if (!acc) {
+        const known = cfg.accessories.map((a) => a.name);
+        throw new EpdError(`no such accessory "${accName}"`, known.length ? `Known: ${known.join(", ")}` : "No accessories configured.");
+      }
+      const host3 = host(acc.host, cfg.ssh);
+      const container = accessoryContainer(cfg.name, acc.name);
+      log.info(`${host3.name}: ${container} $ ${command}`);
+      const code2 = await host3.interactive(`docker exec ${ctx.values.interactive ? "-it" : ""} ${shq(container)} ${cmdArgs}`);
+      if (code2 !== 0)
+        process.exitCode = code2;
+      return;
+    }
+    const host2 = await pickHost(ctx, cfg);
+    const svc = cfg.services.find((s) => s.name === (ctx.values.service ?? cfg.services[0]?.name));
+    if (!svc)
+      throw new EpdError(`no such server group "${ctx.values.service}"`);
+    const state = await readState(host2, cfg);
+    const version = state?.version;
+    if (!version)
+      throw new EpdError(`${cfg.name} is not deployed on ${host2.name}`);
+    if (cfg.mode === "process") {
+      const dir = `${paths(cfg).current}`;
+      const script = `cd ${shq(dir)} && ${pathPrelude(cfg)} && set -a && . ${shq(paths(cfg).envFile)} && set +a && ${command}`;
+      log.info(`${host2.name}: ${command}`);
+      const code2 = await host2.interactive(script, { sudo: false });
+      if (code2 !== 0)
+        process.exitCode = code2;
+      return;
+    }
+    if (ctx.values.reuse) {
+      const slot = state.services[svc.name]?.slot;
+      const container = `epd-${cfg.name}-${svc.name}-${slot}-0`;
+      log.info(`${host2.name}: ${container} $ ${command}`);
+      const code2 = await host2.interactive(`docker exec ${ctx.values.interactive ? "-it" : ""} ${shq(container)} ${cmdArgs}`);
+      if (code2 !== 0)
+        process.exitCode = code2;
+      return;
+    }
+    const envFile = `${paths(cfg).app}/env.${svc.name}`;
+    const args = [
+      "docker",
+      "run",
+      "--rm",
+      ctx.values.interactive ? "-it" : "",
+      "--network",
+      cfg.proxy.network,
+      "--env-file",
+      envFile,
+      "--env",
+      `PORT=${svc.port}`,
+      "--label",
+      `epd.app=${cfg.name}`,
+      imageRef(cfg, version)
+    ].filter(Boolean);
+    log.info(`${host2.name}: ${command} ${c.gray(`(new container from ${version})`)}`);
+    const code = await host2.interactive(`${args.map((a) => shq(a)).join(" ")} ${cmdArgs}`);
+    if (code !== 0)
+      process.exitCode = code;
+  }
+};
+var shell = {
+  name: "shell",
+  summary: "Open a shell inside a running replica",
+  options: { host: { type: "string" }, service: { type: "string" }, accessory: { type: "string" } },
+  help: () => `${c.bold("epd shell")} \u2014 a shell inside a container that is serving traffic
+
+Options
+  --host <ip>        Which host (default: the first one)
+  --service <s>      Which server group (default: the first one)
+  --accessory <a>    Open a shell inside this accessory`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    if (ctx.values.accessory) {
+      await exec.run({ ...ctx, values: { ...ctx.values, interactive: true }, positionals: ["sh", "-c", "bash || sh"] });
+    } else if (cfg.mode === "process") {
+      await exec.run({ ...ctx, values: { ...ctx.values, interactive: true }, positionals: ["bash || sh"] });
+    } else {
+      await exec.run({ ...ctx, values: { ...ctx.values, reuse: true, interactive: true }, positionals: ["sh", "-c", "bash || sh"] });
+    }
+  }
+};
+
+// src/commands/proxy.ts
+var proxy = {
+  name: "proxy",
+  summary: "Inspect or restart the shared Traefik proxy",
+  options: { host: { type: "string" }, lines: { type: "string", short: "n" }, follow: { type: "boolean", short: "f" } },
+  help: () => `${c.bold("epd proxy <status|reboot|logs|routes|remove>")}
+
+One Traefik container per server, shared by every epd app on it. Rebooting it
+briefly interrupts *all* sites on that server; the apps themselves keep running.
+
+  status   Is it up, on which image, with which entrypoints
+  reboot   Recreate it from the current configuration
+  logs     Traefik's own logs (certificates, routing errors)
+  routes   The route file epd wrote for this app
+  remove   Remove this app's routes and stop the proxy if nothing else needs it
+
+Options
+  --host <ip>       Only this host
+  -n, --lines <n>   Log lines (default 100)
+  -f, --follow      Stream logs`,
+  async run(ctx) {
+    const loaded = ctx.load();
+    const cfg = loaded.config;
+    const sub = ctx.positionals[0] ?? "status";
+    let names = proxyHosts(cfg);
+    if (ctx.values.host)
+      names = names.filter((h) => h === ctx.values.host);
+    if (!names.length)
+      throw new EpdError("no host in this config serves routes through the proxy");
+    const hosts = names.map((h) => host(h, cfg.ssh));
+    switch (sub) {
+      case "status": {
+        for (const host2 of hosts) {
+          const s = await proxyState(host2, cfg);
+          const listening = cfg.mode === "docker" ? await host2.capture(`docker port ${PROXY_CONTAINER} 2>/dev/null | sort -u || true`, { allowFailure: true }) : Object.entries(cfg.proxy.entrypoints).map(([n, p]) => `${n} -> :${p}`).join(`
+`);
+          const apps = await host2.capture(`ls -1 ${shq(paths(cfg).proxyDynamicDir)} 2>/dev/null | sed 's/\\.yml$//' || true`, { allowFailure: true });
+          log.plain(`${c.magenta(host2.name)}  ${s.running ? c.green("running") : c.red(s.status)}  ${c.gray(s.image)}`);
+          if (listening)
+            log.plain(listening.split(`
+`).map((l) => `  ${l}`).join(`
+`));
+          if (apps)
+            log.plain(`  apps: ${apps.split(`
+`).filter(Boolean).join(", ")}`);
+        }
+        return;
+      }
+      case "reboot": {
+        await pool(hosts, 4, async (host2) => {
+          await ensureProxy(host2, cfg, { force: true, secrets: loaded.env });
+        });
+        log.ok("proxy restarted");
+        return;
+      }
+      case "logs": {
+        const lines = String(ctx.values.lines ?? "100");
+        const follow = Boolean(ctx.values.follow);
+        for (const host2 of hosts) {
+          const cmd = cfg.mode === "docker" ? `docker logs ${follow ? "-f " : ""}--tail ${lines} ${PROXY_CONTAINER} 2>&1` : `${pathPrelude(cfg)} pm2 logs ${PROXY_PROCESS} --lines ${lines}${follow ? "" : " --nostream"} 2>&1`;
+          if (follow) {
+            log.info(`following proxy on ${host2.name} \u2014 Ctrl-C to stop`);
+            await host2.interactive(cmd, { sudo: cfg.mode === "docker" ? undefined : false });
+          } else {
+            const out = await host2.exec(`${cmd} || true`, { allowFailure: true, sudo: cfg.mode === "docker" ? undefined : false });
+            log.plain(c.magenta(host2.name));
+            log.plain(out.stdout || c.gray("  no output"));
+          }
+        }
+        return;
+      }
+      case "routes": {
+        for (const host2 of hosts) {
+          const doc = await host2.readFile(paths(cfg).proxyDynamic);
+          log.plain(c.magenta(host2.name));
+          log.plain(doc ?? c.gray("  no routes written yet"));
+        }
+        return;
+      }
+      case "remove": {
+        for (const host2 of hosts) {
+          await removeRoutes(host2, cfg);
+          const left = await host2.capture(`ls -1 ${shq(paths(cfg).proxyDynamicDir)}/*.yml 2>/dev/null | wc -l`, { allowFailure: true });
+          if (Number(left.trim()) === 0) {
+            if (cfg.mode === "docker") {
+              await host2.exec(`docker rm -f ${PROXY_CONTAINER} >/dev/null 2>&1 || true`, { allowFailure: true });
+            } else {
+              await host2.exec(`${pathPrelude(cfg)} pm2 delete ${PROXY_PROCESS} >/dev/null 2>&1 || true`, { allowFailure: true, sudo: false });
+            }
+            log.host(host2.name, "routes removed, proxy stopped (no apps left)");
+          } else {
+            log.host(host2.name, `routes removed, proxy still serving ${left.trim()} other app(s)`);
+          }
+        }
+        return;
+      }
+      default:
+        throw new EpdError(`unknown subcommand "${sub}"`, "Try: status, reboot, logs, routes, remove");
+    }
+  }
+};
+
+// src/commands/config.ts
+var config = {
+  name: "config",
+  summary: "Print the resolved configuration",
+  options: { json: { type: "boolean" }, raw: { type: "boolean" }, traefik: { type: "boolean" } },
+  help: () => `${c.bold("epd config")} \u2014 show what epd actually understood
+
+Every default filled in, every \${VAR} interpolated. The quickest way to check
+an overlay or a route before deploying.
+
+Options
+  --json      Print the resolved config as JSON
+  --raw       Print the merged YAML input instead
+  --traefik   Print the traefik configuration epd would write`,
+  async run(ctx) {
+    const loaded = ctx.load();
+    const cfg = loaded.config;
+    if (ctx.values.raw) {
+      console.log(JSON.stringify(loaded.raw, null, 2));
+      return;
+    }
+    if (ctx.values.json) {
+      console.log(JSON.stringify(cfg, null, 2));
+      return;
+    }
+    if (ctx.values.traefik) {
+      const targetHost = allHosts(cfg)[0] ?? "host";
+      const live = new Map([[targetHost, new Map(cfg.services.map((s) => [s.name, "blue"]))]]);
+      log.plain(c.bold("# traefik.yml (static, shared by every app on the host)"));
+      console.log(JSON.stringify(staticConfig({
+        app: cfg.name,
+        image: cfg.proxy.image,
+        network: cfg.proxy.network,
+        entrypoints: cfg.proxy.entrypoints,
+        ssl: cfg.proxy.ssl,
+        email: cfg.proxy.email,
+        challenge: cfg.proxy.challenge,
+        dnsProvider: cfg.proxy.dnsProvider,
+        dnsEnv: cfg.proxy.dnsEnv,
+        acmeServer: cfg.proxy.acmeServer,
+        logLevel: cfg.proxy.logLevel,
+        accessLog: cfg.proxy.accessLog,
+        dashboard: cfg.proxy.dashboard,
+        dashboardHost: cfg.proxy.dashboardHost,
+        trustedIps: cfg.proxy.trustedIps,
+        extra: cfg.proxy.extra
+      }), null, 2));
+      log.plain(c.bold(`
+# dynamic/${cfg.name}.yml (this app's routes)`));
+      console.log(JSON.stringify(dynamicConfig(cfg, buildEndpoints(cfg, targetHost, live), buildAccessoryEndpoints(cfg, targetHost)), null, 2));
+      return;
+    }
+    log.plain(`${c.bold(cfg.name)} ${c.gray(cfg.configPath)}`);
+    log.plain(`  mode         ${cfg.mode}${cfg.destination ? c.gray(`  (${cfg.destination})`) : ""}`);
+    if (cfg.mode === "docker")
+      log.plain(`  image        ${cfg.image}${cfg.registry ? c.gray(`  via ${cfg.registry.server ?? "docker.io"}`) : c.gray("  shipped over ssh")}`);
+    else
+      log.plain(`  start        ${cfg.process.start}`);
+    log.plain(`  hosts        ${allHosts(cfg).join(", ")}`);
+    log.plain(`  ssh          ${cfg.ssh.user}@\u2026:${cfg.ssh.port}`);
+    log.plain(`  strategy     ${cfg.strategy}`);
+    if (usesHostPorts(cfg)) {
+      const b = portBlock(cfg);
+      log.plain(`  ports        ${b.from}-${b.to} ${c.gray("(reserved on every host)")}`);
+    }
+    log.plain(`
+${c.bold("Servers")}`);
+    for (const svc of cfg.services) {
+      log.plain(`  ${c.bold(svc.name)}  ${svc.replicas} \xD7 ${svc.hosts.length} host(s) on port ${svc.port}`);
+      if (svc.command)
+        log.plain(`    command    ${svc.command}`);
+      log.plain(`    hosts      ${svc.hosts.join(", ")}`);
+      if (usesHostPorts(cfg)) {
+        log.plain(`    host ports ${hostPort(cfg, svc, "blue", 0)}\u2026 ${c.gray("(blue)")} / ${hostPort(cfg, svc, "green", 0)}\u2026 ${c.gray("(green)")}`);
+      }
+      log.plain(`    health     ${svc.health.path ?? "tcp connect"} ${c.gray(`${svc.health.status}, ${svc.health.timeout}s`)}`);
+      for (const route of svc.routes) {
+        const scheme = route.ssl ? "https" : "http";
+        const hosts = route.hosts.length ? route.hosts.join(", ") : "(any host)";
+        log.plain(`    route      ${c.cyan(`${scheme}://${hosts}${route.path ?? ""}`)} \u2192 :${route.port}${route.redirect ? c.gray(` (redirects to ${route.redirect.to})`) : ""}`);
+      }
+      if (!svc.routes.length)
+        log.plain(`    route      ${c.gray("none \u2014 worker, not exposed")}`);
+    }
+    if (cfg.accessories.length) {
+      log.plain(`
+${c.bold("Accessories")}`);
+      for (const acc of cfg.accessories)
+        log.plain(`  ${acc.name.padEnd(12)} ${acc.image} ${c.gray(`on ${acc.host}`)}`);
+    }
+    log.plain(`
+${c.bold("Proxy")}`);
+    if (!cfg.proxy.enabled)
+      log.plain(`  ${c.gray("disabled")}`);
+    else {
+      log.plain(`  traefik      ${cfg.proxy.image} on ${proxyHosts(cfg).join(", ") || c.gray("no host serves routes")}`);
+      log.plain(`  entrypoints  ${Object.entries(cfg.proxy.entrypoints).map(([n, p]) => `${n}:${p}`).join(", ")}`);
+      log.plain(`  tls          ${cfg.proxy.ssl ? `Let's Encrypt (${cfg.proxy.challenge} challenge)` : "off"}`);
+      log.plain(`  cross host   ${cfg.proxy.crossHost ? "on \u2014 every proxy balances across every host" : "off \u2014 each proxy uses its own replicas"}`);
+    }
+    const secrets = [...new Set([...cfg.secrets, ...cfg.services.flatMap((s) => s.secrets)])];
+    if (secrets.length) {
+      log.plain(`
+${c.bold("Secrets")} ${c.gray("(read from the environment at deploy time)")}`);
+      for (const s of secrets)
+        log.plain(`  ${s.padEnd(24)} ${loaded.env[s] !== undefined ? c.green("set") : c.red("missing")}`);
+    }
+  }
+};
+
+// src/commands/lock.ts
+var lock = {
+  name: "lock",
+  summary: "Inspect or clear the deploy lock",
+  options: {},
+  help: () => `${c.bold("epd lock <status|release>")}
+
+epd takes a lock on every server while deploying so two deploys cannot overlap.
+If a deploy was killed halfway, release it by hand.`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    const hosts = allHosts(cfg).map((h) => host(h, cfg.ssh));
+    const sub = ctx.positionals[0] ?? "status";
+    if (sub === "release") {
+      await DeployLock.forceRelease(cfg, hosts);
+      log.ok(`lock released on ${hosts.length} host(s)`);
+      return;
+    }
+    if (sub !== "status")
+      throw new EpdError(`unknown subcommand "${sub}"`, "Try: status, release");
+    for (const { host: host2, info } of await DeployLock.status(cfg, hosts)) {
+      log.plain(info ? `${c.magenta(host2)}  ${c.yellow("locked")} by ${info.by} ${c.gray(`${info.at} \u2014 ${info.what}`)}` : `${c.magenta(host2)}  ${c.green("free")}`);
+    }
+  }
+};
+
+// src/commands/remove.ts
+var remove = {
+  name: "remove",
+  summary: "Stop this app and delete its files from the servers",
+  options: { yes: { type: "boolean", short: "y" }, "keep-data": { type: "boolean" }, host: { type: "string", multiple: true } },
+  help: () => `${c.bold("epd remove")} \u2014 take this app off the servers
+
+Stops every replica, removes this app's routes, and deletes its directory.
+Other epd apps on the same servers, and the shared proxy, are left alone.
+
+Options
+  -y, --yes        Do not ask for confirmation
+      --keep-data  Leave ${"{remote_root}"}/apps/<app> in place (releases, env files)
+      --host <ip>  Only this host`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    const only = ctx.values.host;
+    const names = allHosts(cfg).filter((h) => !only?.length || only.includes(h));
+    if (!ctx.values.yes) {
+      if (!interactive())
+        throw new EpdError("refusing to remove without confirmation", "Pass --yes to remove non-interactively.");
+      const ok = await confirm(`Remove ${c.bold(cfg.name)} from ${names.join(", ")}?`, false);
+      if (!ok) {
+        log.info("nothing removed");
+        return;
+      }
+    }
+    await pool(names.map((h) => host(h, cfg.ssh)), 4, async (host2) => {
+      await removeRoutes(host2, cfg);
+      if (cfg.mode === "docker")
+        await removeApp(host2, cfg);
+      else
+        await removeApp2(host2, cfg);
+      if (!ctx.values["keep-data"]) {
+        await host2.exec(`rm -rf ${shq(paths(cfg).app)} ${shq(`${paths(cfg).portsDir}/${cfg.portBase}`)}`, { allowFailure: true });
+      }
+      log.host(host2.name, "removed");
+    });
+    log.ok(`${cfg.name} removed from ${names.length} host(s)`);
+    log.info(`the shared proxy is still running \u2014 ${c.cyan("epd proxy remove")} stops it if nothing else uses it`);
+  }
+};
+
+// src/commands/dockerCommand.ts
+function pretty(args) {
+  const out = [];
+  let line = "";
+  for (const arg of args) {
+    const quoted = /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg) ? arg : shq(arg);
+    if (arg.startsWith("-") && line) {
+      out.push(line);
+      line = `  ${quoted}`;
+    } else {
+      line = line ? `${line} ${quoted}` : quoted;
+    }
+  }
+  if (line)
+    out.push(line);
+  return out.join(" \\\n");
+}
+var dockerCommand = {
+  name: "docker-command",
+  aliases: ["command", "print-command"],
+  summary: "Print the docker (or pm2) commands epd would run",
+  options: { host: { type: "string" }, service: { type: "string" }, slot: { type: "string" }, version: { type: "string" }, replica: { type: "string" } },
+  help: () => `${c.bold("epd docker-command")} \u2014 show the exact command epd runs for you
+
+Useful to check what epd is doing, to run a container by hand, or to lift the
+command into another tool.
+
+Options
+  --host <ip>       Which host to generate for (default: the first one)
+  --service <name>  Which server group (default: all)
+  --slot <blue|green>
+  --replica <n>     Only this replica
+  --version <v>     Tag to use (default: the current git sha)`,
+  async run(ctx) {
+    const { config: cfg } = ctx.load();
+    const version = (await resolveVersion(cfg, ctx.values.version)).id;
+    const slot = ctx.values.slot ?? "blue";
+    const services = cfg.services.filter((s) => !ctx.values.service || s.name === ctx.values.service);
+    for (const svc of services) {
+      const serverHost = ctx.values.host ?? svc.hosts[0] ?? "HOST";
+      const replicas = ctx.values.replica !== undefined ? [Number(ctx.values.replica)] : Array.from({ length: svc.replicas }, (_, i) => i);
+      log.plain(`${c.bold(`# ${svc.name}`)} ${c.gray(`on ${serverHost}, slot ${slot}, version ${version}`)}`);
+      if (cfg.mode === "docker") {
+        for (const i of replicas) {
+          const args = dockerRunArgs({
+            cfg,
+            svc,
+            slot,
+            version,
+            replica: i,
+            serverHost,
+            envFile: `${paths(cfg).app}/env.${svc.name}`
+          });
+          log.plain(pretty(args));
+          log.plain("");
+        }
+      } else {
+        const command = svc.command ?? cfg.process.start;
+        const argv = parseCommand(command);
+        for (const i of replicas) {
+          const name = processName(cfg.name, svc.name, slot, i);
+          const port = hostPort(cfg, svc, slot, i);
+          log.plain(`PORT=${port} pm2 start ${shq(argv[0] ?? "")} --name ${shq(name)} \\
+  --cwd ${shq(`${paths(cfg).current}`)} --interpreter none${argv.length > 1 ? ` \\
+  -- ${argv.slice(1).map((a) => shq(a)).join(" ")}` : ""}`);
+          log.plain("");
+        }
+      }
+    }
+    if (cfg.accessories.length) {
+      for (const acc of cfg.accessories) {
+        log.plain(`${c.bold(`# accessory: ${acc.name}`)} ${c.gray(`on ${acc.host}`)}`);
+        const accArgs = [
+          "docker",
+          "run",
+          "-d",
+          "--name",
+          accessoryContainer(cfg.name, acc.name),
+          "--restart",
+          "unless-stopped",
+          "--network",
+          cfg.proxy.network,
+          "--label",
+          `epd.app=${cfg.name}`,
+          "--label",
+          `epd.accessory=${acc.name}`,
+          "--label",
+          "epd.managed=true",
+          "--env-file",
+          `${paths(cfg).app}/env.acc.${acc.name}`,
+          "--log-opt",
+          "max-size=10m",
+          "--log-opt",
+          "max-file=3",
+          ...acc.volumes.flatMap((v) => ["--volume", v]),
+          ...acc.ports.flatMap((p) => ["--publish", p]),
+          ...acc.dockerOptions,
+          acc.image,
+          ...acc.command ? parseCommand(acc.command) : []
+        ];
+        log.plain(pretty(accArgs));
+        log.plain("");
+      }
+    }
+    log.plain(`${c.bold("# proxy")} ${c.gray("(one per server, shared by every epd app on it)")}`);
+    log.plain(pretty([
+      "docker",
+      "run",
+      "-d",
+      "--name",
+      "epd-proxy",
+      "--restart",
+      "unless-stopped",
+      "--network",
+      cfg.proxy.network,
+      ...Object.values(cfg.proxy.entrypoints).flatMap((p) => ["-p", `${p}:${p}`]),
+      "-v",
+      `${paths(cfg).proxyStatic}:/etc/traefik/traefik.yml:ro`,
+      "-v",
+      `${paths(cfg).proxyDynamicDir}:/etc/traefik/dynamic:ro`,
+      "-v",
+      `${paths(cfg).acmeDir}:/acme`,
+      cfg.proxy.image
+    ]));
+  }
+};
+
+// src/commands/index.ts
+var commands = [
+  init,
+  setup,
+  deploy2,
+  redeploy,
+  rollback,
+  status,
+  logs,
+  exec,
+  shell,
+  proxy,
+  config,
+  lock,
+  remove,
+  dockerCommand
+];
+
+// src/cli.ts
+var VERSION = "0.1.0";
+var USAGE = `${c.bold("epd")} \u2014 Easy Project Deployer ${c.gray(`v${VERSION}`)}
+
+${c.bold("Usage")}
+  epd <command> [options]
+
+${c.bold("Commands")}
+${commands.filter((cmd) => !cmd.hidden).map((cmd) => `  ${cmd.name.padEnd(16)}${cmd.summary}`).join(`
+`)}
+
+${c.bold("Global options")}
+  -c, --config <file>     Path to epd.yml
+  -d, --destination <d>   Overlay epd.<d>.yml (staging, production, \u2026)
+  -v, --verbose           Show every command epd runs
+  -h, --help              Show help for a command
+      --version           Print the epd version
+
+${c.bold("Examples")}
+  epd init                       Create an epd.yml for this project
+  epd setup                      Prepare the servers, then deploy
+  epd deploy                     Build and deploy the current commit
+  epd deploy -d staging          Deploy with the staging overlay
+  epd rollback                   Go back to the previous version
+  epd logs -f                    Follow logs from every server
+  epd docker-command             Print the docker run command epd would use
+`;
+async function main(argv) {
+  if (argv.includes("--version") && !argv[0]?.startsWith("-")) {}
+  const first = argv[0];
+  if (!first || first === "-h" || first === "--help" || first === "help") {
+    console.log(USAGE);
+    return 0;
+  }
+  if (first === "--version" || first === "-V") {
+    console.log(VERSION);
+    return 0;
+  }
+  const command = commands.find((cmd) => cmd.name === first || cmd.aliases?.includes(first));
+  if (!command) {
+    log.error(`unknown command "${first}"`);
+    console.log(`
+Run ${c.cyan("epd --help")} to see the available commands.`);
+    return 1;
+  }
+  const rest = argv.slice(1);
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: rest,
+      options: {
+        config: { type: "string", short: "c" },
+        destination: { type: "string", short: "d" },
+        verbose: { type: "boolean", short: "v" },
+        help: { type: "boolean", short: "h" },
+        ...command.options ?? {}
+      },
+      allowPositionals: true,
+      allowNegative: true
+    });
+  } catch (e) {
+    log.error(e instanceof Error ? e.message : String(e));
+    console.log(`
+${command.help()}`);
+    return 1;
+  }
+  if (parsed.values.help) {
+    console.log(command.help());
+    return 0;
+  }
+  setVerbose(Boolean(parsed.values.verbose));
+  const loadOptions = {
+    file: parsed.values.config,
+    destination: parsed.values.destination
+  };
+  const ctx = {
+    values: parsed.values,
+    positionals: parsed.positionals,
+    loadOptions,
+    load: () => loadConfig(loadOptions)
+  };
+  await command.run(ctx);
+  return 0;
+}
+try {
+  process.exitCode = await main(process.argv.slice(2));
+} catch (error) {
+  if (error instanceof EpdError) {
+    log.error(error.message);
+    if (error.hint)
+      console.error(`
+${c.gray(error.hint)}`);
+  } else {
+    log.error(error instanceof Error ? error.message : String(error));
+    if (process.env.EPD_DEBUG && error instanceof Error)
+      console.error(error.stack);
+  }
+  process.exitCode = 1;
+}